./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor384275681 <...> 77, st_size=13, ...}) = 0 [pid 5305] <... openat resumed>) = 6 [pid 5087] unlink("./8/binderfs" [pid 5305] write(6, "0x000000000000040e", 18 [pid 5087] <... unlink resumed>) = 0 [pid 5087] umount2("./8/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./8/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5087] unlink("./8/cgroup") = 0 [pid 5087] umount2("./8/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./8/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5087] unlink("./8/cgroup.net") = 0 [pid 5087] umount2("./8/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5085] lstat("./6/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5085] unlink("./6/cgroup") = 0 [pid 5085] umount2("./6/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./6/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5085] unlink("./6/cgroup.net") = 0 [pid 5085] umount2("./6/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5087] <... umount2 resumed>) = 0 [pid 5087] umount2("./8/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5085] <... umount2 resumed>) = 0 [pid 5087] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5085] umount2("./6/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5087] lstat("./8/file0", [pid 5085] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5087] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5085] lstat("./6/file0", [pid 5087] umount2("./8/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5085] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5087] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5087] openat(AT_FDCWD, "./8/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5085] umount2("./6/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5087] <... openat resumed>) = 4 [pid 5085] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5087] fstat(4, [pid 5085] openat(AT_FDCWD, "./6/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5087] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5085] <... openat resumed>) = 4 [pid 5087] getdents64(4, [pid 5085] fstat(4, [pid 5087] <... getdents64 resumed>0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5085] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5087] getdents64(4, [pid 5085] getdents64(4, [pid 5087] <... getdents64 resumed>0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5085] <... getdents64 resumed>0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5087] close(4 [pid 5085] getdents64(4, [pid 5087] <... close resumed>) = 0 [pid 5085] <... getdents64 resumed>0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5087] rmdir("./8/file0" [pid 5085] close(4 [pid 5087] <... rmdir resumed>) = 0 [pid 5085] <... close resumed>) = 0 [pid 5087] umount2("./8/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5085] rmdir("./6/file0" [pid 5087] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5085] <... rmdir resumed>) = 0 [pid 5087] lstat("./8/cgroup.cpu", [pid 5085] umount2("./6/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5087] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5085] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5087] unlink("./8/cgroup.cpu" [pid 5085] lstat("./6/cgroup.cpu", [pid 5087] <... unlink resumed>) = 0 [pid 5085] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5087] getdents64(3, [ 123.350937][ T5295] pglazyfreed 0 [ 123.350937][ T5295] zswpin 0 [ 123.350937][ T5295] zswpout 0 [ 123.350937][ T5295] thp_fault_alloc 0 [ 123.350937][ T5295] thp_collapse_alloc 0 [pid 5085] unlink("./6/cgroup.cpu" [pid 5087] <... getdents64 resumed>0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5085] <... unlink resumed>) = 0 [pid 5087] close(3 [pid 5085] getdents64(3, [pid 5087] <... close resumed>) = 0 [pid 5085] <... getdents64 resumed>0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5087] rmdir("./8" [pid 5085] close(3 [pid 5087] <... rmdir resumed>) = 0 [pid 5085] <... close resumed>) = 0 [pid 5087] mkdir("./9", 0777 [pid 5085] rmdir("./6" [pid 5087] <... mkdir resumed>) = 0 [pid 5085] <... rmdir resumed>) = 0 [pid 5087] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5085] mkdir("./7", 0777./strace-static-x86_64: Process 5315 attached ) = 0 [pid 5315] chdir("./9" [pid 5087] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 11 [pid 5085] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5315] <... chdir resumed>) = 0 [pid 5085] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 9 ./strace-static-x86_64: Process 5316 attached [pid 5315] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5316] chdir("./7" [pid 5315] setpgid(0, 0 [pid 5316] <... chdir resumed>) = 0 [pid 5315] <... setpgid resumed>) = 0 [pid 5316] prctl(PR_SET_PDEATHSIG, SIGKILL [ 123.581348][ T5295] Tasks state (memory values in pages): [ 123.598944][ T5295] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 123.610739][ T5295] Out of memory and no killable processes... [pid 5315] symlink("/syzcgroup/unified/syz2", "./cgroup" [pid 5316] <... prctl resumed>) = 0 [pid 5315] <... symlink resumed>) = 0 [pid 5316] setpgid(0, 0 [pid 5315] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu" [pid 5295] <... write resumed>) = 18 [pid 5316] <... setpgid resumed>) = 0 [pid 5315] <... symlink resumed>) = 0 [ 123.628281][ T5311] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 123.644388][ T5311] CPU: 0 PID: 5311 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 123.654368][ T5311] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 123.664476][ T5311] Call Trace: [ 123.667794][ T5311] [ 123.670769][ T5311] dump_stack_lvl+0x136/0x150 [ 123.675528][ T5311] dump_header+0x10a/0xd70 [ 123.680016][ T5311] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 123.686164][ T5311] out_of_memory+0xd64/0x1660 [ 123.690892][ T5311] ? oom_killer_disable+0x2b0/0x2b0 [ 123.696144][ T5311] mem_cgroup_out_of_memory+0x206/0x270 [ 123.701728][ T5311] ? mem_cgroup_margin+0x130/0x130 [ 123.706897][ T5311] memory_max_write+0x2f9/0x3c0 [ 123.711872][ T5311] ? mem_cgroup_force_empty_write+0x160/0x160 [ 123.717987][ T5311] ? lock_sync+0x190/0x190 [ 123.722444][ T5311] cgroup_file_write+0x1e2/0x7b0 [ 123.727428][ T5311] ? mem_cgroup_force_empty_write+0x160/0x160 [ 123.733537][ T5311] ? kill_css+0x3b0/0x3b0 [ 123.737919][ T5311] ? lock_acquire+0x32/0xc0 [ 123.742469][ T5311] ? kill_css+0x3b0/0x3b0 [ 123.746844][ T5311] kernfs_fop_write_iter+0x3f1/0x600 [ 123.752174][ T5311] vfs_write+0x9ed/0xe10 [ 123.756463][ T5311] ? kernel_write+0x670/0x670 [ 123.761185][ T5311] ? find_held_lock+0x2d/0x110 [ 123.765996][ T5311] ? __fget_light+0x20a/0x270 [ 123.770737][ T5311] ksys_write+0x12b/0x250 [ 123.775111][ T5311] ? __ia32_sys_read+0xb0/0xb0 [ 123.779924][ T5311] ? lockdep_hardirqs_on+0x7d/0x100 [ 123.785155][ T5311] ? _raw_spin_unlock_irq+0x2e/0x50 [ 123.790392][ T5311] ? ptrace_notify+0xfe/0x140 [ 123.795113][ T5311] do_syscall_64+0x39/0xb0 [ 123.799582][ T5311] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 123.805515][ T5311] RIP: 0033:0x7faecf034129 [ 123.809963][ T5311] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 5295] close(3 [pid 5316] symlink("/syzcgroup/unified/syz0", "./cgroup" [pid 5315] symlink("/syzcgroup/net/syz2", "./cgroup.net" [pid 5295] <... close resumed>) = 0 [pid 5316] <... symlink resumed>) = 0 [pid 5316] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu" [pid 5315] <... symlink resumed>) = 0 [pid 5295] close(4 [pid 5316] <... symlink resumed>) = 0 [pid 5315] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5295] <... close resumed>) = 0 [pid 5316] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 5315] <... openat resumed>) = 3 [pid 5295] close(5 [pid 5316] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5315] write(3, "1000", 4 [pid 5295] <... close resumed>) = 0 [pid 5316] <... openat resumed>) = 3 [pid 5315] <... write resumed>) = 4 [pid 5295] close(6 [pid 5316] write(3, "1000", 4 [pid 5315] close(3 [pid 5295] <... close resumed>) = 0 [pid 5316] <... write resumed>) = 4 [pid 5315] <... close resumed>) = 0 [pid 5295] close(7 [pid 5316] close(3 [pid 5315] symlink("/dev/binderfs", "./binderfs" [pid 5295] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5316] <... close resumed>) = 0 [pid 5315] <... symlink resumed>) = 0 [pid 5295] close(8 [pid 5316] symlink("/dev/binderfs", "./binderfs" [pid 5315] mkdir("./file0", 000 [pid 5295] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5316] <... symlink resumed>) = 0 [pid 5295] close(9 [pid 5316] mkdir("./file0", 000 [pid 5315] <... mkdir resumed>) = 0 [pid 5295] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5316] <... mkdir resumed>) = 0 [pid 5295] close(10 [pid 5316] open("./file0", O_RDONLY [pid 5315] open("./file0", O_RDONLY [pid 5295] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5316] <... open resumed>) = 3 [pid 5316] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5315] <... open resumed>) = 3 [ 123.829602][ T5311] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 123.838046][ T5311] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 123.846045][ T5311] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 123.854048][ T5311] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 123.862131][ T5311] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 123.870126][ T5311] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000007 [ 123.878145][ T5311] [pid 5295] close(11 [pid 5316] <... mount resumed>) = 0 [pid 5315] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5295] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5316] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5315] <... mount resumed>) = 0 [pid 5295] close(12 [pid 5316] <... openat resumed>) = 4 [pid 5315] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5295] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5316] openat(4, "syz1", O_RDWR|O_PATH [pid 5315] <... openat resumed>) = 4 [pid 5295] close(13 [pid 5316] <... openat resumed>) = 5 [pid 5315] openat(4, "syz1", O_RDWR|O_PATH [pid 5295] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5316] openat(5, "memory.max", O_RDWR [pid 5315] <... openat resumed>) = 5 [pid 5295] close(14 [pid 5316] <... openat resumed>) = 6 [pid 5315] openat(5, "memory.max", O_RDWR [pid 5295] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5316] write(6, "0x000000000000040e", 18 [pid 5315] <... openat resumed>) = 6 [pid 5295] close(15 [pid 5315] write(6, "0x000000000000040e", 18 [pid 5295] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5295] close(16) = -1 EBADF (Bad file descriptor) [pid 5295] close(17) = -1 EBADF (Bad file descriptor) [pid 5295] close(18) = -1 EBADF (Bad file descriptor) [pid 5295] close(19) = -1 EBADF (Bad file descriptor) [pid 5295] close(20) = -1 EBADF (Bad file descriptor) [pid 5295] close(21) = -1 EBADF (Bad file descriptor) [pid 5295] close(22) = -1 EBADF (Bad file descriptor) [pid 5295] close(23) = -1 EBADF (Bad file descriptor) [pid 5295] close(24) = -1 EBADF (Bad file descriptor) [pid 5295] close(25) = -1 EBADF (Bad file descriptor) [pid 5295] close(26) = -1 EBADF (Bad file descriptor) [pid 5295] close(27) = -1 EBADF (Bad file descriptor) [pid 5295] close(28) = -1 EBADF (Bad file descriptor) [pid 5295] close(29) = -1 EBADF (Bad file descriptor) [pid 5295] exit_group(0) = ? [pid 5295] +++ exited with 0 +++ [pid 5090] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=12, si_uid=0, si_status=0, si_utime=0, si_stime=10 /* 0.10 s */} --- [pid 5090] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5090] umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [ 123.929503][ T5311] memory: usage 8kB, limit 0kB, failcnt 36 [ 123.938805][ T5311] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 123.975488][ T5311] Memory cgroup stats for /syz1: [ 123.975769][ T5311] anon 0 [ 123.975769][ T5311] file 0 [ 123.975769][ T5311] kernel 8192 [ 123.975769][ T5311] kernel_stack 0 [ 123.975769][ T5311] pagetables 0 [ 123.975769][ T5311] sec_pagetables 0 [ 123.975769][ T5311] percpu 0 [ 123.975769][ T5311] sock 0 [ 123.975769][ T5311] vmalloc 0 [ 123.975769][ T5311] shmem 0 [ 123.975769][ T5311] zswap 0 [ 123.975769][ T5311] zswapped 0 [ 123.975769][ T5311] file_mapped 0 [ 123.975769][ T5311] file_dirty 0 [ 123.975769][ T5311] file_writeback 0 [ 123.975769][ T5311] swapcached 0 [ 123.975769][ T5311] anon_thp 0 [ 123.975769][ T5311] file_thp 0 [ 123.975769][ T5311] shmem_thp 0 [ 123.975769][ T5311] inactive_anon 0 [ 123.975769][ T5311] active_anon 0 [ 123.975769][ T5311] inactive_file 0 [ 123.975769][ T5311] active_file 0 [ 123.975769][ T5311] unevictable 0 [ 123.975769][ T5311] slab_reclaimable 6752 [ 123.975769][ T5311] slab_unreclaimable 0 [ 123.975769][ T5311] slab 6752 [ 123.975769][ T5311] workingset_refault_anon 0 [ 123.975769][ T5311] workingset_refault_file 0 [ 123.975769][ T5311] workingset_activate_anon 0 [ 123.975769][ T5311] workingset_activate_file 0 [ 123.975769][ T5311] workingset_restore_anon 0 [ 123.975769][ T5311] workingset_restore_file 0 [ 123.975769][ T5311] workingset_nodereclaim 0 [ 123.975769][ T5311] pgscan 831 [ 123.975769][ T5311] pgsteal 2 [ 123.975769][ T5311] pgscan_kswapd 0 [ 123.975769][ T5311] pgscan_direct 831 [ 123.975769][ T5311] pgscan_khugepaged 0 [ 123.975769][ T5311] pgsteal_kswapd 0 [ 123.975769][ T5311] pgsteal_direct 2 [ 123.975769][ T5311] pgsteal_khugepaged 0 [pid 5090] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5090] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5090] umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./10/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5090] unlink("./10/binderfs") = 0 [pid 5090] umount2("./10/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./10/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5090] unlink("./10/cgroup") = 0 [pid 5090] umount2("./10/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./10/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5090] unlink("./10/cgroup.net") = 0 [ 123.975769][ T5311] pgfault 21 [ 123.975769][ T5311] pgmajfault 0 [ 123.975769][ T5311] pgrefill 830 [ 123.975769][ T5311] pgactivate 829 [ 123.975769][ T5311] pgdeactivate 830 [ 123.975769][ T5311] pglazyfree 0 [ 123.975769][ T5311] pglazyfreed 0 [ 123.975769][ T5311] zswpin 0 [ 123.975769][ T5311] zswpout 0 [ 123.975769][ T5311] thp_fault_alloc 0 [ 123.975769][ T5311] thp_collapse_alloc 0 [pid 5090] umount2("./10/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [ 124.199831][ T5311] Tasks state (memory values in pages): [ 124.206017][ T5311] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 124.216364][ T5311] Out of memory and no killable processes... [ 124.224915][ T5305] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 124.236602][ T5305] CPU: 0 PID: 5305 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 124.246577][ T5305] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 124.256703][ T5305] Call Trace: [ 124.260034][ T5305] [ 124.263019][ T5305] dump_stack_lvl+0x136/0x150 [ 124.267772][ T5305] dump_header+0x10a/0xd70 [ 124.272261][ T5305] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 124.278412][ T5305] ? mark_held_locks+0x9f/0xe0 [ 124.283250][ T5305] out_of_memory+0xd64/0x1660 [ 124.288010][ T5305] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 124.294255][ T5305] ? oom_killer_disable+0x2b0/0x2b0 [pid 5090] umount2("./10/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5311] <... write resumed>) = 18 [ 124.299525][ T5305] ? mem_cgroup_margin+0x1b/0x130 [ 124.304624][ T5305] ? mem_cgroup_margin+0x44/0x130 [ 124.309726][ T5305] mem_cgroup_out_of_memory+0x206/0x270 [ 124.315356][ T5305] ? mem_cgroup_margin+0x130/0x130 [ 124.320577][ T5305] memory_max_write+0x2f9/0x3c0 [ 124.325516][ T5305] ? mem_cgroup_force_empty_write+0x160/0x160 [ 124.331677][ T5305] ? lock_sync+0x190/0x190 [ 124.336165][ T5305] cgroup_file_write+0x1e2/0x7b0 [ 124.341187][ T5305] ? mem_cgroup_force_empty_write+0x160/0x160 [ 124.347344][ T5305] ? kill_css+0x3b0/0x3b0 [ 124.351758][ T5305] ? lock_acquire+0x32/0xc0 [ 124.356342][ T5305] ? kill_css+0x3b0/0x3b0 [ 124.360745][ T5305] kernfs_fop_write_iter+0x3f1/0x600 [ 124.366117][ T5305] vfs_write+0x9ed/0xe10 [ 124.370452][ T5305] ? kernel_write+0x670/0x670 [ 124.375217][ T5305] ? find_held_lock+0x2d/0x110 [ 124.380059][ T5305] ? __fget_light+0x20a/0x270 [ 124.384821][ T5305] ksys_write+0x12b/0x250 [ 124.389232][ T5305] ? __ia32_sys_read+0xb0/0xb0 [ 124.394072][ T5305] ? lockdep_hardirqs_on+0x7d/0x100 [ 124.399337][ T5305] ? _raw_spin_unlock_irq+0x2e/0x50 [ 124.404615][ T5305] ? ptrace_notify+0xfe/0x140 [ 124.409370][ T5305] do_syscall_64+0x39/0xb0 [ 124.413887][ T5305] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 124.419856][ T5305] RIP: 0033:0x7faecf034129 [ 124.424326][ T5305] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 124.444011][ T5305] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 124.452494][ T5305] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 124.460524][ T5305] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 124.468557][ T5305] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 124.476591][ T5305] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 124.484621][ T5305] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 000000000000000a [ 124.492687][ T5305] [pid 5311] close(3 [pid 5090] lstat("./10/file0", [pid 5311] <... close resumed>) = 0 [pid 5090] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5311] close(4 [ 124.505136][ T5305] memory: usage 8kB, limit 0kB, failcnt 36 [ 124.511929][ T5305] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 124.519566][ T5305] Memory cgroup stats for /syz1: [ 124.519843][ T5305] anon 0 [ 124.519843][ T5305] file 0 [ 124.519843][ T5305] kernel 8192 [ 124.519843][ T5305] kernel_stack 0 [ 124.519843][ T5305] pagetables 0 [ 124.519843][ T5305] sec_pagetables 0 [ 124.519843][ T5305] percpu 0 [ 124.519843][ T5305] sock 0 [ 124.519843][ T5305] vmalloc 0 [ 124.519843][ T5305] shmem 0 [ 124.519843][ T5305] zswap 0 [ 124.519843][ T5305] zswapped 0 [ 124.519843][ T5305] file_mapped 0 [ 124.519843][ T5305] file_dirty 0 [ 124.519843][ T5305] file_writeback 0 [ 124.519843][ T5305] swapcached 0 [ 124.519843][ T5305] anon_thp 0 [ 124.519843][ T5305] file_thp 0 [ 124.519843][ T5305] shmem_thp 0 [ 124.519843][ T5305] inactive_anon 0 [ 124.519843][ T5305] active_anon 0 [ 124.519843][ T5305] inactive_file 0 [ 124.519843][ T5305] active_file 0 [ 124.519843][ T5305] unevictable 0 [ 124.519843][ T5305] slab_reclaimable 6752 [ 124.519843][ T5305] slab_unreclaimable 0 [ 124.519843][ T5305] slab 6752 [ 124.519843][ T5305] workingset_refault_anon 0 [ 124.519843][ T5305] workingset_refault_file 0 [ 124.519843][ T5305] workingset_activate_anon 0 [ 124.519843][ T5305] workingset_activate_file 0 [ 124.519843][ T5305] workingset_restore_anon 0 [ 124.519843][ T5305] workingset_restore_file 0 [ 124.519843][ T5305] workingset_nodereclaim 0 [ 124.519843][ T5305] pgscan 831 [ 124.519843][ T5305] pgsteal 2 [ 124.519843][ T5305] pgscan_kswapd 0 [ 124.519843][ T5305] pgscan_direct 831 [pid 5090] umount2("./10/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] openat(AT_FDCWD, "./10/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5090] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5090] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5090] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5090] close(4) = 0 [pid 5090] rmdir("./10/file0" [pid 5311] <... close resumed>) = 0 [pid 5311] close(5 [pid 5090] <... rmdir resumed>) = 0 [pid 5090] umount2("./10/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5311] <... close resumed>) = 0 [pid 5090] lstat("./10/cgroup.cpu", [pid 5311] close(6 [pid 5090] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5090] unlink("./10/cgroup.cpu" [pid 5311] <... close resumed>) = 0 [pid 5311] close(7 [pid 5090] <... unlink resumed>) = 0 [pid 5311] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5090] getdents64(3, [pid 5311] close(8 [pid 5090] <... getdents64 resumed>0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5311] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5090] close(3 [pid 5311] close(9 [pid 5090] <... close resumed>) = 0 [pid 5311] <... close resumed>) = -1 EBADF (Bad file descriptor) [ 124.519843][ T5305] pgscan_khugepaged 0 [ 124.519843][ T5305] pgsteal_kswapd 0 [ 124.519843][ T5305] pgsteal_direct 2 [ 124.519843][ T5305] pgsteal_khugepaged 0 [ 124.519843][ T5305] pgfault 21 [ 124.519843][ T5305] pgmajfault 0 [ 124.519843][ T5305] pgrefill 830 [ 124.519843][ T5305] pgactivate 829 [ 124.519843][ T5305] pgdeactivate 830 [ 124.519843][ T5305] pglazyfree 0 [ 124.519843][ T5305] pglazyfreed 0 [ 124.519843][ T5305] zswpin 0 [ 124.519843][ T5305] zswpout 0 [ 124.519843][ T5305] thp_fault_alloc 0 [ 124.519843][ T5305] thp_collapse_alloc 0 [pid 5090] rmdir("./10" [pid 5311] close(10 [pid 5090] <... rmdir resumed>) = 0 [pid 5311] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5090] mkdir("./11", 0777 [pid 5311] close(11 [pid 5090] <... mkdir resumed>) = 0 [pid 5311] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5090] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5320 attached [pid 5311] close(12 [pid 5090] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 13 [pid 5311] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5320] chdir("./11") = 0 [pid 5311] close(13 [pid 5320] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5311] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5320] <... prctl resumed>) = 0 [pid 5311] close(14 [pid 5320] setpgid(0, 0 [pid 5311] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5320] <... setpgid resumed>) = 0 [pid 5311] close(15 [pid 5320] symlink("/syzcgroup/unified/syz4", "./cgroup" [pid 5311] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5311] close(16 [pid 5320] <... symlink resumed>) = 0 [pid 5320] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu" [pid 5311] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5311] close(17 [pid 5320] <... symlink resumed>) = 0 [pid 5311] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5320] symlink("/syzcgroup/net/syz4", "./cgroup.net" [pid 5311] close(18) = -1 EBADF (Bad file descriptor) [pid 5320] <... symlink resumed>) = 0 [pid 5311] close(19 [pid 5320] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5311] <... close resumed>) = -1 EBADF (Bad file descriptor) [ 124.749388][ T5305] Tasks state (memory values in pages): [ 124.756011][ T5305] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 124.785336][ T5305] Out of memory and no killable processes... [pid 5320] <... openat resumed>) = 3 [pid 5311] close(20) = -1 EBADF (Bad file descriptor) [pid 5320] write(3, "1000", 4) = 4 [ 124.791477][ T5316] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 124.812941][ T5316] CPU: 0 PID: 5316 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 124.822932][ T5316] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 124.833054][ T5316] Call Trace: [ 124.836378][ T5316] [ 124.839351][ T5316] dump_stack_lvl+0x136/0x150 [ 124.844116][ T5316] dump_header+0x10a/0xd70 [ 124.848592][ T5316] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 124.854744][ T5316] out_of_memory+0xd64/0x1660 [ 124.859498][ T5316] ? oom_killer_disable+0x2b0/0x2b0 [ 124.864749][ T5316] ? find_held_lock+0x2d/0x110 [ 124.869558][ T5316] mem_cgroup_out_of_memory+0x206/0x270 [ 124.875150][ T5316] ? mem_cgroup_margin+0x130/0x130 [ 124.880334][ T5316] ? _raw_spin_unlock_irqrestore+0x54/0x70 [ 124.886203][ T5316] memory_max_write+0x2f9/0x3c0 [ 124.891126][ T5316] ? mem_cgroup_force_empty_write+0x160/0x160 [ 124.897259][ T5316] ? lock_sync+0x190/0x190 [ 124.901730][ T5316] cgroup_file_write+0x1e2/0x7b0 [ 124.906726][ T5316] ? mem_cgroup_force_empty_write+0x160/0x160 [ 124.912843][ T5316] ? kill_css+0x3b0/0x3b0 [ 124.917219][ T5316] ? lock_acquire+0x32/0xc0 [ 124.921770][ T5316] ? kill_css+0x3b0/0x3b0 [ 124.926146][ T5316] kernfs_fop_write_iter+0x3f1/0x600 [ 124.931476][ T5316] vfs_write+0x9ed/0xe10 [ 124.935771][ T5316] ? kernel_write+0x670/0x670 [ 124.940500][ T5316] ? find_held_lock+0x2d/0x110 [ 124.945314][ T5316] ? __fget_light+0x20a/0x270 [ 124.950042][ T5316] ksys_write+0x12b/0x250 [ 124.954416][ T5316] ? __ia32_sys_read+0xb0/0xb0 [ 124.959224][ T5316] ? lockdep_hardirqs_on+0x7d/0x100 [ 124.964455][ T5316] ? _raw_spin_unlock_irq+0x2e/0x50 [ 124.969693][ T5316] ? ptrace_notify+0xfe/0x140 [ 124.974404][ T5316] do_syscall_64+0x39/0xb0 [ 124.978868][ T5316] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 124.984798][ T5316] RIP: 0033:0x7faecf034129 [ 124.989236][ T5316] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 125.009046][ T5316] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 125.017495][ T5316] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 125.025507][ T5316] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 125.033514][ T5316] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 125.041513][ T5316] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [pid 5320] close(3 [pid 5311] close(21 [pid 5305] <... write resumed>) = 18 [pid 5320] <... close resumed>) = 0 [pid 5311] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5305] close(3 [pid 5311] close(22 [pid 5305] <... close resumed>) = 0 [pid 5320] symlink("/dev/binderfs", "./binderfs" [pid 5311] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5320] <... symlink resumed>) = 0 [pid 5311] close(23 [pid 5305] close(4 [pid 5320] mkdir("./file0", 000 [pid 5311] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5305] <... close resumed>) = 0 [pid 5311] close(24 [pid 5305] close(5) = 0 [pid 5311] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5305] close(6 [pid 5311] close(25 [pid 5305] <... close resumed>) = 0 [pid 5311] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5305] close(7 [pid 5311] close(26 [pid 5305] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5311] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5311] close(27) = -1 EBADF (Bad file descriptor) [pid 5311] close(28) = -1 EBADF (Bad file descriptor) [pid 5311] close(29) = -1 EBADF (Bad file descriptor) [pid 5305] close(8 [pid 5311] exit_group(0) = ? [pid 5305] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5305] close(9) = -1 EBADF (Bad file descriptor) [pid 5305] close(10) = -1 EBADF (Bad file descriptor) [pid 5305] close(11 [pid 5311] +++ exited with 0 +++ [pid 5305] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5305] close(12) = -1 EBADF (Bad file descriptor) [pid 5305] close(13 [pid 5320] <... mkdir resumed>) = 0 [pid 5305] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5086] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=9, si_uid=0, si_status=0, si_utime=0, si_stime=10 /* 0.10 s */} --- [pid 5320] open("./file0", O_RDONLY [pid 5305] close(14) = -1 EBADF (Bad file descriptor) [pid 5320] <... open resumed>) = 3 [pid 5305] close(15 [pid 5320] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5305] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5305] close(16 [pid 5320] <... mount resumed>) = 0 [pid 5305] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5305] close(17 [pid 5320] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5305] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5305] close(18 [pid 5086] umount2("./7", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5305] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5320] <... openat resumed>) = 4 [pid 5086] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5305] close(19 [pid 5320] openat(4, "syz1", O_RDWR|O_PATH [pid 5305] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5086] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5320] <... openat resumed>) = 5 [pid 5305] close(20) = -1 EBADF (Bad file descriptor) [pid 5320] openat(5, "memory.max", O_RDWR [pid 5086] <... openat resumed>) = 3 [pid 5305] close(21 [pid 5086] fstat(3, [pid 5320] <... openat resumed>) = 6 [pid 5305] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5086] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5320] write(6, "0x000000000000040e", 18 [pid 5305] close(22 [ 125.049511][ T5316] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000007 [ 125.057543][ T5316] [pid 5086] getdents64(3, [pid 5305] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5086] <... getdents64 resumed>0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5305] close(23 [pid 5086] umount2("./7/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5305] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5086] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5305] close(24 [pid 5086] lstat("./7/binderfs", [pid 5305] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5305] close(25 [pid 5086] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5305] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5086] unlink("./7/binderfs" [pid 5305] close(26) = -1 EBADF (Bad file descriptor) [pid 5086] <... unlink resumed>) = 0 [pid 5305] close(27 [pid 5086] umount2("./7/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5305] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5086] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5305] close(28 [pid 5086] lstat("./7/cgroup", [pid 5305] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5305] close(29 [pid 5086] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5305] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5086] unlink("./7/cgroup" [pid 5305] exit_group(0) = ? [pid 5086] <... unlink resumed>) = 0 [pid 5305] +++ exited with 0 +++ [pid 5086] umount2("./7/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5089] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=12, si_uid=0, si_status=0, si_utime=0, si_stime=6 /* 0.06 s */} --- [pid 5086] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5089] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5086] lstat("./7/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5089] umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5086] unlink("./7/cgroup.net" [pid 5089] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5086] <... unlink resumed>) = 0 [pid 5089] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5086] umount2("./7/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5089] <... openat resumed>) = 3 [pid 5089] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5089] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5089] umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./10/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5089] unlink("./10/binderfs") = 0 [pid 5089] umount2("./10/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 125.137062][ T5316] memory: usage 8kB, limit 0kB, failcnt 36 [ 125.149685][ T5316] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 125.168180][ T5316] Memory cgroup stats for /syz1: [ 125.168466][ T5316] anon 0 [ 125.168466][ T5316] file 0 [ 125.168466][ T5316] kernel 8192 [ 125.168466][ T5316] kernel_stack 0 [ 125.168466][ T5316] pagetables 0 [ 125.168466][ T5316] sec_pagetables 0 [ 125.168466][ T5316] percpu 0 [ 125.168466][ T5316] sock 0 [ 125.168466][ T5316] vmalloc 0 [ 125.168466][ T5316] shmem 0 [ 125.168466][ T5316] zswap 0 [ 125.168466][ T5316] zswapped 0 [ 125.168466][ T5316] file_mapped 0 [ 125.168466][ T5316] file_dirty 0 [ 125.168466][ T5316] file_writeback 0 [ 125.168466][ T5316] swapcached 0 [ 125.168466][ T5316] anon_thp 0 [ 125.168466][ T5316] file_thp 0 [ 125.168466][ T5316] shmem_thp 0 [ 125.168466][ T5316] inactive_anon 0 [ 125.168466][ T5316] active_anon 0 [ 125.168466][ T5316] inactive_file 0 [ 125.168466][ T5316] active_file 0 [ 125.168466][ T5316] unevictable 0 [ 125.168466][ T5316] slab_reclaimable 6752 [ 125.168466][ T5316] slab_unreclaimable 0 [ 125.168466][ T5316] slab 6752 [ 125.168466][ T5316] workingset_refault_anon 0 [ 125.168466][ T5316] workingset_refault_file 0 [ 125.168466][ T5316] workingset_activate_anon 0 [ 125.168466][ T5316] workingset_activate_file 0 [ 125.168466][ T5316] workingset_restore_anon 0 [ 125.168466][ T5316] workingset_restore_file 0 [pid 5089] lstat("./10/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5089] unlink("./10/cgroup") = 0 [ 125.168466][ T5316] workingset_nodereclaim 0 [ 125.168466][ T5316] pgscan 831 [ 125.168466][ T5316] pgsteal 2 [ 125.168466][ T5316] pgscan_kswapd 0 [ 125.168466][ T5316] pgscan_direct 831 [ 125.168466][ T5316] pgscan_khugepaged 0 [ 125.168466][ T5316] pgsteal_kswapd 0 [ 125.168466][ T5316] pgsteal_direct 2 [ 125.168466][ T5316] pgsteal_khugepaged 0 [ 125.168466][ T5316] pgfault 21 [ 125.168466][ T5316] pgmajfault 0 [ 125.168466][ T5316] pgrefill 830 [ 125.168466][ T5316] pgactivate 829 [ 125.168466][ T5316] pgdeactivate 830 [ 125.168466][ T5316] pglazyfree 0 [pid 5089] umount2("./10/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./10/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5089] unlink("./10/cgroup.net") = 0 [pid 5089] umount2("./10/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5086] <... umount2 resumed>) = 0 [pid 5089] <... umount2 resumed>) = 0 [pid 5086] umount2("./7/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5089] umount2("./10/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5086] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5089] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./7/file0", [pid 5089] lstat("./10/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5086] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5089] umount2("./10/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5086] umount2("./7/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5089] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5089] openat(AT_FDCWD, "./10/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5086] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5089] <... openat resumed>) = 4 [pid 5086] openat(AT_FDCWD, "./7/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5089] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5086] <... openat resumed>) = 4 [pid 5089] getdents64(4, [pid 5086] fstat(4, [pid 5089] <... getdents64 resumed>0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5089] getdents64(4, [pid 5086] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5089] <... getdents64 resumed>0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5086] getdents64(4, [pid 5089] close(4) = 0 [pid 5086] <... getdents64 resumed>0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5089] rmdir("./10/file0" [pid 5086] getdents64(4, [pid 5089] <... rmdir resumed>) = 0 [pid 5086] <... getdents64 resumed>0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5089] umount2("./10/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] close(4 [pid 5089] lstat("./10/cgroup.cpu", [pid 5086] <... close resumed>) = 0 [pid 5089] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5086] rmdir("./7/file0" [pid 5089] unlink("./10/cgroup.cpu") = 0 [pid 5086] <... rmdir resumed>) = 0 [pid 5089] getdents64(3, [pid 5086] umount2("./7/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5089] <... getdents64 resumed>0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5086] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [ 125.168466][ T5316] pglazyfreed 0 [ 125.168466][ T5316] zswpin 0 [ 125.168466][ T5316] zswpout 0 [ 125.168466][ T5316] thp_fault_alloc 0 [ 125.168466][ T5316] thp_collapse_alloc 0 [pid 5089] close(3 [pid 5086] lstat("./7/cgroup.cpu", [pid 5089] <... close resumed>) = 0 [pid 5086] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5089] rmdir("./10" [pid 5086] unlink("./7/cgroup.cpu" [pid 5089] <... rmdir resumed>) = 0 [pid 5086] <... unlink resumed>) = 0 [pid 5089] mkdir("./11", 0777 [pid 5086] getdents64(3, [pid 5089] <... mkdir resumed>) = 0 [pid 5086] <... getdents64 resumed>0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5089] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5086] close(3./strace-static-x86_64: Process 5325 attached ) = 0 [pid 5325] chdir("./11" [pid 5089] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 13 [pid 5086] rmdir("./7" [pid 5325] <... chdir resumed>) = 0 [pid 5325] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5086] <... rmdir resumed>) = 0 [pid 5325] setpgid(0, 0 [pid 5086] mkdir("./8", 0777 [pid 5325] <... setpgid resumed>) = 0 [pid 5325] symlink("/syzcgroup/unified/syz5", "./cgroup" [pid 5086] <... mkdir resumed>) = 0 [pid 5325] <... symlink resumed>) = 0 [pid 5086] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5325] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu"./strace-static-x86_64: Process 5326 attached ) = 0 [pid 5326] chdir("./8" [pid 5325] symlink("/syzcgroup/net/syz5", "./cgroup.net" [pid 5086] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 10 [pid 5326] <... chdir resumed>) = 0 [pid 5325] <... symlink resumed>) = 0 [pid 5326] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5325] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5326] <... prctl resumed>) = 0 [pid 5325] <... openat resumed>) = 3 [pid 5326] setpgid(0, 0 [pid 5325] write(3, "1000", 4 [pid 5326] <... setpgid resumed>) = 0 [pid 5325] <... write resumed>) = 4 [pid 5326] symlink("/syzcgroup/unified/syz3", "./cgroup" [pid 5325] close(3 [pid 5326] <... symlink resumed>) = 0 [pid 5325] <... close resumed>) = 0 [pid 5326] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu" [pid 5325] symlink("/dev/binderfs", "./binderfs" [pid 5326] <... symlink resumed>) = 0 [pid 5325] <... symlink resumed>) = 0 [pid 5326] symlink("/syzcgroup/net/syz3", "./cgroup.net" [pid 5325] mkdir("./file0", 000 [pid 5326] <... symlink resumed>) = 0 [pid 5325] <... mkdir resumed>) = 0 [pid 5326] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5325] open("./file0", O_RDONLY [pid 5326] <... openat resumed>) = 3 [pid 5325] <... open resumed>) = 3 [pid 5326] write(3, "1000", 4 [pid 5325] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5326] <... write resumed>) = 4 [pid 5325] <... mount resumed>) = 0 [pid 5326] close(3 [pid 5325] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5326] <... close resumed>) = 0 [pid 5325] <... openat resumed>) = 4 [pid 5326] symlink("/dev/binderfs", "./binderfs" [pid 5325] openat(4, "syz1", O_RDWR|O_PATH [pid 5326] <... symlink resumed>) = 0 [pid 5325] <... openat resumed>) = 5 [pid 5326] mkdir("./file0", 000 [pid 5325] openat(5, "memory.max", O_RDWR) = 6 [pid 5325] write(6, "0x000000000000040e", 18 [pid 5326] <... mkdir resumed>) = 0 [pid 5326] open("./file0", O_RDONLY) = 3 [pid 5326] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5326] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5326] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5326] openat(5, "memory.max", O_RDWR) = 6 [pid 5326] write(6, "0x000000000000040e", 18 [pid 5316] <... write resumed>) = 18 [pid 5316] close(3) = 0 [pid 5316] close(4) = 0 [pid 5316] close(5) = 0 [pid 5316] close(6) = 0 [pid 5316] close(7) = -1 EBADF (Bad file descriptor) [ 125.492283][ T5316] Tasks state (memory values in pages): [ 125.498232][ T5316] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 125.515139][ T5316] Out of memory and no killable processes... [ 125.525232][ T5315] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5316] close(8) = -1 EBADF (Bad file descriptor) [pid 5316] close(9) = -1 EBADF (Bad file descriptor) [pid 5316] close(10) = -1 EBADF (Bad file descriptor) [pid 5316] close(11) = -1 EBADF (Bad file descriptor) [pid 5316] close(12) = -1 EBADF (Bad file descriptor) [pid 5316] close(13) = -1 EBADF (Bad file descriptor) [pid 5316] close(14) = -1 EBADF (Bad file descriptor) [pid 5316] close(15) = -1 EBADF (Bad file descriptor) [pid 5316] close(16) = -1 EBADF (Bad file descriptor) [pid 5316] close(17) = -1 EBADF (Bad file descriptor) [pid 5316] close(18) = -1 EBADF (Bad file descriptor) [pid 5316] close(19) = -1 EBADF (Bad file descriptor) [pid 5316] close(20) = -1 EBADF (Bad file descriptor) [pid 5316] close(21) = -1 EBADF (Bad file descriptor) [pid 5316] close(22) = -1 EBADF (Bad file descriptor) [pid 5316] close(23) = -1 EBADF (Bad file descriptor) [pid 5316] close(24) = -1 EBADF (Bad file descriptor) [pid 5316] close(25) = -1 EBADF (Bad file descriptor) [pid 5316] close(26) = -1 EBADF (Bad file descriptor) [pid 5316] close(27) = -1 EBADF (Bad file descriptor) [pid 5316] close(28) = -1 EBADF (Bad file descriptor) [pid 5316] close(29) = -1 EBADF (Bad file descriptor) [pid 5316] exit_group(0) = ? [pid 5316] +++ exited with 0 +++ [pid 5085] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=9, si_uid=0, si_status=0, si_utime=0, si_stime=9 /* 0.09 s */} --- [pid 5085] umount2("./7", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 125.545270][ T5315] CPU: 1 PID: 5315 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 125.555263][ T5315] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 125.565374][ T5315] Call Trace: [ 125.568704][ T5315] [ 125.571688][ T5315] dump_stack_lvl+0x136/0x150 [ 125.576444][ T5315] dump_header+0x10a/0xd70 [ 125.580938][ T5315] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 125.587109][ T5315] out_of_memory+0xd64/0x1660 [pid 5085] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5085] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5085] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5085] umount2("./7/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./7/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5085] unlink("./7/binderfs") = 0 [pid 5085] umount2("./7/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./7/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5085] unlink("./7/cgroup") = 0 [pid 5085] umount2("./7/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./7/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5085] unlink("./7/cgroup.net") = 0 [ 125.591881][ T5315] ? oom_killer_disable+0x2b0/0x2b0 [ 125.597181][ T5315] mem_cgroup_out_of_memory+0x206/0x270 [ 125.602814][ T5315] ? mem_cgroup_margin+0x130/0x130 [ 125.608126][ T5315] memory_max_write+0x2f9/0x3c0 [ 125.613069][ T5315] ? mem_cgroup_force_empty_write+0x160/0x160 [ 125.619227][ T5315] ? lock_sync+0x190/0x190 [ 125.623719][ T5315] cgroup_file_write+0x1e2/0x7b0 [ 125.628750][ T5315] ? mem_cgroup_force_empty_write+0x160/0x160 [ 125.634916][ T5315] ? kill_css+0x3b0/0x3b0 [ 125.639322][ T5315] ? lock_acquire+0x32/0xc0 [ 125.643909][ T5315] ? kill_css+0x3b0/0x3b0 [ 125.648317][ T5315] kernfs_fop_write_iter+0x3f1/0x600 [ 125.653693][ T5315] vfs_write+0x9ed/0xe10 [ 125.658024][ T5315] ? kernel_write+0x670/0x670 [ 125.662786][ T5315] ? find_held_lock+0x2d/0x110 [ 125.667631][ T5315] ? __fget_light+0x20a/0x270 [ 125.672396][ T5315] ksys_write+0x12b/0x250 [ 125.676805][ T5315] ? __ia32_sys_read+0xb0/0xb0 [ 125.681668][ T5315] ? lockdep_hardirqs_on+0x7d/0x100 [ 125.686929][ T5315] ? _raw_spin_unlock_irq+0x2e/0x50 [ 125.692200][ T5315] ? ptrace_notify+0xfe/0x140 [ 125.696951][ T5315] do_syscall_64+0x39/0xb0 [ 125.701449][ T5315] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 125.707414][ T5315] RIP: 0033:0x7faecf034129 [ 125.711888][ T5315] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 125.731594][ T5315] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 5085] umount2("./7/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5085] umount2("./7/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./7/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5085] umount2("./7/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] openat(AT_FDCWD, "./7/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5085] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [ 125.740078][ T5315] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 125.748112][ T5315] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 125.756150][ T5315] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 125.764181][ T5315] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 125.772221][ T5315] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000009 [ 125.780289][ T5315] [pid 5085] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5085] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5085] close(4) = 0 [pid 5085] rmdir("./7/file0") = 0 [pid 5085] umount2("./7/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./7/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5085] unlink("./7/cgroup.cpu") = 0 [pid 5085] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5085] close(3) = 0 [pid 5085] rmdir("./7") = 0 [pid 5085] mkdir("./8", 0777) = 0 [pid 5085] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555c0c5d0) = 10 [ 125.801105][ T5315] memory: usage 8kB, limit 0kB, failcnt 36 [ 125.809005][ T5315] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 125.825326][ T5315] Memory cgroup stats for /syz1: [ 125.825606][ T5315] anon 0 [ 125.825606][ T5315] file 0 [ 125.825606][ T5315] kernel 8192 [ 125.825606][ T5315] kernel_stack 0 [ 125.825606][ T5315] pagetables 0 [ 125.825606][ T5315] sec_pagetables 0 [ 125.825606][ T5315] percpu 0 [ 125.825606][ T5315] sock 0 [ 125.825606][ T5315] vmalloc 0 [ 125.825606][ T5315] shmem 0 [ 125.825606][ T5315] zswap 0 [ 125.825606][ T5315] zswapped 0 [ 125.825606][ T5315] file_mapped 0 [ 125.825606][ T5315] file_dirty 0 [ 125.825606][ T5315] file_writeback 0 [ 125.825606][ T5315] swapcached 0 [ 125.825606][ T5315] anon_thp 0 [ 125.825606][ T5315] file_thp 0 [ 125.825606][ T5315] shmem_thp 0 [ 125.825606][ T5315] inactive_anon 0 [ 125.825606][ T5315] active_anon 0 [ 125.825606][ T5315] inactive_file 0 [ 125.825606][ T5315] active_file 0 [ 125.825606][ T5315] unevictable 0 [ 125.825606][ T5315] slab_reclaimable 6752 [ 125.825606][ T5315] slab_unreclaimable 0 [ 125.825606][ T5315] slab 6752 [ 125.825606][ T5315] workingset_refault_anon 0 [ 125.825606][ T5315] workingset_refault_file 0 [ 125.825606][ T5315] workingset_activate_anon 0 [ 125.825606][ T5315] workingset_activate_file 0 [ 125.825606][ T5315] workingset_restore_anon 0 [ 125.825606][ T5315] workingset_restore_file 0 [ 125.825606][ T5315] workingset_nodereclaim 0 [ 125.825606][ T5315] pgscan 831 [ 125.825606][ T5315] pgsteal 2 [ 125.825606][ T5315] pgscan_kswapd 0 [ 125.825606][ T5315] pgscan_direct 831 [ 125.825606][ T5315] pgscan_khugepaged 0 [ 125.825606][ T5315] pgsteal_kswapd 0 [ 125.825606][ T5315] pgsteal_direct 2 [ 125.825606][ T5315] pgsteal_khugepaged 0 [ 125.825606][ T5315] pgfault 21 [ 125.825606][ T5315] pgmajfault 0 [ 125.825606][ T5315] pgrefill 830 [ 125.825606][ T5315] pgactivate 829 [ 125.825606][ T5315] pgdeactivate 830 [ 125.825606][ T5315] pglazyfree 0 [ 125.825606][ T5315] pglazyfreed 0 [ 125.825606][ T5315] zswpin 0 ./strace-static-x86_64: Process 5329 attached [pid 5329] chdir("./8") = 0 [pid 5329] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5329] setpgid(0, 0) = 0 [ 125.825606][ T5315] zswpout 0 [ 125.825606][ T5315] thp_fault_alloc 0 [ 125.825606][ T5315] thp_collapse_alloc 0 [ 126.030614][ T5315] Tasks state (memory values in pages): [ 126.038378][ T5315] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5329] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 5329] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 5329] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 5329] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5315] <... write resumed>) = 18 [pid 5329] <... openat resumed>) = 3 [pid 5329] write(3, "1000", 4 [pid 5315] close(3 [pid 5329] <... write resumed>) = 4 [pid 5315] <... close resumed>) = 0 [ 126.056425][ T5315] Out of memory and no killable processes... [ 126.069016][ T5320] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 126.089626][ T5320] CPU: 1 PID: 5320 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 126.099654][ T5320] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 126.109770][ T5320] Call Trace: [ 126.113092][ T5320] [ 126.116080][ T5320] dump_stack_lvl+0x136/0x150 [ 126.120829][ T5320] dump_header+0x10a/0xd70 [ 126.125313][ T5320] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 126.131479][ T5320] out_of_memory+0xd64/0x1660 [ 126.136246][ T5320] ? oom_killer_disable+0x2b0/0x2b0 [ 126.141529][ T5320] ? find_held_lock+0x2d/0x110 [ 126.146371][ T5320] mem_cgroup_out_of_memory+0x206/0x270 [ 126.152001][ T5320] ? mem_cgroup_margin+0x130/0x130 [ 126.157198][ T5320] ? _raw_spin_unlock_irqrestore+0x54/0x70 [ 126.163090][ T5320] memory_max_write+0x2f9/0x3c0 [ 126.168025][ T5320] ? mem_cgroup_force_empty_write+0x160/0x160 [ 126.174195][ T5320] ? lock_sync+0x190/0x190 [ 126.178692][ T5320] cgroup_file_write+0x1e2/0x7b0 [ 126.183711][ T5320] ? mem_cgroup_force_empty_write+0x160/0x160 [ 126.189878][ T5320] ? kill_css+0x3b0/0x3b0 [ 126.194281][ T5320] ? lock_acquire+0x32/0xc0 [ 126.198858][ T5320] ? kill_css+0x3b0/0x3b0 [pid 5329] close(3) = 0 [pid 5329] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5329] mkdir("./file0", 000) = 0 [pid 5329] open("./file0", O_RDONLY) = 3 [pid 5329] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [ 126.203264][ T5320] kernfs_fop_write_iter+0x3f1/0x600 [ 126.208641][ T5320] vfs_write+0x9ed/0xe10 [ 126.212972][ T5320] ? kernel_write+0x670/0x670 [ 126.217735][ T5320] ? find_held_lock+0x2d/0x110 [ 126.222577][ T5320] ? __fget_light+0x20a/0x270 [ 126.227341][ T5320] ksys_write+0x12b/0x250 [ 126.231746][ T5320] ? __ia32_sys_read+0xb0/0xb0 [ 126.236580][ T5320] ? lockdep_hardirqs_on+0x7d/0x100 [ 126.241867][ T5320] ? _raw_spin_unlock_irq+0x2e/0x50 [ 126.247139][ T5320] ? ptrace_notify+0xfe/0x140 [ 126.251897][ T5320] do_syscall_64+0x39/0xb0 [pid 5329] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5329] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5329] openat(5, "memory.max", O_RDWR) = 6 [pid 5329] write(6, "0x000000000000040e", 18 [pid 5315] close(4) = 0 [pid 5315] close(5) = 0 [ 126.256407][ T5320] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 126.262377][ T5320] RIP: 0033:0x7faecf034129 [ 126.266851][ T5320] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 126.286527][ T5320] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 126.295022][ T5320] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [pid 5315] close(6) = 0 [pid 5315] close(7) = -1 EBADF (Bad file descriptor) [pid 5315] close(8) = -1 EBADF (Bad file descriptor) [pid 5315] close(9) = -1 EBADF (Bad file descriptor) [pid 5315] close(10) = -1 EBADF (Bad file descriptor) [pid 5315] close(11) = -1 EBADF (Bad file descriptor) [pid 5315] close(12) = -1 EBADF (Bad file descriptor) [pid 5315] close(13) = -1 EBADF (Bad file descriptor) [pid 5315] close(14) = -1 EBADF (Bad file descriptor) [pid 5315] close(15) = -1 EBADF (Bad file descriptor) [pid 5315] close(16) = -1 EBADF (Bad file descriptor) [pid 5315] close(17) = -1 EBADF (Bad file descriptor) [pid 5315] close(18) = -1 EBADF (Bad file descriptor) [pid 5315] close(19) = -1 EBADF (Bad file descriptor) [pid 5315] close(20) = -1 EBADF (Bad file descriptor) [pid 5315] close(21) = -1 EBADF (Bad file descriptor) [pid 5315] close(22) = -1 EBADF (Bad file descriptor) [pid 5315] close(23) = -1 EBADF (Bad file descriptor) [pid 5315] close(24) = -1 EBADF (Bad file descriptor) [pid 5315] close(25) = -1 EBADF (Bad file descriptor) [pid 5315] close(26) = -1 EBADF (Bad file descriptor) [pid 5315] close(27) = -1 EBADF (Bad file descriptor) [pid 5315] close(28) = -1 EBADF (Bad file descriptor) [pid 5315] close(29) = -1 EBADF (Bad file descriptor) [pid 5315] exit_group(0) = ? [pid 5315] +++ exited with 0 +++ [pid 5087] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=11, si_uid=0, si_status=0, si_utime=0, si_stime=11 /* 0.11 s */} --- [ 126.303045][ T5320] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 126.311095][ T5320] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 126.319129][ T5320] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 126.327171][ T5320] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 000000000000000b [ 126.335239][ T5320] [pid 5087] umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5087] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5087] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5087] umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./9/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5087] unlink("./9/binderfs") = 0 [pid 5087] umount2("./9/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./9/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5087] unlink("./9/cgroup") = 0 [pid 5087] umount2("./9/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./9/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5087] unlink("./9/cgroup.net") = 0 [pid 5087] umount2("./9/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5087] umount2("./9/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./9/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5087] umount2("./9/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] openat(AT_FDCWD, "./9/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5087] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5087] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5087] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5087] close(4) = 0 [pid 5087] rmdir("./9/file0") = 0 [pid 5087] umount2("./9/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./9/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5087] unlink("./9/cgroup.cpu") = 0 [pid 5087] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5087] close(3) = 0 [pid 5087] rmdir("./9") = 0 [pid 5087] mkdir("./10", 0777) = 0 [pid 5087] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5336 attached [pid 5336] chdir("./10" [pid 5087] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 12 [pid 5336] <... chdir resumed>) = 0 [pid 5336] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5336] setpgid(0, 0) = 0 [pid 5336] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 5336] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 5336] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 5336] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5336] write(3, "1000", 4) = 4 [pid 5336] close(3) = 0 [pid 5336] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5336] mkdir("./file0", 000) = 0 [pid 5336] open("./file0", O_RDONLY) = 3 [pid 5336] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5336] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5336] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5336] openat(5, "memory.max", O_RDWR) = 6 [ 126.550467][ T5320] memory: usage 8kB, limit 0kB, failcnt 36 [ 126.558143][ T5320] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 126.570691][ T5320] Memory cgroup stats for /syz1: [ 126.570970][ T5320] anon 0 [ 126.570970][ T5320] file 0 [ 126.570970][ T5320] kernel 8192 [ 126.570970][ T5320] kernel_stack 0 [ 126.570970][ T5320] pagetables 0 [ 126.570970][ T5320] sec_pagetables 0 [ 126.570970][ T5320] percpu 0 [ 126.570970][ T5320] sock 0 [ 126.570970][ T5320] vmalloc 0 [ 126.570970][ T5320] shmem 0 [ 126.570970][ T5320] zswap 0 [ 126.570970][ T5320] zswapped 0 [ 126.570970][ T5320] file_mapped 0 [ 126.570970][ T5320] file_dirty 0 [ 126.570970][ T5320] file_writeback 0 [ 126.570970][ T5320] swapcached 0 [ 126.570970][ T5320] anon_thp 0 [ 126.570970][ T5320] file_thp 0 [ 126.570970][ T5320] shmem_thp 0 [ 126.570970][ T5320] inactive_anon 0 [ 126.570970][ T5320] active_anon 0 [ 126.570970][ T5320] inactive_file 0 [ 126.570970][ T5320] active_file 0 [ 126.570970][ T5320] unevictable 0 [ 126.570970][ T5320] slab_reclaimable 6752 [ 126.570970][ T5320] slab_unreclaimable 0 [ 126.570970][ T5320] slab 6752 [ 126.570970][ T5320] workingset_refault_anon 0 [ 126.570970][ T5320] workingset_refault_file 0 [ 126.570970][ T5320] workingset_activate_anon 0 [ 126.570970][ T5320] workingset_activate_file 0 [ 126.570970][ T5320] workingset_restore_anon 0 [ 126.570970][ T5320] workingset_restore_file 0 [ 126.570970][ T5320] workingset_nodereclaim 0 [ 126.570970][ T5320] pgscan 831 [ 126.570970][ T5320] pgsteal 2 [ 126.570970][ T5320] pgscan_kswapd 0 [ 126.570970][ T5320] pgscan_direct 831 [ 126.570970][ T5320] pgscan_khugepaged 0 [ 126.570970][ T5320] pgsteal_kswapd 0 [ 126.570970][ T5320] pgsteal_direct 2 [ 126.570970][ T5320] pgsteal_khugepaged 0 [ 126.570970][ T5320] pgfault 21 [ 126.570970][ T5320] pgmajfault 0 [ 126.570970][ T5320] pgrefill 830 [ 126.570970][ T5320] pgactivate 829 [ 126.570970][ T5320] pgdeactivate 830 [ 126.570970][ T5320] pglazyfree 0 [ 126.570970][ T5320] pglazyfreed 0 [ 126.570970][ T5320] zswpin 0 [ 126.570970][ T5320] zswpout 0 [ 126.570970][ T5320] thp_fault_alloc 0 [ 126.570970][ T5320] thp_collapse_alloc 0 [ 126.761778][ T5320] Tasks state (memory values in pages): [ 126.775694][ T5320] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 126.789865][ T5320] Out of memory and no killable processes... [pid 5336] write(6, "0x000000000000040e", 18 [pid 5320] <... write resumed>) = 18 [pid 5320] close(3) = 0 [pid 5320] close(4) = 0 [pid 5320] close(5) = 0 [pid 5320] close(6) = 0 [pid 5320] close(7) = -1 EBADF (Bad file descriptor) [pid 5320] close(8) = -1 EBADF (Bad file descriptor) [pid 5320] close(9) = -1 EBADF (Bad file descriptor) [pid 5320] close(10) = -1 EBADF (Bad file descriptor) [pid 5320] close(11) = -1 EBADF (Bad file descriptor) [pid 5320] close(12) = -1 EBADF (Bad file descriptor) [pid 5320] close(13) = -1 EBADF (Bad file descriptor) [pid 5320] close(14) = -1 EBADF (Bad file descriptor) [pid 5320] close(15) = -1 EBADF (Bad file descriptor) [pid 5320] close(16) = -1 EBADF (Bad file descriptor) [pid 5320] close(17) = -1 EBADF (Bad file descriptor) [ 126.798824][ T5325] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 126.816899][ T5325] CPU: 1 PID: 5325 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 126.826911][ T5325] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 126.837024][ T5325] Call Trace: [ 126.840365][ T5325] [ 126.843362][ T5325] dump_stack_lvl+0x136/0x150 [pid 5320] close(18) = -1 EBADF (Bad file descriptor) [pid 5320] close(19) = -1 EBADF (Bad file descriptor) [pid 5320] close(20) = -1 EBADF (Bad file descriptor) [pid 5320] close(21) = -1 EBADF (Bad file descriptor) [pid 5320] close(22) = -1 EBADF (Bad file descriptor) [pid 5320] close(23) = -1 EBADF (Bad file descriptor) [pid 5320] close(24) = -1 EBADF (Bad file descriptor) [pid 5320] close(25) = -1 EBADF (Bad file descriptor) [pid 5320] close(26) = -1 EBADF (Bad file descriptor) [pid 5320] close(27) = -1 EBADF (Bad file descriptor) [pid 5320] close(28) = -1 EBADF (Bad file descriptor) [pid 5320] close(29) = -1 EBADF (Bad file descriptor) [pid 5320] exit_group(0) = ? [pid 5320] +++ exited with 0 +++ [pid 5090] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=13, si_uid=0, si_status=0, si_utime=0, si_stime=10 /* 0.10 s */} --- [pid 5090] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5090] umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5090] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [ 126.848116][ T5325] dump_header+0x10a/0xd70 [ 126.852642][ T5325] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 126.858818][ T5325] out_of_memory+0xd64/0x1660 [ 126.863595][ T5325] ? oom_killer_disable+0x2b0/0x2b0 [ 126.868939][ T5325] mem_cgroup_out_of_memory+0x206/0x270 [ 126.874570][ T5325] ? mem_cgroup_margin+0x130/0x130 [ 126.879799][ T5325] memory_max_write+0x2f9/0x3c0 [ 126.884789][ T5325] ? mem_cgroup_force_empty_write+0x160/0x160 [ 126.890958][ T5325] ? lock_sync+0x190/0x190 [ 126.895465][ T5325] cgroup_file_write+0x1e2/0x7b0 [pid 5090] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5090] umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./11/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5090] unlink("./11/binderfs") = 0 [pid 5090] umount2("./11/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./11/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5090] unlink("./11/cgroup") = 0 [pid 5090] umount2("./11/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./11/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5090] unlink("./11/cgroup.net") = 0 [ 126.900503][ T5325] ? mem_cgroup_force_empty_write+0x160/0x160 [ 126.906677][ T5325] ? kill_css+0x3b0/0x3b0 [ 126.911094][ T5325] ? lock_acquire+0x32/0xc0 [ 126.915686][ T5325] ? kill_css+0x3b0/0x3b0 [ 126.920105][ T5325] kernfs_fop_write_iter+0x3f1/0x600 [ 126.925493][ T5325] vfs_write+0x9ed/0xe10 [ 126.929831][ T5325] ? kernel_write+0x670/0x670 [ 126.934563][ T5325] ? find_held_lock+0x2d/0x110 [ 126.939399][ T5325] ? __fget_light+0x20a/0x270 [ 126.944131][ T5325] ksys_write+0x12b/0x250 [ 126.948510][ T5325] ? __ia32_sys_read+0xb0/0xb0 [ 126.953320][ T5325] ? lockdep_hardirqs_on+0x7d/0x100 [ 126.958565][ T5325] ? _raw_spin_unlock_irq+0x2e/0x50 [ 126.963805][ T5325] ? ptrace_notify+0xfe/0x140 [ 126.968527][ T5325] do_syscall_64+0x39/0xb0 [ 126.972989][ T5325] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 126.978921][ T5325] RIP: 0033:0x7faecf034129 [ 126.983378][ T5325] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 127.003017][ T5325] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 127.011460][ T5325] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 127.019454][ T5325] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 127.027449][ T5325] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 127.035447][ T5325] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 127.043448][ T5325] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 000000000000000b [pid 5090] umount2("./11/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5090] umount2("./11/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./11/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5090] umount2("./11/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] openat(AT_FDCWD, "./11/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5090] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5090] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5090] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5090] close(4) = 0 [pid 5090] rmdir("./11/file0") = 0 [pid 5090] umount2("./11/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./11/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5090] unlink("./11/cgroup.cpu") = 0 [pid 5090] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [ 127.051469][ T5325] [ 127.056036][ T5325] memory: usage 8kB, limit 0kB, failcnt 36 [ 127.084030][ T5325] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 127.094512][ T5325] Memory cgroup stats for /syz1: [ 127.094904][ T5325] anon 0 [pid 5090] close(3) = 0 [ 127.094904][ T5325] file 0 [ 127.094904][ T5325] kernel 8192 [ 127.094904][ T5325] kernel_stack 0 [ 127.094904][ T5325] pagetables 0 [ 127.094904][ T5325] sec_pagetables 0 [ 127.094904][ T5325] percpu 0 [ 127.094904][ T5325] sock 0 [ 127.094904][ T5325] vmalloc 0 [ 127.094904][ T5325] shmem 0 [ 127.094904][ T5325] zswap 0 [ 127.094904][ T5325] zswapped 0 [ 127.094904][ T5325] file_mapped 0 [ 127.094904][ T5325] file_dirty 0 [ 127.094904][ T5325] file_writeback 0 [ 127.094904][ T5325] swapcached 0 [ 127.094904][ T5325] anon_thp 0 [pid 5090] rmdir("./11") = 0 [pid 5090] mkdir("./12", 0777) = 0 [pid 5090] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5338 attached [pid 5338] chdir("./12" [pid 5090] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 14 [pid 5338] <... chdir resumed>) = 0 [pid 5338] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5338] setpgid(0, 0) = 0 [pid 5338] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 5338] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 5338] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [pid 5338] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5338] write(3, "1000", 4) = 4 [pid 5338] close(3) = 0 [pid 5338] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5338] mkdir("./file0", 000) = 0 [pid 5338] open("./file0", O_RDONLY) = 3 [pid 5338] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5338] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5338] openat(4, "syz1", O_RDWR|O_PATH) = 5 [ 127.094904][ T5325] file_thp 0 [ 127.094904][ T5325] shmem_thp 0 [ 127.094904][ T5325] inactive_anon 0 [ 127.094904][ T5325] active_anon 0 [ 127.094904][ T5325] inactive_file 0 [ 127.094904][ T5325] active_file 0 [ 127.094904][ T5325] unevictable 0 [ 127.094904][ T5325] slab_reclaimable 6752 [ 127.094904][ T5325] slab_unreclaimable 0 [ 127.094904][ T5325] slab 6752 [ 127.094904][ T5325] workingset_refault_anon 0 [ 127.094904][ T5325] workingset_refault_file 0 [ 127.094904][ T5325] workingset_activate_anon 0 [ 127.094904][ T5325] workingset_activate_file 0 [pid 5338] openat(5, "memory.max", O_RDWR) = 6 [ 127.094904][ T5325] workingset_restore_anon 0 [ 127.094904][ T5325] workingset_restore_file 0 [ 127.094904][ T5325] workingset_nodereclaim 0 [ 127.094904][ T5325] pgscan 831 [ 127.094904][ T5325] pgsteal 2 [ 127.094904][ T5325] pgscan_kswapd 0 [ 127.094904][ T5325] pgscan_direct 831 [ 127.094904][ T5325] pgscan_khugepaged 0 [ 127.094904][ T5325] pgsteal_kswapd 0 [ 127.094904][ T5325] pgsteal_direct 2 [ 127.094904][ T5325] pgsteal_khugepaged 0 [ 127.094904][ T5325] pgfault 21 [ 127.094904][ T5325] pgmajfault 0 [ 127.094904][ T5325] pgrefill 830 [ 127.094904][ T5325] pgactivate 829 [ 127.094904][ T5325] pgdeactivate 830 [ 127.094904][ T5325] pglazyfree 0 [ 127.094904][ T5325] pglazyfreed 0 [ 127.094904][ T5325] zswpin 0 [ 127.094904][ T5325] zswpout 0 [ 127.094904][ T5325] thp_fault_alloc 0 [ 127.094904][ T5325] thp_collapse_alloc 0 [ 127.285923][ T5325] Tasks state (memory values in pages): [pid 5338] write(6, "0x000000000000040e", 18 [pid 5325] <... write resumed>) = 18 [ 127.299005][ T5325] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 127.308667][ T5325] Out of memory and no killable processes... [ 127.324254][ T5326] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 127.340679][ T5326] CPU: 1 PID: 5326 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 127.350655][ T5326] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 127.360767][ T5326] Call Trace: [ 127.364086][ T5326] [ 127.367068][ T5326] dump_stack_lvl+0x136/0x150 [ 127.371821][ T5326] dump_header+0x10a/0xd70 [ 127.376301][ T5326] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 127.382478][ T5326] out_of_memory+0xd64/0x1660 [ 127.387258][ T5326] ? oom_killer_disable+0x2b0/0x2b0 [ 127.392550][ T5326] mem_cgroup_out_of_memory+0x206/0x270 [ 127.398172][ T5326] ? mem_cgroup_margin+0x130/0x130 [ 127.403385][ T5326] memory_max_write+0x2f9/0x3c0 [ 127.408321][ T5326] ? mem_cgroup_force_empty_write+0x160/0x160 [ 127.414498][ T5326] ? lock_sync+0x190/0x190 [ 127.419009][ T5326] cgroup_file_write+0x1e2/0x7b0 [ 127.424041][ T5326] ? mem_cgroup_force_empty_write+0x160/0x160 [ 127.430199][ T5326] ? kill_css+0x3b0/0x3b0 [ 127.434611][ T5326] ? lock_acquire+0x32/0xc0 [ 127.439208][ T5326] ? kill_css+0x3b0/0x3b0 [ 127.443614][ T5326] kernfs_fop_write_iter+0x3f1/0x600 [ 127.448973][ T5326] vfs_write+0x9ed/0xe10 [ 127.453296][ T5326] ? kernel_write+0x670/0x670 [ 127.458057][ T5326] ? find_held_lock+0x2d/0x110 [ 127.462894][ T5326] ? __fget_light+0x20a/0x270 [ 127.467656][ T5326] ksys_write+0x12b/0x250 [ 127.472070][ T5326] ? __ia32_sys_read+0xb0/0xb0 [ 127.476931][ T5326] ? lockdep_hardirqs_on+0x7d/0x100 [ 127.482207][ T5326] ? _raw_spin_unlock_irq+0x2e/0x50 [ 127.487491][ T5326] ? ptrace_notify+0xfe/0x140 [ 127.492243][ T5326] do_syscall_64+0x39/0xb0 [ 127.496754][ T5326] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 127.502724][ T5326] RIP: 0033:0x7faecf034129 [ 127.507201][ T5326] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 127.526877][ T5326] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 127.535365][ T5326] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 127.543406][ T5326] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [pid 5325] close(3) = 0 [ 127.551405][ T5326] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 127.559404][ T5326] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 127.567404][ T5326] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000008 [ 127.575425][ T5326] [ 127.586230][ T5326] memory: usage 8kB, limit 0kB, failcnt 36 [ 127.592411][ T5326] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 127.599566][ T5326] Memory cgroup stats for /syz1: [ 127.599852][ T5326] anon 0 [ 127.599852][ T5326] file 0 [ 127.599852][ T5326] kernel 8192 [ 127.599852][ T5326] kernel_stack 0 [ 127.599852][ T5326] pagetables 0 [ 127.599852][ T5326] sec_pagetables 0 [ 127.599852][ T5326] percpu 0 [ 127.599852][ T5326] sock 0 [ 127.599852][ T5326] vmalloc 0 [ 127.599852][ T5326] shmem 0 [ 127.599852][ T5326] zswap 0 [ 127.599852][ T5326] zswapped 0 [ 127.599852][ T5326] file_mapped 0 [ 127.599852][ T5326] file_dirty 0 [ 127.599852][ T5326] file_writeback 0 [ 127.599852][ T5326] swapcached 0 [ 127.599852][ T5326] anon_thp 0 [ 127.599852][ T5326] file_thp 0 [ 127.599852][ T5326] shmem_thp 0 [ 127.599852][ T5326] inactive_anon 0 [ 127.599852][ T5326] active_anon 0 [ 127.599852][ T5326] inactive_file 0 [ 127.599852][ T5326] active_file 0 [ 127.599852][ T5326] unevictable 0 [ 127.599852][ T5326] slab_reclaimable 6752 [ 127.599852][ T5326] slab_unreclaimable 0 [ 127.599852][ T5326] slab 6752 [ 127.599852][ T5326] workingset_refault_anon 0 [ 127.599852][ T5326] workingset_refault_file 0 [ 127.599852][ T5326] workingset_activate_anon 0 [ 127.599852][ T5326] workingset_activate_file 0 [ 127.599852][ T5326] workingset_restore_anon 0 [ 127.599852][ T5326] workingset_restore_file 0 [ 127.599852][ T5326] workingset_nodereclaim 0 [ 127.599852][ T5326] pgscan 831 [ 127.599852][ T5326] pgsteal 2 [ 127.599852][ T5326] pgscan_kswapd 0 [ 127.599852][ T5326] pgscan_direct 831 [ 127.599852][ T5326] pgscan_khugepaged 0 [ 127.599852][ T5326] pgsteal_kswapd 0 [ 127.599852][ T5326] pgsteal_direct 2 [ 127.599852][ T5326] pgsteal_khugepaged 0 [ 127.599852][ T5326] pgfault 21 [ 127.599852][ T5326] pgmajfault 0 [pid 5325] close(4) = 0 [pid 5325] close(5) = 0 [pid 5325] close(6) = 0 [pid 5325] close(7) = -1 EBADF (Bad file descriptor) [pid 5325] close(8) = -1 EBADF (Bad file descriptor) [pid 5325] close(9) = -1 EBADF (Bad file descriptor) [pid 5325] close(10) = -1 EBADF (Bad file descriptor) [pid 5325] close(11) = -1 EBADF (Bad file descriptor) [pid 5325] close(12) = -1 EBADF (Bad file descriptor) [pid 5325] close(13) = -1 EBADF (Bad file descriptor) [pid 5325] close(14) = -1 EBADF (Bad file descriptor) [pid 5325] close(15) = -1 EBADF (Bad file descriptor) [pid 5325] close(16) = -1 EBADF (Bad file descriptor) [pid 5325] close(17) = -1 EBADF (Bad file descriptor) [pid 5325] close(18) = -1 EBADF (Bad file descriptor) [pid 5325] close(19) = -1 EBADF (Bad file descriptor) [pid 5325] close(20) = -1 EBADF (Bad file descriptor) [pid 5325] close(21) = -1 EBADF (Bad file descriptor) [pid 5325] close(22) = -1 EBADF (Bad file descriptor) [pid 5325] close(23) = -1 EBADF (Bad file descriptor) [pid 5325] close(24) = -1 EBADF (Bad file descriptor) [pid 5325] close(25) = -1 EBADF (Bad file descriptor) [pid 5325] close(26) = -1 EBADF (Bad file descriptor) [pid 5325] close(27) = -1 EBADF (Bad file descriptor) [pid 5325] close(28) = -1 EBADF (Bad file descriptor) [pid 5325] close(29) = -1 EBADF (Bad file descriptor) [pid 5325] exit_group(0) = ? [pid 5325] +++ exited with 0 +++ [pid 5089] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=13, si_uid=0, si_status=0, si_utime=0, si_stime=7 /* 0.07 s */} --- [pid 5089] umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5089] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [ 127.599852][ T5326] pgrefill 830 [ 127.599852][ T5326] pgactivate 829 [ 127.599852][ T5326] pgdeactivate 830 [ 127.599852][ T5326] pglazyfree 0 [ 127.599852][ T5326] pglazyfreed 0 [ 127.599852][ T5326] zswpin 0 [ 127.599852][ T5326] zswpout 0 [ 127.599852][ T5326] thp_fault_alloc 0 [ 127.599852][ T5326] thp_collapse_alloc 0 [pid 5089] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5089] umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./11/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5089] unlink("./11/binderfs") = 0 [pid 5089] umount2("./11/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./11/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5089] unlink("./11/cgroup") = 0 [pid 5089] umount2("./11/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./11/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5089] unlink("./11/cgroup.net") = 0 [pid 5089] umount2("./11/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5089] umount2("./11/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./11/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5089] umount2("./11/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] openat(AT_FDCWD, "./11/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5089] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5089] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5089] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5089] close(4) = 0 [pid 5089] rmdir("./11/file0") = 0 [pid 5089] umount2("./11/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./11/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5089] unlink("./11/cgroup.cpu") = 0 [pid 5089] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5089] close(3) = 0 [pid 5089] rmdir("./11") = 0 [pid 5089] mkdir("./12", 0777) = 0 [pid 5089] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5344 attached , child_tidptr=0x555555c0c5d0) = 14 [pid 5344] chdir("./12") = 0 [pid 5344] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5344] setpgid(0, 0) = 0 [pid 5344] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 5344] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [pid 5344] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 5344] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5344] write(3, "1000", 4) = 4 [pid 5344] close(3) = 0 [pid 5344] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5344] mkdir("./file0", 000) = 0 [pid 5344] open("./file0", O_RDONLY) = 3 [pid 5344] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5344] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [ 127.886486][ T5326] Tasks state (memory values in pages): [ 127.903535][ T5326] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5344] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5326] <... write resumed>) = 18 [ 127.940746][ T5326] Out of memory and no killable processes... [ 127.948119][ T5329] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 127.959209][ T5329] CPU: 0 PID: 5329 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 127.969182][ T5329] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 127.979319][ T5329] Call Trace: [ 127.982642][ T5329] [ 127.985617][ T5329] dump_stack_lvl+0x136/0x150 [ 127.990362][ T5329] dump_header+0x10a/0xd70 [ 127.994845][ T5329] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 128.001004][ T5329] out_of_memory+0xd64/0x1660 [ 128.005758][ T5329] ? oom_killer_disable+0x2b0/0x2b0 [ 128.011048][ T5329] mem_cgroup_out_of_memory+0x206/0x270 [ 128.016671][ T5329] ? mem_cgroup_margin+0x130/0x130 [ 128.021891][ T5329] memory_max_write+0x2f9/0x3c0 [ 128.026817][ T5329] ? mem_cgroup_force_empty_write+0x160/0x160 [ 128.032968][ T5329] ? lock_sync+0x190/0x190 [ 128.037455][ T5329] cgroup_file_write+0x1e2/0x7b0 [ 128.042469][ T5329] ? mem_cgroup_force_empty_write+0x160/0x160 [ 128.048612][ T5329] ? kill_css+0x3b0/0x3b0 [ 128.053018][ T5329] ? lock_acquire+0x32/0xc0 [ 128.057594][ T5329] ? kill_css+0x3b0/0x3b0 [ 128.062013][ T5329] kernfs_fop_write_iter+0x3f1/0x600 [ 128.067410][ T5329] vfs_write+0x9ed/0xe10 [ 128.071731][ T5329] ? kernel_write+0x670/0x670 [ 128.076486][ T5329] ? find_held_lock+0x2d/0x110 [ 128.081333][ T5329] ? __fget_light+0x20a/0x270 [ 128.086117][ T5329] ksys_write+0x12b/0x250 [ 128.090559][ T5329] ? __ia32_sys_read+0xb0/0xb0 [ 128.095401][ T5329] ? lockdep_hardirqs_on+0x7d/0x100 [ 128.100671][ T5329] ? _raw_spin_unlock_irq+0x2e/0x50 [ 128.105952][ T5329] ? ptrace_notify+0xfe/0x140 [ 128.110698][ T5329] do_syscall_64+0x39/0xb0 [ 128.115194][ T5329] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 128.121154][ T5329] RIP: 0033:0x7faecf034129 [ 128.125620][ T5329] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 128.145292][ T5329] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 128.153778][ T5329] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 128.161803][ T5329] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 128.169844][ T5329] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 128.177867][ T5329] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [pid 5344] openat(5, "memory.max", O_RDWR [pid 5326] close(3 [pid 5344] <... openat resumed>) = 6 [pid 5326] <... close resumed>) = 0 [pid 5344] write(6, "0x000000000000040e", 18 [pid 5326] close(4) = 0 [ 128.185892][ T5329] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000008 [ 128.193947][ T5329] [pid 5326] close(5) = 0 [pid 5326] close(6) = 0 [pid 5326] close(7) = -1 EBADF (Bad file descriptor) [pid 5326] close(8) = -1 EBADF (Bad file descriptor) [pid 5326] close(9) = -1 EBADF (Bad file descriptor) [pid 5326] close(10) = -1 EBADF (Bad file descriptor) [pid 5326] close(11) = -1 EBADF (Bad file descriptor) [ 128.211242][ T5329] memory: usage 8kB, limit 0kB, failcnt 36 [ 128.226705][ T5329] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 128.234546][ T5329] Memory cgroup stats for /syz1: [ 128.234796][ T5329] anon 0 [ 128.234796][ T5329] file 0 [ 128.234796][ T5329] kernel 8192 [ 128.234796][ T5329] kernel_stack 0 [ 128.234796][ T5329] pagetables 0 [ 128.234796][ T5329] sec_pagetables 0 [ 128.234796][ T5329] percpu 0 [ 128.234796][ T5329] sock 0 [ 128.234796][ T5329] vmalloc 0 [ 128.234796][ T5329] shmem 0 [pid 5326] close(12) = -1 EBADF (Bad file descriptor) [pid 5326] close(13) = -1 EBADF (Bad file descriptor) [pid 5326] close(14) = -1 EBADF (Bad file descriptor) [pid 5326] close(15) = -1 EBADF (Bad file descriptor) [pid 5326] close(16) = -1 EBADF (Bad file descriptor) [pid 5326] close(17) = -1 EBADF (Bad file descriptor) [pid 5326] close(18) = -1 EBADF (Bad file descriptor) [pid 5326] close(19) = -1 EBADF (Bad file descriptor) [pid 5326] close(20) = -1 EBADF (Bad file descriptor) [ 128.234796][ T5329] zswap 0 [ 128.234796][ T5329] zswapped 0 [ 128.234796][ T5329] file_mapped 0 [ 128.234796][ T5329] file_dirty 0 [ 128.234796][ T5329] file_writeback 0 [ 128.234796][ T5329] swapcached 0 [ 128.234796][ T5329] anon_thp 0 [ 128.234796][ T5329] file_thp 0 [ 128.234796][ T5329] shmem_thp 0 [ 128.234796][ T5329] inactive_anon 0 [ 128.234796][ T5329] active_anon 0 [ 128.234796][ T5329] inactive_file 0 [ 128.234796][ T5329] active_file 0 [ 128.234796][ T5329] unevictable 0 [ 128.234796][ T5329] slab_reclaimable 6752 [ 128.234796][ T5329] slab_unreclaimable 0 [ 128.234796][ T5329] slab 6752 [ 128.234796][ T5329] workingset_refault_anon 0 [ 128.234796][ T5329] workingset_refault_file 0 [ 128.234796][ T5329] workingset_activate_anon 0 [ 128.234796][ T5329] workingset_activate_file 0 [ 128.234796][ T5329] workingset_restore_anon 0 [ 128.234796][ T5329] workingset_restore_file 0 [ 128.234796][ T5329] workingset_nodereclaim 0 [ 128.234796][ T5329] pgscan 831 [ 128.234796][ T5329] pgsteal 2 [ 128.234796][ T5329] pgscan_kswapd 0 [ 128.234796][ T5329] pgscan_direct 831 [pid 5326] close(21) = -1 EBADF (Bad file descriptor) [pid 5326] close(22) = -1 EBADF (Bad file descriptor) [pid 5326] close(23) = -1 EBADF (Bad file descriptor) [pid 5326] close(24) = -1 EBADF (Bad file descriptor) [pid 5326] close(25) = -1 EBADF (Bad file descriptor) [pid 5326] close(26) = -1 EBADF (Bad file descriptor) [pid 5326] close(27) = -1 EBADF (Bad file descriptor) [pid 5326] close(28) = -1 EBADF (Bad file descriptor) [pid 5326] close(29) = -1 EBADF (Bad file descriptor) [pid 5326] exit_group(0) = ? [pid 5326] +++ exited with 0 +++ [pid 5086] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=10, si_uid=0, si_status=0, si_utime=0, si_stime=9 /* 0.09 s */} --- [pid 5086] umount2("./8", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5086] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5086] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5086] umount2("./8/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./8/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5086] unlink("./8/binderfs") = 0 [pid 5086] umount2("./8/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./8/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5086] unlink("./8/cgroup") = 0 [pid 5086] umount2("./8/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./8/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5086] unlink("./8/cgroup.net") = 0 [pid 5086] umount2("./8/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5086] umount2("./8/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./8/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5086] umount2("./8/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] openat(AT_FDCWD, "./8/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5086] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5086] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5086] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5086] close(4) = 0 [pid 5086] rmdir("./8/file0") = 0 [pid 5086] umount2("./8/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 128.234796][ T5329] pgscan_khugepaged 0 [ 128.234796][ T5329] pgsteal_kswapd 0 [ 128.234796][ T5329] pgsteal_direct 2 [ 128.234796][ T5329] pgsteal_khugepaged 0 [ 128.234796][ T5329] pgfault 21 [ 128.234796][ T5329] pgmajfault 0 [ 128.234796][ T5329] pgrefill 830 [ 128.234796][ T5329] pgactivate 829 [ 128.234796][ T5329] pgdeactivate 830 [ 128.234796][ T5329] pglazyfree 0 [ 128.234796][ T5329] pglazyfreed 0 [ 128.234796][ T5329] zswpin 0 [ 128.234796][ T5329] zswpout 0 [ 128.234796][ T5329] thp_fault_alloc 0 [ 128.234796][ T5329] thp_collapse_alloc 0 [pid 5086] lstat("./8/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5086] unlink("./8/cgroup.cpu") = 0 [pid 5086] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5086] close(3) = 0 [pid 5086] rmdir("./8") = 0 [pid 5086] mkdir("./9", 0777) = 0 [pid 5086] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5349 attached [pid 5349] chdir("./9" [pid 5086] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 11 [pid 5349] <... chdir resumed>) = 0 [pid 5349] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5349] setpgid(0, 0) = 0 [pid 5349] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [pid 5349] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 5349] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 5349] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5349] write(3, "1000", 4) = 4 [pid 5349] close(3) = 0 [pid 5349] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5349] mkdir("./file0", 000) = 0 [pid 5349] open("./file0", O_RDONLY) = 3 [pid 5349] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5349] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5349] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5349] openat(5, "memory.max", O_RDWR) = 6 [pid 5349] write(6, "0x000000000000040e", 18 [pid 5329] <... write resumed>) = 18 [pid 5329] close(3) = 0 [ 128.569596][ T5329] Tasks state (memory values in pages): [ 128.575651][ T5329] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 128.606540][ T5329] Out of memory and no killable processes... [pid 5329] close(4) = 0 [pid 5329] close(5) = 0 [pid 5329] close(6) = 0 [pid 5329] close(7) = -1 EBADF (Bad file descriptor) [pid 5329] close(8) = -1 EBADF (Bad file descriptor) [pid 5329] close(9) = -1 EBADF (Bad file descriptor) [pid 5329] close(10) = -1 EBADF (Bad file descriptor) [pid 5329] close(11) = -1 EBADF (Bad file descriptor) [pid 5329] close(12) = -1 EBADF (Bad file descriptor) [pid 5329] close(13) = -1 EBADF (Bad file descriptor) [pid 5329] close(14) = -1 EBADF (Bad file descriptor) [pid 5329] close(15) = -1 EBADF (Bad file descriptor) [pid 5329] close(16) = -1 EBADF (Bad file descriptor) [pid 5329] close(17) = -1 EBADF (Bad file descriptor) [pid 5329] close(18) = -1 EBADF (Bad file descriptor) [pid 5329] close(19) = -1 EBADF (Bad file descriptor) [pid 5329] close(20) = -1 EBADF (Bad file descriptor) [pid 5329] close(21) = -1 EBADF (Bad file descriptor) [pid 5329] close(22) = -1 EBADF (Bad file descriptor) [pid 5329] close(23) = -1 EBADF (Bad file descriptor) [ 128.628042][ T5336] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 128.652811][ T5336] CPU: 0 PID: 5336 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 128.662805][ T5336] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 128.672922][ T5336] Call Trace: [pid 5329] close(24) = -1 EBADF (Bad file descriptor) [pid 5329] close(25) = -1 EBADF (Bad file descriptor) [pid 5329] close(26) = -1 EBADF (Bad file descriptor) [pid 5329] close(27) = -1 EBADF (Bad file descriptor) [pid 5329] close(28) = -1 EBADF (Bad file descriptor) [pid 5329] close(29) = -1 EBADF (Bad file descriptor) [pid 5329] exit_group(0) = ? [pid 5329] +++ exited with 0 +++ [ 128.676252][ T5336] [ 128.679235][ T5336] dump_stack_lvl+0x136/0x150 [ 128.683988][ T5336] dump_header+0x10a/0xd70 [ 128.688467][ T5336] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 128.694623][ T5336] out_of_memory+0xd64/0x1660 [ 128.699383][ T5336] ? oom_killer_disable+0x2b0/0x2b0 [ 128.704662][ T5336] ? find_held_lock+0x2d/0x110 [ 128.709515][ T5336] mem_cgroup_out_of_memory+0x206/0x270 [ 128.715139][ T5336] ? mem_cgroup_margin+0x130/0x130 [ 128.720338][ T5336] ? _raw_spin_unlock_irqrestore+0x54/0x70 [ 128.726228][ T5336] memory_max_write+0x2f9/0x3c0 [ 128.731166][ T5336] ? mem_cgroup_force_empty_write+0x160/0x160 [ 128.737326][ T5336] ? lock_sync+0x190/0x190 [ 128.741814][ T5336] cgroup_file_write+0x1e2/0x7b0 [ 128.746832][ T5336] ? mem_cgroup_force_empty_write+0x160/0x160 [ 128.752978][ T5336] ? kill_css+0x3b0/0x3b0 [ 128.757388][ T5336] ? lock_acquire+0x32/0xc0 [ 128.761974][ T5336] ? kill_css+0x3b0/0x3b0 [ 128.766378][ T5336] kernfs_fop_write_iter+0x3f1/0x600 [ 128.771740][ T5336] vfs_write+0x9ed/0xe10 [ 128.776069][ T5336] ? kernel_write+0x670/0x670 [ 128.780825][ T5336] ? find_held_lock+0x2d/0x110 [ 128.785665][ T5336] ? __fget_light+0x20a/0x270 [ 128.790435][ T5336] ksys_write+0x12b/0x250 [ 128.794853][ T5336] ? __ia32_sys_read+0xb0/0xb0 [ 128.799696][ T5336] ? lockdep_hardirqs_on+0x7d/0x100 [ 128.804963][ T5336] ? _raw_spin_unlock_irq+0x2e/0x50 [ 128.810236][ T5336] ? ptrace_notify+0xfe/0x140 [ 128.814988][ T5336] do_syscall_64+0x39/0xb0 [ 128.819480][ T5336] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 128.825449][ T5336] RIP: 0033:0x7faecf034129 [ 128.829916][ T5336] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 128.849702][ T5336] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 128.858198][ T5336] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 128.866243][ T5336] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [pid 5085] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=10, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- [pid 5085] umount2("./8", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5085] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5085] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5085] umount2("./8/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./8/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5085] unlink("./8/binderfs") = 0 [pid 5085] umount2("./8/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./8/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5085] unlink("./8/cgroup") = 0 [pid 5085] umount2("./8/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./8/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5085] unlink("./8/cgroup.net") = 0 [pid 5085] umount2("./8/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5085] umount2("./8/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./8/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5085] umount2("./8/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] openat(AT_FDCWD, "./8/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5085] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5085] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5085] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5085] close(4) = 0 [pid 5085] rmdir("./8/file0") = 0 [pid 5085] umount2("./8/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./8/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [ 128.874271][ T5336] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 128.882299][ T5336] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 128.890320][ T5336] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 000000000000000a [ 128.898376][ T5336] [pid 5085] unlink("./8/cgroup.cpu") = 0 [pid 5085] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5085] close(3) = 0 [pid 5085] rmdir("./8") = 0 [pid 5085] mkdir("./9", 0777) = 0 [pid 5085] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555c0c5d0) = 11 ./strace-static-x86_64: Process 5354 attached [ 128.937719][ T5336] memory: usage 8kB, limit 0kB, failcnt 36 [ 128.945951][ T5336] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 128.961262][ T5336] Memory cgroup stats for /syz1: [ 128.961553][ T5336] anon 0 [ 128.961553][ T5336] file 0 [ 128.961553][ T5336] kernel 8192 [ 128.961553][ T5336] kernel_stack 0 [ 128.961553][ T5336] pagetables 0 [ 128.961553][ T5336] sec_pagetables 0 [ 128.961553][ T5336] percpu 0 [ 128.961553][ T5336] sock 0 [ 128.961553][ T5336] vmalloc 0 [ 128.961553][ T5336] shmem 0 [ 128.961553][ T5336] zswap 0 [ 128.961553][ T5336] zswapped 0 [ 128.961553][ T5336] file_mapped 0 [ 128.961553][ T5336] file_dirty 0 [ 128.961553][ T5336] file_writeback 0 [ 128.961553][ T5336] swapcached 0 [ 128.961553][ T5336] anon_thp 0 [ 128.961553][ T5336] file_thp 0 [ 128.961553][ T5336] shmem_thp 0 [ 128.961553][ T5336] inactive_anon 0 [ 128.961553][ T5336] active_anon 0 [ 128.961553][ T5336] inactive_file 0 [ 128.961553][ T5336] active_file 0 [ 128.961553][ T5336] unevictable 0 [ 128.961553][ T5336] slab_reclaimable 6752 [ 128.961553][ T5336] slab_unreclaimable 0 [ 128.961553][ T5336] slab 6752 [ 128.961553][ T5336] workingset_refault_anon 0 [ 128.961553][ T5336] workingset_refault_file 0 [ 128.961553][ T5336] workingset_activate_anon 0 [ 128.961553][ T5336] workingset_activate_file 0 [ 128.961553][ T5336] workingset_restore_anon 0 [ 128.961553][ T5336] workingset_restore_file 0 [ 128.961553][ T5336] workingset_nodereclaim 0 [ 128.961553][ T5336] pgscan 831 [ 128.961553][ T5336] pgsteal 2 [ 128.961553][ T5336] pgscan_kswapd 0 [ 128.961553][ T5336] pgscan_direct 831 [ 128.961553][ T5336] pgscan_khugepaged 0 [ 128.961553][ T5336] pgsteal_kswapd 0 [ 128.961553][ T5336] pgsteal_direct 2 [ 128.961553][ T5336] pgsteal_khugepaged 0 [ 128.961553][ T5336] pgfault 21 [ 128.961553][ T5336] pgmajfault 0 [ 128.961553][ T5336] pgrefill 830 [ 128.961553][ T5336] pgactivate 829 [ 128.961553][ T5336] pgdeactivate 830 [ 128.961553][ T5336] pglazyfree 0 [ 128.961553][ T5336] pglazyfreed 0 [ 128.961553][ T5336] zswpin 0 [pid 5354] chdir("./9") = 0 [pid 5354] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5354] setpgid(0, 0) = 0 [pid 5354] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [ 128.961553][ T5336] zswpout 0 [ 128.961553][ T5336] thp_fault_alloc 0 [ 128.961553][ T5336] thp_collapse_alloc 0 [ 129.159955][ T5336] Tasks state (memory values in pages): [ 129.165846][ T5336] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5354] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 5354] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 5354] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5354] write(3, "1000", 4 [pid 5336] <... write resumed>) = 18 [ 129.186520][ T5336] Out of memory and no killable processes... [ 129.199058][ T5338] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 129.221081][ T5338] CPU: 0 PID: 5338 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 129.231071][ T5338] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 129.241189][ T5338] Call Trace: [ 129.244519][ T5338] [ 129.247493][ T5338] dump_stack_lvl+0x136/0x150 [ 129.252244][ T5338] dump_header+0x10a/0xd70 [ 129.256725][ T5338] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 129.262888][ T5338] out_of_memory+0xd64/0x1660 [ 129.267653][ T5338] ? oom_killer_disable+0x2b0/0x2b0 [ 129.272938][ T5338] mem_cgroup_out_of_memory+0x206/0x270 [ 129.278562][ T5338] ? mem_cgroup_margin+0x130/0x130 [ 129.283774][ T5338] memory_max_write+0x2f9/0x3c0 [ 129.288708][ T5338] ? mem_cgroup_force_empty_write+0x160/0x160 [ 129.294865][ T5338] ? lock_sync+0x190/0x190 [ 129.299360][ T5338] cgroup_file_write+0x1e2/0x7b0 [ 129.304387][ T5338] ? mem_cgroup_force_empty_write+0x160/0x160 [ 129.310537][ T5338] ? kill_css+0x3b0/0x3b0 [ 129.314942][ T5338] ? lock_acquire+0x32/0xc0 [ 129.319523][ T5338] ? kill_css+0x3b0/0x3b0 [ 129.323933][ T5338] kernfs_fop_write_iter+0x3f1/0x600 [ 129.329318][ T5338] vfs_write+0x9ed/0xe10 [ 129.333652][ T5338] ? kernel_write+0x670/0x670 [ 129.338415][ T5338] ? find_held_lock+0x2d/0x110 [ 129.343262][ T5338] ? __fget_light+0x20a/0x270 [ 129.348028][ T5338] ksys_write+0x12b/0x250 [ 129.352442][ T5338] ? __ia32_sys_read+0xb0/0xb0 [ 129.357289][ T5338] ? lockdep_hardirqs_on+0x7d/0x100 [ 129.362559][ T5338] ? _raw_spin_unlock_irq+0x2e/0x50 [ 129.367833][ T5338] ? ptrace_notify+0xfe/0x140 [ 129.372585][ T5338] do_syscall_64+0x39/0xb0 [ 129.377087][ T5338] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 129.383070][ T5338] RIP: 0033:0x7faecf034129 [ 129.387543][ T5338] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 129.407220][ T5338] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 129.415716][ T5338] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 129.423744][ T5338] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 129.431774][ T5338] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [pid 5354] <... write resumed>) = 4 [ 129.439799][ T5338] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 129.447826][ T5338] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 000000000000000c [ 129.455878][ T5338] [ 129.462890][ T5338] memory: usage 8kB, limit 0kB, failcnt 36 [ 129.468771][ T5338] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 129.476012][ T5338] Memory cgroup stats for /syz1: [ 129.476311][ T5338] anon 0 [ 129.476311][ T5338] file 0 [ 129.476311][ T5338] kernel 8192 [pid 5336] close(3 [pid 5354] close(3) = 0 [pid 5354] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5354] mkdir("./file0", 000) = 0 [pid 5354] open("./file0", O_RDONLY) = 3 [pid 5354] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5354] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [ 129.476311][ T5338] kernel_stack 0 [ 129.476311][ T5338] pagetables 0 [ 129.476311][ T5338] sec_pagetables 0 [ 129.476311][ T5338] percpu 0 [ 129.476311][ T5338] sock 0 [ 129.476311][ T5338] vmalloc 0 [ 129.476311][ T5338] shmem 0 [ 129.476311][ T5338] zswap 0 [ 129.476311][ T5338] zswapped 0 [ 129.476311][ T5338] file_mapped 0 [ 129.476311][ T5338] file_dirty 0 [ 129.476311][ T5338] file_writeback 0 [ 129.476311][ T5338] swapcached 0 [ 129.476311][ T5338] anon_thp 0 [ 129.476311][ T5338] file_thp 0 [ 129.476311][ T5338] shmem_thp 0 [pid 5354] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5354] openat(5, "memory.max", O_RDWR) = 6 [pid 5354] write(6, "0x000000000000040e", 18 [pid 5336] <... close resumed>) = 0 [ 129.476311][ T5338] inactive_anon 0 [ 129.476311][ T5338] active_anon 0 [ 129.476311][ T5338] inactive_file 0 [ 129.476311][ T5338] active_file 0 [ 129.476311][ T5338] unevictable 0 [ 129.476311][ T5338] slab_reclaimable 6752 [ 129.476311][ T5338] slab_unreclaimable 0 [ 129.476311][ T5338] slab 6752 [ 129.476311][ T5338] workingset_refault_anon 0 [ 129.476311][ T5338] workingset_refault_file 0 [ 129.476311][ T5338] workingset_activate_anon 0 [ 129.476311][ T5338] workingset_activate_file 0 [ 129.476311][ T5338] workingset_restore_anon 0 [ 129.476311][ T5338] workingset_restore_file 0 [ 129.476311][ T5338] workingset_nodereclaim 0 [ 129.476311][ T5338] pgscan 831 [ 129.476311][ T5338] pgsteal 2 [ 129.476311][ T5338] pgscan_kswapd 0 [ 129.476311][ T5338] pgscan_direct 831 [ 129.476311][ T5338] pgscan_khugepaged 0 [ 129.476311][ T5338] pgsteal_kswapd 0 [ 129.476311][ T5338] pgsteal_direct 2 [ 129.476311][ T5338] pgsteal_khugepaged 0 [ 129.476311][ T5338] pgfault 21 [ 129.476311][ T5338] pgmajfault 0 [ 129.476311][ T5338] pgrefill 830 [ 129.476311][ T5338] pgactivate 829 [pid 5336] close(4) = 0 [pid 5336] close(5) = 0 [pid 5336] close(6) = 0 [pid 5336] close(7) = -1 EBADF (Bad file descriptor) [pid 5336] close(8) = -1 EBADF (Bad file descriptor) [pid 5336] close(9) = -1 EBADF (Bad file descriptor) [pid 5336] close(10) = -1 EBADF (Bad file descriptor) [pid 5336] close(11) = -1 EBADF (Bad file descriptor) [pid 5336] close(12) = -1 EBADF (Bad file descriptor) [pid 5336] close(13) = -1 EBADF (Bad file descriptor) [pid 5336] close(14) = -1 EBADF (Bad file descriptor) [pid 5336] close(15) = -1 EBADF (Bad file descriptor) [pid 5336] close(16) = -1 EBADF (Bad file descriptor) [pid 5336] close(17) = -1 EBADF (Bad file descriptor) [pid 5336] close(18) = -1 EBADF (Bad file descriptor) [pid 5336] close(19) = -1 EBADF (Bad file descriptor) [pid 5336] close(20) = -1 EBADF (Bad file descriptor) [pid 5336] close(21) = -1 EBADF (Bad file descriptor) [pid 5336] close(22) = -1 EBADF (Bad file descriptor) [ 129.476311][ T5338] pgdeactivate 830 [ 129.476311][ T5338] pglazyfree 0 [ 129.476311][ T5338] pglazyfreed 0 [ 129.476311][ T5338] zswpin 0 [ 129.476311][ T5338] zswpout 0 [ 129.476311][ T5338] thp_fault_alloc 0 [ 129.476311][ T5338] thp_collapse_alloc 0 [pid 5336] close(23) = -1 EBADF (Bad file descriptor) [pid 5336] close(24) = -1 EBADF (Bad file descriptor) [pid 5336] close(25) = -1 EBADF (Bad file descriptor) [pid 5336] close(26) = -1 EBADF (Bad file descriptor) [pid 5336] close(27) = -1 EBADF (Bad file descriptor) [pid 5336] close(28) = -1 EBADF (Bad file descriptor) [pid 5336] close(29) = -1 EBADF (Bad file descriptor) [pid 5336] exit_group(0) = ? [pid 5336] +++ exited with 0 +++ [pid 5087] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=12, si_uid=0, si_status=0, si_utime=0, si_stime=12 /* 0.12 s */} --- [pid 5338] <... write resumed>) = 18 [ 129.699430][ T5338] Tasks state (memory values in pages): [ 129.706014][ T5338] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 129.724750][ T5338] Out of memory and no killable processes... [ 129.732000][ T5344] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 129.751731][ T5344] CPU: 0 PID: 5344 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 129.761728][ T5344] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 129.771831][ T5344] Call Trace: [ 129.775154][ T5344] [ 129.778130][ T5344] dump_stack_lvl+0x136/0x150 [ 129.782895][ T5344] dump_header+0x10a/0xd70 [ 129.787375][ T5344] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 129.793521][ T5344] out_of_memory+0xd64/0x1660 [ 129.798251][ T5344] ? oom_killer_disable+0x2b0/0x2b0 [ 129.803495][ T5344] ? find_held_lock+0x2d/0x110 [ 129.808290][ T5344] mem_cgroup_out_of_memory+0x206/0x270 [ 129.813875][ T5344] ? mem_cgroup_margin+0x130/0x130 [ 129.819034][ T5344] ? _raw_spin_unlock_irqrestore+0x54/0x70 [ 129.824914][ T5344] memory_max_write+0x2f9/0x3c0 [ 129.829825][ T5344] ? mem_cgroup_force_empty_write+0x160/0x160 [ 129.835952][ T5344] ? lock_sync+0x190/0x190 [ 129.840426][ T5344] cgroup_file_write+0x1e2/0x7b0 [ 129.845436][ T5344] ? mem_cgroup_force_empty_write+0x160/0x160 [ 129.851552][ T5344] ? kill_css+0x3b0/0x3b0 [ 129.855934][ T5344] ? lock_acquire+0x32/0xc0 [ 129.860482][ T5344] ? kill_css+0x3b0/0x3b0 [ 129.864866][ T5344] kernfs_fop_write_iter+0x3f1/0x600 [ 129.870329][ T5344] vfs_write+0x9ed/0xe10 [ 129.874651][ T5344] ? kernel_write+0x670/0x670 [ 129.879390][ T5344] ? find_held_lock+0x2d/0x110 [ 129.884208][ T5344] ? __fget_light+0x20a/0x270 [ 129.888953][ T5344] ksys_write+0x12b/0x250 [ 129.893344][ T5344] ? __ia32_sys_read+0xb0/0xb0 [ 129.898158][ T5344] ? lockdep_hardirqs_on+0x7d/0x100 [ 129.903405][ T5344] ? _raw_spin_unlock_irq+0x2e/0x50 [ 129.908660][ T5344] ? ptrace_notify+0xfe/0x140 [ 129.913400][ T5344] do_syscall_64+0x39/0xb0 [ 129.917896][ T5344] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 129.923841][ T5344] RIP: 0033:0x7faecf034129 [ 129.928296][ T5344] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 5338] close(3) = 0 [ 129.947953][ T5344] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 129.956400][ T5344] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 129.964397][ T5344] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 129.972405][ T5344] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 129.980403][ T5344] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 129.988401][ T5344] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 000000000000000c [ 129.996429][ T5344] [pid 5338] close(4) = 0 [pid 5338] close(5) = 0 [pid 5338] close(6) = 0 [pid 5338] close(7) = -1 EBADF (Bad file descriptor) [pid 5338] close(8) = -1 EBADF (Bad file descriptor) [pid 5338] close(9) = -1 EBADF (Bad file descriptor) [pid 5338] close(10) = -1 EBADF (Bad file descriptor) [pid 5338] close(11) = -1 EBADF (Bad file descriptor) [pid 5338] close(12) = -1 EBADF (Bad file descriptor) [pid 5338] close(13) = -1 EBADF (Bad file descriptor) [pid 5338] close(14) = -1 EBADF (Bad file descriptor) [pid 5338] close(15) = -1 EBADF (Bad file descriptor) [pid 5338] close(16) = -1 EBADF (Bad file descriptor) [pid 5338] close(17) = -1 EBADF (Bad file descriptor) [pid 5338] close(18) = -1 EBADF (Bad file descriptor) [pid 5338] close(19) = -1 EBADF (Bad file descriptor) [pid 5338] close(20) = -1 EBADF (Bad file descriptor) [pid 5338] close(21) = -1 EBADF (Bad file descriptor) [pid 5338] close(22) = -1 EBADF (Bad file descriptor) [pid 5338] close(23) = -1 EBADF (Bad file descriptor) [pid 5338] close(24) = -1 EBADF (Bad file descriptor) [pid 5338] close(25) = -1 EBADF (Bad file descriptor) [pid 5338] close(26) = -1 EBADF (Bad file descriptor) [pid 5338] close(27) = -1 EBADF (Bad file descriptor) [pid 5338] close(28 [pid 5087] umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5338] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5338] close(29) = -1 EBADF (Bad file descriptor) [pid 5087] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5338] exit_group(0 [pid 5087] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5338] <... exit_group resumed>) = ? [pid 5338] +++ exited with 0 +++ [pid 5087] <... openat resumed>) = 3 [pid 5087] fstat(3, [pid 5090] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=14, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- [pid 5090] umount2("./12", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5090] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5087] getdents64(3, [pid 5090] <... openat resumed>) = 3 [pid 5090] fstat(3, [pid 5087] <... getdents64 resumed>0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5090] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5087] umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5090] getdents64(3, [pid 5087] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5090] <... getdents64 resumed>0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5087] lstat("./10/binderfs", [pid 5090] umount2("./12/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5087] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5090] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5087] unlink("./10/binderfs" [pid 5090] lstat("./12/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5087] <... unlink resumed>) = 0 [pid 5090] unlink("./12/binderfs" [pid 5087] umount2("./10/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5090] <... unlink resumed>) = 0 [pid 5087] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5090] umount2("./12/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5087] lstat("./10/cgroup", [pid 5090] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5087] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5090] lstat("./12/cgroup", [pid 5087] unlink("./10/cgroup" [pid 5090] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5090] unlink("./12/cgroup" [pid 5087] <... unlink resumed>) = 0 [pid 5090] <... unlink resumed>) = 0 [pid 5087] umount2("./10/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5090] umount2("./12/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5087] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5090] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./10/cgroup.net", [pid 5090] lstat("./12/cgroup.net", [pid 5087] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5090] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5087] unlink("./10/cgroup.net" [pid 5090] unlink("./12/cgroup.net") = 0 [pid 5087] <... unlink resumed>) = 0 [pid 5090] umount2("./12/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5087] umount2("./10/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5090] <... umount2 resumed>) = 0 [pid 5090] umount2("./12/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5087] <... umount2 resumed>) = 0 [pid 5090] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5087] umount2("./10/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5090] lstat("./12/file0", [pid 5087] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5090] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [ 130.009264][ T5344] memory: usage 8kB, limit 0kB, failcnt 36 [pid 5087] lstat("./10/file0", [pid 5090] umount2("./12/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5087] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5090] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5087] umount2("./10/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5090] openat(AT_FDCWD, "./12/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5090] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5090] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5090] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5090] close(4) = 0 [pid 5090] rmdir("./12/file0") = 0 [pid 5090] umount2("./12/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./12/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5087] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5090] unlink("./12/cgroup.cpu" [pid 5087] openat(AT_FDCWD, "./10/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5090] <... unlink resumed>) = 0 [pid 5090] getdents64(3, [pid 5087] <... openat resumed>) = 4 [pid 5090] <... getdents64 resumed>0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5087] fstat(4, [pid 5090] close(3 [pid 5087] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5090] <... close resumed>) = 0 [pid 5087] getdents64(4, [pid 5090] rmdir("./12") = 0 [pid 5087] <... getdents64 resumed>0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5090] mkdir("./13", 0777 [pid 5087] getdents64(4, [pid 5090] <... mkdir resumed>) = 0 [pid 5087] <... getdents64 resumed>0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5090] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5087] close(4./strace-static-x86_64: Process 5361 attached ) = 0 [pid 5361] chdir("./13" [pid 5090] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 15 [pid 5087] rmdir("./10/file0" [pid 5361] <... chdir resumed>) = 0 [pid 5361] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5087] <... rmdir resumed>) = 0 [pid 5361] <... prctl resumed>) = 0 [pid 5087] umount2("./10/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5361] setpgid(0, 0 [pid 5087] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5361] <... setpgid resumed>) = 0 [pid 5087] lstat("./10/cgroup.cpu", [pid 5361] symlink("/syzcgroup/unified/syz4", "./cgroup" [pid 5087] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5361] <... symlink resumed>) = 0 [pid 5087] unlink("./10/cgroup.cpu" [pid 5361] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu" [pid 5087] <... unlink resumed>) = 0 [pid 5361] <... symlink resumed>) = 0 [ 130.049762][ T5344] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [pid 5087] getdents64(3, [pid 5361] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [pid 5361] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5361] write(3, "1000", 4) = 4 [pid 5361] close(3) = 0 [pid 5361] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5361] mkdir("./file0", 000) = 0 [pid 5361] open("./file0", O_RDONLY) = 3 [pid 5361] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5361] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5361] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5361] openat(5, "memory.max", O_RDWR) = 6 [ 130.091570][ T5344] Memory cgroup stats for /syz1: [ 130.092021][ T5344] anon 0 [ 130.092021][ T5344] file 0 [ 130.092021][ T5344] kernel 8192 [ 130.092021][ T5344] kernel_stack 0 [ 130.092021][ T5344] pagetables 0 [ 130.092021][ T5344] sec_pagetables 0 [ 130.092021][ T5344] percpu 0 [ 130.092021][ T5344] sock 0 [ 130.092021][ T5344] vmalloc 0 [ 130.092021][ T5344] shmem 0 [ 130.092021][ T5344] zswap 0 [ 130.092021][ T5344] zswapped 0 [ 130.092021][ T5344] file_mapped 0 [ 130.092021][ T5344] file_dirty 0 [ 130.092021][ T5344] file_writeback 0 [ 130.092021][ T5344] swapcached 0 [ 130.092021][ T5344] anon_thp 0 [ 130.092021][ T5344] file_thp 0 [ 130.092021][ T5344] shmem_thp 0 [ 130.092021][ T5344] inactive_anon 0 [ 130.092021][ T5344] active_anon 0 [ 130.092021][ T5344] inactive_file 0 [ 130.092021][ T5344] active_file 0 [ 130.092021][ T5344] unevictable 0 [ 130.092021][ T5344] slab_reclaimable 6752 [ 130.092021][ T5344] slab_unreclaimable 0 [ 130.092021][ T5344] slab 6752 [ 130.092021][ T5344] workingset_refault_anon 0 [ 130.092021][ T5344] workingset_refault_file 0 [ 130.092021][ T5344] workingset_activate_anon 0 [ 130.092021][ T5344] workingset_activate_file 0 [ 130.092021][ T5344] workingset_restore_anon 0 [ 130.092021][ T5344] workingset_restore_file 0 [ 130.092021][ T5344] workingset_nodereclaim 0 [ 130.092021][ T5344] pgscan 831 [ 130.092021][ T5344] pgsteal 2 [ 130.092021][ T5344] pgscan_kswapd 0 [ 130.092021][ T5344] pgscan_direct 831 [ 130.092021][ T5344] pgscan_khugepaged 0 [ 130.092021][ T5344] pgsteal_kswapd 0 [ 130.092021][ T5344] pgsteal_direct 2 [ 130.092021][ T5344] pgsteal_khugepaged 0 [pid 5361] write(6, "0x000000000000040e", 18 [pid 5087] <... getdents64 resumed>0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5087] close(3) = 0 [pid 5087] rmdir("./10") = 0 [pid 5087] mkdir("./11", 0777) = 0 [pid 5087] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5362 attached [ 130.092021][ T5344] pgfault 21 [ 130.092021][ T5344] pgmajfault 0 [ 130.092021][ T5344] pgrefill 830 [ 130.092021][ T5344] pgactivate 829 [ 130.092021][ T5344] pgdeactivate 830 [ 130.092021][ T5344] pglazyfree 0 [ 130.092021][ T5344] pglazyfreed 0 [ 130.092021][ T5344] zswpin 0 [ 130.092021][ T5344] zswpout 0 [ 130.092021][ T5344] thp_fault_alloc 0 [ 130.092021][ T5344] thp_collapse_alloc 0 , child_tidptr=0x555555c0c5d0) = 13 [pid 5362] chdir("./11") = 0 [pid 5362] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [ 130.305721][ T5344] Tasks state (memory values in pages): [ 130.311360][ T5344] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 130.332510][ T5344] Out of memory and no killable processes... [ 130.338761][ T5349] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5362] setpgid(0, 0 [pid 5344] <... write resumed>) = 18 [ 130.358357][ T5349] CPU: 1 PID: 5349 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 130.368336][ T5349] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 130.378452][ T5349] Call Trace: [ 130.381778][ T5349] [ 130.384752][ T5349] dump_stack_lvl+0x136/0x150 [ 130.389498][ T5349] dump_header+0x10a/0xd70 [ 130.393984][ T5349] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 130.400142][ T5349] out_of_memory+0xd64/0x1660 [pid 5362] <... setpgid resumed>) = 0 [pid 5362] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 5362] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 5362] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 5362] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5362] write(3, "1000", 4) = 4 [pid 5362] close(3) = 0 [pid 5362] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5362] mkdir("./file0", 000) = 0 [pid 5362] open("./file0", O_RDONLY) = 3 [pid 5362] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5362] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5362] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5362] openat(5, "memory.max", O_RDWR) = 6 [ 130.404950][ T5349] ? oom_killer_disable+0x2b0/0x2b0 [ 130.410226][ T5349] ? find_held_lock+0x2d/0x110 [ 130.415064][ T5349] mem_cgroup_out_of_memory+0x206/0x270 [ 130.420697][ T5349] ? mem_cgroup_margin+0x130/0x130 [ 130.425895][ T5349] ? _raw_spin_unlock_irqrestore+0x54/0x70 [ 130.431818][ T5349] memory_max_write+0x2f9/0x3c0 [ 130.436754][ T5349] ? mem_cgroup_force_empty_write+0x160/0x160 [ 130.442915][ T5349] ? lock_sync+0x190/0x190 [ 130.447416][ T5349] cgroup_file_write+0x1e2/0x7b0 [ 130.452445][ T5349] ? mem_cgroup_force_empty_write+0x160/0x160 [ 130.458605][ T5349] ? kill_css+0x3b0/0x3b0 [ 130.463021][ T5349] ? lock_acquire+0x32/0xc0 [ 130.467611][ T5349] ? kill_css+0x3b0/0x3b0 [ 130.472011][ T5349] kernfs_fop_write_iter+0x3f1/0x600 [ 130.477384][ T5349] vfs_write+0x9ed/0xe10 [ 130.481717][ T5349] ? kernel_write+0x670/0x670 [ 130.486470][ T5349] ? find_held_lock+0x2d/0x110 [ 130.491322][ T5349] ? __fget_light+0x20a/0x270 [ 130.496084][ T5349] ksys_write+0x12b/0x250 [ 130.500489][ T5349] ? __ia32_sys_read+0xb0/0xb0 [pid 5362] write(6, "0x000000000000040e", 18 [pid 5344] close(3) = 0 [pid 5344] close(4) = 0 [pid 5344] close(5) = 0 [pid 5344] close(6) = 0 [pid 5344] close(7) = -1 EBADF (Bad file descriptor) [pid 5344] close(8) = -1 EBADF (Bad file descriptor) [pid 5344] close(9) = -1 EBADF (Bad file descriptor) [pid 5344] close(10) = -1 EBADF (Bad file descriptor) [pid 5344] close(11) = -1 EBADF (Bad file descriptor) [pid 5344] close(12) = -1 EBADF (Bad file descriptor) [pid 5344] close(13) = -1 EBADF (Bad file descriptor) [pid 5344] close(14) = -1 EBADF (Bad file descriptor) [pid 5344] close(15) = -1 EBADF (Bad file descriptor) [pid 5344] close(16) = -1 EBADF (Bad file descriptor) [pid 5344] close(17) = -1 EBADF (Bad file descriptor) [pid 5344] close(18) = -1 EBADF (Bad file descriptor) [ 130.505330][ T5349] ? lockdep_hardirqs_on+0x7d/0x100 [ 130.510595][ T5349] ? _raw_spin_unlock_irq+0x2e/0x50 [ 130.515878][ T5349] ? ptrace_notify+0xfe/0x140 [ 130.520632][ T5349] do_syscall_64+0x39/0xb0 [ 130.525137][ T5349] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 130.531108][ T5349] RIP: 0033:0x7faecf034129 [ 130.535578][ T5349] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 5344] close(19) = -1 EBADF (Bad file descriptor) [pid 5344] close(20) = -1 EBADF (Bad file descriptor) [pid 5344] close(21) = -1 EBADF (Bad file descriptor) [pid 5344] close(22) = -1 EBADF (Bad file descriptor) [pid 5344] close(23) = -1 EBADF (Bad file descriptor) [pid 5344] close(24) = -1 EBADF (Bad file descriptor) [pid 5344] close(25) = -1 EBADF (Bad file descriptor) [pid 5344] close(26) = -1 EBADF (Bad file descriptor) [pid 5344] close(27) = -1 EBADF (Bad file descriptor) [pid 5344] close(28) = -1 EBADF (Bad file descriptor) [pid 5344] close(29) = -1 EBADF (Bad file descriptor) [pid 5344] exit_group(0) = ? [pid 5344] +++ exited with 0 +++ [pid 5089] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=14, si_uid=0, si_status=0, si_utime=0, si_stime=9 /* 0.09 s */} --- [pid 5089] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5089] umount2("./12", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5089] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5089] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5089] umount2("./12/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./12/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5089] unlink("./12/binderfs") = 0 [pid 5089] umount2("./12/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./12/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [ 130.555261][ T5349] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 130.563748][ T5349] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 130.571782][ T5349] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 130.579821][ T5349] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 130.587857][ T5349] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 130.595893][ T5349] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000009 [ 130.603959][ T5349] [pid 5089] unlink("./12/cgroup") = 0 [pid 5089] umount2("./12/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./12/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5089] unlink("./12/cgroup.net") = 0 [pid 5089] umount2("./12/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5089] umount2("./12/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./12/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5089] umount2("./12/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] openat(AT_FDCWD, "./12/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5089] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5089] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5089] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5089] close(4) = 0 [pid 5089] rmdir("./12/file0") = 0 [pid 5089] umount2("./12/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./12/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5089] unlink("./12/cgroup.cpu") = 0 [pid 5089] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [ 130.679063][ T5349] memory: usage 8kB, limit 0kB, failcnt 36 [ 130.685216][ T5349] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 130.692437][ T5349] Memory cgroup stats for /syz1: [ 130.692727][ T5349] anon 0 [ 130.692727][ T5349] file 0 [ 130.692727][ T5349] kernel 8192 [ 130.692727][ T5349] kernel_stack 0 [ 130.692727][ T5349] pagetables 0 [ 130.692727][ T5349] sec_pagetables 0 [ 130.692727][ T5349] percpu 0 [ 130.692727][ T5349] sock 0 [ 130.692727][ T5349] vmalloc 0 [ 130.692727][ T5349] shmem 0 [pid 5089] close(3) = 0 [pid 5089] rmdir("./12") = 0 [pid 5089] mkdir("./13", 0777) = 0 [pid 5089] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5367 attached [pid 5367] chdir("./13" [pid 5089] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 15 [pid 5367] <... chdir resumed>) = 0 [pid 5367] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5367] setpgid(0, 0) = 0 [pid 5367] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 5367] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [ 130.692727][ T5349] zswap 0 [ 130.692727][ T5349] zswapped 0 [ 130.692727][ T5349] file_mapped 0 [ 130.692727][ T5349] file_dirty 0 [ 130.692727][ T5349] file_writeback 0 [ 130.692727][ T5349] swapcached 0 [ 130.692727][ T5349] anon_thp 0 [ 130.692727][ T5349] file_thp 0 [ 130.692727][ T5349] shmem_thp 0 [ 130.692727][ T5349] inactive_anon 0 [ 130.692727][ T5349] active_anon 0 [ 130.692727][ T5349] inactive_file 0 [ 130.692727][ T5349] active_file 0 [ 130.692727][ T5349] unevictable 0 [ 130.692727][ T5349] slab_reclaimable 6752 [pid 5367] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 5367] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5367] write(3, "1000", 4) = 4 [pid 5367] close(3) = 0 [pid 5367] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5367] mkdir("./file0", 000) = 0 [pid 5367] open("./file0", O_RDONLY) = 3 [pid 5367] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5367] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5367] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5367] openat(5, "memory.max", O_RDWR) = 6 [ 130.692727][ T5349] slab_unreclaimable 0 [ 130.692727][ T5349] slab 6752 [ 130.692727][ T5349] workingset_refault_anon 0 [ 130.692727][ T5349] workingset_refault_file 0 [ 130.692727][ T5349] workingset_activate_anon 0 [ 130.692727][ T5349] workingset_activate_file 0 [ 130.692727][ T5349] workingset_restore_anon 0 [ 130.692727][ T5349] workingset_restore_file 0 [ 130.692727][ T5349] workingset_nodereclaim 0 [ 130.692727][ T5349] pgscan 831 [ 130.692727][ T5349] pgsteal 2 [ 130.692727][ T5349] pgscan_kswapd 0 [ 130.692727][ T5349] pgscan_direct 831 [ 130.692727][ T5349] pgscan_khugepaged 0 [ 130.692727][ T5349] pgsteal_kswapd 0 [ 130.692727][ T5349] pgsteal_direct 2 [ 130.692727][ T5349] pgsteal_khugepaged 0 [ 130.692727][ T5349] pgfault 21 [ 130.692727][ T5349] pgmajfault 0 [ 130.692727][ T5349] pgrefill 830 [ 130.692727][ T5349] pgactivate 829 [ 130.692727][ T5349] pgdeactivate 830 [ 130.692727][ T5349] pglazyfree 0 [ 130.692727][ T5349] pglazyfreed 0 [ 130.692727][ T5349] zswpin 0 [ 130.692727][ T5349] zswpout 0 [ 130.692727][ T5349] thp_fault_alloc 0 [ 130.692727][ T5349] thp_collapse_alloc 0 [pid 5367] write(6, "0x000000000000040e", 18 [pid 5349] <... write resumed>) = 18 [pid 5349] close(3) = 0 [pid 5349] close(4) = 0 [pid 5349] close(5) = 0 [pid 5349] close(6) = 0 [pid 5349] close(7) = -1 EBADF (Bad file descriptor) [pid 5349] close(8) = -1 EBADF (Bad file descriptor) [pid 5349] close(9) = -1 EBADF (Bad file descriptor) [pid 5349] close(10) = -1 EBADF (Bad file descriptor) [pid 5349] close(11) = -1 EBADF (Bad file descriptor) [pid 5349] close(12) = -1 EBADF (Bad file descriptor) [pid 5349] close(13) = -1 EBADF (Bad file descriptor) [pid 5349] close(14) = -1 EBADF (Bad file descriptor) [pid 5349] close(15) = -1 EBADF (Bad file descriptor) [ 130.934297][ T5349] Tasks state (memory values in pages): [ 130.940308][ T5349] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 130.952452][ T5349] Out of memory and no killable processes... [ 130.961051][ T5354] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5349] close(16) = -1 EBADF (Bad file descriptor) [pid 5349] close(17) = -1 EBADF (Bad file descriptor) [pid 5349] close(18) = -1 EBADF (Bad file descriptor) [pid 5349] close(19) = -1 EBADF (Bad file descriptor) [pid 5349] close(20) = -1 EBADF (Bad file descriptor) [pid 5349] close(21) = -1 EBADF (Bad file descriptor) [pid 5349] close(22) = -1 EBADF (Bad file descriptor) [pid 5349] close(23) = -1 EBADF (Bad file descriptor) [pid 5349] close(24) = -1 EBADF (Bad file descriptor) [pid 5349] close(25) = -1 EBADF (Bad file descriptor) [pid 5349] close(26) = -1 EBADF (Bad file descriptor) [pid 5349] close(27) = -1 EBADF (Bad file descriptor) [pid 5349] close(28) = -1 EBADF (Bad file descriptor) [pid 5349] close(29) = -1 EBADF (Bad file descriptor) [pid 5349] exit_group(0) = ? [pid 5349] +++ exited with 0 +++ [pid 5086] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=11, si_uid=0, si_status=0, si_utime=0, si_stime=7 /* 0.07 s */} --- [pid 5086] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5086] umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5086] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [ 131.001887][ T5354] CPU: 1 PID: 5354 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 131.011881][ T5354] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 131.021992][ T5354] Call Trace: [ 131.025316][ T5354] [ 131.028301][ T5354] dump_stack_lvl+0x136/0x150 [ 131.033053][ T5354] dump_header+0x10a/0xd70 [ 131.037546][ T5354] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 131.043706][ T5354] out_of_memory+0xd64/0x1660 [pid 5086] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5086] umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./9/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5086] unlink("./9/binderfs") = 0 [pid 5086] umount2("./9/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./9/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5086] unlink("./9/cgroup") = 0 [pid 5086] umount2("./9/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./9/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5086] unlink("./9/cgroup.net") = 0 [ 131.048467][ T5354] ? oom_killer_disable+0x2b0/0x2b0 [ 131.053761][ T5354] mem_cgroup_out_of_memory+0x206/0x270 [ 131.059387][ T5354] ? mem_cgroup_margin+0x130/0x130 [ 131.064608][ T5354] memory_max_write+0x2f9/0x3c0 [ 131.069560][ T5354] ? mem_cgroup_force_empty_write+0x160/0x160 [ 131.075713][ T5354] ? lock_sync+0x190/0x190 [ 131.080208][ T5354] cgroup_file_write+0x1e2/0x7b0 [ 131.085234][ T5354] ? mem_cgroup_force_empty_write+0x160/0x160 [ 131.091398][ T5354] ? kill_css+0x3b0/0x3b0 [ 131.095807][ T5354] ? lock_acquire+0x32/0xc0 [ 131.100394][ T5354] ? kill_css+0x3b0/0x3b0 [ 131.104794][ T5354] kernfs_fop_write_iter+0x3f1/0x600 [ 131.110154][ T5354] vfs_write+0x9ed/0xe10 [ 131.114477][ T5354] ? kernel_write+0x670/0x670 [ 131.119241][ T5354] ? find_held_lock+0x2d/0x110 [ 131.124085][ T5354] ? __fget_light+0x20a/0x270 [ 131.128848][ T5354] ksys_write+0x12b/0x250 [ 131.133259][ T5354] ? __ia32_sys_read+0xb0/0xb0 [ 131.138110][ T5354] ? lockdep_hardirqs_on+0x7d/0x100 [ 131.143379][ T5354] ? _raw_spin_unlock_irq+0x2e/0x50 [ 131.148648][ T5354] ? ptrace_notify+0xfe/0x140 [ 131.153402][ T5354] do_syscall_64+0x39/0xb0 [ 131.157905][ T5354] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 131.163886][ T5354] RIP: 0033:0x7faecf034129 [ 131.168356][ T5354] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 131.188028][ T5354] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 131.196512][ T5354] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 131.204545][ T5354] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 131.212571][ T5354] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 131.220599][ T5354] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 131.228633][ T5354] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000009 [ 131.236690][ T5354] [pid 5086] umount2("./9/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5086] umount2("./9/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./9/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5086] umount2("./9/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] openat(AT_FDCWD, "./9/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5086] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5086] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5086] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5086] close(4) = 0 [ 131.250010][ T5354] memory: usage 8kB, limit 0kB, failcnt 36 [ 131.256084][ T5354] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 131.263673][ T5354] Memory cgroup stats for /syz1: [ 131.263955][ T5354] anon 0 [ 131.263955][ T5354] file 0 [ 131.263955][ T5354] kernel 8192 [ 131.263955][ T5354] kernel_stack 0 [ 131.263955][ T5354] pagetables 0 [ 131.263955][ T5354] sec_pagetables 0 [ 131.263955][ T5354] percpu 0 [ 131.263955][ T5354] sock 0 [ 131.263955][ T5354] vmalloc 0 [ 131.263955][ T5354] shmem 0 [ 131.263955][ T5354] zswap 0 [ 131.263955][ T5354] zswapped 0 [ 131.263955][ T5354] file_mapped 0 [ 131.263955][ T5354] file_dirty 0 [ 131.263955][ T5354] file_writeback 0 [ 131.263955][ T5354] swapcached 0 [ 131.263955][ T5354] anon_thp 0 [ 131.263955][ T5354] file_thp 0 [ 131.263955][ T5354] shmem_thp 0 [ 131.263955][ T5354] inactive_anon 0 [ 131.263955][ T5354] active_anon 0 [ 131.263955][ T5354] inactive_file 0 [ 131.263955][ T5354] active_file 0 [ 131.263955][ T5354] unevictable 0 [ 131.263955][ T5354] slab_reclaimable 6752 [ 131.263955][ T5354] slab_unreclaimable 0 [ 131.263955][ T5354] slab 6752 [ 131.263955][ T5354] workingset_refault_anon 0 [ 131.263955][ T5354] workingset_refault_file 0 [ 131.263955][ T5354] workingset_activate_anon 0 [ 131.263955][ T5354] workingset_activate_file 0 [ 131.263955][ T5354] workingset_restore_anon 0 [ 131.263955][ T5354] workingset_restore_file 0 [ 131.263955][ T5354] workingset_nodereclaim 0 [ 131.263955][ T5354] pgscan 831 [ 131.263955][ T5354] pgsteal 2 [ 131.263955][ T5354] pgscan_kswapd 0 [ 131.263955][ T5354] pgscan_direct 831 [ 131.263955][ T5354] pgscan_khugepaged 0 [pid 5086] rmdir("./9/file0") = 0 [ 131.263955][ T5354] pgsteal_kswapd 0 [ 131.263955][ T5354] pgsteal_direct 2 [ 131.263955][ T5354] pgsteal_khugepaged 0 [ 131.263955][ T5354] pgfault 21 [ 131.263955][ T5354] pgmajfault 0 [ 131.263955][ T5354] pgrefill 830 [ 131.263955][ T5354] pgactivate 829 [ 131.263955][ T5354] pgdeactivate 830 [ 131.263955][ T5354] pglazyfree 0 [ 131.263955][ T5354] pglazyfreed 0 [ 131.263955][ T5354] zswpin 0 [ 131.263955][ T5354] zswpout 0 [ 131.263955][ T5354] thp_fault_alloc 0 [ 131.263955][ T5354] thp_collapse_alloc 0 [pid 5086] umount2("./9/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./9/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5086] unlink("./9/cgroup.cpu") = 0 [pid 5086] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5086] close(3) = 0 [pid 5354] <... write resumed>) = 18 [pid 5354] close(3) = 0 [pid 5354] close(4) = 0 [pid 5354] close(5) = 0 [pid 5354] close(6) = 0 [pid 5354] close(7) = -1 EBADF (Bad file descriptor) [pid 5354] close(8) = -1 EBADF (Bad file descriptor) [pid 5354] close(9) = -1 EBADF (Bad file descriptor) [pid 5354] close(10) = -1 EBADF (Bad file descriptor) [pid 5354] close(11) = -1 EBADF (Bad file descriptor) [pid 5354] close(12) = -1 EBADF (Bad file descriptor) [pid 5354] close(13) = -1 EBADF (Bad file descriptor) [pid 5354] close(14) = -1 EBADF (Bad file descriptor) [pid 5354] close(15) = -1 EBADF (Bad file descriptor) [pid 5354] close(16) = -1 EBADF (Bad file descriptor) [pid 5354] close(17) = -1 EBADF (Bad file descriptor) [pid 5354] close(18) = -1 EBADF (Bad file descriptor) [pid 5354] close(19) = -1 EBADF (Bad file descriptor) [pid 5354] close(20) = -1 EBADF (Bad file descriptor) [pid 5354] close(21) = -1 EBADF (Bad file descriptor) [pid 5354] close(22) = -1 EBADF (Bad file descriptor) [pid 5354] close(23) = -1 EBADF (Bad file descriptor) [pid 5354] close(24) = -1 EBADF (Bad file descriptor) [pid 5354] close(25) = -1 EBADF (Bad file descriptor) [pid 5354] close(26) = -1 EBADF (Bad file descriptor) [pid 5354] close(27) = -1 EBADF (Bad file descriptor) [pid 5354] close(28) = -1 EBADF (Bad file descriptor) [pid 5354] close(29) = -1 EBADF (Bad file descriptor) [pid 5354] exit_group(0) = ? [pid 5354] +++ exited with 0 +++ [pid 5086] rmdir("./9") = 0 [pid 5085] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=11, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- [pid 5086] mkdir("./10", 0777 [pid 5085] restart_syscall(<... resuming interrupted clone ...> [pid 5086] <... mkdir resumed>) = 0 [pid 5085] <... restart_syscall resumed>) = 0 [pid 5086] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5085] umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5085] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5085] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5085] umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./9/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5085] unlink("./9/binderfs") = 0 [ 131.463731][ T5354] Tasks state (memory values in pages): [ 131.469356][ T5354] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 131.479437][ T5354] Out of memory and no killable processes... [ 131.485963][ T5361] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 131.526136][ T5361] CPU: 0 PID: 5361 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 131.536130][ T5361] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 131.546239][ T5361] Call Trace: [ 131.549563][ T5361] [ 131.552538][ T5361] dump_stack_lvl+0x136/0x150 [ 131.557296][ T5361] dump_header+0x10a/0xd70 [ 131.561774][ T5361] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 131.567942][ T5361] out_of_memory+0xd64/0x1660 [pid 5085] umount2("./9/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5371 attached [pid 5371] chdir("./10") = 0 [pid 5371] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5371] setpgid(0, 0) = 0 [pid 5371] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [pid 5371] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 5371] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 5371] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5371] write(3, "1000", 4) = 4 [pid 5371] close(3) = 0 [pid 5371] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5371] mkdir("./file0", 000) = 0 [pid 5371] open("./file0", O_RDONLY) = 3 [pid 5371] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5371] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5371] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5371] openat(5, "memory.max", O_RDWR) = 6 [pid 5371] write(6, "0x000000000000040e", 18 [pid 5085] lstat("./9/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5085] unlink("./9/cgroup") = 0 [pid 5085] umount2("./9/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./9/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5085] unlink("./9/cgroup.net") = 0 [pid 5085] umount2("./9/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5086] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 12 [ 131.572709][ T5361] ? oom_killer_disable+0x2b0/0x2b0 [ 131.577985][ T5361] ? find_held_lock+0x2d/0x110 [ 131.582818][ T5361] mem_cgroup_out_of_memory+0x206/0x270 [ 131.588444][ T5361] ? mem_cgroup_margin+0x130/0x130 [ 131.593649][ T5361] ? _raw_spin_unlock_irqrestore+0x54/0x70 [ 131.599550][ T5361] memory_max_write+0x2f9/0x3c0 [ 131.604486][ T5361] ? mem_cgroup_force_empty_write+0x160/0x160 [ 131.610644][ T5361] ? lock_sync+0x190/0x190 [ 131.615140][ T5361] cgroup_file_write+0x1e2/0x7b0 [ 131.620170][ T5361] ? mem_cgroup_force_empty_write+0x160/0x160 [ 131.626320][ T5361] ? kill_css+0x3b0/0x3b0 [ 131.630746][ T5361] ? lock_acquire+0x32/0xc0 [ 131.635330][ T5361] ? kill_css+0x3b0/0x3b0 [ 131.639733][ T5361] kernfs_fop_write_iter+0x3f1/0x600 [ 131.645151][ T5361] vfs_write+0x9ed/0xe10 [ 131.649482][ T5361] ? kernel_write+0x670/0x670 [ 131.654245][ T5361] ? find_held_lock+0x2d/0x110 [ 131.659120][ T5361] ? __fget_light+0x20a/0x270 [ 131.663875][ T5361] ksys_write+0x12b/0x250 [ 131.668289][ T5361] ? __ia32_sys_read+0xb0/0xb0 [ 131.673147][ T5361] ? lockdep_hardirqs_on+0x7d/0x100 [ 131.678501][ T5361] ? _raw_spin_unlock_irq+0x2e/0x50 [ 131.683770][ T5361] ? ptrace_notify+0xfe/0x140 [ 131.688517][ T5361] do_syscall_64+0x39/0xb0 [ 131.693022][ T5361] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 131.698990][ T5361] RIP: 0033:0x7faecf034129 [ 131.703457][ T5361] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 5085] <... umount2 resumed>) = 0 [pid 5085] umount2("./9/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./9/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [ 131.723125][ T5361] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 131.731607][ T5361] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 131.739633][ T5361] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 131.747751][ T5361] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 131.755776][ T5361] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 131.763800][ T5361] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 000000000000000d [ 131.771859][ T5361] [pid 5085] umount2("./9/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] openat(AT_FDCWD, "./9/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5085] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5085] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5085] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5085] close(4) = 0 [pid 5085] rmdir("./9/file0") = 0 [pid 5085] umount2("./9/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./9/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5085] unlink("./9/cgroup.cpu") = 0 [pid 5085] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5085] close(3) = 0 [pid 5085] rmdir("./9") = 0 [pid 5085] mkdir("./10", 0777) = 0 [ 131.789024][ T5361] memory: usage 8kB, limit 0kB, failcnt 36 [ 131.797799][ T5361] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 131.813010][ T5361] Memory cgroup stats for /syz1: [ 131.813306][ T5361] anon 0 [ 131.813306][ T5361] file 0 [ 131.813306][ T5361] kernel 8192 [ 131.813306][ T5361] kernel_stack 0 [ 131.813306][ T5361] pagetables 0 [ 131.813306][ T5361] sec_pagetables 0 [pid 5085] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555c0c5d0) = 12 [ 131.813306][ T5361] percpu 0 [ 131.813306][ T5361] sock 0 [ 131.813306][ T5361] vmalloc 0 [ 131.813306][ T5361] shmem 0 [ 131.813306][ T5361] zswap 0 [ 131.813306][ T5361] zswapped 0 [ 131.813306][ T5361] file_mapped 0 [ 131.813306][ T5361] file_dirty 0 [ 131.813306][ T5361] file_writeback 0 [ 131.813306][ T5361] swapcached 0 [ 131.813306][ T5361] anon_thp 0 [ 131.813306][ T5361] file_thp 0 [ 131.813306][ T5361] shmem_thp 0 [ 131.813306][ T5361] inactive_anon 0 [ 131.813306][ T5361] active_anon 0 [ 131.813306][ T5361] inactive_file 0 ./strace-static-x86_64: Process 5375 attached [pid 5375] chdir("./10") = 0 [pid 5375] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5375] setpgid(0, 0) = 0 [ 131.813306][ T5361] active_file 0 [ 131.813306][ T5361] unevictable 0 [ 131.813306][ T5361] slab_reclaimable 6752 [ 131.813306][ T5361] slab_unreclaimable 0 [ 131.813306][ T5361] slab 6752 [ 131.813306][ T5361] workingset_refault_anon 0 [ 131.813306][ T5361] workingset_refault_file 0 [ 131.813306][ T5361] workingset_activate_anon 0 [ 131.813306][ T5361] workingset_activate_file 0 [ 131.813306][ T5361] workingset_restore_anon 0 [ 131.813306][ T5361] workingset_restore_file 0 [ 131.813306][ T5361] workingset_nodereclaim 0 [ 131.813306][ T5361] pgscan 831 [ 131.813306][ T5361] pgsteal 2 [ 131.813306][ T5361] pgscan_kswapd 0 [ 131.813306][ T5361] pgscan_direct 831 [ 131.813306][ T5361] pgscan_khugepaged 0 [ 131.813306][ T5361] pgsteal_kswapd 0 [ 131.813306][ T5361] pgsteal_direct 2 [ 131.813306][ T5361] pgsteal_khugepaged 0 [ 131.813306][ T5361] pgfault 21 [ 131.813306][ T5361] pgmajfault 0 [ 131.813306][ T5361] pgrefill 830 [ 131.813306][ T5361] pgactivate 829 [ 131.813306][ T5361] pgdeactivate 830 [ 131.813306][ T5361] pglazyfree 0 [ 131.813306][ T5361] pglazyfreed 0 [ 131.813306][ T5361] zswpin 0 [pid 5375] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 5375] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 5375] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 5375] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5375] write(3, "1000", 4) = 4 [pid 5375] close(3) = 0 [pid 5375] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5375] mkdir("./file0", 000) = 0 [pid 5375] open("./file0", O_RDONLY) = 3 [pid 5375] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5375] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5375] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5375] openat(5, "memory.max", O_RDWR) = 6 [ 131.813306][ T5361] zswpout 0 [ 131.813306][ T5361] thp_fault_alloc 0 [ 131.813306][ T5361] thp_collapse_alloc 0 [ 132.066155][ T5361] Tasks state (memory values in pages): [ 132.079292][ T5361] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 132.099848][ T5361] Out of memory and no killable processes... [ 132.109708][ T5362] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 132.129233][ T5362] CPU: 1 PID: 5362 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 132.139234][ T5362] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 132.149317][ T5362] Call Trace: [ 132.152618][ T5362] [ 132.155568][ T5362] dump_stack_lvl+0x136/0x150 [ 132.160281][ T5362] dump_header+0x10a/0xd70 [ 132.164729][ T5362] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 132.170858][ T5362] out_of_memory+0xd64/0x1660 [ 132.175580][ T5362] ? oom_killer_disable+0x2b0/0x2b0 [ 132.180828][ T5362] mem_cgroup_out_of_memory+0x206/0x270 [ 132.186416][ T5362] ? mem_cgroup_margin+0x130/0x130 [ 132.191591][ T5362] memory_max_write+0x2f9/0x3c0 [ 132.196499][ T5362] ? mem_cgroup_force_empty_write+0x160/0x160 [ 132.202623][ T5362] ? lock_sync+0x190/0x190 [ 132.207084][ T5362] cgroup_file_write+0x1e2/0x7b0 [ 132.212070][ T5362] ? mem_cgroup_force_empty_write+0x160/0x160 [ 132.218190][ T5362] ? kill_css+0x3b0/0x3b0 [ 132.222564][ T5362] ? lock_acquire+0x32/0xc0 [ 132.227118][ T5362] ? kill_css+0x3b0/0x3b0 [ 132.231494][ T5362] kernfs_fop_write_iter+0x3f1/0x600 [ 132.236832][ T5362] vfs_write+0x9ed/0xe10 [ 132.241131][ T5362] ? kernel_write+0x670/0x670 [ 132.245858][ T5362] ? find_held_lock+0x2d/0x110 [ 132.250663][ T5362] ? __fget_light+0x20a/0x270 [ 132.255390][ T5362] ksys_write+0x12b/0x250 [ 132.259772][ T5362] ? __ia32_sys_read+0xb0/0xb0 [ 132.264583][ T5362] ? lockdep_hardirqs_on+0x7d/0x100 [ 132.269817][ T5362] ? _raw_spin_unlock_irq+0x2e/0x50 [ 132.275059][ T5362] ? ptrace_notify+0xfe/0x140 [ 132.279789][ T5362] do_syscall_64+0x39/0xb0 [ 132.284255][ T5362] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 132.290187][ T5362] RIP: 0033:0x7faecf034129 [ 132.294634][ T5362] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 5375] write(6, "0x000000000000040e", 18 [pid 5361] <... write resumed>) = 18 [pid 5361] close(3) = 0 [pid 5361] close(4) = 0 [pid 5361] close(5) = 0 [pid 5361] close(6) = 0 [pid 5361] close(7) = -1 EBADF (Bad file descriptor) [pid 5361] close(8) = -1 EBADF (Bad file descriptor) [pid 5361] close(9) = -1 EBADF (Bad file descriptor) [pid 5361] close(10) = -1 EBADF (Bad file descriptor) [pid 5361] close(11) = -1 EBADF (Bad file descriptor) [pid 5361] close(12) = -1 EBADF (Bad file descriptor) [pid 5361] close(13) = -1 EBADF (Bad file descriptor) [pid 5361] close(14) = -1 EBADF (Bad file descriptor) [pid 5361] close(15) = -1 EBADF (Bad file descriptor) [pid 5361] close(16) = -1 EBADF (Bad file descriptor) [pid 5361] close(17) = -1 EBADF (Bad file descriptor) [pid 5361] close(18) = -1 EBADF (Bad file descriptor) [pid 5361] close(19) = -1 EBADF (Bad file descriptor) [pid 5361] close(20) = -1 EBADF (Bad file descriptor) [pid 5361] close(21) = -1 EBADF (Bad file descriptor) [pid 5361] close(22) = -1 EBADF (Bad file descriptor) [pid 5361] close(23) = -1 EBADF (Bad file descriptor) [pid 5361] close(24) = -1 EBADF (Bad file descriptor) [pid 5361] close(25) = -1 EBADF (Bad file descriptor) [pid 5361] close(26) = -1 EBADF (Bad file descriptor) [pid 5361] close(27) = -1 EBADF (Bad file descriptor) [pid 5361] close(28) = -1 EBADF (Bad file descriptor) [pid 5361] close(29) = -1 EBADF (Bad file descriptor) [pid 5361] exit_group(0) = ? [pid 5361] +++ exited with 0 +++ [pid 5090] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=15, si_uid=0, si_status=0, si_utime=0, si_stime=9 /* 0.09 s */} --- [pid 5090] umount2("./13", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5090] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5090] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5090] umount2("./13/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./13/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5090] unlink("./13/binderfs") = 0 [pid 5090] umount2("./13/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./13/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5090] unlink("./13/cgroup") = 0 [pid 5090] umount2("./13/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./13/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [ 132.314270][ T5362] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 132.322714][ T5362] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 132.330715][ T5362] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 132.338714][ T5362] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 132.346705][ T5362] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 132.354971][ T5362] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 000000000000000b [ 132.362992][ T5362] [pid 5090] unlink("./13/cgroup.net") = 0 [pid 5090] umount2("./13/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5090] umount2("./13/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./13/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5090] umount2("./13/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] openat(AT_FDCWD, "./13/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5090] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5090] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5090] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5090] close(4) = 0 [pid 5090] rmdir("./13/file0") = 0 [pid 5090] umount2("./13/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./13/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5090] unlink("./13/cgroup.cpu") = 0 [pid 5090] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5090] close(3) = 0 [pid 5090] rmdir("./13") = 0 [pid 5090] mkdir("./14", 0777) = 0 [pid 5090] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5381 attached [pid 5381] chdir("./14" [pid 5090] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 16 [pid 5381] <... chdir resumed>) = 0 [pid 5381] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5381] setpgid(0, 0) = 0 [pid 5381] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 5381] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 5381] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [pid 5381] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5381] write(3, "1000", 4) = 4 [pid 5381] close(3) = 0 [pid 5381] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5381] mkdir("./file0", 000) = 0 [pid 5381] open("./file0", O_RDONLY) = 3 [pid 5381] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5381] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5381] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5381] openat(5, "memory.max", O_RDWR) = 6 [ 132.509056][ T5362] memory: usage 8kB, limit 0kB, failcnt 36 [ 132.518956][ T5362] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 132.539141][ T5362] Memory cgroup stats for /syz1: [ 132.539428][ T5362] anon 0 [ 132.539428][ T5362] file 0 [ 132.539428][ T5362] kernel 8192 [ 132.539428][ T5362] kernel_stack 0 [ 132.539428][ T5362] pagetables 0 [ 132.539428][ T5362] sec_pagetables 0 [ 132.539428][ T5362] percpu 0 [ 132.539428][ T5362] sock 0 [ 132.539428][ T5362] vmalloc 0 [ 132.539428][ T5362] shmem 0 [ 132.539428][ T5362] zswap 0 [ 132.539428][ T5362] zswapped 0 [ 132.539428][ T5362] file_mapped 0 [ 132.539428][ T5362] file_dirty 0 [ 132.539428][ T5362] file_writeback 0 [ 132.539428][ T5362] swapcached 0 [ 132.539428][ T5362] anon_thp 0 [ 132.539428][ T5362] file_thp 0 [ 132.539428][ T5362] shmem_thp 0 [ 132.539428][ T5362] inactive_anon 0 [ 132.539428][ T5362] active_anon 0 [ 132.539428][ T5362] inactive_file 0 [ 132.539428][ T5362] active_file 0 [ 132.539428][ T5362] unevictable 0 [ 132.539428][ T5362] slab_reclaimable 6752 [ 132.539428][ T5362] slab_unreclaimable 0 [ 132.539428][ T5362] slab 6752 [ 132.539428][ T5362] workingset_refault_anon 0 [ 132.539428][ T5362] workingset_refault_file 0 [ 132.539428][ T5362] workingset_activate_anon 0 [ 132.539428][ T5362] workingset_activate_file 0 [ 132.539428][ T5362] workingset_restore_anon 0 [ 132.539428][ T5362] workingset_restore_file 0 [ 132.539428][ T5362] workingset_nodereclaim 0 [ 132.539428][ T5362] pgscan 831 [ 132.539428][ T5362] pgsteal 2 [ 132.539428][ T5362] pgscan_kswapd 0 [ 132.539428][ T5362] pgscan_direct 831 [ 132.539428][ T5362] pgscan_khugepaged 0 [ 132.539428][ T5362] pgsteal_kswapd 0 [ 132.539428][ T5362] pgsteal_direct 2 [ 132.539428][ T5362] pgsteal_khugepaged 0 [ 132.539428][ T5362] pgfault 21 [ 132.539428][ T5362] pgmajfault 0 [ 132.539428][ T5362] pgrefill 830 [ 132.539428][ T5362] pgactivate 829 [ 132.539428][ T5362] pgdeactivate 830 [ 132.539428][ T5362] pglazyfree 0 [ 132.539428][ T5362] pglazyfreed 0 [ 132.539428][ T5362] zswpin 0 [ 132.539428][ T5362] zswpout 0 [ 132.539428][ T5362] thp_fault_alloc 0 [ 132.539428][ T5362] thp_collapse_alloc 0 [ 132.759304][ T5362] Tasks state (memory values in pages): [ 132.766647][ T5362] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 132.797448][ T5362] Out of memory and no killable processes... [pid 5381] write(6, "0x000000000000040e", 18 [pid 5362] <... write resumed>) = 18 [pid 5362] close(3) = 0 [pid 5362] close(4) = 0 [pid 5362] close(5) = 0 [pid 5362] close(6) = 0 [pid 5362] close(7) = -1 EBADF (Bad file descriptor) [pid 5362] close(8) = -1 EBADF (Bad file descriptor) [pid 5362] close(9) = -1 EBADF (Bad file descriptor) [ 132.806746][ T5367] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 132.831971][ T5367] CPU: 0 PID: 5367 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 132.841967][ T5367] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 132.852081][ T5367] Call Trace: [ 132.855418][ T5367] [ 132.858399][ T5367] dump_stack_lvl+0x136/0x150 [ 132.863151][ T5367] dump_header+0x10a/0xd70 [ 132.867634][ T5367] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 132.873797][ T5367] out_of_memory+0xd64/0x1660 [ 132.878560][ T5367] ? oom_killer_disable+0x2b0/0x2b0 [ 132.883856][ T5367] mem_cgroup_out_of_memory+0x206/0x270 [ 132.889481][ T5367] ? mem_cgroup_margin+0x130/0x130 [ 132.894689][ T5367] memory_max_write+0x2f9/0x3c0 [ 132.899620][ T5367] ? mem_cgroup_force_empty_write+0x160/0x160 [ 132.905783][ T5367] ? lock_sync+0x190/0x190 [ 132.910281][ T5367] cgroup_file_write+0x1e2/0x7b0 [ 132.915321][ T5367] ? mem_cgroup_force_empty_write+0x160/0x160 [ 132.921479][ T5367] ? kill_css+0x3b0/0x3b0 [ 132.925885][ T5367] ? lock_acquire+0x32/0xc0 [ 132.930475][ T5367] ? kill_css+0x3b0/0x3b0 [ 132.934915][ T5367] kernfs_fop_write_iter+0x3f1/0x600 [ 132.940285][ T5367] vfs_write+0x9ed/0xe10 [ 132.944623][ T5367] ? kernel_write+0x670/0x670 [ 132.949393][ T5367] ? find_held_lock+0x2d/0x110 [ 132.954247][ T5367] ? __fget_light+0x20a/0x270 [pid 5362] close(10) = -1 EBADF (Bad file descriptor) [pid 5362] close(11) = -1 EBADF (Bad file descriptor) [pid 5362] close(12) = -1 EBADF (Bad file descriptor) [pid 5362] close(13) = -1 EBADF (Bad file descriptor) [pid 5362] close(14) = -1 EBADF (Bad file descriptor) [ 132.959009][ T5367] ksys_write+0x12b/0x250 [ 132.963519][ T5367] ? __ia32_sys_read+0xb0/0xb0 [ 132.968376][ T5367] ? lockdep_hardirqs_on+0x7d/0x100 [ 132.973676][ T5367] ? _raw_spin_unlock_irq+0x2e/0x50 [ 132.978971][ T5367] ? ptrace_notify+0xfe/0x140 [ 132.983730][ T5367] do_syscall_64+0x39/0xb0 [ 132.988229][ T5367] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 132.994196][ T5367] RIP: 0033:0x7faecf034129 [pid 5362] close(15) = -1 EBADF (Bad file descriptor) [pid 5362] close(16) = -1 EBADF (Bad file descriptor) [pid 5362] close(17) = -1 EBADF (Bad file descriptor) [pid 5362] close(18) = -1 EBADF (Bad file descriptor) [pid 5362] close(19) = -1 EBADF (Bad file descriptor) [pid 5362] close(20) = -1 EBADF (Bad file descriptor) [pid 5362] close(21) = -1 EBADF (Bad file descriptor) [pid 5362] close(22) = -1 EBADF (Bad file descriptor) [pid 5362] close(23) = -1 EBADF (Bad file descriptor) [ 132.998666][ T5367] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 133.018348][ T5367] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 133.026849][ T5367] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 133.034880][ T5367] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 133.042910][ T5367] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 133.051025][ T5367] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [pid 5362] close(24) = -1 EBADF (Bad file descriptor) [pid 5362] close(25) = -1 EBADF (Bad file descriptor) [pid 5362] close(26) = -1 EBADF (Bad file descriptor) [pid 5362] close(27) = -1 EBADF (Bad file descriptor) [pid 5362] close(28) = -1 EBADF (Bad file descriptor) [pid 5362] close(29) = -1 EBADF (Bad file descriptor) [pid 5362] exit_group(0) = ? [pid 5362] +++ exited with 0 +++ [pid 5087] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=13, si_uid=0, si_status=0, si_utime=0, si_stime=14 /* 0.14 s */} --- [pid 5087] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5087] umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5087] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5087] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5087] umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./11/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5087] unlink("./11/binderfs") = 0 [pid 5087] umount2("./11/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./11/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5087] unlink("./11/cgroup") = 0 [pid 5087] umount2("./11/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./11/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5087] unlink("./11/cgroup.net") = 0 [pid 5087] umount2("./11/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5087] umount2("./11/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./11/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5087] umount2("./11/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] openat(AT_FDCWD, "./11/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5087] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5087] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5087] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5087] close(4) = 0 [pid 5087] rmdir("./11/file0") = 0 [pid 5087] umount2("./11/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./11/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5087] unlink("./11/cgroup.cpu") = 0 [pid 5087] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5087] close(3) = 0 [pid 5087] rmdir("./11") = 0 [pid 5087] mkdir("./12", 0777) = 0 [pid 5087] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5389 attached [ 133.059051][ T5367] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 000000000000000d [ 133.067106][ T5367] [ 133.084704][ T5367] memory: usage 8kB, limit 0kB, failcnt 36 [ 133.096684][ T5367] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [pid 5389] chdir("./12" [pid 5087] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 14 [pid 5389] <... chdir resumed>) = 0 [pid 5389] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5389] setpgid(0, 0) = 0 [pid 5389] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 5389] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 5389] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 5389] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5389] write(3, "1000", 4) = 4 [pid 5389] close(3) = 0 [pid 5389] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5389] mkdir("./file0", 000) = 0 [pid 5389] open("./file0", O_RDONLY) = 3 [ 133.127201][ T5367] Memory cgroup stats for /syz1: [ 133.127498][ T5367] anon 0 [ 133.127498][ T5367] file 0 [ 133.127498][ T5367] kernel 8192 [ 133.127498][ T5367] kernel_stack 0 [ 133.127498][ T5367] pagetables 0 [ 133.127498][ T5367] sec_pagetables 0 [ 133.127498][ T5367] percpu 0 [ 133.127498][ T5367] sock 0 [ 133.127498][ T5367] vmalloc 0 [ 133.127498][ T5367] shmem 0 [ 133.127498][ T5367] zswap 0 [ 133.127498][ T5367] zswapped 0 [ 133.127498][ T5367] file_mapped 0 [ 133.127498][ T5367] file_dirty 0 [pid 5389] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5389] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5389] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5389] openat(5, "memory.max", O_RDWR) = 6 [ 133.127498][ T5367] file_writeback 0 [ 133.127498][ T5367] swapcached 0 [ 133.127498][ T5367] anon_thp 0 [ 133.127498][ T5367] file_thp 0 [ 133.127498][ T5367] shmem_thp 0 [ 133.127498][ T5367] inactive_anon 0 [ 133.127498][ T5367] active_anon 0 [ 133.127498][ T5367] inactive_file 0 [ 133.127498][ T5367] active_file 0 [ 133.127498][ T5367] unevictable 0 [ 133.127498][ T5367] slab_reclaimable 6752 [ 133.127498][ T5367] slab_unreclaimable 0 [ 133.127498][ T5367] slab 6752 [ 133.127498][ T5367] workingset_refault_anon 0 [ 133.127498][ T5367] workingset_refault_file 0 [ 133.127498][ T5367] workingset_activate_anon 0 [ 133.127498][ T5367] workingset_activate_file 0 [ 133.127498][ T5367] workingset_restore_anon 0 [ 133.127498][ T5367] workingset_restore_file 0 [ 133.127498][ T5367] workingset_nodereclaim 0 [ 133.127498][ T5367] pgscan 831 [ 133.127498][ T5367] pgsteal 2 [ 133.127498][ T5367] pgscan_kswapd 0 [ 133.127498][ T5367] pgscan_direct 831 [ 133.127498][ T5367] pgscan_khugepaged 0 [ 133.127498][ T5367] pgsteal_kswapd 0 [ 133.127498][ T5367] pgsteal_direct 2 [ 133.127498][ T5367] pgsteal_khugepaged 0 [ 133.127498][ T5367] pgfault 21 [ 133.127498][ T5367] pgmajfault 0 [ 133.127498][ T5367] pgrefill 830 [ 133.127498][ T5367] pgactivate 829 [ 133.127498][ T5367] pgdeactivate 830 [ 133.127498][ T5367] pglazyfree 0 [ 133.127498][ T5367] pglazyfreed 0 [ 133.127498][ T5367] zswpin 0 [ 133.127498][ T5367] zswpout 0 [ 133.127498][ T5367] thp_fault_alloc 0 [ 133.127498][ T5367] thp_collapse_alloc 0 [pid 5389] write(6, "0x000000000000040e", 18 [pid 5367] <... write resumed>) = 18 [pid 5367] close(3) = 0 [pid 5367] close(4) = 0 [pid 5367] close(5) = 0 [pid 5367] close(6) = 0 [pid 5367] close(7) = -1 EBADF (Bad file descriptor) [pid 5367] close(8) = -1 EBADF (Bad file descriptor) [pid 5367] close(9) = -1 EBADF (Bad file descriptor) [pid 5367] close(10) = -1 EBADF (Bad file descriptor) [pid 5367] close(11) = -1 EBADF (Bad file descriptor) [pid 5367] close(12) = -1 EBADF (Bad file descriptor) [pid 5367] close(13) = -1 EBADF (Bad file descriptor) [pid 5367] close(14) = -1 EBADF (Bad file descriptor) [pid 5367] close(15) = -1 EBADF (Bad file descriptor) [pid 5367] close(16) = -1 EBADF (Bad file descriptor) [pid 5367] close(17) = -1 EBADF (Bad file descriptor) [pid 5367] close(18) = -1 EBADF (Bad file descriptor) [pid 5367] close(19) = -1 EBADF (Bad file descriptor) [pid 5367] close(20) = -1 EBADF (Bad file descriptor) [pid 5367] close(21) = -1 EBADF (Bad file descriptor) [pid 5367] close(22) = -1 EBADF (Bad file descriptor) [pid 5367] close(23) = -1 EBADF (Bad file descriptor) [pid 5367] close(24) = -1 EBADF (Bad file descriptor) [pid 5367] close(25) = -1 EBADF (Bad file descriptor) [pid 5367] close(26) = -1 EBADF (Bad file descriptor) [pid 5367] close(27) = -1 EBADF (Bad file descriptor) [pid 5367] close(28) = -1 EBADF (Bad file descriptor) [pid 5367] close(29) = -1 EBADF (Bad file descriptor) [pid 5367] exit_group(0) = ? [ 133.328472][ T5367] Tasks state (memory values in pages): [ 133.336003][ T5367] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 133.352417][ T5367] Out of memory and no killable processes... [ 133.358535][ T5371] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 133.370898][ T5371] CPU: 1 PID: 5371 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 133.380866][ T5371] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 133.390974][ T5371] Call Trace: [ 133.394292][ T5371] [ 133.397265][ T5371] dump_stack_lvl+0x136/0x150 [ 133.402019][ T5371] dump_header+0x10a/0xd70 [ 133.406515][ T5371] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 133.412667][ T5371] out_of_memory+0xd64/0x1660 [ 133.417430][ T5371] ? oom_killer_disable+0x2b0/0x2b0 [ 133.422724][ T5371] mem_cgroup_out_of_memory+0x206/0x270 [pid 5367] +++ exited with 0 +++ [pid 5089] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=15, si_uid=0, si_status=0, si_utime=0, si_stime=10 /* 0.10 s */} --- [pid 5089] umount2("./13", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5089] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5089] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5089] umount2("./13/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./13/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5089] unlink("./13/binderfs") = 0 [pid 5089] umount2("./13/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./13/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5089] unlink("./13/cgroup") = 0 [pid 5089] umount2("./13/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./13/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5089] unlink("./13/cgroup.net") = 0 [ 133.428336][ T5371] ? mem_cgroup_margin+0x130/0x130 [ 133.433537][ T5371] memory_max_write+0x2f9/0x3c0 [ 133.438481][ T5371] ? mem_cgroup_force_empty_write+0x160/0x160 [ 133.444664][ T5371] ? lock_sync+0x190/0x190 [ 133.449167][ T5371] cgroup_file_write+0x1e2/0x7b0 [ 133.454190][ T5371] ? mem_cgroup_force_empty_write+0x160/0x160 [ 133.460341][ T5371] ? kill_css+0x3b0/0x3b0 [ 133.464773][ T5371] ? lock_acquire+0x32/0xc0 [ 133.469367][ T5371] ? kill_css+0x3b0/0x3b0 [ 133.473785][ T5371] kernfs_fop_write_iter+0x3f1/0x600 [ 133.479146][ T5371] vfs_write+0x9ed/0xe10 [ 133.483479][ T5371] ? kernel_write+0x670/0x670 [ 133.488254][ T5371] ? find_held_lock+0x2d/0x110 [ 133.493099][ T5371] ? __fget_light+0x20a/0x270 [ 133.497869][ T5371] ksys_write+0x12b/0x250 [ 133.502283][ T5371] ? __ia32_sys_read+0xb0/0xb0 [ 133.507125][ T5371] ? lockdep_hardirqs_on+0x7d/0x100 [ 133.512395][ T5371] ? _raw_spin_unlock_irq+0x2e/0x50 [ 133.517674][ T5371] ? ptrace_notify+0xfe/0x140 [ 133.522426][ T5371] do_syscall_64+0x39/0xb0 [ 133.526928][ T5371] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 133.532888][ T5371] RIP: 0033:0x7faecf034129 [ 133.537353][ T5371] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 133.557057][ T5371] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 133.565543][ T5371] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [pid 5089] umount2("./13/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5089] umount2("./13/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./13/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5089] umount2("./13/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] openat(AT_FDCWD, "./13/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5089] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5089] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5089] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5089] close(4) = 0 [pid 5089] rmdir("./13/file0") = 0 [pid 5089] umount2("./13/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./13/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5089] unlink("./13/cgroup.cpu") = 0 [ 133.573575][ T5371] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 133.581595][ T5371] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 133.589619][ T5371] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 133.597654][ T5371] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 000000000000000a [ 133.605733][ T5371] [pid 5089] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5089] close(3) = 0 [pid 5089] rmdir("./13") = 0 [pid 5089] mkdir("./14", 0777) = 0 [pid 5089] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5394 attached [pid 5394] chdir("./14") = 0 [pid 5089] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 16 [pid 5394] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5394] setpgid(0, 0) = 0 [pid 5394] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 5394] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [pid 5394] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 5394] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5394] write(3, "1000", 4) = 4 [pid 5394] close(3) = 0 [pid 5394] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5394] mkdir("./file0", 000) = 0 [pid 5394] open("./file0", O_RDONLY) = 3 [pid 5394] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5394] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5394] openat(4, "syz1", O_RDWR|O_PATH) = 5 [ 133.630709][ T5371] memory: usage 8kB, limit 0kB, failcnt 36 [ 133.643068][ T5371] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 133.652256][ T5371] Memory cgroup stats for /syz1: [ 133.652556][ T5371] anon 0 [ 133.652556][ T5371] file 0 [ 133.652556][ T5371] kernel 8192 [ 133.652556][ T5371] kernel_stack 0 [ 133.652556][ T5371] pagetables 0 [ 133.652556][ T5371] sec_pagetables 0 [ 133.652556][ T5371] percpu 0 [pid 5394] openat(5, "memory.max", O_RDWR) = 6 [ 133.652556][ T5371] sock 0 [ 133.652556][ T5371] vmalloc 0 [ 133.652556][ T5371] shmem 0 [ 133.652556][ T5371] zswap 0 [ 133.652556][ T5371] zswapped 0 [ 133.652556][ T5371] file_mapped 0 [ 133.652556][ T5371] file_dirty 0 [ 133.652556][ T5371] file_writeback 0 [ 133.652556][ T5371] swapcached 0 [ 133.652556][ T5371] anon_thp 0 [ 133.652556][ T5371] file_thp 0 [ 133.652556][ T5371] shmem_thp 0 [ 133.652556][ T5371] inactive_anon 0 [ 133.652556][ T5371] active_anon 0 [ 133.652556][ T5371] inactive_file 0 [ 133.652556][ T5371] active_file 0 [ 133.652556][ T5371] unevictable 0 [ 133.652556][ T5371] slab_reclaimable 6752 [ 133.652556][ T5371] slab_unreclaimable 0 [ 133.652556][ T5371] slab 6752 [ 133.652556][ T5371] workingset_refault_anon 0 [ 133.652556][ T5371] workingset_refault_file 0 [ 133.652556][ T5371] workingset_activate_anon 0 [ 133.652556][ T5371] workingset_activate_file 0 [ 133.652556][ T5371] workingset_restore_anon 0 [ 133.652556][ T5371] workingset_restore_file 0 [ 133.652556][ T5371] workingset_nodereclaim 0 [ 133.652556][ T5371] pgscan 831 [ 133.652556][ T5371] pgsteal 2 [ 133.652556][ T5371] pgscan_kswapd 0 [ 133.652556][ T5371] pgscan_direct 831 [ 133.652556][ T5371] pgscan_khugepaged 0 [ 133.652556][ T5371] pgsteal_kswapd 0 [ 133.652556][ T5371] pgsteal_direct 2 [ 133.652556][ T5371] pgsteal_khugepaged 0 [ 133.652556][ T5371] pgfault 21 [ 133.652556][ T5371] pgmajfault 0 [ 133.652556][ T5371] pgrefill 830 [ 133.652556][ T5371] pgactivate 829 [ 133.652556][ T5371] pgdeactivate 830 [ 133.652556][ T5371] pglazyfree 0 [ 133.652556][ T5371] pglazyfreed 0 [ 133.652556][ T5371] zswpin 0 [ 133.652556][ T5371] zswpout 0 [ 133.652556][ T5371] thp_fault_alloc 0 [ 133.652556][ T5371] thp_collapse_alloc 0 [ 133.852356][ T5371] Tasks state (memory values in pages): [ 133.858144][ T5371] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 133.868324][ T5371] Out of memory and no killable processes... [pid 5394] write(6, "0x000000000000040e", 18 [pid 5371] <... write resumed>) = 18 [pid 5371] close(3) = 0 [pid 5371] close(4) = 0 [pid 5371] close(5) = 0 [pid 5371] close(6) = 0 [pid 5371] close(7) = -1 EBADF (Bad file descriptor) [pid 5371] close(8) = -1 EBADF (Bad file descriptor) [pid 5371] close(9) = -1 EBADF (Bad file descriptor) [pid 5371] close(10) = -1 EBADF (Bad file descriptor) [pid 5371] close(11) = -1 EBADF (Bad file descriptor) [pid 5371] close(12) = -1 EBADF (Bad file descriptor) [pid 5371] close(13) = -1 EBADF (Bad file descriptor) [pid 5371] close(14) = -1 EBADF (Bad file descriptor) [pid 5371] close(15) = -1 EBADF (Bad file descriptor) [pid 5371] close(16) = -1 EBADF (Bad file descriptor) [ 133.877397][ T5375] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 133.889141][ T5375] CPU: 1 PID: 5375 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 133.899126][ T5375] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 133.909248][ T5375] Call Trace: [ 133.912587][ T5375] [ 133.915575][ T5375] dump_stack_lvl+0x136/0x150 [ 133.920330][ T5375] dump_header+0x10a/0xd70 [ 133.924822][ T5375] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [pid 5371] close(17) = -1 EBADF (Bad file descriptor) [pid 5371] close(18) = -1 EBADF (Bad file descriptor) [pid 5371] close(19) = -1 EBADF (Bad file descriptor) [pid 5371] close(20) = -1 EBADF (Bad file descriptor) [pid 5371] close(21) = -1 EBADF (Bad file descriptor) [ 133.931000][ T5375] out_of_memory+0xd64/0x1660 [ 133.935773][ T5375] ? oom_killer_disable+0x2b0/0x2b0 [ 133.941070][ T5375] mem_cgroup_out_of_memory+0x206/0x270 [ 133.946722][ T5375] ? mem_cgroup_margin+0x130/0x130 [ 133.951916][ T5375] memory_max_write+0x2f9/0x3c0 [ 133.956823][ T5375] ? mem_cgroup_force_empty_write+0x160/0x160 [ 133.962951][ T5375] ? lock_sync+0x190/0x190 [ 133.967496][ T5375] cgroup_file_write+0x1e2/0x7b0 [ 133.972485][ T5375] ? mem_cgroup_force_empty_write+0x160/0x160 [ 133.978607][ T5375] ? kill_css+0x3b0/0x3b0 [ 133.982982][ T5375] ? lock_acquire+0x32/0xc0 [ 133.987532][ T5375] ? kill_css+0x3b0/0x3b0 [ 133.991918][ T5375] kernfs_fop_write_iter+0x3f1/0x600 [ 133.997256][ T5375] vfs_write+0x9ed/0xe10 [ 134.001550][ T5375] ? kernel_write+0x670/0x670 [ 134.006291][ T5375] ? find_held_lock+0x2d/0x110 [ 134.011104][ T5375] ? __fget_light+0x20a/0x270 [ 134.015842][ T5375] ksys_write+0x12b/0x250 [ 134.020230][ T5375] ? __ia32_sys_read+0xb0/0xb0 [ 134.025044][ T5375] ? lockdep_hardirqs_on+0x7d/0x100 [ 134.030300][ T5375] ? _raw_spin_unlock_irq+0x2e/0x50 [ 134.035554][ T5375] ? ptrace_notify+0xfe/0x140 [ 134.040288][ T5375] do_syscall_64+0x39/0xb0 [ 134.044769][ T5375] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 134.050708][ T5375] RIP: 0033:0x7faecf034129 [ 134.055148][ T5375] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 5371] close(22) = -1 EBADF (Bad file descriptor) [ 134.074784][ T5375] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 134.083231][ T5375] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 134.091225][ T5375] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 134.099266][ T5375] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 134.107270][ T5375] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 134.115272][ T5375] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 000000000000000a [ 134.123296][ T5375] [pid 5371] close(23) = -1 EBADF (Bad file descriptor) [pid 5371] close(24) = -1 EBADF (Bad file descriptor) [pid 5371] close(25) = -1 EBADF (Bad file descriptor) [pid 5371] close(26) = -1 EBADF (Bad file descriptor) [pid 5371] close(27) = -1 EBADF (Bad file descriptor) [pid 5371] close(28) = -1 EBADF (Bad file descriptor) [pid 5371] close(29) = -1 EBADF (Bad file descriptor) [pid 5371] exit_group(0) = ? [ 134.152563][ T5375] memory: usage 8kB, limit 0kB, failcnt 36 [ 134.159170][ T5375] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 134.175001][ T5375] Memory cgroup stats for /syz1: [ 134.175291][ T5375] anon 0 [ 134.175291][ T5375] file 0 [ 134.175291][ T5375] kernel 8192 [ 134.175291][ T5375] kernel_stack 0 [ 134.175291][ T5375] pagetables 0 [ 134.175291][ T5375] sec_pagetables 0 [ 134.175291][ T5375] percpu 0 [ 134.175291][ T5375] sock 0 [ 134.175291][ T5375] vmalloc 0 [ 134.175291][ T5375] shmem 0 [ 134.175291][ T5375] zswap 0 [ 134.175291][ T5375] zswapped 0 [ 134.175291][ T5375] file_mapped 0 [ 134.175291][ T5375] file_dirty 0 [ 134.175291][ T5375] file_writeback 0 [ 134.175291][ T5375] swapcached 0 [ 134.175291][ T5375] anon_thp 0 [ 134.175291][ T5375] file_thp 0 [ 134.175291][ T5375] shmem_thp 0 [ 134.175291][ T5375] inactive_anon 0 [ 134.175291][ T5375] active_anon 0 [ 134.175291][ T5375] inactive_file 0 [ 134.175291][ T5375] active_file 0 [ 134.175291][ T5375] unevictable 0 [ 134.175291][ T5375] slab_reclaimable 6752 [ 134.175291][ T5375] slab_unreclaimable 0 [ 134.175291][ T5375] slab 6752 [ 134.175291][ T5375] workingset_refault_anon 0 [ 134.175291][ T5375] workingset_refault_file 0 [ 134.175291][ T5375] workingset_activate_anon 0 [ 134.175291][ T5375] workingset_activate_file 0 [ 134.175291][ T5375] workingset_restore_anon 0 [ 134.175291][ T5375] workingset_restore_file 0 [ 134.175291][ T5375] workingset_nodereclaim 0 [ 134.175291][ T5375] pgscan 831 [ 134.175291][ T5375] pgsteal 2 [ 134.175291][ T5375] pgscan_kswapd 0 [ 134.175291][ T5375] pgscan_direct 831 [ 134.175291][ T5375] pgscan_khugepaged 0 [ 134.175291][ T5375] pgsteal_kswapd 0 [ 134.175291][ T5375] pgsteal_direct 2 [ 134.175291][ T5375] pgsteal_khugepaged 0 [ 134.175291][ T5375] pgfault 21 [ 134.175291][ T5375] pgmajfault 0 [ 134.175291][ T5375] pgrefill 830 [ 134.175291][ T5375] pgactivate 829 [ 134.175291][ T5375] pgdeactivate 830 [ 134.175291][ T5375] pglazyfree 0 [ 134.175291][ T5375] pglazyfreed 0 [ 134.175291][ T5375] zswpin 0 [ 134.175291][ T5375] zswpout 0 [pid 5371] +++ exited with 0 +++ [pid 5086] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=12, si_uid=0, si_status=0, si_utime=0, si_stime=7 /* 0.07 s */} --- [pid 5086] umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5086] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5086] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5086] umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./10/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5086] unlink("./10/binderfs") = 0 [pid 5086] umount2("./10/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./10/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5086] unlink("./10/cgroup") = 0 [pid 5086] umount2("./10/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./10/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5086] unlink("./10/cgroup.net") = 0 [pid 5086] umount2("./10/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5086] umount2("./10/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./10/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5086] umount2("./10/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] openat(AT_FDCWD, "./10/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5086] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5086] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5086] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5086] close(4) = 0 [pid 5086] rmdir("./10/file0") = 0 [ 134.175291][ T5375] thp_fault_alloc 0 [ 134.175291][ T5375] thp_collapse_alloc 0 [pid 5086] umount2("./10/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./10/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5086] unlink("./10/cgroup.cpu") = 0 [pid 5086] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5086] close(3) = 0 [pid 5086] rmdir("./10") = 0 [pid 5086] mkdir("./11", 0777) = 0 [pid 5086] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5401 attached [pid 5401] chdir("./11") = 0 [pid 5086] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 13 [pid 5401] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5401] setpgid(0, 0) = 0 [pid 5401] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [pid 5401] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 5401] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 5401] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5401] write(3, "1000", 4) = 4 [pid 5401] close(3) = 0 [pid 5401] symlink("/dev/binderfs", "./binderfs") = 0 [ 134.434061][ T5375] Tasks state (memory values in pages): [ 134.439850][ T5375] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 134.453542][ T5375] Out of memory and no killable processes... [pid 5401] mkdir("./file0", 000) = 0 [pid 5401] open("./file0", O_RDONLY) = 3 [pid 5401] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5375] <... write resumed>) = 18 [pid 5375] close(3) = 0 [pid 5401] <... mount resumed>) = 0 [pid 5375] close(4 [pid 5401] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5375] <... close resumed>) = 0 [pid 5401] <... openat resumed>) = 4 [pid 5375] close(5 [pid 5401] openat(4, "syz1", O_RDWR|O_PATH [pid 5375] <... close resumed>) = 0 [pid 5401] <... openat resumed>) = 5 [pid 5375] close(6 [pid 5401] openat(5, "memory.max", O_RDWR [pid 5375] <... close resumed>) = 0 [pid 5401] <... openat resumed>) = 6 [pid 5375] close(7 [pid 5401] write(6, "0x000000000000040e", 18 [pid 5375] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5375] close(8) = -1 EBADF (Bad file descriptor) [ 134.478040][ T5381] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 134.505443][ T5381] CPU: 1 PID: 5381 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 134.515431][ T5381] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 134.525542][ T5381] Call Trace: [ 134.528872][ T5381] [ 134.531854][ T5381] dump_stack_lvl+0x136/0x150 [ 134.536603][ T5381] dump_header+0x10a/0xd70 [ 134.541105][ T5381] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 134.547265][ T5381] out_of_memory+0xd64/0x1660 [ 134.552030][ T5381] ? oom_killer_disable+0x2b0/0x2b0 [ 134.557311][ T5381] ? find_held_lock+0x2d/0x110 [ 134.562143][ T5381] mem_cgroup_out_of_memory+0x206/0x270 [ 134.567774][ T5381] ? mem_cgroup_margin+0x130/0x130 [ 134.572974][ T5381] ? _raw_spin_unlock_irqrestore+0x54/0x70 [ 134.578871][ T5381] memory_max_write+0x2f9/0x3c0 [ 134.583806][ T5381] ? mem_cgroup_force_empty_write+0x160/0x160 [ 134.589967][ T5381] ? lock_sync+0x190/0x190 [ 134.594466][ T5381] cgroup_file_write+0x1e2/0x7b0 [ 134.599487][ T5381] ? mem_cgroup_force_empty_write+0x160/0x160 [ 134.605632][ T5381] ? kill_css+0x3b0/0x3b0 [ 134.610035][ T5381] ? lock_acquire+0x32/0xc0 [ 134.614619][ T5381] ? kill_css+0x3b0/0x3b0 [ 134.619015][ T5381] kernfs_fop_write_iter+0x3f1/0x600 [ 134.624361][ T5381] vfs_write+0x9ed/0xe10 [ 134.628652][ T5381] ? kernel_write+0x670/0x670 [ 134.633386][ T5381] ? find_held_lock+0x2d/0x110 [ 134.638214][ T5381] ? __fget_light+0x20a/0x270 [ 134.642942][ T5381] ksys_write+0x12b/0x250 [ 134.647322][ T5381] ? __ia32_sys_read+0xb0/0xb0 [ 134.652129][ T5381] ? lockdep_hardirqs_on+0x7d/0x100 [ 134.657383][ T5381] ? _raw_spin_unlock_irq+0x2e/0x50 [ 134.662625][ T5381] ? ptrace_notify+0xfe/0x140 [ 134.667343][ T5381] do_syscall_64+0x39/0xb0 [ 134.671807][ T5381] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 134.677740][ T5381] RIP: 0033:0x7faecf034129 [ 134.682180][ T5381] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 134.701822][ T5381] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 134.710281][ T5381] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 134.718299][ T5381] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [pid 5375] close(9) = -1 EBADF (Bad file descriptor) [pid 5375] close(10) = -1 EBADF (Bad file descriptor) [pid 5375] close(11) = -1 EBADF (Bad file descriptor) [pid 5375] close(12) = -1 EBADF (Bad file descriptor) [pid 5375] close(13) = -1 EBADF (Bad file descriptor) [pid 5375] close(14) = -1 EBADF (Bad file descriptor) [pid 5375] close(15) = -1 EBADF (Bad file descriptor) [pid 5375] close(16) = -1 EBADF (Bad file descriptor) [pid 5375] close(17) = -1 EBADF (Bad file descriptor) [pid 5375] close(18) = -1 EBADF (Bad file descriptor) [pid 5375] close(19) = -1 EBADF (Bad file descriptor) [pid 5375] close(20) = -1 EBADF (Bad file descriptor) [pid 5375] close(21) = -1 EBADF (Bad file descriptor) [pid 5375] close(22) = -1 EBADF (Bad file descriptor) [ 134.726295][ T5381] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 134.734325][ T5381] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 134.742337][ T5381] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 000000000000000e [ 134.750359][ T5381] [ 134.761844][ T5381] memory: usage 8kB, limit 0kB, failcnt 36 [ 134.768109][ T5381] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [pid 5375] close(23) = -1 EBADF (Bad file descriptor) [pid 5375] close(24) = -1 EBADF (Bad file descriptor) [pid 5375] close(25) = -1 EBADF (Bad file descriptor) [pid 5375] close(26) = -1 EBADF (Bad file descriptor) [pid 5375] close(27) = -1 EBADF (Bad file descriptor) [pid 5375] close(28) = -1 EBADF (Bad file descriptor) [pid 5375] close(29) = -1 EBADF (Bad file descriptor) [pid 5375] exit_group(0) = ? [pid 5375] +++ exited with 0 +++ [pid 5085] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=12, si_uid=0, si_status=0, si_utime=0, si_stime=10 /* 0.10 s */} --- [pid 5085] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5085] umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 134.792544][ T5381] Memory cgroup stats for /syz1: [ 134.792839][ T5381] anon 0 [ 134.792839][ T5381] file 0 [ 134.792839][ T5381] kernel 8192 [ 134.792839][ T5381] kernel_stack 0 [ 134.792839][ T5381] pagetables 0 [ 134.792839][ T5381] sec_pagetables 0 [ 134.792839][ T5381] percpu 0 [ 134.792839][ T5381] sock 0 [ 134.792839][ T5381] vmalloc 0 [ 134.792839][ T5381] shmem 0 [ 134.792839][ T5381] zswap 0 [ 134.792839][ T5381] zswapped 0 [ 134.792839][ T5381] file_mapped 0 [ 134.792839][ T5381] file_dirty 0 [pid 5085] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5085] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5085] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5085] umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./10/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5085] unlink("./10/binderfs") = 0 [pid 5085] umount2("./10/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./10/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5085] unlink("./10/cgroup") = 0 [ 134.792839][ T5381] file_writeback 0 [ 134.792839][ T5381] swapcached 0 [ 134.792839][ T5381] anon_thp 0 [ 134.792839][ T5381] file_thp 0 [ 134.792839][ T5381] shmem_thp 0 [ 134.792839][ T5381] inactive_anon 0 [ 134.792839][ T5381] active_anon 0 [ 134.792839][ T5381] inactive_file 0 [ 134.792839][ T5381] active_file 0 [ 134.792839][ T5381] unevictable 0 [ 134.792839][ T5381] slab_reclaimable 6752 [ 134.792839][ T5381] slab_unreclaimable 0 [ 134.792839][ T5381] slab 6752 [ 134.792839][ T5381] workingset_refault_anon 0 [ 134.792839][ T5381] workingset_refault_file 0 [ 134.792839][ T5381] workingset_activate_anon 0 [ 134.792839][ T5381] workingset_activate_file 0 [ 134.792839][ T5381] workingset_restore_anon 0 [ 134.792839][ T5381] workingset_restore_file 0 [ 134.792839][ T5381] workingset_nodereclaim 0 [ 134.792839][ T5381] pgscan 831 [ 134.792839][ T5381] pgsteal 2 [ 134.792839][ T5381] pgscan_kswapd 0 [ 134.792839][ T5381] pgscan_direct 831 [ 134.792839][ T5381] pgscan_khugepaged 0 [ 134.792839][ T5381] pgsteal_kswapd 0 [ 134.792839][ T5381] pgsteal_direct 2 [ 134.792839][ T5381] pgsteal_khugepaged 0 [pid 5085] umount2("./10/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./10/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5085] unlink("./10/cgroup.net") = 0 [pid 5085] umount2("./10/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5085] umount2("./10/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./10/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [ 134.792839][ T5381] pgfault 21 [ 134.792839][ T5381] pgmajfault 0 [ 134.792839][ T5381] pgrefill 830 [ 134.792839][ T5381] pgactivate 829 [ 134.792839][ T5381] pgdeactivate 830 [ 134.792839][ T5381] pglazyfree 0 [ 134.792839][ T5381] pglazyfreed 0 [ 134.792839][ T5381] zswpin 0 [ 134.792839][ T5381] zswpout 0 [ 134.792839][ T5381] thp_fault_alloc 0 [ 134.792839][ T5381] thp_collapse_alloc 0 [ 134.984415][ T5381] Tasks state (memory values in pages): [pid 5085] umount2("./10/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] openat(AT_FDCWD, "./10/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5085] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5085] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5085] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5085] close(4) = 0 [pid 5085] rmdir("./10/file0") = 0 [pid 5085] umount2("./10/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./10/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5085] unlink("./10/cgroup.cpu") = 0 [pid 5085] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5085] close(3) = 0 [pid 5085] rmdir("./10") = 0 [pid 5085] mkdir("./11", 0777) = 0 [pid 5085] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5407 attached [pid 5407] chdir("./11" [pid 5085] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 13 [pid 5407] <... chdir resumed>) = 0 [pid 5407] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5407] setpgid(0, 0) = 0 [pid 5407] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 5407] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [ 135.000460][ T5381] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 135.011493][ T5381] Out of memory and no killable processes... [pid 5407] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 5381] <... write resumed>) = 18 [pid 5407] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5381] close(3 [pid 5407] <... openat resumed>) = 3 [pid 5381] <... close resumed>) = 0 [pid 5407] write(3, "1000", 4 [pid 5381] close(4 [pid 5407] <... write resumed>) = 4 [pid 5381] <... close resumed>) = 0 [pid 5407] close(3) = 0 [pid 5407] symlink("/dev/binderfs", "./binderfs") = 0 [ 135.052134][ T5389] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 135.078423][ T5389] CPU: 1 PID: 5389 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 135.088413][ T5389] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 135.098522][ T5389] Call Trace: [ 135.101909][ T5389] [ 135.104879][ T5389] dump_stack_lvl+0x136/0x150 [ 135.109638][ T5389] dump_header+0x10a/0xd70 [ 135.114123][ T5389] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 135.120280][ T5389] out_of_memory+0xd64/0x1660 [ 135.125039][ T5389] ? oom_killer_disable+0x2b0/0x2b0 [ 135.130326][ T5389] mem_cgroup_out_of_memory+0x206/0x270 [ 135.135941][ T5389] ? mem_cgroup_margin+0x130/0x130 [ 135.141119][ T5389] memory_max_write+0x2f9/0x3c0 [ 135.146020][ T5389] ? mem_cgroup_force_empty_write+0x160/0x160 [ 135.152137][ T5389] ? lock_sync+0x190/0x190 [ 135.156587][ T5389] cgroup_file_write+0x1e2/0x7b0 [ 135.161561][ T5389] ? mem_cgroup_force_empty_write+0x160/0x160 [ 135.167676][ T5389] ? kill_css+0x3b0/0x3b0 [ 135.172050][ T5389] ? lock_acquire+0x32/0xc0 [ 135.176597][ T5389] ? kill_css+0x3b0/0x3b0 [ 135.180967][ T5389] kernfs_fop_write_iter+0x3f1/0x600 [ 135.186298][ T5389] vfs_write+0x9ed/0xe10 [ 135.190589][ T5389] ? kernel_write+0x670/0x670 [ 135.195313][ T5389] ? find_held_lock+0x2d/0x110 [ 135.200147][ T5389] ? __fget_light+0x20a/0x270 [ 135.204883][ T5389] ksys_write+0x12b/0x250 [ 135.209290][ T5389] ? __ia32_sys_read+0xb0/0xb0 [ 135.214096][ T5389] ? lockdep_hardirqs_on+0x7d/0x100 [ 135.219325][ T5389] ? _raw_spin_unlock_irq+0x2e/0x50 [ 135.224553][ T5389] ? ptrace_notify+0xfe/0x140 [ 135.229270][ T5389] do_syscall_64+0x39/0xb0 [ 135.233729][ T5389] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 135.239665][ T5389] RIP: 0033:0x7faecf034129 [ 135.244113][ T5389] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 135.263750][ T5389] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 135.272218][ T5389] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 135.280214][ T5389] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 135.288210][ T5389] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [pid 5407] mkdir("./file0", 000 [pid 5381] close(5) = 0 [pid 5381] close(6) = 0 [pid 5381] close(7) = -1 EBADF (Bad file descriptor) [pid 5381] close(8) = -1 EBADF (Bad file descriptor) [pid 5381] close(9) = -1 EBADF (Bad file descriptor) [pid 5381] close(10) = -1 EBADF (Bad file descriptor) [pid 5381] close(11) = -1 EBADF (Bad file descriptor) [pid 5381] close(12) = -1 EBADF (Bad file descriptor) [pid 5381] close(13) = -1 EBADF (Bad file descriptor) [pid 5381] close(14) = -1 EBADF (Bad file descriptor) [pid 5381] close(15) = -1 EBADF (Bad file descriptor) [pid 5381] close(16) = -1 EBADF (Bad file descriptor) [pid 5381] close(17) = -1 EBADF (Bad file descriptor) [pid 5381] close(18) = -1 EBADF (Bad file descriptor) [pid 5381] close(19) = -1 EBADF (Bad file descriptor) [pid 5381] close(20) = -1 EBADF (Bad file descriptor) [pid 5381] close(21) = -1 EBADF (Bad file descriptor) [pid 5381] close(22) = -1 EBADF (Bad file descriptor) [pid 5381] close(23) = -1 EBADF (Bad file descriptor) [pid 5381] close(24) = -1 EBADF (Bad file descriptor) [pid 5381] close(25) = -1 EBADF (Bad file descriptor) [pid 5381] close(26) = -1 EBADF (Bad file descriptor) [pid 5381] close(27) = -1 EBADF (Bad file descriptor) [pid 5381] close(28) = -1 EBADF (Bad file descriptor) [pid 5381] close(29) = -1 EBADF (Bad file descriptor) [pid 5381] exit_group(0) = ? [pid 5381] +++ exited with 0 +++ [pid 5407] <... mkdir resumed>) = 0 [pid 5407] open("./file0", O_RDONLY [pid 5090] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=16, si_uid=0, si_status=0, si_utime=0, si_stime=6 /* 0.06 s */} --- [pid 5090] umount2("./14", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5090] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5090] getdents64(3, [pid 5407] <... open resumed>) = 3 [pid 5407] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5090] <... getdents64 resumed>0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5090] umount2("./14/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5407] <... mount resumed>) = 0 [pid 5090] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5407] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5090] lstat("./14/binderfs", [pid 5407] <... openat resumed>) = 4 [pid 5090] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5407] openat(4, "syz1", O_RDWR|O_PATH [pid 5090] unlink("./14/binderfs" [pid 5407] <... openat resumed>) = 5 [pid 5090] <... unlink resumed>) = 0 [pid 5407] openat(5, "memory.max", O_RDWR [pid 5090] umount2("./14/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5407] <... openat resumed>) = 6 [pid 5090] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5407] write(6, "0x000000000000040e", 18 [pid 5090] lstat("./14/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5090] unlink("./14/cgroup") = 0 [pid 5090] umount2("./14/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./14/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5090] unlink("./14/cgroup.net") = 0 [pid 5090] umount2("./14/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5090] umount2("./14/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./14/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5090] umount2("./14/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] openat(AT_FDCWD, "./14/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5090] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5090] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5090] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5090] close(4) = 0 [pid 5090] rmdir("./14/file0") = 0 [pid 5090] umount2("./14/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./14/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5090] unlink("./14/cgroup.cpu") = 0 [pid 5090] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5090] close(3) = 0 [pid 5090] rmdir("./14") = 0 [ 135.296205][ T5389] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 135.304199][ T5389] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 000000000000000c [ 135.312219][ T5389] [ 135.332086][ T5389] memory: usage 8kB, limit 0kB, failcnt 36 [ 135.338003][ T5389] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [pid 5090] mkdir("./15", 0777) = 0 [ 135.391819][ T5389] Memory cgroup stats for /syz1: [ 135.392099][ T5389] anon 0 [ 135.392099][ T5389] file 0 [ 135.392099][ T5389] kernel 8192 [ 135.392099][ T5389] kernel_stack 0 [ 135.392099][ T5389] pagetables 0 [ 135.392099][ T5389] sec_pagetables 0 [ 135.392099][ T5389] percpu 0 [ 135.392099][ T5389] sock 0 [ 135.392099][ T5389] vmalloc 0 [ 135.392099][ T5389] shmem 0 [ 135.392099][ T5389] zswap 0 [ 135.392099][ T5389] zswapped 0 [ 135.392099][ T5389] file_mapped 0 [ 135.392099][ T5389] file_dirty 0 [ 135.392099][ T5389] file_writeback 0 [ 135.392099][ T5389] swapcached 0 [ 135.392099][ T5389] anon_thp 0 [ 135.392099][ T5389] file_thp 0 [ 135.392099][ T5389] shmem_thp 0 [ 135.392099][ T5389] inactive_anon 0 [ 135.392099][ T5389] active_anon 0 [ 135.392099][ T5389] inactive_file 0 [ 135.392099][ T5389] active_file 0 [ 135.392099][ T5389] unevictable 0 [ 135.392099][ T5389] slab_reclaimable 6752 [ 135.392099][ T5389] slab_unreclaimable 0 [ 135.392099][ T5389] slab 6752 [ 135.392099][ T5389] workingset_refault_anon 0 [ 135.392099][ T5389] workingset_refault_file 0 [ 135.392099][ T5389] workingset_activate_anon 0 [ 135.392099][ T5389] workingset_activate_file 0 [ 135.392099][ T5389] workingset_restore_anon 0 [ 135.392099][ T5389] workingset_restore_file 0 [ 135.392099][ T5389] workingset_nodereclaim 0 [ 135.392099][ T5389] pgscan 831 [ 135.392099][ T5389] pgsteal 2 [ 135.392099][ T5389] pgscan_kswapd 0 [ 135.392099][ T5389] pgscan_direct 831 [ 135.392099][ T5389] pgscan_khugepaged 0 [ 135.392099][ T5389] pgsteal_kswapd 0 [ 135.392099][ T5389] pgsteal_direct 2 [ 135.392099][ T5389] pgsteal_khugepaged 0 [pid 5090] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5410 attached [pid 5410] chdir("./15" [pid 5090] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 17 [pid 5410] <... chdir resumed>) = 0 [pid 5410] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5410] setpgid(0, 0) = 0 [pid 5410] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 5410] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 5410] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [pid 5410] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5410] write(3, "1000", 4) = 4 [pid 5410] close(3) = 0 [pid 5410] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5410] mkdir("./file0", 000) = 0 [pid 5410] open("./file0", O_RDONLY) = 3 [pid 5410] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5410] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5410] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5410] openat(5, "memory.max", O_RDWR) = 6 [ 135.392099][ T5389] pgfault 21 [ 135.392099][ T5389] pgmajfault 0 [ 135.392099][ T5389] pgrefill 830 [ 135.392099][ T5389] pgactivate 829 [ 135.392099][ T5389] pgdeactivate 830 [ 135.392099][ T5389] pglazyfree 0 [ 135.392099][ T5389] pglazyfreed 0 [ 135.392099][ T5389] zswpin 0 [ 135.392099][ T5389] zswpout 0 [ 135.392099][ T5389] thp_fault_alloc 0 [ 135.392099][ T5389] thp_collapse_alloc 0 [ 135.583196][ T5389] Tasks state (memory values in pages): [pid 5410] write(6, "0x000000000000040e", 18 [pid 5389] <... write resumed>) = 18 [pid 5389] close(3) = 0 [pid 5389] close(4) = 0 [pid 5389] close(5) = 0 [pid 5389] close(6) = 0 [pid 5389] close(7) = -1 EBADF (Bad file descriptor) [pid 5389] close(8) = -1 EBADF (Bad file descriptor) [ 135.588821][ T5389] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 135.598687][ T5389] Out of memory and no killable processes... [ 135.611768][ T5394] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 135.632751][ T5394] CPU: 0 PID: 5394 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 135.642737][ T5394] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 135.652844][ T5394] Call Trace: [ 135.656162][ T5394] [ 135.659137][ T5394] dump_stack_lvl+0x136/0x150 [ 135.663885][ T5394] dump_header+0x10a/0xd70 [ 135.668359][ T5394] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 135.674524][ T5394] out_of_memory+0xd64/0x1660 [ 135.679285][ T5394] ? oom_killer_disable+0x2b0/0x2b0 [ 135.684572][ T5394] mem_cgroup_out_of_memory+0x206/0x270 [pid 5389] close(9) = -1 EBADF (Bad file descriptor) [pid 5389] close(10) = -1 EBADF (Bad file descriptor) [pid 5389] close(11) = -1 EBADF (Bad file descriptor) [pid 5389] close(12) = -1 EBADF (Bad file descriptor) [pid 5389] close(13) = -1 EBADF (Bad file descriptor) [pid 5389] close(14) = -1 EBADF (Bad file descriptor) [ 135.690197][ T5394] ? mem_cgroup_margin+0x130/0x130 [ 135.695417][ T5394] memory_max_write+0x2f9/0x3c0 [ 135.700347][ T5394] ? mem_cgroup_force_empty_write+0x160/0x160 [ 135.706500][ T5394] ? lock_sync+0x190/0x190 [ 135.711014][ T5394] cgroup_file_write+0x1e2/0x7b0 [ 135.716030][ T5394] ? mem_cgroup_force_empty_write+0x160/0x160 [ 135.722191][ T5394] ? kill_css+0x3b0/0x3b0 [ 135.726634][ T5394] ? lock_acquire+0x32/0xc0 [ 135.731224][ T5394] ? kill_css+0x3b0/0x3b0 [ 135.735644][ T5394] kernfs_fop_write_iter+0x3f1/0x600 [pid 5389] close(15) = -1 EBADF (Bad file descriptor) [pid 5389] close(16) = -1 EBADF (Bad file descriptor) [pid 5389] close(17) = -1 EBADF (Bad file descriptor) [pid 5389] close(18) = -1 EBADF (Bad file descriptor) [pid 5389] close(19) = -1 EBADF (Bad file descriptor) [pid 5389] close(20) = -1 EBADF (Bad file descriptor) [pid 5389] close(21) = -1 EBADF (Bad file descriptor) [pid 5389] close(22) = -1 EBADF (Bad file descriptor) [pid 5389] close(23) = -1 EBADF (Bad file descriptor) [ 135.741019][ T5394] vfs_write+0x9ed/0xe10 [ 135.745355][ T5394] ? kernel_write+0x670/0x670 [ 135.750120][ T5394] ? find_held_lock+0x2d/0x110 [ 135.754953][ T5394] ? __fget_light+0x20a/0x270 [ 135.759711][ T5394] ksys_write+0x12b/0x250 [ 135.764125][ T5394] ? __ia32_sys_read+0xb0/0xb0 [ 135.769002][ T5394] ? lockdep_hardirqs_on+0x7d/0x100 [ 135.774269][ T5394] ? _raw_spin_unlock_irq+0x2e/0x50 [ 135.779541][ T5394] ? ptrace_notify+0xfe/0x140 [ 135.784280][ T5394] do_syscall_64+0x39/0xb0 [ 135.788767][ T5394] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 135.794730][ T5394] RIP: 0033:0x7faecf034129 [ 135.799212][ T5394] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 135.818887][ T5394] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 135.827374][ T5394] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 135.835396][ T5394] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [pid 5389] close(24) = -1 EBADF (Bad file descriptor) [pid 5389] close(25) = -1 EBADF (Bad file descriptor) [pid 5389] close(26) = -1 EBADF (Bad file descriptor) [pid 5389] close(27) = -1 EBADF (Bad file descriptor) [pid 5389] close(28) = -1 EBADF (Bad file descriptor) [pid 5389] close(29) = -1 EBADF (Bad file descriptor) [pid 5389] exit_group(0) = ? [pid 5389] +++ exited with 0 +++ [pid 5087] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=14, si_uid=0, si_status=0, si_utime=0, si_stime=6 /* 0.06 s */} --- [pid 5087] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5087] umount2("./12", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5087] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5087] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5087] umount2("./12/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./12/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5087] unlink("./12/binderfs") = 0 [pid 5087] umount2("./12/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./12/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5087] unlink("./12/cgroup") = 0 [pid 5087] umount2("./12/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./12/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5087] unlink("./12/cgroup.net") = 0 [pid 5087] umount2("./12/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5087] umount2("./12/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./12/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5087] umount2("./12/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] openat(AT_FDCWD, "./12/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5087] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5087] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5087] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5087] close(4) = 0 [pid 5087] rmdir("./12/file0") = 0 [pid 5087] umount2("./12/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./12/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5087] unlink("./12/cgroup.cpu") = 0 [pid 5087] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [ 135.843411][ T5394] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 135.851520][ T5394] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 135.859544][ T5394] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 000000000000000e [ 135.867597][ T5394] [pid 5087] close(3) = 0 [pid 5087] rmdir("./12") = 0 [pid 5087] mkdir("./13", 0777) = 0 [pid 5087] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5412 attached [pid 5412] chdir("./13" [pid 5087] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 15 [pid 5412] <... chdir resumed>) = 0 [pid 5412] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5412] setpgid(0, 0) = 0 [ 135.921109][ T5394] memory: usage 8kB, limit 0kB, failcnt 36 [ 135.936029][ T5394] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 135.948995][ T5394] Memory cgroup stats for /syz1: [ 135.949298][ T5394] anon 0 [ 135.949298][ T5394] file 0 [ 135.949298][ T5394] kernel 8192 [ 135.949298][ T5394] kernel_stack 0 [ 135.949298][ T5394] pagetables 0 [ 135.949298][ T5394] sec_pagetables 0 [ 135.949298][ T5394] percpu 0 [ 135.949298][ T5394] sock 0 [ 135.949298][ T5394] vmalloc 0 [ 135.949298][ T5394] shmem 0 [ 135.949298][ T5394] zswap 0 [ 135.949298][ T5394] zswapped 0 [ 135.949298][ T5394] file_mapped 0 [ 135.949298][ T5394] file_dirty 0 [ 135.949298][ T5394] file_writeback 0 [ 135.949298][ T5394] swapcached 0 [ 135.949298][ T5394] anon_thp 0 [ 135.949298][ T5394] file_thp 0 [ 135.949298][ T5394] shmem_thp 0 [ 135.949298][ T5394] inactive_anon 0 [ 135.949298][ T5394] active_anon 0 [ 135.949298][ T5394] inactive_file 0 [ 135.949298][ T5394] active_file 0 [ 135.949298][ T5394] unevictable 0 [ 135.949298][ T5394] slab_reclaimable 6752 [ 135.949298][ T5394] slab_unreclaimable 0 [ 135.949298][ T5394] slab 6752 [ 135.949298][ T5394] workingset_refault_anon 0 [ 135.949298][ T5394] workingset_refault_file 0 [ 135.949298][ T5394] workingset_activate_anon 0 [ 135.949298][ T5394] workingset_activate_file 0 [ 135.949298][ T5394] workingset_restore_anon 0 [ 135.949298][ T5394] workingset_restore_file 0 [ 135.949298][ T5394] workingset_nodereclaim 0 [ 135.949298][ T5394] pgscan 831 [ 135.949298][ T5394] pgsteal 2 [ 135.949298][ T5394] pgscan_kswapd 0 [ 135.949298][ T5394] pgscan_direct 831 [ 135.949298][ T5394] pgscan_khugepaged 0 [ 135.949298][ T5394] pgsteal_kswapd 0 [ 135.949298][ T5394] pgsteal_direct 2 [ 135.949298][ T5394] pgsteal_khugepaged 0 [ 135.949298][ T5394] pgfault 21 [ 135.949298][ T5394] pgmajfault 0 [ 135.949298][ T5394] pgrefill 830 [ 135.949298][ T5394] pgactivate 829 [ 135.949298][ T5394] pgdeactivate 830 [ 135.949298][ T5394] pglazyfree 0 [ 135.949298][ T5394] pglazyfreed 0 [pid 5412] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 5412] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 5412] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 5412] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5412] write(3, "1000", 4) = 4 [pid 5412] close(3) = 0 [pid 5412] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5412] mkdir("./file0", 000) = 0 [pid 5412] open("./file0", O_RDONLY) = 3 [pid 5412] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5412] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5412] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5412] openat(5, "memory.max", O_RDWR) = 6 [ 135.949298][ T5394] zswpin 0 [ 135.949298][ T5394] zswpout 0 [ 135.949298][ T5394] thp_fault_alloc 0 [ 135.949298][ T5394] thp_collapse_alloc 0 [ 136.148550][ T5394] Tasks state (memory values in pages): [ 136.159092][ T5394] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5412] write(6, "0x000000000000040e", 18 [pid 5394] <... write resumed>) = 18 [ 136.174737][ T5394] Out of memory and no killable processes... [ 136.180852][ T5401] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 136.196684][ T5401] CPU: 0 PID: 5401 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 136.206663][ T5401] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 136.216772][ T5401] Call Trace: [ 136.220095][ T5401] [ 136.223071][ T5401] dump_stack_lvl+0x136/0x150 [ 136.227821][ T5401] dump_header+0x10a/0xd70 [ 136.232302][ T5401] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 136.238459][ T5401] out_of_memory+0xd64/0x1660 [ 136.243224][ T5401] ? oom_killer_disable+0x2b0/0x2b0 [ 136.248502][ T5401] ? find_held_lock+0x2d/0x110 [ 136.253332][ T5401] mem_cgroup_out_of_memory+0x206/0x270 [ 136.258950][ T5401] ? mem_cgroup_margin+0x130/0x130 [ 136.264146][ T5401] ? _raw_spin_unlock_irqrestore+0x54/0x70 [ 136.270045][ T5401] memory_max_write+0x2f9/0x3c0 [pid 5394] close(3) = 0 [pid 5394] close(4) = 0 [pid 5394] close(5) = 0 [pid 5394] close(6) = 0 [pid 5394] close(7) = -1 EBADF (Bad file descriptor) [pid 5394] close(8) = -1 EBADF (Bad file descriptor) [pid 5394] close(9) = -1 EBADF (Bad file descriptor) [pid 5394] close(10) = -1 EBADF (Bad file descriptor) [pid 5394] close(11) = -1 EBADF (Bad file descriptor) [pid 5394] close(12) = -1 EBADF (Bad file descriptor) [ 136.274986][ T5401] ? mem_cgroup_force_empty_write+0x160/0x160 [ 136.281143][ T5401] ? lock_sync+0x190/0x190 [ 136.285648][ T5401] cgroup_file_write+0x1e2/0x7b0 [ 136.290665][ T5401] ? mem_cgroup_force_empty_write+0x160/0x160 [ 136.296814][ T5401] ? kill_css+0x3b0/0x3b0 [ 136.301230][ T5401] ? lock_acquire+0x32/0xc0 [ 136.305817][ T5401] ? kill_css+0x3b0/0x3b0 [ 136.310227][ T5401] kernfs_fop_write_iter+0x3f1/0x600 [ 136.315618][ T5401] vfs_write+0x9ed/0xe10 [ 136.319955][ T5401] ? kernel_write+0x670/0x670 [pid 5394] close(13) = -1 EBADF (Bad file descriptor) [ 136.324736][ T5401] ? find_held_lock+0x2d/0x110 [ 136.329583][ T5401] ? __fget_light+0x20a/0x270 [ 136.334351][ T5401] ksys_write+0x12b/0x250 [ 136.338807][ T5401] ? __ia32_sys_read+0xb0/0xb0 [ 136.343657][ T5401] ? lockdep_hardirqs_on+0x7d/0x100 [ 136.348921][ T5401] ? _raw_spin_unlock_irq+0x2e/0x50 [ 136.354196][ T5401] ? ptrace_notify+0xfe/0x140 [ 136.358936][ T5401] do_syscall_64+0x39/0xb0 [ 136.363429][ T5401] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 136.369391][ T5401] RIP: 0033:0x7faecf034129 [ 136.373859][ T5401] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 136.393534][ T5401] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 136.402015][ T5401] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 136.410046][ T5401] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 136.418078][ T5401] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [pid 5394] close(14) = -1 EBADF (Bad file descriptor) [pid 5394] close(15) = -1 EBADF (Bad file descriptor) [pid 5394] close(16) = -1 EBADF (Bad file descriptor) [pid 5394] close(17) = -1 EBADF (Bad file descriptor) [pid 5394] close(18) = -1 EBADF (Bad file descriptor) [pid 5394] close(19) = -1 EBADF (Bad file descriptor) [pid 5394] close(20) = -1 EBADF (Bad file descriptor) [pid 5394] close(21) = -1 EBADF (Bad file descriptor) [pid 5394] close(22) = -1 EBADF (Bad file descriptor) [pid 5394] close(23) = -1 EBADF (Bad file descriptor) [pid 5394] close(24) = -1 EBADF (Bad file descriptor) [pid 5394] close(25) = -1 EBADF (Bad file descriptor) [pid 5394] close(26) = -1 EBADF (Bad file descriptor) [pid 5394] close(27) = -1 EBADF (Bad file descriptor) [pid 5394] close(28) = -1 EBADF (Bad file descriptor) [pid 5394] close(29) = -1 EBADF (Bad file descriptor) [pid 5394] exit_group(0) = ? [pid 5394] +++ exited with 0 +++ [pid 5089] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=16, si_uid=0, si_status=0, si_utime=0, si_stime=9 /* 0.09 s */} --- [pid 5089] umount2("./14", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5089] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5089] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5089] umount2("./14/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./14/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5089] unlink("./14/binderfs") = 0 [pid 5089] umount2("./14/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./14/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5089] unlink("./14/cgroup") = 0 [pid 5089] umount2("./14/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./14/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5089] unlink("./14/cgroup.net") = 0 [pid 5089] umount2("./14/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5089] umount2("./14/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./14/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5089] umount2("./14/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] openat(AT_FDCWD, "./14/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5089] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5089] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5089] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5089] close(4) = 0 [pid 5089] rmdir("./14/file0") = 0 [pid 5089] umount2("./14/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./14/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5089] unlink("./14/cgroup.cpu") = 0 [pid 5089] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5089] close(3) = 0 [pid 5089] rmdir("./14") = 0 [pid 5089] mkdir("./15", 0777) = 0 [pid 5089] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5417 attached [pid 5417] chdir("./15" [pid 5089] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 17 [pid 5417] <... chdir resumed>) = 0 [pid 5417] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5417] setpgid(0, 0) = 0 [ 136.426106][ T5401] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 136.434135][ T5401] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 000000000000000b [ 136.442204][ T5401] [pid 5417] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 5417] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [pid 5417] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 5417] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5417] write(3, "1000", 4) = 4 [pid 5417] close(3) = 0 [pid 5417] symlink("/dev/binderfs", "./binderfs") = 0 [ 136.493694][ T5401] memory: usage 8kB, limit 0kB, failcnt 36 [ 136.503106][ T5401] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 136.512990][ T5401] Memory cgroup stats for /syz1: [ 136.513267][ T5401] anon 0 [ 136.513267][ T5401] file 0 [ 136.513267][ T5401] kernel 8192 [ 136.513267][ T5401] kernel_stack 0 [ 136.513267][ T5401] pagetables 0 [ 136.513267][ T5401] sec_pagetables 0 [ 136.513267][ T5401] percpu 0 [ 136.513267][ T5401] sock 0 [ 136.513267][ T5401] vmalloc 0 [ 136.513267][ T5401] shmem 0 [ 136.513267][ T5401] zswap 0 [ 136.513267][ T5401] zswapped 0 [ 136.513267][ T5401] file_mapped 0 [ 136.513267][ T5401] file_dirty 0 [ 136.513267][ T5401] file_writeback 0 [ 136.513267][ T5401] swapcached 0 [ 136.513267][ T5401] anon_thp 0 [ 136.513267][ T5401] file_thp 0 [ 136.513267][ T5401] shmem_thp 0 [ 136.513267][ T5401] inactive_anon 0 [ 136.513267][ T5401] active_anon 0 [ 136.513267][ T5401] inactive_file 0 [ 136.513267][ T5401] active_file 0 [ 136.513267][ T5401] unevictable 0 [ 136.513267][ T5401] slab_reclaimable 6752 [ 136.513267][ T5401] slab_unreclaimable 0 [ 136.513267][ T5401] slab 6752 [ 136.513267][ T5401] workingset_refault_anon 0 [ 136.513267][ T5401] workingset_refault_file 0 [ 136.513267][ T5401] workingset_activate_anon 0 [ 136.513267][ T5401] workingset_activate_file 0 [ 136.513267][ T5401] workingset_restore_anon 0 [ 136.513267][ T5401] workingset_restore_file 0 [ 136.513267][ T5401] workingset_nodereclaim 0 [ 136.513267][ T5401] pgscan 831 [ 136.513267][ T5401] pgsteal 2 [ 136.513267][ T5401] pgscan_kswapd 0 [ 136.513267][ T5401] pgscan_direct 831 [ 136.513267][ T5401] pgscan_khugepaged 0 [ 136.513267][ T5401] pgsteal_kswapd 0 [ 136.513267][ T5401] pgsteal_direct 2 [ 136.513267][ T5401] pgsteal_khugepaged 0 [ 136.513267][ T5401] pgfault 21 [ 136.513267][ T5401] pgmajfault 0 [ 136.513267][ T5401] pgrefill 830 [ 136.513267][ T5401] pgactivate 829 [ 136.513267][ T5401] pgdeactivate 830 [ 136.513267][ T5401] pglazyfree 0 [ 136.513267][ T5401] pglazyfreed 0 [ 136.513267][ T5401] zswpin 0 [ 136.513267][ T5401] zswpout 0 [pid 5417] mkdir("./file0", 000) = 0 [pid 5417] open("./file0", O_RDONLY) = 3 [pid 5417] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5417] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5417] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5417] openat(5, "memory.max", O_RDWR) = 6 [ 136.513267][ T5401] thp_fault_alloc 0 [ 136.513267][ T5401] thp_collapse_alloc 0 [ 136.707068][ T5401] Tasks state (memory values in pages): [ 136.734256][ T5401] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 136.747521][ T5401] Out of memory and no killable processes... [ 136.754834][ T5407] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 136.767070][ T5407] CPU: 0 PID: 5407 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 136.777037][ T5407] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 136.787149][ T5407] Call Trace: [ 136.790472][ T5407] [pid 5417] write(6, "0x000000000000040e", 18 [pid 5401] <... write resumed>) = 18 [ 136.793451][ T5407] dump_stack_lvl+0x136/0x150 [ 136.798214][ T5407] dump_header+0x10a/0xd70 [ 136.802700][ T5407] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 136.808854][ T5407] out_of_memory+0xd64/0x1660 [ 136.813612][ T5407] ? oom_killer_disable+0x2b0/0x2b0 [ 136.818961][ T5407] mem_cgroup_out_of_memory+0x206/0x270 [ 136.824597][ T5407] ? mem_cgroup_margin+0x130/0x130 [ 136.829805][ T5407] memory_max_write+0x2f9/0x3c0 [ 136.834739][ T5407] ? mem_cgroup_force_empty_write+0x160/0x160 [ 136.840895][ T5407] ? lock_sync+0x190/0x190 [ 136.845389][ T5407] cgroup_file_write+0x1e2/0x7b0 [ 136.850412][ T5407] ? mem_cgroup_force_empty_write+0x160/0x160 [ 136.856556][ T5407] ? kill_css+0x3b0/0x3b0 [ 136.860965][ T5407] ? lock_acquire+0x32/0xc0 [ 136.865552][ T5407] ? kill_css+0x3b0/0x3b0 [ 136.869954][ T5407] kernfs_fop_write_iter+0x3f1/0x600 [ 136.875323][ T5407] vfs_write+0x9ed/0xe10 [ 136.879652][ T5407] ? kernel_write+0x670/0x670 [ 136.884413][ T5407] ? find_held_lock+0x2d/0x110 [ 136.889252][ T5407] ? __fget_light+0x20a/0x270 [ 136.894014][ T5407] ksys_write+0x12b/0x250 [ 136.898429][ T5407] ? __ia32_sys_read+0xb0/0xb0 [ 136.903265][ T5407] ? lockdep_hardirqs_on+0x7d/0x100 [ 136.908542][ T5407] ? _raw_spin_unlock_irq+0x2e/0x50 [ 136.913841][ T5407] ? ptrace_notify+0xfe/0x140 [ 136.918738][ T5407] do_syscall_64+0x39/0xb0 [ 136.923238][ T5407] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 136.929201][ T5407] RIP: 0033:0x7faecf034129 [ 136.933679][ T5407] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 136.953347][ T5407] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 136.961840][ T5407] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 136.969870][ T5407] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 136.977896][ T5407] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 136.985926][ T5407] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [pid 5401] close(3) = 0 [pid 5401] close(4) = 0 [pid 5401] close(5) = 0 [ 136.993953][ T5407] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 000000000000000b [ 137.002032][ T5407] [ 137.013028][ T5407] memory: usage 8kB, limit 0kB, failcnt 36 [ 137.019552][ T5407] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 137.030764][ T5407] Memory cgroup stats for /syz1: [ 137.031033][ T5407] anon 0 [ 137.031033][ T5407] file 0 [ 137.031033][ T5407] kernel 8192 [ 137.031033][ T5407] kernel_stack 0 [ 137.031033][ T5407] pagetables 0 [ 137.031033][ T5407] sec_pagetables 0 [ 137.031033][ T5407] percpu 0 [ 137.031033][ T5407] sock 0 [ 137.031033][ T5407] vmalloc 0 [ 137.031033][ T5407] shmem 0 [ 137.031033][ T5407] zswap 0 [ 137.031033][ T5407] zswapped 0 [ 137.031033][ T5407] file_mapped 0 [ 137.031033][ T5407] file_dirty 0 [ 137.031033][ T5407] file_writeback 0 [ 137.031033][ T5407] swapcached 0 [ 137.031033][ T5407] anon_thp 0 [ 137.031033][ T5407] file_thp 0 [ 137.031033][ T5407] shmem_thp 0 [ 137.031033][ T5407] inactive_anon 0 [ 137.031033][ T5407] active_anon 0 [ 137.031033][ T5407] inactive_file 0 [ 137.031033][ T5407] active_file 0 [ 137.031033][ T5407] unevictable 0 [ 137.031033][ T5407] slab_reclaimable 6752 [ 137.031033][ T5407] slab_unreclaimable 0 [ 137.031033][ T5407] slab 6752 [ 137.031033][ T5407] workingset_refault_anon 0 [ 137.031033][ T5407] workingset_refault_file 0 [ 137.031033][ T5407] workingset_activate_anon 0 [ 137.031033][ T5407] workingset_activate_file 0 [ 137.031033][ T5407] workingset_restore_anon 0 [ 137.031033][ T5407] workingset_restore_file 0 [ 137.031033][ T5407] workingset_nodereclaim 0 [ 137.031033][ T5407] pgscan 831 [ 137.031033][ T5407] pgsteal 2 [ 137.031033][ T5407] pgscan_kswapd 0 [ 137.031033][ T5407] pgscan_direct 831 [ 137.031033][ T5407] pgscan_khugepaged 0 [ 137.031033][ T5407] pgsteal_kswapd 0 [ 137.031033][ T5407] pgsteal_direct 2 [ 137.031033][ T5407] pgsteal_khugepaged 0 [ 137.031033][ T5407] pgfault 21 [ 137.031033][ T5407] pgmajfault 0 [ 137.031033][ T5407] pgrefill 830 [ 137.031033][ T5407] pgactivate 829 [ 137.031033][ T5407] pgdeactivate 830 [pid 5401] close(6) = 0 [pid 5401] close(7) = -1 EBADF (Bad file descriptor) [ 137.031033][ T5407] pglazyfree 0 [ 137.031033][ T5407] pglazyfreed 0 [ 137.031033][ T5407] zswpin 0 [ 137.031033][ T5407] zswpout 0 [ 137.031033][ T5407] thp_fault_alloc 0 [ 137.031033][ T5407] thp_collapse_alloc 0 [ 137.224607][ T5407] Tasks state (memory values in pages): [ 137.230233][ T5407] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 137.240606][ T5407] Out of memory and no killable processes... [pid 5407] <... write resumed>) = 18 [pid 5401] close(8 [pid 5407] close(3 [pid 5401] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5407] <... close resumed>) = 0 [pid 5401] close(9 [pid 5407] close(4 [pid 5401] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5407] <... close resumed>) = 0 [pid 5401] close(10 [pid 5407] close(5 [pid 5401] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5407] <... close resumed>) = 0 [pid 5401] close(11 [pid 5407] close(6 [pid 5401] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5407] <... close resumed>) = 0 [pid 5401] close(12 [pid 5407] close(7 [pid 5401] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5407] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5401] close(13 [pid 5407] close(8 [pid 5401] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5407] <... close resumed>) = -1 EBADF (Bad file descriptor) [ 137.247438][ T5410] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 137.271558][ T5410] CPU: 1 PID: 5410 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 137.281587][ T5410] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 137.291697][ T5410] Call Trace: [ 137.295018][ T5410] [pid 5401] close(14 [pid 5407] close(9 [pid 5401] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5407] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5401] close(15 [pid 5407] close(10 [pid 5401] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5407] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5401] close(16 [pid 5407] close(11 [pid 5401] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5407] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5401] close(17 [pid 5407] close(12 [pid 5401] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5407] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5401] close(18 [pid 5407] close(13 [pid 5401] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5407] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5401] close(19 [pid 5407] close(14 [pid 5401] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5407] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5401] close(20 [pid 5407] close(15 [pid 5401] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5407] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5401] close(21 [pid 5407] close(16 [pid 5401] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5407] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5401] close(22 [pid 5407] close(17 [pid 5401] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5407] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5401] close(23 [pid 5407] close(18 [pid 5401] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5407] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5401] close(24 [pid 5407] close(19 [pid 5401] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5407] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5401] close(25 [pid 5407] close(20 [pid 5401] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5407] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5401] close(26 [pid 5407] close(21 [pid 5401] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5407] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5401] close(27 [pid 5407] close(22 [pid 5401] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5407] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5401] close(28 [pid 5407] close(23 [pid 5401] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5407] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5401] close(29 [pid 5407] close(24 [pid 5401] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5407] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5401] exit_group(0 [pid 5407] close(25 [pid 5401] <... exit_group resumed>) = ? [pid 5407] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5401] +++ exited with 0 +++ [pid 5407] close(26) = -1 EBADF (Bad file descriptor) [pid 5407] close(27) = -1 EBADF (Bad file descriptor) [pid 5407] close(28) = -1 EBADF (Bad file descriptor) [pid 5407] close(29) = -1 EBADF (Bad file descriptor) [pid 5407] exit_group(0) = ? [pid 5407] +++ exited with 0 +++ [pid 5086] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=13, si_uid=0, si_status=0, si_utime=0, si_stime=7 /* 0.07 s */} --- [pid 5086] restart_syscall(<... resuming interrupted clone ...> [pid 5085] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=13, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- [pid 5086] <... restart_syscall resumed>) = 0 [pid 5085] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5086] umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5086] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5085] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5086] <... openat resumed>) = 3 [pid 5085] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5086] fstat(3, [pid 5085] <... openat resumed>) = 3 [pid 5086] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5085] fstat(3, [pid 5086] getdents64(3, [pid 5085] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5086] <... getdents64 resumed>0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5085] getdents64(3, [pid 5086] umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5085] <... getdents64 resumed>0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5086] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5085] umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5086] lstat("./11/binderfs", [pid 5085] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5086] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5085] lstat("./11/binderfs", [pid 5086] unlink("./11/binderfs" [pid 5085] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5086] <... unlink resumed>) = 0 [pid 5085] unlink("./11/binderfs" [pid 5086] umount2("./11/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5085] <... unlink resumed>) = 0 [pid 5086] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5085] umount2("./11/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5086] lstat("./11/cgroup", [pid 5085] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5086] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5085] lstat("./11/cgroup", [pid 5086] unlink("./11/cgroup" [pid 5085] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5086] <... unlink resumed>) = 0 [pid 5085] unlink("./11/cgroup" [pid 5086] umount2("./11/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5085] <... unlink resumed>) = 0 [pid 5086] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5085] umount2("./11/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5086] lstat("./11/cgroup.net", [pid 5085] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5086] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5085] lstat("./11/cgroup.net", [pid 5086] unlink("./11/cgroup.net" [pid 5085] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5086] <... unlink resumed>) = 0 [pid 5085] unlink("./11/cgroup.net" [pid 5086] umount2("./11/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5085] <... unlink resumed>) = 0 [ 137.297990][ T5410] dump_stack_lvl+0x136/0x150 [ 137.302739][ T5410] dump_header+0x10a/0xd70 [ 137.307227][ T5410] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 137.313399][ T5410] out_of_memory+0xd64/0x1660 [ 137.318154][ T5410] ? oom_killer_disable+0x2b0/0x2b0 [ 137.323445][ T5410] mem_cgroup_out_of_memory+0x206/0x270 [ 137.329085][ T5410] ? mem_cgroup_margin+0x130/0x130 [ 137.334307][ T5410] memory_max_write+0x2f9/0x3c0 [ 137.339250][ T5410] ? mem_cgroup_force_empty_write+0x160/0x160 [ 137.345407][ T5410] ? lock_sync+0x190/0x190 [ 137.349928][ T5410] cgroup_file_write+0x1e2/0x7b0 [ 137.354952][ T5410] ? mem_cgroup_force_empty_write+0x160/0x160 [ 137.361096][ T5410] ? kill_css+0x3b0/0x3b0 [ 137.365519][ T5410] ? lock_acquire+0x32/0xc0 [ 137.370110][ T5410] ? kill_css+0x3b0/0x3b0 [ 137.374515][ T5410] kernfs_fop_write_iter+0x3f1/0x600 [ 137.379886][ T5410] vfs_write+0x9ed/0xe10 [ 137.384220][ T5410] ? kernel_write+0x670/0x670 [ 137.388982][ T5410] ? find_held_lock+0x2d/0x110 [ 137.393824][ T5410] ? __fget_light+0x20a/0x270 [ 137.398579][ T5410] ksys_write+0x12b/0x250 [ 137.402985][ T5410] ? __ia32_sys_read+0xb0/0xb0 [ 137.407834][ T5410] ? lockdep_hardirqs_on+0x7d/0x100 [ 137.413098][ T5410] ? _raw_spin_unlock_irq+0x2e/0x50 [ 137.418370][ T5410] ? ptrace_notify+0xfe/0x140 [ 137.423113][ T5410] do_syscall_64+0x39/0xb0 [ 137.427644][ T5410] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 137.433628][ T5410] RIP: 0033:0x7faecf034129 [ 137.438094][ T5410] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 137.457867][ T5410] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 137.466345][ T5410] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 137.474372][ T5410] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 137.482403][ T5410] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 137.490431][ T5410] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [pid 5085] umount2("./11/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5086] <... umount2 resumed>) = 0 [pid 5086] umount2("./11/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./11/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5086] umount2("./11/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] openat(AT_FDCWD, "./11/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5086] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5086] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5086] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5086] close(4) = 0 [pid 5086] rmdir("./11/file0") = 0 [pid 5086] umount2("./11/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./11/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5086] unlink("./11/cgroup.cpu") = 0 [pid 5086] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5086] close(3) = 0 [pid 5086] rmdir("./11") = 0 [ 137.498455][ T5410] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 000000000000000f [ 137.506520][ T5410] [ 137.522230][ T5410] memory: usage 8kB, limit 0kB, failcnt 36 [ 137.528311][ T5410] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 137.535906][ T5410] Memory cgroup stats for /syz1: [ 137.536210][ T5410] anon 0 [ 137.536210][ T5410] file 0 [ 137.536210][ T5410] kernel 8192 [pid 5086] mkdir("./12", 0777) = 0 [pid 5086] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555c0c5d0) = 14 [ 137.536210][ T5410] kernel_stack 0 [ 137.536210][ T5410] pagetables 0 [ 137.536210][ T5410] sec_pagetables 0 [ 137.536210][ T5410] percpu 0 [ 137.536210][ T5410] sock 0 [ 137.536210][ T5410] vmalloc 0 [ 137.536210][ T5410] shmem 0 [ 137.536210][ T5410] zswap 0 [ 137.536210][ T5410] zswapped 0 [ 137.536210][ T5410] file_mapped 0 [ 137.536210][ T5410] file_dirty 0 [ 137.536210][ T5410] file_writeback 0 [ 137.536210][ T5410] swapcached 0 [ 137.536210][ T5410] anon_thp 0 [ 137.536210][ T5410] file_thp 0 [ 137.536210][ T5410] shmem_thp 0 [ 137.536210][ T5410] inactive_anon 0 [ 137.536210][ T5410] active_anon 0 [ 137.536210][ T5410] inactive_file 0 [ 137.536210][ T5410] active_file 0 [ 137.536210][ T5410] unevictable 0 [ 137.536210][ T5410] slab_reclaimable 6752 [ 137.536210][ T5410] slab_unreclaimable 0 [ 137.536210][ T5410] slab 6752 [ 137.536210][ T5410] workingset_refault_anon 0 [ 137.536210][ T5410] workingset_refault_file 0 [ 137.536210][ T5410] workingset_activate_anon 0 [ 137.536210][ T5410] workingset_activate_file 0 [ 137.536210][ T5410] workingset_restore_anon 0 [ 137.536210][ T5410] workingset_restore_file 0 [ 137.536210][ T5410] workingset_nodereclaim 0 [ 137.536210][ T5410] pgscan 831 [ 137.536210][ T5410] pgsteal 2 [ 137.536210][ T5410] pgscan_kswapd 0 [ 137.536210][ T5410] pgscan_direct 831 [ 137.536210][ T5410] pgscan_khugepaged 0 [ 137.536210][ T5410] pgsteal_kswapd 0 [ 137.536210][ T5410] pgsteal_direct 2 [ 137.536210][ T5410] pgsteal_khugepaged 0 [ 137.536210][ T5410] pgfault 21 [ 137.536210][ T5410] pgmajfault 0 [ 137.536210][ T5410] pgrefill 830 [ 137.536210][ T5410] pgactivate 829 [ 137.536210][ T5410] pgdeactivate 830 ./strace-static-x86_64: Process 5423 attached [pid 5085] <... umount2 resumed>) = 0 [pid 5085] umount2("./11/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./11/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5085] umount2("./11/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] openat(AT_FDCWD, "./11/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5085] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5085] getdents64(4, [pid 5423] chdir("./12" [pid 5085] <... getdents64 resumed>0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5423] <... chdir resumed>) = 0 [pid 5085] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5423] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5085] close(4) = 0 [pid 5423] <... prctl resumed>) = 0 [pid 5085] rmdir("./11/file0" [pid 5423] setpgid(0, 0 [pid 5085] <... rmdir resumed>) = 0 [pid 5423] <... setpgid resumed>) = 0 [pid 5085] umount2("./11/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5423] symlink("/syzcgroup/unified/syz3", "./cgroup" [pid 5085] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5423] <... symlink resumed>) = 0 [pid 5085] lstat("./11/cgroup.cpu", [pid 5423] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu" [pid 5085] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5423] <... symlink resumed>) = 0 [pid 5085] unlink("./11/cgroup.cpu" [pid 5423] symlink("/syzcgroup/net/syz3", "./cgroup.net" [pid 5085] <... unlink resumed>) = 0 [ 137.536210][ T5410] pglazyfree 0 [ 137.536210][ T5410] pglazyfreed 0 [ 137.536210][ T5410] zswpin 0 [ 137.536210][ T5410] zswpout 0 [ 137.536210][ T5410] thp_fault_alloc 0 [ 137.536210][ T5410] thp_collapse_alloc 0 [pid 5423] <... symlink resumed>) = 0 [pid 5085] getdents64(3, [pid 5423] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5423] write(3, "1000", 4) = 4 [pid 5423] close(3) = 0 [pid 5423] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5423] mkdir("./file0", 000) = 0 [pid 5410] <... write resumed>) = 18 [pid 5085] <... getdents64 resumed>0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5423] open("./file0", O_RDONLY) = 3 [pid 5423] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5423] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5410] close(3 [pid 5085] close(3 [pid 5423] <... openat resumed>) = 4 [pid 5423] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5423] openat(5, "memory.max", O_RDWR) = 6 [pid 5423] write(6, "0x000000000000040e", 18 [pid 5410] <... close resumed>) = 0 [pid 5085] <... close resumed>) = 0 [pid 5410] close(4 [pid 5085] rmdir("./11" [pid 5410] <... close resumed>) = 0 [ 137.753741][ T5410] Tasks state (memory values in pages): [ 137.759362][ T5410] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 137.769627][ T5410] Out of memory and no killable processes... [ 137.777178][ T5412] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 137.803140][ T5412] CPU: 1 PID: 5412 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 137.813135][ T5412] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 137.823252][ T5412] Call Trace: [ 137.826590][ T5412] [ 137.829594][ T5412] dump_stack_lvl+0x136/0x150 [ 137.834339][ T5412] dump_header+0x10a/0xd70 [ 137.838821][ T5412] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 137.844995][ T5412] out_of_memory+0xd64/0x1660 [ 137.849755][ T5412] ? oom_killer_disable+0x2b0/0x2b0 [ 137.855037][ T5412] mem_cgroup_out_of_memory+0x206/0x270 [ 137.860660][ T5412] ? mem_cgroup_margin+0x130/0x130 [ 137.865872][ T5412] memory_max_write+0x2f9/0x3c0 [ 137.870798][ T5412] ? mem_cgroup_force_empty_write+0x160/0x160 [ 137.876941][ T5412] ? lock_sync+0x190/0x190 [ 137.881427][ T5412] cgroup_file_write+0x1e2/0x7b0 [ 137.886480][ T5412] ? mem_cgroup_force_empty_write+0x160/0x160 [ 137.892629][ T5412] ? kill_css+0x3b0/0x3b0 [ 137.897038][ T5412] ? lock_acquire+0x32/0xc0 [ 137.901613][ T5412] ? kill_css+0x3b0/0x3b0 [ 137.906012][ T5412] kernfs_fop_write_iter+0x3f1/0x600 [ 137.911379][ T5412] vfs_write+0x9ed/0xe10 [ 137.915702][ T5412] ? kernel_write+0x670/0x670 [ 137.920434][ T5412] ? find_held_lock+0x2d/0x110 [ 137.925240][ T5412] ? __fget_light+0x20a/0x270 [ 137.929966][ T5412] ksys_write+0x12b/0x250 [ 137.934343][ T5412] ? __ia32_sys_read+0xb0/0xb0 [ 137.939155][ T5412] ? lockdep_hardirqs_on+0x7d/0x100 [ 137.944388][ T5412] ? _raw_spin_unlock_irq+0x2e/0x50 [ 137.949647][ T5412] ? ptrace_notify+0xfe/0x140 [ 137.954390][ T5412] do_syscall_64+0x39/0xb0 [ 137.958851][ T5412] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 137.964786][ T5412] RIP: 0033:0x7faecf034129 [ 137.969225][ T5412] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 137.988862][ T5412] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 5410] close(5 [pid 5085] <... rmdir resumed>) = 0 [pid 5410] <... close resumed>) = 0 [pid 5085] mkdir("./12", 0777 [pid 5410] close(6 [pid 5085] <... mkdir resumed>) = 0 [pid 5410] <... close resumed>) = 0 [pid 5085] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5410] close(7) = -1 EBADF (Bad file descriptor) ./strace-static-x86_64: Process 5429 attached [pid 5410] close(8 [pid 5429] chdir("./12" [pid 5410] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5085] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 14 [pid 5429] <... chdir resumed>) = 0 [pid 5410] close(9 [pid 5429] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5410] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5429] <... prctl resumed>) = 0 [pid 5410] close(10 [pid 5429] setpgid(0, 0 [pid 5410] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5429] <... setpgid resumed>) = 0 [pid 5429] symlink("/syzcgroup/unified/syz0", "./cgroup" [pid 5410] close(11 [pid 5429] <... symlink resumed>) = 0 [pid 5410] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5429] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 5410] close(12 [pid 5429] symlink("/syzcgroup/net/syz0", "./cgroup.net" [pid 5410] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5429] <... symlink resumed>) = 0 [pid 5410] close(13 [pid 5429] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5410] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5429] <... openat resumed>) = 3 [pid 5410] close(14 [pid 5429] write(3, "1000", 4 [pid 5410] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5429] <... write resumed>) = 4 [pid 5410] close(15 [pid 5429] close(3 [pid 5410] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5429] <... close resumed>) = 0 [pid 5429] symlink("/dev/binderfs", "./binderfs" [pid 5410] close(16 [pid 5429] <... symlink resumed>) = 0 [pid 5410] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5429] mkdir("./file0", 000 [pid 5410] close(17 [pid 5429] <... mkdir resumed>) = 0 [pid 5410] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5429] open("./file0", O_RDONLY [pid 5410] close(18 [pid 5429] <... open resumed>) = 3 [pid 5410] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5429] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5410] close(19 [pid 5429] <... mount resumed>) = 0 [pid 5410] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5429] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5410] close(20 [pid 5429] <... openat resumed>) = 4 [pid 5410] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5429] openat(4, "syz1", O_RDWR|O_PATH [ 137.997331][ T5412] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 138.005324][ T5412] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 138.013327][ T5412] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 138.021329][ T5412] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 138.029325][ T5412] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 000000000000000d [ 138.037361][ T5412] [pid 5410] close(21 [pid 5429] <... openat resumed>) = 5 [pid 5410] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5429] openat(5, "memory.max", O_RDWR [pid 5410] close(22 [pid 5429] <... openat resumed>) = 6 [pid 5429] write(6, "0x000000000000040e", 18 [pid 5410] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5410] close(23) = -1 EBADF (Bad file descriptor) [pid 5410] close(24) = -1 EBADF (Bad file descriptor) [pid 5410] close(25) = -1 EBADF (Bad file descriptor) [pid 5410] close(26) = -1 EBADF (Bad file descriptor) [pid 5410] close(27) = -1 EBADF (Bad file descriptor) [pid 5410] close(28) = -1 EBADF (Bad file descriptor) [pid 5410] close(29) = -1 EBADF (Bad file descriptor) [pid 5410] exit_group(0) = ? [pid 5410] +++ exited with 0 +++ [pid 5090] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=17, si_uid=0, si_status=0, si_utime=0, si_stime=6 /* 0.06 s */} --- [ 138.093080][ T5412] memory: usage 8kB, limit 0kB, failcnt 36 [ 138.102971][ T5412] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 138.116915][ T5412] Memory cgroup stats for /syz1: [ 138.119659][ T5412] anon 0 [ 138.119659][ T5412] file 0 [ 138.119659][ T5412] kernel 8192 [ 138.119659][ T5412] kernel_stack 0 [ 138.119659][ T5412] pagetables 0 [ 138.119659][ T5412] sec_pagetables 0 [ 138.119659][ T5412] percpu 0 [ 138.119659][ T5412] sock 0 [ 138.119659][ T5412] vmalloc 0 [ 138.119659][ T5412] shmem 0 [ 138.119659][ T5412] zswap 0 [ 138.119659][ T5412] zswapped 0 [ 138.119659][ T5412] file_mapped 0 [ 138.119659][ T5412] file_dirty 0 [ 138.119659][ T5412] file_writeback 0 [ 138.119659][ T5412] swapcached 0 [ 138.119659][ T5412] anon_thp 0 [ 138.119659][ T5412] file_thp 0 [ 138.119659][ T5412] shmem_thp 0 [ 138.119659][ T5412] inactive_anon 0 [ 138.119659][ T5412] active_anon 0 [ 138.119659][ T5412] inactive_file 0 [ 138.119659][ T5412] active_file 0 [ 138.119659][ T5412] unevictable 0 [ 138.119659][ T5412] slab_reclaimable 6752 [ 138.119659][ T5412] slab_unreclaimable 0 [ 138.119659][ T5412] slab 6752 [ 138.119659][ T5412] workingset_refault_anon 0 [ 138.119659][ T5412] workingset_refault_file 0 [ 138.119659][ T5412] workingset_activate_anon 0 [ 138.119659][ T5412] workingset_activate_file 0 [ 138.119659][ T5412] workingset_restore_anon 0 [ 138.119659][ T5412] workingset_restore_file 0 [ 138.119659][ T5412] workingset_nodereclaim 0 [ 138.119659][ T5412] pgscan 831 [ 138.119659][ T5412] pgsteal 2 [ 138.119659][ T5412] pgscan_kswapd 0 [ 138.119659][ T5412] pgscan_direct 831 [ 138.119659][ T5412] pgscan_khugepaged 0 [ 138.119659][ T5412] pgsteal_kswapd 0 [ 138.119659][ T5412] pgsteal_direct 2 [ 138.119659][ T5412] pgsteal_khugepaged 0 [ 138.119659][ T5412] pgfault 21 [ 138.119659][ T5412] pgmajfault 0 [ 138.119659][ T5412] pgrefill 830 [ 138.119659][ T5412] pgactivate 829 [pid 5090] umount2("./15", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5090] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5090] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5090] umount2("./15/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./15/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5090] unlink("./15/binderfs") = 0 [pid 5090] umount2("./15/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 138.119659][ T5412] pgdeactivate 830 [ 138.119659][ T5412] pglazyfree 0 [ 138.119659][ T5412] pglazyfreed 0 [ 138.119659][ T5412] zswpin 0 [ 138.119659][ T5412] zswpout 0 [ 138.119659][ T5412] thp_fault_alloc 0 [ 138.119659][ T5412] thp_collapse_alloc 0 [ 138.321985][ T5412] Tasks state (memory values in pages): [ 138.327713][ T5412] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5412] <... write resumed>) = 18 [pid 5412] close(3) = 0 [pid 5412] close(4) = 0 [pid 5412] close(5) = 0 [pid 5412] close(6) = 0 [pid 5412] close(7) = -1 EBADF (Bad file descriptor) [pid 5412] close(8 [pid 5090] lstat("./15/cgroup", [pid 5412] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5412] close(9 [pid 5090] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5412] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5090] unlink("./15/cgroup" [pid 5412] close(10) = -1 EBADF (Bad file descriptor) [ 138.352874][ T5412] Out of memory and no killable processes... [ 138.359006][ T5417] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 138.373244][ T5417] CPU: 0 PID: 5417 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 138.383228][ T5417] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 138.393349][ T5417] Call Trace: [ 138.396669][ T5417] [ 138.399639][ T5417] dump_stack_lvl+0x136/0x150 [ 138.404384][ T5417] dump_header+0x10a/0xd70 [ 138.408865][ T5417] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 138.415033][ T5417] out_of_memory+0xd64/0x1660 [ 138.419802][ T5417] ? oom_killer_disable+0x2b0/0x2b0 [ 138.425100][ T5417] mem_cgroup_out_of_memory+0x206/0x270 [ 138.430730][ T5417] ? mem_cgroup_margin+0x130/0x130 [ 138.435941][ T5417] memory_max_write+0x2f9/0x3c0 [ 138.440876][ T5417] ? mem_cgroup_force_empty_write+0x160/0x160 [ 138.447049][ T5417] ? lock_sync+0x190/0x190 [ 138.451546][ T5417] cgroup_file_write+0x1e2/0x7b0 [ 138.456585][ T5417] ? mem_cgroup_force_empty_write+0x160/0x160 [ 138.462722][ T5417] ? kill_css+0x3b0/0x3b0 [ 138.467102][ T5417] ? lock_acquire+0x32/0xc0 [ 138.471678][ T5417] ? kill_css+0x3b0/0x3b0 [ 138.476087][ T5417] kernfs_fop_write_iter+0x3f1/0x600 [ 138.481420][ T5417] vfs_write+0x9ed/0xe10 [ 138.485715][ T5417] ? kernel_write+0x670/0x670 [ 138.490446][ T5417] ? find_held_lock+0x2d/0x110 [ 138.495253][ T5417] ? __fget_light+0x20a/0x270 [ 138.499980][ T5417] ksys_write+0x12b/0x250 [ 138.504357][ T5417] ? __ia32_sys_read+0xb0/0xb0 [ 138.509168][ T5417] ? lockdep_hardirqs_on+0x7d/0x100 [ 138.514405][ T5417] ? _raw_spin_unlock_irq+0x2e/0x50 [ 138.519647][ T5417] ? ptrace_notify+0xfe/0x140 [ 138.524367][ T5417] do_syscall_64+0x39/0xb0 [ 138.528832][ T5417] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 138.534785][ T5417] RIP: 0033:0x7faecf034129 [ 138.539237][ T5417] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 138.558890][ T5417] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 138.567330][ T5417] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 138.575318][ T5417] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 138.583310][ T5417] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 138.591306][ T5417] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [pid 5412] close(11 [pid 5090] <... unlink resumed>) = 0 [pid 5412] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5412] close(12) = -1 EBADF (Bad file descriptor) [pid 5412] close(13) = -1 EBADF (Bad file descriptor) [pid 5412] close(14) = -1 EBADF (Bad file descriptor) [pid 5412] close(15) = -1 EBADF (Bad file descriptor) [pid 5412] close(16) = -1 EBADF (Bad file descriptor) [pid 5412] close(17) = -1 EBADF (Bad file descriptor) [pid 5412] close(18) = -1 EBADF (Bad file descriptor) [pid 5412] close(19) = -1 EBADF (Bad file descriptor) [pid 5412] close(20) = -1 EBADF (Bad file descriptor) [pid 5412] close(21) = -1 EBADF (Bad file descriptor) [pid 5412] close(22) = -1 EBADF (Bad file descriptor) [pid 5412] close(23) = -1 EBADF (Bad file descriptor) [pid 5412] close(24) = -1 EBADF (Bad file descriptor) [pid 5412] close(25) = -1 EBADF (Bad file descriptor) [pid 5412] close(26) = -1 EBADF (Bad file descriptor) [pid 5412] close(27) = -1 EBADF (Bad file descriptor) [pid 5412] close(28) = -1 EBADF (Bad file descriptor) [pid 5412] close(29) = -1 EBADF (Bad file descriptor) [pid 5412] exit_group(0) = ? [pid 5412] +++ exited with 0 +++ [pid 5087] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=15, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- [pid 5087] umount2("./13", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5087] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5087] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5087] umount2("./13/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./13/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5087] unlink("./13/binderfs") = 0 [pid 5087] umount2("./13/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./13/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5087] unlink("./13/cgroup") = 0 [pid 5087] umount2("./13/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./13/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5087] unlink("./13/cgroup.net") = 0 [pid 5087] umount2("./13/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5090] umount2("./15/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5087] <... umount2 resumed>) = 0 [pid 5087] umount2("./13/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./13/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5087] umount2("./13/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] openat(AT_FDCWD, "./13/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5087] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5087] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5087] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5087] close(4) = 0 [pid 5087] rmdir("./13/file0" [pid 5090] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5087] <... rmdir resumed>) = 0 [pid 5090] lstat("./15/cgroup.net", [pid 5087] umount2("./13/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5090] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5087] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5090] unlink("./15/cgroup.net" [pid 5087] lstat("./13/cgroup.cpu", [pid 5090] <... unlink resumed>) = 0 [pid 5087] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5090] umount2("./15/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5087] unlink("./13/cgroup.cpu") = 0 [pid 5087] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5087] close(3) = 0 [pid 5087] rmdir("./13") = 0 [pid 5087] mkdir("./14", 0777) = 0 [pid 5087] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5432 attached [pid 5432] chdir("./14" [pid 5087] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 16 [pid 5432] <... chdir resumed>) = 0 [pid 5432] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5432] setpgid(0, 0) = 0 [pid 5432] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 5432] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 5432] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 5432] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5432] write(3, "1000", 4) = 4 [pid 5432] close(3) = 0 [pid 5432] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5432] mkdir("./file0", 000) = 0 [pid 5432] open("./file0", O_RDONLY) = 3 [pid 5432] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5432] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [ 138.599302][ T5417] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 000000000000000f [ 138.607339][ T5417] [pid 5432] openat(4, "syz1", O_RDWR|O_PATH [pid 5090] <... umount2 resumed>) = 0 [pid 5432] <... openat resumed>) = 5 [pid 5090] umount2("./15/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5432] openat(5, "memory.max", O_RDWR [pid 5090] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5432] <... openat resumed>) = 6 [pid 5090] lstat("./15/file0", [pid 5432] write(6, "0x000000000000040e", 18 [pid 5090] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5090] umount2("./15/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] openat(AT_FDCWD, "./15/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5090] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5090] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5090] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5090] close(4) = 0 [pid 5090] rmdir("./15/file0") = 0 [pid 5090] umount2("./15/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./15/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5090] unlink("./15/cgroup.cpu") = 0 [ 138.651853][ T5417] memory: usage 8kB, limit 0kB, failcnt 36 [ 138.657880][ T5417] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 138.684142][ T5417] Memory cgroup stats for /syz1: [ 138.684418][ T5417] anon 0 [ 138.684418][ T5417] file 0 [ 138.684418][ T5417] kernel 8192 [ 138.684418][ T5417] kernel_stack 0 [ 138.684418][ T5417] pagetables 0 [ 138.684418][ T5417] sec_pagetables 0 [ 138.684418][ T5417] percpu 0 [ 138.684418][ T5417] sock 0 [ 138.684418][ T5417] vmalloc 0 [ 138.684418][ T5417] shmem 0 [ 138.684418][ T5417] zswap 0 [ 138.684418][ T5417] zswapped 0 [ 138.684418][ T5417] file_mapped 0 [ 138.684418][ T5417] file_dirty 0 [ 138.684418][ T5417] file_writeback 0 [ 138.684418][ T5417] swapcached 0 [ 138.684418][ T5417] anon_thp 0 [ 138.684418][ T5417] file_thp 0 [ 138.684418][ T5417] shmem_thp 0 [ 138.684418][ T5417] inactive_anon 0 [ 138.684418][ T5417] active_anon 0 [ 138.684418][ T5417] inactive_file 0 [ 138.684418][ T5417] active_file 0 [ 138.684418][ T5417] unevictable 0 [ 138.684418][ T5417] slab_reclaimable 6752 [ 138.684418][ T5417] slab_unreclaimable 0 [ 138.684418][ T5417] slab 6752 [ 138.684418][ T5417] workingset_refault_anon 0 [ 138.684418][ T5417] workingset_refault_file 0 [ 138.684418][ T5417] workingset_activate_anon 0 [ 138.684418][ T5417] workingset_activate_file 0 [ 138.684418][ T5417] workingset_restore_anon 0 [ 138.684418][ T5417] workingset_restore_file 0 [ 138.684418][ T5417] workingset_nodereclaim 0 [ 138.684418][ T5417] pgscan 831 [ 138.684418][ T5417] pgsteal 2 [ 138.684418][ T5417] pgscan_kswapd 0 [ 138.684418][ T5417] pgscan_direct 831 [ 138.684418][ T5417] pgscan_khugepaged 0 [ 138.684418][ T5417] pgsteal_kswapd 0 [ 138.684418][ T5417] pgsteal_direct 2 [ 138.684418][ T5417] pgsteal_khugepaged 0 [ 138.684418][ T5417] pgfault 21 [ 138.684418][ T5417] pgmajfault 0 [ 138.684418][ T5417] pgrefill 830 [ 138.684418][ T5417] pgactivate 829 [ 138.684418][ T5417] pgdeactivate 830 [pid 5090] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5090] close(3) = 0 [pid 5090] rmdir("./15") = 0 [pid 5090] mkdir("./16", 0777) = 0 [pid 5090] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5433 attached , child_tidptr=0x555555c0c5d0) = 18 [ 138.684418][ T5417] pglazyfree 0 [ 138.684418][ T5417] pglazyfreed 0 [ 138.684418][ T5417] zswpin 0 [ 138.684418][ T5417] zswpout 0 [ 138.684418][ T5417] thp_fault_alloc 0 [ 138.684418][ T5417] thp_collapse_alloc 0 [pid 5433] chdir("./16") = 0 [pid 5433] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5433] setpgid(0, 0) = 0 [pid 5417] <... write resumed>) = 18 [pid 5433] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 5433] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 5433] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [pid 5433] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5433] write(3, "1000", 4 [pid 5417] close(3 [pid 5433] <... write resumed>) = 4 [pid 5417] <... close resumed>) = 0 [pid 5433] close(3 [pid 5417] close(4 [pid 5433] <... close resumed>) = 0 [pid 5417] <... close resumed>) = 0 [ 138.894784][ T5417] Tasks state (memory values in pages): [ 138.903766][ T5417] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 138.913559][ T5417] Out of memory and no killable processes... [ 138.919654][ T5423] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5433] symlink("/dev/binderfs", "./binderfs" [pid 5417] close(5 [pid 5433] <... symlink resumed>) = 0 [pid 5417] <... close resumed>) = 0 [pid 5433] mkdir("./file0", 000 [pid 5417] close(6 [pid 5433] <... mkdir resumed>) = 0 [pid 5417] <... close resumed>) = 0 [pid 5433] open("./file0", O_RDONLY [pid 5417] close(7 [pid 5433] <... open resumed>) = 3 [pid 5417] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5433] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5417] close(8 [pid 5433] <... mount resumed>) = 0 [pid 5417] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5433] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5417] close(9 [pid 5433] <... openat resumed>) = 4 [pid 5417] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5433] openat(4, "syz1", O_RDWR|O_PATH [pid 5417] close(10 [pid 5433] <... openat resumed>) = 5 [pid 5417] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5433] openat(5, "memory.max", O_RDWR [pid 5417] close(11 [pid 5433] <... openat resumed>) = 6 [pid 5417] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5433] write(6, "0x000000000000040e", 18 [pid 5417] close(12) = -1 EBADF (Bad file descriptor) [pid 5417] close(13) = -1 EBADF (Bad file descriptor) [pid 5417] close(14) = -1 EBADF (Bad file descriptor) [pid 5417] close(15) = -1 EBADF (Bad file descriptor) [pid 5417] close(16) = -1 EBADF (Bad file descriptor) [pid 5417] close(17) = -1 EBADF (Bad file descriptor) [pid 5417] close(18) = -1 EBADF (Bad file descriptor) [pid 5417] close(19) = -1 EBADF (Bad file descriptor) [ 138.937861][ T5423] CPU: 1 PID: 5423 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 138.947839][ T5423] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 138.957943][ T5423] Call Trace: [ 138.961371][ T5423] [ 138.964347][ T5423] dump_stack_lvl+0x136/0x150 [ 138.969096][ T5423] dump_header+0x10a/0xd70 [ 138.973583][ T5423] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 138.979744][ T5423] out_of_memory+0xd64/0x1660 [ 138.984505][ T5423] ? oom_killer_disable+0x2b0/0x2b0 [ 138.989811][ T5423] mem_cgroup_out_of_memory+0x206/0x270 [pid 5417] close(20) = -1 EBADF (Bad file descriptor) [pid 5417] close(21) = -1 EBADF (Bad file descriptor) [pid 5417] close(22) = -1 EBADF (Bad file descriptor) [pid 5417] close(23) = -1 EBADF (Bad file descriptor) [pid 5417] close(24) = -1 EBADF (Bad file descriptor) [pid 5417] close(25) = -1 EBADF (Bad file descriptor) [pid 5417] close(26) = -1 EBADF (Bad file descriptor) [pid 5417] close(27) = -1 EBADF (Bad file descriptor) [pid 5417] close(28) = -1 EBADF (Bad file descriptor) [pid 5417] close(29) = -1 EBADF (Bad file descriptor) [pid 5417] exit_group(0) = ? [pid 5417] +++ exited with 0 +++ [pid 5089] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=17, si_uid=0, si_status=0, si_utime=0, si_stime=7 /* 0.07 s */} --- [pid 5089] umount2("./15", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5089] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5089] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5089] umount2("./15/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./15/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5089] unlink("./15/binderfs") = 0 [ 138.995444][ T5423] ? mem_cgroup_margin+0x130/0x130 [ 139.000656][ T5423] memory_max_write+0x2f9/0x3c0 [ 139.005609][ T5423] ? mem_cgroup_force_empty_write+0x160/0x160 [ 139.011761][ T5423] ? lock_sync+0x190/0x190 [ 139.016252][ T5423] cgroup_file_write+0x1e2/0x7b0 [ 139.021263][ T5423] ? mem_cgroup_force_empty_write+0x160/0x160 [ 139.027535][ T5423] ? kill_css+0x3b0/0x3b0 [ 139.031957][ T5423] ? lock_acquire+0x32/0xc0 [ 139.036569][ T5423] ? kill_css+0x3b0/0x3b0 [ 139.040985][ T5423] kernfs_fop_write_iter+0x3f1/0x600 [ 139.046371][ T5423] vfs_write+0x9ed/0xe10 [ 139.050935][ T5423] ? kernel_write+0x670/0x670 [ 139.055682][ T5423] ? find_held_lock+0x2d/0x110 [ 139.060495][ T5423] ? __fget_light+0x20a/0x270 [ 139.065228][ T5423] ksys_write+0x12b/0x250 [ 139.069608][ T5423] ? __ia32_sys_read+0xb0/0xb0 [ 139.074412][ T5423] ? lockdep_hardirqs_on+0x7d/0x100 [ 139.079645][ T5423] ? _raw_spin_unlock_irq+0x2e/0x50 [ 139.084884][ T5423] ? ptrace_notify+0xfe/0x140 [ 139.089640][ T5423] do_syscall_64+0x39/0xb0 [ 139.094123][ T5423] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 139.100069][ T5423] RIP: 0033:0x7faecf034129 [ 139.104523][ T5423] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 139.124160][ T5423] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 139.132603][ T5423] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [pid 5089] umount2("./15/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./15/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5089] unlink("./15/cgroup") = 0 [pid 5089] umount2("./15/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./15/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [ 139.140596][ T5423] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 139.148866][ T5423] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 139.156862][ T5423] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 139.164852][ T5423] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 000000000000000c [ 139.172870][ T5423] [ 139.182028][ T5423] memory: usage 8kB, limit 0kB, failcnt 36 [pid 5089] unlink("./15/cgroup.net") = 0 [pid 5089] umount2("./15/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5089] umount2("./15/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./15/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5089] umount2("./15/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] openat(AT_FDCWD, "./15/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5089] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5089] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5089] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5089] close(4) = 0 [pid 5089] rmdir("./15/file0") = 0 [pid 5089] umount2("./15/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./15/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5089] unlink("./15/cgroup.cpu") = 0 [pid 5089] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5089] close(3) = 0 [pid 5089] rmdir("./15") = 0 [pid 5089] mkdir("./16", 0777) = 0 [ 139.194663][ T5423] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 139.212639][ T5423] Memory cgroup stats for /syz1: [ 139.212919][ T5423] anon 0 [ 139.212919][ T5423] file 0 [ 139.212919][ T5423] kernel 8192 [ 139.212919][ T5423] kernel_stack 0 [ 139.212919][ T5423] pagetables 0 [ 139.212919][ T5423] sec_pagetables 0 [ 139.212919][ T5423] percpu 0 [ 139.212919][ T5423] sock 0 [ 139.212919][ T5423] vmalloc 0 [pid 5089] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5437 attached [pid 5437] chdir("./16" [pid 5089] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 18 [pid 5437] <... chdir resumed>) = 0 [pid 5437] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5437] setpgid(0, 0) = 0 [pid 5437] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 5437] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [pid 5437] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 5437] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [ 139.212919][ T5423] shmem 0 [ 139.212919][ T5423] zswap 0 [ 139.212919][ T5423] zswapped 0 [ 139.212919][ T5423] file_mapped 0 [ 139.212919][ T5423] file_dirty 0 [ 139.212919][ T5423] file_writeback 0 [ 139.212919][ T5423] swapcached 0 [ 139.212919][ T5423] anon_thp 0 [ 139.212919][ T5423] file_thp 0 [ 139.212919][ T5423] shmem_thp 0 [ 139.212919][ T5423] inactive_anon 0 [ 139.212919][ T5423] active_anon 0 [ 139.212919][ T5423] inactive_file 0 [ 139.212919][ T5423] active_file 0 [ 139.212919][ T5423] unevictable 0 [ 139.212919][ T5423] slab_reclaimable 6752 [ 139.212919][ T5423] slab_unreclaimable 0 [ 139.212919][ T5423] slab 6752 [ 139.212919][ T5423] workingset_refault_anon 0 [ 139.212919][ T5423] workingset_refault_file 0 [ 139.212919][ T5423] workingset_activate_anon 0 [ 139.212919][ T5423] workingset_activate_file 0 [ 139.212919][ T5423] workingset_restore_anon 0 [ 139.212919][ T5423] workingset_restore_file 0 [ 139.212919][ T5423] workingset_nodereclaim 0 [ 139.212919][ T5423] pgscan 831 [ 139.212919][ T5423] pgsteal 2 [ 139.212919][ T5423] pgscan_kswapd 0 [ 139.212919][ T5423] pgscan_direct 831 [ 139.212919][ T5423] pgscan_khugepaged 0 [ 139.212919][ T5423] pgsteal_kswapd 0 [ 139.212919][ T5423] pgsteal_direct 2 [ 139.212919][ T5423] pgsteal_khugepaged 0 [ 139.212919][ T5423] pgfault 21 [ 139.212919][ T5423] pgmajfault 0 [ 139.212919][ T5423] pgrefill 830 [ 139.212919][ T5423] pgactivate 829 [ 139.212919][ T5423] pgdeactivate 830 [ 139.212919][ T5423] pglazyfree 0 [ 139.212919][ T5423] pglazyfreed 0 [ 139.212919][ T5423] zswpin 0 [ 139.212919][ T5423] zswpout 0 [ 139.212919][ T5423] thp_fault_alloc 0 [pid 5437] write(3, "1000", 4) = 4 [pid 5437] close(3) = 0 [pid 5437] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5437] mkdir("./file0", 000) = 0 [pid 5437] open("./file0", O_RDONLY) = 3 [pid 5437] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5437] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5437] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5437] openat(5, "memory.max", O_RDWR) = 6 [ 139.212919][ T5423] thp_collapse_alloc 0 [pid 5437] write(6, "0x000000000000040e", 18 [pid 5423] <... write resumed>) = 18 [ 139.417535][ T5423] Tasks state (memory values in pages): [ 139.431317][ T5423] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 139.443240][ T5423] Out of memory and no killable processes... [pid 5423] close(3) = 0 [pid 5423] close(4) = 0 [pid 5423] close(5) = 0 [ 139.457902][ T5429] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 139.474722][ T5429] CPU: 1 PID: 5429 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 139.484724][ T5429] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 139.494835][ T5429] Call Trace: [ 139.498158][ T5429] [ 139.501144][ T5429] dump_stack_lvl+0x136/0x150 [ 139.505892][ T5429] dump_header+0x10a/0xd70 [ 139.510377][ T5429] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 139.516541][ T5429] out_of_memory+0xd64/0x1660 [ 139.521303][ T5429] ? oom_killer_disable+0x2b0/0x2b0 [ 139.526587][ T5429] ? find_held_lock+0x2d/0x110 [ 139.531422][ T5429] mem_cgroup_out_of_memory+0x206/0x270 [ 139.537050][ T5429] ? mem_cgroup_margin+0x130/0x130 [ 139.542246][ T5429] ? _raw_spin_unlock_irqrestore+0x54/0x70 [ 139.548146][ T5429] memory_max_write+0x2f9/0x3c0 [ 139.553092][ T5429] ? mem_cgroup_force_empty_write+0x160/0x160 [ 139.559253][ T5429] ? lock_sync+0x190/0x190 [ 139.563745][ T5429] cgroup_file_write+0x1e2/0x7b0 [ 139.568787][ T5429] ? mem_cgroup_force_empty_write+0x160/0x160 [ 139.574936][ T5429] ? kill_css+0x3b0/0x3b0 [ 139.579335][ T5429] ? lock_acquire+0x32/0xc0 [ 139.583916][ T5429] ? kill_css+0x3b0/0x3b0 [ 139.588315][ T5429] kernfs_fop_write_iter+0x3f1/0x600 [ 139.593696][ T5429] vfs_write+0x9ed/0xe10 [ 139.598019][ T5429] ? kernel_write+0x670/0x670 [ 139.602780][ T5429] ? find_held_lock+0x2d/0x110 [ 139.607620][ T5429] ? __fget_light+0x20a/0x270 [ 139.612376][ T5429] ksys_write+0x12b/0x250 [pid 5423] close(6) = 0 [pid 5423] close(7) = -1 EBADF (Bad file descriptor) [pid 5423] close(8) = -1 EBADF (Bad file descriptor) [pid 5423] close(9) = -1 EBADF (Bad file descriptor) [pid 5423] close(10) = -1 EBADF (Bad file descriptor) [pid 5423] close(11) = -1 EBADF (Bad file descriptor) [pid 5423] close(12) = -1 EBADF (Bad file descriptor) [pid 5423] close(13) = -1 EBADF (Bad file descriptor) [pid 5423] close(14) = -1 EBADF (Bad file descriptor) [pid 5423] close(15) = -1 EBADF (Bad file descriptor) [pid 5423] close(16) = -1 EBADF (Bad file descriptor) [pid 5423] close(17) = -1 EBADF (Bad file descriptor) [pid 5423] close(18) = -1 EBADF (Bad file descriptor) [pid 5423] close(19) = -1 EBADF (Bad file descriptor) [pid 5423] close(20) = -1 EBADF (Bad file descriptor) [pid 5423] close(21) = -1 EBADF (Bad file descriptor) [pid 5423] close(22) = -1 EBADF (Bad file descriptor) [pid 5423] close(23) = -1 EBADF (Bad file descriptor) [pid 5423] close(24) = -1 EBADF (Bad file descriptor) [pid 5423] close(25) = -1 EBADF (Bad file descriptor) [pid 5423] close(26) = -1 EBADF (Bad file descriptor) [pid 5423] close(27) = -1 EBADF (Bad file descriptor) [pid 5423] close(28) = -1 EBADF (Bad file descriptor) [pid 5423] close(29) = -1 EBADF (Bad file descriptor) [pid 5423] exit_group(0) = ? [pid 5423] +++ exited with 0 +++ [pid 5086] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=14, si_uid=0, si_status=0, si_utime=0, si_stime=7 /* 0.07 s */} --- [pid 5086] umount2("./12", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5086] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5086] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5086] umount2("./12/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./12/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5086] unlink("./12/binderfs") = 0 [pid 5086] umount2("./12/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./12/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5086] unlink("./12/cgroup") = 0 [pid 5086] umount2("./12/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./12/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5086] unlink("./12/cgroup.net") = 0 [ 139.616788][ T5429] ? __ia32_sys_read+0xb0/0xb0 [ 139.621619][ T5429] ? lockdep_hardirqs_on+0x7d/0x100 [ 139.626877][ T5429] ? _raw_spin_unlock_irq+0x2e/0x50 [ 139.632144][ T5429] ? ptrace_notify+0xfe/0x140 [ 139.636906][ T5429] do_syscall_64+0x39/0xb0 [ 139.641391][ T5429] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 139.647355][ T5429] RIP: 0033:0x7faecf034129 [ 139.651993][ T5429] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 139.671664][ T5429] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 139.680147][ T5429] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 139.688178][ T5429] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 139.696210][ T5429] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 139.704229][ T5429] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [pid 5086] umount2("./12/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5086] umount2("./12/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./12/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5086] umount2("./12/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] openat(AT_FDCWD, "./12/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5086] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5086] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5086] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [ 139.712253][ T5429] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 000000000000000c [ 139.720305][ T5429] [pid 5086] close(4) = 0 [pid 5086] rmdir("./12/file0") = 0 [pid 5086] umount2("./12/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./12/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5086] unlink("./12/cgroup.cpu") = 0 [pid 5086] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5086] close(3) = 0 [pid 5086] rmdir("./12") = 0 [pid 5086] mkdir("./13", 0777) = 0 [pid 5086] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5442 attached [pid 5442] chdir("./13" [pid 5086] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 15 [pid 5442] <... chdir resumed>) = 0 [pid 5442] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5442] setpgid(0, 0) = 0 [pid 5442] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [pid 5442] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 5442] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [ 139.740819][ T5429] memory: usage 8kB, limit 0kB, failcnt 36 [ 139.747023][ T5429] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 139.771722][ T5429] Memory cgroup stats for /syz1: [ 139.772006][ T5429] anon 0 [ 139.772006][ T5429] file 0 [ 139.772006][ T5429] kernel 8192 [ 139.772006][ T5429] kernel_stack 0 [pid 5442] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5442] write(3, "1000", 4) = 4 [pid 5442] close(3) = 0 [pid 5442] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5442] mkdir("./file0", 000) = 0 [pid 5442] open("./file0", O_RDONLY) = 3 [pid 5442] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5442] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5442] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5442] openat(5, "memory.max", O_RDWR) = 6 [ 139.772006][ T5429] pagetables 0 [ 139.772006][ T5429] sec_pagetables 0 [ 139.772006][ T5429] percpu 0 [ 139.772006][ T5429] sock 0 [ 139.772006][ T5429] vmalloc 0 [ 139.772006][ T5429] shmem 0 [ 139.772006][ T5429] zswap 0 [ 139.772006][ T5429] zswapped 0 [ 139.772006][ T5429] file_mapped 0 [ 139.772006][ T5429] file_dirty 0 [ 139.772006][ T5429] file_writeback 0 [ 139.772006][ T5429] swapcached 0 [ 139.772006][ T5429] anon_thp 0 [ 139.772006][ T5429] file_thp 0 [ 139.772006][ T5429] shmem_thp 0 [ 139.772006][ T5429] inactive_anon 0 [ 139.772006][ T5429] active_anon 0 [ 139.772006][ T5429] inactive_file 0 [ 139.772006][ T5429] active_file 0 [ 139.772006][ T5429] unevictable 0 [ 139.772006][ T5429] slab_reclaimable 6752 [ 139.772006][ T5429] slab_unreclaimable 0 [ 139.772006][ T5429] slab 6752 [ 139.772006][ T5429] workingset_refault_anon 0 [ 139.772006][ T5429] workingset_refault_file 0 [ 139.772006][ T5429] workingset_activate_anon 0 [ 139.772006][ T5429] workingset_activate_file 0 [ 139.772006][ T5429] workingset_restore_anon 0 [ 139.772006][ T5429] workingset_restore_file 0 [ 139.772006][ T5429] workingset_nodereclaim 0 [ 139.772006][ T5429] pgscan 831 [ 139.772006][ T5429] pgsteal 2 [ 139.772006][ T5429] pgscan_kswapd 0 [ 139.772006][ T5429] pgscan_direct 831 [ 139.772006][ T5429] pgscan_khugepaged 0 [ 139.772006][ T5429] pgsteal_kswapd 0 [ 139.772006][ T5429] pgsteal_direct 2 [ 139.772006][ T5429] pgsteal_khugepaged 0 [ 139.772006][ T5429] pgfault 21 [ 139.772006][ T5429] pgmajfault 0 [ 139.772006][ T5429] pgrefill 830 [ 139.772006][ T5429] pgactivate 829 [ 139.772006][ T5429] pgdeactivate 830 [ 139.772006][ T5429] pglazyfree 0 [ 139.772006][ T5429] pglazyfreed 0 [ 139.772006][ T5429] zswpin 0 [ 139.772006][ T5429] zswpout 0 [ 139.772006][ T5429] thp_fault_alloc 0 [ 139.772006][ T5429] thp_collapse_alloc 0 [ 139.972180][ T5429] Tasks state (memory values in pages): [ 139.978161][ T5429] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5442] write(6, "0x000000000000040e", 18 [pid 5429] <... write resumed>) = 18 [pid 5429] close(3) = 0 [pid 5429] close(4) = 0 [pid 5429] close(5) = 0 [pid 5429] close(6) = 0 [pid 5429] close(7) = -1 EBADF (Bad file descriptor) [pid 5429] close(8) = -1 EBADF (Bad file descriptor) [pid 5429] close(9) = -1 EBADF (Bad file descriptor) [pid 5429] close(10) = -1 EBADF (Bad file descriptor) [pid 5429] close(11) = -1 EBADF (Bad file descriptor) [pid 5429] close(12) = -1 EBADF (Bad file descriptor) [pid 5429] close(13) = -1 EBADF (Bad file descriptor) [pid 5429] close(14) = -1 EBADF (Bad file descriptor) [pid 5429] close(15) = -1 EBADF (Bad file descriptor) [pid 5429] close(16) = -1 EBADF (Bad file descriptor) [pid 5429] close(17) = -1 EBADF (Bad file descriptor) [pid 5429] close(18) = -1 EBADF (Bad file descriptor) [ 139.990166][ T5429] Out of memory and no killable processes... [ 140.000256][ T5432] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 140.023531][ T5432] CPU: 1 PID: 5432 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [pid 5429] close(19) = -1 EBADF (Bad file descriptor) [pid 5429] close(20) = -1 EBADF (Bad file descriptor) [pid 5429] close(21) = -1 EBADF (Bad file descriptor) [pid 5429] close(22) = -1 EBADF (Bad file descriptor) [pid 5429] close(23) = -1 EBADF (Bad file descriptor) [pid 5429] close(24) = -1 EBADF (Bad file descriptor) [pid 5429] close(25) = -1 EBADF (Bad file descriptor) [pid 5429] close(26) = -1 EBADF (Bad file descriptor) [pid 5429] close(27) = -1 EBADF (Bad file descriptor) [pid 5429] close(28) = -1 EBADF (Bad file descriptor) [pid 5429] close(29) = -1 EBADF (Bad file descriptor) [pid 5429] exit_group(0) = ? [pid 5429] +++ exited with 0 +++ [ 140.033526][ T5432] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 140.043654][ T5432] Call Trace: [ 140.046983][ T5432] [ 140.049968][ T5432] dump_stack_lvl+0x136/0x150 [ 140.054722][ T5432] dump_header+0x10a/0xd70 [ 140.059205][ T5432] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 140.065379][ T5432] out_of_memory+0xd64/0x1660 [ 140.070140][ T5432] ? oom_killer_disable+0x2b0/0x2b0 [ 140.075421][ T5432] mem_cgroup_out_of_memory+0x206/0x270 [ 140.081040][ T5432] ? mem_cgroup_margin+0x130/0x130 [ 140.086249][ T5432] memory_max_write+0x2f9/0x3c0 [ 140.091187][ T5432] ? mem_cgroup_force_empty_write+0x160/0x160 [ 140.097359][ T5432] ? lock_sync+0x190/0x190 [ 140.101856][ T5432] cgroup_file_write+0x1e2/0x7b0 [ 140.106888][ T5432] ? mem_cgroup_force_empty_write+0x160/0x160 [ 140.113035][ T5432] ? kill_css+0x3b0/0x3b0 [ 140.117527][ T5432] ? lock_acquire+0x32/0xc0 [ 140.122120][ T5432] ? kill_css+0x3b0/0x3b0 [ 140.126547][ T5432] kernfs_fop_write_iter+0x3f1/0x600 [ 140.131922][ T5432] vfs_write+0x9ed/0xe10 [ 140.136238][ T5432] ? kernel_write+0x670/0x670 [ 140.140968][ T5432] ? find_held_lock+0x2d/0x110 [ 140.145769][ T5432] ? __fget_light+0x20a/0x270 [ 140.150495][ T5432] ksys_write+0x12b/0x250 [ 140.154894][ T5432] ? __ia32_sys_read+0xb0/0xb0 [ 140.159695][ T5432] ? lockdep_hardirqs_on+0x7d/0x100 [ 140.164928][ T5432] ? _raw_spin_unlock_irq+0x2e/0x50 [ 140.170164][ T5432] ? ptrace_notify+0xfe/0x140 [ 140.174965][ T5432] do_syscall_64+0x39/0xb0 [ 140.179427][ T5432] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 140.185365][ T5432] RIP: 0033:0x7faecf034129 [ 140.189808][ T5432] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 140.209443][ T5432] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 140.217888][ T5432] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 140.225882][ T5432] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 140.233879][ T5432] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 140.241879][ T5432] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 140.249878][ T5432] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 000000000000000e [ 140.257910][ T5432] [ 140.262617][ T5432] memory: usage 8kB, limit 0kB, failcnt 36 [ 140.268486][ T5432] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 140.275572][ T5432] Memory cgroup stats for /syz1: [ 140.275842][ T5432] anon 0 [ 140.275842][ T5432] file 0 [ 140.275842][ T5432] kernel 8192 [ 140.275842][ T5432] kernel_stack 0 [ 140.275842][ T5432] pagetables 0 [ 140.275842][ T5432] sec_pagetables 0 [ 140.275842][ T5432] percpu 0 [ 140.275842][ T5432] sock 0 [ 140.275842][ T5432] vmalloc 0 [ 140.275842][ T5432] shmem 0 [ 140.275842][ T5432] zswap 0 [ 140.275842][ T5432] zswapped 0 [ 140.275842][ T5432] file_mapped 0 [ 140.275842][ T5432] file_dirty 0 [ 140.275842][ T5432] file_writeback 0 [ 140.275842][ T5432] swapcached 0 [ 140.275842][ T5432] anon_thp 0 [ 140.275842][ T5432] file_thp 0 [ 140.275842][ T5432] shmem_thp 0 [ 140.275842][ T5432] inactive_anon 0 [ 140.275842][ T5432] active_anon 0 [ 140.275842][ T5432] inactive_file 0 [ 140.275842][ T5432] active_file 0 [ 140.275842][ T5432] unevictable 0 [ 140.275842][ T5432] slab_reclaimable 6752 [ 140.275842][ T5432] slab_unreclaimable 0 [ 140.275842][ T5432] slab 6752 [ 140.275842][ T5432] workingset_refault_anon 0 [ 140.275842][ T5432] workingset_refault_file 0 [ 140.275842][ T5432] workingset_activate_anon 0 [ 140.275842][ T5432] workingset_activate_file 0 [ 140.275842][ T5432] workingset_restore_anon 0 [ 140.275842][ T5432] workingset_restore_file 0 [ 140.275842][ T5432] workingset_nodereclaim 0 [ 140.275842][ T5432] pgscan 831 [ 140.275842][ T5432] pgsteal 2 [ 140.275842][ T5432] pgscan_kswapd 0 [ 140.275842][ T5432] pgscan_direct 831 [ 140.275842][ T5432] pgscan_khugepaged 0 [ 140.275842][ T5432] pgsteal_kswapd 0 [ 140.275842][ T5432] pgsteal_direct 2 [ 140.275842][ T5432] pgsteal_khugepaged 0 [ 140.275842][ T5432] pgfault 21 [ 140.275842][ T5432] pgmajfault 0 [ 140.275842][ T5432] pgrefill 830 [ 140.275842][ T5432] pgactivate 829 [ 140.275842][ T5432] pgdeactivate 830 [pid 5085] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=14, si_uid=0, si_status=0, si_utime=0, si_stime=7 /* 0.07 s */} --- [pid 5085] umount2("./12", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 140.275842][ T5432] pglazyfree 0 [ 140.275842][ T5432] pglazyfreed 0 [ 140.275842][ T5432] zswpin 0 [ 140.275842][ T5432] zswpout 0 [ 140.275842][ T5432] thp_fault_alloc 0 [ 140.275842][ T5432] thp_collapse_alloc 0 [ 140.483721][ T5432] Tasks state (memory values in pages): [pid 5085] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5085] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5085] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5085] umount2("./12/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./12/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5085] unlink("./12/binderfs") = 0 [pid 5085] umount2("./12/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./12/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5085] unlink("./12/cgroup" [pid 5432] <... write resumed>) = 18 [pid 5432] close(3 [pid 5085] <... unlink resumed>) = 0 [pid 5085] umount2("./12/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./12/cgroup.net", [pid 5432] <... close resumed>) = 0 [pid 5085] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5432] close(4) = 0 [ 140.489344][ T5432] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 140.503926][ T5432] Out of memory and no killable processes... [ 140.514775][ T5433] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5432] close(5) = 0 [pid 5085] unlink("./12/cgroup.net" [pid 5432] close(6) = 0 [pid 5432] close(7) = -1 EBADF (Bad file descriptor) [pid 5432] close(8) = -1 EBADF (Bad file descriptor) [pid 5432] close(9) = -1 EBADF (Bad file descriptor) [pid 5432] close(10) = -1 EBADF (Bad file descriptor) [pid 5432] close(11) = -1 EBADF (Bad file descriptor) [pid 5432] close(12) = -1 EBADF (Bad file descriptor) [pid 5432] close(13) = -1 EBADF (Bad file descriptor) [pid 5432] close(14) = -1 EBADF (Bad file descriptor) [pid 5432] close(15) = -1 EBADF (Bad file descriptor) [pid 5432] close(16) = -1 EBADF (Bad file descriptor) [pid 5432] close(17) = -1 EBADF (Bad file descriptor) [pid 5432] close(18) = -1 EBADF (Bad file descriptor) [pid 5432] close(19) = -1 EBADF (Bad file descriptor) [pid 5432] close(20) = -1 EBADF (Bad file descriptor) [pid 5432] close(21) = -1 EBADF (Bad file descriptor) [pid 5432] close(22) = -1 EBADF (Bad file descriptor) [pid 5432] close(23) = -1 EBADF (Bad file descriptor) [pid 5432] close(24) = -1 EBADF (Bad file descriptor) [pid 5432] close(25) = -1 EBADF (Bad file descriptor) [pid 5432] close(26) = -1 EBADF (Bad file descriptor) [pid 5432] close(27) = -1 EBADF (Bad file descriptor) [ 140.546622][ T5433] CPU: 1 PID: 5433 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 140.556626][ T5433] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 140.566741][ T5433] Call Trace: [ 140.570067][ T5433] [ 140.573050][ T5433] dump_stack_lvl+0x136/0x150 [ 140.577808][ T5433] dump_header+0x10a/0xd70 [ 140.582301][ T5433] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 140.588478][ T5433] out_of_memory+0xd64/0x1660 [pid 5432] close(28) = -1 EBADF (Bad file descriptor) [pid 5432] close(29) = -1 EBADF (Bad file descriptor) [pid 5432] exit_group(0) = ? [pid 5432] +++ exited with 0 +++ [pid 5087] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=16, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- [pid 5087] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5087] umount2("./14", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5087] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5087] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5087] umount2("./14/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./14/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5087] unlink("./14/binderfs") = 0 [pid 5087] umount2("./14/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./14/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5087] unlink("./14/cgroup") = 0 [pid 5087] umount2("./14/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./14/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5087] unlink("./14/cgroup.net") = 0 [ 140.593249][ T5433] ? oom_killer_disable+0x2b0/0x2b0 [ 140.598550][ T5433] mem_cgroup_out_of_memory+0x206/0x270 [ 140.604175][ T5433] ? mem_cgroup_margin+0x130/0x130 [ 140.609393][ T5433] memory_max_write+0x2f9/0x3c0 [ 140.614328][ T5433] ? mem_cgroup_force_empty_write+0x160/0x160 [ 140.620498][ T5433] ? lock_sync+0x190/0x190 [ 140.625026][ T5433] cgroup_file_write+0x1e2/0x7b0 [ 140.630051][ T5433] ? mem_cgroup_force_empty_write+0x160/0x160 [ 140.636214][ T5433] ? kill_css+0x3b0/0x3b0 [ 140.640682][ T5433] ? lock_acquire+0x32/0xc0 [pid 5087] umount2("./14/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5085] <... unlink resumed>) = 0 [ 140.645275][ T5433] ? kill_css+0x3b0/0x3b0 [ 140.649685][ T5433] kernfs_fop_write_iter+0x3f1/0x600 [ 140.655056][ T5433] vfs_write+0x9ed/0xe10 [ 140.659393][ T5433] ? kernel_write+0x670/0x670 [ 140.664168][ T5433] ? find_held_lock+0x2d/0x110 [ 140.669018][ T5433] ? __fget_light+0x20a/0x270 [ 140.673781][ T5433] ksys_write+0x12b/0x250 [ 140.678209][ T5433] ? __ia32_sys_read+0xb0/0xb0 [ 140.683052][ T5433] ? lockdep_hardirqs_on+0x7d/0x100 [ 140.688355][ T5433] ? _raw_spin_unlock_irq+0x2e/0x50 [ 140.693646][ T5433] ? ptrace_notify+0xfe/0x140 [ 140.698399][ T5433] do_syscall_64+0x39/0xb0 [ 140.702896][ T5433] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 140.708859][ T5433] RIP: 0033:0x7faecf034129 [ 140.713327][ T5433] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 140.733099][ T5433] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 5085] umount2("./12/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5087] <... umount2 resumed>) = 0 [pid 5085] <... umount2 resumed>) = 0 [pid 5087] umount2("./14/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5085] umount2("./12/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5087] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5085] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./14/file0", [pid 5085] lstat("./12/file0", [pid 5087] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5085] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5087] umount2("./14/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5085] umount2("./12/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5087] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5085] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5087] openat(AT_FDCWD, "./14/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5085] openat(AT_FDCWD, "./12/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5087] <... openat resumed>) = 4 [pid 5085] <... openat resumed>) = 4 [pid 5087] fstat(4, [pid 5085] fstat(4, [pid 5087] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5085] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5087] getdents64(4, [pid 5085] getdents64(4, [pid 5087] <... getdents64 resumed>0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5085] <... getdents64 resumed>0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5087] getdents64(4, [pid 5085] getdents64(4, [pid 5087] <... getdents64 resumed>0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5085] <... getdents64 resumed>0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5087] close(4 [pid 5085] close(4 [pid 5087] <... close resumed>) = 0 [pid 5085] <... close resumed>) = 0 [pid 5087] rmdir("./14/file0" [pid 5085] rmdir("./12/file0" [pid 5087] <... rmdir resumed>) = 0 [pid 5085] <... rmdir resumed>) = 0 [pid 5087] umount2("./14/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5085] umount2("./12/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5087] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5085] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./14/cgroup.cpu", [pid 5085] lstat("./12/cgroup.cpu", [pid 5087] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [ 140.741594][ T5433] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 140.749630][ T5433] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 140.757663][ T5433] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 140.765694][ T5433] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 140.773719][ T5433] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000010 [ 140.781780][ T5433] [pid 5085] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5087] unlink("./14/cgroup.cpu" [pid 5085] unlink("./12/cgroup.cpu" [pid 5087] <... unlink resumed>) = 0 [pid 5085] <... unlink resumed>) = 0 [pid 5087] getdents64(3, [pid 5085] getdents64(3, [pid 5087] <... getdents64 resumed>0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5085] <... getdents64 resumed>0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5087] close(3 [pid 5085] close(3 [pid 5087] <... close resumed>) = 0 [pid 5085] <... close resumed>) = 0 [pid 5087] rmdir("./14" [pid 5085] rmdir("./12" [pid 5087] <... rmdir resumed>) = 0 [pid 5085] <... rmdir resumed>) = 0 [pid 5087] mkdir("./15", 0777 [pid 5085] mkdir("./13", 0777 [pid 5087] <... mkdir resumed>) = 0 [pid 5085] <... mkdir resumed>) = 0 [pid 5087] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5085] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5449 attached [pid 5449] chdir("./15" [pid 5087] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 17 [pid 5449] <... chdir resumed>) = 0 [pid 5085] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 15 [pid 5449] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5449] setpgid(0, 0) = 0 [pid 5449] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 5449] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 5449] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 5449] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5449] write(3, "1000", 4) = 4 [pid 5449] close(3) = 0 [pid 5449] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5449] mkdir("./file0", 000) = 0 [ 140.821054][ T5433] memory: usage 8kB, limit 0kB, failcnt 36 [ 140.829090][ T5433] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 140.845511][ T5433] Memory cgroup stats for /syz1: [ 140.845803][ T5433] anon 0 [ 140.845803][ T5433] file 0 [ 140.845803][ T5433] kernel 8192 [ 140.845803][ T5433] kernel_stack 0 [ 140.845803][ T5433] pagetables 0 [ 140.845803][ T5433] sec_pagetables 0 [pid 5449] open("./file0", O_RDONLY) = 3 [pid 5449] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5449] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5449] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5449] openat(5, "memory.max", O_RDWR) = 6 [ 140.845803][ T5433] percpu 0 [ 140.845803][ T5433] sock 0 [ 140.845803][ T5433] vmalloc 0 [ 140.845803][ T5433] shmem 0 [ 140.845803][ T5433] zswap 0 [ 140.845803][ T5433] zswapped 0 [ 140.845803][ T5433] file_mapped 0 [ 140.845803][ T5433] file_dirty 0 [ 140.845803][ T5433] file_writeback 0 [ 140.845803][ T5433] swapcached 0 [ 140.845803][ T5433] anon_thp 0 [ 140.845803][ T5433] file_thp 0 [ 140.845803][ T5433] shmem_thp 0 [ 140.845803][ T5433] inactive_anon 0 [ 140.845803][ T5433] active_anon 0 [ 140.845803][ T5433] inactive_file 0 [ 140.845803][ T5433] active_file 0 [ 140.845803][ T5433] unevictable 0 [ 140.845803][ T5433] slab_reclaimable 6752 [ 140.845803][ T5433] slab_unreclaimable 0 [ 140.845803][ T5433] slab 6752 [ 140.845803][ T5433] workingset_refault_anon 0 [ 140.845803][ T5433] workingset_refault_file 0 [ 140.845803][ T5433] workingset_activate_anon 0 [ 140.845803][ T5433] workingset_activate_file 0 [ 140.845803][ T5433] workingset_restore_anon 0 [ 140.845803][ T5433] workingset_restore_file 0 [ 140.845803][ T5433] workingset_nodereclaim 0 [ 140.845803][ T5433] pgscan 831 [ 140.845803][ T5433] pgsteal 2 [ 140.845803][ T5433] pgscan_kswapd 0 [ 140.845803][ T5433] pgscan_direct 831 [ 140.845803][ T5433] pgscan_khugepaged 0 [ 140.845803][ T5433] pgsteal_kswapd 0 [ 140.845803][ T5433] pgsteal_direct 2 [ 140.845803][ T5433] pgsteal_khugepaged 0 [ 140.845803][ T5433] pgfault 21 [ 140.845803][ T5433] pgmajfault 0 [ 140.845803][ T5433] pgrefill 830 [ 140.845803][ T5433] pgactivate 829 [ 140.845803][ T5433] pgdeactivate 830 [ 140.845803][ T5433] pglazyfree 0 [ 140.845803][ T5433] pglazyfreed 0 [ 140.845803][ T5433] zswpin 0 [pid 5449] write(6, "0x000000000000040e", 18./strace-static-x86_64: Process 5450 attached [pid 5450] chdir("./13") = 0 [pid 5450] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5450] setpgid(0, 0) = 0 [pid 5450] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 5450] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 5450] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 5450] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5450] write(3, "1000", 4) = 4 [pid 5450] close(3) = 0 [pid 5450] symlink("/dev/binderfs", "./binderfs") = 0 [ 140.845803][ T5433] zswpout 0 [ 140.845803][ T5433] thp_fault_alloc 0 [ 140.845803][ T5433] thp_collapse_alloc 0 [pid 5450] mkdir("./file0", 000) = 0 [pid 5450] open("./file0", O_RDONLY) = 3 [pid 5450] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5450] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5450] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5450] openat(5, "memory.max", O_RDWR) = 6 [pid 5450] write(6, "0x000000000000040e", 18 [pid 5433] <... write resumed>) = 18 [pid 5433] close(3) = 0 [pid 5433] close(4) = 0 [pid 5433] close(5) = 0 [pid 5433] close(6) = 0 [pid 5433] close(7) = -1 EBADF (Bad file descriptor) [pid 5433] close(8) = -1 EBADF (Bad file descriptor) [pid 5433] close(9) = -1 EBADF (Bad file descriptor) [pid 5433] close(10) = -1 EBADF (Bad file descriptor) [pid 5433] close(11) = -1 EBADF (Bad file descriptor) [pid 5433] close(12) = -1 EBADF (Bad file descriptor) [pid 5433] close(13) = -1 EBADF (Bad file descriptor) [pid 5433] close(14) = -1 EBADF (Bad file descriptor) [pid 5433] close(15) = -1 EBADF (Bad file descriptor) [pid 5433] close(16) = -1 EBADF (Bad file descriptor) [pid 5433] close(17) = -1 EBADF (Bad file descriptor) [ 141.079470][ T5433] Tasks state (memory values in pages): [ 141.087681][ T5433] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 141.097557][ T5433] Out of memory and no killable processes... [ 141.116921][ T5437] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5433] close(18) = -1 EBADF (Bad file descriptor) [ 141.161778][ T5437] CPU: 0 PID: 5437 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 141.171759][ T5437] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 141.181847][ T5437] Call Trace: [ 141.185158][ T5437] [ 141.188110][ T5437] dump_stack_lvl+0x136/0x150 [ 141.192833][ T5437] dump_header+0x10a/0xd70 [ 141.197285][ T5437] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 141.203446][ T5437] out_of_memory+0xd64/0x1660 [ 141.208171][ T5437] ? oom_killer_disable+0x2b0/0x2b0 [ 141.213426][ T5437] mem_cgroup_out_of_memory+0x206/0x270 [ 141.219012][ T5437] ? mem_cgroup_margin+0x130/0x130 [ 141.224180][ T5437] memory_max_write+0x2f9/0x3c0 [ 141.229078][ T5437] ? mem_cgroup_force_empty_write+0x160/0x160 [ 141.235192][ T5437] ? lock_sync+0x190/0x190 [ 141.239646][ T5437] cgroup_file_write+0x1e2/0x7b0 [ 141.244630][ T5437] ? mem_cgroup_force_empty_write+0x160/0x160 [ 141.250737][ T5437] ? kill_css+0x3b0/0x3b0 [ 141.255102][ T5437] ? lock_acquire+0x32/0xc0 [ 141.259653][ T5437] ? kill_css+0x3b0/0x3b0 [ 141.264025][ T5437] kernfs_fop_write_iter+0x3f1/0x600 [ 141.269359][ T5437] vfs_write+0x9ed/0xe10 [ 141.273659][ T5437] ? kernel_write+0x670/0x670 [ 141.278385][ T5437] ? find_held_lock+0x2d/0x110 [ 141.283209][ T5437] ? __fget_light+0x20a/0x270 [ 141.287934][ T5437] ksys_write+0x12b/0x250 [ 141.292312][ T5437] ? __ia32_sys_read+0xb0/0xb0 [ 141.297118][ T5437] ? lockdep_hardirqs_on+0x7d/0x100 [ 141.302353][ T5437] ? _raw_spin_unlock_irq+0x2e/0x50 [ 141.307622][ T5437] ? ptrace_notify+0xfe/0x140 [ 141.312343][ T5437] do_syscall_64+0x39/0xb0 [ 141.316810][ T5437] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 141.322742][ T5437] RIP: 0033:0x7faecf034129 [ 141.327183][ T5437] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 141.346824][ T5437] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 5433] close(19) = -1 EBADF (Bad file descriptor) [pid 5433] close(20) = -1 EBADF (Bad file descriptor) [pid 5433] close(21) = -1 EBADF (Bad file descriptor) [pid 5433] close(22) = -1 EBADF (Bad file descriptor) [pid 5433] close(23) = -1 EBADF (Bad file descriptor) [pid 5433] close(24) = -1 EBADF (Bad file descriptor) [pid 5433] close(25) = -1 EBADF (Bad file descriptor) [pid 5433] close(26) = -1 EBADF (Bad file descriptor) [pid 5433] close(27) = -1 EBADF (Bad file descriptor) [ 141.355272][ T5437] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 141.363273][ T5437] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 141.371272][ T5437] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 141.379267][ T5437] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 141.387278][ T5437] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000010 [ 141.395302][ T5437] [pid 5433] close(28) = -1 EBADF (Bad file descriptor) [pid 5433] close(29) = -1 EBADF (Bad file descriptor) [pid 5433] exit_group(0) = ? [pid 5433] +++ exited with 0 +++ [pid 5090] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=18, si_uid=0, si_status=0, si_utime=0, si_stime=11 /* 0.11 s */} --- [pid 5090] umount2("./16", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5090] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5090] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5090] umount2("./16/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./16/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5090] unlink("./16/binderfs") = 0 [pid 5090] umount2("./16/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./16/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [ 141.421021][ T5437] memory: usage 8kB, limit 0kB, failcnt 36 [ 141.430626][ T5437] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 141.446897][ T5437] Memory cgroup stats for /syz1: [ 141.447189][ T5437] anon 0 [ 141.447189][ T5437] file 0 [ 141.447189][ T5437] kernel 8192 [ 141.447189][ T5437] kernel_stack 0 [ 141.447189][ T5437] pagetables 0 [ 141.447189][ T5437] sec_pagetables 0 [pid 5090] unlink("./16/cgroup") = 0 [pid 5090] umount2("./16/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./16/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5090] unlink("./16/cgroup.net") = 0 [ 141.447189][ T5437] percpu 0 [ 141.447189][ T5437] sock 0 [ 141.447189][ T5437] vmalloc 0 [ 141.447189][ T5437] shmem 0 [ 141.447189][ T5437] zswap 0 [ 141.447189][ T5437] zswapped 0 [ 141.447189][ T5437] file_mapped 0 [ 141.447189][ T5437] file_dirty 0 [ 141.447189][ T5437] file_writeback 0 [ 141.447189][ T5437] swapcached 0 [ 141.447189][ T5437] anon_thp 0 [ 141.447189][ T5437] file_thp 0 [ 141.447189][ T5437] shmem_thp 0 [ 141.447189][ T5437] inactive_anon 0 [ 141.447189][ T5437] active_anon 0 [ 141.447189][ T5437] inactive_file 0 [ 141.447189][ T5437] active_file 0 [ 141.447189][ T5437] unevictable 0 [ 141.447189][ T5437] slab_reclaimable 6752 [ 141.447189][ T5437] slab_unreclaimable 0 [ 141.447189][ T5437] slab 6752 [ 141.447189][ T5437] workingset_refault_anon 0 [ 141.447189][ T5437] workingset_refault_file 0 [ 141.447189][ T5437] workingset_activate_anon 0 [ 141.447189][ T5437] workingset_activate_file 0 [ 141.447189][ T5437] workingset_restore_anon 0 [ 141.447189][ T5437] workingset_restore_file 0 [ 141.447189][ T5437] workingset_nodereclaim 0 [ 141.447189][ T5437] pgscan 831 [ 141.447189][ T5437] pgsteal 2 [ 141.447189][ T5437] pgscan_kswapd 0 [ 141.447189][ T5437] pgscan_direct 831 [ 141.447189][ T5437] pgscan_khugepaged 0 [ 141.447189][ T5437] pgsteal_kswapd 0 [ 141.447189][ T5437] pgsteal_direct 2 [ 141.447189][ T5437] pgsteal_khugepaged 0 [ 141.447189][ T5437] pgfault 21 [ 141.447189][ T5437] pgmajfault 0 [ 141.447189][ T5437] pgrefill 830 [ 141.447189][ T5437] pgactivate 829 [ 141.447189][ T5437] pgdeactivate 830 [ 141.447189][ T5437] pglazyfree 0 [ 141.447189][ T5437] pglazyfreed 0 [pid 5090] umount2("./16/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5090] umount2("./16/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./16/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5090] umount2("./16/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] openat(AT_FDCWD, "./16/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5090] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5090] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5090] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5090] close(4) = 0 [pid 5090] rmdir("./16/file0") = 0 [pid 5090] umount2("./16/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./16/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [ 141.447189][ T5437] zswpin 0 [ 141.447189][ T5437] zswpout 0 [ 141.447189][ T5437] thp_fault_alloc 0 [ 141.447189][ T5437] thp_collapse_alloc 0 [pid 5090] unlink("./16/cgroup.cpu") = 0 [pid 5090] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5090] close(3) = 0 [pid 5090] rmdir("./16") = 0 [pid 5090] mkdir("./17", 0777) = 0 [pid 5090] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5455 attached , child_tidptr=0x555555c0c5d0) = 19 [pid 5455] chdir("./17") = 0 [pid 5455] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5455] setpgid(0, 0 [pid 5437] <... write resumed>) = 18 [pid 5455] <... setpgid resumed>) = 0 [pid 5437] close(3 [pid 5455] symlink("/syzcgroup/unified/syz4", "./cgroup" [ 141.682543][ T5437] Tasks state (memory values in pages): [ 141.688172][ T5437] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 141.707566][ T5437] Out of memory and no killable processes... [ 141.715952][ T5442] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5437] <... close resumed>) = 0 [pid 5455] <... symlink resumed>) = 0 [ 141.733778][ T5442] CPU: 1 PID: 5442 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 141.743785][ T5442] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 141.753903][ T5442] Call Trace: [ 141.757226][ T5442] [ 141.760206][ T5442] dump_stack_lvl+0x136/0x150 [ 141.764968][ T5442] dump_header+0x10a/0xd70 [ 141.769449][ T5442] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 141.775623][ T5442] out_of_memory+0xd64/0x1660 [ 141.780380][ T5442] ? oom_killer_disable+0x2b0/0x2b0 [ 141.785665][ T5442] mem_cgroup_out_of_memory+0x206/0x270 [ 141.791289][ T5442] ? mem_cgroup_margin+0x130/0x130 [ 141.796511][ T5442] memory_max_write+0x2f9/0x3c0 [ 141.801447][ T5442] ? mem_cgroup_force_empty_write+0x160/0x160 [ 141.807597][ T5442] ? lock_sync+0x190/0x190 [ 141.812085][ T5442] cgroup_file_write+0x1e2/0x7b0 [ 141.817101][ T5442] ? mem_cgroup_force_empty_write+0x160/0x160 [ 141.823336][ T5442] ? kill_css+0x3b0/0x3b0 [ 141.827740][ T5442] ? lock_acquire+0x32/0xc0 [ 141.832331][ T5442] ? kill_css+0x3b0/0x3b0 [ 141.836735][ T5442] kernfs_fop_write_iter+0x3f1/0x600 [ 141.842123][ T5442] vfs_write+0x9ed/0xe10 [ 141.846496][ T5442] ? kernel_write+0x670/0x670 [ 141.851262][ T5442] ? find_held_lock+0x2d/0x110 [ 141.856095][ T5442] ? __fget_light+0x20a/0x270 [ 141.860858][ T5442] ksys_write+0x12b/0x250 [ 141.865268][ T5442] ? __ia32_sys_read+0xb0/0xb0 [ 141.870109][ T5442] ? lockdep_hardirqs_on+0x7d/0x100 [ 141.875382][ T5442] ? _raw_spin_unlock_irq+0x2e/0x50 [ 141.880661][ T5442] ? ptrace_notify+0xfe/0x140 [ 141.885418][ T5442] do_syscall_64+0x39/0xb0 [ 141.889916][ T5442] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 141.895905][ T5442] RIP: 0033:0x7faecf034129 [ 141.900434][ T5442] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 141.920112][ T5442] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 5455] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu" [ 141.928605][ T5442] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 141.936637][ T5442] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 141.944666][ T5442] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 141.952697][ T5442] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 141.960726][ T5442] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 000000000000000d [ 141.968787][ T5442] [pid 5437] close(4 [pid 5455] <... symlink resumed>) = 0 [pid 5437] <... close resumed>) = 0 [pid 5455] symlink("/syzcgroup/net/syz4", "./cgroup.net" [ 141.983619][ T5442] memory: usage 8kB, limit 0kB, failcnt 36 [ 141.989505][ T5442] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 141.997327][ T5442] Memory cgroup stats for /syz1: [ 141.997628][ T5442] anon 0 [ 141.997628][ T5442] file 0 [ 141.997628][ T5442] kernel 8192 [ 141.997628][ T5442] kernel_stack 0 [ 141.997628][ T5442] pagetables 0 [ 141.997628][ T5442] sec_pagetables 0 [ 141.997628][ T5442] percpu 0 [ 141.997628][ T5442] sock 0 [ 141.997628][ T5442] vmalloc 0 [ 141.997628][ T5442] shmem 0 [ 141.997628][ T5442] zswap 0 [ 141.997628][ T5442] zswapped 0 [ 141.997628][ T5442] file_mapped 0 [ 141.997628][ T5442] file_dirty 0 [ 141.997628][ T5442] file_writeback 0 [ 141.997628][ T5442] swapcached 0 [ 141.997628][ T5442] anon_thp 0 [ 141.997628][ T5442] file_thp 0 [ 141.997628][ T5442] shmem_thp 0 [ 141.997628][ T5442] inactive_anon 0 [ 141.997628][ T5442] active_anon 0 [ 141.997628][ T5442] inactive_file 0 [ 141.997628][ T5442] active_file 0 [ 141.997628][ T5442] unevictable 0 [ 141.997628][ T5442] slab_reclaimable 6752 [ 141.997628][ T5442] slab_unreclaimable 0 [ 141.997628][ T5442] slab 6752 [ 141.997628][ T5442] workingset_refault_anon 0 [ 141.997628][ T5442] workingset_refault_file 0 [ 141.997628][ T5442] workingset_activate_anon 0 [ 141.997628][ T5442] workingset_activate_file 0 [ 141.997628][ T5442] workingset_restore_anon 0 [ 141.997628][ T5442] workingset_restore_file 0 [ 141.997628][ T5442] workingset_nodereclaim 0 [ 141.997628][ T5442] pgscan 831 [ 141.997628][ T5442] pgsteal 2 [ 141.997628][ T5442] pgscan_kswapd 0 [ 141.997628][ T5442] pgscan_direct 831 [pid 5437] close(5 [pid 5455] <... symlink resumed>) = 0 [pid 5455] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5455] write(3, "1000", 4) = 4 [pid 5455] close(3) = 0 [pid 5437] <... close resumed>) = 0 [pid 5455] symlink("/dev/binderfs", "./binderfs" [pid 5437] close(6 [pid 5455] <... symlink resumed>) = 0 [pid 5437] <... close resumed>) = 0 [pid 5455] mkdir("./file0", 000 [pid 5437] close(7 [pid 5455] <... mkdir resumed>) = 0 [pid 5437] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5455] open("./file0", O_RDONLY [pid 5437] close(8 [pid 5455] <... open resumed>) = 3 [pid 5437] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5455] mount(NULL, "./file0", "cgroup2", 0, NULL [ 141.997628][ T5442] pgscan_khugepaged 0 [ 141.997628][ T5442] pgsteal_kswapd 0 [ 141.997628][ T5442] pgsteal_direct 2 [ 141.997628][ T5442] pgsteal_khugepaged 0 [ 141.997628][ T5442] pgfault 21 [ 141.997628][ T5442] pgmajfault 0 [ 141.997628][ T5442] pgrefill 830 [ 141.997628][ T5442] pgactivate 829 [ 141.997628][ T5442] pgdeactivate 830 [ 141.997628][ T5442] pglazyfree 0 [ 141.997628][ T5442] pglazyfreed 0 [ 141.997628][ T5442] zswpin 0 [ 141.997628][ T5442] zswpout 0 [ 141.997628][ T5442] thp_fault_alloc 0 [ 141.997628][ T5442] thp_collapse_alloc 0 [pid 5437] close(9 [pid 5455] <... mount resumed>) = 0 [pid 5437] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5455] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5437] close(10 [pid 5455] <... openat resumed>) = 4 [pid 5437] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5455] openat(4, "syz1", O_RDWR|O_PATH [pid 5437] close(11 [pid 5455] <... openat resumed>) = 5 [pid 5437] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5455] openat(5, "memory.max", O_RDWR [pid 5437] close(12 [pid 5455] <... openat resumed>) = 6 [pid 5437] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5455] write(6, "0x000000000000040e", 18 [pid 5437] close(13) = -1 EBADF (Bad file descriptor) [pid 5437] close(14) = -1 EBADF (Bad file descriptor) [pid 5437] close(15) = -1 EBADF (Bad file descriptor) [pid 5437] close(16) = -1 EBADF (Bad file descriptor) [pid 5437] close(17) = -1 EBADF (Bad file descriptor) [pid 5437] close(18) = -1 EBADF (Bad file descriptor) [pid 5437] close(19) = -1 EBADF (Bad file descriptor) [pid 5437] close(20) = -1 EBADF (Bad file descriptor) [pid 5437] close(21) = -1 EBADF (Bad file descriptor) [pid 5437] close(22) = -1 EBADF (Bad file descriptor) [pid 5437] close(23) = -1 EBADF (Bad file descriptor) [pid 5437] close(24) = -1 EBADF (Bad file descriptor) [pid 5437] close(25) = -1 EBADF (Bad file descriptor) [pid 5437] close(26) = -1 EBADF (Bad file descriptor) [pid 5437] close(27) = -1 EBADF (Bad file descriptor) [pid 5437] close(28) = -1 EBADF (Bad file descriptor) [pid 5437] close(29) = -1 EBADF (Bad file descriptor) [pid 5437] exit_group(0) = ? [pid 5437] +++ exited with 0 +++ [pid 5089] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=18, si_uid=0, si_status=0, si_utime=0, si_stime=9 /* 0.09 s */} --- [pid 5089] umount2("./16", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 142.269977][ T5442] Tasks state (memory values in pages): [ 142.276208][ T5442] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5089] openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5089] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5089] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5089] umount2("./16/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./16/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5089] unlink("./16/binderfs") = 0 [pid 5089] umount2("./16/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./16/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5089] unlink("./16/cgroup") = 0 [pid 5089] umount2("./16/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5442] <... write resumed>) = 18 [pid 5089] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5442] close(3 [pid 5089] lstat("./16/cgroup.net", [pid 5442] <... close resumed>) = 0 [pid 5089] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5442] close(4) = 0 [pid 5442] close(5) = 0 [pid 5442] close(6) = 0 [pid 5442] close(7) = -1 EBADF (Bad file descriptor) [pid 5442] close(8) = -1 EBADF (Bad file descriptor) [ 142.320809][ T5442] Out of memory and no killable processes... [ 142.346108][ T5449] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5442] close(9) = -1 EBADF (Bad file descriptor) [pid 5442] close(10) = -1 EBADF (Bad file descriptor) [pid 5442] close(11) = -1 EBADF (Bad file descriptor) [pid 5442] close(12) = -1 EBADF (Bad file descriptor) [pid 5442] close(13) = -1 EBADF (Bad file descriptor) [pid 5442] close(14) = -1 EBADF (Bad file descriptor) [pid 5442] close(15) = -1 EBADF (Bad file descriptor) [pid 5442] close(16) = -1 EBADF (Bad file descriptor) [pid 5442] close(17) = -1 EBADF (Bad file descriptor) [pid 5442] close(18) = -1 EBADF (Bad file descriptor) [pid 5442] close(19) = -1 EBADF (Bad file descriptor) [pid 5442] close(20) = -1 EBADF (Bad file descriptor) [pid 5442] close(21) = -1 EBADF (Bad file descriptor) [pid 5442] close(22) = -1 EBADF (Bad file descriptor) [pid 5442] close(23) = -1 EBADF (Bad file descriptor) [pid 5442] close(24) = -1 EBADF (Bad file descriptor) [pid 5442] close(25) = -1 EBADF (Bad file descriptor) [pid 5442] close(26) = -1 EBADF (Bad file descriptor) [pid 5442] close(27) = -1 EBADF (Bad file descriptor) [pid 5442] close(28) = -1 EBADF (Bad file descriptor) [pid 5442] close(29) = -1 EBADF (Bad file descriptor) [pid 5442] exit_group(0) = ? [pid 5442] +++ exited with 0 +++ [pid 5086] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=15, si_uid=0, si_status=0, si_utime=0, si_stime=9 /* 0.09 s */} --- [pid 5086] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5086] umount2("./13", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5086] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5086] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [ 142.361877][ T5449] CPU: 1 PID: 5449 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 142.371912][ T5449] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 142.382047][ T5449] Call Trace: [ 142.385377][ T5449] [ 142.388374][ T5449] dump_stack_lvl+0x136/0x150 [ 142.393127][ T5449] dump_header+0x10a/0xd70 [ 142.397613][ T5449] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 142.403777][ T5449] out_of_memory+0xd64/0x1660 [ 142.408550][ T5449] ? oom_killer_disable+0x2b0/0x2b0 [ 142.413845][ T5449] mem_cgroup_out_of_memory+0x206/0x270 [pid 5086] umount2("./13/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5089] unlink("./16/cgroup.net" [pid 5086] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5089] <... unlink resumed>) = 0 [pid 5086] lstat("./13/binderfs", [pid 5089] umount2("./16/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5086] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5086] unlink("./13/binderfs") = 0 [pid 5086] umount2("./13/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./13/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5086] unlink("./13/cgroup") = 0 [pid 5086] umount2("./13/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./13/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5086] unlink("./13/cgroup.net") = 0 [ 142.419467][ T5449] ? mem_cgroup_margin+0x130/0x130 [ 142.424686][ T5449] memory_max_write+0x2f9/0x3c0 [ 142.429627][ T5449] ? mem_cgroup_force_empty_write+0x160/0x160 [ 142.435784][ T5449] ? lock_sync+0x190/0x190 [ 142.440290][ T5449] cgroup_file_write+0x1e2/0x7b0 [ 142.445313][ T5449] ? mem_cgroup_force_empty_write+0x160/0x160 [ 142.451469][ T5449] ? kill_css+0x3b0/0x3b0 [ 142.455878][ T5449] ? lock_acquire+0x32/0xc0 [ 142.460495][ T5449] ? kill_css+0x3b0/0x3b0 [ 142.464903][ T5449] kernfs_fop_write_iter+0x3f1/0x600 [ 142.470275][ T5449] vfs_write+0x9ed/0xe10 [ 142.474610][ T5449] ? kernel_write+0x670/0x670 [ 142.479373][ T5449] ? find_held_lock+0x2d/0x110 [ 142.484225][ T5449] ? __fget_light+0x20a/0x270 [ 142.488993][ T5449] ksys_write+0x12b/0x250 [ 142.493408][ T5449] ? __ia32_sys_read+0xb0/0xb0 [ 142.498254][ T5449] ? lockdep_hardirqs_on+0x7d/0x100 [ 142.503526][ T5449] ? _raw_spin_unlock_irq+0x2e/0x50 [ 142.508813][ T5449] ? ptrace_notify+0xfe/0x140 [ 142.513579][ T5449] do_syscall_64+0x39/0xb0 [ 142.518100][ T5449] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 142.524066][ T5449] RIP: 0033:0x7faecf034129 [ 142.528540][ T5449] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 142.548240][ T5449] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 142.556731][ T5449] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [pid 5086] umount2("./13/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5089] <... umount2 resumed>) = 0 [pid 5089] umount2("./16/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5086] <... umount2 resumed>) = 0 [pid 5089] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5086] umount2("./13/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5089] lstat("./16/file0", [pid 5086] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5089] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [ 142.564767][ T5449] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 142.572799][ T5449] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 142.580838][ T5449] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 142.588875][ T5449] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 000000000000000f [ 142.596939][ T5449] [pid 5086] lstat("./13/file0", [pid 5089] umount2("./16/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5086] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5089] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5086] umount2("./13/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5089] openat(AT_FDCWD, "./16/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5086] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5089] <... openat resumed>) = 4 [pid 5086] openat(AT_FDCWD, "./13/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5089] fstat(4, [pid 5086] <... openat resumed>) = 4 [pid 5089] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5086] fstat(4, [pid 5089] getdents64(4, [pid 5086] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5089] <... getdents64 resumed>0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5086] getdents64(4, [pid 5089] getdents64(4, [pid 5086] <... getdents64 resumed>0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5089] <... getdents64 resumed>0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5086] getdents64(4, [pid 5089] close(4 [pid 5086] <... getdents64 resumed>0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5089] <... close resumed>) = 0 [pid 5086] close(4 [pid 5089] rmdir("./16/file0" [pid 5086] <... close resumed>) = 0 [pid 5089] <... rmdir resumed>) = 0 [pid 5086] rmdir("./13/file0" [pid 5089] umount2("./16/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5086] <... rmdir resumed>) = 0 [pid 5089] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5086] umount2("./13/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5089] lstat("./16/cgroup.cpu", [pid 5086] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5089] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5086] lstat("./13/cgroup.cpu", [pid 5089] unlink("./16/cgroup.cpu" [pid 5086] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5089] <... unlink resumed>) = 0 [pid 5086] unlink("./13/cgroup.cpu" [pid 5089] getdents64(3, [pid 5086] <... unlink resumed>) = 0 [pid 5089] <... getdents64 resumed>0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5086] getdents64(3, [pid 5089] close(3 [pid 5086] <... getdents64 resumed>0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5089] <... close resumed>) = 0 [pid 5086] close(3 [pid 5089] rmdir("./16" [pid 5086] <... close resumed>) = 0 [pid 5089] <... rmdir resumed>) = 0 [pid 5086] rmdir("./13" [pid 5089] mkdir("./17", 0777 [pid 5086] <... rmdir resumed>) = 0 [pid 5089] <... mkdir resumed>) = 0 [pid 5086] mkdir("./14", 0777 [pid 5089] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5086] <... mkdir resumed>) = 0 [pid 5086] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5467 attached [pid 5089] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 19 [pid 5467] chdir("./14" [pid 5086] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 16 [pid 5467] <... chdir resumed>) = 0 [pid 5467] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5467] setpgid(0, 0) = 0 [pid 5467] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [ 142.620302][ T5449] memory: usage 8kB, limit 0kB, failcnt 36 [ 142.628415][ T5449] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 142.645651][ T5449] Memory cgroup stats for /syz1: [ 142.646111][ T5449] anon 0 [ 142.646111][ T5449] file 0 [ 142.646111][ T5449] kernel 8192 [ 142.646111][ T5449] kernel_stack 0 [ 142.646111][ T5449] pagetables 0 [ 142.646111][ T5449] sec_pagetables 0 [pid 5467] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 5467] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 5467] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5467] write(3, "1000", 4) = 4 [pid 5467] close(3) = 0 [pid 5467] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5467] mkdir("./file0", 000) = 0 [pid 5467] open("./file0", O_RDONLY) = 3 [pid 5467] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5467] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5467] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5467] openat(5, "memory.max", O_RDWR) = 6 [ 142.646111][ T5449] percpu 0 [ 142.646111][ T5449] sock 0 [ 142.646111][ T5449] vmalloc 0 [ 142.646111][ T5449] shmem 0 [ 142.646111][ T5449] zswap 0 [ 142.646111][ T5449] zswapped 0 [ 142.646111][ T5449] file_mapped 0 [ 142.646111][ T5449] file_dirty 0 [ 142.646111][ T5449] file_writeback 0 [ 142.646111][ T5449] swapcached 0 [ 142.646111][ T5449] anon_thp 0 [ 142.646111][ T5449] file_thp 0 [ 142.646111][ T5449] shmem_thp 0 [ 142.646111][ T5449] inactive_anon 0 [ 142.646111][ T5449] active_anon 0 [ 142.646111][ T5449] inactive_file 0 [ 142.646111][ T5449] active_file 0 [ 142.646111][ T5449] unevictable 0 [ 142.646111][ T5449] slab_reclaimable 6752 [ 142.646111][ T5449] slab_unreclaimable 0 [ 142.646111][ T5449] slab 6752 [ 142.646111][ T5449] workingset_refault_anon 0 [ 142.646111][ T5449] workingset_refault_file 0 [ 142.646111][ T5449] workingset_activate_anon 0 [ 142.646111][ T5449] workingset_activate_file 0 [ 142.646111][ T5449] workingset_restore_anon 0 [ 142.646111][ T5449] workingset_restore_file 0 [ 142.646111][ T5449] workingset_nodereclaim 0 [ 142.646111][ T5449] pgscan 831 [ 142.646111][ T5449] pgsteal 2 [ 142.646111][ T5449] pgscan_kswapd 0 [ 142.646111][ T5449] pgscan_direct 831 [ 142.646111][ T5449] pgscan_khugepaged 0 [ 142.646111][ T5449] pgsteal_kswapd 0 [ 142.646111][ T5449] pgsteal_direct 2 [ 142.646111][ T5449] pgsteal_khugepaged 0 [ 142.646111][ T5449] pgfault 21 [ 142.646111][ T5449] pgmajfault 0 [ 142.646111][ T5449] pgrefill 830 [ 142.646111][ T5449] pgactivate 829 [ 142.646111][ T5449] pgdeactivate 830 [ 142.646111][ T5449] pglazyfree 0 [ 142.646111][ T5449] pglazyfreed 0 [ 142.646111][ T5449] zswpin 0 [pid 5467] write(6, "0x000000000000040e", 18./strace-static-x86_64: Process 5466 attached [pid 5466] chdir("./17") = 0 [pid 5466] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5466] setpgid(0, 0) = 0 [pid 5466] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 5466] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [pid 5466] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 5466] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5466] write(3, "1000", 4) = 4 [pid 5466] close(3) = 0 [pid 5466] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5466] mkdir("./file0", 000) = 0 [pid 5466] open("./file0", O_RDONLY) = 3 [pid 5466] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [ 142.646111][ T5449] zswpout 0 [ 142.646111][ T5449] thp_fault_alloc 0 [ 142.646111][ T5449] thp_collapse_alloc 0 [ 142.843074][ T5449] Tasks state (memory values in pages): [ 142.848703][ T5449] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5466] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5466] openat(4, "syz1", O_RDWR|O_PATH [pid 5449] <... write resumed>) = 18 [pid 5466] <... openat resumed>) = 5 [pid 5449] close(3 [pid 5466] openat(5, "memory.max", O_RDWR [pid 5449] <... close resumed>) = 0 [pid 5466] <... openat resumed>) = 6 [pid 5449] close(4 [ 142.905107][ T5449] Out of memory and no killable processes... [ 142.911405][ T5450] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 142.928161][ T5450] CPU: 1 PID: 5450 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 142.938185][ T5450] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 142.948303][ T5450] Call Trace: [ 142.951631][ T5450] [pid 5466] write(6, "0x000000000000040e", 18 [pid 5449] <... close resumed>) = 0 [pid 5449] close(5) = 0 [pid 5449] close(6) = 0 [pid 5449] close(7) = -1 EBADF (Bad file descriptor) [pid 5449] close(8) = -1 EBADF (Bad file descriptor) [pid 5449] close(9) = -1 EBADF (Bad file descriptor) [pid 5449] close(10) = -1 EBADF (Bad file descriptor) [pid 5449] close(11) = -1 EBADF (Bad file descriptor) [ 142.954607][ T5450] dump_stack_lvl+0x136/0x150 [ 142.959351][ T5450] dump_header+0x10a/0xd70 [ 142.963824][ T5450] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 142.969982][ T5450] out_of_memory+0xd64/0x1660 [ 142.974753][ T5450] ? oom_killer_disable+0x2b0/0x2b0 [ 142.980049][ T5450] mem_cgroup_out_of_memory+0x206/0x270 [ 142.985680][ T5450] ? mem_cgroup_margin+0x130/0x130 [ 142.990889][ T5450] memory_max_write+0x2f9/0x3c0 [ 142.995835][ T5450] ? mem_cgroup_force_empty_write+0x160/0x160 [ 143.001989][ T5450] ? lock_sync+0x190/0x190 [ 143.006459][ T5450] cgroup_file_write+0x1e2/0x7b0 [ 143.011449][ T5450] ? mem_cgroup_force_empty_write+0x160/0x160 [ 143.017571][ T5450] ? kill_css+0x3b0/0x3b0 [ 143.021947][ T5450] ? lock_acquire+0x32/0xc0 [ 143.026496][ T5450] ? kill_css+0x3b0/0x3b0 [ 143.030865][ T5450] kernfs_fop_write_iter+0x3f1/0x600 [ 143.036207][ T5450] vfs_write+0x9ed/0xe10 [ 143.040513][ T5450] ? kernel_write+0x670/0x670 [ 143.045240][ T5450] ? find_held_lock+0x2d/0x110 [ 143.050047][ T5450] ? __fget_light+0x20a/0x270 [ 143.054777][ T5450] ksys_write+0x12b/0x250 [ 143.059153][ T5450] ? __ia32_sys_read+0xb0/0xb0 [ 143.063965][ T5450] ? lockdep_hardirqs_on+0x7d/0x100 [ 143.069207][ T5450] ? _raw_spin_unlock_irq+0x2e/0x50 [ 143.074447][ T5450] ? ptrace_notify+0xfe/0x140 [ 143.079160][ T5450] do_syscall_64+0x39/0xb0 [ 143.083634][ T5450] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 143.089585][ T5450] RIP: 0033:0x7faecf034129 [ 143.094037][ T5450] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 143.113681][ T5450] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 143.122264][ T5450] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 143.130271][ T5450] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 143.138269][ T5450] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 143.146266][ T5450] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [pid 5449] close(12) = -1 EBADF (Bad file descriptor) [pid 5449] close(13) = -1 EBADF (Bad file descriptor) [pid 5449] close(14) = -1 EBADF (Bad file descriptor) [pid 5449] close(15) = -1 EBADF (Bad file descriptor) [pid 5449] close(16) = -1 EBADF (Bad file descriptor) [pid 5449] close(17) = -1 EBADF (Bad file descriptor) [pid 5449] close(18) = -1 EBADF (Bad file descriptor) [pid 5449] close(19) = -1 EBADF (Bad file descriptor) [pid 5449] close(20) = -1 EBADF (Bad file descriptor) [pid 5449] close(21) = -1 EBADF (Bad file descriptor) [ 143.154269][ T5450] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 000000000000000d [ 143.162314][ T5450] [ 143.185334][ T5450] memory: usage 8kB, limit 0kB, failcnt 36 [ 143.191353][ T5450] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 143.198689][ T5450] Memory cgroup stats for /syz1: [pid 5449] close(22) = -1 EBADF (Bad file descriptor) [pid 5449] close(23) = -1 EBADF (Bad file descriptor) [pid 5449] close(24) = -1 EBADF (Bad file descriptor) [pid 5449] close(25) = -1 EBADF (Bad file descriptor) [pid 5449] close(26) = -1 EBADF (Bad file descriptor) [pid 5449] close(27) = -1 EBADF (Bad file descriptor) [pid 5449] close(28) = -1 EBADF (Bad file descriptor) [pid 5449] close(29) = -1 EBADF (Bad file descriptor) [pid 5449] exit_group(0) = ? [pid 5449] +++ exited with 0 +++ [pid 5087] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=17, si_uid=0, si_status=0, si_utime=0, si_stime=7 /* 0.07 s */} --- [pid 5087] umount2("./15", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5087] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5087] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5087] umount2("./15/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./15/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5087] unlink("./15/binderfs") = 0 [pid 5087] umount2("./15/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 143.198969][ T5450] anon 0 [ 143.198969][ T5450] file 0 [ 143.198969][ T5450] kernel 8192 [ 143.198969][ T5450] kernel_stack 0 [ 143.198969][ T5450] pagetables 0 [ 143.198969][ T5450] sec_pagetables 0 [ 143.198969][ T5450] percpu 0 [ 143.198969][ T5450] sock 0 [ 143.198969][ T5450] vmalloc 0 [ 143.198969][ T5450] shmem 0 [ 143.198969][ T5450] zswap 0 [ 143.198969][ T5450] zswapped 0 [ 143.198969][ T5450] file_mapped 0 [ 143.198969][ T5450] file_dirty 0 [ 143.198969][ T5450] file_writeback 0 [ 143.198969][ T5450] swapcached 0 [ 143.198969][ T5450] anon_thp 0 [pid 5087] lstat("./15/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5087] unlink("./15/cgroup") = 0 [pid 5087] umount2("./15/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./15/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5087] unlink("./15/cgroup.net") = 0 [ 143.198969][ T5450] file_thp 0 [ 143.198969][ T5450] shmem_thp 0 [ 143.198969][ T5450] inactive_anon 0 [ 143.198969][ T5450] active_anon 0 [ 143.198969][ T5450] inactive_file 0 [ 143.198969][ T5450] active_file 0 [ 143.198969][ T5450] unevictable 0 [ 143.198969][ T5450] slab_reclaimable 6752 [ 143.198969][ T5450] slab_unreclaimable 0 [ 143.198969][ T5450] slab 6752 [ 143.198969][ T5450] workingset_refault_anon 0 [ 143.198969][ T5450] workingset_refault_file 0 [ 143.198969][ T5450] workingset_activate_anon 0 [ 143.198969][ T5450] workingset_activate_file 0 [ 143.198969][ T5450] workingset_restore_anon 0 [ 143.198969][ T5450] workingset_restore_file 0 [ 143.198969][ T5450] workingset_nodereclaim 0 [ 143.198969][ T5450] pgscan 831 [ 143.198969][ T5450] pgsteal 2 [ 143.198969][ T5450] pgscan_kswapd 0 [ 143.198969][ T5450] pgscan_direct 831 [ 143.198969][ T5450] pgscan_khugepaged 0 [ 143.198969][ T5450] pgsteal_kswapd 0 [ 143.198969][ T5450] pgsteal_direct 2 [ 143.198969][ T5450] pgsteal_khugepaged 0 [ 143.198969][ T5450] pgfault 21 [ 143.198969][ T5450] pgmajfault 0 [pid 5087] umount2("./15/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5087] umount2("./15/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./15/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5087] umount2("./15/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] openat(AT_FDCWD, "./15/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5087] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5087] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5087] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5087] close(4) = 0 [pid 5087] rmdir("./15/file0") = 0 [pid 5087] umount2("./15/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./15/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5087] unlink("./15/cgroup.cpu") = 0 [pid 5087] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5087] close(3) = 0 [pid 5087] rmdir("./15") = 0 [pid 5087] mkdir("./16", 0777) = 0 [pid 5087] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5470 attached [pid 5470] chdir("./16" [pid 5087] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 18 [pid 5470] <... chdir resumed>) = 0 [pid 5470] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5470] setpgid(0, 0) = 0 [pid 5470] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 5470] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [ 143.198969][ T5450] pgrefill 830 [ 143.198969][ T5450] pgactivate 829 [ 143.198969][ T5450] pgdeactivate 830 [ 143.198969][ T5450] pglazyfree 0 [ 143.198969][ T5450] pglazyfreed 0 [ 143.198969][ T5450] zswpin 0 [ 143.198969][ T5450] zswpout 0 [ 143.198969][ T5450] thp_fault_alloc 0 [ 143.198969][ T5450] thp_collapse_alloc 0 [pid 5470] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 5470] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5470] write(3, "1000", 4) = 4 [pid 5470] close(3) = 0 [pid 5470] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5470] mkdir("./file0", 000) = 0 [pid 5470] open("./file0", O_RDONLY) = 3 [pid 5470] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5470] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5470] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5470] openat(5, "memory.max", O_RDWR) = 6 [pid 5470] write(6, "0x000000000000040e", 18 [pid 5450] <... write resumed>) = 18 [pid 5450] close(3) = 0 [pid 5450] close(4) = 0 [pid 5450] close(5) = 0 [pid 5450] close(6) = 0 [pid 5450] close(7) = -1 EBADF (Bad file descriptor) [pid 5450] close(8) = -1 EBADF (Bad file descriptor) [pid 5450] close(9) = -1 EBADF (Bad file descriptor) [pid 5450] close(10) = -1 EBADF (Bad file descriptor) [pid 5450] close(11) = -1 EBADF (Bad file descriptor) [pid 5450] close(12) = -1 EBADF (Bad file descriptor) [ 143.483879][ T5450] Tasks state (memory values in pages): [ 143.489871][ T5450] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 143.503016][ T5450] Out of memory and no killable processes... [ 143.511266][ T5455] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 143.554900][ T5455] CPU: 0 PID: 5455 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 143.564893][ T5455] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 143.575018][ T5455] Call Trace: [ 143.578337][ T5455] [ 143.581309][ T5455] dump_stack_lvl+0x136/0x150 [ 143.586047][ T5455] dump_header+0x10a/0xd70 [ 143.590507][ T5455] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 143.596650][ T5455] out_of_memory+0xd64/0x1660 [ 143.601383][ T5455] ? oom_killer_disable+0x2b0/0x2b0 [ 143.606638][ T5455] mem_cgroup_out_of_memory+0x206/0x270 [ 143.612274][ T5455] ? mem_cgroup_margin+0x130/0x130 [ 143.617451][ T5455] memory_max_write+0x2f9/0x3c0 [ 143.622355][ T5455] ? mem_cgroup_force_empty_write+0x160/0x160 [ 143.628475][ T5455] ? lock_sync+0x190/0x190 [ 143.632957][ T5455] cgroup_file_write+0x1e2/0x7b0 [ 143.637954][ T5455] ? mem_cgroup_force_empty_write+0x160/0x160 [ 143.644068][ T5455] ? kill_css+0x3b0/0x3b0 [ 143.648444][ T5455] ? lock_acquire+0x32/0xc0 [ 143.652994][ T5455] ? kill_css+0x3b0/0x3b0 [ 143.657369][ T5455] kernfs_fop_write_iter+0x3f1/0x600 [ 143.662707][ T5455] vfs_write+0x9ed/0xe10 [ 143.667019][ T5455] ? kernel_write+0x670/0x670 [ 143.671750][ T5455] ? find_held_lock+0x2d/0x110 [ 143.676561][ T5455] ? __fget_light+0x20a/0x270 [ 143.681301][ T5455] ksys_write+0x12b/0x250 [ 143.685684][ T5455] ? __ia32_sys_read+0xb0/0xb0 [ 143.690494][ T5455] ? lockdep_hardirqs_on+0x7d/0x100 [ 143.695808][ T5455] ? _raw_spin_unlock_irq+0x2e/0x50 [ 143.701094][ T5455] ? ptrace_notify+0xfe/0x140 [ 143.705878][ T5455] do_syscall_64+0x39/0xb0 [ 143.710373][ T5455] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 143.716331][ T5455] RIP: 0033:0x7faecf034129 [ 143.720804][ T5455] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 143.740455][ T5455] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 5450] close(13) = -1 EBADF (Bad file descriptor) [ 143.748920][ T5455] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 143.756929][ T5455] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 143.764962][ T5455] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 143.772958][ T5455] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 143.780954][ T5455] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000011 [ 143.788983][ T5455] [pid 5450] close(14) = -1 EBADF (Bad file descriptor) [pid 5450] close(15) = -1 EBADF (Bad file descriptor) [pid 5450] close(16) = -1 EBADF (Bad file descriptor) [pid 5450] close(17) = -1 EBADF (Bad file descriptor) [pid 5450] close(18) = -1 EBADF (Bad file descriptor) [pid 5450] close(19) = -1 EBADF (Bad file descriptor) [pid 5450] close(20) = -1 EBADF (Bad file descriptor) [pid 5450] close(21) = -1 EBADF (Bad file descriptor) [pid 5450] close(22) = -1 EBADF (Bad file descriptor) [pid 5450] close(23) = -1 EBADF (Bad file descriptor) [pid 5450] close(24) = -1 EBADF (Bad file descriptor) [pid 5450] close(25) = -1 EBADF (Bad file descriptor) [pid 5450] close(26) = -1 EBADF (Bad file descriptor) [pid 5450] close(27) = -1 EBADF (Bad file descriptor) [pid 5450] close(28) = -1 EBADF (Bad file descriptor) [pid 5450] close(29) = -1 EBADF (Bad file descriptor) [pid 5450] exit_group(0) = ? [pid 5450] +++ exited with 0 +++ [pid 5085] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=15, si_uid=0, si_status=0, si_utime=0, si_stime=7 /* 0.07 s */} --- [pid 5085] umount2("./13", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5085] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [ 143.801979][ T5455] memory: usage 8kB, limit 0kB, failcnt 36 [ 143.807888][ T5455] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 143.831828][ T5455] Memory cgroup stats for /syz1: [ 143.832109][ T5455] anon 0 [ 143.832109][ T5455] file 0 [ 143.832109][ T5455] kernel 8192 [ 143.832109][ T5455] kernel_stack 0 [ 143.832109][ T5455] pagetables 0 [ 143.832109][ T5455] sec_pagetables 0 [pid 5085] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5085] umount2("./13/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./13/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5085] unlink("./13/binderfs") = 0 [pid 5085] umount2("./13/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./13/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5085] unlink("./13/cgroup") = 0 [pid 5085] umount2("./13/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./13/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5085] unlink("./13/cgroup.net") = 0 [ 143.832109][ T5455] percpu 0 [ 143.832109][ T5455] sock 0 [ 143.832109][ T5455] vmalloc 0 [ 143.832109][ T5455] shmem 0 [ 143.832109][ T5455] zswap 0 [ 143.832109][ T5455] zswapped 0 [ 143.832109][ T5455] file_mapped 0 [ 143.832109][ T5455] file_dirty 0 [ 143.832109][ T5455] file_writeback 0 [ 143.832109][ T5455] swapcached 0 [ 143.832109][ T5455] anon_thp 0 [ 143.832109][ T5455] file_thp 0 [ 143.832109][ T5455] shmem_thp 0 [ 143.832109][ T5455] inactive_anon 0 [ 143.832109][ T5455] active_anon 0 [ 143.832109][ T5455] inactive_file 0 [ 143.832109][ T5455] active_file 0 [ 143.832109][ T5455] unevictable 0 [ 143.832109][ T5455] slab_reclaimable 6752 [ 143.832109][ T5455] slab_unreclaimable 0 [ 143.832109][ T5455] slab 6752 [ 143.832109][ T5455] workingset_refault_anon 0 [ 143.832109][ T5455] workingset_refault_file 0 [ 143.832109][ T5455] workingset_activate_anon 0 [ 143.832109][ T5455] workingset_activate_file 0 [ 143.832109][ T5455] workingset_restore_anon 0 [ 143.832109][ T5455] workingset_restore_file 0 [ 143.832109][ T5455] workingset_nodereclaim 0 [ 143.832109][ T5455] pgscan 831 [ 143.832109][ T5455] pgsteal 2 [ 143.832109][ T5455] pgscan_kswapd 0 [ 143.832109][ T5455] pgscan_direct 831 [ 143.832109][ T5455] pgscan_khugepaged 0 [ 143.832109][ T5455] pgsteal_kswapd 0 [ 143.832109][ T5455] pgsteal_direct 2 [ 143.832109][ T5455] pgsteal_khugepaged 0 [ 143.832109][ T5455] pgfault 21 [ 143.832109][ T5455] pgmajfault 0 [ 143.832109][ T5455] pgrefill 830 [ 143.832109][ T5455] pgactivate 829 [ 143.832109][ T5455] pgdeactivate 830 [ 143.832109][ T5455] pglazyfree 0 [ 143.832109][ T5455] pglazyfreed 0 [ 143.832109][ T5455] zswpin 0 [pid 5085] umount2("./13/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5085] umount2("./13/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./13/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5085] umount2("./13/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] openat(AT_FDCWD, "./13/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5085] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5085] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5085] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5085] close(4) = 0 [pid 5085] rmdir("./13/file0") = 0 [pid 5085] umount2("./13/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./13/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [ 143.832109][ T5455] zswpout 0 [ 143.832109][ T5455] thp_fault_alloc 0 [ 143.832109][ T5455] thp_collapse_alloc 0 [ 144.028395][ T5455] Tasks state (memory values in pages): [ 144.041778][ T5455] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5085] unlink("./13/cgroup.cpu") = 0 [pid 5455] <... write resumed>) = 18 [pid 5455] close(3) = 0 [pid 5455] close(4) = 0 [pid 5455] close(5) = 0 [pid 5455] close(6) = 0 [pid 5085] getdents64(3, [pid 5455] close(7 [pid 5085] <... getdents64 resumed>0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5455] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5085] close(3 [pid 5455] close(8) = -1 EBADF (Bad file descriptor) [pid 5085] <... close resumed>) = 0 [pid 5085] rmdir("./13" [pid 5455] close(9) = -1 EBADF (Bad file descriptor) [pid 5455] close(10) = -1 EBADF (Bad file descriptor) [pid 5455] close(11) = -1 EBADF (Bad file descriptor) [pid 5085] <... rmdir resumed>) = 0 [pid 5455] close(12 [pid 5085] mkdir("./14", 0777 [pid 5455] <... close resumed>) = -1 EBADF (Bad file descriptor) [ 144.062441][ T5455] Out of memory and no killable processes... [ 144.068875][ T5467] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 144.086104][ T5467] CPU: 0 PID: 5467 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 144.096094][ T5467] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 144.106223][ T5467] Call Trace: [ 144.109546][ T5467] [ 144.112521][ T5467] dump_stack_lvl+0x136/0x150 [ 144.117266][ T5467] dump_header+0x10a/0xd70 [ 144.121741][ T5467] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 144.127911][ T5467] out_of_memory+0xd64/0x1660 [ 144.132690][ T5467] ? oom_killer_disable+0x2b0/0x2b0 [ 144.137959][ T5467] mem_cgroup_out_of_memory+0x206/0x270 [ 144.143555][ T5467] ? mem_cgroup_margin+0x130/0x130 [ 144.148730][ T5467] memory_max_write+0x2f9/0x3c0 [ 144.153631][ T5467] ? mem_cgroup_force_empty_write+0x160/0x160 [ 144.159751][ T5467] ? lock_sync+0x190/0x190 [ 144.164220][ T5467] cgroup_file_write+0x1e2/0x7b0 [ 144.169206][ T5467] ? mem_cgroup_force_empty_write+0x160/0x160 [ 144.175323][ T5467] ? kill_css+0x3b0/0x3b0 [ 144.179698][ T5467] ? lock_acquire+0x32/0xc0 [ 144.184281][ T5467] ? kill_css+0x3b0/0x3b0 [ 144.188684][ T5467] kernfs_fop_write_iter+0x3f1/0x600 [ 144.194018][ T5467] vfs_write+0x9ed/0xe10 [ 144.198309][ T5467] ? kernel_write+0x670/0x670 [ 144.203033][ T5467] ? find_held_lock+0x2d/0x110 [ 144.207841][ T5467] ? __fget_light+0x20a/0x270 [ 144.212572][ T5467] ksys_write+0x12b/0x250 [ 144.216957][ T5467] ? __ia32_sys_read+0xb0/0xb0 [ 144.221770][ T5467] ? lockdep_hardirqs_on+0x7d/0x100 [ 144.227015][ T5467] ? _raw_spin_unlock_irq+0x2e/0x50 [ 144.232268][ T5467] ? ptrace_notify+0xfe/0x140 [ 144.236989][ T5467] do_syscall_64+0x39/0xb0 [ 144.241455][ T5467] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 144.247390][ T5467] RIP: 0033:0x7faecf034129 [ 144.251835][ T5467] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 144.271472][ T5467] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 144.279911][ T5467] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 144.287912][ T5467] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 144.295906][ T5467] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 144.303905][ T5467] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [pid 5455] close(13 [pid 5085] <... mkdir resumed>) = 0 [pid 5455] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5455] close(14) = -1 EBADF (Bad file descriptor) [pid 5455] close(15) = -1 EBADF (Bad file descriptor) [pid 5455] close(16) = -1 EBADF (Bad file descriptor) [pid 5455] close(17) = -1 EBADF (Bad file descriptor) [pid 5455] close(18) = -1 EBADF (Bad file descriptor) [pid 5455] close(19) = -1 EBADF (Bad file descriptor) [pid 5455] close(20) = -1 EBADF (Bad file descriptor) [pid 5455] close(21) = -1 EBADF (Bad file descriptor) [pid 5455] close(22) = -1 EBADF (Bad file descriptor) [pid 5455] close(23) = -1 EBADF (Bad file descriptor) [pid 5455] close(24) = -1 EBADF (Bad file descriptor) [pid 5455] close(25) = -1 EBADF (Bad file descriptor) [pid 5455] close(26) = -1 EBADF (Bad file descriptor) [pid 5455] close(27) = -1 EBADF (Bad file descriptor) [pid 5455] close(28) = -1 EBADF (Bad file descriptor) [pid 5455] close(29) = -1 EBADF (Bad file descriptor) [pid 5455] exit_group(0) = ? [pid 5455] +++ exited with 0 +++ [pid 5090] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=19, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- [pid 5090] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5090] umount2("./17", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5090] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5090] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5090] umount2("./17/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./17/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5090] unlink("./17/binderfs") = 0 [pid 5090] umount2("./17/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./17/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5090] unlink("./17/cgroup") = 0 [pid 5090] umount2("./17/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./17/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5090] unlink("./17/cgroup.net") = 0 [pid 5090] umount2("./17/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5085] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555c0c5d0) = 16 [pid 5090] <... umount2 resumed>) = 0 ./strace-static-x86_64: Process 5475 attached [pid 5090] umount2("./17/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5475] chdir("./14" [pid 5090] lstat("./17/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5090] umount2("./17/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] openat(AT_FDCWD, "./17/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5090] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5475] <... chdir resumed>) = 0 [pid 5090] getdents64(4, [pid 5475] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5090] <... getdents64 resumed>0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5090] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5090] close(4 [pid 5475] <... prctl resumed>) = 0 [pid 5090] <... close resumed>) = 0 [pid 5090] rmdir("./17/file0" [pid 5475] setpgid(0, 0 [pid 5090] <... rmdir resumed>) = 0 [pid 5090] umount2("./17/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./17/cgroup.cpu", [pid 5475] <... setpgid resumed>) = 0 [pid 5090] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5475] symlink("/syzcgroup/unified/syz0", "./cgroup" [pid 5090] unlink("./17/cgroup.cpu" [pid 5475] <... symlink resumed>) = 0 [pid 5090] <... unlink resumed>) = 0 [pid 5475] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu" [pid 5090] getdents64(3, [pid 5475] <... symlink resumed>) = 0 [pid 5090] <... getdents64 resumed>0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5475] symlink("/syzcgroup/net/syz0", "./cgroup.net" [pid 5090] close(3 [pid 5475] <... symlink resumed>) = 0 [pid 5090] <... close resumed>) = 0 [pid 5475] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5090] rmdir("./17" [pid 5475] <... openat resumed>) = 3 [pid 5475] write(3, "1000", 4 [pid 5090] <... rmdir resumed>) = 0 [pid 5475] <... write resumed>) = 4 [pid 5090] mkdir("./18", 0777 [pid 5475] close(3) = 0 [pid 5090] <... mkdir resumed>) = 0 [ 144.311899][ T5467] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 000000000000000e [ 144.319916][ T5467] [pid 5475] symlink("/dev/binderfs", "./binderfs" [pid 5090] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5475] <... symlink resumed>) = 0 [pid 5475] mkdir("./file0", 000) = 0 [pid 5475] open("./file0", O_RDONLY) = 3 [pid 5475] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5475] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5475] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5475] openat(5, "memory.max", O_RDWR) = 6 [pid 5475] write(6, "0x000000000000040e", 18 [pid 5090] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 20 ./strace-static-x86_64: Process 5477 attached [pid 5477] chdir("./18") = 0 [pid 5477] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5477] setpgid(0, 0) = 0 [pid 5477] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [ 144.371473][ T5467] memory: usage 8kB, limit 0kB, failcnt 36 [ 144.378273][ T5467] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 144.399816][ T5467] Memory cgroup stats for /syz1: [ 144.400066][ T5467] anon 0 [ 144.400066][ T5467] file 0 [ 144.400066][ T5467] kernel 8192 [ 144.400066][ T5467] kernel_stack 0 [ 144.400066][ T5467] pagetables 0 [pid 5477] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 5477] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [pid 5477] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5477] write(3, "1000", 4) = 4 [pid 5477] close(3) = 0 [pid 5477] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5477] mkdir("./file0", 000) = 0 [pid 5477] open("./file0", O_RDONLY) = 3 [pid 5477] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5477] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5477] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5477] openat(5, "memory.max", O_RDWR) = 6 [ 144.400066][ T5467] sec_pagetables 0 [ 144.400066][ T5467] percpu 0 [ 144.400066][ T5467] sock 0 [ 144.400066][ T5467] vmalloc 0 [ 144.400066][ T5467] shmem 0 [ 144.400066][ T5467] zswap 0 [ 144.400066][ T5467] zswapped 0 [ 144.400066][ T5467] file_mapped 0 [ 144.400066][ T5467] file_dirty 0 [ 144.400066][ T5467] file_writeback 0 [ 144.400066][ T5467] swapcached 0 [ 144.400066][ T5467] anon_thp 0 [ 144.400066][ T5467] file_thp 0 [ 144.400066][ T5467] shmem_thp 0 [ 144.400066][ T5467] inactive_anon 0 [ 144.400066][ T5467] active_anon 0 [ 144.400066][ T5467] inactive_file 0 [ 144.400066][ T5467] active_file 0 [ 144.400066][ T5467] unevictable 0 [ 144.400066][ T5467] slab_reclaimable 6752 [ 144.400066][ T5467] slab_unreclaimable 0 [ 144.400066][ T5467] slab 6752 [ 144.400066][ T5467] workingset_refault_anon 0 [ 144.400066][ T5467] workingset_refault_file 0 [ 144.400066][ T5467] workingset_activate_anon 0 [ 144.400066][ T5467] workingset_activate_file 0 [ 144.400066][ T5467] workingset_restore_anon 0 [ 144.400066][ T5467] workingset_restore_file 0 [ 144.400066][ T5467] workingset_nodereclaim 0 [ 144.400066][ T5467] pgscan 831 [ 144.400066][ T5467] pgsteal 2 [ 144.400066][ T5467] pgscan_kswapd 0 [ 144.400066][ T5467] pgscan_direct 831 [ 144.400066][ T5467] pgscan_khugepaged 0 [ 144.400066][ T5467] pgsteal_kswapd 0 [ 144.400066][ T5467] pgsteal_direct 2 [ 144.400066][ T5467] pgsteal_khugepaged 0 [ 144.400066][ T5467] pgfault 21 [ 144.400066][ T5467] pgmajfault 0 [ 144.400066][ T5467] pgrefill 830 [ 144.400066][ T5467] pgactivate 829 [ 144.400066][ T5467] pgdeactivate 830 [ 144.400066][ T5467] pglazyfree 0 [ 144.400066][ T5467] pglazyfreed 0 [ 144.400066][ T5467] zswpin 0 [ 144.400066][ T5467] zswpout 0 [ 144.400066][ T5467] thp_fault_alloc 0 [ 144.400066][ T5467] thp_collapse_alloc 0 [ 144.605309][ T5467] Tasks state (memory values in pages): [ 144.610939][ T5467] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5477] write(6, "0x000000000000040e", 18 [pid 5467] <... write resumed>) = 18 [pid 5467] close(3) = 0 [pid 5467] close(4) = 0 [pid 5467] close(5) = 0 [pid 5467] close(6) = 0 [pid 5467] close(7) = -1 EBADF (Bad file descriptor) [pid 5467] close(8) = -1 EBADF (Bad file descriptor) [pid 5467] close(9) = -1 EBADF (Bad file descriptor) [pid 5467] close(10) = -1 EBADF (Bad file descriptor) [pid 5467] close(11) = -1 EBADF (Bad file descriptor) [pid 5467] close(12) = -1 EBADF (Bad file descriptor) [pid 5467] close(13) = -1 EBADF (Bad file descriptor) [ 144.629561][ T5467] Out of memory and no killable processes... [ 144.636040][ T5466] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 144.655838][ T5466] CPU: 1 PID: 5466 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 144.665823][ T5466] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 144.675940][ T5466] Call Trace: [pid 5467] close(14) = -1 EBADF (Bad file descriptor) [pid 5467] close(15) = -1 EBADF (Bad file descriptor) [pid 5467] close(16) = -1 EBADF (Bad file descriptor) [pid 5467] close(17) = -1 EBADF (Bad file descriptor) [pid 5467] close(18) = -1 EBADF (Bad file descriptor) [pid 5467] close(19) = -1 EBADF (Bad file descriptor) [pid 5467] close(20) = -1 EBADF (Bad file descriptor) [pid 5467] close(21) = -1 EBADF (Bad file descriptor) [pid 5467] close(22) = -1 EBADF (Bad file descriptor) [pid 5467] close(23) = -1 EBADF (Bad file descriptor) [pid 5467] close(24) = -1 EBADF (Bad file descriptor) [pid 5467] close(25) = -1 EBADF (Bad file descriptor) [pid 5467] close(26) = -1 EBADF (Bad file descriptor) [pid 5467] close(27) = -1 EBADF (Bad file descriptor) [pid 5467] close(28) = -1 EBADF (Bad file descriptor) [pid 5467] close(29) = -1 EBADF (Bad file descriptor) [pid 5467] exit_group(0) = ? [pid 5467] +++ exited with 0 +++ [ 144.679270][ T5466] [ 144.682249][ T5466] dump_stack_lvl+0x136/0x150 [ 144.687002][ T5466] dump_header+0x10a/0xd70 [ 144.691507][ T5466] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 144.697673][ T5466] out_of_memory+0xd64/0x1660 [ 144.702445][ T5466] ? oom_killer_disable+0x2b0/0x2b0 [ 144.707737][ T5466] mem_cgroup_out_of_memory+0x206/0x270 [ 144.713376][ T5466] ? mem_cgroup_margin+0x130/0x130 [ 144.718608][ T5466] memory_max_write+0x2f9/0x3c0 [ 144.723584][ T5466] ? mem_cgroup_force_empty_write+0x160/0x160 [ 144.729749][ T5466] ? lock_sync+0x190/0x190 [ 144.734239][ T5466] cgroup_file_write+0x1e2/0x7b0 [ 144.739257][ T5466] ? mem_cgroup_force_empty_write+0x160/0x160 [ 144.745405][ T5466] ? kill_css+0x3b0/0x3b0 [ 144.749821][ T5466] ? lock_acquire+0x32/0xc0 [ 144.754411][ T5466] ? kill_css+0x3b0/0x3b0 [ 144.758818][ T5466] kernfs_fop_write_iter+0x3f1/0x600 [ 144.764203][ T5466] vfs_write+0x9ed/0xe10 [ 144.768536][ T5466] ? kernel_write+0x670/0x670 [ 144.773305][ T5466] ? find_held_lock+0x2d/0x110 [ 144.778148][ T5466] ? __fget_light+0x20a/0x270 [ 144.782909][ T5466] ksys_write+0x12b/0x250 [ 144.787322][ T5466] ? __ia32_sys_read+0xb0/0xb0 [ 144.792162][ T5466] ? lockdep_hardirqs_on+0x7d/0x100 [ 144.797452][ T5466] ? _raw_spin_unlock_irq+0x2e/0x50 [ 144.802725][ T5466] ? ptrace_notify+0xfe/0x140 [ 144.807478][ T5466] do_syscall_64+0x39/0xb0 [ 144.811982][ T5466] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 144.817943][ T5466] RIP: 0033:0x7faecf034129 [ 144.822416][ T5466] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 144.842092][ T5466] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 144.850580][ T5466] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 144.858617][ T5466] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 144.866642][ T5466] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [pid 5086] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=16, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- [pid 5086] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5086] umount2("./14", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5086] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5086] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5086] umount2("./14/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./14/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5086] unlink("./14/binderfs") = 0 [pid 5086] umount2("./14/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 144.874667][ T5466] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 144.882709][ T5466] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000011 [ 144.890787][ T5466] [pid 5086] lstat("./14/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5086] unlink("./14/cgroup") = 0 [pid 5086] umount2("./14/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./14/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5086] unlink("./14/cgroup.net") = 0 [pid 5086] umount2("./14/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5086] umount2("./14/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./14/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5086] umount2("./14/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] openat(AT_FDCWD, "./14/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5086] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5086] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5086] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5086] close(4) = 0 [pid 5086] rmdir("./14/file0") = 0 [pid 5086] umount2("./14/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 144.928625][ T5466] memory: usage 8kB, limit 0kB, failcnt 36 [ 144.936729][ T5466] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 144.968960][ T5466] Memory cgroup stats for /syz1: [ 144.969253][ T5466] anon 0 [ 144.969253][ T5466] file 0 [ 144.969253][ T5466] kernel 8192 [ 144.969253][ T5466] kernel_stack 0 [ 144.969253][ T5466] pagetables 0 [ 144.969253][ T5466] sec_pagetables 0 [ 144.969253][ T5466] percpu 0 [ 144.969253][ T5466] sock 0 [ 144.969253][ T5466] vmalloc 0 [ 144.969253][ T5466] shmem 0 [ 144.969253][ T5466] zswap 0 [ 144.969253][ T5466] zswapped 0 [ 144.969253][ T5466] file_mapped 0 [ 144.969253][ T5466] file_dirty 0 [pid 5086] lstat("./14/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5086] unlink("./14/cgroup.cpu") = 0 [pid 5086] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5086] close(3) = 0 [pid 5086] rmdir("./14") = 0 [pid 5086] mkdir("./15", 0777) = 0 [pid 5086] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5481 attached [pid 5481] chdir("./15" [pid 5086] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 17 [pid 5481] <... chdir resumed>) = 0 [pid 5481] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5481] setpgid(0, 0) = 0 [pid 5481] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [pid 5481] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 5481] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 5481] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5481] write(3, "1000", 4) = 4 [pid 5481] close(3) = 0 [pid 5481] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5481] mkdir("./file0", 000) = 0 [pid 5481] open("./file0", O_RDONLY) = 3 [pid 5481] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5481] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5481] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5481] openat(5, "memory.max", O_RDWR) = 6 [ 144.969253][ T5466] file_writeback 0 [ 144.969253][ T5466] swapcached 0 [ 144.969253][ T5466] anon_thp 0 [ 144.969253][ T5466] file_thp 0 [ 144.969253][ T5466] shmem_thp 0 [ 144.969253][ T5466] inactive_anon 0 [ 144.969253][ T5466] active_anon 0 [ 144.969253][ T5466] inactive_file 0 [ 144.969253][ T5466] active_file 0 [ 144.969253][ T5466] unevictable 0 [ 144.969253][ T5466] slab_reclaimable 6752 [ 144.969253][ T5466] slab_unreclaimable 0 [ 144.969253][ T5466] slab 6752 [ 144.969253][ T5466] workingset_refault_anon 0 [ 144.969253][ T5466] workingset_refault_file 0 [ 144.969253][ T5466] workingset_activate_anon 0 [ 144.969253][ T5466] workingset_activate_file 0 [ 144.969253][ T5466] workingset_restore_anon 0 [ 144.969253][ T5466] workingset_restore_file 0 [ 144.969253][ T5466] workingset_nodereclaim 0 [ 144.969253][ T5466] pgscan 831 [ 144.969253][ T5466] pgsteal 2 [ 144.969253][ T5466] pgscan_kswapd 0 [ 144.969253][ T5466] pgscan_direct 831 [ 144.969253][ T5466] pgscan_khugepaged 0 [ 144.969253][ T5466] pgsteal_kswapd 0 [ 144.969253][ T5466] pgsteal_direct 2 [ 144.969253][ T5466] pgsteal_khugepaged 0 [ 144.969253][ T5466] pgfault 21 [ 144.969253][ T5466] pgmajfault 0 [ 144.969253][ T5466] pgrefill 830 [ 144.969253][ T5466] pgactivate 829 [ 144.969253][ T5466] pgdeactivate 830 [ 144.969253][ T5466] pglazyfree 0 [ 144.969253][ T5466] pglazyfreed 0 [ 144.969253][ T5466] zswpin 0 [ 144.969253][ T5466] zswpout 0 [ 144.969253][ T5466] thp_fault_alloc 0 [ 144.969253][ T5466] thp_collapse_alloc 0 [pid 5481] write(6, "0x000000000000040e", 18 [pid 5466] <... write resumed>) = 18 [ 145.168748][ T5466] Tasks state (memory values in pages): [ 145.174690][ T5466] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 145.191686][ T5466] Out of memory and no killable processes... [ 145.197803][ T5470] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 145.216512][ T5470] CPU: 0 PID: 5470 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 145.226578][ T5470] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 145.236692][ T5470] Call Trace: [ 145.240015][ T5470] [ 145.242994][ T5470] dump_stack_lvl+0x136/0x150 [ 145.247747][ T5470] dump_header+0x10a/0xd70 [ 145.252234][ T5470] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 145.258397][ T5470] out_of_memory+0xd64/0x1660 [ 145.263161][ T5470] ? oom_killer_disable+0x2b0/0x2b0 [pid 5466] close(3) = 0 [pid 5466] close(4) = 0 [pid 5466] close(5) = 0 [pid 5466] close(6) = 0 [ 145.268457][ T5470] mem_cgroup_out_of_memory+0x206/0x270 [ 145.274086][ T5470] ? mem_cgroup_margin+0x130/0x130 [ 145.279314][ T5470] memory_max_write+0x2f9/0x3c0 [ 145.284254][ T5470] ? mem_cgroup_force_empty_write+0x160/0x160 [ 145.290425][ T5470] ? lock_sync+0x190/0x190 [ 145.294925][ T5470] cgroup_file_write+0x1e2/0x7b0 [ 145.299952][ T5470] ? mem_cgroup_force_empty_write+0x160/0x160 [ 145.306111][ T5470] ? kill_css+0x3b0/0x3b0 [ 145.310522][ T5470] ? lock_acquire+0x32/0xc0 [ 145.315117][ T5470] ? kill_css+0x3b0/0x3b0 [ 145.319532][ T5470] kernfs_fop_write_iter+0x3f1/0x600 [ 145.324905][ T5470] vfs_write+0x9ed/0xe10 [ 145.329226][ T5470] ? kernel_write+0x670/0x670 [ 145.333967][ T5470] ? find_held_lock+0x2d/0x110 [ 145.338776][ T5470] ? __fget_light+0x20a/0x270 [ 145.343519][ T5470] ksys_write+0x12b/0x250 [ 145.347913][ T5470] ? __ia32_sys_read+0xb0/0xb0 [ 145.352723][ T5470] ? lockdep_hardirqs_on+0x7d/0x100 [ 145.357961][ T5470] ? _raw_spin_unlock_irq+0x2e/0x50 [ 145.363202][ T5470] ? ptrace_notify+0xfe/0x140 [ 145.367918][ T5470] do_syscall_64+0x39/0xb0 [ 145.372391][ T5470] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 145.378322][ T5470] RIP: 0033:0x7faecf034129 [ 145.382763][ T5470] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 145.402401][ T5470] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 145.410856][ T5470] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [pid 5466] close(7) = -1 EBADF (Bad file descriptor) [pid 5466] close(8) = -1 EBADF (Bad file descriptor) [pid 5466] close(9) = -1 EBADF (Bad file descriptor) [pid 5466] close(10) = -1 EBADF (Bad file descriptor) [pid 5466] close(11) = -1 EBADF (Bad file descriptor) [pid 5466] close(12) = -1 EBADF (Bad file descriptor) [pid 5466] close(13) = -1 EBADF (Bad file descriptor) [pid 5466] close(14) = -1 EBADF (Bad file descriptor) [pid 5466] close(15) = -1 EBADF (Bad file descriptor) [pid 5466] close(16) = -1 EBADF (Bad file descriptor) [pid 5466] close(17) = -1 EBADF (Bad file descriptor) [pid 5466] close(18) = -1 EBADF (Bad file descriptor) [pid 5466] close(19) = -1 EBADF (Bad file descriptor) [pid 5466] close(20) = -1 EBADF (Bad file descriptor) [pid 5466] close(21) = -1 EBADF (Bad file descriptor) [pid 5466] close(22) = -1 EBADF (Bad file descriptor) [pid 5466] close(23) = -1 EBADF (Bad file descriptor) [pid 5466] close(24) = -1 EBADF (Bad file descriptor) [pid 5466] close(25) = -1 EBADF (Bad file descriptor) [pid 5466] close(26) = -1 EBADF (Bad file descriptor) [pid 5466] close(27) = -1 EBADF (Bad file descriptor) [pid 5466] close(28) = -1 EBADF (Bad file descriptor) [pid 5466] close(29) = -1 EBADF (Bad file descriptor) [pid 5466] exit_group(0) = ? [pid 5466] +++ exited with 0 +++ [pid 5089] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=19, si_uid=0, si_status=0, si_utime=0, si_stime=9 /* 0.09 s */} --- [ 145.418850][ T5470] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 145.426850][ T5470] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 145.434846][ T5470] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 145.442841][ T5470] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000010 [ 145.450862][ T5470] [pid 5089] umount2("./17", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [ 145.486929][ T5470] memory: usage 8kB, limit 0kB, failcnt 36 [ 145.500101][ T5470] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 145.511371][ T5470] Memory cgroup stats for /syz1: [ 145.511770][ T5470] anon 0 [ 145.511770][ T5470] file 0 [ 145.511770][ T5470] kernel 8192 [ 145.511770][ T5470] kernel_stack 0 [ 145.511770][ T5470] pagetables 0 [ 145.511770][ T5470] sec_pagetables 0 [ 145.511770][ T5470] percpu 0 [ 145.511770][ T5470] sock 0 [ 145.511770][ T5470] vmalloc 0 [ 145.511770][ T5470] shmem 0 [ 145.511770][ T5470] zswap 0 [ 145.511770][ T5470] zswapped 0 [ 145.511770][ T5470] file_mapped 0 [ 145.511770][ T5470] file_dirty 0 [ 145.511770][ T5470] file_writeback 0 [ 145.511770][ T5470] swapcached 0 [ 145.511770][ T5470] anon_thp 0 [ 145.511770][ T5470] file_thp 0 [ 145.511770][ T5470] shmem_thp 0 [ 145.511770][ T5470] inactive_anon 0 [ 145.511770][ T5470] active_anon 0 [ 145.511770][ T5470] inactive_file 0 [ 145.511770][ T5470] active_file 0 [ 145.511770][ T5470] unevictable 0 [ 145.511770][ T5470] slab_reclaimable 6752 [ 145.511770][ T5470] slab_unreclaimable 0 [ 145.511770][ T5470] slab 6752 [ 145.511770][ T5470] workingset_refault_anon 0 [ 145.511770][ T5470] workingset_refault_file 0 [ 145.511770][ T5470] workingset_activate_anon 0 [ 145.511770][ T5470] workingset_activate_file 0 [ 145.511770][ T5470] workingset_restore_anon 0 [ 145.511770][ T5470] workingset_restore_file 0 [ 145.511770][ T5470] workingset_nodereclaim 0 [ 145.511770][ T5470] pgscan 831 [pid 5089] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [ 145.511770][ T5470] pgsteal 2 [ 145.511770][ T5470] pgscan_kswapd 0 [ 145.511770][ T5470] pgscan_direct 831 [ 145.511770][ T5470] pgscan_khugepaged 0 [ 145.511770][ T5470] pgsteal_kswapd 0 [ 145.511770][ T5470] pgsteal_direct 2 [ 145.511770][ T5470] pgsteal_khugepaged 0 [ 145.511770][ T5470] pgfault 21 [ 145.511770][ T5470] pgmajfault 0 [ 145.511770][ T5470] pgrefill 830 [ 145.511770][ T5470] pgactivate 829 [ 145.511770][ T5470] pgdeactivate 830 [ 145.511770][ T5470] pglazyfree 0 [ 145.511770][ T5470] pglazyfreed 0 [ 145.511770][ T5470] zswpin 0 [pid 5089] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5089] umount2("./17/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./17/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5089] unlink("./17/binderfs") = 0 [pid 5089] umount2("./17/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./17/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5089] unlink("./17/cgroup") = 0 [pid 5089] umount2("./17/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./17/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5089] unlink("./17/cgroup.net") = 0 [pid 5089] umount2("./17/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5089] umount2("./17/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./17/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5089] umount2("./17/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] openat(AT_FDCWD, "./17/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5089] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5089] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5089] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5089] close(4) = 0 [pid 5089] rmdir("./17/file0") = 0 [pid 5089] umount2("./17/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 145.511770][ T5470] zswpout 0 [ 145.511770][ T5470] thp_fault_alloc 0 [ 145.511770][ T5470] thp_collapse_alloc 0 [ 145.719242][ T5470] Tasks state (memory values in pages): [pid 5089] lstat("./17/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5089] unlink("./17/cgroup.cpu") = 0 [pid 5089] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5089] close(3) = 0 [pid 5089] rmdir("./17") = 0 [pid 5089] mkdir("./18", 0777) = 0 [pid 5089] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555c0c5d0) = 20 ./strace-static-x86_64: Process 5488 attached [pid 5488] chdir("./18") = 0 [pid 5488] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5488] setpgid(0, 0) = 0 [pid 5488] symlink("/syzcgroup/unified/syz5", "./cgroup" [pid 5470] <... write resumed>) = 18 [ 145.740915][ T5470] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 145.757575][ T5470] Out of memory and no killable processes... [ 145.769251][ T5475] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 145.785829][ T5475] CPU: 0 PID: 5475 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 145.795811][ T5475] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 145.806010][ T5475] Call Trace: [ 145.809336][ T5475] [ 145.812311][ T5475] dump_stack_lvl+0x136/0x150 [ 145.817064][ T5475] dump_header+0x10a/0xd70 [ 145.821559][ T5475] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 145.827723][ T5475] out_of_memory+0xd64/0x1660 [ 145.832494][ T5475] ? oom_killer_disable+0x2b0/0x2b0 [pid 5488] <... symlink resumed>) = 0 [pid 5488] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [pid 5488] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 5488] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5488] write(3, "1000", 4) = 4 [ 145.837789][ T5475] mem_cgroup_out_of_memory+0x206/0x270 [ 145.843419][ T5475] ? mem_cgroup_margin+0x130/0x130 [ 145.848636][ T5475] memory_max_write+0x2f9/0x3c0 [ 145.853571][ T5475] ? mem_cgroup_force_empty_write+0x160/0x160 [ 145.859730][ T5475] ? lock_sync+0x190/0x190 [ 145.864230][ T5475] cgroup_file_write+0x1e2/0x7b0 [ 145.869263][ T5475] ? mem_cgroup_force_empty_write+0x160/0x160 [ 145.875415][ T5475] ? kill_css+0x3b0/0x3b0 [ 145.879827][ T5475] ? lock_acquire+0x32/0xc0 [ 145.884411][ T5475] ? kill_css+0x3b0/0x3b0 [pid 5488] close(3) = 0 [pid 5488] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5488] mkdir("./file0", 000) = 0 [pid 5488] open("./file0", O_RDONLY) = 3 [pid 5488] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [ 145.888830][ T5475] kernfs_fop_write_iter+0x3f1/0x600 [ 145.894292][ T5475] vfs_write+0x9ed/0xe10 [ 145.898630][ T5475] ? kernel_write+0x670/0x670 [ 145.903404][ T5475] ? find_held_lock+0x2d/0x110 [ 145.908252][ T5475] ? __fget_light+0x20a/0x270 [ 145.913016][ T5475] ksys_write+0x12b/0x250 [ 145.917437][ T5475] ? __ia32_sys_read+0xb0/0xb0 [ 145.922293][ T5475] ? lockdep_hardirqs_on+0x7d/0x100 [ 145.927553][ T5475] ? _raw_spin_unlock_irq+0x2e/0x50 [ 145.932824][ T5475] ? ptrace_notify+0xfe/0x140 [ 145.937580][ T5475] do_syscall_64+0x39/0xb0 [pid 5488] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5488] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5488] openat(5, "memory.max", O_RDWR) = 6 [ 145.942091][ T5475] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 145.948083][ T5475] RIP: 0033:0x7faecf034129 [ 145.952554][ T5475] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 145.972253][ T5475] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 145.980739][ T5475] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [pid 5488] write(6, "0x000000000000040e", 18 [pid 5470] close(3) = 0 [pid 5470] close(4) = 0 [pid 5470] close(5) = 0 [pid 5470] close(6) = 0 [pid 5470] close(7) = -1 EBADF (Bad file descriptor) [pid 5470] close(8) = -1 EBADF (Bad file descriptor) [pid 5470] close(9) = -1 EBADF (Bad file descriptor) [pid 5470] close(10) = -1 EBADF (Bad file descriptor) [pid 5470] close(11) = -1 EBADF (Bad file descriptor) [pid 5470] close(12) = -1 EBADF (Bad file descriptor) [pid 5470] close(13) = -1 EBADF (Bad file descriptor) [pid 5470] close(14) = -1 EBADF (Bad file descriptor) [pid 5470] close(15) = -1 EBADF (Bad file descriptor) [pid 5470] close(16) = -1 EBADF (Bad file descriptor) [pid 5470] close(17) = -1 EBADF (Bad file descriptor) [pid 5470] close(18) = -1 EBADF (Bad file descriptor) [pid 5470] close(19) = -1 EBADF (Bad file descriptor) [pid 5470] close(20) = -1 EBADF (Bad file descriptor) [pid 5470] close(21) = -1 EBADF (Bad file descriptor) [pid 5470] close(22) = -1 EBADF (Bad file descriptor) [pid 5470] close(23) = -1 EBADF (Bad file descriptor) [pid 5470] close(24) = -1 EBADF (Bad file descriptor) [pid 5470] close(25) = -1 EBADF (Bad file descriptor) [pid 5470] close(26) = -1 EBADF (Bad file descriptor) [pid 5470] close(27) = -1 EBADF (Bad file descriptor) [pid 5470] close(28) = -1 EBADF (Bad file descriptor) [pid 5470] close(29) = -1 EBADF (Bad file descriptor) [pid 5470] exit_group(0) = ? [pid 5470] +++ exited with 0 +++ [pid 5087] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=18, si_uid=0, si_status=0, si_utime=0, si_stime=10 /* 0.10 s */} --- [pid 5087] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5087] umount2("./16", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5087] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5087] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5087] umount2("./16/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./16/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5087] unlink("./16/binderfs") = 0 [pid 5087] umount2("./16/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./16/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5087] unlink("./16/cgroup") = 0 [pid 5087] umount2("./16/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./16/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5087] unlink("./16/cgroup.net") = 0 [ 145.988774][ T5475] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 145.996812][ T5475] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 146.004844][ T5475] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 146.012878][ T5475] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 000000000000000e [ 146.020940][ T5475] [ 146.046545][ T5475] memory: usage 8kB, limit 0kB, failcnt 36 [ 146.053154][ T5475] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 146.060070][ T5475] Memory cgroup stats for /syz1: [ 146.060378][ T5475] anon 0 [ 146.060378][ T5475] file 0 [ 146.060378][ T5475] kernel 8192 [ 146.060378][ T5475] kernel_stack 0 [ 146.060378][ T5475] pagetables 0 [ 146.060378][ T5475] sec_pagetables 0 [ 146.060378][ T5475] percpu 0 [ 146.060378][ T5475] sock 0 [ 146.060378][ T5475] vmalloc 0 [ 146.060378][ T5475] shmem 0 [ 146.060378][ T5475] zswap 0 [ 146.060378][ T5475] zswapped 0 [ 146.060378][ T5475] file_mapped 0 [ 146.060378][ T5475] file_dirty 0 [ 146.060378][ T5475] file_writeback 0 [ 146.060378][ T5475] swapcached 0 [ 146.060378][ T5475] anon_thp 0 [ 146.060378][ T5475] file_thp 0 [ 146.060378][ T5475] shmem_thp 0 [ 146.060378][ T5475] inactive_anon 0 [ 146.060378][ T5475] active_anon 0 [ 146.060378][ T5475] inactive_file 0 [ 146.060378][ T5475] active_file 0 [ 146.060378][ T5475] unevictable 0 [ 146.060378][ T5475] slab_reclaimable 6752 [ 146.060378][ T5475] slab_unreclaimable 0 [ 146.060378][ T5475] slab 6752 [ 146.060378][ T5475] workingset_refault_anon 0 [ 146.060378][ T5475] workingset_refault_file 0 [ 146.060378][ T5475] workingset_activate_anon 0 [ 146.060378][ T5475] workingset_activate_file 0 [ 146.060378][ T5475] workingset_restore_anon 0 [ 146.060378][ T5475] workingset_restore_file 0 [ 146.060378][ T5475] workingset_nodereclaim 0 [ 146.060378][ T5475] pgscan 831 [ 146.060378][ T5475] pgsteal 2 [ 146.060378][ T5475] pgscan_kswapd 0 [ 146.060378][ T5475] pgscan_direct 831 [pid 5087] umount2("./16/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5087] umount2("./16/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./16/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5087] umount2("./16/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] openat(AT_FDCWD, "./16/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5087] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5087] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5087] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5087] close(4) = 0 [pid 5087] rmdir("./16/file0") = 0 [pid 5087] umount2("./16/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./16/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5087] unlink("./16/cgroup.cpu") = 0 [ 146.060378][ T5475] pgscan_khugepaged 0 [ 146.060378][ T5475] pgsteal_kswapd 0 [ 146.060378][ T5475] pgsteal_direct 2 [ 146.060378][ T5475] pgsteal_khugepaged 0 [ 146.060378][ T5475] pgfault 21 [ 146.060378][ T5475] pgmajfault 0 [ 146.060378][ T5475] pgrefill 830 [ 146.060378][ T5475] pgactivate 829 [ 146.060378][ T5475] pgdeactivate 830 [ 146.060378][ T5475] pglazyfree 0 [ 146.060378][ T5475] pglazyfreed 0 [ 146.060378][ T5475] zswpin 0 [ 146.060378][ T5475] zswpout 0 [ 146.060378][ T5475] thp_fault_alloc 0 [ 146.060378][ T5475] thp_collapse_alloc 0 [pid 5087] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5087] close(3) = 0 [pid 5087] rmdir("./16") = 0 [pid 5087] mkdir("./17", 0777) = 0 [pid 5087] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5494 attached [pid 5494] chdir("./17" [pid 5087] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 19 [pid 5494] <... chdir resumed>) = 0 [pid 5494] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5494] setpgid(0, 0) = 0 [pid 5494] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 5494] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 5494] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 5494] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5494] write(3, "1000", 4) = 4 [pid 5494] close(3) = 0 [pid 5494] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5494] mkdir("./file0", 000) = 0 [pid 5494] open("./file0", O_RDONLY) = 3 [pid 5494] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5494] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5494] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5494] openat(5, "memory.max", O_RDWR) = 6 [pid 5494] write(6, "0x000000000000040e", 18 [pid 5475] <... write resumed>) = 18 [pid 5475] close(3) = 0 [pid 5475] close(4) = 0 [pid 5475] close(5) = 0 [pid 5475] close(6) = 0 [pid 5475] close(7) = -1 EBADF (Bad file descriptor) [pid 5475] close(8) = -1 EBADF (Bad file descriptor) [pid 5475] close(9) = -1 EBADF (Bad file descriptor) [pid 5475] close(10) = -1 EBADF (Bad file descriptor) [pid 5475] close(11) = -1 EBADF (Bad file descriptor) [ 146.367213][ T5475] Tasks state (memory values in pages): [ 146.375060][ T5475] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 146.387258][ T5475] Out of memory and no killable processes... [ 146.395860][ T5477] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 146.430728][ T5477] CPU: 1 PID: 5477 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 146.440725][ T5477] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 146.450836][ T5477] Call Trace: [ 146.454167][ T5477] [ 146.457135][ T5477] dump_stack_lvl+0x136/0x150 [ 146.461894][ T5477] dump_header+0x10a/0xd70 [ 146.466366][ T5477] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 146.472527][ T5477] out_of_memory+0xd64/0x1660 [ 146.477285][ T5477] ? oom_killer_disable+0x2b0/0x2b0 [ 146.482567][ T5477] mem_cgroup_out_of_memory+0x206/0x270 [ 146.488198][ T5477] ? mem_cgroup_margin+0x130/0x130 [ 146.493407][ T5477] memory_max_write+0x2f9/0x3c0 [ 146.498348][ T5477] ? mem_cgroup_force_empty_write+0x160/0x160 [ 146.504504][ T5477] ? lock_sync+0x190/0x190 [ 146.508992][ T5477] cgroup_file_write+0x1e2/0x7b0 [ 146.514011][ T5477] ? mem_cgroup_force_empty_write+0x160/0x160 [ 146.520157][ T5477] ? kill_css+0x3b0/0x3b0 [ 146.524554][ T5477] ? lock_acquire+0x32/0xc0 [ 146.529113][ T5477] ? kill_css+0x3b0/0x3b0 [ 146.533491][ T5477] kernfs_fop_write_iter+0x3f1/0x600 [ 146.538825][ T5477] vfs_write+0x9ed/0xe10 [ 146.543131][ T5477] ? kernel_write+0x670/0x670 [ 146.547862][ T5477] ? find_held_lock+0x2d/0x110 [ 146.552686][ T5477] ? __fget_light+0x20a/0x270 [ 146.557413][ T5477] ksys_write+0x12b/0x250 [ 146.561794][ T5477] ? __ia32_sys_read+0xb0/0xb0 [ 146.566596][ T5477] ? lockdep_hardirqs_on+0x7d/0x100 [ 146.571834][ T5477] ? _raw_spin_unlock_irq+0x2e/0x50 [ 146.577093][ T5477] ? ptrace_notify+0xfe/0x140 [ 146.581828][ T5477] do_syscall_64+0x39/0xb0 [ 146.586296][ T5477] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 146.592227][ T5477] RIP: 0033:0x7faecf034129 [ 146.596669][ T5477] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 146.616305][ T5477] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 146.624755][ T5477] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 146.632752][ T5477] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 146.640752][ T5477] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 146.648748][ T5477] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 146.656744][ T5477] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000012 [ 146.664760][ T5477] [pid 5475] close(12) = -1 EBADF (Bad file descriptor) [pid 5475] close(13) = -1 EBADF (Bad file descriptor) [pid 5475] close(14) = -1 EBADF (Bad file descriptor) [pid 5475] close(15) = -1 EBADF (Bad file descriptor) [pid 5475] close(16) = -1 EBADF (Bad file descriptor) [pid 5475] close(17) = -1 EBADF (Bad file descriptor) [pid 5475] close(18) = -1 EBADF (Bad file descriptor) [pid 5475] close(19) = -1 EBADF (Bad file descriptor) [pid 5475] close(20) = -1 EBADF (Bad file descriptor) [pid 5475] close(21) = -1 EBADF (Bad file descriptor) [pid 5475] close(22) = -1 EBADF (Bad file descriptor) [pid 5475] close(23) = -1 EBADF (Bad file descriptor) [pid 5475] close(24) = -1 EBADF (Bad file descriptor) [pid 5475] close(25) = -1 EBADF (Bad file descriptor) [pid 5475] close(26) = -1 EBADF (Bad file descriptor) [pid 5475] close(27) = -1 EBADF (Bad file descriptor) [pid 5475] close(28) = -1 EBADF (Bad file descriptor) [pid 5475] close(29) = -1 EBADF (Bad file descriptor) [pid 5475] exit_group(0) = ? [pid 5475] +++ exited with 0 +++ [pid 5085] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=16, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- [pid 5085] restart_syscall(<... resuming interrupted clone ...>) = 0 [ 146.681827][ T5477] memory: usage 8kB, limit 0kB, failcnt 36 [ 146.688509][ T5477] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 146.711840][ T5477] Memory cgroup stats for /syz1: [ 146.712263][ T5477] anon 0 [ 146.712263][ T5477] file 0 [ 146.712263][ T5477] kernel 8192 [ 146.712263][ T5477] kernel_stack 0 [pid 5085] umount2("./14", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5085] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5085] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5085] umount2("./14/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./14/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5085] unlink("./14/binderfs") = 0 [pid 5085] umount2("./14/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./14/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5085] unlink("./14/cgroup") = 0 [ 146.712263][ T5477] pagetables 0 [ 146.712263][ T5477] sec_pagetables 0 [ 146.712263][ T5477] percpu 0 [ 146.712263][ T5477] sock 0 [ 146.712263][ T5477] vmalloc 0 [ 146.712263][ T5477] shmem 0 [ 146.712263][ T5477] zswap 0 [ 146.712263][ T5477] zswapped 0 [ 146.712263][ T5477] file_mapped 0 [ 146.712263][ T5477] file_dirty 0 [ 146.712263][ T5477] file_writeback 0 [ 146.712263][ T5477] swapcached 0 [ 146.712263][ T5477] anon_thp 0 [ 146.712263][ T5477] file_thp 0 [ 146.712263][ T5477] shmem_thp 0 [ 146.712263][ T5477] inactive_anon 0 [ 146.712263][ T5477] active_anon 0 [ 146.712263][ T5477] inactive_file 0 [ 146.712263][ T5477] active_file 0 [ 146.712263][ T5477] unevictable 0 [ 146.712263][ T5477] slab_reclaimable 6752 [ 146.712263][ T5477] slab_unreclaimable 0 [ 146.712263][ T5477] slab 6752 [ 146.712263][ T5477] workingset_refault_anon 0 [ 146.712263][ T5477] workingset_refault_file 0 [ 146.712263][ T5477] workingset_activate_anon 0 [ 146.712263][ T5477] workingset_activate_file 0 [ 146.712263][ T5477] workingset_restore_anon 0 [ 146.712263][ T5477] workingset_restore_file 0 [ 146.712263][ T5477] workingset_nodereclaim 0 [ 146.712263][ T5477] pgscan 831 [ 146.712263][ T5477] pgsteal 2 [ 146.712263][ T5477] pgscan_kswapd 0 [ 146.712263][ T5477] pgscan_direct 831 [ 146.712263][ T5477] pgscan_khugepaged 0 [ 146.712263][ T5477] pgsteal_kswapd 0 [ 146.712263][ T5477] pgsteal_direct 2 [ 146.712263][ T5477] pgsteal_khugepaged 0 [ 146.712263][ T5477] pgfault 21 [ 146.712263][ T5477] pgmajfault 0 [ 146.712263][ T5477] pgrefill 830 [ 146.712263][ T5477] pgactivate 829 [ 146.712263][ T5477] pgdeactivate 830 [ 146.712263][ T5477] pglazyfree 0 [pid 5085] umount2("./14/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./14/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5085] unlink("./14/cgroup.net") = 0 [pid 5085] umount2("./14/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5085] umount2("./14/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./14/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5085] umount2("./14/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] openat(AT_FDCWD, "./14/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5085] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5085] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5085] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5085] close(4) = 0 [pid 5085] rmdir("./14/file0") = 0 [pid 5085] umount2("./14/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./14/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5085] unlink("./14/cgroup.cpu") = 0 [pid 5085] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5085] close(3) = 0 [pid 5085] rmdir("./14") = 0 [pid 5085] mkdir("./15", 0777) = 0 [pid 5085] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5498 attached [pid 5498] chdir("./15" [pid 5085] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 17 [pid 5498] <... chdir resumed>) = 0 [pid 5498] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5498] setpgid(0, 0) = 0 [pid 5498] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 5498] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [ 146.712263][ T5477] pglazyfreed 0 [ 146.712263][ T5477] zswpin 0 [ 146.712263][ T5477] zswpout 0 [ 146.712263][ T5477] thp_fault_alloc 0 [ 146.712263][ T5477] thp_collapse_alloc 0 [pid 5498] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 5498] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5498] write(3, "1000", 4) = 4 [pid 5498] close(3) = 0 [pid 5498] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5498] mkdir("./file0", 000) = 0 [pid 5498] open("./file0", O_RDONLY) = 3 [pid 5498] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5498] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5498] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5498] openat(5, "memory.max", O_RDWR) = 6 [ 147.001428][ T5477] Tasks state (memory values in pages): [ 147.011471][ T5477] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 147.037652][ T5477] Out of memory and no killable processes... [pid 5498] write(6, "0x000000000000040e", 18 [pid 5477] <... write resumed>) = 18 [pid 5477] close(3) = 0 [pid 5477] close(4) = 0 [pid 5477] close(5) = 0 [pid 5477] close(6) = 0 [pid 5477] close(7) = -1 EBADF (Bad file descriptor) [ 147.046000][ T5481] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5477] close(8) = -1 EBADF (Bad file descriptor) [pid 5477] close(9) = -1 EBADF (Bad file descriptor) [pid 5477] close(10) = -1 EBADF (Bad file descriptor) [pid 5477] close(11) = -1 EBADF (Bad file descriptor) [pid 5477] close(12) = -1 EBADF (Bad file descriptor) [pid 5477] close(13) = -1 EBADF (Bad file descriptor) [pid 5477] close(14) = -1 EBADF (Bad file descriptor) [pid 5477] close(15) = -1 EBADF (Bad file descriptor) [pid 5477] close(16) = -1 EBADF (Bad file descriptor) [pid 5477] close(17) = -1 EBADF (Bad file descriptor) [pid 5477] close(18) = -1 EBADF (Bad file descriptor) [pid 5477] close(19) = -1 EBADF (Bad file descriptor) [pid 5477] close(20) = -1 EBADF (Bad file descriptor) [ 147.072083][ T5481] CPU: 0 PID: 5481 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 147.082093][ T5481] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 147.092216][ T5481] Call Trace: [ 147.095548][ T5481] [ 147.098527][ T5481] dump_stack_lvl+0x136/0x150 [ 147.103300][ T5481] dump_header+0x10a/0xd70 [ 147.107791][ T5481] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 147.113980][ T5481] out_of_memory+0xd64/0x1660 [pid 5477] close(21) = -1 EBADF (Bad file descriptor) [pid 5477] close(22) = -1 EBADF (Bad file descriptor) [pid 5477] close(23) = -1 EBADF (Bad file descriptor) [pid 5477] close(24) = -1 EBADF (Bad file descriptor) [pid 5477] close(25) = -1 EBADF (Bad file descriptor) [pid 5477] close(26) = -1 EBADF (Bad file descriptor) [pid 5477] close(27) = -1 EBADF (Bad file descriptor) [pid 5477] close(28) = -1 EBADF (Bad file descriptor) [pid 5477] close(29) = -1 EBADF (Bad file descriptor) [ 147.118743][ T5481] ? oom_killer_disable+0x2b0/0x2b0 [ 147.124036][ T5481] mem_cgroup_out_of_memory+0x206/0x270 [ 147.129666][ T5481] ? mem_cgroup_margin+0x130/0x130 [ 147.134878][ T5481] memory_max_write+0x2f9/0x3c0 [ 147.139813][ T5481] ? mem_cgroup_force_empty_write+0x160/0x160 [ 147.145986][ T5481] ? lock_sync+0x190/0x190 [ 147.150479][ T5481] cgroup_file_write+0x1e2/0x7b0 [ 147.155496][ T5481] ? mem_cgroup_force_empty_write+0x160/0x160 [ 147.161661][ T5481] ? kill_css+0x3b0/0x3b0 [ 147.166084][ T5481] ? lock_acquire+0x32/0xc0 [ 147.170669][ T5481] ? kill_css+0x3b0/0x3b0 [ 147.175070][ T5481] kernfs_fop_write_iter+0x3f1/0x600 [ 147.180445][ T5481] vfs_write+0x9ed/0xe10 [ 147.184775][ T5481] ? kernel_write+0x670/0x670 [ 147.189546][ T5481] ? find_held_lock+0x2d/0x110 [ 147.194384][ T5481] ? __fget_light+0x20a/0x270 [ 147.199204][ T5481] ksys_write+0x12b/0x250 [ 147.203599][ T5481] ? __ia32_sys_read+0xb0/0xb0 [ 147.208412][ T5481] ? lockdep_hardirqs_on+0x7d/0x100 [ 147.213650][ T5481] ? _raw_spin_unlock_irq+0x2e/0x50 [ 147.218893][ T5481] ? ptrace_notify+0xfe/0x140 [ 147.223611][ T5481] do_syscall_64+0x39/0xb0 [ 147.228075][ T5481] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 147.234011][ T5481] RIP: 0033:0x7faecf034129 [ 147.238453][ T5481] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 147.258106][ T5481] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 5477] exit_group(0) = ? [pid 5477] +++ exited with 0 +++ [pid 5090] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=20, si_uid=0, si_status=0, si_utime=0, si_stime=10 /* 0.10 s */} --- [pid 5090] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5090] umount2("./18", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5090] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5090] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5090] umount2("./18/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./18/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5090] unlink("./18/binderfs") = 0 [pid 5090] umount2("./18/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./18/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5090] unlink("./18/cgroup") = 0 [pid 5090] umount2("./18/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./18/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5090] unlink("./18/cgroup.net") = 0 [ 147.266553][ T5481] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 147.274555][ T5481] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 147.282551][ T5481] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 147.290548][ T5481] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 147.298543][ T5481] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 000000000000000f [ 147.306564][ T5481] [ 147.315060][ T5481] memory: usage 8kB, limit 0kB, failcnt 36 [pid 5090] umount2("./18/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5090] umount2("./18/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./18/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5090] umount2("./18/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] openat(AT_FDCWD, "./18/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5090] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5090] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5090] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5090] close(4) = 0 [pid 5090] rmdir("./18/file0") = 0 [pid 5090] umount2("./18/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./18/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5090] unlink("./18/cgroup.cpu") = 0 [ 147.320955][ T5481] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 147.328152][ T5481] Memory cgroup stats for /syz1: [ 147.328435][ T5481] anon 0 [ 147.328435][ T5481] file 0 [ 147.328435][ T5481] kernel 8192 [ 147.328435][ T5481] kernel_stack 0 [ 147.328435][ T5481] pagetables 0 [ 147.328435][ T5481] sec_pagetables 0 [ 147.328435][ T5481] percpu 0 [ 147.328435][ T5481] sock 0 [ 147.328435][ T5481] vmalloc 0 [ 147.328435][ T5481] shmem 0 [ 147.328435][ T5481] zswap 0 [ 147.328435][ T5481] zswapped 0 [ 147.328435][ T5481] file_mapped 0 [pid 5090] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5090] close(3) = 0 [pid 5090] rmdir("./18") = 0 [pid 5090] mkdir("./19", 0777) = 0 [pid 5090] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5503 attached [pid 5503] chdir("./19" [pid 5090] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 21 [pid 5503] <... chdir resumed>) = 0 [pid 5503] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5503] setpgid(0, 0) = 0 [pid 5503] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 5503] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 5503] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [pid 5503] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5503] write(3, "1000", 4) = 4 [pid 5503] close(3) = 0 [pid 5503] symlink("/dev/binderfs", "./binderfs") = 0 [ 147.328435][ T5481] file_dirty 0 [ 147.328435][ T5481] file_writeback 0 [ 147.328435][ T5481] swapcached 0 [ 147.328435][ T5481] anon_thp 0 [ 147.328435][ T5481] file_thp 0 [ 147.328435][ T5481] shmem_thp 0 [ 147.328435][ T5481] inactive_anon 0 [ 147.328435][ T5481] active_anon 0 [ 147.328435][ T5481] inactive_file 0 [ 147.328435][ T5481] active_file 0 [ 147.328435][ T5481] unevictable 0 [ 147.328435][ T5481] slab_reclaimable 6752 [ 147.328435][ T5481] slab_unreclaimable 0 [ 147.328435][ T5481] slab 6752 [pid 5503] mkdir("./file0", 000) = 0 [pid 5503] open("./file0", O_RDONLY) = 3 [pid 5503] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5503] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5503] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5503] openat(5, "memory.max", O_RDWR) = 6 [ 147.328435][ T5481] workingset_refault_anon 0 [ 147.328435][ T5481] workingset_refault_file 0 [ 147.328435][ T5481] workingset_activate_anon 0 [ 147.328435][ T5481] workingset_activate_file 0 [ 147.328435][ T5481] workingset_restore_anon 0 [ 147.328435][ T5481] workingset_restore_file 0 [ 147.328435][ T5481] workingset_nodereclaim 0 [ 147.328435][ T5481] pgscan 831 [ 147.328435][ T5481] pgsteal 2 [ 147.328435][ T5481] pgscan_kswapd 0 [ 147.328435][ T5481] pgscan_direct 831 [ 147.328435][ T5481] pgscan_khugepaged 0 [ 147.328435][ T5481] pgsteal_kswapd 0 [ 147.328435][ T5481] pgsteal_direct 2 [ 147.328435][ T5481] pgsteal_khugepaged 0 [ 147.328435][ T5481] pgfault 21 [ 147.328435][ T5481] pgmajfault 0 [ 147.328435][ T5481] pgrefill 830 [ 147.328435][ T5481] pgactivate 829 [ 147.328435][ T5481] pgdeactivate 830 [ 147.328435][ T5481] pglazyfree 0 [ 147.328435][ T5481] pglazyfreed 0 [ 147.328435][ T5481] zswpin 0 [ 147.328435][ T5481] zswpout 0 [ 147.328435][ T5481] thp_fault_alloc 0 [ 147.328435][ T5481] thp_collapse_alloc 0 [ 147.535328][ T5481] Tasks state (memory values in pages): [ 147.553736][ T5481] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5503] write(6, "0x000000000000040e", 18 [pid 5481] <... write resumed>) = 18 [ 147.580959][ T5481] Out of memory and no killable processes... [ 147.602240][ T5488] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 147.613304][ T5488] CPU: 1 PID: 5488 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 147.623286][ T5488] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [pid 5481] close(3) = 0 [pid 5481] close(4) = 0 [pid 5481] close(5) = 0 [pid 5481] close(6) = 0 [pid 5481] close(7) = -1 EBADF (Bad file descriptor) [pid 5481] close(8) = -1 EBADF (Bad file descriptor) [pid 5481] close(9) = -1 EBADF (Bad file descriptor) [pid 5481] close(10) = -1 EBADF (Bad file descriptor) [pid 5481] close(11) = -1 EBADF (Bad file descriptor) [pid 5481] close(12) = -1 EBADF (Bad file descriptor) [pid 5481] close(13) = -1 EBADF (Bad file descriptor) [pid 5481] close(14) = -1 EBADF (Bad file descriptor) [pid 5481] close(15) = -1 EBADF (Bad file descriptor) [ 147.633412][ T5488] Call Trace: [ 147.636733][ T5488] [ 147.639705][ T5488] dump_stack_lvl+0x136/0x150 [ 147.644460][ T5488] dump_header+0x10a/0xd70 [ 147.648953][ T5488] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 147.655127][ T5488] out_of_memory+0xd64/0x1660 [ 147.659909][ T5488] ? oom_killer_disable+0x2b0/0x2b0 [ 147.665199][ T5488] ? find_held_lock+0x2d/0x110 [ 147.670071][ T5488] mem_cgroup_out_of_memory+0x206/0x270 [ 147.675691][ T5488] ? mem_cgroup_margin+0x130/0x130 [ 147.680856][ T5488] ? _raw_spin_unlock_irqrestore+0x54/0x70 [ 147.686722][ T5488] memory_max_write+0x2f9/0x3c0 [ 147.691637][ T5488] ? mem_cgroup_force_empty_write+0x160/0x160 [ 147.697752][ T5488] ? lock_sync+0x190/0x190 [ 147.702216][ T5488] cgroup_file_write+0x1e2/0x7b0 [ 147.707197][ T5488] ? mem_cgroup_force_empty_write+0x160/0x160 [ 147.713306][ T5488] ? kill_css+0x3b0/0x3b0 [ 147.717682][ T5488] ? lock_acquire+0x32/0xc0 [ 147.722240][ T5488] ? kill_css+0x3b0/0x3b0 [ 147.726613][ T5488] kernfs_fop_write_iter+0x3f1/0x600 [ 147.731948][ T5488] vfs_write+0x9ed/0xe10 [ 147.736252][ T5488] ? kernel_write+0x670/0x670 [ 147.740974][ T5488] ? find_held_lock+0x2d/0x110 [ 147.745778][ T5488] ? __fget_light+0x20a/0x270 [ 147.750502][ T5488] ksys_write+0x12b/0x250 [ 147.754873][ T5488] ? __ia32_sys_read+0xb0/0xb0 [ 147.759683][ T5488] ? lockdep_hardirqs_on+0x7d/0x100 [ 147.765024][ T5488] ? _raw_spin_unlock_irq+0x2e/0x50 [ 147.770299][ T5488] ? ptrace_notify+0xfe/0x140 [ 147.775050][ T5488] do_syscall_64+0x39/0xb0 [ 147.779527][ T5488] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 147.785464][ T5488] RIP: 0033:0x7faecf034129 [ 147.789905][ T5488] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 147.809544][ T5488] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 147.817987][ T5488] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 147.825983][ T5488] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [pid 5481] close(16) = -1 EBADF (Bad file descriptor) [pid 5481] close(17) = -1 EBADF (Bad file descriptor) [pid 5481] close(18) = -1 EBADF (Bad file descriptor) [pid 5481] close(19) = -1 EBADF (Bad file descriptor) [pid 5481] close(20) = -1 EBADF (Bad file descriptor) [pid 5481] close(21) = -1 EBADF (Bad file descriptor) [pid 5481] close(22) = -1 EBADF (Bad file descriptor) [pid 5481] close(23) = -1 EBADF (Bad file descriptor) [pid 5481] close(24) = -1 EBADF (Bad file descriptor) [pid 5481] close(25) = -1 EBADF (Bad file descriptor) [pid 5481] close(26) = -1 EBADF (Bad file descriptor) [pid 5481] close(27) = -1 EBADF (Bad file descriptor) [ 147.833979][ T5488] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 147.841987][ T5488] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 147.849983][ T5488] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000012 [ 147.858014][ T5488] [pid 5481] close(28) = -1 EBADF (Bad file descriptor) [pid 5481] close(29) = -1 EBADF (Bad file descriptor) [pid 5481] exit_group(0) = ? [pid 5481] +++ exited with 0 +++ [pid 5086] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=17, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- [pid 5086] umount2("./15", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5086] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5086] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5086] umount2("./15/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./15/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5086] unlink("./15/binderfs") = 0 [pid 5086] umount2("./15/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./15/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5086] unlink("./15/cgroup") = 0 [pid 5086] umount2("./15/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./15/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [ 147.904584][ T5488] memory: usage 8kB, limit 0kB, failcnt 36 [ 147.911847][ T5488] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 147.945479][ T5488] Memory cgroup stats for /syz1: [ 147.945771][ T5488] anon 0 [ 147.945771][ T5488] file 0 [ 147.945771][ T5488] kernel 8192 [ 147.945771][ T5488] kernel_stack 0 [ 147.945771][ T5488] pagetables 0 [ 147.945771][ T5488] sec_pagetables 0 [ 147.945771][ T5488] percpu 0 [ 147.945771][ T5488] sock 0 [ 147.945771][ T5488] vmalloc 0 [ 147.945771][ T5488] shmem 0 [ 147.945771][ T5488] zswap 0 [ 147.945771][ T5488] zswapped 0 [ 147.945771][ T5488] file_mapped 0 [ 147.945771][ T5488] file_dirty 0 [ 147.945771][ T5488] file_writeback 0 [ 147.945771][ T5488] swapcached 0 [ 147.945771][ T5488] anon_thp 0 [ 147.945771][ T5488] file_thp 0 [ 147.945771][ T5488] shmem_thp 0 [ 147.945771][ T5488] inactive_anon 0 [ 147.945771][ T5488] active_anon 0 [ 147.945771][ T5488] inactive_file 0 [ 147.945771][ T5488] active_file 0 [ 147.945771][ T5488] unevictable 0 [ 147.945771][ T5488] slab_reclaimable 6752 [ 147.945771][ T5488] slab_unreclaimable 0 [ 147.945771][ T5488] slab 6752 [ 147.945771][ T5488] workingset_refault_anon 0 [ 147.945771][ T5488] workingset_refault_file 0 [ 147.945771][ T5488] workingset_activate_anon 0 [ 147.945771][ T5488] workingset_activate_file 0 [ 147.945771][ T5488] workingset_restore_anon 0 [ 147.945771][ T5488] workingset_restore_file 0 [ 147.945771][ T5488] workingset_nodereclaim 0 [ 147.945771][ T5488] pgscan 831 [ 147.945771][ T5488] pgsteal 2 [ 147.945771][ T5488] pgscan_kswapd 0 [ 147.945771][ T5488] pgscan_direct 831 [ 147.945771][ T5488] pgscan_khugepaged 0 [ 147.945771][ T5488] pgsteal_kswapd 0 [ 147.945771][ T5488] pgsteal_direct 2 [ 147.945771][ T5488] pgsteal_khugepaged 0 [pid 5086] unlink("./15/cgroup.net") = 0 [pid 5086] umount2("./15/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5086] umount2("./15/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./15/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5086] umount2("./15/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] openat(AT_FDCWD, "./15/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5086] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5086] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [ 147.945771][ T5488] pgfault 21 [ 147.945771][ T5488] pgmajfault 0 [ 147.945771][ T5488] pgrefill 830 [ 147.945771][ T5488] pgactivate 829 [ 147.945771][ T5488] pgdeactivate 830 [ 147.945771][ T5488] pglazyfree 0 [ 147.945771][ T5488] pglazyfreed 0 [ 147.945771][ T5488] zswpin 0 [ 147.945771][ T5488] zswpout 0 [ 147.945771][ T5488] thp_fault_alloc 0 [ 147.945771][ T5488] thp_collapse_alloc 0 [pid 5086] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5086] close(4) = 0 [pid 5086] rmdir("./15/file0") = 0 [pid 5086] umount2("./15/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./15/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5086] unlink("./15/cgroup.cpu") = 0 [pid 5086] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5086] close(3) = 0 [pid 5086] rmdir("./15") = 0 [pid 5086] mkdir("./16", 0777) = 0 [pid 5086] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5506 attached , child_tidptr=0x555555c0c5d0) = 18 [pid 5506] chdir("./16") = 0 [pid 5506] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5506] setpgid(0, 0) = 0 [pid 5506] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [pid 5506] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 5506] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 5506] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5506] write(3, "1000", 4) = 4 [pid 5506] close(3) = 0 [pid 5506] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5506] mkdir("./file0", 000) = 0 [pid 5506] open("./file0", O_RDONLY) = 3 [pid 5506] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5506] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5506] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5506] openat(5, "memory.max", O_RDWR) = 6 [ 148.227530][ T5488] Tasks state (memory values in pages): [ 148.250066][ T5488] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5506] write(6, "0x000000000000040e", 18 [pid 5488] <... write resumed>) = 18 [pid 5488] close(3) = 0 [pid 5488] close(4) = 0 [pid 5488] close(5) = 0 [ 148.277554][ T5488] Out of memory and no killable processes... [ 148.301552][ T5494] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5488] close(6) = 0 [pid 5488] close(7) = -1 EBADF (Bad file descriptor) [pid 5488] close(8) = -1 EBADF (Bad file descriptor) [pid 5488] close(9) = -1 EBADF (Bad file descriptor) [pid 5488] close(10) = -1 EBADF (Bad file descriptor) [pid 5488] close(11) = -1 EBADF (Bad file descriptor) [pid 5488] close(12) = -1 EBADF (Bad file descriptor) [pid 5488] close(13) = -1 EBADF (Bad file descriptor) [pid 5488] close(14) = -1 EBADF (Bad file descriptor) [pid 5488] close(15) = -1 EBADF (Bad file descriptor) [pid 5488] close(16) = -1 EBADF (Bad file descriptor) [pid 5488] close(17) = -1 EBADF (Bad file descriptor) [pid 5488] close(18) = -1 EBADF (Bad file descriptor) [pid 5488] close(19) = -1 EBADF (Bad file descriptor) [pid 5488] close(20) = -1 EBADF (Bad file descriptor) [pid 5488] close(21) = -1 EBADF (Bad file descriptor) [pid 5488] close(22) = -1 EBADF (Bad file descriptor) [pid 5488] close(23) = -1 EBADF (Bad file descriptor) [pid 5488] close(24) = -1 EBADF (Bad file descriptor) [pid 5488] close(25) = -1 EBADF (Bad file descriptor) [pid 5488] close(26) = -1 EBADF (Bad file descriptor) [pid 5488] close(27) = -1 EBADF (Bad file descriptor) [pid 5488] close(28) = -1 EBADF (Bad file descriptor) [pid 5488] close(29) = -1 EBADF (Bad file descriptor) [pid 5488] exit_group(0) = ? [pid 5488] +++ exited with 0 +++ [pid 5089] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=20, si_uid=0, si_status=0, si_utime=0, si_stime=10 /* 0.10 s */} --- [pid 5089] umount2("./18", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 148.321741][ T5494] CPU: 0 PID: 5494 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 148.331728][ T5494] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 148.341839][ T5494] Call Trace: [ 148.345162][ T5494] [ 148.348136][ T5494] dump_stack_lvl+0x136/0x150 [ 148.352886][ T5494] dump_header+0x10a/0xd70 [ 148.357368][ T5494] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 148.363529][ T5494] out_of_memory+0xd64/0x1660 [ 148.368287][ T5494] ? oom_killer_disable+0x2b0/0x2b0 [pid 5089] openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5089] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5089] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5089] umount2("./18/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./18/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5089] unlink("./18/binderfs") = 0 [pid 5089] umount2("./18/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./18/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5089] unlink("./18/cgroup") = 0 [pid 5089] umount2("./18/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./18/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [ 148.373572][ T5494] mem_cgroup_out_of_memory+0x206/0x270 [ 148.379195][ T5494] ? mem_cgroup_margin+0x130/0x130 [ 148.384425][ T5494] memory_max_write+0x2f9/0x3c0 [ 148.389364][ T5494] ? mem_cgroup_force_empty_write+0x160/0x160 [ 148.395515][ T5494] ? lock_sync+0x190/0x190 [ 148.400012][ T5494] cgroup_file_write+0x1e2/0x7b0 [ 148.405037][ T5494] ? mem_cgroup_force_empty_write+0x160/0x160 [ 148.411182][ T5494] ? kill_css+0x3b0/0x3b0 [ 148.415584][ T5494] ? lock_acquire+0x32/0xc0 [ 148.420149][ T5494] ? kill_css+0x3b0/0x3b0 [ 148.424531][ T5494] kernfs_fop_write_iter+0x3f1/0x600 [ 148.429876][ T5494] vfs_write+0x9ed/0xe10 [ 148.434169][ T5494] ? kernel_write+0x670/0x670 [ 148.438893][ T5494] ? find_held_lock+0x2d/0x110 [ 148.443699][ T5494] ? __fget_light+0x20a/0x270 [ 148.448424][ T5494] ksys_write+0x12b/0x250 [ 148.452804][ T5494] ? __ia32_sys_read+0xb0/0xb0 [ 148.457616][ T5494] ? lockdep_hardirqs_on+0x7d/0x100 [ 148.462850][ T5494] ? _raw_spin_unlock_irq+0x2e/0x50 [ 148.468095][ T5494] ? ptrace_notify+0xfe/0x140 [ 148.472813][ T5494] do_syscall_64+0x39/0xb0 [ 148.477275][ T5494] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 148.483207][ T5494] RIP: 0033:0x7faecf034129 [ 148.487646][ T5494] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 148.507286][ T5494] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 148.515735][ T5494] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [pid 5089] unlink("./18/cgroup.net") = 0 [pid 5089] umount2("./18/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5089] umount2("./18/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./18/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [ 148.523735][ T5494] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 148.531733][ T5494] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 148.539730][ T5494] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 148.547738][ T5494] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000011 [ 148.555775][ T5494] [pid 5089] umount2("./18/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] openat(AT_FDCWD, "./18/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5089] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5089] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5089] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5089] close(4) = 0 [pid 5089] rmdir("./18/file0") = 0 [pid 5089] umount2("./18/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./18/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5089] unlink("./18/cgroup.cpu") = 0 [pid 5089] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [ 148.603110][ T5494] memory: usage 8kB, limit 0kB, failcnt 36 [ 148.609767][ T5494] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 148.634127][ T5494] Memory cgroup stats for /syz1: [ 148.636182][ T5494] anon 0 [ 148.636182][ T5494] file 0 [ 148.636182][ T5494] kernel 8192 [ 148.636182][ T5494] kernel_stack 0 [ 148.636182][ T5494] pagetables 0 [ 148.636182][ T5494] sec_pagetables 0 [ 148.636182][ T5494] percpu 0 [ 148.636182][ T5494] sock 0 [ 148.636182][ T5494] vmalloc 0 [ 148.636182][ T5494] shmem 0 [ 148.636182][ T5494] zswap 0 [ 148.636182][ T5494] zswapped 0 [ 148.636182][ T5494] file_mapped 0 [ 148.636182][ T5494] file_dirty 0 [ 148.636182][ T5494] file_writeback 0 [ 148.636182][ T5494] swapcached 0 [ 148.636182][ T5494] anon_thp 0 [ 148.636182][ T5494] file_thp 0 [ 148.636182][ T5494] shmem_thp 0 [ 148.636182][ T5494] inactive_anon 0 [pid 5089] close(3) = 0 [ 148.636182][ T5494] active_anon 0 [ 148.636182][ T5494] inactive_file 0 [ 148.636182][ T5494] active_file 0 [ 148.636182][ T5494] unevictable 0 [ 148.636182][ T5494] slab_reclaimable 6752 [ 148.636182][ T5494] slab_unreclaimable 0 [ 148.636182][ T5494] slab 6752 [ 148.636182][ T5494] workingset_refault_anon 0 [ 148.636182][ T5494] workingset_refault_file 0 [ 148.636182][ T5494] workingset_activate_anon 0 [ 148.636182][ T5494] workingset_activate_file 0 [ 148.636182][ T5494] workingset_restore_anon 0 [ 148.636182][ T5494] workingset_restore_file 0 [ 148.636182][ T5494] workingset_nodereclaim 0 [ 148.636182][ T5494] pgscan 831 [ 148.636182][ T5494] pgsteal 2 [ 148.636182][ T5494] pgscan_kswapd 0 [ 148.636182][ T5494] pgscan_direct 831 [ 148.636182][ T5494] pgscan_khugepaged 0 [ 148.636182][ T5494] pgsteal_kswapd 0 [ 148.636182][ T5494] pgsteal_direct 2 [ 148.636182][ T5494] pgsteal_khugepaged 0 [ 148.636182][ T5494] pgfault 21 [ 148.636182][ T5494] pgmajfault 0 [ 148.636182][ T5494] pgrefill 830 [ 148.636182][ T5494] pgactivate 829 [ 148.636182][ T5494] pgdeactivate 830 [pid 5089] rmdir("./18") = 0 [pid 5089] mkdir("./19", 0777) = 0 [pid 5089] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5510 attached [pid 5510] chdir("./19" [pid 5089] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 21 [pid 5510] <... chdir resumed>) = 0 [ 148.636182][ T5494] pglazyfree 0 [ 148.636182][ T5494] pglazyfreed 0 [ 148.636182][ T5494] zswpin 0 [ 148.636182][ T5494] zswpout 0 [ 148.636182][ T5494] thp_fault_alloc 0 [ 148.636182][ T5494] thp_collapse_alloc 0 [ 148.836599][ T5494] Tasks state (memory values in pages): [ 148.842814][ T5494] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5510] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5510] setpgid(0, 0) = 0 [pid 5510] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 5510] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [pid 5510] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 5494] <... write resumed>) = 18 [pid 5510] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [ 148.853087][ T5494] Out of memory and no killable processes... [ 148.872940][ T5498] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 148.886410][ T5498] CPU: 1 PID: 5498 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 148.896390][ T5498] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 148.906503][ T5498] Call Trace: [ 148.909835][ T5498] [ 148.912812][ T5498] dump_stack_lvl+0x136/0x150 [ 148.917569][ T5498] dump_header+0x10a/0xd70 [ 148.922050][ T5498] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 148.928206][ T5498] out_of_memory+0xd64/0x1660 [ 148.932970][ T5498] ? oom_killer_disable+0x2b0/0x2b0 [ 148.938249][ T5498] mem_cgroup_out_of_memory+0x206/0x270 [ 148.943870][ T5498] ? mem_cgroup_margin+0x130/0x130 [ 148.949102][ T5498] memory_max_write+0x2f9/0x3c0 [ 148.954035][ T5498] ? mem_cgroup_force_empty_write+0x160/0x160 [ 148.960182][ T5498] ? lock_sync+0x190/0x190 [ 148.964667][ T5498] cgroup_file_write+0x1e2/0x7b0 [ 148.969679][ T5498] ? mem_cgroup_force_empty_write+0x160/0x160 [ 148.975847][ T5498] ? kill_css+0x3b0/0x3b0 [ 148.980245][ T5498] ? lock_acquire+0x32/0xc0 [ 148.984836][ T5498] ? kill_css+0x3b0/0x3b0 [ 148.989236][ T5498] kernfs_fop_write_iter+0x3f1/0x600 [ 148.994612][ T5498] vfs_write+0x9ed/0xe10 [ 148.998934][ T5498] ? kernel_write+0x670/0x670 [ 149.003688][ T5498] ? find_held_lock+0x2d/0x110 [ 149.008534][ T5498] ? __fget_light+0x20a/0x270 [ 149.013305][ T5498] ksys_write+0x12b/0x250 [ 149.017717][ T5498] ? __ia32_sys_read+0xb0/0xb0 [ 149.022576][ T5498] ? lockdep_hardirqs_on+0x7d/0x100 [ 149.027867][ T5498] ? _raw_spin_unlock_irq+0x2e/0x50 [ 149.033142][ T5498] ? ptrace_notify+0xfe/0x140 [ 149.037978][ T5498] do_syscall_64+0x39/0xb0 [ 149.042474][ T5498] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 149.048431][ T5498] RIP: 0033:0x7faecf034129 [ 149.052882][ T5498] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 149.072533][ T5498] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 149.080981][ T5498] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 149.089000][ T5498] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 149.097019][ T5498] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [pid 5494] close(3 [pid 5510] <... openat resumed>) = 3 [pid 5510] write(3, "1000", 4 [pid 5494] <... close resumed>) = 0 [pid 5510] <... write resumed>) = 4 [pid 5494] close(4 [pid 5510] close(3 [pid 5494] <... close resumed>) = 0 [pid 5510] <... close resumed>) = 0 [pid 5494] close(5 [pid 5510] symlink("/dev/binderfs", "./binderfs" [pid 5494] <... close resumed>) = 0 [pid 5510] <... symlink resumed>) = 0 [pid 5494] close(6 [pid 5510] mkdir("./file0", 000 [pid 5494] <... close resumed>) = 0 [pid 5510] <... mkdir resumed>) = 0 [pid 5510] open("./file0", O_RDONLY [pid 5494] close(7 [pid 5510] <... open resumed>) = 3 [pid 5494] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5510] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5494] close(8 [pid 5510] <... mount resumed>) = 0 [pid 5494] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5510] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5494] close(9 [pid 5510] <... openat resumed>) = 4 [pid 5494] <... close resumed>) = -1 EBADF (Bad file descriptor) [ 149.105016][ T5498] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 149.113013][ T5498] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 000000000000000f [ 149.121031][ T5498] [pid 5510] openat(4, "syz1", O_RDWR|O_PATH [pid 5494] close(10 [pid 5510] <... openat resumed>) = 5 [pid 5494] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5510] openat(5, "memory.max", O_RDWR [pid 5494] close(11 [pid 5510] <... openat resumed>) = 6 [pid 5510] write(6, "0x000000000000040e", 18 [pid 5494] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5494] close(12) = -1 EBADF (Bad file descriptor) [pid 5494] close(13) = -1 EBADF (Bad file descriptor) [pid 5494] close(14) = -1 EBADF (Bad file descriptor) [pid 5494] close(15) = -1 EBADF (Bad file descriptor) [ 149.159622][ T5498] memory: usage 8kB, limit 0kB, failcnt 36 [ 149.168250][ T5498] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 149.200481][ T5498] Memory cgroup stats for /syz1: [ 149.200726][ T5498] anon 0 [ 149.200726][ T5498] file 0 [ 149.200726][ T5498] kernel 8192 [ 149.200726][ T5498] kernel_stack 0 [ 149.200726][ T5498] pagetables 0 [ 149.200726][ T5498] sec_pagetables 0 [ 149.200726][ T5498] percpu 0 [ 149.200726][ T5498] sock 0 [ 149.200726][ T5498] vmalloc 0 [ 149.200726][ T5498] shmem 0 [ 149.200726][ T5498] zswap 0 [ 149.200726][ T5498] zswapped 0 [ 149.200726][ T5498] file_mapped 0 [ 149.200726][ T5498] file_dirty 0 [ 149.200726][ T5498] file_writeback 0 [ 149.200726][ T5498] swapcached 0 [ 149.200726][ T5498] anon_thp 0 [ 149.200726][ T5498] file_thp 0 [ 149.200726][ T5498] shmem_thp 0 [ 149.200726][ T5498] inactive_anon 0 [ 149.200726][ T5498] active_anon 0 [ 149.200726][ T5498] inactive_file 0 [ 149.200726][ T5498] active_file 0 [ 149.200726][ T5498] unevictable 0 [ 149.200726][ T5498] slab_reclaimable 6752 [ 149.200726][ T5498] slab_unreclaimable 0 [ 149.200726][ T5498] slab 6752 [ 149.200726][ T5498] workingset_refault_anon 0 [ 149.200726][ T5498] workingset_refault_file 0 [ 149.200726][ T5498] workingset_activate_anon 0 [ 149.200726][ T5498] workingset_activate_file 0 [ 149.200726][ T5498] workingset_restore_anon 0 [ 149.200726][ T5498] workingset_restore_file 0 [ 149.200726][ T5498] workingset_nodereclaim 0 [ 149.200726][ T5498] pgscan 831 [ 149.200726][ T5498] pgsteal 2 [ 149.200726][ T5498] pgscan_kswapd 0 [ 149.200726][ T5498] pgscan_direct 831 [ 149.200726][ T5498] pgscan_khugepaged 0 [ 149.200726][ T5498] pgsteal_kswapd 0 [ 149.200726][ T5498] pgsteal_direct 2 [ 149.200726][ T5498] pgsteal_khugepaged 0 [ 149.200726][ T5498] pgfault 21 [ 149.200726][ T5498] pgmajfault 0 [ 149.200726][ T5498] pgrefill 830 [ 149.200726][ T5498] pgactivate 829 [ 149.200726][ T5498] pgdeactivate 830 [ 149.200726][ T5498] pglazyfree 0 [ 149.200726][ T5498] pglazyfreed 0 [ 149.200726][ T5498] zswpin 0 [ 149.200726][ T5498] zswpout 0 [ 149.200726][ T5498] thp_fault_alloc 0 [ 149.200726][ T5498] thp_collapse_alloc 0 [pid 5494] close(16) = -1 EBADF (Bad file descriptor) [pid 5494] close(17) = -1 EBADF (Bad file descriptor) [pid 5494] close(18) = -1 EBADF (Bad file descriptor) [pid 5494] close(19) = -1 EBADF (Bad file descriptor) [pid 5494] close(20) = -1 EBADF (Bad file descriptor) [pid 5494] close(21) = -1 EBADF (Bad file descriptor) [pid 5494] close(22) = -1 EBADF (Bad file descriptor) [pid 5494] close(23) = -1 EBADF (Bad file descriptor) [pid 5494] close(24) = -1 EBADF (Bad file descriptor) [pid 5494] close(25) = -1 EBADF (Bad file descriptor) [pid 5494] close(26) = -1 EBADF (Bad file descriptor) [pid 5494] close(27) = -1 EBADF (Bad file descriptor) [pid 5494] close(28) = -1 EBADF (Bad file descriptor) [pid 5494] close(29) = -1 EBADF (Bad file descriptor) [pid 5494] exit_group(0) = ? [pid 5494] +++ exited with 0 +++ [pid 5087] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=19, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- [pid 5087] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5087] umount2("./17", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5087] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5087] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5087] umount2("./17/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./17/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5087] unlink("./17/binderfs") = 0 [pid 5087] umount2("./17/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./17/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5087] unlink("./17/cgroup" [pid 5498] <... write resumed>) = 18 [pid 5087] <... unlink resumed>) = 0 [pid 5498] close(3 [pid 5087] umount2("./17/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5498] <... close resumed>) = 0 [pid 5087] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5498] close(4 [pid 5087] lstat("./17/cgroup.net", [pid 5498] <... close resumed>) = 0 [pid 5087] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5498] close(5 [pid 5087] unlink("./17/cgroup.net" [pid 5498] <... close resumed>) = 0 [pid 5087] <... unlink resumed>) = 0 [pid 5498] close(6 [pid 5087] umount2("./17/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5498] <... close resumed>) = 0 [pid 5498] close(7) = -1 EBADF (Bad file descriptor) [ 149.542009][ T5498] Tasks state (memory values in pages): [ 149.547796][ T5498] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 149.564455][ T5498] Out of memory and no killable processes... [ 149.570588][ T5503] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 149.604004][ T5503] CPU: 0 PID: 5503 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 149.614083][ T5503] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 149.624207][ T5503] Call Trace: [ 149.627529][ T5503] [ 149.630508][ T5503] dump_stack_lvl+0x136/0x150 [ 149.635247][ T5503] dump_header+0x10a/0xd70 [ 149.639700][ T5503] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 149.645824][ T5503] out_of_memory+0xd64/0x1660 [ 149.650552][ T5503] ? oom_killer_disable+0x2b0/0x2b0 [ 149.655802][ T5503] mem_cgroup_out_of_memory+0x206/0x270 [ 149.661420][ T5503] ? mem_cgroup_margin+0x130/0x130 [ 149.666594][ T5503] memory_max_write+0x2f9/0x3c0 [ 149.671493][ T5503] ? mem_cgroup_force_empty_write+0x160/0x160 [ 149.677610][ T5503] ? lock_sync+0x190/0x190 [ 149.682065][ T5503] cgroup_file_write+0x1e2/0x7b0 [ 149.687060][ T5503] ? mem_cgroup_force_empty_write+0x160/0x160 [ 149.693174][ T5503] ? kill_css+0x3b0/0x3b0 [ 149.697548][ T5503] ? lock_acquire+0x32/0xc0 [ 149.702100][ T5503] ? kill_css+0x3b0/0x3b0 [ 149.706489][ T5503] kernfs_fop_write_iter+0x3f1/0x600 [ 149.711844][ T5503] vfs_write+0x9ed/0xe10 [ 149.716145][ T5503] ? kernel_write+0x670/0x670 [ 149.720878][ T5503] ? find_held_lock+0x2d/0x110 [ 149.725681][ T5503] ? __fget_light+0x20a/0x270 [ 149.730405][ T5503] ksys_write+0x12b/0x250 [ 149.734780][ T5503] ? __ia32_sys_read+0xb0/0xb0 [ 149.739586][ T5503] ? lockdep_hardirqs_on+0x7d/0x100 [ 149.744821][ T5503] ? _raw_spin_unlock_irq+0x2e/0x50 [ 149.750083][ T5503] ? ptrace_notify+0xfe/0x140 [ 149.754799][ T5503] do_syscall_64+0x39/0xb0 [ 149.759265][ T5503] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 149.765193][ T5503] RIP: 0033:0x7faecf034129 [ 149.769628][ T5503] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 149.789272][ T5503] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 5498] close(8) = -1 EBADF (Bad file descriptor) [pid 5498] close(9) = -1 EBADF (Bad file descriptor) [pid 5498] close(10) = -1 EBADF (Bad file descriptor) [pid 5498] close(11) = -1 EBADF (Bad file descriptor) [pid 5498] close(12) = -1 EBADF (Bad file descriptor) [pid 5498] close(13) = -1 EBADF (Bad file descriptor) [ 149.797718][ T5503] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 149.805733][ T5503] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 149.813758][ T5503] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 149.821759][ T5503] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 149.829764][ T5503] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000013 [ 149.837791][ T5503] [pid 5498] close(14) = -1 EBADF (Bad file descriptor) [pid 5498] close(15 [pid 5087] <... umount2 resumed>) = 0 [pid 5087] umount2("./17/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./17/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5498] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5087] umount2("./17/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5498] close(16 [pid 5087] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5498] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5087] openat(AT_FDCWD, "./17/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5498] close(17 [pid 5087] <... openat resumed>) = 4 [pid 5087] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5087] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5087] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5087] close(4) = 0 [pid 5087] rmdir("./17/file0") = 0 [pid 5087] umount2("./17/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./17/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5087] unlink("./17/cgroup.cpu") = 0 [pid 5087] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5087] close(3) = 0 [pid 5087] rmdir("./17") = 0 [pid 5087] mkdir("./18", 0777) = 0 [pid 5087] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555c0c5d0) = 20 [ 149.872223][ T5503] memory: usage 8kB, limit 0kB, failcnt 36 [ 149.878118][ T5503] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 149.888832][ T5503] Memory cgroup stats for /syz1: [ 149.889135][ T5503] anon 0 [ 149.889135][ T5503] file 0 [ 149.889135][ T5503] kernel 8192 [ 149.889135][ T5503] kernel_stack 0 [ 149.889135][ T5503] pagetables 0 [ 149.889135][ T5503] sec_pagetables 0 [ 149.889135][ T5503] percpu 0 [ 149.889135][ T5503] sock 0 [ 149.889135][ T5503] vmalloc 0 [ 149.889135][ T5503] shmem 0 [ 149.889135][ T5503] zswap 0 [ 149.889135][ T5503] zswapped 0 [ 149.889135][ T5503] file_mapped 0 [ 149.889135][ T5503] file_dirty 0 [ 149.889135][ T5503] file_writeback 0 [ 149.889135][ T5503] swapcached 0 [ 149.889135][ T5503] anon_thp 0 [ 149.889135][ T5503] file_thp 0 [ 149.889135][ T5503] shmem_thp 0 [ 149.889135][ T5503] inactive_anon 0 [ 149.889135][ T5503] active_anon 0 [ 149.889135][ T5503] inactive_file 0 [ 149.889135][ T5503] active_file 0 [ 149.889135][ T5503] unevictable 0 [ 149.889135][ T5503] slab_reclaimable 6752 [ 149.889135][ T5503] slab_unreclaimable 0 [ 149.889135][ T5503] slab 6752 [ 149.889135][ T5503] workingset_refault_anon 0 [ 149.889135][ T5503] workingset_refault_file 0 [ 149.889135][ T5503] workingset_activate_anon 0 [ 149.889135][ T5503] workingset_activate_file 0 [ 149.889135][ T5503] workingset_restore_anon 0 [ 149.889135][ T5503] workingset_restore_file 0 [ 149.889135][ T5503] workingset_nodereclaim 0 [ 149.889135][ T5503] pgscan 831 [ 149.889135][ T5503] pgsteal 2 [ 149.889135][ T5503] pgscan_kswapd 0 [pid 5498] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5498] close(18) = -1 EBADF (Bad file descriptor) [ 149.889135][ T5503] pgscan_direct 831 [ 149.889135][ T5503] pgscan_khugepaged 0 [ 149.889135][ T5503] pgsteal_kswapd 0 [ 149.889135][ T5503] pgsteal_direct 2 [ 149.889135][ T5503] pgsteal_khugepaged 0 [ 149.889135][ T5503] pgfault 21 [ 149.889135][ T5503] pgmajfault 0 [ 149.889135][ T5503] pgrefill 830 [ 149.889135][ T5503] pgactivate 829 [ 149.889135][ T5503] pgdeactivate 830 [ 149.889135][ T5503] pglazyfree 0 [ 149.889135][ T5503] pglazyfreed 0 [ 149.889135][ T5503] zswpin 0 [ 149.889135][ T5503] zswpout 0 [ 149.889135][ T5503] thp_fault_alloc 0 [pid 5498] close(19./strace-static-x86_64: Process 5518 attached ) = -1 EBADF (Bad file descriptor) [pid 5518] chdir("./18" [pid 5498] close(20 [pid 5518] <... chdir resumed>) = 0 [pid 5498] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5518] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5498] close(21 [pid 5518] <... prctl resumed>) = 0 [pid 5498] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5518] setpgid(0, 0 [pid 5498] close(22 [pid 5518] <... setpgid resumed>) = 0 [pid 5498] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5518] symlink("/syzcgroup/unified/syz2", "./cgroup" [pid 5498] close(23 [pid 5518] <... symlink resumed>) = 0 [pid 5498] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5518] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu" [pid 5498] close(24 [pid 5518] <... symlink resumed>) = 0 [pid 5498] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5518] symlink("/syzcgroup/net/syz2", "./cgroup.net" [pid 5498] close(25 [pid 5518] <... symlink resumed>) = 0 [pid 5498] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5518] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [ 149.889135][ T5503] thp_collapse_alloc 0 [pid 5498] close(26 [pid 5518] <... openat resumed>) = 3 [pid 5498] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5518] write(3, "1000", 4 [pid 5498] close(27 [pid 5518] <... write resumed>) = 4 [pid 5498] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5518] close(3 [pid 5498] close(28 [pid 5518] <... close resumed>) = 0 [pid 5498] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5518] symlink("/dev/binderfs", "./binderfs" [pid 5498] close(29 [pid 5518] <... symlink resumed>) = 0 [pid 5498] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5498] exit_group(0) = ? [pid 5518] mkdir("./file0", 000 [pid 5498] +++ exited with 0 +++ [pid 5518] <... mkdir resumed>) = 0 [pid 5085] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=17, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- [pid 5518] open("./file0", O_RDONLY) = 3 [pid 5518] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5085] umount2("./15", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5518] <... mount resumed>) = 0 [pid 5085] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5518] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5085] openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5518] <... openat resumed>) = 4 [pid 5085] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5085] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5085] umount2("./15/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 150.127001][ T5503] Tasks state (memory values in pages): [ 150.141217][ T5503] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 150.160902][ T5503] Out of memory and no killable processes... [pid 5085] lstat("./15/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5518] openat(4, "syz1", O_RDWR|O_PATH [pid 5085] unlink("./15/binderfs") = 0 [pid 5518] <... openat resumed>) = 5 [pid 5085] umount2("./15/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5518] openat(5, "memory.max", O_RDWR [pid 5503] <... write resumed>) = 18 [pid 5085] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5518] <... openat resumed>) = 6 [pid 5503] close(3 [pid 5085] lstat("./15/cgroup", [pid 5518] write(6, "0x000000000000040e", 18 [pid 5503] <... close resumed>) = 0 [ 150.167411][ T5506] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5085] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5085] unlink("./15/cgroup") = 0 [pid 5085] umount2("./15/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./15/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5085] unlink("./15/cgroup.net") = 0 [ 150.205002][ T5506] CPU: 1 PID: 5506 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 150.214996][ T5506] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 150.225108][ T5506] Call Trace: [ 150.228436][ T5506] [ 150.231412][ T5506] dump_stack_lvl+0x136/0x150 [ 150.236294][ T5506] dump_header+0x10a/0xd70 [ 150.240777][ T5506] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 150.246939][ T5506] out_of_memory+0xd64/0x1660 [ 150.251720][ T5506] ? oom_killer_disable+0x2b0/0x2b0 [ 150.257005][ T5506] mem_cgroup_out_of_memory+0x206/0x270 [ 150.262637][ T5506] ? mem_cgroup_margin+0x130/0x130 [ 150.267859][ T5506] memory_max_write+0x2f9/0x3c0 [ 150.272795][ T5506] ? mem_cgroup_force_empty_write+0x160/0x160 [ 150.278942][ T5506] ? lock_sync+0x190/0x190 [ 150.283426][ T5506] cgroup_file_write+0x1e2/0x7b0 [ 150.288440][ T5506] ? mem_cgroup_force_empty_write+0x160/0x160 [ 150.294584][ T5506] ? kill_css+0x3b0/0x3b0 [ 150.298992][ T5506] ? lock_acquire+0x32/0xc0 [ 150.303570][ T5506] ? kill_css+0x3b0/0x3b0 [ 150.307977][ T5506] kernfs_fop_write_iter+0x3f1/0x600 [ 150.313347][ T5506] vfs_write+0x9ed/0xe10 [ 150.317665][ T5506] ? kernel_write+0x670/0x670 [ 150.322421][ T5506] ? find_held_lock+0x2d/0x110 [ 150.327252][ T5506] ? __fget_light+0x20a/0x270 [ 150.332015][ T5506] ksys_write+0x12b/0x250 [ 150.336423][ T5506] ? __ia32_sys_read+0xb0/0xb0 [ 150.341257][ T5506] ? lockdep_hardirqs_on+0x7d/0x100 [ 150.346520][ T5506] ? _raw_spin_unlock_irq+0x2e/0x50 [ 150.351786][ T5506] ? ptrace_notify+0xfe/0x140 [ 150.356529][ T5506] do_syscall_64+0x39/0xb0 [ 150.361021][ T5506] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 150.366977][ T5506] RIP: 0033:0x7faecf034129 [ 150.371442][ T5506] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 150.391115][ T5506] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 5085] umount2("./15/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5085] umount2("./15/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./15/file0", [pid 5503] close(4 [pid 5085] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5503] <... close resumed>) = 0 [pid 5085] umount2("./15/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5503] close(5 [pid 5085] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5503] <... close resumed>) = 0 [pid 5085] openat(AT_FDCWD, "./15/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5503] close(6 [pid 5085] <... openat resumed>) = 4 [pid 5503] <... close resumed>) = 0 [pid 5085] fstat(4, [pid 5503] close(7 [pid 5085] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5503] <... close resumed>) = -1 EBADF (Bad file descriptor) [ 150.399592][ T5506] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 150.407618][ T5506] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 150.415690][ T5506] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 150.423715][ T5506] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 150.431734][ T5506] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000010 [ 150.439794][ T5506] [pid 5085] getdents64(4, [pid 5503] close(8 [pid 5085] <... getdents64 resumed>0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5503] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5085] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5503] close(9 [pid 5085] close(4) = 0 [pid 5085] rmdir("./15/file0") = 0 [pid 5085] umount2("./15/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./15/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5503] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5085] unlink("./15/cgroup.cpu") = 0 [pid 5085] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5085] close(3) = 0 [pid 5085] rmdir("./15") = 0 [pid 5085] mkdir("./16", 0777) = 0 [ 150.480390][ T5506] memory: usage 8kB, limit 0kB, failcnt 36 [ 150.486449][ T5506] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 150.502399][ T5506] Memory cgroup stats for /syz1: [ 150.502702][ T5506] anon 0 [ 150.502702][ T5506] file 0 [ 150.502702][ T5506] kernel 8192 [ 150.502702][ T5506] kernel_stack 0 [ 150.502702][ T5506] pagetables 0 [ 150.502702][ T5506] sec_pagetables 0 [ 150.502702][ T5506] percpu 0 [pid 5085] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5522 attached [pid 5522] chdir("./16" [pid 5085] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 18 [pid 5522] <... chdir resumed>) = 0 [pid 5522] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5522] setpgid(0, 0) = 0 [pid 5522] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 5522] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 5522] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 5522] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5522] write(3, "1000", 4) = 4 [pid 5522] close(3) = 0 [pid 5522] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5522] mkdir("./file0", 000) = 0 [pid 5522] open("./file0", O_RDONLY) = 3 [pid 5522] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5522] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5522] openat(4, "syz1", O_RDWR|O_PATH) = 5 [ 150.502702][ T5506] sock 0 [ 150.502702][ T5506] vmalloc 0 [ 150.502702][ T5506] shmem 0 [ 150.502702][ T5506] zswap 0 [ 150.502702][ T5506] zswapped 0 [ 150.502702][ T5506] file_mapped 0 [ 150.502702][ T5506] file_dirty 0 [ 150.502702][ T5506] file_writeback 0 [ 150.502702][ T5506] swapcached 0 [ 150.502702][ T5506] anon_thp 0 [ 150.502702][ T5506] file_thp 0 [ 150.502702][ T5506] shmem_thp 0 [ 150.502702][ T5506] inactive_anon 0 [ 150.502702][ T5506] active_anon 0 [ 150.502702][ T5506] inactive_file 0 [ 150.502702][ T5506] active_file 0 [pid 5522] openat(5, "memory.max", O_RDWR) = 6 [ 150.502702][ T5506] unevictable 0 [ 150.502702][ T5506] slab_reclaimable 6752 [ 150.502702][ T5506] slab_unreclaimable 0 [ 150.502702][ T5506] slab 6752 [ 150.502702][ T5506] workingset_refault_anon 0 [ 150.502702][ T5506] workingset_refault_file 0 [ 150.502702][ T5506] workingset_activate_anon 0 [ 150.502702][ T5506] workingset_activate_file 0 [ 150.502702][ T5506] workingset_restore_anon 0 [ 150.502702][ T5506] workingset_restore_file 0 [ 150.502702][ T5506] workingset_nodereclaim 0 [ 150.502702][ T5506] pgscan 831 [ 150.502702][ T5506] pgsteal 2 [ 150.502702][ T5506] pgscan_kswapd 0 [ 150.502702][ T5506] pgscan_direct 831 [ 150.502702][ T5506] pgscan_khugepaged 0 [ 150.502702][ T5506] pgsteal_kswapd 0 [ 150.502702][ T5506] pgsteal_direct 2 [ 150.502702][ T5506] pgsteal_khugepaged 0 [ 150.502702][ T5506] pgfault 21 [ 150.502702][ T5506] pgmajfault 0 [ 150.502702][ T5506] pgrefill 830 [ 150.502702][ T5506] pgactivate 829 [ 150.502702][ T5506] pgdeactivate 830 [ 150.502702][ T5506] pglazyfree 0 [ 150.502702][ T5506] pglazyfreed 0 [ 150.502702][ T5506] zswpin 0 [ 150.502702][ T5506] zswpout 0 [ 150.502702][ T5506] thp_fault_alloc 0 [ 150.502702][ T5506] thp_collapse_alloc 0 [ 150.751943][ T5506] Tasks state (memory values in pages): [ 150.757657][ T5506] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5522] write(6, "0x000000000000040e", 18 [pid 5503] close(10) = -1 EBADF (Bad file descriptor) [pid 5503] close(11) = -1 EBADF (Bad file descriptor) [pid 5503] close(12) = -1 EBADF (Bad file descriptor) [pid 5503] close(13) = -1 EBADF (Bad file descriptor) [pid 5503] close(14) = -1 EBADF (Bad file descriptor) [pid 5503] close(15) = -1 EBADF (Bad file descriptor) [pid 5503] close(16 [pid 5506] <... write resumed>) = 18 [pid 5503] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5506] close(3 [pid 5503] close(17) = -1 EBADF (Bad file descriptor) [pid 5503] close(18) = -1 EBADF (Bad file descriptor) [pid 5503] close(19) = -1 EBADF (Bad file descriptor) [pid 5503] close(20 [pid 5506] <... close resumed>) = 0 [pid 5503] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5506] close(4 [pid 5503] close(21 [pid 5506] <... close resumed>) = 0 [pid 5503] <... close resumed>) = -1 EBADF (Bad file descriptor) [ 150.797063][ T5506] Out of memory and no killable processes... [ 150.829235][ T5510] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 150.857230][ T5510] CPU: 0 PID: 5510 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 150.867224][ T5510] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 150.877336][ T5510] Call Trace: [ 150.880661][ T5510] [ 150.883644][ T5510] dump_stack_lvl+0x136/0x150 [ 150.888389][ T5510] dump_header+0x10a/0xd70 [ 150.892871][ T5510] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 150.899038][ T5510] out_of_memory+0xd64/0x1660 [ 150.903806][ T5510] ? oom_killer_disable+0x2b0/0x2b0 [ 150.909077][ T5510] ? find_held_lock+0x2d/0x110 [ 150.913905][ T5510] mem_cgroup_out_of_memory+0x206/0x270 [ 150.919531][ T5510] ? mem_cgroup_margin+0x130/0x130 [ 150.924730][ T5510] ? _raw_spin_unlock_irqrestore+0x54/0x70 [ 150.930612][ T5510] memory_max_write+0x2f9/0x3c0 [ 150.935529][ T5510] ? mem_cgroup_force_empty_write+0x160/0x160 [ 150.941662][ T5510] ? lock_sync+0x190/0x190 [ 150.946128][ T5510] cgroup_file_write+0x1e2/0x7b0 [ 150.951123][ T5510] ? mem_cgroup_force_empty_write+0x160/0x160 [ 150.957240][ T5510] ? kill_css+0x3b0/0x3b0 [ 150.961621][ T5510] ? lock_acquire+0x32/0xc0 [ 150.966182][ T5510] ? kill_css+0x3b0/0x3b0 [ 150.970558][ T5510] kernfs_fop_write_iter+0x3f1/0x600 [ 150.975893][ T5510] vfs_write+0x9ed/0xe10 [ 150.980188][ T5510] ? kernel_write+0x670/0x670 [ 150.984913][ T5510] ? find_held_lock+0x2d/0x110 [ 150.989722][ T5510] ? __fget_light+0x20a/0x270 [ 150.994453][ T5510] ksys_write+0x12b/0x250 [ 150.998830][ T5510] ? __ia32_sys_read+0xb0/0xb0 [ 151.003653][ T5510] ? lockdep_hardirqs_on+0x7d/0x100 [ 151.008889][ T5510] ? _raw_spin_unlock_irq+0x2e/0x50 [ 151.014133][ T5510] ? ptrace_notify+0xfe/0x140 [ 151.018852][ T5510] do_syscall_64+0x39/0xb0 [ 151.023312][ T5510] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 151.029238][ T5510] RIP: 0033:0x7faecf034129 [ 151.033676][ T5510] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 5506] close(5 [pid 5503] close(22 [pid 5506] <... close resumed>) = 0 [pid 5506] close(6) = 0 [pid 5506] close(7) = -1 EBADF (Bad file descriptor) [pid 5506] close(8) = -1 EBADF (Bad file descriptor) [pid 5506] close(9) = -1 EBADF (Bad file descriptor) [pid 5506] close(10) = -1 EBADF (Bad file descriptor) [pid 5506] close(11) = -1 EBADF (Bad file descriptor) [pid 5506] close(12) = -1 EBADF (Bad file descriptor) [pid 5506] close(13) = -1 EBADF (Bad file descriptor) [pid 5506] close(14) = -1 EBADF (Bad file descriptor) [ 151.053314][ T5510] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 151.061779][ T5510] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 151.069773][ T5510] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 151.077767][ T5510] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 151.085763][ T5510] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 151.093759][ T5510] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000013 [ 151.101790][ T5510] [pid 5506] close(15) = -1 EBADF (Bad file descriptor) [pid 5503] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5506] close(16) = -1 EBADF (Bad file descriptor) [pid 5506] close(17) = -1 EBADF (Bad file descriptor) [pid 5506] close(18) = -1 EBADF (Bad file descriptor) [pid 5506] close(19) = -1 EBADF (Bad file descriptor) [pid 5506] close(20) = -1 EBADF (Bad file descriptor) [pid 5506] close(21) = -1 EBADF (Bad file descriptor) [pid 5506] close(22) = -1 EBADF (Bad file descriptor) [pid 5506] close(23) = -1 EBADF (Bad file descriptor) [pid 5506] close(24) = -1 EBADF (Bad file descriptor) [pid 5506] close(25) = -1 EBADF (Bad file descriptor) [pid 5506] close(26) = -1 EBADF (Bad file descriptor) [pid 5506] close(27) = -1 EBADF (Bad file descriptor) [pid 5506] close(28) = -1 EBADF (Bad file descriptor) [pid 5506] close(29) = -1 EBADF (Bad file descriptor) [pid 5506] exit_group(0) = ? [pid 5506] +++ exited with 0 +++ [pid 5503] close(23) = -1 EBADF (Bad file descriptor) [pid 5086] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=18, si_uid=0, si_status=0, si_utime=0, si_stime=7 /* 0.07 s */} --- [pid 5503] close(24) = -1 EBADF (Bad file descriptor) [pid 5503] close(25) = -1 EBADF (Bad file descriptor) [pid 5503] close(26) = -1 EBADF (Bad file descriptor) [pid 5503] close(27) = -1 EBADF (Bad file descriptor) [pid 5503] close(28) = -1 EBADF (Bad file descriptor) [pid 5503] close(29 [pid 5086] umount2("./16", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5503] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5086] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5086] openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5503] exit_group(0 [pid 5086] <... openat resumed>) = 3 [pid 5503] <... exit_group resumed>) = ? [pid 5086] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5086] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5086] umount2("./16/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5503] +++ exited with 0 +++ [pid 5090] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=21, si_uid=0, si_status=0, si_utime=0, si_stime=9 /* 0.09 s */} --- [pid 5086] lstat("./16/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5086] unlink("./16/binderfs") = 0 [pid 5086] umount2("./16/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./16/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5090] umount2("./19", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5086] unlink("./16/cgroup" [pid 5090] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5086] <... unlink resumed>) = 0 [pid 5090] openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5086] umount2("./16/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] <... openat resumed>) = 3 [pid 5086] lstat("./16/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5090] fstat(3, [pid 5086] unlink("./16/cgroup.net" [pid 5090] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5086] <... unlink resumed>) = 0 [pid 5090] getdents64(3, [pid 5086] umount2("./16/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5090] <... getdents64 resumed>0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5090] umount2("./19/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./19/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5090] unlink("./19/binderfs") = 0 [pid 5090] umount2("./19/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./19/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5090] unlink("./19/cgroup") = 0 [pid 5090] umount2("./19/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./19/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5090] unlink("./19/cgroup.net") = 0 [pid 5090] umount2("./19/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5086] <... umount2 resumed>) = 0 [pid 5086] umount2("./16/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./16/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [ 151.209817][ T5510] memory: usage 8kB, limit 0kB, failcnt 36 [ 151.222685][ T5510] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 151.238958][ T5510] Memory cgroup stats for /syz1: [ 151.239258][ T5510] anon 0 [ 151.239258][ T5510] file 0 [ 151.239258][ T5510] kernel 8192 [ 151.239258][ T5510] kernel_stack 0 [ 151.239258][ T5510] pagetables 0 [pid 5090] <... umount2 resumed>) = 0 [pid 5086] umount2("./16/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5090] umount2("./19/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5086] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5090] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5086] openat(AT_FDCWD, "./16/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5090] lstat("./19/file0", [pid 5086] <... openat resumed>) = 4 [pid 5090] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5086] fstat(4, [pid 5090] umount2("./19/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5086] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5090] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5086] getdents64(4, [pid 5090] openat(AT_FDCWD, "./19/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5086] <... getdents64 resumed>0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5090] <... openat resumed>) = 4 [pid 5086] getdents64(4, [pid 5090] fstat(4, [pid 5086] <... getdents64 resumed>0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5090] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5086] close(4 [pid 5090] getdents64(4, [pid 5086] <... close resumed>) = 0 [pid 5090] <... getdents64 resumed>0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5086] rmdir("./16/file0" [pid 5090] getdents64(4, [pid 5086] <... rmdir resumed>) = 0 [ 151.239258][ T5510] sec_pagetables 0 [ 151.239258][ T5510] percpu 0 [ 151.239258][ T5510] sock 0 [ 151.239258][ T5510] vmalloc 0 [ 151.239258][ T5510] shmem 0 [ 151.239258][ T5510] zswap 0 [ 151.239258][ T5510] zswapped 0 [ 151.239258][ T5510] file_mapped 0 [ 151.239258][ T5510] file_dirty 0 [ 151.239258][ T5510] file_writeback 0 [ 151.239258][ T5510] swapcached 0 [ 151.239258][ T5510] anon_thp 0 [ 151.239258][ T5510] file_thp 0 [ 151.239258][ T5510] shmem_thp 0 [ 151.239258][ T5510] inactive_anon 0 [ 151.239258][ T5510] active_anon 0 [pid 5090] <... getdents64 resumed>0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5086] umount2("./16/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5090] close(4 [pid 5086] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5090] <... close resumed>) = 0 [pid 5086] lstat("./16/cgroup.cpu", [pid 5090] rmdir("./19/file0" [pid 5086] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5090] <... rmdir resumed>) = 0 [pid 5086] unlink("./16/cgroup.cpu" [pid 5090] umount2("./19/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5086] <... unlink resumed>) = 0 [pid 5090] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5086] getdents64(3, [pid 5090] lstat("./19/cgroup.cpu", [pid 5086] <... getdents64 resumed>0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5090] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5086] close(3 [pid 5090] unlink("./19/cgroup.cpu" [pid 5086] <... close resumed>) = 0 [pid 5090] <... unlink resumed>) = 0 [pid 5086] rmdir("./16" [pid 5090] getdents64(3, [pid 5086] <... rmdir resumed>) = 0 [pid 5090] <... getdents64 resumed>0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5086] mkdir("./17", 0777 [pid 5090] close(3 [pid 5086] <... mkdir resumed>) = 0 [pid 5090] <... close resumed>) = 0 [pid 5086] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5526 attached [pid 5090] rmdir("./19" [pid 5526] chdir("./17" [pid 5090] <... rmdir resumed>) = 0 [pid 5086] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 19 [pid 5526] <... chdir resumed>) = 0 [pid 5090] mkdir("./20", 0777 [pid 5526] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5090] <... mkdir resumed>) = 0 [pid 5526] <... prctl resumed>) = 0 [pid 5090] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5526] setpgid(0, 0) = 0 [pid 5090] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 22 [pid 5526] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [pid 5526] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 5526] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 5526] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5526] write(3, "1000", 4) = 4 [ 151.239258][ T5510] inactive_file 0 [ 151.239258][ T5510] active_file 0 [ 151.239258][ T5510] unevictable 0 [ 151.239258][ T5510] slab_reclaimable 6752 [ 151.239258][ T5510] slab_unreclaimable 0 [ 151.239258][ T5510] slab 6752 [ 151.239258][ T5510] workingset_refault_anon 0 [ 151.239258][ T5510] workingset_refault_file 0 [ 151.239258][ T5510] workingset_activate_anon 0 [ 151.239258][ T5510] workingset_activate_file 0 [ 151.239258][ T5510] workingset_restore_anon 0 [ 151.239258][ T5510] workingset_restore_file 0 [pid 5526] close(3) = 0 [pid 5526] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5526] mkdir("./file0", 000) = 0 [pid 5526] open("./file0", O_RDONLY) = 3 [pid 5526] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5526] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5526] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5526] openat(5, "memory.max", O_RDWR) = 6 [ 151.239258][ T5510] workingset_nodereclaim 0 [ 151.239258][ T5510] pgscan 831 [ 151.239258][ T5510] pgsteal 2 [ 151.239258][ T5510] pgscan_kswapd 0 [ 151.239258][ T5510] pgscan_direct 831 [ 151.239258][ T5510] pgscan_khugepaged 0 [ 151.239258][ T5510] pgsteal_kswapd 0 [ 151.239258][ T5510] pgsteal_direct 2 [ 151.239258][ T5510] pgsteal_khugepaged 0 [ 151.239258][ T5510] pgfault 21 [ 151.239258][ T5510] pgmajfault 0 [ 151.239258][ T5510] pgrefill 830 [ 151.239258][ T5510] pgactivate 829 [ 151.239258][ T5510] pgdeactivate 830 [ 151.239258][ T5510] pglazyfree 0 [pid 5526] write(6, "0x000000000000040e", 18./strace-static-x86_64: Process 5527 attached [pid 5527] chdir("./20") = 0 [pid 5527] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5527] setpgid(0, 0) = 0 [pid 5527] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 5527] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 5527] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [ 151.239258][ T5510] pglazyfreed 0 [ 151.239258][ T5510] zswpin 0 [ 151.239258][ T5510] zswpout 0 [ 151.239258][ T5510] thp_fault_alloc 0 [ 151.239258][ T5510] thp_collapse_alloc 0 [ 151.436484][ T5510] Tasks state (memory values in pages): [ 151.442742][ T5510] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5527] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5527] write(3, "1000", 4) = 4 [pid 5527] close(3) = 0 [pid 5527] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5510] <... write resumed>) = 18 [pid 5527] mkdir("./file0", 000 [pid 5510] close(3 [pid 5527] <... mkdir resumed>) = 0 [pid 5527] open("./file0", O_RDONLY [pid 5510] <... close resumed>) = 0 [pid 5527] <... open resumed>) = 3 [pid 5510] close(4 [pid 5527] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5510] <... close resumed>) = 0 [pid 5527] <... mount resumed>) = 0 [pid 5510] close(5 [pid 5527] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5510] <... close resumed>) = 0 [pid 5527] <... openat resumed>) = 4 [ 151.470186][ T5510] Out of memory and no killable processes... [ 151.487610][ T5518] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 151.525190][ T5518] CPU: 0 PID: 5518 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 151.535187][ T5518] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 151.545307][ T5518] Call Trace: [ 151.548628][ T5518] [ 151.551605][ T5518] dump_stack_lvl+0x136/0x150 [ 151.556343][ T5518] dump_header+0x10a/0xd70 [ 151.560825][ T5518] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 151.566979][ T5518] out_of_memory+0xd64/0x1660 [ 151.571733][ T5518] ? oom_killer_disable+0x2b0/0x2b0 [ 151.577003][ T5518] ? find_held_lock+0x2d/0x110 [ 151.581837][ T5518] mem_cgroup_out_of_memory+0x206/0x270 [ 151.587457][ T5518] ? mem_cgroup_margin+0x130/0x130 [ 151.592653][ T5518] ? _raw_spin_unlock_irqrestore+0x54/0x70 [ 151.598548][ T5518] memory_max_write+0x2f9/0x3c0 [ 151.603474][ T5518] ? mem_cgroup_force_empty_write+0x160/0x160 [ 151.609632][ T5518] ? lock_sync+0x190/0x190 [ 151.614114][ T5518] cgroup_file_write+0x1e2/0x7b0 [ 151.619131][ T5518] ? mem_cgroup_force_empty_write+0x160/0x160 [ 151.625280][ T5518] ? kill_css+0x3b0/0x3b0 [ 151.629685][ T5518] ? lock_acquire+0x32/0xc0 [ 151.634273][ T5518] ? kill_css+0x3b0/0x3b0 [ 151.638675][ T5518] kernfs_fop_write_iter+0x3f1/0x600 [ 151.644040][ T5518] vfs_write+0x9ed/0xe10 [ 151.648370][ T5518] ? kernel_write+0x670/0x670 [ 151.653132][ T5518] ? find_held_lock+0x2d/0x110 [ 151.657975][ T5518] ? __fget_light+0x20a/0x270 [ 151.662739][ T5518] ksys_write+0x12b/0x250 [ 151.667243][ T5518] ? __ia32_sys_read+0xb0/0xb0 [pid 5510] close(6 [pid 5527] openat(4, "syz1", O_RDWR|O_PATH [pid 5510] <... close resumed>) = 0 [pid 5527] <... openat resumed>) = 5 [pid 5510] close(7 [pid 5527] openat(5, "memory.max", O_RDWR [pid 5510] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5527] <... openat resumed>) = 6 [pid 5510] close(8 [pid 5527] write(6, "0x000000000000040e", 18 [pid 5510] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5510] close(9) = -1 EBADF (Bad file descriptor) [pid 5510] close(10) = -1 EBADF (Bad file descriptor) [pid 5510] close(11) = -1 EBADF (Bad file descriptor) [pid 5510] close(12) = -1 EBADF (Bad file descriptor) [pid 5510] close(13) = -1 EBADF (Bad file descriptor) [pid 5510] close(14) = -1 EBADF (Bad file descriptor) [pid 5510] close(15) = -1 EBADF (Bad file descriptor) [pid 5510] close(16) = -1 EBADF (Bad file descriptor) [pid 5510] close(17) = -1 EBADF (Bad file descriptor) [pid 5510] close(18) = -1 EBADF (Bad file descriptor) [pid 5510] close(19) = -1 EBADF (Bad file descriptor) [pid 5510] close(20) = -1 EBADF (Bad file descriptor) [pid 5510] close(21) = -1 EBADF (Bad file descriptor) [pid 5510] close(22) = -1 EBADF (Bad file descriptor) [pid 5510] close(23) = -1 EBADF (Bad file descriptor) [pid 5510] close(24) = -1 EBADF (Bad file descriptor) [pid 5510] close(25) = -1 EBADF (Bad file descriptor) [pid 5510] close(26) = -1 EBADF (Bad file descriptor) [pid 5510] close(27) = -1 EBADF (Bad file descriptor) [pid 5510] close(28) = -1 EBADF (Bad file descriptor) [pid 5510] close(29) = -1 EBADF (Bad file descriptor) [pid 5510] exit_group(0) = ? [pid 5510] +++ exited with 0 +++ [pid 5089] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=21, si_uid=0, si_status=0, si_utime=0, si_stime=9 /* 0.09 s */} --- [pid 5089] umount2("./19", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5089] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5089] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5089] umount2("./19/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 151.672083][ T5518] ? lockdep_hardirqs_on+0x7d/0x100 [ 151.677342][ T5518] ? _raw_spin_unlock_irq+0x2e/0x50 [ 151.682612][ T5518] ? ptrace_notify+0xfe/0x140 [ 151.687392][ T5518] do_syscall_64+0x39/0xb0 [ 151.691890][ T5518] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 151.697862][ T5518] RIP: 0033:0x7faecf034129 [ 151.702348][ T5518] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 5089] lstat("./19/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5089] unlink("./19/binderfs") = 0 [pid 5089] umount2("./19/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./19/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5089] unlink("./19/cgroup") = 0 [pid 5089] umount2("./19/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./19/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5089] unlink("./19/cgroup.net") = 0 [pid 5089] umount2("./19/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5089] umount2("./19/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./19/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [ 151.722022][ T5518] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 151.730504][ T5518] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 151.738531][ T5518] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 151.746562][ T5518] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 151.754589][ T5518] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 151.762616][ T5518] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000012 [ 151.770680][ T5518] [pid 5089] umount2("./19/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] openat(AT_FDCWD, "./19/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5089] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5089] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5089] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5089] close(4) = 0 [pid 5089] rmdir("./19/file0") = 0 [pid 5089] umount2("./19/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./19/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5089] unlink("./19/cgroup.cpu") = 0 [pid 5089] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5089] close(3) = 0 [pid 5089] rmdir("./19") = 0 [pid 5089] mkdir("./20", 0777) = 0 [pid 5089] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5534 attached [pid 5534] chdir("./20") = 0 [pid 5089] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 22 [pid 5534] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5534] setpgid(0, 0) = 0 [pid 5534] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 5534] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [ 151.785872][ T5518] memory: usage 8kB, limit 0kB, failcnt 36 [ 151.792161][ T5518] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 151.821636][ T5518] Memory cgroup stats for /syz1: [ 151.821921][ T5518] anon 0 [ 151.821921][ T5518] file 0 [ 151.821921][ T5518] kernel 8192 [pid 5534] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 5534] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5534] write(3, "1000", 4) = 4 [pid 5534] close(3) = 0 [pid 5534] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5534] mkdir("./file0", 000) = 0 [pid 5534] open("./file0", O_RDONLY) = 3 [ 151.821921][ T5518] kernel_stack 0 [ 151.821921][ T5518] pagetables 0 [ 151.821921][ T5518] sec_pagetables 0 [ 151.821921][ T5518] percpu 0 [ 151.821921][ T5518] sock 0 [ 151.821921][ T5518] vmalloc 0 [ 151.821921][ T5518] shmem 0 [ 151.821921][ T5518] zswap 0 [ 151.821921][ T5518] zswapped 0 [ 151.821921][ T5518] file_mapped 0 [ 151.821921][ T5518] file_dirty 0 [ 151.821921][ T5518] file_writeback 0 [ 151.821921][ T5518] swapcached 0 [ 151.821921][ T5518] anon_thp 0 [ 151.821921][ T5518] file_thp 0 [ 151.821921][ T5518] shmem_thp 0 [pid 5534] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5534] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5534] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5534] openat(5, "memory.max", O_RDWR) = 6 [ 151.821921][ T5518] inactive_anon 0 [ 151.821921][ T5518] active_anon 0 [ 151.821921][ T5518] inactive_file 0 [ 151.821921][ T5518] active_file 0 [ 151.821921][ T5518] unevictable 0 [ 151.821921][ T5518] slab_reclaimable 6752 [ 151.821921][ T5518] slab_unreclaimable 0 [ 151.821921][ T5518] slab 6752 [ 151.821921][ T5518] workingset_refault_anon 0 [ 151.821921][ T5518] workingset_refault_file 0 [ 151.821921][ T5518] workingset_activate_anon 0 [ 151.821921][ T5518] workingset_activate_file 0 [ 151.821921][ T5518] workingset_restore_anon 0 [ 151.821921][ T5518] workingset_restore_file 0 [ 151.821921][ T5518] workingset_nodereclaim 0 [ 151.821921][ T5518] pgscan 831 [ 151.821921][ T5518] pgsteal 2 [ 151.821921][ T5518] pgscan_kswapd 0 [ 151.821921][ T5518] pgscan_direct 831 [ 151.821921][ T5518] pgscan_khugepaged 0 [ 151.821921][ T5518] pgsteal_kswapd 0 [ 151.821921][ T5518] pgsteal_direct 2 [ 151.821921][ T5518] pgsteal_khugepaged 0 [ 151.821921][ T5518] pgfault 21 [ 151.821921][ T5518] pgmajfault 0 [ 151.821921][ T5518] pgrefill 830 [ 151.821921][ T5518] pgactivate 829 [ 151.821921][ T5518] pgdeactivate 830 [ 151.821921][ T5518] pglazyfree 0 [ 151.821921][ T5518] pglazyfreed 0 [ 151.821921][ T5518] zswpin 0 [ 151.821921][ T5518] zswpout 0 [ 151.821921][ T5518] thp_fault_alloc 0 [ 151.821921][ T5518] thp_collapse_alloc 0 [ 152.026414][ T5518] Tasks state (memory values in pages): [pid 5534] write(6, "0x000000000000040e", 18 [pid 5518] <... write resumed>) = 18 [ 152.035972][ T5518] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 152.051300][ T5518] Out of memory and no killable processes... [ 152.061128][ T5522] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 152.080738][ T5522] CPU: 0 PID: 5522 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 152.090723][ T5522] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 152.100840][ T5522] Call Trace: [ 152.104166][ T5522] [ 152.107144][ T5522] dump_stack_lvl+0x136/0x150 [ 152.111894][ T5522] dump_header+0x10a/0xd70 [ 152.116382][ T5522] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 152.122559][ T5522] out_of_memory+0xd64/0x1660 [ 152.127353][ T5522] ? oom_killer_disable+0x2b0/0x2b0 [ 152.132632][ T5522] ? find_held_lock+0x2d/0x110 [ 152.137470][ T5522] mem_cgroup_out_of_memory+0x206/0x270 [ 152.143088][ T5522] ? mem_cgroup_margin+0x130/0x130 [ 152.148285][ T5522] ? _raw_spin_unlock_irqrestore+0x54/0x70 [ 152.154179][ T5522] memory_max_write+0x2f9/0x3c0 [ 152.159137][ T5522] ? mem_cgroup_force_empty_write+0x160/0x160 [ 152.165289][ T5522] ? lock_sync+0x190/0x190 [ 152.169792][ T5522] cgroup_file_write+0x1e2/0x7b0 [ 152.174814][ T5522] ? mem_cgroup_force_empty_write+0x160/0x160 [ 152.180967][ T5522] ? kill_css+0x3b0/0x3b0 [pid 5518] close(3) = 0 [pid 5518] close(4) = 0 [pid 5518] close(5) = 0 [pid 5518] close(6) = 0 [pid 5518] close(7) = -1 EBADF (Bad file descriptor) [pid 5518] close(8) = -1 EBADF (Bad file descriptor) [pid 5518] close(9) = -1 EBADF (Bad file descriptor) [pid 5518] close(10) = -1 EBADF (Bad file descriptor) [pid 5518] close(11) = -1 EBADF (Bad file descriptor) [pid 5518] close(12) = -1 EBADF (Bad file descriptor) [pid 5518] close(13) = -1 EBADF (Bad file descriptor) [ 152.185376][ T5522] ? lock_acquire+0x32/0xc0 [ 152.189978][ T5522] ? kill_css+0x3b0/0x3b0 [ 152.194385][ T5522] kernfs_fop_write_iter+0x3f1/0x600 [ 152.199760][ T5522] vfs_write+0x9ed/0xe10 [ 152.204106][ T5522] ? kernel_write+0x670/0x670 [ 152.208869][ T5522] ? find_held_lock+0x2d/0x110 [ 152.213715][ T5522] ? __fget_light+0x20a/0x270 [ 152.218480][ T5522] ksys_write+0x12b/0x250 [ 152.222896][ T5522] ? __ia32_sys_read+0xb0/0xb0 [ 152.227735][ T5522] ? lockdep_hardirqs_on+0x7d/0x100 [ 152.233000][ T5522] ? _raw_spin_unlock_irq+0x2e/0x50 [ 152.238269][ T5522] ? ptrace_notify+0xfe/0x140 [ 152.243035][ T5522] do_syscall_64+0x39/0xb0 [ 152.247526][ T5522] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 152.253518][ T5522] RIP: 0033:0x7faecf034129 [ 152.257987][ T5522] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 152.277665][ T5522] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 5518] close(14) = -1 EBADF (Bad file descriptor) [pid 5518] close(15) = -1 EBADF (Bad file descriptor) [pid 5518] close(16) = -1 EBADF (Bad file descriptor) [pid 5518] close(17) = -1 EBADF (Bad file descriptor) [pid 5518] close(18) = -1 EBADF (Bad file descriptor) [pid 5518] close(19) = -1 EBADF (Bad file descriptor) [pid 5518] close(20) = -1 EBADF (Bad file descriptor) [pid 5518] close(21) = -1 EBADF (Bad file descriptor) [pid 5518] close(22) = -1 EBADF (Bad file descriptor) [pid 5518] close(23) = -1 EBADF (Bad file descriptor) [pid 5518] close(24) = -1 EBADF (Bad file descriptor) [pid 5518] close(25) = -1 EBADF (Bad file descriptor) [pid 5518] close(26) = -1 EBADF (Bad file descriptor) [pid 5518] close(27) = -1 EBADF (Bad file descriptor) [pid 5518] close(28) = -1 EBADF (Bad file descriptor) [pid 5518] close(29) = -1 EBADF (Bad file descriptor) [pid 5518] exit_group(0) = ? [pid 5518] +++ exited with 0 +++ [pid 5087] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=20, si_uid=0, si_status=0, si_utime=0, si_stime=6 /* 0.06 s */} --- [pid 5087] umount2("./18", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5087] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5087] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5087] umount2("./18/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./18/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5087] unlink("./18/binderfs") = 0 [pid 5087] umount2("./18/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./18/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5087] unlink("./18/cgroup") = 0 [pid 5087] umount2("./18/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./18/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5087] unlink("./18/cgroup.net") = 0 [pid 5087] umount2("./18/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5087] umount2("./18/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./18/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5087] umount2("./18/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 152.286147][ T5522] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 152.294173][ T5522] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 152.302202][ T5522] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 152.310230][ T5522] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 152.318257][ T5522] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000010 [ 152.326315][ T5522] [pid 5087] openat(AT_FDCWD, "./18/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5087] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5087] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5087] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5087] close(4) = 0 [pid 5087] rmdir("./18/file0") = 0 [pid 5087] umount2("./18/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./18/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5087] unlink("./18/cgroup.cpu") = 0 [pid 5087] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5087] close(3) = 0 [ 152.352622][ T5522] memory: usage 8kB, limit 0kB, failcnt 36 [ 152.358512][ T5522] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 152.387298][ T5522] Memory cgroup stats for /syz1: [ 152.387610][ T5522] anon 0 [ 152.387610][ T5522] file 0 [ 152.387610][ T5522] kernel 8192 [ 152.387610][ T5522] kernel_stack 0 [ 152.387610][ T5522] pagetables 0 [ 152.387610][ T5522] sec_pagetables 0 [ 152.387610][ T5522] percpu 0 [ 152.387610][ T5522] sock 0 [ 152.387610][ T5522] vmalloc 0 [ 152.387610][ T5522] shmem 0 [ 152.387610][ T5522] zswap 0 [ 152.387610][ T5522] zswapped 0 [ 152.387610][ T5522] file_mapped 0 [ 152.387610][ T5522] file_dirty 0 [ 152.387610][ T5522] file_writeback 0 [ 152.387610][ T5522] swapcached 0 [ 152.387610][ T5522] anon_thp 0 [ 152.387610][ T5522] file_thp 0 [ 152.387610][ T5522] shmem_thp 0 [ 152.387610][ T5522] inactive_anon 0 [ 152.387610][ T5522] active_anon 0 [ 152.387610][ T5522] inactive_file 0 [ 152.387610][ T5522] active_file 0 [ 152.387610][ T5522] unevictable 0 [ 152.387610][ T5522] slab_reclaimable 6752 [ 152.387610][ T5522] slab_unreclaimable 0 [ 152.387610][ T5522] slab 6752 [ 152.387610][ T5522] workingset_refault_anon 0 [ 152.387610][ T5522] workingset_refault_file 0 [ 152.387610][ T5522] workingset_activate_anon 0 [ 152.387610][ T5522] workingset_activate_file 0 [ 152.387610][ T5522] workingset_restore_anon 0 [ 152.387610][ T5522] workingset_restore_file 0 [ 152.387610][ T5522] workingset_nodereclaim 0 [ 152.387610][ T5522] pgscan 831 [ 152.387610][ T5522] pgsteal 2 [ 152.387610][ T5522] pgscan_kswapd 0 [ 152.387610][ T5522] pgscan_direct 831 [ 152.387610][ T5522] pgscan_khugepaged 0 [ 152.387610][ T5522] pgsteal_kswapd 0 [ 152.387610][ T5522] pgsteal_direct 2 [ 152.387610][ T5522] pgsteal_khugepaged 0 [ 152.387610][ T5522] pgfault 21 [ 152.387610][ T5522] pgmajfault 0 [ 152.387610][ T5522] pgrefill 830 [ 152.387610][ T5522] pgactivate 829 [pid 5087] rmdir("./18") = 0 [pid 5087] mkdir("./19", 0777) = 0 [pid 5087] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555c0c5d0) = 21 [ 152.387610][ T5522] pgdeactivate 830 [ 152.387610][ T5522] pglazyfree 0 [ 152.387610][ T5522] pglazyfreed 0 [ 152.387610][ T5522] zswpin 0 [ 152.387610][ T5522] zswpout 0 [ 152.387610][ T5522] thp_fault_alloc 0 [ 152.387610][ T5522] thp_collapse_alloc 0 [ 152.586222][ T5522] Tasks state (memory values in pages): ./strace-static-x86_64: Process 5539 attached [pid 5539] chdir("./19") = 0 [pid 5539] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5539] setpgid(0, 0) = 0 [pid 5539] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 5539] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu" [pid 5522] <... write resumed>) = 18 [pid 5539] <... symlink resumed>) = 0 [pid 5522] close(3 [pid 5539] symlink("/syzcgroup/net/syz2", "./cgroup.net" [pid 5522] <... close resumed>) = 0 [ 152.597937][ T5522] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 152.613821][ T5522] Out of memory and no killable processes... [ 152.620798][ T5526] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 152.647174][ T5526] CPU: 0 PID: 5526 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 152.657170][ T5526] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 152.667283][ T5526] Call Trace: [ 152.670619][ T5526] [ 152.673602][ T5526] dump_stack_lvl+0x136/0x150 [ 152.678345][ T5526] dump_header+0x10a/0xd70 [ 152.682859][ T5526] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 152.689019][ T5526] out_of_memory+0xd64/0x1660 [ 152.693778][ T5526] ? oom_killer_disable+0x2b0/0x2b0 [ 152.699059][ T5526] ? find_held_lock+0x2d/0x110 [ 152.703888][ T5526] mem_cgroup_out_of_memory+0x206/0x270 [ 152.709509][ T5526] ? mem_cgroup_margin+0x130/0x130 [ 152.714706][ T5526] ? _raw_spin_unlock_irqrestore+0x54/0x70 [ 152.720598][ T5526] memory_max_write+0x2f9/0x3c0 [ 152.725532][ T5526] ? mem_cgroup_force_empty_write+0x160/0x160 [ 152.731692][ T5526] ? lock_sync+0x190/0x190 [ 152.736181][ T5526] cgroup_file_write+0x1e2/0x7b0 [ 152.741203][ T5526] ? mem_cgroup_force_empty_write+0x160/0x160 [ 152.747372][ T5526] ? kill_css+0x3b0/0x3b0 [ 152.751780][ T5526] ? lock_acquire+0x32/0xc0 [ 152.756365][ T5526] ? kill_css+0x3b0/0x3b0 [ 152.760770][ T5526] kernfs_fop_write_iter+0x3f1/0x600 [ 152.766136][ T5526] vfs_write+0x9ed/0xe10 [ 152.770458][ T5526] ? kernel_write+0x670/0x670 [ 152.775214][ T5526] ? find_held_lock+0x2d/0x110 [ 152.780058][ T5526] ? __fget_light+0x20a/0x270 [ 152.784820][ T5526] ksys_write+0x12b/0x250 [ 152.789228][ T5526] ? __ia32_sys_read+0xb0/0xb0 [ 152.794068][ T5526] ? lockdep_hardirqs_on+0x7d/0x100 [ 152.799329][ T5526] ? _raw_spin_unlock_irq+0x2e/0x50 [ 152.804603][ T5526] ? ptrace_notify+0xfe/0x140 [ 152.809352][ T5526] do_syscall_64+0x39/0xb0 [ 152.813848][ T5526] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 152.819820][ T5526] RIP: 0033:0x7faecf034129 [ 152.824284][ T5526] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 152.843952][ T5526] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 5539] <... symlink resumed>) = 0 [ 152.852436][ T5526] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 152.860465][ T5526] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 152.868492][ T5526] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 152.876522][ T5526] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 152.884554][ T5526] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000011 [ 152.892703][ T5526] [pid 5539] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5522] close(4 [pid 5539] write(3, "1000", 4 [pid 5522] <... close resumed>) = 0 [pid 5539] <... write resumed>) = 4 [ 152.905745][ T5526] memory: usage 8kB, limit 0kB, failcnt 36 [ 152.912234][ T5526] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 152.919828][ T5526] Memory cgroup stats for /syz1: [ 152.920118][ T5526] anon 0 [ 152.920118][ T5526] file 0 [ 152.920118][ T5526] kernel 8192 [ 152.920118][ T5526] kernel_stack 0 [ 152.920118][ T5526] pagetables 0 [ 152.920118][ T5526] sec_pagetables 0 [ 152.920118][ T5526] percpu 0 [ 152.920118][ T5526] sock 0 [ 152.920118][ T5526] vmalloc 0 [ 152.920118][ T5526] shmem 0 [ 152.920118][ T5526] zswap 0 [ 152.920118][ T5526] zswapped 0 [ 152.920118][ T5526] file_mapped 0 [ 152.920118][ T5526] file_dirty 0 [ 152.920118][ T5526] file_writeback 0 [ 152.920118][ T5526] swapcached 0 [ 152.920118][ T5526] anon_thp 0 [ 152.920118][ T5526] file_thp 0 [ 152.920118][ T5526] shmem_thp 0 [ 152.920118][ T5526] inactive_anon 0 [ 152.920118][ T5526] active_anon 0 [ 152.920118][ T5526] inactive_file 0 [ 152.920118][ T5526] active_file 0 [ 152.920118][ T5526] unevictable 0 [ 152.920118][ T5526] slab_reclaimable 6752 [ 152.920118][ T5526] slab_unreclaimable 0 [ 152.920118][ T5526] slab 6752 [ 152.920118][ T5526] workingset_refault_anon 0 [ 152.920118][ T5526] workingset_refault_file 0 [ 152.920118][ T5526] workingset_activate_anon 0 [ 152.920118][ T5526] workingset_activate_file 0 [ 152.920118][ T5526] workingset_restore_anon 0 [ 152.920118][ T5526] workingset_restore_file 0 [ 152.920118][ T5526] workingset_nodereclaim 0 [ 152.920118][ T5526] pgscan 831 [ 152.920118][ T5526] pgsteal 2 [ 152.920118][ T5526] pgscan_kswapd 0 [ 152.920118][ T5526] pgscan_direct 831 [pid 5539] close(3 [pid 5522] close(5 [pid 5539] <... close resumed>) = 0 [pid 5522] <... close resumed>) = 0 [pid 5539] symlink("/dev/binderfs", "./binderfs" [pid 5522] close(6) = 0 [pid 5539] <... symlink resumed>) = 0 [pid 5522] close(7) = -1 EBADF (Bad file descriptor) [pid 5539] mkdir("./file0", 000 [pid 5522] close(8) = -1 EBADF (Bad file descriptor) [pid 5522] close(9 [pid 5539] <... mkdir resumed>) = 0 [pid 5522] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5522] close(10) = -1 EBADF (Bad file descriptor) [pid 5522] close(11 [pid 5539] open("./file0", O_RDONLY [pid 5522] <... close resumed>) = -1 EBADF (Bad file descriptor) [ 152.920118][ T5526] pgscan_khugepaged 0 [ 152.920118][ T5526] pgsteal_kswapd 0 [ 152.920118][ T5526] pgsteal_direct 2 [ 152.920118][ T5526] pgsteal_khugepaged 0 [ 152.920118][ T5526] pgfault 21 [ 152.920118][ T5526] pgmajfault 0 [ 152.920118][ T5526] pgrefill 830 [ 152.920118][ T5526] pgactivate 829 [ 152.920118][ T5526] pgdeactivate 830 [ 152.920118][ T5526] pglazyfree 0 [ 152.920118][ T5526] pglazyfreed 0 [ 152.920118][ T5526] zswpin 0 [ 152.920118][ T5526] zswpout 0 [ 152.920118][ T5526] thp_fault_alloc 0 [ 152.920118][ T5526] thp_collapse_alloc 0 [pid 5539] <... open resumed>) = 3 [pid 5522] close(12 [pid 5539] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5522] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5539] <... mount resumed>) = 0 [pid 5522] close(13 [pid 5539] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5522] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5539] <... openat resumed>) = 4 [pid 5522] close(14 [pid 5539] openat(4, "syz1", O_RDWR|O_PATH [pid 5522] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5539] <... openat resumed>) = 5 [pid 5522] close(15 [pid 5539] openat(5, "memory.max", O_RDWR [pid 5522] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5539] <... openat resumed>) = 6 [pid 5526] <... write resumed>) = 18 [ 153.131109][ T5526] Tasks state (memory values in pages): [ 153.140456][ T5526] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 153.163775][ T5526] Out of memory and no killable processes... [ 153.169919][ T5527] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 153.184799][ T5527] CPU: 1 PID: 5527 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 153.194787][ T5527] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 153.204887][ T5527] Call Trace: [ 153.208210][ T5527] [ 153.211177][ T5527] dump_stack_lvl+0x136/0x150 [ 153.215918][ T5527] dump_header+0x10a/0xd70 [ 153.220389][ T5527] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 153.226543][ T5527] out_of_memory+0xd64/0x1660 [pid 5522] close(16 [pid 5539] write(6, "0x000000000000040e", 18 [pid 5526] close(3 [pid 5522] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5526] <... close resumed>) = 0 [pid 5522] close(17 [pid 5526] close(4 [pid 5522] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5526] <... close resumed>) = 0 [pid 5522] close(18 [pid 5526] close(5 [pid 5522] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5526] <... close resumed>) = 0 [pid 5522] close(19 [pid 5526] close(6 [pid 5522] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5526] <... close resumed>) = 0 [pid 5522] close(20 [pid 5526] close(7 [pid 5522] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5526] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5522] close(21 [pid 5526] close(8 [pid 5522] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5526] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5522] close(22 [pid 5526] close(9 [pid 5522] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5526] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5522] close(23 [pid 5526] close(10 [pid 5522] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5526] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5522] close(24 [pid 5526] close(11 [pid 5522] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5526] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5522] close(25 [pid 5526] close(12 [pid 5522] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5526] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5522] close(26 [pid 5526] close(13 [pid 5522] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5526] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5522] close(27 [pid 5526] close(14 [pid 5522] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5526] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5522] close(28 [pid 5526] close(15 [pid 5522] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5526] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5522] close(29 [pid 5526] close(16 [pid 5522] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5526] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5522] exit_group(0 [pid 5526] close(17 [pid 5522] <... exit_group resumed>) = ? [pid 5526] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5522] +++ exited with 0 +++ [pid 5526] close(18 [pid 5085] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=18, si_uid=0, si_status=0, si_utime=0, si_stime=9 /* 0.09 s */} --- [pid 5526] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5526] close(19) = -1 EBADF (Bad file descriptor) [pid 5085] umount2("./16", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5526] close(20 [pid 5085] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5526] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5085] openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5526] close(21 [pid 5085] <... openat resumed>) = 3 [pid 5526] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5085] fstat(3, [pid 5526] close(22 [pid 5085] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5526] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5085] getdents64(3, [pid 5526] close(23 [pid 5085] <... getdents64 resumed>0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5526] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5085] umount2("./16/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5526] close(24 [pid 5085] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5526] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5085] lstat("./16/binderfs", [pid 5526] close(25 [pid 5085] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5526] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5085] unlink("./16/binderfs" [pid 5526] close(26 [pid 5085] <... unlink resumed>) = 0 [pid 5526] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5085] umount2("./16/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5526] close(27 [pid 5085] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5526] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5085] lstat("./16/cgroup", [pid 5526] close(28 [pid 5085] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5526] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5085] unlink("./16/cgroup" [pid 5526] close(29 [pid 5085] <... unlink resumed>) = 0 [pid 5526] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5085] umount2("./16/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5526] exit_group(0 [pid 5085] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5526] <... exit_group resumed>) = ? [pid 5085] lstat("./16/cgroup.net", [pid 5526] +++ exited with 0 +++ [pid 5085] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5085] unlink("./16/cgroup.net") = 0 [pid 5085] umount2("./16/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5086] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=19, si_uid=0, si_status=0, si_utime=0, si_stime=10 /* 0.10 s */} --- [pid 5086] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5086] umount2("./17", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5086] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5086] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5086] umount2("./17/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./17/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5086] unlink("./17/binderfs") = 0 [ 153.231306][ T5527] ? oom_killer_disable+0x2b0/0x2b0 [ 153.236595][ T5527] mem_cgroup_out_of_memory+0x206/0x270 [ 153.242232][ T5527] ? mem_cgroup_margin+0x130/0x130 [ 153.247443][ T5527] memory_max_write+0x2f9/0x3c0 [ 153.252392][ T5527] ? mem_cgroup_force_empty_write+0x160/0x160 [ 153.258545][ T5527] ? lock_sync+0x190/0x190 [ 153.263037][ T5527] cgroup_file_write+0x1e2/0x7b0 [ 153.268072][ T5527] ? mem_cgroup_force_empty_write+0x160/0x160 [ 153.274221][ T5527] ? kill_css+0x3b0/0x3b0 [ 153.278623][ T5527] ? lock_acquire+0x32/0xc0 [pid 5086] umount2("./17/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./17/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5086] unlink("./17/cgroup") = 0 [ 153.283207][ T5527] ? kill_css+0x3b0/0x3b0 [ 153.287616][ T5527] kernfs_fop_write_iter+0x3f1/0x600 [ 153.292988][ T5527] vfs_write+0x9ed/0xe10 [ 153.297311][ T5527] ? kernel_write+0x670/0x670 [ 153.302037][ T5527] ? find_held_lock+0x2d/0x110 [ 153.306845][ T5527] ? __fget_light+0x20a/0x270 [ 153.311590][ T5527] ksys_write+0x12b/0x250 [ 153.315961][ T5527] ? __ia32_sys_read+0xb0/0xb0 [ 153.320767][ T5527] ? lockdep_hardirqs_on+0x7d/0x100 [ 153.326000][ T5527] ? _raw_spin_unlock_irq+0x2e/0x50 [ 153.331257][ T5527] ? ptrace_notify+0xfe/0x140 [ 153.335974][ T5527] do_syscall_64+0x39/0xb0 [ 153.340436][ T5527] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 153.346369][ T5527] RIP: 0033:0x7faecf034129 [ 153.350812][ T5527] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 153.370452][ T5527] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 5086] umount2("./17/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5085] <... umount2 resumed>) = 0 [ 153.378906][ T5527] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 153.386908][ T5527] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 153.394920][ T5527] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 153.402918][ T5527] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 153.410921][ T5527] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000014 [ 153.418943][ T5527] [pid 5086] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5085] umount2("./16/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5086] lstat("./17/cgroup.net", [pid 5085] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5086] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5085] lstat("./16/file0", [pid 5086] unlink("./17/cgroup.net") = 0 [pid 5085] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5086] umount2("./17/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5085] umount2("./16/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] openat(AT_FDCWD, "./16/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5085] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5085] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5085] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5085] close(4) = 0 [pid 5085] rmdir("./16/file0") = 0 [pid 5085] umount2("./16/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./16/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5085] unlink("./16/cgroup.cpu") = 0 [pid 5085] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5085] close(3) = 0 [pid 5086] <... umount2 resumed>) = 0 [pid 5085] rmdir("./16" [pid 5086] umount2("./17/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5085] <... rmdir resumed>) = 0 [pid 5086] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5085] mkdir("./17", 0777 [pid 5086] lstat("./17/file0", [pid 5085] <... mkdir resumed>) = 0 [pid 5086] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5085] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5086] umount2("./17/file0", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5547 attached ) = -1 EINVAL (Invalid argument) [pid 5547] chdir("./17") = 0 [pid 5086] openat(AT_FDCWD, "./17/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5085] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 19 [pid 5547] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5086] <... openat resumed>) = 4 [pid 5547] setpgid(0, 0 [pid 5086] fstat(4, [pid 5547] <... setpgid resumed>) = 0 [pid 5086] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5547] symlink("/syzcgroup/unified/syz0", "./cgroup" [pid 5086] getdents64(4, [pid 5547] <... symlink resumed>) = 0 [pid 5547] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu" [pid 5086] <... getdents64 resumed>0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5547] <... symlink resumed>) = 0 [pid 5086] getdents64(4, [ 153.440032][ T5527] memory: usage 8kB, limit 0kB, failcnt 36 [ 153.475764][ T5527] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [pid 5547] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 5086] <... getdents64 resumed>0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5547] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5547] write(3, "1000", 4) = 4 [pid 5547] close(3) = 0 [pid 5547] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5547] mkdir("./file0", 000) = 0 [pid 5547] open("./file0", O_RDONLY) = 3 [ 153.498647][ T5527] Memory cgroup stats for /syz1: [ 153.498932][ T5527] anon 0 [ 153.498932][ T5527] file 0 [ 153.498932][ T5527] kernel 8192 [ 153.498932][ T5527] kernel_stack 0 [ 153.498932][ T5527] pagetables 0 [ 153.498932][ T5527] sec_pagetables 0 [ 153.498932][ T5527] percpu 0 [ 153.498932][ T5527] sock 0 [ 153.498932][ T5527] vmalloc 0 [ 153.498932][ T5527] shmem 0 [ 153.498932][ T5527] zswap 0 [ 153.498932][ T5527] zswapped 0 [ 153.498932][ T5527] file_mapped 0 [ 153.498932][ T5527] file_dirty 0 [pid 5547] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5547] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5547] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5547] openat(5, "memory.max", O_RDWR) = 6 [ 153.498932][ T5527] file_writeback 0 [ 153.498932][ T5527] swapcached 0 [ 153.498932][ T5527] anon_thp 0 [ 153.498932][ T5527] file_thp 0 [ 153.498932][ T5527] shmem_thp 0 [ 153.498932][ T5527] inactive_anon 0 [ 153.498932][ T5527] active_anon 0 [ 153.498932][ T5527] inactive_file 0 [ 153.498932][ T5527] active_file 0 [ 153.498932][ T5527] unevictable 0 [ 153.498932][ T5527] slab_reclaimable 6752 [ 153.498932][ T5527] slab_unreclaimable 0 [ 153.498932][ T5527] slab 6752 [ 153.498932][ T5527] workingset_refault_anon 0 [ 153.498932][ T5527] workingset_refault_file 0 [ 153.498932][ T5527] workingset_activate_anon 0 [ 153.498932][ T5527] workingset_activate_file 0 [ 153.498932][ T5527] workingset_restore_anon 0 [ 153.498932][ T5527] workingset_restore_file 0 [ 153.498932][ T5527] workingset_nodereclaim 0 [ 153.498932][ T5527] pgscan 831 [ 153.498932][ T5527] pgsteal 2 [ 153.498932][ T5527] pgscan_kswapd 0 [ 153.498932][ T5527] pgscan_direct 831 [ 153.498932][ T5527] pgscan_khugepaged 0 [ 153.498932][ T5527] pgsteal_kswapd 0 [ 153.498932][ T5527] pgsteal_direct 2 [ 153.498932][ T5527] pgsteal_khugepaged 0 [pid 5547] write(6, "0x000000000000040e", 18 [pid 5086] close(4) = 0 [pid 5086] rmdir("./17/file0") = 0 [pid 5086] umount2("./17/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./17/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5086] unlink("./17/cgroup.cpu") = 0 [pid 5086] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5086] close(3) = 0 [pid 5086] rmdir("./17") = 0 [pid 5086] mkdir("./18", 0777) = 0 [pid 5086] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555c0c5d0) = 20 ./strace-static-x86_64: Process 5548 attached [ 153.498932][ T5527] pgfault 21 [ 153.498932][ T5527] pgmajfault 0 [ 153.498932][ T5527] pgrefill 830 [ 153.498932][ T5527] pgactivate 829 [ 153.498932][ T5527] pgdeactivate 830 [ 153.498932][ T5527] pglazyfree 0 [ 153.498932][ T5527] pglazyfreed 0 [ 153.498932][ T5527] zswpin 0 [ 153.498932][ T5527] zswpout 0 [ 153.498932][ T5527] thp_fault_alloc 0 [ 153.498932][ T5527] thp_collapse_alloc 0 [ 153.690151][ T5527] Tasks state (memory values in pages): [pid 5548] chdir("./18") = 0 [pid 5548] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5527] <... write resumed>) = 18 [pid 5548] <... prctl resumed>) = 0 [pid 5527] close(3 [pid 5548] setpgid(0, 0 [pid 5527] <... close resumed>) = 0 [pid 5548] <... setpgid resumed>) = 0 [pid 5527] close(4 [pid 5548] symlink("/syzcgroup/unified/syz3", "./cgroup" [pid 5527] <... close resumed>) = 0 [pid 5548] <... symlink resumed>) = 0 [pid 5527] close(5 [pid 5548] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu" [pid 5527] <... close resumed>) = 0 [pid 5548] <... symlink resumed>) = 0 [pid 5527] close(6 [pid 5548] symlink("/syzcgroup/net/syz3", "./cgroup.net" [pid 5527] <... close resumed>) = 0 [pid 5548] <... symlink resumed>) = 0 [pid 5527] close(7 [pid 5548] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5527] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5548] <... openat resumed>) = 3 [pid 5527] close(8 [pid 5548] write(3, "1000", 4 [pid 5527] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5548] <... write resumed>) = 4 [pid 5527] close(9 [pid 5548] close(3 [pid 5527] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5548] <... close resumed>) = 0 [pid 5527] close(10 [pid 5548] symlink("/dev/binderfs", "./binderfs" [pid 5527] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5548] <... symlink resumed>) = 0 [pid 5527] close(11 [pid 5548] mkdir("./file0", 000 [pid 5527] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5548] <... mkdir resumed>) = 0 [pid 5527] close(12 [pid 5548] open("./file0", O_RDONLY [pid 5527] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5548] <... open resumed>) = 3 [pid 5527] close(13 [pid 5548] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5527] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5548] <... mount resumed>) = 0 [pid 5527] close(14 [pid 5548] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5527] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5548] <... openat resumed>) = 4 [pid 5527] close(15 [pid 5548] openat(4, "syz1", O_RDWR|O_PATH [pid 5527] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5548] <... openat resumed>) = 5 [pid 5527] close(16 [pid 5548] openat(5, "memory.max", O_RDWR [pid 5527] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5548] <... openat resumed>) = 6 [pid 5527] close(17 [pid 5548] write(6, "0x000000000000040e", 18 [pid 5527] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5527] close(18) = -1 EBADF (Bad file descriptor) [pid 5527] close(19) = -1 EBADF (Bad file descriptor) [pid 5527] close(20) = -1 EBADF (Bad file descriptor) [pid 5527] close(21) = -1 EBADF (Bad file descriptor) [pid 5527] close(22) = -1 EBADF (Bad file descriptor) [pid 5527] close(23) = -1 EBADF (Bad file descriptor) [pid 5527] close(24) = -1 EBADF (Bad file descriptor) [pid 5527] close(25) = -1 EBADF (Bad file descriptor) [pid 5527] close(26) = -1 EBADF (Bad file descriptor) [pid 5527] close(27) = -1 EBADF (Bad file descriptor) [pid 5527] close(28) = -1 EBADF (Bad file descriptor) [pid 5527] close(29) = -1 EBADF (Bad file descriptor) [pid 5527] exit_group(0) = ? [ 153.696714][ T5527] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 153.707001][ T5527] Out of memory and no killable processes... [ 153.713652][ T5534] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5527] +++ exited with 0 +++ [pid 5090] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=22, si_uid=0, si_status=0, si_utime=0, si_stime=11 /* 0.11 s */} --- [pid 5090] umount2("./20", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] openat(AT_FDCWD, "./20", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5090] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5090] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5090] umount2("./20/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./20/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5090] unlink("./20/binderfs") = 0 [pid 5090] umount2("./20/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./20/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5090] unlink("./20/cgroup") = 0 [pid 5090] umount2("./20/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./20/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [ 153.755187][ T5534] CPU: 0 PID: 5534 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 153.765178][ T5534] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 153.775292][ T5534] Call Trace: [ 153.778623][ T5534] [ 153.781599][ T5534] dump_stack_lvl+0x136/0x150 [ 153.786345][ T5534] dump_header+0x10a/0xd70 [ 153.790844][ T5534] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 153.797002][ T5534] out_of_memory+0xd64/0x1660 [pid 5090] unlink("./20/cgroup.net") = 0 [ 153.801770][ T5534] ? oom_killer_disable+0x2b0/0x2b0 [ 153.807080][ T5534] mem_cgroup_out_of_memory+0x206/0x270 [ 153.812704][ T5534] ? mem_cgroup_margin+0x130/0x130 [ 153.817880][ T5534] memory_max_write+0x2f9/0x3c0 [ 153.822796][ T5534] ? mem_cgroup_force_empty_write+0x160/0x160 [ 153.828916][ T5534] ? lock_sync+0x190/0x190 [ 153.833385][ T5534] cgroup_file_write+0x1e2/0x7b0 [ 153.838368][ T5534] ? mem_cgroup_force_empty_write+0x160/0x160 [ 153.844491][ T5534] ? kill_css+0x3b0/0x3b0 [ 153.848871][ T5534] ? lock_acquire+0x32/0xc0 [ 153.853420][ T5534] ? kill_css+0x3b0/0x3b0 [ 153.857791][ T5534] kernfs_fop_write_iter+0x3f1/0x600 [ 153.863127][ T5534] vfs_write+0x9ed/0xe10 [ 153.867444][ T5534] ? kernel_write+0x670/0x670 [ 153.872282][ T5534] ? find_held_lock+0x2d/0x110 [ 153.877098][ T5534] ? __fget_light+0x20a/0x270 [ 153.881932][ T5534] ksys_write+0x12b/0x250 [ 153.886317][ T5534] ? __ia32_sys_read+0xb0/0xb0 [ 153.891126][ T5534] ? lockdep_hardirqs_on+0x7d/0x100 [ 153.896368][ T5534] ? _raw_spin_unlock_irq+0x2e/0x50 [ 153.901615][ T5534] ? ptrace_notify+0xfe/0x140 [ 153.906333][ T5534] do_syscall_64+0x39/0xb0 [ 153.910799][ T5534] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 153.916732][ T5534] RIP: 0033:0x7faecf034129 [ 153.921176][ T5534] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 153.940810][ T5534] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 153.949254][ T5534] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 153.957249][ T5534] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 153.965241][ T5534] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 153.973233][ T5534] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 153.981228][ T5534] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000014 [ 153.989246][ T5534] [pid 5090] umount2("./20/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5090] umount2("./20/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 154.006687][ T5534] memory: usage 8kB, limit 0kB, failcnt 36 [ 154.014492][ T5534] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 154.022990][ T5534] Memory cgroup stats for /syz1: [ 154.023291][ T5534] anon 0 [ 154.023291][ T5534] file 0 [ 154.023291][ T5534] kernel 8192 [ 154.023291][ T5534] kernel_stack 0 [ 154.023291][ T5534] pagetables 0 [ 154.023291][ T5534] sec_pagetables 0 [ 154.023291][ T5534] percpu 0 [ 154.023291][ T5534] sock 0 [ 154.023291][ T5534] vmalloc 0 [pid 5090] lstat("./20/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5090] umount2("./20/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] openat(AT_FDCWD, "./20/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5090] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5090] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5090] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5090] close(4) = 0 [pid 5090] rmdir("./20/file0") = 0 [pid 5090] umount2("./20/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./20/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5090] unlink("./20/cgroup.cpu") = 0 [pid 5090] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5090] close(3) = 0 [pid 5090] rmdir("./20") = 0 [pid 5090] mkdir("./21", 0777) = 0 [pid 5090] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555c0c5d0) = 23 [ 154.023291][ T5534] shmem 0 [ 154.023291][ T5534] zswap 0 [ 154.023291][ T5534] zswapped 0 [ 154.023291][ T5534] file_mapped 0 [ 154.023291][ T5534] file_dirty 0 [ 154.023291][ T5534] file_writeback 0 [ 154.023291][ T5534] swapcached 0 [ 154.023291][ T5534] anon_thp 0 [ 154.023291][ T5534] file_thp 0 [ 154.023291][ T5534] shmem_thp 0 [ 154.023291][ T5534] inactive_anon 0 [ 154.023291][ T5534] active_anon 0 [ 154.023291][ T5534] inactive_file 0 [ 154.023291][ T5534] active_file 0 [ 154.023291][ T5534] unevictable 0 [ 154.023291][ T5534] slab_reclaimable 6752 [ 154.023291][ T5534] slab_unreclaimable 0 [ 154.023291][ T5534] slab 6752 [ 154.023291][ T5534] workingset_refault_anon 0 [ 154.023291][ T5534] workingset_refault_file 0 [ 154.023291][ T5534] workingset_activate_anon 0 [ 154.023291][ T5534] workingset_activate_file 0 [ 154.023291][ T5534] workingset_restore_anon 0 [ 154.023291][ T5534] workingset_restore_file 0 [ 154.023291][ T5534] workingset_nodereclaim 0 [ 154.023291][ T5534] pgscan 831 [ 154.023291][ T5534] pgsteal 2 [ 154.023291][ T5534] pgscan_kswapd 0 ./strace-static-x86_64: Process 5551 attached [pid 5551] chdir("./21") = 0 [pid 5551] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5551] setpgid(0, 0) = 0 [pid 5551] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 5551] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 5551] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [ 154.023291][ T5534] pgscan_direct 831 [ 154.023291][ T5534] pgscan_khugepaged 0 [ 154.023291][ T5534] pgsteal_kswapd 0 [ 154.023291][ T5534] pgsteal_direct 2 [ 154.023291][ T5534] pgsteal_khugepaged 0 [ 154.023291][ T5534] pgfault 21 [ 154.023291][ T5534] pgmajfault 0 [ 154.023291][ T5534] pgrefill 830 [ 154.023291][ T5534] pgactivate 829 [ 154.023291][ T5534] pgdeactivate 830 [ 154.023291][ T5534] pglazyfree 0 [ 154.023291][ T5534] pglazyfreed 0 [ 154.023291][ T5534] zswpin 0 [ 154.023291][ T5534] zswpout 0 [ 154.023291][ T5534] thp_fault_alloc 0 [pid 5551] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5551] write(3, "1000", 4) = 4 [pid 5551] close(3) = 0 [pid 5551] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5551] mkdir("./file0", 000) = 0 [pid 5551] open("./file0", O_RDONLY [pid 5534] <... write resumed>) = 18 [ 154.023291][ T5534] thp_collapse_alloc 0 [ 154.214714][ T5534] Tasks state (memory values in pages): [ 154.221239][ T5534] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 154.234550][ T5534] Out of memory and no killable processes... [ 154.243183][ T5539] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 154.257585][ T5539] CPU: 0 PID: 5539 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 154.267570][ T5539] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 154.277682][ T5539] Call Trace: [ 154.281004][ T5539] [ 154.284007][ T5539] dump_stack_lvl+0x136/0x150 [ 154.288760][ T5539] dump_header+0x10a/0xd70 [ 154.293243][ T5539] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 154.299416][ T5539] out_of_memory+0xd64/0x1660 [ 154.304182][ T5539] ? oom_killer_disable+0x2b0/0x2b0 [ 154.309457][ T5539] ? find_held_lock+0x2d/0x110 [ 154.314287][ T5539] mem_cgroup_out_of_memory+0x206/0x270 [ 154.319917][ T5539] ? mem_cgroup_margin+0x130/0x130 [ 154.325105][ T5539] ? _raw_spin_unlock_irqrestore+0x54/0x70 [ 154.330997][ T5539] memory_max_write+0x2f9/0x3c0 [ 154.335928][ T5539] ? mem_cgroup_force_empty_write+0x160/0x160 [ 154.342054][ T5539] ? lock_sync+0x190/0x190 [ 154.346521][ T5539] cgroup_file_write+0x1e2/0x7b0 [ 154.351506][ T5539] ? mem_cgroup_force_empty_write+0x160/0x160 [ 154.357620][ T5539] ? kill_css+0x3b0/0x3b0 [ 154.361996][ T5539] ? lock_acquire+0x32/0xc0 [ 154.366549][ T5539] ? kill_css+0x3b0/0x3b0 [ 154.370921][ T5539] kernfs_fop_write_iter+0x3f1/0x600 [ 154.376257][ T5539] vfs_write+0x9ed/0xe10 [ 154.380549][ T5539] ? kernel_write+0x670/0x670 [ 154.385280][ T5539] ? find_held_lock+0x2d/0x110 [ 154.390084][ T5539] ? __fget_light+0x20a/0x270 [ 154.394814][ T5539] ksys_write+0x12b/0x250 [ 154.399192][ T5539] ? __ia32_sys_read+0xb0/0xb0 [ 154.404001][ T5539] ? lockdep_hardirqs_on+0x7d/0x100 [ 154.409235][ T5539] ? _raw_spin_unlock_irq+0x2e/0x50 [ 154.414473][ T5539] ? ptrace_notify+0xfe/0x140 [ 154.419191][ T5539] do_syscall_64+0x39/0xb0 [ 154.423671][ T5539] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 154.429601][ T5539] RIP: 0033:0x7faecf034129 [ 154.434043][ T5539] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 5551] <... open resumed>) = 3 [pid 5534] close(3 [pid 5551] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [ 154.453677][ T5539] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 154.462130][ T5539] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 154.470134][ T5539] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 154.478130][ T5539] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 154.486123][ T5539] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 154.494121][ T5539] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000013 [ 154.502144][ T5539] [pid 5551] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5534] <... close resumed>) = 0 [pid 5551] <... openat resumed>) = 4 [pid 5534] close(4) = 0 [pid 5551] openat(4, "syz1", O_RDWR|O_PATH [pid 5534] close(5 [pid 5551] <... openat resumed>) = 5 [pid 5534] <... close resumed>) = 0 [pid 5551] openat(5, "memory.max", O_RDWR [ 154.529028][ T5539] memory: usage 8kB, limit 0kB, failcnt 36 [ 154.543927][ T5539] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 154.571854][ T5539] Memory cgroup stats for /syz1: [ 154.572174][ T5539] anon 0 [ 154.572174][ T5539] file 0 [ 154.572174][ T5539] kernel 8192 [ 154.572174][ T5539] kernel_stack 0 [ 154.572174][ T5539] pagetables 0 [ 154.572174][ T5539] sec_pagetables 0 [ 154.572174][ T5539] percpu 0 [ 154.572174][ T5539] sock 0 [ 154.572174][ T5539] vmalloc 0 [ 154.572174][ T5539] shmem 0 [ 154.572174][ T5539] zswap 0 [ 154.572174][ T5539] zswapped 0 [ 154.572174][ T5539] file_mapped 0 [ 154.572174][ T5539] file_dirty 0 [pid 5534] close(6 [pid 5551] <... openat resumed>) = 6 [pid 5534] <... close resumed>) = 0 [pid 5551] write(6, "0x000000000000040e", 18 [ 154.572174][ T5539] file_writeback 0 [ 154.572174][ T5539] swapcached 0 [ 154.572174][ T5539] anon_thp 0 [ 154.572174][ T5539] file_thp 0 [ 154.572174][ T5539] shmem_thp 0 [ 154.572174][ T5539] inactive_anon 0 [ 154.572174][ T5539] active_anon 0 [ 154.572174][ T5539] inactive_file 0 [ 154.572174][ T5539] active_file 0 [ 154.572174][ T5539] unevictable 0 [ 154.572174][ T5539] slab_reclaimable 6752 [ 154.572174][ T5539] slab_unreclaimable 0 [ 154.572174][ T5539] slab 6752 [ 154.572174][ T5539] workingset_refault_anon 0 [ 154.572174][ T5539] workingset_refault_file 0 [ 154.572174][ T5539] workingset_activate_anon 0 [ 154.572174][ T5539] workingset_activate_file 0 [ 154.572174][ T5539] workingset_restore_anon 0 [ 154.572174][ T5539] workingset_restore_file 0 [ 154.572174][ T5539] workingset_nodereclaim 0 [ 154.572174][ T5539] pgscan 831 [ 154.572174][ T5539] pgsteal 2 [ 154.572174][ T5539] pgscan_kswapd 0 [ 154.572174][ T5539] pgscan_direct 831 [ 154.572174][ T5539] pgscan_khugepaged 0 [ 154.572174][ T5539] pgsteal_kswapd 0 [ 154.572174][ T5539] pgsteal_direct 2 [ 154.572174][ T5539] pgsteal_khugepaged 0 [pid 5534] close(7) = -1 EBADF (Bad file descriptor) [pid 5534] close(8) = -1 EBADF (Bad file descriptor) [pid 5534] close(9) = -1 EBADF (Bad file descriptor) [pid 5534] close(10) = -1 EBADF (Bad file descriptor) [pid 5534] close(11) = -1 EBADF (Bad file descriptor) [pid 5534] close(12) = -1 EBADF (Bad file descriptor) [pid 5534] close(13) = -1 EBADF (Bad file descriptor) [pid 5534] close(14) = -1 EBADF (Bad file descriptor) [pid 5534] close(15) = -1 EBADF (Bad file descriptor) [pid 5534] close(16) = -1 EBADF (Bad file descriptor) [pid 5534] close(17) = -1 EBADF (Bad file descriptor) [pid 5534] close(18) = -1 EBADF (Bad file descriptor) [pid 5534] close(19) = -1 EBADF (Bad file descriptor) [pid 5534] close(20) = -1 EBADF (Bad file descriptor) [pid 5534] close(21) = -1 EBADF (Bad file descriptor) [pid 5534] close(22) = -1 EBADF (Bad file descriptor) [pid 5534] close(23) = -1 EBADF (Bad file descriptor) [pid 5534] close(24) = -1 EBADF (Bad file descriptor) [pid 5534] close(25) = -1 EBADF (Bad file descriptor) [pid 5534] close(26) = -1 EBADF (Bad file descriptor) [pid 5534] close(27) = -1 EBADF (Bad file descriptor) [pid 5534] close(28) = -1 EBADF (Bad file descriptor) [pid 5534] close(29) = -1 EBADF (Bad file descriptor) [pid 5534] exit_group(0) = ? [pid 5534] +++ exited with 0 +++ [pid 5089] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=22, si_uid=0, si_status=0, si_utime=0, si_stime=6 /* 0.06 s */} --- [pid 5089] umount2("./20", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 154.572174][ T5539] pgfault 21 [ 154.572174][ T5539] pgmajfault 0 [ 154.572174][ T5539] pgrefill 830 [ 154.572174][ T5539] pgactivate 829 [ 154.572174][ T5539] pgdeactivate 830 [ 154.572174][ T5539] pglazyfree 0 [ 154.572174][ T5539] pglazyfreed 0 [ 154.572174][ T5539] zswpin 0 [ 154.572174][ T5539] zswpout 0 [ 154.572174][ T5539] thp_fault_alloc 0 [ 154.572174][ T5539] thp_collapse_alloc 0 [pid 5089] openat(AT_FDCWD, "./20", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5089] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5089] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5089] umount2("./20/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./20/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5089] unlink("./20/binderfs") = 0 [pid 5089] umount2("./20/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./20/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5089] unlink("./20/cgroup") = 0 [pid 5089] umount2("./20/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./20/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5089] unlink("./20/cgroup.net") = 0 [pid 5089] umount2("./20/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5089] umount2("./20/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./20/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5089] umount2("./20/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] openat(AT_FDCWD, "./20/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5089] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5089] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5089] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5089] close(4) = 0 [pid 5089] rmdir("./20/file0") = 0 [pid 5089] umount2("./20/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./20/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5089] unlink("./20/cgroup.cpu") = 0 [pid 5089] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5089] close(3) = 0 [pid 5089] rmdir("./20") = 0 [pid 5089] mkdir("./21", 0777) = 0 [pid 5089] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5554 attached [pid 5554] chdir("./21" [pid 5089] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 23 [pid 5554] <... chdir resumed>) = 0 [pid 5554] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5554] setpgid(0, 0) = 0 [pid 5554] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 5554] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [pid 5554] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 5554] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5554] write(3, "1000", 4) = 4 [pid 5554] close(3) = 0 [pid 5554] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5554] mkdir("./file0", 000) = 0 [pid 5554] open("./file0", O_RDONLY) = 3 [pid 5554] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5554] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5554] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5554] openat(5, "memory.max", O_RDWR) = 6 [ 154.832004][ T5539] Tasks state (memory values in pages): [ 154.837785][ T5539] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 154.869900][ T5539] Out of memory and no killable processes... [pid 5554] write(6, "0x000000000000040e", 18 [pid 5539] <... write resumed>) = 18 [pid 5539] close(3) = 0 [pid 5539] close(4) = 0 [pid 5539] close(5) = 0 [pid 5539] close(6) = 0 [pid 5539] close(7) = -1 EBADF (Bad file descriptor) [pid 5539] close(8) = -1 EBADF (Bad file descriptor) [pid 5539] close(9) = -1 EBADF (Bad file descriptor) [pid 5539] close(10) = -1 EBADF (Bad file descriptor) [pid 5539] close(11) = -1 EBADF (Bad file descriptor) [ 154.892574][ T5547] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 154.929427][ T5547] CPU: 0 PID: 5547 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 154.939481][ T5547] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 154.949590][ T5547] Call Trace: [ 154.952908][ T5547] [ 154.955884][ T5547] dump_stack_lvl+0x136/0x150 [ 154.960632][ T5547] dump_header+0x10a/0xd70 [ 154.965140][ T5547] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 154.971301][ T5547] out_of_memory+0xd64/0x1660 [ 154.976062][ T5547] ? oom_killer_disable+0x2b0/0x2b0 [ 154.981363][ T5547] mem_cgroup_out_of_memory+0x206/0x270 [ 154.987003][ T5547] ? mem_cgroup_margin+0x130/0x130 [pid 5539] close(12) = -1 EBADF (Bad file descriptor) [pid 5539] close(13) = -1 EBADF (Bad file descriptor) [pid 5539] close(14) = -1 EBADF (Bad file descriptor) [pid 5539] close(15) = -1 EBADF (Bad file descriptor) [pid 5539] close(16) = -1 EBADF (Bad file descriptor) [pid 5539] close(17) = -1 EBADF (Bad file descriptor) [pid 5539] close(18) = -1 EBADF (Bad file descriptor) [ 154.992229][ T5547] memory_max_write+0x2f9/0x3c0 [ 154.997169][ T5547] ? mem_cgroup_force_empty_write+0x160/0x160 [ 155.003366][ T5547] ? lock_sync+0x190/0x190 [ 155.007859][ T5547] cgroup_file_write+0x1e2/0x7b0 [ 155.012877][ T5547] ? mem_cgroup_force_empty_write+0x160/0x160 [ 155.019031][ T5547] ? kill_css+0x3b0/0x3b0 [ 155.023445][ T5547] ? lock_acquire+0x32/0xc0 [ 155.028042][ T5547] ? kill_css+0x3b0/0x3b0 [ 155.032455][ T5547] kernfs_fop_write_iter+0x3f1/0x600 [ 155.037826][ T5547] vfs_write+0x9ed/0xe10 [pid 5539] close(19) = -1 EBADF (Bad file descriptor) [pid 5539] close(20) = -1 EBADF (Bad file descriptor) [pid 5539] close(21) = -1 EBADF (Bad file descriptor) [pid 5539] close(22) = -1 EBADF (Bad file descriptor) [pid 5539] close(23) = -1 EBADF (Bad file descriptor) [pid 5539] close(24) = -1 EBADF (Bad file descriptor) [pid 5539] close(25) = -1 EBADF (Bad file descriptor) [pid 5539] close(26) = -1 EBADF (Bad file descriptor) [pid 5539] close(27) = -1 EBADF (Bad file descriptor) [ 155.042159][ T5547] ? kernel_write+0x670/0x670 [ 155.046942][ T5547] ? find_held_lock+0x2d/0x110 [ 155.051785][ T5547] ? __fget_light+0x20a/0x270 [ 155.056545][ T5547] ksys_write+0x12b/0x250 [ 155.060958][ T5547] ? __ia32_sys_read+0xb0/0xb0 [ 155.065800][ T5547] ? lockdep_hardirqs_on+0x7d/0x100 [ 155.071084][ T5547] ? _raw_spin_unlock_irq+0x2e/0x50 [ 155.076355][ T5547] ? ptrace_notify+0xfe/0x140 [ 155.081101][ T5547] do_syscall_64+0x39/0xb0 [ 155.085595][ T5547] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 155.091575][ T5547] RIP: 0033:0x7faecf034129 [ 155.096043][ T5547] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 155.115767][ T5547] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 155.124246][ T5547] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 155.132290][ T5547] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [pid 5539] close(28) = -1 EBADF (Bad file descriptor) [pid 5539] close(29) = -1 EBADF (Bad file descriptor) [pid 5539] exit_group(0) = ? [pid 5539] +++ exited with 0 +++ [pid 5087] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=21, si_uid=0, si_status=0, si_utime=0, si_stime=7 /* 0.07 s */} --- [pid 5087] umount2("./19", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5087] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5087] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5087] umount2("./19/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./19/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5087] unlink("./19/binderfs") = 0 [pid 5087] umount2("./19/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./19/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5087] unlink("./19/cgroup") = 0 [pid 5087] umount2("./19/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./19/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5087] unlink("./19/cgroup.net") = 0 [pid 5087] umount2("./19/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5087] umount2("./19/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 155.140406][ T5547] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 155.148435][ T5547] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 155.156464][ T5547] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000011 [ 155.164516][ T5547] [pid 5087] lstat("./19/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5087] umount2("./19/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] openat(AT_FDCWD, "./19/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5087] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5087] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5087] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5087] close(4) = 0 [pid 5087] rmdir("./19/file0") = 0 [pid 5087] umount2("./19/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./19/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5087] unlink("./19/cgroup.cpu") = 0 [pid 5087] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [ 155.186898][ T5547] memory: usage 8kB, limit 0kB, failcnt 36 [ 155.200186][ T5547] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 155.209875][ T5547] Memory cgroup stats for /syz1: [ 155.210346][ T5547] anon 0 [ 155.210346][ T5547] file 0 [ 155.210346][ T5547] kernel 8192 [ 155.210346][ T5547] kernel_stack 0 [ 155.210346][ T5547] pagetables 0 [ 155.210346][ T5547] sec_pagetables 0 [ 155.210346][ T5547] percpu 0 [pid 5087] close(3) = 0 [pid 5087] rmdir("./19") = 0 [pid 5087] mkdir("./20", 0777) = 0 [pid 5087] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5561 attached [pid 5561] chdir("./20" [pid 5087] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 22 [pid 5561] <... chdir resumed>) = 0 [ 155.210346][ T5547] sock 0 [ 155.210346][ T5547] vmalloc 0 [ 155.210346][ T5547] shmem 0 [ 155.210346][ T5547] zswap 0 [ 155.210346][ T5547] zswapped 0 [ 155.210346][ T5547] file_mapped 0 [ 155.210346][ T5547] file_dirty 0 [ 155.210346][ T5547] file_writeback 0 [ 155.210346][ T5547] swapcached 0 [ 155.210346][ T5547] anon_thp 0 [ 155.210346][ T5547] file_thp 0 [ 155.210346][ T5547] shmem_thp 0 [ 155.210346][ T5547] inactive_anon 0 [ 155.210346][ T5547] active_anon 0 [ 155.210346][ T5547] inactive_file 0 [ 155.210346][ T5547] active_file 0 [ 155.210346][ T5547] unevictable 0 [ 155.210346][ T5547] slab_reclaimable 6752 [ 155.210346][ T5547] slab_unreclaimable 0 [ 155.210346][ T5547] slab 6752 [ 155.210346][ T5547] workingset_refault_anon 0 [ 155.210346][ T5547] workingset_refault_file 0 [ 155.210346][ T5547] workingset_activate_anon 0 [ 155.210346][ T5547] workingset_activate_file 0 [ 155.210346][ T5547] workingset_restore_anon 0 [ 155.210346][ T5547] workingset_restore_file 0 [ 155.210346][ T5547] workingset_nodereclaim 0 [ 155.210346][ T5547] pgscan 831 [pid 5561] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5561] setpgid(0, 0) = 0 [pid 5561] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 5561] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 5561] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 5561] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5561] write(3, "1000", 4) = 4 [pid 5561] close(3) = 0 [pid 5561] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5561] mkdir("./file0", 000) = 0 [pid 5561] open("./file0", O_RDONLY) = 3 [ 155.210346][ T5547] pgsteal 2 [ 155.210346][ T5547] pgscan_kswapd 0 [ 155.210346][ T5547] pgscan_direct 831 [ 155.210346][ T5547] pgscan_khugepaged 0 [ 155.210346][ T5547] pgsteal_kswapd 0 [ 155.210346][ T5547] pgsteal_direct 2 [ 155.210346][ T5547] pgsteal_khugepaged 0 [ 155.210346][ T5547] pgfault 21 [ 155.210346][ T5547] pgmajfault 0 [ 155.210346][ T5547] pgrefill 830 [ 155.210346][ T5547] pgactivate 829 [ 155.210346][ T5547] pgdeactivate 830 [ 155.210346][ T5547] pglazyfree 0 [ 155.210346][ T5547] pglazyfreed 0 [ 155.210346][ T5547] zswpin 0 [pid 5561] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5561] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5561] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5561] openat(5, "memory.max", O_RDWR) = 6 [ 155.210346][ T5547] zswpout 0 [ 155.210346][ T5547] thp_fault_alloc 0 [ 155.210346][ T5547] thp_collapse_alloc 0 [ 155.416271][ T5547] Tasks state (memory values in pages): [ 155.425481][ T5547] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5561] write(6, "0x000000000000040e", 18 [pid 5547] <... write resumed>) = 18 [ 155.440490][ T5547] Out of memory and no killable processes... [ 155.450287][ T5548] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 155.466203][ T5548] CPU: 0 PID: 5548 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 155.476190][ T5548] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 155.486297][ T5548] Call Trace: [ 155.489617][ T5548] [ 155.492597][ T5548] dump_stack_lvl+0x136/0x150 [ 155.497349][ T5548] dump_header+0x10a/0xd70 [ 155.501834][ T5548] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 155.508000][ T5548] out_of_memory+0xd64/0x1660 [ 155.512771][ T5548] ? oom_killer_disable+0x2b0/0x2b0 [ 155.518072][ T5548] mem_cgroup_out_of_memory+0x206/0x270 [ 155.523701][ T5548] ? mem_cgroup_margin+0x130/0x130 [ 155.528922][ T5548] memory_max_write+0x2f9/0x3c0 [ 155.533863][ T5548] ? mem_cgroup_force_empty_write+0x160/0x160 [ 155.540022][ T5548] ? lock_sync+0x190/0x190 [ 155.544518][ T5548] cgroup_file_write+0x1e2/0x7b0 [ 155.549540][ T5548] ? mem_cgroup_force_empty_write+0x160/0x160 [ 155.555686][ T5548] ? kill_css+0x3b0/0x3b0 [ 155.560095][ T5548] ? lock_acquire+0x32/0xc0 [ 155.564680][ T5548] ? kill_css+0x3b0/0x3b0 [ 155.569088][ T5548] kernfs_fop_write_iter+0x3f1/0x600 [ 155.574453][ T5548] vfs_write+0x9ed/0xe10 [ 155.578781][ T5548] ? kernel_write+0x670/0x670 [ 155.583537][ T5548] ? find_held_lock+0x2d/0x110 [pid 5547] close(3) = 0 [ 155.588380][ T5548] ? __fget_light+0x20a/0x270 [ 155.593143][ T5548] ksys_write+0x12b/0x250 [ 155.597556][ T5548] ? __ia32_sys_read+0xb0/0xb0 [ 155.602416][ T5548] ? lockdep_hardirqs_on+0x7d/0x100 [ 155.607681][ T5548] ? _raw_spin_unlock_irq+0x2e/0x50 [ 155.612957][ T5548] ? ptrace_notify+0xfe/0x140 [ 155.617709][ T5548] do_syscall_64+0x39/0xb0 [ 155.622202][ T5548] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 155.628160][ T5548] RIP: 0033:0x7faecf034129 [pid 5547] close(4) = 0 [pid 5547] close(5) = 0 [pid 5547] close(6) = 0 [pid 5547] close(7) = -1 EBADF (Bad file descriptor) [pid 5547] close(8) = -1 EBADF (Bad file descriptor) [pid 5547] close(9) = -1 EBADF (Bad file descriptor) [pid 5547] close(10) = -1 EBADF (Bad file descriptor) [pid 5547] close(11) = -1 EBADF (Bad file descriptor) [pid 5547] close(12) = -1 EBADF (Bad file descriptor) [pid 5547] close(13) = -1 EBADF (Bad file descriptor) [pid 5547] close(14) = -1 EBADF (Bad file descriptor) [pid 5547] close(15) = -1 EBADF (Bad file descriptor) [pid 5547] close(16) = -1 EBADF (Bad file descriptor) [pid 5547] close(17) = -1 EBADF (Bad file descriptor) [pid 5547] close(18) = -1 EBADF (Bad file descriptor) [ 155.632623][ T5548] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 155.652303][ T5548] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 155.660810][ T5548] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 155.668841][ T5548] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 155.676882][ T5548] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [pid 5547] close(19) = -1 EBADF (Bad file descriptor) [pid 5547] close(20) = -1 EBADF (Bad file descriptor) [pid 5547] close(21) = -1 EBADF (Bad file descriptor) [pid 5547] close(22) = -1 EBADF (Bad file descriptor) [pid 5547] close(23) = -1 EBADF (Bad file descriptor) [pid 5547] close(24) = -1 EBADF (Bad file descriptor) [pid 5547] close(25) = -1 EBADF (Bad file descriptor) [pid 5547] close(26) = -1 EBADF (Bad file descriptor) [pid 5547] close(27) = -1 EBADF (Bad file descriptor) [pid 5547] close(28) = -1 EBADF (Bad file descriptor) [pid 5547] close(29) = -1 EBADF (Bad file descriptor) [pid 5547] exit_group(0) = ? [pid 5547] +++ exited with 0 +++ [pid 5085] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=19, si_uid=0, si_status=0, si_utime=0, si_stime=10 /* 0.10 s */} --- [pid 5085] umount2("./17", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5085] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5085] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5085] umount2("./17/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./17/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5085] unlink("./17/binderfs") = 0 [pid 5085] umount2("./17/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./17/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5085] unlink("./17/cgroup") = 0 [pid 5085] umount2("./17/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 155.684928][ T5548] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 155.692970][ T5548] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000012 [ 155.701018][ T5548] [pid 5085] lstat("./17/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5085] unlink("./17/cgroup.net") = 0 [pid 5085] umount2("./17/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5085] umount2("./17/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./17/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5085] umount2("./17/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] openat(AT_FDCWD, "./17/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5085] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5085] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5085] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5085] close(4) = 0 [pid 5085] rmdir("./17/file0") = 0 [pid 5085] umount2("./17/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./17/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5085] unlink("./17/cgroup.cpu") = 0 [pid 5085] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5085] close(3) = 0 [pid 5085] rmdir("./17") = 0 [pid 5085] mkdir("./18", 0777) = 0 [ 155.788164][ T5548] memory: usage 8kB, limit 0kB, failcnt 36 [ 155.795364][ T5548] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 155.805205][ T5548] Memory cgroup stats for /syz1: [ 155.805487][ T5548] anon 0 [ 155.805487][ T5548] file 0 [ 155.805487][ T5548] kernel 8192 [ 155.805487][ T5548] kernel_stack 0 [ 155.805487][ T5548] pagetables 0 [ 155.805487][ T5548] sec_pagetables 0 [ 155.805487][ T5548] percpu 0 [ 155.805487][ T5548] sock 0 [ 155.805487][ T5548] vmalloc 0 [ 155.805487][ T5548] shmem 0 [ 155.805487][ T5548] zswap 0 [ 155.805487][ T5548] zswapped 0 [ 155.805487][ T5548] file_mapped 0 [ 155.805487][ T5548] file_dirty 0 [ 155.805487][ T5548] file_writeback 0 [ 155.805487][ T5548] swapcached 0 [ 155.805487][ T5548] anon_thp 0 [ 155.805487][ T5548] file_thp 0 [ 155.805487][ T5548] shmem_thp 0 [ 155.805487][ T5548] inactive_anon 0 [ 155.805487][ T5548] active_anon 0 [ 155.805487][ T5548] inactive_file 0 [ 155.805487][ T5548] active_file 0 [ 155.805487][ T5548] unevictable 0 [ 155.805487][ T5548] slab_reclaimable 6752 [ 155.805487][ T5548] slab_unreclaimable 0 [ 155.805487][ T5548] slab 6752 [ 155.805487][ T5548] workingset_refault_anon 0 [ 155.805487][ T5548] workingset_refault_file 0 [ 155.805487][ T5548] workingset_activate_anon 0 [ 155.805487][ T5548] workingset_activate_file 0 [ 155.805487][ T5548] workingset_restore_anon 0 [ 155.805487][ T5548] workingset_restore_file 0 [ 155.805487][ T5548] workingset_nodereclaim 0 [ 155.805487][ T5548] pgscan 831 [ 155.805487][ T5548] pgsteal 2 [ 155.805487][ T5548] pgscan_kswapd 0 [pid 5085] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5564 attached [pid 5564] chdir("./18" [pid 5085] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 20 [pid 5564] <... chdir resumed>) = 0 [pid 5564] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5564] setpgid(0, 0) = 0 [pid 5564] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 5564] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 5564] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 5564] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5564] write(3, "1000", 4) = 4 [pid 5564] close(3) = 0 [pid 5564] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5564] mkdir("./file0", 000) = 0 [pid 5564] open("./file0", O_RDONLY) = 3 [pid 5564] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5564] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5564] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5564] openat(5, "memory.max", O_RDWR) = 6 [ 155.805487][ T5548] pgscan_direct 831 [ 155.805487][ T5548] pgscan_khugepaged 0 [ 155.805487][ T5548] pgsteal_kswapd 0 [ 155.805487][ T5548] pgsteal_direct 2 [ 155.805487][ T5548] pgsteal_khugepaged 0 [ 155.805487][ T5548] pgfault 21 [ 155.805487][ T5548] pgmajfault 0 [ 155.805487][ T5548] pgrefill 830 [ 155.805487][ T5548] pgactivate 829 [ 155.805487][ T5548] pgdeactivate 830 [ 155.805487][ T5548] pglazyfree 0 [ 155.805487][ T5548] pglazyfreed 0 [ 155.805487][ T5548] zswpin 0 [ 155.805487][ T5548] zswpout 0 [ 155.805487][ T5548] thp_fault_alloc 0 [ 155.805487][ T5548] thp_collapse_alloc 0 [ 156.001858][ T5548] Tasks state (memory values in pages): [ 156.007490][ T5548] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 156.030359][ T5548] Out of memory and no killable processes... [pid 5564] write(6, "0x000000000000040e", 18 [pid 5548] <... write resumed>) = 18 [pid 5548] close(3) = 0 [pid 5548] close(4) = 0 [pid 5548] close(5) = 0 [pid 5548] close(6) = 0 [pid 5548] close(7) = -1 EBADF (Bad file descriptor) [pid 5548] close(8) = -1 EBADF (Bad file descriptor) [pid 5548] close(9) = -1 EBADF (Bad file descriptor) [pid 5548] close(10) = -1 EBADF (Bad file descriptor) [pid 5548] close(11) = -1 EBADF (Bad file descriptor) [pid 5548] close(12) = -1 EBADF (Bad file descriptor) [pid 5548] close(13) = -1 EBADF (Bad file descriptor) [pid 5548] close(14) = -1 EBADF (Bad file descriptor) [pid 5548] close(15) = -1 EBADF (Bad file descriptor) [pid 5548] close(16) = -1 EBADF (Bad file descriptor) [pid 5548] close(17) = -1 EBADF (Bad file descriptor) [pid 5548] close(18) = -1 EBADF (Bad file descriptor) [pid 5548] close(19) = -1 EBADF (Bad file descriptor) [pid 5548] close(20) = -1 EBADF (Bad file descriptor) [pid 5548] close(21) = -1 EBADF (Bad file descriptor) [pid 5548] close(22) = -1 EBADF (Bad file descriptor) [pid 5548] close(23) = -1 EBADF (Bad file descriptor) [pid 5548] close(24) = -1 EBADF (Bad file descriptor) [pid 5548] close(25) = -1 EBADF (Bad file descriptor) [pid 5548] close(26) = -1 EBADF (Bad file descriptor) [pid 5548] close(27) = -1 EBADF (Bad file descriptor) [pid 5548] close(28) = -1 EBADF (Bad file descriptor) [pid 5548] close(29) = -1 EBADF (Bad file descriptor) [pid 5548] exit_group(0) = ? [pid 5548] +++ exited with 0 +++ [pid 5086] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=20, si_uid=0, si_status=0, si_utime=0, si_stime=10 /* 0.10 s */} --- [ 156.038004][ T5551] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 156.061916][ T5551] CPU: 1 PID: 5551 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 156.071905][ T5551] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 156.082015][ T5551] Call Trace: [ 156.085386][ T5551] [ 156.088361][ T5551] dump_stack_lvl+0x136/0x150 [ 156.093111][ T5551] dump_header+0x10a/0xd70 [ 156.097600][ T5551] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 156.103764][ T5551] out_of_memory+0xd64/0x1660 [ 156.108530][ T5551] ? oom_killer_disable+0x2b0/0x2b0 [ 156.113804][ T5551] ? find_held_lock+0x2d/0x110 [ 156.118682][ T5551] mem_cgroup_out_of_memory+0x206/0x270 [ 156.124301][ T5551] ? mem_cgroup_margin+0x130/0x130 [ 156.129510][ T5551] ? _raw_spin_unlock_irqrestore+0x54/0x70 [ 156.135373][ T5551] memory_max_write+0x2f9/0x3c0 [ 156.140273][ T5551] ? mem_cgroup_force_empty_write+0x160/0x160 [ 156.146432][ T5551] ? lock_sync+0x190/0x190 [ 156.150905][ T5551] cgroup_file_write+0x1e2/0x7b0 [ 156.155886][ T5551] ? mem_cgroup_force_empty_write+0x160/0x160 [ 156.161996][ T5551] ? kill_css+0x3b0/0x3b0 [ 156.166372][ T5551] ? lock_acquire+0x32/0xc0 [ 156.170925][ T5551] ? kill_css+0x3b0/0x3b0 [ 156.175303][ T5551] kernfs_fop_write_iter+0x3f1/0x600 [ 156.180644][ T5551] vfs_write+0x9ed/0xe10 [ 156.184974][ T5551] ? kernel_write+0x670/0x670 [ 156.189705][ T5551] ? find_held_lock+0x2d/0x110 [ 156.194514][ T5551] ? __fget_light+0x20a/0x270 [ 156.199247][ T5551] ksys_write+0x12b/0x250 [ 156.203634][ T5551] ? __ia32_sys_read+0xb0/0xb0 [ 156.208447][ T5551] ? lockdep_hardirqs_on+0x7d/0x100 [ 156.213682][ T5551] ? _raw_spin_unlock_irq+0x2e/0x50 [ 156.218922][ T5551] ? ptrace_notify+0xfe/0x140 [ 156.223643][ T5551] do_syscall_64+0x39/0xb0 [ 156.228113][ T5551] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 156.234046][ T5551] RIP: 0033:0x7faecf034129 [ 156.238491][ T5551] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 156.258133][ T5551] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 156.266579][ T5551] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 156.274577][ T5551] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 156.282576][ T5551] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [pid 5086] umount2("./18", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5086] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [ 156.290574][ T5551] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 156.298571][ T5551] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000015 [ 156.306591][ T5551] [ 156.320601][ T5551] memory: usage 8kB, limit 0kB, failcnt 36 [ 156.329174][ T5551] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 156.339078][ T5551] Memory cgroup stats for /syz1: [ 156.339369][ T5551] anon 0 [ 156.339369][ T5551] file 0 [ 156.339369][ T5551] kernel 8192 [ 156.339369][ T5551] kernel_stack 0 [ 156.339369][ T5551] pagetables 0 [ 156.339369][ T5551] sec_pagetables 0 [ 156.339369][ T5551] percpu 0 [ 156.339369][ T5551] sock 0 [ 156.339369][ T5551] vmalloc 0 [ 156.339369][ T5551] shmem 0 [ 156.339369][ T5551] zswap 0 [ 156.339369][ T5551] zswapped 0 [ 156.339369][ T5551] file_mapped 0 [ 156.339369][ T5551] file_dirty 0 [ 156.339369][ T5551] file_writeback 0 [pid 5086] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5086] umount2("./18/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./18/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5086] unlink("./18/binderfs") = 0 [pid 5086] umount2("./18/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./18/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5086] unlink("./18/cgroup") = 0 [pid 5086] umount2("./18/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./18/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5086] unlink("./18/cgroup.net") = 0 [ 156.339369][ T5551] swapcached 0 [ 156.339369][ T5551] anon_thp 0 [ 156.339369][ T5551] file_thp 0 [ 156.339369][ T5551] shmem_thp 0 [ 156.339369][ T5551] inactive_anon 0 [ 156.339369][ T5551] active_anon 0 [ 156.339369][ T5551] inactive_file 0 [ 156.339369][ T5551] active_file 0 [ 156.339369][ T5551] unevictable 0 [ 156.339369][ T5551] slab_reclaimable 6752 [ 156.339369][ T5551] slab_unreclaimable 0 [ 156.339369][ T5551] slab 6752 [ 156.339369][ T5551] workingset_refault_anon 0 [ 156.339369][ T5551] workingset_refault_file 0 [ 156.339369][ T5551] workingset_activate_anon 0 [ 156.339369][ T5551] workingset_activate_file 0 [ 156.339369][ T5551] workingset_restore_anon 0 [ 156.339369][ T5551] workingset_restore_file 0 [ 156.339369][ T5551] workingset_nodereclaim 0 [ 156.339369][ T5551] pgscan 831 [ 156.339369][ T5551] pgsteal 2 [ 156.339369][ T5551] pgscan_kswapd 0 [ 156.339369][ T5551] pgscan_direct 831 [ 156.339369][ T5551] pgscan_khugepaged 0 [ 156.339369][ T5551] pgsteal_kswapd 0 [ 156.339369][ T5551] pgsteal_direct 2 [ 156.339369][ T5551] pgsteal_khugepaged 0 [pid 5086] umount2("./18/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5086] umount2("./18/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./18/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5086] umount2("./18/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 156.339369][ T5551] pgfault 21 [ 156.339369][ T5551] pgmajfault 0 [ 156.339369][ T5551] pgrefill 830 [ 156.339369][ T5551] pgactivate 829 [ 156.339369][ T5551] pgdeactivate 830 [ 156.339369][ T5551] pglazyfree 0 [ 156.339369][ T5551] pglazyfreed 0 [ 156.339369][ T5551] zswpin 0 [ 156.339369][ T5551] zswpout 0 [ 156.339369][ T5551] thp_fault_alloc 0 [ 156.339369][ T5551] thp_collapse_alloc 0 [ 156.531691][ T5551] Tasks state (memory values in pages): [pid 5086] openat(AT_FDCWD, "./18/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5086] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5086] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5086] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5086] close(4) = 0 [pid 5086] rmdir("./18/file0") = 0 [pid 5086] umount2("./18/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./18/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5086] unlink("./18/cgroup.cpu") = 0 [pid 5551] <... write resumed>) = 18 [pid 5086] getdents64(3, [pid 5551] close(3 [pid 5086] <... getdents64 resumed>0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5551] <... close resumed>) = 0 [pid 5086] close(3 [pid 5551] close(4 [pid 5086] <... close resumed>) = 0 [pid 5551] <... close resumed>) = 0 [pid 5086] rmdir("./18" [pid 5551] close(5 [pid 5086] <... rmdir resumed>) = 0 [pid 5551] <... close resumed>) = 0 [pid 5086] mkdir("./19", 0777 [pid 5551] close(6 [pid 5086] <... mkdir resumed>) = 0 [pid 5551] <... close resumed>) = 0 [ 156.537395][ T5551] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 156.558562][ T5551] Out of memory and no killable processes... [ 156.573986][ T5554] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 156.614719][ T5554] CPU: 0 PID: 5554 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 156.624713][ T5554] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 156.634818][ T5554] Call Trace: [ 156.638143][ T5554] [ 156.641123][ T5554] dump_stack_lvl+0x136/0x150 [ 156.645873][ T5554] dump_header+0x10a/0xd70 [ 156.650352][ T5554] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 156.656507][ T5554] out_of_memory+0xd64/0x1660 [ 156.661263][ T5554] ? oom_killer_disable+0x2b0/0x2b0 [ 156.666572][ T5554] mem_cgroup_out_of_memory+0x206/0x270 [ 156.672186][ T5554] ? mem_cgroup_margin+0x130/0x130 [ 156.677431][ T5554] memory_max_write+0x2f9/0x3c0 [ 156.682373][ T5554] ? mem_cgroup_force_empty_write+0x160/0x160 [ 156.688525][ T5554] ? lock_sync+0x190/0x190 [ 156.693014][ T5554] cgroup_file_write+0x1e2/0x7b0 [ 156.698031][ T5554] ? mem_cgroup_force_empty_write+0x160/0x160 [ 156.704192][ T5554] ? kill_css+0x3b0/0x3b0 [ 156.708629][ T5554] ? lock_acquire+0x32/0xc0 [ 156.713234][ T5554] ? kill_css+0x3b0/0x3b0 [ 156.717642][ T5554] kernfs_fop_write_iter+0x3f1/0x600 [ 156.723006][ T5554] vfs_write+0x9ed/0xe10 [ 156.727340][ T5554] ? kernel_write+0x670/0x670 [ 156.732102][ T5554] ? find_held_lock+0x2d/0x110 [ 156.736943][ T5554] ? __fget_light+0x20a/0x270 [ 156.741699][ T5554] ksys_write+0x12b/0x250 [ 156.746110][ T5554] ? __ia32_sys_read+0xb0/0xb0 [ 156.750949][ T5554] ? lockdep_hardirqs_on+0x7d/0x100 [ 156.756217][ T5554] ? _raw_spin_unlock_irq+0x2e/0x50 [ 156.761493][ T5554] ? ptrace_notify+0xfe/0x140 [ 156.766241][ T5554] do_syscall_64+0x39/0xb0 [ 156.770746][ T5554] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 156.776709][ T5554] RIP: 0033:0x7faecf034129 [ 156.781174][ T5554] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 156.800847][ T5554] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 5086] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5568 attached [pid 5551] close(7 [pid 5568] chdir("./19" [pid 5551] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5086] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 21 [pid 5568] <... chdir resumed>) = 0 [pid 5551] close(8 [pid 5568] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5551] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5568] <... prctl resumed>) = 0 [pid 5551] close(9 [pid 5568] setpgid(0, 0 [pid 5551] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5568] <... setpgid resumed>) = 0 [pid 5551] close(10 [pid 5568] symlink("/syzcgroup/unified/syz3", "./cgroup" [pid 5551] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5568] <... symlink resumed>) = 0 [pid 5551] close(11 [pid 5568] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu" [pid 5551] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5551] close(12 [pid 5568] <... symlink resumed>) = 0 [pid 5551] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5568] symlink("/syzcgroup/net/syz3", "./cgroup.net" [pid 5551] close(13 [pid 5568] <... symlink resumed>) = 0 [pid 5551] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5568] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5551] close(14 [pid 5568] <... openat resumed>) = 3 [pid 5551] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5568] write(3, "1000", 4 [pid 5551] close(15 [pid 5568] <... write resumed>) = 4 [pid 5568] close(3 [pid 5551] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5568] <... close resumed>) = 0 [pid 5551] close(16 [pid 5568] symlink("/dev/binderfs", "./binderfs" [pid 5551] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5568] <... symlink resumed>) = 0 [pid 5551] close(17 [pid 5568] mkdir("./file0", 000 [pid 5551] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5568] <... mkdir resumed>) = 0 [pid 5551] close(18 [pid 5568] open("./file0", O_RDONLY [pid 5551] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5568] <... open resumed>) = 3 [pid 5551] close(19 [pid 5568] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5551] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5568] <... mount resumed>) = 0 [ 156.809323][ T5554] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 156.817413][ T5554] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 156.825410][ T5554] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 156.833410][ T5554] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 156.841423][ T5554] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000015 [ 156.849445][ T5554] [pid 5551] close(20 [pid 5568] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5551] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5568] <... openat resumed>) = 4 [pid 5551] close(21 [pid 5568] openat(4, "syz1", O_RDWR|O_PATH [pid 5551] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5568] <... openat resumed>) = 5 [pid 5551] close(22 [pid 5568] openat(5, "memory.max", O_RDWR [pid 5551] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5568] <... openat resumed>) = 6 [pid 5551] close(23) = -1 EBADF (Bad file descriptor) [pid 5568] write(6, "0x000000000000040e", 18 [pid 5551] close(24) = -1 EBADF (Bad file descriptor) [pid 5551] close(25) = -1 EBADF (Bad file descriptor) [pid 5551] close(26) = -1 EBADF (Bad file descriptor) [pid 5551] close(27) = -1 EBADF (Bad file descriptor) [pid 5551] close(28) = -1 EBADF (Bad file descriptor) [pid 5551] close(29) = -1 EBADF (Bad file descriptor) [pid 5551] exit_group(0) = ? [pid 5551] +++ exited with 0 +++ [pid 5090] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=23, si_uid=0, si_status=0, si_utime=0, si_stime=12 /* 0.12 s */} --- [pid 5090] umount2("./21", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] openat(AT_FDCWD, "./21", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5090] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5090] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5090] umount2("./21/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./21/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5090] unlink("./21/binderfs") = 0 [pid 5090] umount2("./21/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./21/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5090] unlink("./21/cgroup") = 0 [pid 5090] umount2("./21/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./21/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5090] unlink("./21/cgroup.net") = 0 [ 156.908289][ T5554] memory: usage 8kB, limit 0kB, failcnt 36 [ 156.941093][ T5554] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 156.971783][ T5554] Memory cgroup stats for /syz1: [ 156.972116][ T5554] anon 0 [ 156.972116][ T5554] file 0 [ 156.972116][ T5554] kernel 8192 [ 156.972116][ T5554] kernel_stack 0 [ 156.972116][ T5554] pagetables 0 [ 156.972116][ T5554] sec_pagetables 0 [ 156.972116][ T5554] percpu 0 [ 156.972116][ T5554] sock 0 [ 156.972116][ T5554] vmalloc 0 [ 156.972116][ T5554] shmem 0 [ 156.972116][ T5554] zswap 0 [ 156.972116][ T5554] zswapped 0 [ 156.972116][ T5554] file_mapped 0 [ 156.972116][ T5554] file_dirty 0 [ 156.972116][ T5554] file_writeback 0 [ 156.972116][ T5554] swapcached 0 [ 156.972116][ T5554] anon_thp 0 [ 156.972116][ T5554] file_thp 0 [ 156.972116][ T5554] shmem_thp 0 [ 156.972116][ T5554] inactive_anon 0 [ 156.972116][ T5554] active_anon 0 [ 156.972116][ T5554] inactive_file 0 [ 156.972116][ T5554] active_file 0 [ 156.972116][ T5554] unevictable 0 [ 156.972116][ T5554] slab_reclaimable 6752 [ 156.972116][ T5554] slab_unreclaimable 0 [ 156.972116][ T5554] slab 6752 [ 156.972116][ T5554] workingset_refault_anon 0 [ 156.972116][ T5554] workingset_refault_file 0 [ 156.972116][ T5554] workingset_activate_anon 0 [ 156.972116][ T5554] workingset_activate_file 0 [ 156.972116][ T5554] workingset_restore_anon 0 [ 156.972116][ T5554] workingset_restore_file 0 [ 156.972116][ T5554] workingset_nodereclaim 0 [ 156.972116][ T5554] pgscan 831 [ 156.972116][ T5554] pgsteal 2 [ 156.972116][ T5554] pgscan_kswapd 0 [ 156.972116][ T5554] pgscan_direct 831 [ 156.972116][ T5554] pgscan_khugepaged 0 [ 156.972116][ T5554] pgsteal_kswapd 0 [ 156.972116][ T5554] pgsteal_direct 2 [ 156.972116][ T5554] pgsteal_khugepaged 0 [pid 5090] umount2("./21/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5090] umount2("./21/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./21/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5090] umount2("./21/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] openat(AT_FDCWD, "./21/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5090] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5090] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5090] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5090] close(4) = 0 [pid 5090] rmdir("./21/file0") = 0 [pid 5090] umount2("./21/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./21/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5090] unlink("./21/cgroup.cpu") = 0 [pid 5090] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5090] close(3) = 0 [ 156.972116][ T5554] pgfault 21 [ 156.972116][ T5554] pgmajfault 0 [ 156.972116][ T5554] pgrefill 830 [ 156.972116][ T5554] pgactivate 829 [ 156.972116][ T5554] pgdeactivate 830 [ 156.972116][ T5554] pglazyfree 0 [ 156.972116][ T5554] pglazyfreed 0 [ 156.972116][ T5554] zswpin 0 [ 156.972116][ T5554] zswpout 0 [ 156.972116][ T5554] thp_fault_alloc 0 [ 156.972116][ T5554] thp_collapse_alloc 0 [pid 5090] rmdir("./21") = 0 [pid 5090] mkdir("./22", 0777) = 0 [pid 5090] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5577 attached [pid 5577] chdir("./22" [pid 5090] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 24 [pid 5577] <... chdir resumed>) = 0 [pid 5577] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5577] setpgid(0, 0) = 0 [pid 5577] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 5577] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 5577] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [pid 5577] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5577] write(3, "1000", 4) = 4 [pid 5577] close(3) = 0 [pid 5577] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5577] mkdir("./file0", 000) = 0 [pid 5577] open("./file0", O_RDONLY) = 3 [pid 5577] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5577] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5577] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5577] openat(5, "memory.max", O_RDWR) = 6 [ 157.200832][ T5554] Tasks state (memory values in pages): [ 157.239537][ T5554] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 157.270639][ T5554] Out of memory and no killable processes... [pid 5577] write(6, "0x000000000000040e", 18 [pid 5554] <... write resumed>) = 18 [pid 5554] close(3) = 0 [pid 5554] close(4) = 0 [pid 5554] close(5) = 0 [pid 5554] close(6) = 0 [pid 5554] close(7) = -1 EBADF (Bad file descriptor) [pid 5554] close(8) = -1 EBADF (Bad file descriptor) [pid 5554] close(9) = -1 EBADF (Bad file descriptor) [pid 5554] close(10) = -1 EBADF (Bad file descriptor) [pid 5554] close(11) = -1 EBADF (Bad file descriptor) [pid 5554] close(12) = -1 EBADF (Bad file descriptor) [pid 5554] close(13) = -1 EBADF (Bad file descriptor) [pid 5554] close(14) = -1 EBADF (Bad file descriptor) [pid 5554] close(15) = -1 EBADF (Bad file descriptor) [pid 5554] close(16) = -1 EBADF (Bad file descriptor) [pid 5554] close(17) = -1 EBADF (Bad file descriptor) [pid 5554] close(18) = -1 EBADF (Bad file descriptor) [ 157.311767][ T5561] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 157.334576][ T5561] CPU: 1 PID: 5561 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 157.344565][ T5561] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 157.354684][ T5561] Call Trace: [ 157.358015][ T5561] [pid 5554] close(19) = -1 EBADF (Bad file descriptor) [pid 5554] close(20) = -1 EBADF (Bad file descriptor) [pid 5554] close(21) = -1 EBADF (Bad file descriptor) [pid 5554] close(22) = -1 EBADF (Bad file descriptor) [pid 5554] close(23) = -1 EBADF (Bad file descriptor) [pid 5554] close(24) = -1 EBADF (Bad file descriptor) [pid 5554] close(25) = -1 EBADF (Bad file descriptor) [pid 5554] close(26) = -1 EBADF (Bad file descriptor) [pid 5554] close(27) = -1 EBADF (Bad file descriptor) [pid 5554] close(28) = -1 EBADF (Bad file descriptor) [pid 5554] close(29) = -1 EBADF (Bad file descriptor) [pid 5554] exit_group(0) = ? [pid 5554] +++ exited with 0 +++ [pid 5089] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=23, si_uid=0, si_status=0, si_utime=0, si_stime=10 /* 0.10 s */} --- [pid 5089] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5089] umount2("./21", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] openat(AT_FDCWD, "./21", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5089] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5089] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5089] umount2("./21/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 157.361000][ T5561] dump_stack_lvl+0x136/0x150 [ 157.365749][ T5561] dump_header+0x10a/0xd70 [ 157.370244][ T5561] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 157.376409][ T5561] out_of_memory+0xd64/0x1660 [ 157.381180][ T5561] ? oom_killer_disable+0x2b0/0x2b0 [ 157.386471][ T5561] mem_cgroup_out_of_memory+0x206/0x270 [ 157.392101][ T5561] ? mem_cgroup_margin+0x130/0x130 [ 157.397339][ T5561] memory_max_write+0x2f9/0x3c0 [ 157.402267][ T5561] ? mem_cgroup_force_empty_write+0x160/0x160 [pid 5089] lstat("./21/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5089] unlink("./21/binderfs") = 0 [pid 5089] umount2("./21/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./21/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5089] unlink("./21/cgroup") = 0 [pid 5089] umount2("./21/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./21/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5089] unlink("./21/cgroup.net") = 0 [ 157.408426][ T5561] ? lock_sync+0x190/0x190 [ 157.412930][ T5561] cgroup_file_write+0x1e2/0x7b0 [ 157.417960][ T5561] ? mem_cgroup_force_empty_write+0x160/0x160 [ 157.424134][ T5561] ? kill_css+0x3b0/0x3b0 [ 157.428555][ T5561] ? lock_acquire+0x32/0xc0 [ 157.433147][ T5561] ? kill_css+0x3b0/0x3b0 [ 157.437560][ T5561] kernfs_fop_write_iter+0x3f1/0x600 [ 157.442936][ T5561] vfs_write+0x9ed/0xe10 [ 157.447255][ T5561] ? kernel_write+0x670/0x670 [ 157.451989][ T5561] ? find_held_lock+0x2d/0x110 [ 157.456801][ T5561] ? __fget_light+0x20a/0x270 [ 157.461529][ T5561] ksys_write+0x12b/0x250 [ 157.465912][ T5561] ? __ia32_sys_read+0xb0/0xb0 [ 157.470719][ T5561] ? lockdep_hardirqs_on+0x7d/0x100 [ 157.475953][ T5561] ? _raw_spin_unlock_irq+0x2e/0x50 [ 157.481194][ T5561] ? ptrace_notify+0xfe/0x140 [ 157.485911][ T5561] do_syscall_64+0x39/0xb0 [ 157.490376][ T5561] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 157.496307][ T5561] RIP: 0033:0x7faecf034129 [ 157.500748][ T5561] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 157.520390][ T5561] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 157.528838][ T5561] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 157.536839][ T5561] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 157.544839][ T5561] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 157.552835][ T5561] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [pid 5089] umount2("./21/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5089] umount2("./21/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./21/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5089] umount2("./21/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] openat(AT_FDCWD, "./21/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5089] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5089] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5089] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5089] close(4) = 0 [ 157.560831][ T5561] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000014 [ 157.568851][ T5561] [ 157.588178][ T5561] memory: usage 8kB, limit 0kB, failcnt 36 [ 157.603372][ T5561] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [pid 5089] rmdir("./21/file0") = 0 [pid 5089] umount2("./21/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./21/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5089] unlink("./21/cgroup.cpu") = 0 [pid 5089] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5089] close(3) = 0 [pid 5089] rmdir("./21") = 0 [pid 5089] mkdir("./22", 0777) = 0 [pid 5089] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555c0c5d0) = 24 [ 157.610299][ T5561] Memory cgroup stats for /syz1: [ 157.610585][ T5561] anon 0 [ 157.610585][ T5561] file 0 [ 157.610585][ T5561] kernel 8192 [ 157.610585][ T5561] kernel_stack 0 [ 157.610585][ T5561] pagetables 0 [ 157.610585][ T5561] sec_pagetables 0 [ 157.610585][ T5561] percpu 0 [ 157.610585][ T5561] sock 0 [ 157.610585][ T5561] vmalloc 0 [ 157.610585][ T5561] shmem 0 [ 157.610585][ T5561] zswap 0 [ 157.610585][ T5561] zswapped 0 [ 157.610585][ T5561] file_mapped 0 [ 157.610585][ T5561] file_dirty 0 [ 157.610585][ T5561] file_writeback 0 [ 157.610585][ T5561] swapcached 0 [ 157.610585][ T5561] anon_thp 0 [ 157.610585][ T5561] file_thp 0 [ 157.610585][ T5561] shmem_thp 0 [ 157.610585][ T5561] inactive_anon 0 [ 157.610585][ T5561] active_anon 0 [ 157.610585][ T5561] inactive_file 0 [ 157.610585][ T5561] active_file 0 [ 157.610585][ T5561] unevictable 0 [ 157.610585][ T5561] slab_reclaimable 6752 [ 157.610585][ T5561] slab_unreclaimable 0 [ 157.610585][ T5561] slab 6752 [ 157.610585][ T5561] workingset_refault_anon 0 [ 157.610585][ T5561] workingset_refault_file 0 [ 157.610585][ T5561] workingset_activate_anon 0 [ 157.610585][ T5561] workingset_activate_file 0 [ 157.610585][ T5561] workingset_restore_anon 0 [ 157.610585][ T5561] workingset_restore_file 0 [ 157.610585][ T5561] workingset_nodereclaim 0 [ 157.610585][ T5561] pgscan 831 [ 157.610585][ T5561] pgsteal 2 [ 157.610585][ T5561] pgscan_kswapd 0 [ 157.610585][ T5561] pgscan_direct 831 [ 157.610585][ T5561] pgscan_khugepaged 0 [ 157.610585][ T5561] pgsteal_kswapd 0 [ 157.610585][ T5561] pgsteal_direct 2 [ 157.610585][ T5561] pgsteal_khugepaged 0 [ 157.610585][ T5561] pgfault 21 ./strace-static-x86_64: Process 5580 attached [ 157.610585][ T5561] pgmajfault 0 [ 157.610585][ T5561] pgrefill 830 [ 157.610585][ T5561] pgactivate 829 [ 157.610585][ T5561] pgdeactivate 830 [ 157.610585][ T5561] pglazyfree 0 [ 157.610585][ T5561] pglazyfreed 0 [ 157.610585][ T5561] zswpin 0 [ 157.610585][ T5561] zswpout 0 [ 157.610585][ T5561] thp_fault_alloc 0 [ 157.610585][ T5561] thp_collapse_alloc 0 [ 157.799660][ T5561] Tasks state (memory values in pages): [pid 5580] chdir("./22") = 0 [pid 5580] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5580] setpgid(0, 0) = 0 [pid 5580] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 5580] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [pid 5580] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 5580] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5580] write(3, "1000", 4) = 4 [pid 5580] close(3) = 0 [pid 5580] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5580] mkdir("./file0", 000) = 0 [pid 5580] open("./file0", O_RDONLY) = 3 [pid 5580] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5580] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5580] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5580] openat(5, "memory.max", O_RDWR) = 6 [ 157.809621][ T5561] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5580] write(6, "0x000000000000040e", 18 [pid 5561] <... write resumed>) = 18 [pid 5561] close(3) = 0 [pid 5561] close(4) = 0 [pid 5561] close(5) = 0 [pid 5561] close(6) = 0 [pid 5561] close(7) = -1 EBADF (Bad file descriptor) [pid 5561] close(8) = -1 EBADF (Bad file descriptor) [pid 5561] close(9) = -1 EBADF (Bad file descriptor) [ 157.856570][ T5561] Out of memory and no killable processes... [ 157.865069][ T5564] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 157.903218][ T5564] CPU: 0 PID: 5564 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 157.913208][ T5564] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 157.923321][ T5564] Call Trace: [ 157.926640][ T5564] [ 157.929609][ T5564] dump_stack_lvl+0x136/0x150 [ 157.934357][ T5564] dump_header+0x10a/0xd70 [ 157.938840][ T5564] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 157.944994][ T5564] out_of_memory+0xd64/0x1660 [pid 5561] close(10) = -1 EBADF (Bad file descriptor) [pid 5561] close(11) = -1 EBADF (Bad file descriptor) [pid 5561] close(12) = -1 EBADF (Bad file descriptor) [pid 5561] close(13) = -1 EBADF (Bad file descriptor) [pid 5561] close(14) = -1 EBADF (Bad file descriptor) [pid 5561] close(15) = -1 EBADF (Bad file descriptor) [pid 5561] close(16) = -1 EBADF (Bad file descriptor) [pid 5561] close(17) = -1 EBADF (Bad file descriptor) [pid 5561] close(18) = -1 EBADF (Bad file descriptor) [pid 5561] close(19) = -1 EBADF (Bad file descriptor) [pid 5561] close(20) = -1 EBADF (Bad file descriptor) [pid 5561] close(21) = -1 EBADF (Bad file descriptor) [pid 5561] close(22) = -1 EBADF (Bad file descriptor) [pid 5561] close(23) = -1 EBADF (Bad file descriptor) [pid 5561] close(24) = -1 EBADF (Bad file descriptor) [pid 5561] close(25) = -1 EBADF (Bad file descriptor) [pid 5561] close(26) = -1 EBADF (Bad file descriptor) [ 157.949751][ T5564] ? oom_killer_disable+0x2b0/0x2b0 [ 157.955022][ T5564] ? find_held_lock+0x2d/0x110 [ 157.959863][ T5564] mem_cgroup_out_of_memory+0x206/0x270 [ 157.965481][ T5564] ? mem_cgroup_margin+0x130/0x130 [ 157.970676][ T5564] ? _raw_spin_unlock_irqrestore+0x54/0x70 [ 157.976572][ T5564] memory_max_write+0x2f9/0x3c0 [ 157.981516][ T5564] ? mem_cgroup_force_empty_write+0x160/0x160 [ 157.987675][ T5564] ? lock_sync+0x190/0x190 [ 157.992165][ T5564] cgroup_file_write+0x1e2/0x7b0 [ 157.997185][ T5564] ? mem_cgroup_force_empty_write+0x160/0x160 [pid 5561] close(27) = -1 EBADF (Bad file descriptor) [pid 5561] close(28) = -1 EBADF (Bad file descriptor) [pid 5561] close(29) = -1 EBADF (Bad file descriptor) [pid 5561] exit_group(0) = ? [pid 5561] +++ exited with 0 +++ [pid 5087] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=22, si_uid=0, si_status=0, si_utime=0, si_stime=11 /* 0.11 s */} --- [pid 5087] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5087] umount2("./20", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] openat(AT_FDCWD, "./20", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [ 158.003334][ T5564] ? kill_css+0x3b0/0x3b0 [ 158.007745][ T5564] ? lock_acquire+0x32/0xc0 [ 158.012338][ T5564] ? kill_css+0x3b0/0x3b0 [ 158.016748][ T5564] kernfs_fop_write_iter+0x3f1/0x600 [ 158.022118][ T5564] vfs_write+0x9ed/0xe10 [ 158.026448][ T5564] ? kernel_write+0x670/0x670 [ 158.031214][ T5564] ? find_held_lock+0x2d/0x110 [ 158.036064][ T5564] ? __fget_light+0x20a/0x270 [ 158.040840][ T5564] ksys_write+0x12b/0x250 [ 158.045269][ T5564] ? __ia32_sys_read+0xb0/0xb0 [ 158.050113][ T5564] ? lockdep_hardirqs_on+0x7d/0x100 [ 158.055380][ T5564] ? _raw_spin_unlock_irq+0x2e/0x50 [ 158.060651][ T5564] ? ptrace_notify+0xfe/0x140 [ 158.065400][ T5564] do_syscall_64+0x39/0xb0 [ 158.069899][ T5564] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 158.075862][ T5564] RIP: 0033:0x7faecf034129 [ 158.080328][ T5564] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 5087] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5087] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5087] umount2("./20/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./20/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5087] unlink("./20/binderfs") = 0 [pid 5087] umount2("./20/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./20/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5087] unlink("./20/cgroup") = 0 [pid 5087] umount2("./20/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./20/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5087] unlink("./20/cgroup.net") = 0 [pid 5087] umount2("./20/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5087] umount2("./20/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./20/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5087] umount2("./20/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] openat(AT_FDCWD, "./20/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5087] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5087] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5087] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5087] close(4) = 0 [pid 5087] rmdir("./20/file0") = 0 [ 158.100004][ T5564] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 158.108489][ T5564] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 158.116521][ T5564] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 158.124549][ T5564] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 158.132579][ T5564] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 158.140628][ T5564] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000012 [ 158.148774][ T5564] [pid 5087] umount2("./20/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./20/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5087] unlink("./20/cgroup.cpu") = 0 [pid 5087] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5087] close(3) = 0 [pid 5087] rmdir("./20") = 0 [pid 5087] mkdir("./21", 0777) = 0 [pid 5087] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5583 attached [pid 5583] chdir("./21" [pid 5087] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 23 [pid 5583] <... chdir resumed>) = 0 [pid 5583] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5583] setpgid(0, 0) = 0 [pid 5583] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 5583] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 5583] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 5583] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5583] write(3, "1000", 4) = 4 [pid 5583] close(3) = 0 [ 158.173801][ T5564] memory: usage 8kB, limit 0kB, failcnt 36 [ 158.193363][ T5564] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 158.200876][ T5564] Memory cgroup stats for /syz1: [ 158.201309][ T5564] anon 0 [ 158.201309][ T5564] file 0 [ 158.201309][ T5564] kernel 8192 [ 158.201309][ T5564] kernel_stack 0 [ 158.201309][ T5564] pagetables 0 [pid 5583] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5583] mkdir("./file0", 000) = 0 [pid 5583] open("./file0", O_RDONLY) = 3 [pid 5583] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5583] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5583] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5583] openat(5, "memory.max", O_RDWR) = 6 [ 158.201309][ T5564] sec_pagetables 0 [ 158.201309][ T5564] percpu 0 [ 158.201309][ T5564] sock 0 [ 158.201309][ T5564] vmalloc 0 [ 158.201309][ T5564] shmem 0 [ 158.201309][ T5564] zswap 0 [ 158.201309][ T5564] zswapped 0 [ 158.201309][ T5564] file_mapped 0 [ 158.201309][ T5564] file_dirty 0 [ 158.201309][ T5564] file_writeback 0 [ 158.201309][ T5564] swapcached 0 [ 158.201309][ T5564] anon_thp 0 [ 158.201309][ T5564] file_thp 0 [ 158.201309][ T5564] shmem_thp 0 [ 158.201309][ T5564] inactive_anon 0 [ 158.201309][ T5564] active_anon 0 [ 158.201309][ T5564] inactive_file 0 [ 158.201309][ T5564] active_file 0 [ 158.201309][ T5564] unevictable 0 [ 158.201309][ T5564] slab_reclaimable 6752 [ 158.201309][ T5564] slab_unreclaimable 0 [ 158.201309][ T5564] slab 6752 [ 158.201309][ T5564] workingset_refault_anon 0 [ 158.201309][ T5564] workingset_refault_file 0 [ 158.201309][ T5564] workingset_activate_anon 0 [ 158.201309][ T5564] workingset_activate_file 0 [ 158.201309][ T5564] workingset_restore_anon 0 [ 158.201309][ T5564] workingset_restore_file 0 [ 158.201309][ T5564] workingset_nodereclaim 0 [ 158.201309][ T5564] pgscan 831 [ 158.201309][ T5564] pgsteal 2 [ 158.201309][ T5564] pgscan_kswapd 0 [ 158.201309][ T5564] pgscan_direct 831 [ 158.201309][ T5564] pgscan_khugepaged 0 [ 158.201309][ T5564] pgsteal_kswapd 0 [ 158.201309][ T5564] pgsteal_direct 2 [ 158.201309][ T5564] pgsteal_khugepaged 0 [ 158.201309][ T5564] pgfault 21 [ 158.201309][ T5564] pgmajfault 0 [ 158.201309][ T5564] pgrefill 830 [ 158.201309][ T5564] pgactivate 829 [ 158.201309][ T5564] pgdeactivate 830 [ 158.201309][ T5564] pglazyfree 0 [ 158.201309][ T5564] pglazyfreed 0 [ 158.201309][ T5564] zswpin 0 [ 158.201309][ T5564] zswpout 0 [ 158.201309][ T5564] thp_fault_alloc 0 [ 158.201309][ T5564] thp_collapse_alloc 0 [ 158.394831][ T5564] Tasks state (memory values in pages): [ 158.400441][ T5564] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 158.410564][ T5564] Out of memory and no killable processes... [pid 5583] write(6, "0x000000000000040e", 18 [pid 5564] <... write resumed>) = 18 [pid 5564] close(3) = 0 [pid 5564] close(4) = 0 [pid 5564] close(5) = 0 [ 158.416819][ T5568] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 158.439885][ T5568] CPU: 0 PID: 5568 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 158.449882][ T5568] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 158.459996][ T5568] Call Trace: [ 158.463315][ T5568] [ 158.466302][ T5568] dump_stack_lvl+0x136/0x150 [ 158.471045][ T5568] dump_header+0x10a/0xd70 [ 158.475519][ T5568] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 158.481676][ T5568] out_of_memory+0xd64/0x1660 [ 158.486439][ T5568] ? oom_killer_disable+0x2b0/0x2b0 [ 158.491735][ T5568] mem_cgroup_out_of_memory+0x206/0x270 [ 158.497345][ T5568] ? mem_cgroup_margin+0x130/0x130 [ 158.502517][ T5568] memory_max_write+0x2f9/0x3c0 [ 158.507417][ T5568] ? mem_cgroup_force_empty_write+0x160/0x160 [ 158.513537][ T5568] ? lock_sync+0x190/0x190 [ 158.518009][ T5568] cgroup_file_write+0x1e2/0x7b0 [ 158.522998][ T5568] ? mem_cgroup_force_empty_write+0x160/0x160 [ 158.529115][ T5568] ? kill_css+0x3b0/0x3b0 [ 158.533494][ T5568] ? lock_acquire+0x32/0xc0 [ 158.538043][ T5568] ? kill_css+0x3b0/0x3b0 [ 158.542420][ T5568] kernfs_fop_write_iter+0x3f1/0x600 [ 158.547789][ T5568] vfs_write+0x9ed/0xe10 [ 158.552085][ T5568] ? kernel_write+0x670/0x670 [ 158.556817][ T5568] ? find_held_lock+0x2d/0x110 [ 158.561635][ T5568] ? __fget_light+0x20a/0x270 [ 158.566371][ T5568] ksys_write+0x12b/0x250 [ 158.570749][ T5568] ? __ia32_sys_read+0xb0/0xb0 [ 158.575562][ T5568] ? lockdep_hardirqs_on+0x7d/0x100 [ 158.580798][ T5568] ? _raw_spin_unlock_irq+0x2e/0x50 [ 158.586039][ T5568] ? ptrace_notify+0xfe/0x140 [ 158.590756][ T5568] do_syscall_64+0x39/0xb0 [ 158.595221][ T5568] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 158.601153][ T5568] RIP: 0033:0x7faecf034129 [ 158.605596][ T5568] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 158.625235][ T5568] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 158.633695][ T5568] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 158.641695][ T5568] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 158.649690][ T5568] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 158.657689][ T5568] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 158.665688][ T5568] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000013 [pid 5564] close(6) = 0 [pid 5564] close(7) = -1 EBADF (Bad file descriptor) [pid 5564] close(8) = -1 EBADF (Bad file descriptor) [pid 5564] close(9) = -1 EBADF (Bad file descriptor) [pid 5564] close(10) = -1 EBADF (Bad file descriptor) [pid 5564] close(11) = -1 EBADF (Bad file descriptor) [pid 5564] close(12) = -1 EBADF (Bad file descriptor) [pid 5564] close(13) = -1 EBADF (Bad file descriptor) [pid 5564] close(14) = -1 EBADF (Bad file descriptor) [pid 5564] close(15) = -1 EBADF (Bad file descriptor) [pid 5564] close(16) = -1 EBADF (Bad file descriptor) [pid 5564] close(17) = -1 EBADF (Bad file descriptor) [pid 5564] close(18) = -1 EBADF (Bad file descriptor) [pid 5564] close(19) = -1 EBADF (Bad file descriptor) [pid 5564] close(20) = -1 EBADF (Bad file descriptor) [pid 5564] close(21) = -1 EBADF (Bad file descriptor) [pid 5564] close(22) = -1 EBADF (Bad file descriptor) [pid 5564] close(23) = -1 EBADF (Bad file descriptor) [pid 5564] close(24) = -1 EBADF (Bad file descriptor) [pid 5564] close(25) = -1 EBADF (Bad file descriptor) [ 158.673716][ T5568] [pid 5564] close(26) = -1 EBADF (Bad file descriptor) [pid 5564] close(27) = -1 EBADF (Bad file descriptor) [pid 5564] close(28) = -1 EBADF (Bad file descriptor) [pid 5564] close(29) = -1 EBADF (Bad file descriptor) [ 158.711873][ T5568] memory: usage 8kB, limit 0kB, failcnt 36 [ 158.717840][ T5568] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 158.729616][ T5568] Memory cgroup stats for /syz1: [ 158.729909][ T5568] anon 0 [ 158.729909][ T5568] file 0 [ 158.729909][ T5568] kernel 8192 [ 158.729909][ T5568] kernel_stack 0 [ 158.729909][ T5568] pagetables 0 [ 158.729909][ T5568] sec_pagetables 0 [ 158.729909][ T5568] percpu 0 [ 158.729909][ T5568] sock 0 [ 158.729909][ T5568] vmalloc 0 [ 158.729909][ T5568] shmem 0 [ 158.729909][ T5568] zswap 0 [ 158.729909][ T5568] zswapped 0 [ 158.729909][ T5568] file_mapped 0 [ 158.729909][ T5568] file_dirty 0 [ 158.729909][ T5568] file_writeback 0 [ 158.729909][ T5568] swapcached 0 [ 158.729909][ T5568] anon_thp 0 [ 158.729909][ T5568] file_thp 0 [ 158.729909][ T5568] shmem_thp 0 [ 158.729909][ T5568] inactive_anon 0 [ 158.729909][ T5568] active_anon 0 [ 158.729909][ T5568] inactive_file 0 [ 158.729909][ T5568] active_file 0 [ 158.729909][ T5568] unevictable 0 [ 158.729909][ T5568] slab_reclaimable 6752 [ 158.729909][ T5568] slab_unreclaimable 0 [ 158.729909][ T5568] slab 6752 [ 158.729909][ T5568] workingset_refault_anon 0 [ 158.729909][ T5568] workingset_refault_file 0 [ 158.729909][ T5568] workingset_activate_anon 0 [ 158.729909][ T5568] workingset_activate_file 0 [ 158.729909][ T5568] workingset_restore_anon 0 [ 158.729909][ T5568] workingset_restore_file 0 [ 158.729909][ T5568] workingset_nodereclaim 0 [ 158.729909][ T5568] pgscan 831 [ 158.729909][ T5568] pgsteal 2 [ 158.729909][ T5568] pgscan_kswapd 0 [ 158.729909][ T5568] pgscan_direct 831 [ 158.729909][ T5568] pgscan_khugepaged 0 [ 158.729909][ T5568] pgsteal_kswapd 0 [ 158.729909][ T5568] pgsteal_direct 2 [ 158.729909][ T5568] pgsteal_khugepaged 0 [ 158.729909][ T5568] pgfault 21 [ 158.729909][ T5568] pgmajfault 0 [ 158.729909][ T5568] pgrefill 830 [ 158.729909][ T5568] pgactivate 829 [ 158.729909][ T5568] pgdeactivate 830 [ 158.729909][ T5568] pglazyfree 0 [ 158.729909][ T5568] pglazyfreed 0 [ 158.729909][ T5568] zswpin 0 [ 158.729909][ T5568] zswpout 0 [ 158.729909][ T5568] thp_fault_alloc 0 [pid 5564] exit_group(0) = ? [pid 5564] +++ exited with 0 +++ [pid 5085] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=20, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- [pid 5085] umount2("./18", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5085] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5085] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5085] umount2("./18/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./18/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5085] unlink("./18/binderfs") = 0 [pid 5085] umount2("./18/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 158.729909][ T5568] thp_collapse_alloc 0 [pid 5085] lstat("./18/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5085] unlink("./18/cgroup") = 0 [pid 5085] umount2("./18/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./18/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5085] unlink("./18/cgroup.net") = 0 [pid 5085] umount2("./18/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5085] umount2("./18/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./18/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5085] umount2("./18/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] openat(AT_FDCWD, "./18/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5085] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5085] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5085] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5085] close(4) = 0 [pid 5085] rmdir("./18/file0") = 0 [pid 5085] umount2("./18/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./18/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5085] unlink("./18/cgroup.cpu") = 0 [pid 5085] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5085] close(3) = 0 [pid 5085] rmdir("./18") = 0 [pid 5085] mkdir("./19", 0777) = 0 [pid 5085] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5589 attached [pid 5589] chdir("./19" [pid 5085] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 21 [pid 5589] <... chdir resumed>) = 0 [pid 5589] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5589] setpgid(0, 0) = 0 [pid 5589] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 5589] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 5589] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 5589] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5589] write(3, "1000", 4) = 4 [ 158.992948][ T5568] Tasks state (memory values in pages): [ 159.001361][ T5568] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 159.030701][ T5568] Out of memory and no killable processes... [pid 5589] close(3) = 0 [pid 5568] <... write resumed>) = 18 [pid 5589] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5568] close(3 [pid 5589] mkdir("./file0", 000 [pid 5568] <... close resumed>) = 0 [pid 5589] <... mkdir resumed>) = 0 [pid 5568] close(4 [pid 5589] open("./file0", O_RDONLY) = 3 [pid 5568] <... close resumed>) = 0 [pid 5589] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5568] close(5 [pid 5589] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5589] openat(4, "syz1", O_RDWR|O_PATH [pid 5568] <... close resumed>) = 0 [pid 5589] <... openat resumed>) = 5 [pid 5568] close(6 [pid 5589] openat(5, "memory.max", O_RDWR [pid 5568] <... close resumed>) = 0 [pid 5589] <... openat resumed>) = 6 [ 159.073029][ T5577] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 159.101759][ T5577] CPU: 1 PID: 5577 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 159.111750][ T5577] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 159.121858][ T5577] Call Trace: [ 159.125186][ T5577] [ 159.128163][ T5577] dump_stack_lvl+0x136/0x150 [ 159.132914][ T5577] dump_header+0x10a/0xd70 [ 159.137394][ T5577] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 159.143552][ T5577] out_of_memory+0xd64/0x1660 [ 159.148310][ T5577] ? oom_killer_disable+0x2b0/0x2b0 [ 159.153599][ T5577] mem_cgroup_out_of_memory+0x206/0x270 [ 159.159221][ T5577] ? mem_cgroup_margin+0x130/0x130 [ 159.164425][ T5577] memory_max_write+0x2f9/0x3c0 [ 159.169381][ T5577] ? mem_cgroup_force_empty_write+0x160/0x160 [ 159.175527][ T5577] ? lock_sync+0x190/0x190 [ 159.180012][ T5577] cgroup_file_write+0x1e2/0x7b0 [ 159.185031][ T5577] ? mem_cgroup_force_empty_write+0x160/0x160 [ 159.191191][ T5577] ? kill_css+0x3b0/0x3b0 [ 159.195599][ T5577] ? lock_acquire+0x32/0xc0 [ 159.200194][ T5577] ? kill_css+0x3b0/0x3b0 [ 159.204599][ T5577] kernfs_fop_write_iter+0x3f1/0x600 [ 159.209969][ T5577] vfs_write+0x9ed/0xe10 [ 159.214297][ T5577] ? kernel_write+0x670/0x670 [ 159.219056][ T5577] ? find_held_lock+0x2d/0x110 [pid 5568] close(7 [pid 5589] write(6, "0x000000000000040e", 18 [pid 5568] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5568] close(8) = -1 EBADF (Bad file descriptor) [ 159.223895][ T5577] ? __fget_light+0x20a/0x270 [ 159.228663][ T5577] ksys_write+0x12b/0x250 [ 159.233086][ T5577] ? __ia32_sys_read+0xb0/0xb0 [ 159.237929][ T5577] ? lockdep_hardirqs_on+0x7d/0x100 [ 159.243203][ T5577] ? _raw_spin_unlock_irq+0x2e/0x50 [ 159.248483][ T5577] ? ptrace_notify+0xfe/0x140 [ 159.253237][ T5577] do_syscall_64+0x39/0xb0 [ 159.257755][ T5577] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 159.263732][ T5577] RIP: 0033:0x7faecf034129 [pid 5568] close(9) = -1 EBADF (Bad file descriptor) [pid 5568] close(10) = -1 EBADF (Bad file descriptor) [pid 5568] close(11) = -1 EBADF (Bad file descriptor) [pid 5568] close(12) = -1 EBADF (Bad file descriptor) [pid 5568] close(13) = -1 EBADF (Bad file descriptor) [pid 5568] close(14) = -1 EBADF (Bad file descriptor) [pid 5568] close(15) = -1 EBADF (Bad file descriptor) [pid 5568] close(16) = -1 EBADF (Bad file descriptor) [pid 5568] close(17) = -1 EBADF (Bad file descriptor) [pid 5568] close(18) = -1 EBADF (Bad file descriptor) [pid 5568] close(19) = -1 EBADF (Bad file descriptor) [pid 5568] close(20) = -1 EBADF (Bad file descriptor) [pid 5568] close(21) = -1 EBADF (Bad file descriptor) [pid 5568] close(22) = -1 EBADF (Bad file descriptor) [pid 5568] close(23) = -1 EBADF (Bad file descriptor) [pid 5568] close(24) = -1 EBADF (Bad file descriptor) [pid 5568] close(25) = -1 EBADF (Bad file descriptor) [pid 5568] close(26) = -1 EBADF (Bad file descriptor) [ 159.268196][ T5577] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 159.287863][ T5577] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 159.296344][ T5577] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 159.304378][ T5577] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 159.312410][ T5577] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [pid 5568] close(27) = -1 EBADF (Bad file descriptor) [pid 5568] close(28) = -1 EBADF (Bad file descriptor) [pid 5568] close(29) = -1 EBADF (Bad file descriptor) [pid 5568] exit_group(0) = ? [pid 5568] +++ exited with 0 +++ [pid 5086] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=21, si_uid=0, si_status=0, si_utime=0, si_stime=7 /* 0.07 s */} --- [pid 5086] umount2("./19", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5086] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5086] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5086] umount2("./19/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./19/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5086] unlink("./19/binderfs") = 0 [pid 5086] umount2("./19/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./19/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5086] unlink("./19/cgroup") = 0 [pid 5086] umount2("./19/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./19/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5086] unlink("./19/cgroup.net") = 0 [pid 5086] umount2("./19/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [ 159.320434][ T5577] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 159.328463][ T5577] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000016 [ 159.336526][ T5577] [ 159.358809][ T5577] memory: usage 8kB, limit 0kB, failcnt 36 [ 159.364970][ T5577] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [pid 5086] umount2("./19/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./19/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5086] umount2("./19/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] openat(AT_FDCWD, "./19/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5086] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5086] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5086] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5086] close(4) = 0 [pid 5086] rmdir("./19/file0") = 0 [pid 5086] umount2("./19/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./19/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5086] unlink("./19/cgroup.cpu") = 0 [pid 5086] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5086] close(3) = 0 [pid 5086] rmdir("./19") = 0 [pid 5086] mkdir("./20", 0777) = 0 [pid 5086] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555c0c5d0) = 22 [ 159.379307][ T5577] Memory cgroup stats for /syz1: [ 159.379587][ T5577] anon 0 [ 159.379587][ T5577] file 0 [ 159.379587][ T5577] kernel 8192 [ 159.379587][ T5577] kernel_stack 0 [ 159.379587][ T5577] pagetables 0 [ 159.379587][ T5577] sec_pagetables 0 [ 159.379587][ T5577] percpu 0 [ 159.379587][ T5577] sock 0 [ 159.379587][ T5577] vmalloc 0 [ 159.379587][ T5577] shmem 0 [ 159.379587][ T5577] zswap 0 [ 159.379587][ T5577] zswapped 0 [ 159.379587][ T5577] file_mapped 0 [ 159.379587][ T5577] file_dirty 0 [ 159.379587][ T5577] file_writeback 0 [ 159.379587][ T5577] swapcached 0 [ 159.379587][ T5577] anon_thp 0 [ 159.379587][ T5577] file_thp 0 [ 159.379587][ T5577] shmem_thp 0 [ 159.379587][ T5577] inactive_anon 0 [ 159.379587][ T5577] active_anon 0 [ 159.379587][ T5577] inactive_file 0 [ 159.379587][ T5577] active_file 0 [ 159.379587][ T5577] unevictable 0 [ 159.379587][ T5577] slab_reclaimable 6752 [ 159.379587][ T5577] slab_unreclaimable 0 [ 159.379587][ T5577] slab 6752 [ 159.379587][ T5577] workingset_refault_anon 0 [ 159.379587][ T5577] workingset_refault_file 0 [ 159.379587][ T5577] workingset_activate_anon 0 [ 159.379587][ T5577] workingset_activate_file 0 [ 159.379587][ T5577] workingset_restore_anon 0 [ 159.379587][ T5577] workingset_restore_file 0 [ 159.379587][ T5577] workingset_nodereclaim 0 [ 159.379587][ T5577] pgscan 831 [ 159.379587][ T5577] pgsteal 2 [ 159.379587][ T5577] pgscan_kswapd 0 [ 159.379587][ T5577] pgscan_direct 831 [ 159.379587][ T5577] pgscan_khugepaged 0 [ 159.379587][ T5577] pgsteal_kswapd 0 [ 159.379587][ T5577] pgsteal_direct 2 [ 159.379587][ T5577] pgsteal_khugepaged 0 ./strace-static-x86_64: Process 5591 attached [pid 5591] chdir("./20") = 0 [pid 5591] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5591] setpgid(0, 0) = 0 [pid 5591] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [pid 5591] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 5591] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 5591] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5591] write(3, "1000", 4) = 4 [ 159.379587][ T5577] pgfault 21 [ 159.379587][ T5577] pgmajfault 0 [ 159.379587][ T5577] pgrefill 830 [ 159.379587][ T5577] pgactivate 829 [ 159.379587][ T5577] pgdeactivate 830 [ 159.379587][ T5577] pglazyfree 0 [ 159.379587][ T5577] pglazyfreed 0 [ 159.379587][ T5577] zswpin 0 [ 159.379587][ T5577] zswpout 0 [ 159.379587][ T5577] thp_fault_alloc 0 [ 159.379587][ T5577] thp_collapse_alloc 0 [pid 5591] close(3) = 0 [pid 5591] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5591] mkdir("./file0", 000) = 0 [pid 5591] open("./file0", O_RDONLY) = 3 [pid 5591] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5591] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5591] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5591] openat(5, "memory.max", O_RDWR) = 6 [ 159.588003][ T5577] Tasks state (memory values in pages): [ 159.603497][ T5577] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 159.624727][ T5577] Out of memory and no killable processes... [pid 5591] write(6, "0x000000000000040e", 18 [pid 5577] <... write resumed>) = 18 [ 159.631065][ T5580] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 159.651456][ T5580] CPU: 0 PID: 5580 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 159.661430][ T5580] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 159.671536][ T5580] Call Trace: [ 159.674860][ T5580] [ 159.677851][ T5580] dump_stack_lvl+0x136/0x150 [ 159.682600][ T5580] dump_header+0x10a/0xd70 [ 159.687095][ T5580] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 159.693260][ T5580] out_of_memory+0xd64/0x1660 [ 159.698018][ T5580] ? oom_killer_disable+0x2b0/0x2b0 [ 159.703307][ T5580] ? find_held_lock+0x2d/0x110 [ 159.708157][ T5580] mem_cgroup_out_of_memory+0x206/0x270 [ 159.713779][ T5580] ? mem_cgroup_margin+0x130/0x130 [ 159.718974][ T5580] ? _raw_spin_unlock_irqrestore+0x54/0x70 [ 159.725046][ T5580] memory_max_write+0x2f9/0x3c0 [ 159.729976][ T5580] ? mem_cgroup_force_empty_write+0x160/0x160 [ 159.736128][ T5580] ? lock_sync+0x190/0x190 [ 159.740634][ T5580] cgroup_file_write+0x1e2/0x7b0 [ 159.745650][ T5580] ? mem_cgroup_force_empty_write+0x160/0x160 [ 159.751798][ T5580] ? kill_css+0x3b0/0x3b0 [ 159.756201][ T5580] ? lock_acquire+0x32/0xc0 [ 159.760787][ T5580] ? kill_css+0x3b0/0x3b0 [ 159.765199][ T5580] kernfs_fop_write_iter+0x3f1/0x600 [ 159.770572][ T5580] vfs_write+0x9ed/0xe10 [ 159.774900][ T5580] ? kernel_write+0x670/0x670 [ 159.779746][ T5580] ? find_held_lock+0x2d/0x110 [pid 5577] close(3) = 0 [pid 5577] close(4) = 0 [pid 5577] close(5) = 0 [pid 5577] close(6) = 0 [pid 5577] close(7) = -1 EBADF (Bad file descriptor) [pid 5577] close(8) = -1 EBADF (Bad file descriptor) [ 159.784583][ T5580] ? __fget_light+0x20a/0x270 [ 159.789357][ T5580] ksys_write+0x12b/0x250 [ 159.793765][ T5580] ? __ia32_sys_read+0xb0/0xb0 [ 159.798606][ T5580] ? lockdep_hardirqs_on+0x7d/0x100 [ 159.803874][ T5580] ? _raw_spin_unlock_irq+0x2e/0x50 [ 159.809166][ T5580] ? ptrace_notify+0xfe/0x140 [ 159.813935][ T5580] do_syscall_64+0x39/0xb0 [ 159.818440][ T5580] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 159.824408][ T5580] RIP: 0033:0x7faecf034129 [pid 5577] close(9) = -1 EBADF (Bad file descriptor) [pid 5577] close(10) = -1 EBADF (Bad file descriptor) [pid 5577] close(11) = -1 EBADF (Bad file descriptor) [pid 5577] close(12) = -1 EBADF (Bad file descriptor) [pid 5577] close(13) = -1 EBADF (Bad file descriptor) [pid 5577] close(14) = -1 EBADF (Bad file descriptor) [pid 5577] close(15) = -1 EBADF (Bad file descriptor) [pid 5577] close(16) = -1 EBADF (Bad file descriptor) [pid 5577] close(17) = -1 EBADF (Bad file descriptor) [pid 5577] close(18) = -1 EBADF (Bad file descriptor) [pid 5577] close(19) = -1 EBADF (Bad file descriptor) [pid 5577] close(20) = -1 EBADF (Bad file descriptor) [pid 5577] close(21) = -1 EBADF (Bad file descriptor) [pid 5577] close(22) = -1 EBADF (Bad file descriptor) [pid 5577] close(23) = -1 EBADF (Bad file descriptor) [pid 5577] close(24) = -1 EBADF (Bad file descriptor) [ 159.828879][ T5580] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 159.848555][ T5580] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 159.857043][ T5580] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 159.865081][ T5580] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 159.873118][ T5580] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 159.881165][ T5580] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [pid 5577] close(25) = -1 EBADF (Bad file descriptor) [pid 5577] close(26) = -1 EBADF (Bad file descriptor) [pid 5577] close(27) = -1 EBADF (Bad file descriptor) [pid 5577] close(28) = -1 EBADF (Bad file descriptor) [pid 5577] close(29) = -1 EBADF (Bad file descriptor) [pid 5577] exit_group(0) = ? [pid 5577] +++ exited with 0 +++ [pid 5090] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=24, si_uid=0, si_status=0, si_utime=0, si_stime=9 /* 0.09 s */} --- [pid 5090] umount2("./22", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] openat(AT_FDCWD, "./22", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5090] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5090] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5090] umount2("./22/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./22/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5090] unlink("./22/binderfs") = 0 [pid 5090] umount2("./22/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./22/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5090] unlink("./22/cgroup") = 0 [pid 5090] umount2("./22/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./22/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5090] unlink("./22/cgroup.net") = 0 [pid 5090] umount2("./22/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5090] umount2("./22/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./22/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5090] umount2("./22/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] openat(AT_FDCWD, "./22/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5090] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5090] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5090] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5090] close(4) = 0 [pid 5090] rmdir("./22/file0") = 0 [pid 5090] umount2("./22/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 159.889207][ T5580] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000016 [ 159.897298][ T5580] [ 159.914614][ T5580] memory: usage 8kB, limit 0kB, failcnt 36 [ 159.920504][ T5580] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [pid 5090] lstat("./22/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5090] unlink("./22/cgroup.cpu") = 0 [pid 5090] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5090] close(3) = 0 [pid 5090] rmdir("./22") = 0 [pid 5090] mkdir("./23", 0777) = 0 [ 159.962589][ T5580] Memory cgroup stats for /syz1: [ 159.962870][ T5580] anon 0 [ 159.962870][ T5580] file 0 [ 159.962870][ T5580] kernel 8192 [ 159.962870][ T5580] kernel_stack 0 [ 159.962870][ T5580] pagetables 0 [ 159.962870][ T5580] sec_pagetables 0 [ 159.962870][ T5580] percpu 0 [ 159.962870][ T5580] sock 0 [ 159.962870][ T5580] vmalloc 0 [ 159.962870][ T5580] shmem 0 [ 159.962870][ T5580] zswap 0 [ 159.962870][ T5580] zswapped 0 [ 159.962870][ T5580] file_mapped 0 [ 159.962870][ T5580] file_dirty 0 [pid 5090] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555c0c5d0) = 25 ./strace-static-x86_64: Process 5595 attached [pid 5595] chdir("./23") = 0 [pid 5595] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5595] setpgid(0, 0) = 0 [pid 5595] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 5595] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 5595] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [pid 5595] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5595] write(3, "1000", 4) = 4 [pid 5595] close(3) = 0 [pid 5595] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5595] mkdir("./file0", 000) = 0 [pid 5595] open("./file0", O_RDONLY) = 3 [ 159.962870][ T5580] file_writeback 0 [ 159.962870][ T5580] swapcached 0 [ 159.962870][ T5580] anon_thp 0 [ 159.962870][ T5580] file_thp 0 [ 159.962870][ T5580] shmem_thp 0 [ 159.962870][ T5580] inactive_anon 0 [ 159.962870][ T5580] active_anon 0 [ 159.962870][ T5580] inactive_file 0 [ 159.962870][ T5580] active_file 0 [ 159.962870][ T5580] unevictable 0 [ 159.962870][ T5580] slab_reclaimable 6752 [ 159.962870][ T5580] slab_unreclaimable 0 [ 159.962870][ T5580] slab 6752 [ 159.962870][ T5580] workingset_refault_anon 0 [ 159.962870][ T5580] workingset_refault_file 0 [pid 5595] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5595] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5595] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5595] openat(5, "memory.max", O_RDWR) = 6 [ 159.962870][ T5580] workingset_activate_anon 0 [ 159.962870][ T5580] workingset_activate_file 0 [ 159.962870][ T5580] workingset_restore_anon 0 [ 159.962870][ T5580] workingset_restore_file 0 [ 159.962870][ T5580] workingset_nodereclaim 0 [ 159.962870][ T5580] pgscan 831 [ 159.962870][ T5580] pgsteal 2 [ 159.962870][ T5580] pgscan_kswapd 0 [ 159.962870][ T5580] pgscan_direct 831 [ 159.962870][ T5580] pgscan_khugepaged 0 [ 159.962870][ T5580] pgsteal_kswapd 0 [ 159.962870][ T5580] pgsteal_direct 2 [ 159.962870][ T5580] pgsteal_khugepaged 0 [ 159.962870][ T5580] pgfault 21 [ 159.962870][ T5580] pgmajfault 0 [ 159.962870][ T5580] pgrefill 830 [ 159.962870][ T5580] pgactivate 829 [ 159.962870][ T5580] pgdeactivate 830 [ 159.962870][ T5580] pglazyfree 0 [ 159.962870][ T5580] pglazyfreed 0 [ 159.962870][ T5580] zswpin 0 [ 159.962870][ T5580] zswpout 0 [ 159.962870][ T5580] thp_fault_alloc 0 [ 159.962870][ T5580] thp_collapse_alloc 0 [pid 5595] write(6, "0x000000000000040e", 18 [pid 5580] <... write resumed>) = 18 [pid 5580] close(3) = 0 [pid 5580] close(4) = 0 [ 160.164829][ T5580] Tasks state (memory values in pages): [ 160.170536][ T5580] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 160.180734][ T5580] Out of memory and no killable processes... [ 160.187338][ T5583] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 160.198182][ T5583] CPU: 1 PID: 5583 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [pid 5580] close(5) = 0 [pid 5580] close(6) = 0 [pid 5580] close(7) = -1 EBADF (Bad file descriptor) [pid 5580] close(8) = -1 EBADF (Bad file descriptor) [pid 5580] close(9) = -1 EBADF (Bad file descriptor) [pid 5580] close(10) = -1 EBADF (Bad file descriptor) [pid 5580] close(11) = -1 EBADF (Bad file descriptor) [pid 5580] close(12) = -1 EBADF (Bad file descriptor) [pid 5580] close(13) = -1 EBADF (Bad file descriptor) [pid 5580] close(14) = -1 EBADF (Bad file descriptor) [pid 5580] close(15) = -1 EBADF (Bad file descriptor) [pid 5580] close(16) = -1 EBADF (Bad file descriptor) [pid 5580] close(17) = -1 EBADF (Bad file descriptor) [pid 5580] close(18) = -1 EBADF (Bad file descriptor) [pid 5580] close(19) = -1 EBADF (Bad file descriptor) [pid 5580] close(20) = -1 EBADF (Bad file descriptor) [ 160.208149][ T5583] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 160.218262][ T5583] Call Trace: [ 160.221601][ T5583] [ 160.224580][ T5583] dump_stack_lvl+0x136/0x150 [ 160.229336][ T5583] dump_header+0x10a/0xd70 [ 160.233826][ T5583] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 160.239997][ T5583] out_of_memory+0xd64/0x1660 [ 160.244772][ T5583] ? oom_killer_disable+0x2b0/0x2b0 [ 160.250061][ T5583] ? find_held_lock+0x2d/0x110 [ 160.254910][ T5583] mem_cgroup_out_of_memory+0x206/0x270 [ 160.260523][ T5583] ? mem_cgroup_margin+0x130/0x130 [pid 5580] close(21) = -1 EBADF (Bad file descriptor) [pid 5580] close(22) = -1 EBADF (Bad file descriptor) [pid 5580] close(23) = -1 EBADF (Bad file descriptor) [pid 5580] close(24) = -1 EBADF (Bad file descriptor) [pid 5580] close(25) = -1 EBADF (Bad file descriptor) [pid 5580] close(26) = -1 EBADF (Bad file descriptor) [pid 5580] close(27) = -1 EBADF (Bad file descriptor) [pid 5580] close(28) = -1 EBADF (Bad file descriptor) [pid 5580] close(29) = -1 EBADF (Bad file descriptor) [pid 5580] exit_group(0) = ? [pid 5580] +++ exited with 0 +++ [pid 5089] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=24, si_uid=0, si_status=0, si_utime=0, si_stime=9 /* 0.09 s */} --- [pid 5089] umount2("./22", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] openat(AT_FDCWD, "./22", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5089] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [ 160.265717][ T5583] ? _raw_spin_unlock_irqrestore+0x54/0x70 [ 160.271618][ T5583] memory_max_write+0x2f9/0x3c0 [ 160.276556][ T5583] ? mem_cgroup_force_empty_write+0x160/0x160 [ 160.282717][ T5583] ? lock_sync+0x190/0x190 [ 160.287216][ T5583] cgroup_file_write+0x1e2/0x7b0 [ 160.292244][ T5583] ? mem_cgroup_force_empty_write+0x160/0x160 [ 160.298398][ T5583] ? kill_css+0x3b0/0x3b0 [ 160.302813][ T5583] ? lock_acquire+0x32/0xc0 [ 160.307399][ T5583] ? kill_css+0x3b0/0x3b0 [pid 5089] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5089] umount2("./22/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./22/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5089] unlink("./22/binderfs") = 0 [pid 5089] umount2("./22/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./22/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5089] unlink("./22/cgroup") = 0 [pid 5089] umount2("./22/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./22/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5089] unlink("./22/cgroup.net") = 0 [ 160.311794][ T5583] kernfs_fop_write_iter+0x3f1/0x600 [ 160.317159][ T5583] vfs_write+0x9ed/0xe10 [ 160.321489][ T5583] ? kernel_write+0x670/0x670 [ 160.326253][ T5583] ? find_held_lock+0x2d/0x110 [ 160.331099][ T5583] ? __fget_light+0x20a/0x270 [ 160.335873][ T5583] ksys_write+0x12b/0x250 [ 160.340287][ T5583] ? __ia32_sys_read+0xb0/0xb0 [ 160.345142][ T5583] ? lockdep_hardirqs_on+0x7d/0x100 [ 160.350413][ T5583] ? _raw_spin_unlock_irq+0x2e/0x50 [ 160.355685][ T5583] ? ptrace_notify+0xfe/0x140 [ 160.360432][ T5583] do_syscall_64+0x39/0xb0 [ 160.364918][ T5583] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 160.370843][ T5583] RIP: 0033:0x7faecf034129 [ 160.375296][ T5583] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 160.394963][ T5583] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 160.403441][ T5583] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [pid 5089] umount2("./22/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5089] umount2("./22/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./22/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5089] umount2("./22/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] openat(AT_FDCWD, "./22/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5089] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [ 160.411456][ T5583] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 160.419464][ T5583] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 160.427473][ T5583] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 160.435501][ T5583] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000015 [ 160.443563][ T5583] [pid 5089] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5089] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5089] close(4) = 0 [pid 5089] rmdir("./22/file0") = 0 [pid 5089] umount2("./22/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./22/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5089] unlink("./22/cgroup.cpu") = 0 [pid 5089] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5089] close(3) = 0 [pid 5089] rmdir("./22") = 0 [pid 5089] mkdir("./23", 0777) = 0 [pid 5089] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555c0c5d0) = 25 ./strace-static-x86_64: Process 5596 attached [pid 5596] chdir("./23") = 0 [pid 5596] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5596] setpgid(0, 0) = 0 [pid 5596] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 5596] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [pid 5596] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [ 160.463664][ T5583] memory: usage 8kB, limit 0kB, failcnt 36 [ 160.469549][ T5583] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 160.485399][ T5583] Memory cgroup stats for /syz1: [ 160.485710][ T5583] anon 0 [ 160.485710][ T5583] file 0 [ 160.485710][ T5583] kernel 8192 [ 160.485710][ T5583] kernel_stack 0 [ 160.485710][ T5583] pagetables 0 [ 160.485710][ T5583] sec_pagetables 0 [ 160.485710][ T5583] percpu 0 [ 160.485710][ T5583] sock 0 [pid 5596] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5596] write(3, "1000", 4) = 4 [pid 5596] close(3) = 0 [pid 5596] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5596] mkdir("./file0", 000) = 0 [pid 5596] open("./file0", O_RDONLY) = 3 [pid 5596] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5596] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5596] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5596] openat(5, "memory.max", O_RDWR) = 6 [ 160.485710][ T5583] vmalloc 0 [ 160.485710][ T5583] shmem 0 [ 160.485710][ T5583] zswap 0 [ 160.485710][ T5583] zswapped 0 [ 160.485710][ T5583] file_mapped 0 [ 160.485710][ T5583] file_dirty 0 [ 160.485710][ T5583] file_writeback 0 [ 160.485710][ T5583] swapcached 0 [ 160.485710][ T5583] anon_thp 0 [ 160.485710][ T5583] file_thp 0 [ 160.485710][ T5583] shmem_thp 0 [ 160.485710][ T5583] inactive_anon 0 [ 160.485710][ T5583] active_anon 0 [ 160.485710][ T5583] inactive_file 0 [ 160.485710][ T5583] active_file 0 [ 160.485710][ T5583] unevictable 0 [ 160.485710][ T5583] slab_reclaimable 6752 [ 160.485710][ T5583] slab_unreclaimable 0 [ 160.485710][ T5583] slab 6752 [ 160.485710][ T5583] workingset_refault_anon 0 [ 160.485710][ T5583] workingset_refault_file 0 [ 160.485710][ T5583] workingset_activate_anon 0 [ 160.485710][ T5583] workingset_activate_file 0 [ 160.485710][ T5583] workingset_restore_anon 0 [ 160.485710][ T5583] workingset_restore_file 0 [ 160.485710][ T5583] workingset_nodereclaim 0 [ 160.485710][ T5583] pgscan 831 [ 160.485710][ T5583] pgsteal 2 [ 160.485710][ T5583] pgscan_kswapd 0 [ 160.485710][ T5583] pgscan_direct 831 [ 160.485710][ T5583] pgscan_khugepaged 0 [ 160.485710][ T5583] pgsteal_kswapd 0 [ 160.485710][ T5583] pgsteal_direct 2 [ 160.485710][ T5583] pgsteal_khugepaged 0 [ 160.485710][ T5583] pgfault 21 [ 160.485710][ T5583] pgmajfault 0 [ 160.485710][ T5583] pgrefill 830 [ 160.485710][ T5583] pgactivate 829 [ 160.485710][ T5583] pgdeactivate 830 [ 160.485710][ T5583] pglazyfree 0 [ 160.485710][ T5583] pglazyfreed 0 [ 160.485710][ T5583] zswpin 0 [ 160.485710][ T5583] zswpout 0 [ 160.485710][ T5583] thp_fault_alloc 0 [pid 5596] write(6, "0x000000000000040e", 18 [pid 5583] <... write resumed>) = 18 [pid 5583] close(3) = 0 [pid 5583] close(4) = 0 [pid 5583] close(5) = 0 [pid 5583] close(6) = 0 [pid 5583] close(7) = -1 EBADF (Bad file descriptor) [pid 5583] close(8) = -1 EBADF (Bad file descriptor) [pid 5583] close(9) = -1 EBADF (Bad file descriptor) [pid 5583] close(10) = -1 EBADF (Bad file descriptor) [pid 5583] close(11) = -1 EBADF (Bad file descriptor) [pid 5583] close(12) = -1 EBADF (Bad file descriptor) [pid 5583] close(13) = -1 EBADF (Bad file descriptor) [pid 5583] close(14) = -1 EBADF (Bad file descriptor) [pid 5583] close(15) = -1 EBADF (Bad file descriptor) [pid 5583] close(16) = -1 EBADF (Bad file descriptor) [pid 5583] close(17) = -1 EBADF (Bad file descriptor) [pid 5583] close(18) = -1 EBADF (Bad file descriptor) [pid 5583] close(19) = -1 EBADF (Bad file descriptor) [pid 5583] close(20) = -1 EBADF (Bad file descriptor) [pid 5583] close(21) = -1 EBADF (Bad file descriptor) [ 160.485710][ T5583] thp_collapse_alloc 0 [ 160.672923][ T5583] Tasks state (memory values in pages): [ 160.679540][ T5583] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 160.694286][ T5583] Out of memory and no killable processes... [ 160.700583][ T5589] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 160.718942][ T5589] CPU: 0 PID: 5589 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 160.729013][ T5589] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 160.739118][ T5589] Call Trace: [ 160.742419][ T5589] [ 160.745373][ T5589] dump_stack_lvl+0x136/0x150 [ 160.750117][ T5589] dump_header+0x10a/0xd70 [ 160.754564][ T5589] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 160.760684][ T5589] out_of_memory+0xd64/0x1660 [ 160.765408][ T5589] ? oom_killer_disable+0x2b0/0x2b0 [ 160.770673][ T5589] mem_cgroup_out_of_memory+0x206/0x270 [ 160.776266][ T5589] ? mem_cgroup_margin+0x130/0x130 [ 160.781455][ T5589] memory_max_write+0x2f9/0x3c0 [ 160.786379][ T5589] ? mem_cgroup_force_empty_write+0x160/0x160 [ 160.792502][ T5589] ? lock_sync+0x190/0x190 [ 160.796980][ T5589] cgroup_file_write+0x1e2/0x7b0 [ 160.801965][ T5589] ? mem_cgroup_force_empty_write+0x160/0x160 [ 160.808077][ T5589] ? kill_css+0x3b0/0x3b0 [ 160.812452][ T5589] ? lock_acquire+0x32/0xc0 [ 160.817016][ T5589] ? kill_css+0x3b0/0x3b0 [ 160.821385][ T5589] kernfs_fop_write_iter+0x3f1/0x600 [ 160.826719][ T5589] vfs_write+0x9ed/0xe10 [ 160.831020][ T5589] ? kernel_write+0x670/0x670 [ 160.835748][ T5589] ? find_held_lock+0x2d/0x110 [ 160.840555][ T5589] ? __fget_light+0x20a/0x270 [ 160.845307][ T5589] ksys_write+0x12b/0x250 [ 160.849701][ T5589] ? __ia32_sys_read+0xb0/0xb0 [ 160.854529][ T5589] ? lockdep_hardirqs_on+0x7d/0x100 [ 160.859786][ T5589] ? _raw_spin_unlock_irq+0x2e/0x50 [ 160.865035][ T5589] ? ptrace_notify+0xfe/0x140 [ 160.869756][ T5589] do_syscall_64+0x39/0xb0 [ 160.874225][ T5589] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 160.880160][ T5589] RIP: 0033:0x7faecf034129 [ 160.884603][ T5589] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 160.904243][ T5589] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 5583] close(22) = -1 EBADF (Bad file descriptor) [pid 5583] close(23) = -1 EBADF (Bad file descriptor) [pid 5583] close(24) = -1 EBADF (Bad file descriptor) [pid 5583] close(25) = -1 EBADF (Bad file descriptor) [pid 5583] close(26) = -1 EBADF (Bad file descriptor) [pid 5583] close(27) = -1 EBADF (Bad file descriptor) [pid 5583] close(28) = -1 EBADF (Bad file descriptor) [pid 5583] close(29) = -1 EBADF (Bad file descriptor) [pid 5583] exit_group(0) = ? [pid 5583] +++ exited with 0 +++ [pid 5087] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=23, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- [pid 5087] umount2("./21", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] openat(AT_FDCWD, "./21", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5087] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5087] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5087] umount2("./21/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./21/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5087] unlink("./21/binderfs") = 0 [pid 5087] umount2("./21/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 160.912690][ T5589] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 160.920688][ T5589] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 160.928686][ T5589] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 160.936681][ T5589] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 160.944676][ T5589] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000013 [ 160.952694][ T5589] [ 160.963903][ T5589] memory: usage 8kB, limit 0kB, failcnt 36 [pid 5087] lstat("./21/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5087] unlink("./21/cgroup") = 0 [pid 5087] umount2("./21/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./21/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5087] unlink("./21/cgroup.net") = 0 [ 160.971386][ T5589] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 160.978925][ T5589] Memory cgroup stats for /syz1: [ 160.979326][ T5589] anon 0 [ 160.979326][ T5589] file 0 [ 160.979326][ T5589] kernel 8192 [ 160.979326][ T5589] kernel_stack 0 [ 160.979326][ T5589] pagetables 0 [ 160.979326][ T5589] sec_pagetables 0 [ 160.979326][ T5589] percpu 0 [ 160.979326][ T5589] sock 0 [ 160.979326][ T5589] vmalloc 0 [ 160.979326][ T5589] shmem 0 [ 160.979326][ T5589] zswap 0 [ 160.979326][ T5589] zswapped 0 [ 160.979326][ T5589] file_mapped 0 [ 160.979326][ T5589] file_dirty 0 [ 160.979326][ T5589] file_writeback 0 [ 160.979326][ T5589] swapcached 0 [ 160.979326][ T5589] anon_thp 0 [ 160.979326][ T5589] file_thp 0 [ 160.979326][ T5589] shmem_thp 0 [ 160.979326][ T5589] inactive_anon 0 [ 160.979326][ T5589] active_anon 0 [ 160.979326][ T5589] inactive_file 0 [ 160.979326][ T5589] active_file 0 [ 160.979326][ T5589] unevictable 0 [ 160.979326][ T5589] slab_reclaimable 6752 [ 160.979326][ T5589] slab_unreclaimable 0 [ 160.979326][ T5589] slab 6752 [ 160.979326][ T5589] workingset_refault_anon 0 [ 160.979326][ T5589] workingset_refault_file 0 [ 160.979326][ T5589] workingset_activate_anon 0 [ 160.979326][ T5589] workingset_activate_file 0 [ 160.979326][ T5589] workingset_restore_anon 0 [ 160.979326][ T5589] workingset_restore_file 0 [ 160.979326][ T5589] workingset_nodereclaim 0 [ 160.979326][ T5589] pgscan 831 [ 160.979326][ T5589] pgsteal 2 [ 160.979326][ T5589] pgscan_kswapd 0 [ 160.979326][ T5589] pgscan_direct 831 [ 160.979326][ T5589] pgscan_khugepaged 0 [pid 5087] umount2("./21/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5087] umount2("./21/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./21/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [ 160.979326][ T5589] pgsteal_kswapd 0 [ 160.979326][ T5589] pgsteal_direct 2 [ 160.979326][ T5589] pgsteal_khugepaged 0 [ 160.979326][ T5589] pgfault 21 [ 160.979326][ T5589] pgmajfault 0 [ 160.979326][ T5589] pgrefill 830 [ 160.979326][ T5589] pgactivate 829 [ 160.979326][ T5589] pgdeactivate 830 [ 160.979326][ T5589] pglazyfree 0 [ 160.979326][ T5589] pglazyfreed 0 [ 160.979326][ T5589] zswpin 0 [ 160.979326][ T5589] zswpout 0 [ 160.979326][ T5589] thp_fault_alloc 0 [ 160.979326][ T5589] thp_collapse_alloc 0 [pid 5087] umount2("./21/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] openat(AT_FDCWD, "./21/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5087] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5087] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5087] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5087] close(4) = 0 [pid 5087] rmdir("./21/file0") = 0 [pid 5087] umount2("./21/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./21/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5087] unlink("./21/cgroup.cpu") = 0 [pid 5087] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5087] close(3) = 0 [pid 5087] rmdir("./21") = 0 [pid 5087] mkdir("./22", 0777) = 0 [pid 5087] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5597 attached [pid 5597] chdir("./22" [pid 5087] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 24 [pid 5597] <... chdir resumed>) = 0 [pid 5597] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5597] setpgid(0, 0) = 0 [pid 5597] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 5597] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 5597] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 5597] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5597] write(3, "1000", 4) = 4 [pid 5597] close(3) = 0 [pid 5597] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5597] mkdir("./file0", 000) = 0 [pid 5597] open("./file0", O_RDONLY) = 3 [ 161.173509][ T5589] Tasks state (memory values in pages): [ 161.196110][ T5589] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5597] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5597] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5597] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5597] openat(5, "memory.max", O_RDWR) = 6 [pid 5597] write(6, "0x000000000000040e", 18 [pid 5589] <... write resumed>) = 18 [pid 5589] close(3) = 0 [pid 5589] close(4) = 0 [pid 5589] close(5) = 0 [pid 5589] close(6) = 0 [ 161.229985][ T5589] Out of memory and no killable processes... [ 161.244940][ T5591] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 161.257519][ T5591] CPU: 0 PID: 5591 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 161.267506][ T5591] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [pid 5589] close(7) = -1 EBADF (Bad file descriptor) [pid 5589] close(8) = -1 EBADF (Bad file descriptor) [pid 5589] close(9) = -1 EBADF (Bad file descriptor) [pid 5589] close(10) = -1 EBADF (Bad file descriptor) [pid 5589] close(11) = -1 EBADF (Bad file descriptor) [pid 5589] close(12) = -1 EBADF (Bad file descriptor) [pid 5589] close(13) = -1 EBADF (Bad file descriptor) [pid 5589] close(14) = -1 EBADF (Bad file descriptor) [pid 5589] close(15) = -1 EBADF (Bad file descriptor) [pid 5589] close(16) = -1 EBADF (Bad file descriptor) [pid 5589] close(17) = -1 EBADF (Bad file descriptor) [pid 5589] close(18) = -1 EBADF (Bad file descriptor) [pid 5589] close(19) = -1 EBADF (Bad file descriptor) [pid 5589] close(20) = -1 EBADF (Bad file descriptor) [pid 5589] close(21) = -1 EBADF (Bad file descriptor) [ 161.277615][ T5591] Call Trace: [ 161.280947][ T5591] [ 161.283934][ T5591] dump_stack_lvl+0x136/0x150 [ 161.288701][ T5591] dump_header+0x10a/0xd70 [ 161.293187][ T5591] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 161.299351][ T5591] out_of_memory+0xd64/0x1660 [ 161.304117][ T5591] ? oom_killer_disable+0x2b0/0x2b0 [ 161.309408][ T5591] mem_cgroup_out_of_memory+0x206/0x270 [ 161.315038][ T5591] ? mem_cgroup_margin+0x130/0x130 [ 161.320257][ T5591] memory_max_write+0x2f9/0x3c0 [pid 5589] close(22) = -1 EBADF (Bad file descriptor) [pid 5589] close(23) = -1 EBADF (Bad file descriptor) [pid 5589] close(24) = -1 EBADF (Bad file descriptor) [pid 5589] close(25) = -1 EBADF (Bad file descriptor) [pid 5589] close(26) = -1 EBADF (Bad file descriptor) [pid 5589] close(27) = -1 EBADF (Bad file descriptor) [pid 5589] close(28) = -1 EBADF (Bad file descriptor) [pid 5589] close(29) = -1 EBADF (Bad file descriptor) [pid 5589] exit_group(0) = ? [pid 5589] +++ exited with 0 +++ [ 161.325207][ T5591] ? mem_cgroup_force_empty_write+0x160/0x160 [ 161.331368][ T5591] ? lock_sync+0x190/0x190 [ 161.335843][ T5591] cgroup_file_write+0x1e2/0x7b0 [ 161.340835][ T5591] ? mem_cgroup_force_empty_write+0x160/0x160 [ 161.347015][ T5591] ? kill_css+0x3b0/0x3b0 [ 161.351418][ T5591] ? lock_acquire+0x32/0xc0 [ 161.356007][ T5591] ? kill_css+0x3b0/0x3b0 [ 161.360404][ T5591] kernfs_fop_write_iter+0x3f1/0x600 [ 161.365748][ T5591] vfs_write+0x9ed/0xe10 [ 161.370063][ T5591] ? kernel_write+0x670/0x670 [ 161.374783][ T5591] ? find_held_lock+0x2d/0x110 [ 161.379584][ T5591] ? __fget_light+0x20a/0x270 [ 161.384306][ T5591] ksys_write+0x12b/0x250 [ 161.388691][ T5591] ? __ia32_sys_read+0xb0/0xb0 [ 161.393531][ T5591] ? lockdep_hardirqs_on+0x7d/0x100 [ 161.398778][ T5591] ? _raw_spin_unlock_irq+0x2e/0x50 [ 161.404029][ T5591] ? ptrace_notify+0xfe/0x140 [ 161.408783][ T5591] do_syscall_64+0x39/0xb0 [ 161.413270][ T5591] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 161.419206][ T5591] RIP: 0033:0x7faecf034129 [ 161.423677][ T5591] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 161.443352][ T5591] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 161.451821][ T5591] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 161.459826][ T5591] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 161.467854][ T5591] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [pid 5085] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=21, si_uid=0, si_status=0, si_utime=0, si_stime=11 /* 0.11 s */} --- [pid 5085] umount2("./19", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5085] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5085] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5085] umount2("./19/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./19/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5085] unlink("./19/binderfs") = 0 [pid 5085] umount2("./19/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./19/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5085] unlink("./19/cgroup") = 0 [pid 5085] umount2("./19/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./19/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5085] unlink("./19/cgroup.net") = 0 [pid 5085] umount2("./19/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5085] umount2("./19/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./19/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5085] umount2("./19/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] openat(AT_FDCWD, "./19/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5085] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5085] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5085] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [ 161.475863][ T5591] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 161.483869][ T5591] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000014 [ 161.491927][ T5591] [pid 5085] close(4) = 0 [pid 5085] rmdir("./19/file0") = 0 [pid 5085] umount2("./19/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./19/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5085] unlink("./19/cgroup.cpu") = 0 [pid 5085] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5085] close(3) = 0 [pid 5085] rmdir("./19") = 0 [pid 5085] mkdir("./20", 0777) = 0 [pid 5085] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5598 attached [pid 5598] chdir("./20" [pid 5085] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 22 [pid 5598] <... chdir resumed>) = 0 [pid 5598] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5598] setpgid(0, 0) = 0 [pid 5598] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [ 161.521481][ T5591] memory: usage 8kB, limit 0kB, failcnt 36 [ 161.528659][ T5591] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 161.536522][ T5591] Memory cgroup stats for /syz1: [ 161.536894][ T5591] anon 0 [ 161.536894][ T5591] file 0 [ 161.536894][ T5591] kernel 8192 [ 161.536894][ T5591] kernel_stack 0 [ 161.536894][ T5591] pagetables 0 [ 161.536894][ T5591] sec_pagetables 0 [ 161.536894][ T5591] percpu 0 [ 161.536894][ T5591] sock 0 [ 161.536894][ T5591] vmalloc 0 [pid 5598] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 5598] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 5598] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5598] write(3, "1000", 4) = 4 [pid 5598] close(3) = 0 [pid 5598] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5598] mkdir("./file0", 000) = 0 [pid 5598] open("./file0", O_RDONLY) = 3 [pid 5598] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5598] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5598] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5598] openat(5, "memory.max", O_RDWR) = 6 [ 161.536894][ T5591] shmem 0 [ 161.536894][ T5591] zswap 0 [ 161.536894][ T5591] zswapped 0 [ 161.536894][ T5591] file_mapped 0 [ 161.536894][ T5591] file_dirty 0 [ 161.536894][ T5591] file_writeback 0 [ 161.536894][ T5591] swapcached 0 [ 161.536894][ T5591] anon_thp 0 [ 161.536894][ T5591] file_thp 0 [ 161.536894][ T5591] shmem_thp 0 [ 161.536894][ T5591] inactive_anon 0 [ 161.536894][ T5591] active_anon 0 [ 161.536894][ T5591] inactive_file 0 [ 161.536894][ T5591] active_file 0 [ 161.536894][ T5591] unevictable 0 [ 161.536894][ T5591] slab_reclaimable 6752 [ 161.536894][ T5591] slab_unreclaimable 0 [ 161.536894][ T5591] slab 6752 [ 161.536894][ T5591] workingset_refault_anon 0 [ 161.536894][ T5591] workingset_refault_file 0 [ 161.536894][ T5591] workingset_activate_anon 0 [ 161.536894][ T5591] workingset_activate_file 0 [ 161.536894][ T5591] workingset_restore_anon 0 [ 161.536894][ T5591] workingset_restore_file 0 [ 161.536894][ T5591] workingset_nodereclaim 0 [ 161.536894][ T5591] pgscan 831 [ 161.536894][ T5591] pgsteal 2 [ 161.536894][ T5591] pgscan_kswapd 0 [ 161.536894][ T5591] pgscan_direct 831 [ 161.536894][ T5591] pgscan_khugepaged 0 [ 161.536894][ T5591] pgsteal_kswapd 0 [ 161.536894][ T5591] pgsteal_direct 2 [ 161.536894][ T5591] pgsteal_khugepaged 0 [ 161.536894][ T5591] pgfault 21 [ 161.536894][ T5591] pgmajfault 0 [ 161.536894][ T5591] pgrefill 830 [ 161.536894][ T5591] pgactivate 829 [ 161.536894][ T5591] pgdeactivate 830 [ 161.536894][ T5591] pglazyfree 0 [ 161.536894][ T5591] pglazyfreed 0 [ 161.536894][ T5591] zswpin 0 [ 161.536894][ T5591] zswpout 0 [ 161.536894][ T5591] thp_fault_alloc 0 [ 161.536894][ T5591] thp_collapse_alloc 0 [ 161.728984][ T5591] Tasks state (memory values in pages): [ 161.736404][ T5591] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 161.755373][ T5591] Out of memory and no killable processes... [pid 5598] write(6, "0x000000000000040e", 18 [pid 5591] <... write resumed>) = 18 [pid 5591] close(3) = 0 [pid 5591] close(4) = 0 [pid 5591] close(5) = 0 [pid 5591] close(6) = 0 [pid 5591] close(7) = -1 EBADF (Bad file descriptor) [pid 5591] close(8) = -1 EBADF (Bad file descriptor) [pid 5591] close(9) = -1 EBADF (Bad file descriptor) [pid 5591] close(10) = -1 EBADF (Bad file descriptor) [pid 5591] close(11) = -1 EBADF (Bad file descriptor) [pid 5591] close(12) = -1 EBADF (Bad file descriptor) [pid 5591] close(13) = -1 EBADF (Bad file descriptor) [pid 5591] close(14) = -1 EBADF (Bad file descriptor) [pid 5591] close(15) = -1 EBADF (Bad file descriptor) [pid 5591] close(16) = -1 EBADF (Bad file descriptor) [pid 5591] close(17) = -1 EBADF (Bad file descriptor) [pid 5591] close(18) = -1 EBADF (Bad file descriptor) [pid 5591] close(19) = -1 EBADF (Bad file descriptor) [pid 5591] close(20) = -1 EBADF (Bad file descriptor) [pid 5591] close(21) = -1 EBADF (Bad file descriptor) [pid 5591] close(22) = -1 EBADF (Bad file descriptor) [pid 5591] close(23) = -1 EBADF (Bad file descriptor) [ 161.767398][ T5595] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 161.788909][ T5595] CPU: 0 PID: 5595 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 161.798907][ T5595] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 161.809035][ T5595] Call Trace: [ 161.812382][ T5595] [ 161.815361][ T5595] dump_stack_lvl+0x136/0x150 [pid 5591] close(24) = -1 EBADF (Bad file descriptor) [pid 5591] close(25) = -1 EBADF (Bad file descriptor) [pid 5591] close(26) = -1 EBADF (Bad file descriptor) [pid 5591] close(27) = -1 EBADF (Bad file descriptor) [pid 5591] close(28) = -1 EBADF (Bad file descriptor) [pid 5591] close(29) = -1 EBADF (Bad file descriptor) [pid 5591] exit_group(0) = ? [pid 5591] +++ exited with 0 +++ [pid 5086] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=22, si_uid=0, si_status=0, si_utime=0, si_stime=10 /* 0.10 s */} --- [pid 5086] umount2("./20", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] openat(AT_FDCWD, "./20", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5086] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5086] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5086] umount2("./20/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./20/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5086] unlink("./20/binderfs") = 0 [pid 5086] umount2("./20/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./20/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [ 161.820115][ T5595] dump_header+0x10a/0xd70 [ 161.824602][ T5595] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 161.830773][ T5595] out_of_memory+0xd64/0x1660 [ 161.835541][ T5595] ? oom_killer_disable+0x2b0/0x2b0 [ 161.840851][ T5595] mem_cgroup_out_of_memory+0x206/0x270 [ 161.846482][ T5595] ? mem_cgroup_margin+0x130/0x130 [ 161.851706][ T5595] memory_max_write+0x2f9/0x3c0 [ 161.856647][ T5595] ? mem_cgroup_force_empty_write+0x160/0x160 [ 161.862811][ T5595] ? lock_sync+0x190/0x190 [ 161.867330][ T5595] cgroup_file_write+0x1e2/0x7b0 [ 161.872352][ T5595] ? mem_cgroup_force_empty_write+0x160/0x160 [ 161.878536][ T5595] ? kill_css+0x3b0/0x3b0 [ 161.882917][ T5595] ? lock_acquire+0x32/0xc0 [ 161.887474][ T5595] ? kill_css+0x3b0/0x3b0 [ 161.891863][ T5595] kernfs_fop_write_iter+0x3f1/0x600 [ 161.897198][ T5595] vfs_write+0x9ed/0xe10 [ 161.901493][ T5595] ? kernel_write+0x670/0x670 [ 161.906229][ T5595] ? find_held_lock+0x2d/0x110 [ 161.911040][ T5595] ? __fget_light+0x20a/0x270 [ 161.915769][ T5595] ksys_write+0x12b/0x250 [ 161.920150][ T5595] ? __ia32_sys_read+0xb0/0xb0 [ 161.924963][ T5595] ? lockdep_hardirqs_on+0x7d/0x100 [ 161.930199][ T5595] ? _raw_spin_unlock_irq+0x2e/0x50 [ 161.935531][ T5595] ? ptrace_notify+0xfe/0x140 [ 161.940249][ T5595] do_syscall_64+0x39/0xb0 [ 161.944717][ T5595] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 161.950653][ T5595] RIP: 0033:0x7faecf034129 [ 161.955097][ T5595] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 161.974737][ T5595] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 161.983187][ T5595] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 161.991186][ T5595] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 161.999179][ T5595] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 162.007268][ T5595] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 162.015266][ T5595] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000017 [pid 5086] unlink("./20/cgroup") = 0 [pid 5086] umount2("./20/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./20/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5086] unlink("./20/cgroup.net") = 0 [pid 5086] umount2("./20/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5086] umount2("./20/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./20/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5086] umount2("./20/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] openat(AT_FDCWD, "./20/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5086] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5086] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5086] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5086] close(4) = 0 [pid 5086] rmdir("./20/file0") = 0 [pid 5086] umount2("./20/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./20/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5086] unlink("./20/cgroup.cpu") = 0 [pid 5086] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5086] close(3) = 0 [ 162.023284][ T5595] [ 162.035078][ T5595] memory: usage 8kB, limit 0kB, failcnt 36 [ 162.049121][ T5595] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 162.059787][ T5595] Memory cgroup stats for /syz1: [ 162.060040][ T5595] anon 0 [ 162.060040][ T5595] file 0 [ 162.060040][ T5595] kernel 8192 [pid 5086] rmdir("./20") = 0 [pid 5086] mkdir("./21", 0777) = 0 [pid 5086] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5600 attached [pid 5600] chdir("./21" [pid 5086] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 23 [pid 5600] <... chdir resumed>) = 0 [pid 5600] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5600] setpgid(0, 0) = 0 [pid 5600] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [pid 5600] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 5600] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 5600] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5600] write(3, "1000", 4) = 4 [pid 5600] close(3) = 0 [ 162.060040][ T5595] kernel_stack 0 [ 162.060040][ T5595] pagetables 0 [ 162.060040][ T5595] sec_pagetables 0 [ 162.060040][ T5595] percpu 0 [ 162.060040][ T5595] sock 0 [ 162.060040][ T5595] vmalloc 0 [ 162.060040][ T5595] shmem 0 [ 162.060040][ T5595] zswap 0 [ 162.060040][ T5595] zswapped 0 [ 162.060040][ T5595] file_mapped 0 [ 162.060040][ T5595] file_dirty 0 [ 162.060040][ T5595] file_writeback 0 [ 162.060040][ T5595] swapcached 0 [ 162.060040][ T5595] anon_thp 0 [ 162.060040][ T5595] file_thp 0 [ 162.060040][ T5595] shmem_thp 0 [pid 5600] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5600] mkdir("./file0", 000) = 0 [pid 5600] open("./file0", O_RDONLY) = 3 [pid 5600] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5600] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5600] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5600] openat(5, "memory.max", O_RDWR) = 6 [ 162.060040][ T5595] inactive_anon 0 [ 162.060040][ T5595] active_anon 0 [ 162.060040][ T5595] inactive_file 0 [ 162.060040][ T5595] active_file 0 [ 162.060040][ T5595] unevictable 0 [ 162.060040][ T5595] slab_reclaimable 6752 [ 162.060040][ T5595] slab_unreclaimable 0 [ 162.060040][ T5595] slab 6752 [ 162.060040][ T5595] workingset_refault_anon 0 [ 162.060040][ T5595] workingset_refault_file 0 [ 162.060040][ T5595] workingset_activate_anon 0 [ 162.060040][ T5595] workingset_activate_file 0 [ 162.060040][ T5595] workingset_restore_anon 0 [ 162.060040][ T5595] workingset_restore_file 0 [ 162.060040][ T5595] workingset_nodereclaim 0 [ 162.060040][ T5595] pgscan 831 [ 162.060040][ T5595] pgsteal 2 [ 162.060040][ T5595] pgscan_kswapd 0 [ 162.060040][ T5595] pgscan_direct 831 [ 162.060040][ T5595] pgscan_khugepaged 0 [ 162.060040][ T5595] pgsteal_kswapd 0 [ 162.060040][ T5595] pgsteal_direct 2 [ 162.060040][ T5595] pgsteal_khugepaged 0 [ 162.060040][ T5595] pgfault 21 [ 162.060040][ T5595] pgmajfault 0 [ 162.060040][ T5595] pgrefill 830 [ 162.060040][ T5595] pgactivate 829 [pid 5600] write(6, "0x000000000000040e", 18 [pid 5595] <... write resumed>) = 18 [ 162.060040][ T5595] pgdeactivate 830 [ 162.060040][ T5595] pglazyfree 0 [ 162.060040][ T5595] pglazyfreed 0 [ 162.060040][ T5595] zswpin 0 [ 162.060040][ T5595] zswpout 0 [ 162.060040][ T5595] thp_fault_alloc 0 [ 162.060040][ T5595] thp_collapse_alloc 0 [ 162.246409][ T5595] Tasks state (memory values in pages): [ 162.252155][ T5595] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 162.266941][ T5595] Out of memory and no killable processes... [pid 5595] close(3) = 0 [pid 5595] close(4) = 0 [pid 5595] close(5) = 0 [pid 5595] close(6) = 0 [pid 5595] close(7) = -1 EBADF (Bad file descriptor) [pid 5595] close(8) = -1 EBADF (Bad file descriptor) [pid 5595] close(9) = -1 EBADF (Bad file descriptor) [pid 5595] close(10) = -1 EBADF (Bad file descriptor) [pid 5595] close(11) = -1 EBADF (Bad file descriptor) [pid 5595] close(12) = -1 EBADF (Bad file descriptor) [pid 5595] close(13) = -1 EBADF (Bad file descriptor) [pid 5595] close(14) = -1 EBADF (Bad file descriptor) [pid 5595] close(15) = -1 EBADF (Bad file descriptor) [pid 5595] close(16) = -1 EBADF (Bad file descriptor) [pid 5595] close(17) = -1 EBADF (Bad file descriptor) [pid 5595] close(18) = -1 EBADF (Bad file descriptor) [pid 5595] close(19) = -1 EBADF (Bad file descriptor) [pid 5595] close(20) = -1 EBADF (Bad file descriptor) [pid 5595] close(21) = -1 EBADF (Bad file descriptor) [pid 5595] close(22) = -1 EBADF (Bad file descriptor) [pid 5595] close(23) = -1 EBADF (Bad file descriptor) [pid 5595] close(24) = -1 EBADF (Bad file descriptor) [ 162.276073][ T5596] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 162.301782][ T5596] CPU: 0 PID: 5596 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 162.311781][ T5596] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 162.321898][ T5596] Call Trace: [pid 5595] close(25) = -1 EBADF (Bad file descriptor) [pid 5595] close(26) = -1 EBADF (Bad file descriptor) [pid 5595] close(27) = -1 EBADF (Bad file descriptor) [pid 5595] close(28) = -1 EBADF (Bad file descriptor) [pid 5595] close(29) = -1 EBADF (Bad file descriptor) [pid 5595] exit_group(0) = ? [pid 5595] +++ exited with 0 +++ [pid 5090] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=25, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- [pid 5090] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5090] umount2("./23", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] openat(AT_FDCWD, "./23", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5090] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5090] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5090] umount2("./23/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./23/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5090] unlink("./23/binderfs") = 0 [pid 5090] umount2("./23/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./23/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5090] unlink("./23/cgroup") = 0 [pid 5090] umount2("./23/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./23/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5090] unlink("./23/cgroup.net") = 0 [ 162.325238][ T5596] [ 162.328218][ T5596] dump_stack_lvl+0x136/0x150 [ 162.332969][ T5596] dump_header+0x10a/0xd70 [ 162.337468][ T5596] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 162.343641][ T5596] out_of_memory+0xd64/0x1660 [ 162.348408][ T5596] ? oom_killer_disable+0x2b0/0x2b0 [ 162.353697][ T5596] mem_cgroup_out_of_memory+0x206/0x270 [ 162.359325][ T5596] ? mem_cgroup_margin+0x130/0x130 [ 162.364544][ T5596] memory_max_write+0x2f9/0x3c0 [ 162.369491][ T5596] ? mem_cgroup_force_empty_write+0x160/0x160 [ 162.375647][ T5596] ? lock_sync+0x190/0x190 [ 162.380141][ T5596] cgroup_file_write+0x1e2/0x7b0 [ 162.385157][ T5596] ? mem_cgroup_force_empty_write+0x160/0x160 [ 162.391303][ T5596] ? kill_css+0x3b0/0x3b0 [ 162.395706][ T5596] ? lock_acquire+0x32/0xc0 [ 162.400289][ T5596] ? kill_css+0x3b0/0x3b0 [ 162.404688][ T5596] kernfs_fop_write_iter+0x3f1/0x600 [ 162.410046][ T5596] vfs_write+0x9ed/0xe10 [ 162.414364][ T5596] ? kernel_write+0x670/0x670 [ 162.419133][ T5596] ? asm_common_interrupt+0x26/0x40 [ 162.424405][ T5596] ? asm_common_interrupt+0x26/0x40 [ 162.429691][ T5596] ? __fget_light+0x20a/0x270 [ 162.434450][ T5596] ksys_write+0x12b/0x250 [ 162.438848][ T5596] ? __ia32_sys_read+0xb0/0xb0 [ 162.443660][ T5596] ? _raw_spin_unlock_irq+0x2e/0x50 [ 162.448936][ T5596] ? ptrace_notify+0xfe/0x140 [ 162.453683][ T5596] do_syscall_64+0x39/0xb0 [ 162.458182][ T5596] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 162.464134][ T5596] RIP: 0033:0x7faecf034129 [ 162.468602][ T5596] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 162.488272][ T5596] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 162.496752][ T5596] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 162.504786][ T5596] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 162.512815][ T5596] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [pid 5090] umount2("./23/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5090] umount2("./23/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./23/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5090] umount2("./23/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] openat(AT_FDCWD, "./23/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5090] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5090] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5090] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5090] close(4) = 0 [pid 5090] rmdir("./23/file0") = 0 [pid 5090] umount2("./23/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 162.520849][ T5596] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 162.528877][ T5596] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000017 [ 162.536946][ T5596] [ 162.565566][ T5596] memory: usage 8kB, limit 0kB, failcnt 36 [pid 5090] lstat("./23/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5090] unlink("./23/cgroup.cpu") = 0 [pid 5090] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5090] close(3) = 0 [pid 5090] rmdir("./23") = 0 [pid 5090] mkdir("./24", 0777) = 0 [pid 5090] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555c0c5d0) = 26 [ 162.572729][ T5596] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 162.579919][ T5596] Memory cgroup stats for /syz1: [ 162.580327][ T5596] anon 0 [ 162.580327][ T5596] file 0 [ 162.580327][ T5596] kernel 8192 [ 162.580327][ T5596] kernel_stack 0 [ 162.580327][ T5596] pagetables 0 [ 162.580327][ T5596] sec_pagetables 0 [ 162.580327][ T5596] percpu 0 [ 162.580327][ T5596] sock 0 [ 162.580327][ T5596] vmalloc 0 [ 162.580327][ T5596] shmem 0 [ 162.580327][ T5596] zswap 0 [ 162.580327][ T5596] zswapped 0 [ 162.580327][ T5596] file_mapped 0 [ 162.580327][ T5596] file_dirty 0 [ 162.580327][ T5596] file_writeback 0 [ 162.580327][ T5596] swapcached 0 [ 162.580327][ T5596] anon_thp 0 [ 162.580327][ T5596] file_thp 0 [ 162.580327][ T5596] shmem_thp 0 [ 162.580327][ T5596] inactive_anon 0 [ 162.580327][ T5596] active_anon 0 [ 162.580327][ T5596] inactive_file 0 [ 162.580327][ T5596] active_file 0 [ 162.580327][ T5596] unevictable 0 [ 162.580327][ T5596] slab_reclaimable 6752 [ 162.580327][ T5596] slab_unreclaimable 0 [ 162.580327][ T5596] slab 6752 [ 162.580327][ T5596] workingset_refault_anon 0 [ 162.580327][ T5596] workingset_refault_file 0 [ 162.580327][ T5596] workingset_activate_anon 0 [ 162.580327][ T5596] workingset_activate_file 0 [ 162.580327][ T5596] workingset_restore_anon 0 [ 162.580327][ T5596] workingset_restore_file 0 [ 162.580327][ T5596] workingset_nodereclaim 0 [ 162.580327][ T5596] pgscan 831 [ 162.580327][ T5596] pgsteal 2 [ 162.580327][ T5596] pgscan_kswapd 0 [ 162.580327][ T5596] pgscan_direct 831 [ 162.580327][ T5596] pgscan_khugepaged 0 [ 162.580327][ T5596] pgsteal_kswapd 0 [ 162.580327][ T5596] pgsteal_direct 2 [ 162.580327][ T5596] pgsteal_khugepaged 0 [ 162.580327][ T5596] pgfault 21 [ 162.580327][ T5596] pgmajfault 0 [ 162.580327][ T5596] pgrefill 830 [ 162.580327][ T5596] pgactivate 829 [ 162.580327][ T5596] pgdeactivate 830 [ 162.580327][ T5596] pglazyfree 0 [ 162.580327][ T5596] pglazyfreed 0 [ 162.580327][ T5596] zswpin 0 [ 162.580327][ T5596] zswpout 0 [ 162.580327][ T5596] thp_fault_alloc 0 [ 162.580327][ T5596] thp_collapse_alloc 0 ./strace-static-x86_64: Process 5601 attached [pid 5601] chdir("./24") = 0 [pid 5601] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5601] setpgid(0, 0) = 0 [pid 5601] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 5601] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 5601] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [pid 5601] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5601] write(3, "1000", 4) = 4 [pid 5601] close(3) = 0 [pid 5601] symlink("/dev/binderfs", "./binderfs" [pid 5596] <... write resumed>) = 18 [pid 5596] close(3) = 0 [pid 5596] close(4) = 0 [pid 5596] close(5) = 0 [pid 5596] close(6) = 0 [pid 5596] close(7) = -1 EBADF (Bad file descriptor) [pid 5596] close(8) = -1 EBADF (Bad file descriptor) [pid 5596] close(9) = -1 EBADF (Bad file descriptor) [pid 5596] close(10) = -1 EBADF (Bad file descriptor) [pid 5596] close(11) = -1 EBADF (Bad file descriptor) [pid 5596] close(12) = -1 EBADF (Bad file descriptor) [pid 5596] close(13) = -1 EBADF (Bad file descriptor) [pid 5596] close(14) = -1 EBADF (Bad file descriptor) [pid 5596] close(15) = -1 EBADF (Bad file descriptor) [pid 5596] close(16) = -1 EBADF (Bad file descriptor) [pid 5596] close(17) = -1 EBADF (Bad file descriptor) [pid 5596] close(18) = -1 EBADF (Bad file descriptor) [pid 5596] close(19) = -1 EBADF (Bad file descriptor) [pid 5596] close(20) = -1 EBADF (Bad file descriptor) [pid 5596] close(21) = -1 EBADF (Bad file descriptor) [pid 5596] close(22) = -1 EBADF (Bad file descriptor) [pid 5596] close(23) = -1 EBADF (Bad file descriptor) [pid 5596] close(24) = -1 EBADF (Bad file descriptor) [pid 5596] close(25) = -1 EBADF (Bad file descriptor) [pid 5596] close(26) = -1 EBADF (Bad file descriptor) [pid 5596] close(27) = -1 EBADF (Bad file descriptor) [pid 5596] close(28) = -1 EBADF (Bad file descriptor) [pid 5596] close(29) = -1 EBADF (Bad file descriptor) [pid 5596] exit_group(0) = ? [pid 5601] <... symlink resumed>) = 0 [pid 5596] +++ exited with 0 +++ [pid 5601] mkdir("./file0", 000) = 0 [pid 5601] open("./file0", O_RDONLY) = 3 [pid 5601] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [ 162.774819][ T5596] Tasks state (memory values in pages): [ 162.781000][ T5596] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 162.793661][ T5596] Out of memory and no killable processes... [ 162.799784][ T5597] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 162.812574][ T5597] CPU: 1 PID: 5597 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [pid 5601] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5601] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5601] openat(5, "memory.max", O_RDWR) = 6 [pid 5601] write(6, "0x000000000000040e", 18 [pid 5089] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=25, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- [pid 5089] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5089] umount2("./23", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] openat(AT_FDCWD, "./23", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5089] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5089] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5089] umount2("./23/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./23/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5089] unlink("./23/binderfs") = 0 [pid 5089] umount2("./23/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./23/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5089] unlink("./23/cgroup") = 0 [pid 5089] umount2("./23/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./23/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5089] unlink("./23/cgroup.net") = 0 [ 162.822558][ T5597] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 162.832666][ T5597] Call Trace: [ 162.835994][ T5597] [ 162.838970][ T5597] dump_stack_lvl+0x136/0x150 [ 162.843718][ T5597] dump_header+0x10a/0xd70 [ 162.848200][ T5597] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 162.854372][ T5597] out_of_memory+0xd64/0x1660 [ 162.859149][ T5597] ? oom_killer_disable+0x2b0/0x2b0 [ 162.864444][ T5597] mem_cgroup_out_of_memory+0x206/0x270 [ 162.870065][ T5597] ? mem_cgroup_margin+0x130/0x130 [ 162.875277][ T5597] memory_max_write+0x2f9/0x3c0 [ 162.880237][ T5597] ? mem_cgroup_force_empty_write+0x160/0x160 [ 162.886418][ T5597] ? lock_sync+0x190/0x190 [ 162.890889][ T5597] cgroup_file_write+0x1e2/0x7b0 [ 162.895912][ T5597] ? mem_cgroup_force_empty_write+0x160/0x160 [ 162.902054][ T5597] ? kill_css+0x3b0/0x3b0 [ 162.906420][ T5597] ? lock_acquire+0x32/0xc0 [ 162.910987][ T5597] ? kill_css+0x3b0/0x3b0 [ 162.915394][ T5597] kernfs_fop_write_iter+0x3f1/0x600 [ 162.920757][ T5597] vfs_write+0x9ed/0xe10 [ 162.925084][ T5597] ? kernel_write+0x670/0x670 [ 162.929837][ T5597] ? find_held_lock+0x2d/0x110 [ 162.934656][ T5597] ? __fget_light+0x20a/0x270 [ 162.939408][ T5597] ksys_write+0x12b/0x250 [ 162.943802][ T5597] ? __ia32_sys_read+0xb0/0xb0 [ 162.948618][ T5597] ? lockdep_hardirqs_on+0x7d/0x100 [ 162.953877][ T5597] ? _raw_spin_unlock_irq+0x2e/0x50 [ 162.959109][ T5597] ? ptrace_notify+0xfe/0x140 [ 162.963839][ T5597] do_syscall_64+0x39/0xb0 [ 162.968331][ T5597] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 162.974312][ T5597] RIP: 0033:0x7faecf034129 [ 162.978777][ T5597] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 162.998454][ T5597] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 163.006934][ T5597] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 163.014946][ T5597] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [pid 5089] umount2("./23/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5089] umount2("./23/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./23/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5089] umount2("./23/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] openat(AT_FDCWD, "./23/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5089] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5089] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5089] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5089] close(4) = 0 [pid 5089] rmdir("./23/file0") = 0 [ 163.022982][ T5597] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 163.031010][ T5597] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 163.039045][ T5597] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000016 [ 163.047107][ T5597] [ 163.062669][ T5597] memory: usage 8kB, limit 0kB, failcnt 36 [ 163.068705][ T5597] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [pid 5089] umount2("./23/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./23/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5089] unlink("./23/cgroup.cpu") = 0 [pid 5089] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5089] close(3) = 0 [pid 5089] rmdir("./23") = 0 [pid 5089] mkdir("./24", 0777) = 0 [pid 5089] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5602 attached [pid 5602] chdir("./24" [pid 5089] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 26 [pid 5602] <... chdir resumed>) = 0 [pid 5602] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5602] setpgid(0, 0) = 0 [pid 5602] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 5602] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [pid 5602] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 5602] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [ 163.076298][ T5597] Memory cgroup stats for /syz1: [ 163.076581][ T5597] anon 0 [ 163.076581][ T5597] file 0 [ 163.076581][ T5597] kernel 8192 [ 163.076581][ T5597] kernel_stack 0 [ 163.076581][ T5597] pagetables 0 [ 163.076581][ T5597] sec_pagetables 0 [ 163.076581][ T5597] percpu 0 [ 163.076581][ T5597] sock 0 [ 163.076581][ T5597] vmalloc 0 [ 163.076581][ T5597] shmem 0 [ 163.076581][ T5597] zswap 0 [ 163.076581][ T5597] zswapped 0 [ 163.076581][ T5597] file_mapped 0 [ 163.076581][ T5597] file_dirty 0 [ 163.076581][ T5597] file_writeback 0 [pid 5602] write(3, "1000", 4) = 4 [pid 5602] close(3) = 0 [pid 5602] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5602] mkdir("./file0", 000) = 0 [pid 5602] open("./file0", O_RDONLY) = 3 [pid 5602] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5602] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5602] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5602] openat(5, "memory.max", O_RDWR) = 6 [ 163.076581][ T5597] swapcached 0 [ 163.076581][ T5597] anon_thp 0 [ 163.076581][ T5597] file_thp 0 [ 163.076581][ T5597] shmem_thp 0 [ 163.076581][ T5597] inactive_anon 0 [ 163.076581][ T5597] active_anon 0 [ 163.076581][ T5597] inactive_file 0 [ 163.076581][ T5597] active_file 0 [ 163.076581][ T5597] unevictable 0 [ 163.076581][ T5597] slab_reclaimable 6752 [ 163.076581][ T5597] slab_unreclaimable 0 [ 163.076581][ T5597] slab 6752 [ 163.076581][ T5597] workingset_refault_anon 0 [ 163.076581][ T5597] workingset_refault_file 0 [ 163.076581][ T5597] workingset_activate_anon 0 [ 163.076581][ T5597] workingset_activate_file 0 [ 163.076581][ T5597] workingset_restore_anon 0 [ 163.076581][ T5597] workingset_restore_file 0 [ 163.076581][ T5597] workingset_nodereclaim 0 [ 163.076581][ T5597] pgscan 831 [ 163.076581][ T5597] pgsteal 2 [ 163.076581][ T5597] pgscan_kswapd 0 [ 163.076581][ T5597] pgscan_direct 831 [ 163.076581][ T5597] pgscan_khugepaged 0 [ 163.076581][ T5597] pgsteal_kswapd 0 [ 163.076581][ T5597] pgsteal_direct 2 [ 163.076581][ T5597] pgsteal_khugepaged 0 [ 163.076581][ T5597] pgfault 21 [ 163.076581][ T5597] pgmajfault 0 [ 163.076581][ T5597] pgrefill 830 [ 163.076581][ T5597] pgactivate 829 [ 163.076581][ T5597] pgdeactivate 830 [ 163.076581][ T5597] pglazyfree 0 [ 163.076581][ T5597] pglazyfreed 0 [ 163.076581][ T5597] zswpin 0 [ 163.076581][ T5597] zswpout 0 [ 163.076581][ T5597] thp_fault_alloc 0 [ 163.076581][ T5597] thp_collapse_alloc 0 [ 163.264683][ T5597] Tasks state (memory values in pages): [ 163.270293][ T5597] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5602] write(6, "0x000000000000040e", 18 [pid 5597] <... write resumed>) = 18 [pid 5597] close(3) = 0 [pid 5597] close(4) = 0 [pid 5597] close(5) = 0 [pid 5597] close(6) = 0 [pid 5597] close(7) = -1 EBADF (Bad file descriptor) [pid 5597] close(8) = -1 EBADF (Bad file descriptor) [pid 5597] close(9) = -1 EBADF (Bad file descriptor) [pid 5597] close(10) = -1 EBADF (Bad file descriptor) [pid 5597] close(11) = -1 EBADF (Bad file descriptor) [pid 5597] close(12) = -1 EBADF (Bad file descriptor) [pid 5597] close(13) = -1 EBADF (Bad file descriptor) [pid 5597] close(14) = -1 EBADF (Bad file descriptor) [pid 5597] close(15) = -1 EBADF (Bad file descriptor) [ 163.283575][ T5597] Out of memory and no killable processes... [ 163.289838][ T5598] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 163.301231][ T5598] CPU: 0 PID: 5598 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 163.311207][ T5598] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 163.321401][ T5598] Call Trace: [ 163.324729][ T5598] [ 163.327713][ T5598] dump_stack_lvl+0x136/0x150 [pid 5597] close(16) = -1 EBADF (Bad file descriptor) [pid 5597] close(17) = -1 EBADF (Bad file descriptor) [pid 5597] close(18) = -1 EBADF (Bad file descriptor) [pid 5597] close(19) = -1 EBADF (Bad file descriptor) [pid 5597] close(20) = -1 EBADF (Bad file descriptor) [pid 5597] close(21) = -1 EBADF (Bad file descriptor) [pid 5597] close(22) = -1 EBADF (Bad file descriptor) [pid 5597] close(23) = -1 EBADF (Bad file descriptor) [pid 5597] close(24) = -1 EBADF (Bad file descriptor) [pid 5597] close(25) = -1 EBADF (Bad file descriptor) [pid 5597] close(26) = -1 EBADF (Bad file descriptor) [pid 5597] close(27) = -1 EBADF (Bad file descriptor) [pid 5597] close(28) = -1 EBADF (Bad file descriptor) [pid 5597] close(29) = -1 EBADF (Bad file descriptor) [pid 5597] exit_group(0) = ? [pid 5597] +++ exited with 0 +++ [pid 5087] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=24, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- [ 163.332467][ T5598] dump_header+0x10a/0xd70 [ 163.336958][ T5598] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 163.343119][ T5598] out_of_memory+0xd64/0x1660 [ 163.347887][ T5598] ? oom_killer_disable+0x2b0/0x2b0 [ 163.353185][ T5598] ? find_held_lock+0x2d/0x110 [ 163.358049][ T5598] mem_cgroup_out_of_memory+0x206/0x270 [ 163.363666][ T5598] ? mem_cgroup_margin+0x130/0x130 [ 163.368865][ T5598] ? _raw_spin_unlock_irqrestore+0x54/0x70 [ 163.374768][ T5598] memory_max_write+0x2f9/0x3c0 [pid 5087] umount2("./22", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] openat(AT_FDCWD, "./22", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5087] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5087] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5087] umount2("./22/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./22/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5087] unlink("./22/binderfs") = 0 [pid 5087] umount2("./22/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./22/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5087] unlink("./22/cgroup") = 0 [pid 5087] umount2("./22/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./22/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5087] unlink("./22/cgroup.net") = 0 [ 163.379706][ T5598] ? mem_cgroup_force_empty_write+0x160/0x160 [ 163.385860][ T5598] ? lock_sync+0x190/0x190 [ 163.390358][ T5598] cgroup_file_write+0x1e2/0x7b0 [ 163.395372][ T5598] ? mem_cgroup_force_empty_write+0x160/0x160 [ 163.401518][ T5598] ? kill_css+0x3b0/0x3b0 [ 163.405935][ T5598] ? lock_acquire+0x32/0xc0 [ 163.410522][ T5598] ? kill_css+0x3b0/0x3b0 [ 163.414937][ T5598] kernfs_fop_write_iter+0x3f1/0x600 [ 163.420320][ T5598] vfs_write+0x9ed/0xe10 [ 163.424648][ T5598] ? kernel_write+0x670/0x670 [ 163.429412][ T5598] ? find_held_lock+0x2d/0x110 [ 163.434254][ T5598] ? __fget_light+0x20a/0x270 [ 163.439009][ T5598] ksys_write+0x12b/0x250 [ 163.443411][ T5598] ? __ia32_sys_read+0xb0/0xb0 [ 163.448249][ T5598] ? lockdep_hardirqs_on+0x7d/0x100 [ 163.453514][ T5598] ? _raw_spin_unlock_irq+0x2e/0x50 [ 163.458784][ T5598] ? ptrace_notify+0xfe/0x140 [ 163.463536][ T5598] do_syscall_64+0x39/0xb0 [ 163.468031][ T5598] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 163.473992][ T5598] RIP: 0033:0x7faecf034129 [ 163.478443][ T5598] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 163.498094][ T5598] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 163.506572][ T5598] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 163.514600][ T5598] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 163.522629][ T5598] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [pid 5087] umount2("./22/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5087] umount2("./22/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./22/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5087] umount2("./22/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] openat(AT_FDCWD, "./22/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5087] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5087] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5087] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5087] close(4) = 0 [pid 5087] rmdir("./22/file0") = 0 [ 163.530658][ T5598] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 163.538686][ T5598] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000014 [ 163.546758][ T5598] [ 163.564427][ T5598] memory: usage 8kB, limit 0kB, failcnt 36 [ 163.570313][ T5598] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 163.578450][ T5598] Memory cgroup stats for /syz1: [pid 5087] umount2("./22/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./22/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5087] unlink("./22/cgroup.cpu") = 0 [pid 5087] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5087] close(3) = 0 [pid 5087] rmdir("./22") = 0 [pid 5087] mkdir("./23", 0777) = 0 [pid 5087] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5603 attached [pid 5603] chdir("./23" [pid 5087] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 25 [pid 5603] <... chdir resumed>) = 0 [pid 5603] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5603] setpgid(0, 0) = 0 [pid 5603] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 5603] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 5603] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 5603] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5603] write(3, "1000", 4) = 4 [ 163.578880][ T5598] anon 0 [ 163.578880][ T5598] file 0 [ 163.578880][ T5598] kernel 8192 [ 163.578880][ T5598] kernel_stack 0 [ 163.578880][ T5598] pagetables 0 [ 163.578880][ T5598] sec_pagetables 0 [ 163.578880][ T5598] percpu 0 [ 163.578880][ T5598] sock 0 [ 163.578880][ T5598] vmalloc 0 [ 163.578880][ T5598] shmem 0 [ 163.578880][ T5598] zswap 0 [ 163.578880][ T5598] zswapped 0 [ 163.578880][ T5598] file_mapped 0 [ 163.578880][ T5598] file_dirty 0 [ 163.578880][ T5598] file_writeback 0 [ 163.578880][ T5598] swapcached 0 [pid 5603] close(3) = 0 [pid 5603] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5603] mkdir("./file0", 000) = 0 [pid 5603] open("./file0", O_RDONLY) = 3 [pid 5603] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5603] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5603] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5603] openat(5, "memory.max", O_RDWR) = 6 [ 163.578880][ T5598] anon_thp 0 [ 163.578880][ T5598] file_thp 0 [ 163.578880][ T5598] shmem_thp 0 [ 163.578880][ T5598] inactive_anon 0 [ 163.578880][ T5598] active_anon 0 [ 163.578880][ T5598] inactive_file 0 [ 163.578880][ T5598] active_file 0 [ 163.578880][ T5598] unevictable 0 [ 163.578880][ T5598] slab_reclaimable 6752 [ 163.578880][ T5598] slab_unreclaimable 0 [ 163.578880][ T5598] slab 6752 [ 163.578880][ T5598] workingset_refault_anon 0 [ 163.578880][ T5598] workingset_refault_file 0 [ 163.578880][ T5598] workingset_activate_anon 0 [ 163.578880][ T5598] workingset_activate_file 0 [ 163.578880][ T5598] workingset_restore_anon 0 [ 163.578880][ T5598] workingset_restore_file 0 [ 163.578880][ T5598] workingset_nodereclaim 0 [ 163.578880][ T5598] pgscan 831 [ 163.578880][ T5598] pgsteal 2 [ 163.578880][ T5598] pgscan_kswapd 0 [ 163.578880][ T5598] pgscan_direct 831 [ 163.578880][ T5598] pgscan_khugepaged 0 [ 163.578880][ T5598] pgsteal_kswapd 0 [ 163.578880][ T5598] pgsteal_direct 2 [ 163.578880][ T5598] pgsteal_khugepaged 0 [ 163.578880][ T5598] pgfault 21 [ 163.578880][ T5598] pgmajfault 0 [ 163.578880][ T5598] pgrefill 830 [ 163.578880][ T5598] pgactivate 829 [ 163.578880][ T5598] pgdeactivate 830 [ 163.578880][ T5598] pglazyfree 0 [ 163.578880][ T5598] pglazyfreed 0 [ 163.578880][ T5598] zswpin 0 [ 163.578880][ T5598] zswpout 0 [ 163.578880][ T5598] thp_fault_alloc 0 [ 163.578880][ T5598] thp_collapse_alloc 0 [pid 5603] write(6, "0x000000000000040e", 18 [pid 5598] <... write resumed>) = 18 [pid 5598] close(3) = 0 [pid 5598] close(4) = 0 [pid 5598] close(5) = 0 [pid 5598] close(6) = 0 [pid 5598] close(7) = -1 EBADF (Bad file descriptor) [pid 5598] close(8) = -1 EBADF (Bad file descriptor) [pid 5598] close(9) = -1 EBADF (Bad file descriptor) [pid 5598] close(10) = -1 EBADF (Bad file descriptor) [pid 5598] close(11) = -1 EBADF (Bad file descriptor) [pid 5598] close(12) = -1 EBADF (Bad file descriptor) [pid 5598] close(13) = -1 EBADF (Bad file descriptor) [pid 5598] close(14) = -1 EBADF (Bad file descriptor) [pid 5598] close(15) = -1 EBADF (Bad file descriptor) [pid 5598] close(16) = -1 EBADF (Bad file descriptor) [pid 5598] close(17) = -1 EBADF (Bad file descriptor) [pid 5598] close(18) = -1 EBADF (Bad file descriptor) [pid 5598] close(19) = -1 EBADF (Bad file descriptor) [pid 5598] close(20) = -1 EBADF (Bad file descriptor) [pid 5598] close(21) = -1 EBADF (Bad file descriptor) [pid 5598] close(22) = -1 EBADF (Bad file descriptor) [pid 5598] close(23) = -1 EBADF (Bad file descriptor) [pid 5598] close(24) = -1 EBADF (Bad file descriptor) [pid 5598] close(25) = -1 EBADF (Bad file descriptor) [ 163.801204][ T5598] Tasks state (memory values in pages): [ 163.809671][ T5598] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 163.821234][ T5598] Out of memory and no killable processes... [ 163.829560][ T5600] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5598] close(26) = -1 EBADF (Bad file descriptor) [pid 5598] close(27) = -1 EBADF (Bad file descriptor) [pid 5598] close(28) = -1 EBADF (Bad file descriptor) [pid 5598] close(29) = -1 EBADF (Bad file descriptor) [pid 5598] exit_group(0) = ? [pid 5598] +++ exited with 0 +++ [pid 5085] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=22, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- [pid 5085] umount2("./20", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] openat(AT_FDCWD, "./20", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5085] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5085] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5085] umount2("./20/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./20/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5085] unlink("./20/binderfs") = 0 [pid 5085] umount2("./20/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./20/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5085] unlink("./20/cgroup") = 0 [pid 5085] umount2("./20/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./20/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [ 163.845361][ T5600] CPU: 1 PID: 5600 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 163.855342][ T5600] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 163.865480][ T5600] Call Trace: [ 163.868826][ T5600] [ 163.871809][ T5600] dump_stack_lvl+0x136/0x150 [ 163.876567][ T5600] dump_header+0x10a/0xd70 [ 163.881059][ T5600] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 163.887223][ T5600] out_of_memory+0xd64/0x1660 [ 163.892008][ T5600] ? oom_killer_disable+0x2b0/0x2b0 [ 163.897307][ T5600] mem_cgroup_out_of_memory+0x206/0x270 [ 163.902954][ T5600] ? mem_cgroup_margin+0x130/0x130 [ 163.908155][ T5600] memory_max_write+0x2f9/0x3c0 [ 163.913089][ T5600] ? mem_cgroup_force_empty_write+0x160/0x160 [ 163.919224][ T5600] ? lock_sync+0x190/0x190 [ 163.923693][ T5600] cgroup_file_write+0x1e2/0x7b0 [ 163.928691][ T5600] ? mem_cgroup_force_empty_write+0x160/0x160 [ 163.934824][ T5600] ? kill_css+0x3b0/0x3b0 [ 163.939205][ T5600] ? lock_acquire+0x32/0xc0 [ 163.943756][ T5600] ? kill_css+0x3b0/0x3b0 [ 163.948135][ T5600] kernfs_fop_write_iter+0x3f1/0x600 [ 163.953473][ T5600] vfs_write+0x9ed/0xe10 [ 163.957772][ T5600] ? kernel_write+0x670/0x670 [ 163.962516][ T5600] ? find_held_lock+0x2d/0x110 [ 163.967324][ T5600] ? __fget_light+0x20a/0x270 [ 163.972054][ T5600] ksys_write+0x12b/0x250 [ 163.976431][ T5600] ? __ia32_sys_read+0xb0/0xb0 [ 163.981249][ T5600] ? lockdep_hardirqs_on+0x7d/0x100 [ 163.986487][ T5600] ? _raw_spin_unlock_irq+0x2e/0x50 [ 163.991729][ T5600] ? ptrace_notify+0xfe/0x140 [ 163.996456][ T5600] do_syscall_64+0x39/0xb0 [ 164.000920][ T5600] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 164.006878][ T5600] RIP: 0033:0x7faecf034129 [ 164.011323][ T5600] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 164.030963][ T5600] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 164.039407][ T5600] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [pid 5085] unlink("./20/cgroup.net") = 0 [pid 5085] umount2("./20/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5085] umount2("./20/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 164.047407][ T5600] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 164.055406][ T5600] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 164.063403][ T5600] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 164.071414][ T5600] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000015 [ 164.079437][ T5600] [ 164.093282][ T5600] memory: usage 8kB, limit 0kB, failcnt 36 [pid 5085] lstat("./20/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5085] umount2("./20/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] openat(AT_FDCWD, "./20/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5085] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5085] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5085] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5085] close(4) = 0 [pid 5085] rmdir("./20/file0") = 0 [pid 5085] umount2("./20/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./20/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5085] unlink("./20/cgroup.cpu") = 0 [pid 5085] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5085] close(3) = 0 [pid 5085] rmdir("./20") = 0 [pid 5085] mkdir("./21", 0777) = 0 [pid 5085] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5604 attached , child_tidptr=0x555555c0c5d0) = 23 [pid 5604] chdir("./21") = 0 [pid 5604] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5604] setpgid(0, 0) = 0 [pid 5604] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [ 164.099422][ T5600] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 164.115335][ T5600] Memory cgroup stats for /syz1: [ 164.115620][ T5600] anon 0 [ 164.115620][ T5600] file 0 [ 164.115620][ T5600] kernel 8192 [ 164.115620][ T5600] kernel_stack 0 [ 164.115620][ T5600] pagetables 0 [ 164.115620][ T5600] sec_pagetables 0 [ 164.115620][ T5600] percpu 0 [ 164.115620][ T5600] sock 0 [ 164.115620][ T5600] vmalloc 0 [ 164.115620][ T5600] shmem 0 [pid 5604] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 5604] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 5604] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5604] write(3, "1000", 4) = 4 [pid 5604] close(3) = 0 [pid 5604] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5604] mkdir("./file0", 000) = 0 [pid 5604] open("./file0", O_RDONLY) = 3 [ 164.115620][ T5600] zswap 0 [ 164.115620][ T5600] zswapped 0 [ 164.115620][ T5600] file_mapped 0 [ 164.115620][ T5600] file_dirty 0 [ 164.115620][ T5600] file_writeback 0 [ 164.115620][ T5600] swapcached 0 [ 164.115620][ T5600] anon_thp 0 [ 164.115620][ T5600] file_thp 0 [ 164.115620][ T5600] shmem_thp 0 [ 164.115620][ T5600] inactive_anon 0 [ 164.115620][ T5600] active_anon 0 [ 164.115620][ T5600] inactive_file 0 [ 164.115620][ T5600] active_file 0 [ 164.115620][ T5600] unevictable 0 [ 164.115620][ T5600] slab_reclaimable 6752 [pid 5604] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5604] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5604] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5604] openat(5, "memory.max", O_RDWR) = 6 [ 164.115620][ T5600] slab_unreclaimable 0 [ 164.115620][ T5600] slab 6752 [ 164.115620][ T5600] workingset_refault_anon 0 [ 164.115620][ T5600] workingset_refault_file 0 [ 164.115620][ T5600] workingset_activate_anon 0 [ 164.115620][ T5600] workingset_activate_file 0 [ 164.115620][ T5600] workingset_restore_anon 0 [ 164.115620][ T5600] workingset_restore_file 0 [ 164.115620][ T5600] workingset_nodereclaim 0 [ 164.115620][ T5600] pgscan 831 [ 164.115620][ T5600] pgsteal 2 [ 164.115620][ T5600] pgscan_kswapd 0 [ 164.115620][ T5600] pgscan_direct 831 [ 164.115620][ T5600] pgscan_khugepaged 0 [ 164.115620][ T5600] pgsteal_kswapd 0 [ 164.115620][ T5600] pgsteal_direct 2 [ 164.115620][ T5600] pgsteal_khugepaged 0 [ 164.115620][ T5600] pgfault 21 [ 164.115620][ T5600] pgmajfault 0 [ 164.115620][ T5600] pgrefill 830 [ 164.115620][ T5600] pgactivate 829 [ 164.115620][ T5600] pgdeactivate 830 [ 164.115620][ T5600] pglazyfree 0 [ 164.115620][ T5600] pglazyfreed 0 [ 164.115620][ T5600] zswpin 0 [ 164.115620][ T5600] zswpout 0 [ 164.115620][ T5600] thp_fault_alloc 0 [ 164.115620][ T5600] thp_collapse_alloc 0 [pid 5604] write(6, "0x000000000000040e", 18 [pid 5600] <... write resumed>) = 18 [pid 5600] close(3) = 0 [pid 5600] close(4) = 0 [pid 5600] close(5) = 0 [pid 5600] close(6) = 0 [pid 5600] close(7) = -1 EBADF (Bad file descriptor) [pid 5600] close(8) = -1 EBADF (Bad file descriptor) [pid 5600] close(9) = -1 EBADF (Bad file descriptor) [ 164.308670][ T5600] Tasks state (memory values in pages): [ 164.315217][ T5600] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 164.327515][ T5600] Out of memory and no killable processes... [ 164.336305][ T5601] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5600] close(10) = -1 EBADF (Bad file descriptor) [pid 5600] close(11) = -1 EBADF (Bad file descriptor) [pid 5600] close(12) = -1 EBADF (Bad file descriptor) [pid 5600] close(13) = -1 EBADF (Bad file descriptor) [pid 5600] close(14) = -1 EBADF (Bad file descriptor) [pid 5600] close(15) = -1 EBADF (Bad file descriptor) [pid 5600] close(16) = -1 EBADF (Bad file descriptor) [pid 5600] close(17) = -1 EBADF (Bad file descriptor) [pid 5600] close(18) = -1 EBADF (Bad file descriptor) [pid 5600] close(19) = -1 EBADF (Bad file descriptor) [pid 5600] close(20) = -1 EBADF (Bad file descriptor) [pid 5600] close(21) = -1 EBADF (Bad file descriptor) [pid 5600] close(22) = -1 EBADF (Bad file descriptor) [pid 5600] close(23) = -1 EBADF (Bad file descriptor) [pid 5600] close(24) = -1 EBADF (Bad file descriptor) [pid 5600] close(25) = -1 EBADF (Bad file descriptor) [pid 5600] close(26) = -1 EBADF (Bad file descriptor) [pid 5600] close(27) = -1 EBADF (Bad file descriptor) [pid 5600] close(28) = -1 EBADF (Bad file descriptor) [pid 5600] close(29) = -1 EBADF (Bad file descriptor) [pid 5600] exit_group(0) = ? [pid 5600] +++ exited with 0 +++ [pid 5086] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=23, si_uid=0, si_status=0, si_utime=0, si_stime=7 /* 0.07 s */} --- [ 164.356844][ T5601] CPU: 0 PID: 5601 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 164.366834][ T5601] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 164.376952][ T5601] Call Trace: [ 164.380296][ T5601] [ 164.383295][ T5601] dump_stack_lvl+0x136/0x150 [ 164.388052][ T5601] dump_header+0x10a/0xd70 [ 164.392545][ T5601] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 164.398712][ T5601] out_of_memory+0xd64/0x1660 [ 164.403480][ T5601] ? oom_killer_disable+0x2b0/0x2b0 [pid 5086] umount2("./21", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] openat(AT_FDCWD, "./21", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5086] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5086] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5086] umount2("./21/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./21/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5086] unlink("./21/binderfs") = 0 [pid 5086] umount2("./21/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./21/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5086] unlink("./21/cgroup") = 0 [pid 5086] umount2("./21/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./21/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5086] unlink("./21/cgroup.net") = 0 [ 164.408773][ T5601] mem_cgroup_out_of_memory+0x206/0x270 [ 164.414418][ T5601] ? mem_cgroup_margin+0x130/0x130 [ 164.419720][ T5601] memory_max_write+0x2f9/0x3c0 [ 164.424670][ T5601] ? mem_cgroup_force_empty_write+0x160/0x160 [ 164.430889][ T5601] ? lock_sync+0x190/0x190 [ 164.435391][ T5601] cgroup_file_write+0x1e2/0x7b0 [ 164.440420][ T5601] ? mem_cgroup_force_empty_write+0x160/0x160 [ 164.446581][ T5601] ? kill_css+0x3b0/0x3b0 [ 164.450983][ T5601] ? lock_acquire+0x32/0xc0 [ 164.455546][ T5601] ? kill_css+0x3b0/0x3b0 [ 164.459954][ T5601] kernfs_fop_write_iter+0x3f1/0x600 [ 164.465326][ T5601] vfs_write+0x9ed/0xe10 [ 164.469659][ T5601] ? kernel_write+0x670/0x670 [ 164.474425][ T5601] ? find_held_lock+0x2d/0x110 [ 164.479276][ T5601] ? __fget_light+0x20a/0x270 [ 164.484027][ T5601] ksys_write+0x12b/0x250 [ 164.488414][ T5601] ? __ia32_sys_read+0xb0/0xb0 [ 164.493266][ T5601] ? lockdep_hardirqs_on+0x7d/0x100 [ 164.498533][ T5601] ? _raw_spin_unlock_irq+0x2e/0x50 [ 164.503823][ T5601] ? ptrace_notify+0xfe/0x140 [ 164.508554][ T5601] do_syscall_64+0x39/0xb0 [ 164.513060][ T5601] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 164.519029][ T5601] RIP: 0033:0x7faecf034129 [ 164.523501][ T5601] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 164.543175][ T5601] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 164.551659][ T5601] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 164.559689][ T5601] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 164.567727][ T5601] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 164.575757][ T5601] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 164.583787][ T5601] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000018 [ 164.591843][ T5601] [ 164.597361][ T5601] memory: usage 8kB, limit 0kB, failcnt 36 [pid 5086] umount2("./21/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5086] umount2("./21/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./21/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5086] umount2("./21/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] openat(AT_FDCWD, "./21/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5086] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5086] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5086] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5086] close(4) = 0 [pid 5086] rmdir("./21/file0") = 0 [ 164.604435][ T5601] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [pid 5086] umount2("./21/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./21/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5086] unlink("./21/cgroup.cpu") = 0 [pid 5086] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5086] close(3) = 0 [pid 5086] rmdir("./21") = 0 [pid 5086] mkdir("./22", 0777) = 0 [pid 5086] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5605 attached [pid 5605] chdir("./22" [pid 5086] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 24 [pid 5605] <... chdir resumed>) = 0 [pid 5605] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5605] setpgid(0, 0) = 0 [pid 5605] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [pid 5605] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 5605] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 5605] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5605] write(3, "1000", 4) = 4 [pid 5605] close(3) = 0 [pid 5605] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5605] mkdir("./file0", 000) = 0 [pid 5605] open("./file0", O_RDONLY) = 3 [ 164.611351][ T5601] Memory cgroup stats for /syz1: [ 164.636145][ T5601] anon 0 [ 164.636145][ T5601] file 0 [ 164.636145][ T5601] kernel 8192 [ 164.636145][ T5601] kernel_stack 0 [ 164.636145][ T5601] pagetables 0 [ 164.636145][ T5601] sec_pagetables 0 [ 164.636145][ T5601] percpu 0 [ 164.636145][ T5601] sock 0 [ 164.636145][ T5601] vmalloc 0 [ 164.636145][ T5601] shmem 0 [ 164.636145][ T5601] zswap 0 [ 164.636145][ T5601] zswapped 0 [ 164.636145][ T5601] file_mapped 0 [ 164.636145][ T5601] file_dirty 0 [pid 5605] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5605] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5605] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5605] openat(5, "memory.max", O_RDWR) = 6 [ 164.636145][ T5601] file_writeback 0 [ 164.636145][ T5601] swapcached 0 [ 164.636145][ T5601] anon_thp 0 [ 164.636145][ T5601] file_thp 0 [ 164.636145][ T5601] shmem_thp 0 [ 164.636145][ T5601] inactive_anon 0 [ 164.636145][ T5601] active_anon 0 [ 164.636145][ T5601] inactive_file 0 [ 164.636145][ T5601] active_file 0 [ 164.636145][ T5601] unevictable 0 [ 164.636145][ T5601] slab_reclaimable 6752 [ 164.636145][ T5601] slab_unreclaimable 0 [ 164.636145][ T5601] slab 6752 [ 164.636145][ T5601] workingset_refault_anon 0 [ 164.636145][ T5601] workingset_refault_file 0 [ 164.636145][ T5601] workingset_activate_anon 0 [ 164.636145][ T5601] workingset_activate_file 0 [ 164.636145][ T5601] workingset_restore_anon 0 [ 164.636145][ T5601] workingset_restore_file 0 [ 164.636145][ T5601] workingset_nodereclaim 0 [ 164.636145][ T5601] pgscan 831 [ 164.636145][ T5601] pgsteal 2 [ 164.636145][ T5601] pgscan_kswapd 0 [ 164.636145][ T5601] pgscan_direct 831 [ 164.636145][ T5601] pgscan_khugepaged 0 [ 164.636145][ T5601] pgsteal_kswapd 0 [ 164.636145][ T5601] pgsteal_direct 2 [ 164.636145][ T5601] pgsteal_khugepaged 0 [ 164.636145][ T5601] pgfault 21 [ 164.636145][ T5601] pgmajfault 0 [ 164.636145][ T5601] pgrefill 830 [ 164.636145][ T5601] pgactivate 829 [ 164.636145][ T5601] pgdeactivate 830 [ 164.636145][ T5601] pglazyfree 0 [ 164.636145][ T5601] pglazyfreed 0 [ 164.636145][ T5601] zswpin 0 [ 164.636145][ T5601] zswpout 0 [ 164.636145][ T5601] thp_fault_alloc 0 [ 164.636145][ T5601] thp_collapse_alloc 0 [ 164.832759][ T5601] Tasks state (memory values in pages): [ 164.839593][ T5601] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 164.857149][ T5601] Out of memory and no killable processes... [ 164.865466][ T5602] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 164.876620][ T5602] CPU: 1 PID: 5602 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [pid 5605] write(6, "0x000000000000040e", 18 [pid 5601] <... write resumed>) = 18 [pid 5601] close(3) = 0 [ 164.886583][ T5602] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 164.896694][ T5602] Call Trace: [ 164.900013][ T5602] [ 164.902990][ T5602] dump_stack_lvl+0x136/0x150 [ 164.907747][ T5602] dump_header+0x10a/0xd70 [ 164.912255][ T5602] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 164.918420][ T5602] out_of_memory+0xd64/0x1660 [ 164.923183][ T5602] ? oom_killer_disable+0x2b0/0x2b0 [ 164.928463][ T5602] ? find_held_lock+0x2d/0x110 [pid 5601] close(4) = 0 [pid 5601] close(5) = 0 [pid 5601] close(6) = 0 [pid 5601] close(7) = -1 EBADF (Bad file descriptor) [pid 5601] close(8) = -1 EBADF (Bad file descriptor) [pid 5601] close(9) = -1 EBADF (Bad file descriptor) [pid 5601] close(10) = -1 EBADF (Bad file descriptor) [pid 5601] close(11) = -1 EBADF (Bad file descriptor) [pid 5601] close(12) = -1 EBADF (Bad file descriptor) [pid 5601] close(13) = -1 EBADF (Bad file descriptor) [pid 5601] close(14) = -1 EBADF (Bad file descriptor) [pid 5601] close(15) = -1 EBADF (Bad file descriptor) [pid 5601] close(16) = -1 EBADF (Bad file descriptor) [pid 5601] close(17) = -1 EBADF (Bad file descriptor) [pid 5601] close(18) = -1 EBADF (Bad file descriptor) [pid 5601] close(19) = -1 EBADF (Bad file descriptor) [pid 5601] close(20) = -1 EBADF (Bad file descriptor) [pid 5601] close(21) = -1 EBADF (Bad file descriptor) [pid 5601] close(22) = -1 EBADF (Bad file descriptor) [ 164.933305][ T5602] mem_cgroup_out_of_memory+0x206/0x270 [ 164.938947][ T5602] ? mem_cgroup_margin+0x130/0x130 [ 164.944148][ T5602] ? _raw_spin_unlock_irqrestore+0x54/0x70 [ 164.950042][ T5602] memory_max_write+0x2f9/0x3c0 [ 164.954970][ T5602] ? mem_cgroup_force_empty_write+0x160/0x160 [ 164.961121][ T5602] ? lock_sync+0x190/0x190 [ 164.965624][ T5602] cgroup_file_write+0x1e2/0x7b0 [ 164.970645][ T5602] ? mem_cgroup_force_empty_write+0x160/0x160 [ 164.976798][ T5602] ? kill_css+0x3b0/0x3b0 [ 164.981204][ T5602] ? lock_acquire+0x32/0xc0 [ 164.985807][ T5602] ? kill_css+0x3b0/0x3b0 [ 164.990188][ T5602] kernfs_fop_write_iter+0x3f1/0x600 [ 164.995525][ T5602] vfs_write+0x9ed/0xe10 [ 164.999821][ T5602] ? kernel_write+0x670/0x670 [ 165.004551][ T5602] ? find_held_lock+0x2d/0x110 [ 165.009360][ T5602] ? __fget_light+0x20a/0x270 [ 165.014088][ T5602] ksys_write+0x12b/0x250 [ 165.018461][ T5602] ? __ia32_sys_read+0xb0/0xb0 [ 165.023270][ T5602] ? lockdep_hardirqs_on+0x7d/0x100 [ 165.028507][ T5602] ? _raw_spin_unlock_irq+0x2e/0x50 [ 165.033756][ T5602] ? ptrace_notify+0xfe/0x140 [ 165.038473][ T5602] do_syscall_64+0x39/0xb0 [ 165.042936][ T5602] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 165.048866][ T5602] RIP: 0033:0x7faecf034129 [ 165.053320][ T5602] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 165.072965][ T5602] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 5601] close(23) = -1 EBADF (Bad file descriptor) [pid 5601] close(24) = -1 EBADF (Bad file descriptor) [pid 5601] close(25) = -1 EBADF (Bad file descriptor) [pid 5601] close(26) = -1 EBADF (Bad file descriptor) [pid 5601] close(27) = -1 EBADF (Bad file descriptor) [pid 5601] close(28) = -1 EBADF (Bad file descriptor) [pid 5601] close(29) = -1 EBADF (Bad file descriptor) [pid 5601] exit_group(0) = ? [pid 5601] +++ exited with 0 +++ [pid 5090] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=26, si_uid=0, si_status=0, si_utime=0, si_stime=12 /* 0.12 s */} --- [pid 5090] restart_syscall(<... resuming interrupted clone ...>) = 0 [ 165.081416][ T5602] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 165.089418][ T5602] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 165.097417][ T5602] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 165.105412][ T5602] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 165.113405][ T5602] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000018 [ 165.121420][ T5602] [pid 5090] umount2("./24", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] openat(AT_FDCWD, "./24", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5090] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5090] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5090] umount2("./24/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./24/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5090] unlink("./24/binderfs") = 0 [pid 5090] umount2("./24/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./24/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5090] unlink("./24/cgroup") = 0 [pid 5090] umount2("./24/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./24/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5090] unlink("./24/cgroup.net") = 0 [pid 5090] umount2("./24/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5090] umount2("./24/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./24/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5090] umount2("./24/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] openat(AT_FDCWD, "./24/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5090] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5090] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [ 165.150190][ T5602] memory: usage 8kB, limit 0kB, failcnt 36 [ 165.156309][ T5602] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 165.173610][ T5602] Memory cgroup stats for /syz1: [ 165.173914][ T5602] anon 0 [ 165.173914][ T5602] file 0 [ 165.173914][ T5602] kernel 8192 [ 165.173914][ T5602] kernel_stack 0 [ 165.173914][ T5602] pagetables 0 [ 165.173914][ T5602] sec_pagetables 0 [ 165.173914][ T5602] percpu 0 [ 165.173914][ T5602] sock 0 [ 165.173914][ T5602] vmalloc 0 [ 165.173914][ T5602] shmem 0 [ 165.173914][ T5602] zswap 0 [ 165.173914][ T5602] zswapped 0 [ 165.173914][ T5602] file_mapped 0 [ 165.173914][ T5602] file_dirty 0 [ 165.173914][ T5602] file_writeback 0 [ 165.173914][ T5602] swapcached 0 [ 165.173914][ T5602] anon_thp 0 [ 165.173914][ T5602] file_thp 0 [ 165.173914][ T5602] shmem_thp 0 [ 165.173914][ T5602] inactive_anon 0 [ 165.173914][ T5602] active_anon 0 [ 165.173914][ T5602] inactive_file 0 [ 165.173914][ T5602] active_file 0 [ 165.173914][ T5602] unevictable 0 [ 165.173914][ T5602] slab_reclaimable 6752 [ 165.173914][ T5602] slab_unreclaimable 0 [ 165.173914][ T5602] slab 6752 [ 165.173914][ T5602] workingset_refault_anon 0 [ 165.173914][ T5602] workingset_refault_file 0 [ 165.173914][ T5602] workingset_activate_anon 0 [ 165.173914][ T5602] workingset_activate_file 0 [ 165.173914][ T5602] workingset_restore_anon 0 [ 165.173914][ T5602] workingset_restore_file 0 [ 165.173914][ T5602] workingset_nodereclaim 0 [ 165.173914][ T5602] pgscan 831 [ 165.173914][ T5602] pgsteal 2 [ 165.173914][ T5602] pgscan_kswapd 0 [ 165.173914][ T5602] pgscan_direct 831 [ 165.173914][ T5602] pgscan_khugepaged 0 [ 165.173914][ T5602] pgsteal_kswapd 0 [ 165.173914][ T5602] pgsteal_direct 2 [ 165.173914][ T5602] pgsteal_khugepaged 0 [ 165.173914][ T5602] pgfault 21 [ 165.173914][ T5602] pgmajfault 0 [ 165.173914][ T5602] pgrefill 830 [ 165.173914][ T5602] pgactivate 829 [ 165.173914][ T5602] pgdeactivate 830 [ 165.173914][ T5602] pglazyfree 0 [ 165.173914][ T5602] pglazyfreed 0 [ 165.173914][ T5602] zswpin 0 [pid 5090] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5090] close(4) = 0 [pid 5090] rmdir("./24/file0") = 0 [pid 5090] umount2("./24/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./24/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5090] unlink("./24/cgroup.cpu") = 0 [pid 5090] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5090] close(3) = 0 [pid 5090] rmdir("./24") = 0 [pid 5090] mkdir("./25", 0777) = 0 [pid 5090] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5607 attached [pid 5607] chdir("./25" [pid 5090] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 27 [pid 5607] <... chdir resumed>) = 0 [pid 5607] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5607] setpgid(0, 0) = 0 [pid 5607] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 5607] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 5607] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [pid 5607] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5607] write(3, "1000", 4) = 4 [pid 5607] close(3) = 0 [pid 5607] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5607] mkdir("./file0", 000) = 0 [pid 5607] open("./file0", O_RDONLY) = 3 [pid 5607] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5607] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5607] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5607] openat(5, "memory.max", O_RDWR) = 6 [pid 5607] write(6, "0x000000000000040e", 18 [pid 5602] <... write resumed>) = 18 [ 165.173914][ T5602] zswpout 0 [ 165.173914][ T5602] thp_fault_alloc 0 [ 165.173914][ T5602] thp_collapse_alloc 0 [ 165.361035][ T5602] Tasks state (memory values in pages): [ 165.368166][ T5602] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 165.378365][ T5602] Out of memory and no killable processes... [ 165.385222][ T5603] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 165.396462][ T5603] CPU: 0 PID: 5603 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 165.406438][ T5603] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 165.416521][ T5603] Call Trace: [ 165.419826][ T5603] [ 165.422798][ T5603] dump_stack_lvl+0x136/0x150 [ 165.427516][ T5603] dump_header+0x10a/0xd70 [ 165.431965][ T5603] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 165.438092][ T5603] out_of_memory+0xd64/0x1660 [ 165.442815][ T5603] ? oom_killer_disable+0x2b0/0x2b0 [ 165.448060][ T5603] ? find_held_lock+0x2d/0x110 [ 165.452863][ T5603] mem_cgroup_out_of_memory+0x206/0x270 [ 165.458450][ T5603] ? mem_cgroup_margin+0x130/0x130 [ 165.463613][ T5603] ? _raw_spin_unlock_irqrestore+0x54/0x70 [ 165.469469][ T5603] memory_max_write+0x2f9/0x3c0 [ 165.474372][ T5603] ? mem_cgroup_force_empty_write+0x160/0x160 [ 165.480492][ T5603] ? lock_sync+0x190/0x190 [ 165.484950][ T5603] cgroup_file_write+0x1e2/0x7b0 [ 165.489939][ T5603] ? mem_cgroup_force_empty_write+0x160/0x160 [ 165.496053][ T5603] ? kill_css+0x3b0/0x3b0 [ 165.500431][ T5603] ? lock_acquire+0x32/0xc0 [ 165.504984][ T5603] ? kill_css+0x3b0/0x3b0 [ 165.509359][ T5603] kernfs_fop_write_iter+0x3f1/0x600 [ 165.514693][ T5603] vfs_write+0x9ed/0xe10 [ 165.519009][ T5603] ? kernel_write+0x670/0x670 [ 165.523743][ T5603] ? find_held_lock+0x2d/0x110 [ 165.528556][ T5603] ? __fget_light+0x20a/0x270 [ 165.533287][ T5603] ksys_write+0x12b/0x250 [ 165.537665][ T5603] ? __ia32_sys_read+0xb0/0xb0 [ 165.542479][ T5603] ? lockdep_hardirqs_on+0x7d/0x100 [ 165.547724][ T5603] ? _raw_spin_unlock_irq+0x2e/0x50 [ 165.552962][ T5603] ? ptrace_notify+0xfe/0x140 [ 165.557686][ T5603] do_syscall_64+0x39/0xb0 [ 165.562154][ T5603] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 165.568101][ T5603] RIP: 0033:0x7faecf034129 [ 165.572542][ T5603] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 165.592179][ T5603] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 165.600621][ T5603] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 165.608622][ T5603] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 165.616617][ T5603] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 165.624614][ T5603] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 165.632609][ T5603] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000017 [ 165.640624][ T5603] [pid 5602] close(3) = 0 [pid 5602] close(4) = 0 [pid 5602] close(5) = 0 [pid 5602] close(6) = 0 [pid 5602] close(7) = -1 EBADF (Bad file descriptor) [pid 5602] close(8) = -1 EBADF (Bad file descriptor) [pid 5602] close(9) = -1 EBADF (Bad file descriptor) [pid 5602] close(10) = -1 EBADF (Bad file descriptor) [pid 5602] close(11) = -1 EBADF (Bad file descriptor) [pid 5602] close(12) = -1 EBADF (Bad file descriptor) [pid 5602] close(13) = -1 EBADF (Bad file descriptor) [pid 5602] close(14) = -1 EBADF (Bad file descriptor) [pid 5602] close(15) = -1 EBADF (Bad file descriptor) [pid 5602] close(16) = -1 EBADF (Bad file descriptor) [pid 5602] close(17) = -1 EBADF (Bad file descriptor) [pid 5602] close(18) = -1 EBADF (Bad file descriptor) [pid 5602] close(19) = -1 EBADF (Bad file descriptor) [pid 5602] close(20) = -1 EBADF (Bad file descriptor) [pid 5602] close(21) = -1 EBADF (Bad file descriptor) [pid 5602] close(22) = -1 EBADF (Bad file descriptor) [pid 5602] close(23) = -1 EBADF (Bad file descriptor) [pid 5602] close(24) = -1 EBADF (Bad file descriptor) [pid 5602] close(25) = -1 EBADF (Bad file descriptor) [pid 5602] close(26) = -1 EBADF (Bad file descriptor) [ 165.651021][ T5603] memory: usage 8kB, limit 0kB, failcnt 36 [ 165.668731][ T5603] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 165.681287][ T5603] Memory cgroup stats for /syz1: [ 165.686293][ T5603] anon 0 [ 165.686293][ T5603] file 0 [ 165.686293][ T5603] kernel 8192 [ 165.686293][ T5603] kernel_stack 0 [ 165.686293][ T5603] pagetables 0 [ 165.686293][ T5603] sec_pagetables 0 [ 165.686293][ T5603] percpu 0 [ 165.686293][ T5603] sock 0 [ 165.686293][ T5603] vmalloc 0 [ 165.686293][ T5603] shmem 0 [ 165.686293][ T5603] zswap 0 [ 165.686293][ T5603] zswapped 0 [ 165.686293][ T5603] file_mapped 0 [ 165.686293][ T5603] file_dirty 0 [ 165.686293][ T5603] file_writeback 0 [ 165.686293][ T5603] swapcached 0 [ 165.686293][ T5603] anon_thp 0 [ 165.686293][ T5603] file_thp 0 [ 165.686293][ T5603] shmem_thp 0 [ 165.686293][ T5603] inactive_anon 0 [ 165.686293][ T5603] active_anon 0 [ 165.686293][ T5603] inactive_file 0 [ 165.686293][ T5603] active_file 0 [ 165.686293][ T5603] unevictable 0 [ 165.686293][ T5603] slab_reclaimable 6752 [ 165.686293][ T5603] slab_unreclaimable 0 [ 165.686293][ T5603] slab 6752 [ 165.686293][ T5603] workingset_refault_anon 0 [ 165.686293][ T5603] workingset_refault_file 0 [ 165.686293][ T5603] workingset_activate_anon 0 [ 165.686293][ T5603] workingset_activate_file 0 [ 165.686293][ T5603] workingset_restore_anon 0 [ 165.686293][ T5603] workingset_restore_file 0 [ 165.686293][ T5603] workingset_nodereclaim 0 [ 165.686293][ T5603] pgscan 831 [ 165.686293][ T5603] pgsteal 2 [ 165.686293][ T5603] pgscan_kswapd 0 [ 165.686293][ T5603] pgscan_direct 831 [ 165.686293][ T5603] pgscan_khugepaged 0 [ 165.686293][ T5603] pgsteal_kswapd 0 [ 165.686293][ T5603] pgsteal_direct 2 [ 165.686293][ T5603] pgsteal_khugepaged 0 [ 165.686293][ T5603] pgfault 21 [ 165.686293][ T5603] pgmajfault 0 [ 165.686293][ T5603] pgrefill 830 [ 165.686293][ T5603] pgactivate 829 [ 165.686293][ T5603] pgdeactivate 830 [pid 5602] close(27) = -1 EBADF (Bad file descriptor) [pid 5602] close(28) = -1 EBADF (Bad file descriptor) [pid 5602] close(29) = -1 EBADF (Bad file descriptor) [pid 5602] exit_group(0) = ? [pid 5602] +++ exited with 0 +++ [pid 5089] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=26, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- [ 165.686293][ T5603] pglazyfree 0 [ 165.686293][ T5603] pglazyfreed 0 [ 165.686293][ T5603] zswpin 0 [ 165.686293][ T5603] zswpout 0 [ 165.686293][ T5603] thp_fault_alloc 0 [ 165.686293][ T5603] thp_collapse_alloc 0 [ 165.881231][ T5603] Tasks state (memory values in pages): [ 165.886984][ T5603] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5089] umount2("./24", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] openat(AT_FDCWD, "./24", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5089] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5089] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5089] umount2("./24/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./24/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5089] unlink("./24/binderfs") = 0 [pid 5603] <... write resumed>) = 18 [pid 5089] umount2("./24/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./24/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5089] unlink("./24/cgroup") = 0 [pid 5089] umount2("./24/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./24/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5089] unlink("./24/cgroup.net") = 0 [ 165.911678][ T5603] Out of memory and no killable processes... [ 165.917860][ T5604] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 165.928662][ T5604] CPU: 1 PID: 5604 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 165.938628][ T5604] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 165.948740][ T5604] Call Trace: [ 165.952057][ T5604] [ 165.955032][ T5604] dump_stack_lvl+0x136/0x150 [ 165.959793][ T5604] dump_header+0x10a/0xd70 [ 165.964273][ T5604] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 165.970426][ T5604] out_of_memory+0xd64/0x1660 [ 165.975199][ T5604] ? oom_killer_disable+0x2b0/0x2b0 [ 165.980465][ T5604] ? find_held_lock+0x2d/0x110 [ 165.985279][ T5604] mem_cgroup_out_of_memory+0x206/0x270 [ 165.990871][ T5604] ? mem_cgroup_margin+0x130/0x130 [ 165.996030][ T5604] ? _raw_spin_unlock_irqrestore+0x54/0x70 [ 166.001898][ T5604] memory_max_write+0x2f9/0x3c0 [ 166.006798][ T5604] ? mem_cgroup_force_empty_write+0x160/0x160 [ 166.012944][ T5604] ? lock_sync+0x190/0x190 [ 166.017401][ T5604] cgroup_file_write+0x1e2/0x7b0 [ 166.022410][ T5604] ? mem_cgroup_force_empty_write+0x160/0x160 [ 166.028520][ T5604] ? kill_css+0x3b0/0x3b0 [ 166.032885][ T5604] ? lock_acquire+0x32/0xc0 [ 166.037447][ T5604] ? kill_css+0x3b0/0x3b0 [ 166.041849][ T5604] kernfs_fop_write_iter+0x3f1/0x600 [ 166.047185][ T5604] vfs_write+0x9ed/0xe10 [ 166.051477][ T5604] ? kernel_write+0x670/0x670 [ 166.056203][ T5604] ? find_held_lock+0x2d/0x110 [ 166.061007][ T5604] ? __fget_light+0x20a/0x270 [ 166.065738][ T5604] ksys_write+0x12b/0x250 [ 166.070120][ T5604] ? __ia32_sys_read+0xb0/0xb0 [ 166.074949][ T5604] ? lockdep_hardirqs_on+0x7d/0x100 [ 166.080189][ T5604] ? _raw_spin_unlock_irq+0x2e/0x50 [ 166.085427][ T5604] ? ptrace_notify+0xfe/0x140 [ 166.090148][ T5604] do_syscall_64+0x39/0xb0 [ 166.094632][ T5604] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 166.100559][ T5604] RIP: 0033:0x7faecf034129 [ 166.105002][ T5604] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 166.124634][ T5604] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 166.133082][ T5604] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 166.141080][ T5604] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 166.149073][ T5604] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [pid 5089] umount2("./24/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5603] close(3 [pid 5089] <... umount2 resumed>) = 0 [pid 5603] <... close resumed>) = 0 [pid 5603] close(4) = 0 [pid 5603] close(5) = 0 [pid 5603] close(6) = 0 [pid 5603] close(7) = -1 EBADF (Bad file descriptor) [pid 5603] close(8) = -1 EBADF (Bad file descriptor) [pid 5603] close(9) = -1 EBADF (Bad file descriptor) [pid 5603] close(10) = -1 EBADF (Bad file descriptor) [pid 5603] close(11) = -1 EBADF (Bad file descriptor) [pid 5603] close(12) = -1 EBADF (Bad file descriptor) [pid 5603] close(13) = -1 EBADF (Bad file descriptor) [pid 5603] close(14) = -1 EBADF (Bad file descriptor) [pid 5603] close(15) = -1 EBADF (Bad file descriptor) [pid 5603] close(16) = -1 EBADF (Bad file descriptor) [pid 5603] close(17) = -1 EBADF (Bad file descriptor) [pid 5603] close(18) = -1 EBADF (Bad file descriptor) [pid 5603] close(19) = -1 EBADF (Bad file descriptor) [pid 5603] close(20) = -1 EBADF (Bad file descriptor) [pid 5603] close(21) = -1 EBADF (Bad file descriptor) [pid 5603] close(22) = -1 EBADF (Bad file descriptor) [pid 5603] close(23) = -1 EBADF (Bad file descriptor) [pid 5603] close(24) = -1 EBADF (Bad file descriptor) [pid 5603] close(25) = -1 EBADF (Bad file descriptor) [pid 5603] close(26) = -1 EBADF (Bad file descriptor) [pid 5603] close(27) = -1 EBADF (Bad file descriptor) [pid 5603] close(28) = -1 EBADF (Bad file descriptor) [pid 5603] close(29) = -1 EBADF (Bad file descriptor) [ 166.157071][ T5604] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 166.165081][ T5604] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000015 [ 166.173102][ T5604] [ 166.182596][ T5604] memory: usage 8kB, limit 0kB, failcnt 36 [ 166.188473][ T5604] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 166.205215][ T5604] Memory cgroup stats for /syz1: [ 166.205491][ T5604] anon 0 [ 166.205491][ T5604] file 0 [ 166.205491][ T5604] kernel 8192 [ 166.205491][ T5604] kernel_stack 0 [ 166.205491][ T5604] pagetables 0 [ 166.205491][ T5604] sec_pagetables 0 [ 166.205491][ T5604] percpu 0 [ 166.205491][ T5604] sock 0 [ 166.205491][ T5604] vmalloc 0 [ 166.205491][ T5604] shmem 0 [ 166.205491][ T5604] zswap 0 [ 166.205491][ T5604] zswapped 0 [ 166.205491][ T5604] file_mapped 0 [ 166.205491][ T5604] file_dirty 0 [ 166.205491][ T5604] file_writeback 0 [ 166.205491][ T5604] swapcached 0 [ 166.205491][ T5604] anon_thp 0 [ 166.205491][ T5604] file_thp 0 [ 166.205491][ T5604] shmem_thp 0 [ 166.205491][ T5604] inactive_anon 0 [ 166.205491][ T5604] active_anon 0 [ 166.205491][ T5604] inactive_file 0 [ 166.205491][ T5604] active_file 0 [ 166.205491][ T5604] unevictable 0 [ 166.205491][ T5604] slab_reclaimable 6752 [ 166.205491][ T5604] slab_unreclaimable 0 [ 166.205491][ T5604] slab 6752 [ 166.205491][ T5604] workingset_refault_anon 0 [ 166.205491][ T5604] workingset_refault_file 0 [ 166.205491][ T5604] workingset_activate_anon 0 [ 166.205491][ T5604] workingset_activate_file 0 [ 166.205491][ T5604] workingset_restore_anon 0 [ 166.205491][ T5604] workingset_restore_file 0 [ 166.205491][ T5604] workingset_nodereclaim 0 [ 166.205491][ T5604] pgscan 831 [ 166.205491][ T5604] pgsteal 2 [ 166.205491][ T5604] pgscan_kswapd 0 [ 166.205491][ T5604] pgscan_direct 831 [ 166.205491][ T5604] pgscan_khugepaged 0 [ 166.205491][ T5604] pgsteal_kswapd 0 [ 166.205491][ T5604] pgsteal_direct 2 [ 166.205491][ T5604] pgsteal_khugepaged 0 [ 166.205491][ T5604] pgfault 21 [ 166.205491][ T5604] pgmajfault 0 [pid 5603] exit_group(0) = ? [pid 5089] umount2("./24/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5603] +++ exited with 0 +++ [pid 5089] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5087] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=25, si_uid=0, si_status=0, si_utime=0, si_stime=11 /* 0.11 s */} --- [pid 5089] lstat("./24/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5089] umount2("./24/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5087] umount2("./23", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5089] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5087] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5089] openat(AT_FDCWD, "./24/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5087] openat(AT_FDCWD, "./23", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5089] <... openat resumed>) = 4 [pid 5087] <... openat resumed>) = 3 [pid 5089] fstat(4, [pid 5087] fstat(3, [pid 5089] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5087] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [ 166.205491][ T5604] pgrefill 830 [ 166.205491][ T5604] pgactivate 829 [ 166.205491][ T5604] pgdeactivate 830 [ 166.205491][ T5604] pglazyfree 0 [ 166.205491][ T5604] pglazyfreed 0 [ 166.205491][ T5604] zswpin 0 [ 166.205491][ T5604] zswpout 0 [ 166.205491][ T5604] thp_fault_alloc 0 [ 166.205491][ T5604] thp_collapse_alloc 0 [ 166.408165][ T5604] Tasks state (memory values in pages): [pid 5089] getdents64(4, [pid 5087] getdents64(3, [pid 5089] <... getdents64 resumed>0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5087] <... getdents64 resumed>0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5089] getdents64(4, [pid 5087] umount2("./23/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5089] <... getdents64 resumed>0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5087] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5089] close(4 [pid 5087] lstat("./23/binderfs", [pid 5089] <... close resumed>) = 0 [pid 5087] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5089] rmdir("./24/file0" [pid 5087] unlink("./23/binderfs" [pid 5089] <... rmdir resumed>) = 0 [pid 5087] <... unlink resumed>) = 0 [pid 5089] umount2("./24/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5087] umount2("./23/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5089] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5087] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./24/cgroup.cpu", [pid 5087] lstat("./23/cgroup", [pid 5089] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5087] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5089] unlink("./24/cgroup.cpu" [pid 5087] unlink("./23/cgroup" [pid 5089] <... unlink resumed>) = 0 [pid 5087] <... unlink resumed>) = 0 [pid 5089] getdents64(3, [pid 5087] umount2("./23/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5089] <... getdents64 resumed>0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5087] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5089] close(3 [pid 5087] lstat("./23/cgroup.net", [pid 5089] <... close resumed>) = 0 [pid 5087] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5089] rmdir("./24" [pid 5087] unlink("./23/cgroup.net" [pid 5089] <... rmdir resumed>) = 0 [pid 5087] <... unlink resumed>) = 0 [pid 5089] mkdir("./25", 0777 [pid 5087] umount2("./23/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5089] <... mkdir resumed>) = 0 [pid 5089] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5608 attached [pid 5608] chdir("./25" [pid 5089] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 27 [pid 5608] <... chdir resumed>) = 0 [pid 5608] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5608] setpgid(0, 0) = 0 [pid 5608] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 5608] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu" [pid 5087] <... umount2 resumed>) = 0 [pid 5608] <... symlink resumed>) = 0 [pid 5604] <... write resumed>) = 18 [pid 5087] umount2("./23/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5608] symlink("/syzcgroup/net/syz5", "./cgroup.net" [pid 5604] close(3 [pid 5087] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5608] <... symlink resumed>) = 0 [pid 5604] <... close resumed>) = 0 [pid 5087] lstat("./23/file0", [pid 5608] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5604] close(4 [pid 5087] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5608] <... openat resumed>) = 3 [pid 5087] umount2("./23/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5608] write(3, "1000", 4 [pid 5087] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5608] <... write resumed>) = 4 [ 166.414233][ T5604] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 166.433472][ T5604] Out of memory and no killable processes... [ 166.439703][ T5605] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5087] openat(AT_FDCWD, "./23/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5608] close(3 [pid 5087] <... openat resumed>) = 4 [pid 5608] <... close resumed>) = 0 [pid 5087] fstat(4, [pid 5608] symlink("/dev/binderfs", "./binderfs" [pid 5087] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5608] <... symlink resumed>) = 0 [pid 5087] getdents64(4, [pid 5608] mkdir("./file0", 000 [pid 5087] <... getdents64 resumed>0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5608] <... mkdir resumed>) = 0 [pid 5087] getdents64(4, [pid 5608] open("./file0", O_RDONLY [pid 5087] <... getdents64 resumed>0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5608] <... open resumed>) = 3 [pid 5087] close(4 [pid 5608] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5087] <... close resumed>) = 0 [pid 5608] <... mount resumed>) = 0 [pid 5087] rmdir("./23/file0" [pid 5608] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5087] <... rmdir resumed>) = 0 [pid 5608] <... openat resumed>) = 4 [pid 5087] umount2("./23/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5608] openat(4, "syz1", O_RDWR|O_PATH [pid 5087] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5608] <... openat resumed>) = 5 [pid 5087] lstat("./23/cgroup.cpu", [pid 5608] openat(5, "memory.max", O_RDWR [pid 5087] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5608] <... openat resumed>) = 6 [pid 5087] unlink("./23/cgroup.cpu" [pid 5608] write(6, "0x000000000000040e", 18 [pid 5087] <... unlink resumed>) = 0 [pid 5087] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5087] close(3) = 0 [pid 5087] rmdir("./23") = 0 [pid 5087] mkdir("./24", 0777) = 0 [pid 5087] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555c0c5d0) = 26 [pid 5604] <... close resumed>) = 0 [ 166.459450][ T5605] CPU: 1 PID: 5605 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 166.469433][ T5605] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 166.479541][ T5605] Call Trace: [ 166.482877][ T5605] [ 166.485861][ T5605] dump_stack_lvl+0x136/0x150 [ 166.490611][ T5605] dump_header+0x10a/0xd70 [ 166.495095][ T5605] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 166.501260][ T5605] out_of_memory+0xd64/0x1660 [ 166.506021][ T5605] ? oom_killer_disable+0x2b0/0x2b0 [pid 5604] close(5) = 0 [pid 5604] close(6) = 0 [pid 5604] close(7) = -1 EBADF (Bad file descriptor) [pid 5604] close(8) = -1 EBADF (Bad file descriptor) [pid 5604] close(9) = -1 EBADF (Bad file descriptor) [pid 5604] close(10) = -1 EBADF (Bad file descriptor) [pid 5604] close(11) = -1 EBADF (Bad file descriptor) [pid 5604] close(12) = -1 EBADF (Bad file descriptor) [pid 5604] close(13) = -1 EBADF (Bad file descriptor) [pid 5604] close(14) = -1 EBADF (Bad file descriptor) [pid 5604] close(15) = -1 EBADF (Bad file descriptor) [pid 5604] close(16) = -1 EBADF (Bad file descriptor) [pid 5604] close(17) = -1 EBADF (Bad file descriptor) [pid 5604] close(18) = -1 EBADF (Bad file descriptor) [pid 5604] close(19) = -1 EBADF (Bad file descriptor) [pid 5604] close(20) = -1 EBADF (Bad file descriptor) [pid 5604] close(21) = -1 EBADF (Bad file descriptor) [pid 5604] close(22) = -1 EBADF (Bad file descriptor) [pid 5604] close(23) = -1 EBADF (Bad file descriptor) [pid 5604] close(24) = -1 EBADF (Bad file descriptor) [pid 5604] close(25) = -1 EBADF (Bad file descriptor) [pid 5604] close(26) = -1 EBADF (Bad file descriptor) [pid 5604] close(27) = -1 EBADF (Bad file descriptor) [pid 5604] close(28) = -1 EBADF (Bad file descriptor) [ 166.511311][ T5605] mem_cgroup_out_of_memory+0x206/0x270 [ 166.516953][ T5605] ? mem_cgroup_margin+0x130/0x130 [ 166.522196][ T5605] memory_max_write+0x2f9/0x3c0 [ 166.527137][ T5605] ? mem_cgroup_force_empty_write+0x160/0x160 [ 166.533304][ T5605] ? lock_sync+0x190/0x190 [ 166.537794][ T5605] cgroup_file_write+0x1e2/0x7b0 [ 166.542817][ T5605] ? mem_cgroup_force_empty_write+0x160/0x160 [ 166.548969][ T5605] ? kill_css+0x3b0/0x3b0 [ 166.553375][ T5605] ? lock_acquire+0x32/0xc0 [ 166.557966][ T5605] ? kill_css+0x3b0/0x3b0 [pid 5604] close(29) = -1 EBADF (Bad file descriptor) [pid 5604] exit_group(0) = ? [pid 5604] +++ exited with 0 +++ [pid 5085] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=23, si_uid=0, si_status=0, si_utime=0, si_stime=7 /* 0.07 s */} --- [pid 5085] umount2("./21", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] openat(AT_FDCWD, "./21", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5085] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5085] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5085] umount2("./21/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./21/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5085] unlink("./21/binderfs") = 0 [pid 5085] umount2("./21/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./21/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5085] unlink("./21/cgroup") = 0 [pid 5085] umount2("./21/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./21/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5085] unlink("./21/cgroup.net") = 0 [pid 5085] umount2("./21/file0", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5609 attached [pid 5609] chdir("./24") = 0 [ 166.562376][ T5605] kernfs_fop_write_iter+0x3f1/0x600 [ 166.567751][ T5605] vfs_write+0x9ed/0xe10 [ 166.572080][ T5605] ? kernel_write+0x670/0x670 [ 166.576857][ T5605] ? find_held_lock+0x2d/0x110 [ 166.581703][ T5605] ? __fget_light+0x20a/0x270 [ 166.586468][ T5605] ksys_write+0x12b/0x250 [ 166.590896][ T5605] ? __ia32_sys_read+0xb0/0xb0 [ 166.595764][ T5605] ? lockdep_hardirqs_on+0x7d/0x100 [ 166.601032][ T5605] ? _raw_spin_unlock_irq+0x2e/0x50 [ 166.606309][ T5605] ? ptrace_notify+0xfe/0x140 [pid 5609] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5609] setpgid(0, 0) = 0 [pid 5609] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 5609] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 5609] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 5609] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5609] write(3, "1000", 4) = 4 [pid 5609] close(3) = 0 [pid 5609] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5609] mkdir("./file0", 000) = 0 [pid 5609] open("./file0", O_RDONLY) = 3 [pid 5609] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5609] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5609] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5609] openat(5, "memory.max", O_RDWR) = 6 [ 166.611066][ T5605] do_syscall_64+0x39/0xb0 [ 166.615587][ T5605] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 166.621551][ T5605] RIP: 0033:0x7faecf034129 [ 166.626017][ T5605] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 166.645694][ T5605] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 166.654186][ T5605] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [pid 5609] write(6, "0x000000000000040e", 18 [pid 5085] <... umount2 resumed>) = 0 [pid 5085] umount2("./21/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./21/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5085] umount2("./21/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] openat(AT_FDCWD, "./21/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5085] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5085] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5085] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [ 166.662239][ T5605] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 166.670267][ T5605] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 166.678294][ T5605] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 166.686320][ T5605] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000016 [ 166.694362][ T5605] [ 166.704194][ T5605] memory: usage 8kB, limit 0kB, failcnt 36 [pid 5085] close(4) = 0 [pid 5085] rmdir("./21/file0") = 0 [pid 5085] umount2("./21/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./21/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5085] unlink("./21/cgroup.cpu") = 0 [pid 5085] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5085] close(3) = 0 [pid 5085] rmdir("./21") = 0 [pid 5085] mkdir("./22", 0777) = 0 [pid 5085] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5610 attached [pid 5610] chdir("./22" [pid 5085] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 24 [pid 5610] <... chdir resumed>) = 0 [pid 5610] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5610] setpgid(0, 0) = 0 [pid 5610] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 5610] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 5610] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 5610] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5610] write(3, "1000", 4) = 4 [pid 5610] close(3) = 0 [ 166.724553][ T5605] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 166.731551][ T5605] Memory cgroup stats for /syz1: [ 166.732068][ T5605] anon 0 [ 166.732068][ T5605] file 0 [ 166.732068][ T5605] kernel 8192 [ 166.732068][ T5605] kernel_stack 0 [ 166.732068][ T5605] pagetables 0 [ 166.732068][ T5605] sec_pagetables 0 [ 166.732068][ T5605] percpu 0 [ 166.732068][ T5605] sock 0 [ 166.732068][ T5605] vmalloc 0 [ 166.732068][ T5605] shmem 0 [ 166.732068][ T5605] zswap 0 [ 166.732068][ T5605] zswapped 0 [pid 5610] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5610] mkdir("./file0", 000) = 0 [pid 5610] open("./file0", O_RDONLY) = 3 [pid 5610] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5610] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5610] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5610] openat(5, "memory.max", O_RDWR) = 6 [ 166.732068][ T5605] file_mapped 0 [ 166.732068][ T5605] file_dirty 0 [ 166.732068][ T5605] file_writeback 0 [ 166.732068][ T5605] swapcached 0 [ 166.732068][ T5605] anon_thp 0 [ 166.732068][ T5605] file_thp 0 [ 166.732068][ T5605] shmem_thp 0 [ 166.732068][ T5605] inactive_anon 0 [ 166.732068][ T5605] active_anon 0 [ 166.732068][ T5605] inactive_file 0 [ 166.732068][ T5605] active_file 0 [ 166.732068][ T5605] unevictable 0 [ 166.732068][ T5605] slab_reclaimable 6752 [ 166.732068][ T5605] slab_unreclaimable 0 [ 166.732068][ T5605] slab 6752 [ 166.732068][ T5605] workingset_refault_anon 0 [ 166.732068][ T5605] workingset_refault_file 0 [ 166.732068][ T5605] workingset_activate_anon 0 [ 166.732068][ T5605] workingset_activate_file 0 [ 166.732068][ T5605] workingset_restore_anon 0 [ 166.732068][ T5605] workingset_restore_file 0 [ 166.732068][ T5605] workingset_nodereclaim 0 [ 166.732068][ T5605] pgscan 831 [ 166.732068][ T5605] pgsteal 2 [ 166.732068][ T5605] pgscan_kswapd 0 [ 166.732068][ T5605] pgscan_direct 831 [ 166.732068][ T5605] pgscan_khugepaged 0 [ 166.732068][ T5605] pgsteal_kswapd 0 [ 166.732068][ T5605] pgsteal_direct 2 [ 166.732068][ T5605] pgsteal_khugepaged 0 [ 166.732068][ T5605] pgfault 21 [ 166.732068][ T5605] pgmajfault 0 [ 166.732068][ T5605] pgrefill 830 [ 166.732068][ T5605] pgactivate 829 [ 166.732068][ T5605] pgdeactivate 830 [ 166.732068][ T5605] pglazyfree 0 [ 166.732068][ T5605] pglazyfreed 0 [ 166.732068][ T5605] zswpin 0 [ 166.732068][ T5605] zswpout 0 [ 166.732068][ T5605] thp_fault_alloc 0 [ 166.732068][ T5605] thp_collapse_alloc 0 [pid 5610] write(6, "0x000000000000040e", 18 [pid 5605] <... write resumed>) = 18 [pid 5605] close(3) = 0 [pid 5605] close(4) = 0 [pid 5605] close(5) = 0 [pid 5605] close(6) = 0 [pid 5605] close(7) = -1 EBADF (Bad file descriptor) [pid 5605] close(8) = -1 EBADF (Bad file descriptor) [pid 5605] close(9) = -1 EBADF (Bad file descriptor) [pid 5605] close(10) = -1 EBADF (Bad file descriptor) [pid 5605] close(11) = -1 EBADF (Bad file descriptor) [pid 5605] close(12) = -1 EBADF (Bad file descriptor) [pid 5605] close(13) = -1 EBADF (Bad file descriptor) [pid 5605] close(14) = -1 EBADF (Bad file descriptor) [pid 5605] close(15) = -1 EBADF (Bad file descriptor) [pid 5605] close(16) = -1 EBADF (Bad file descriptor) [ 166.944610][ T5605] Tasks state (memory values in pages): [ 166.950235][ T5605] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 166.959927][ T5605] Out of memory and no killable processes... [ 166.970260][ T5607] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5605] close(17) = -1 EBADF (Bad file descriptor) [pid 5605] close(18) = -1 EBADF (Bad file descriptor) [pid 5605] close(19) = -1 EBADF (Bad file descriptor) [pid 5605] close(20) = -1 EBADF (Bad file descriptor) [pid 5605] close(21) = -1 EBADF (Bad file descriptor) [pid 5605] close(22) = -1 EBADF (Bad file descriptor) [pid 5605] close(23) = -1 EBADF (Bad file descriptor) [pid 5605] close(24) = -1 EBADF (Bad file descriptor) [pid 5605] close(25) = -1 EBADF (Bad file descriptor) [pid 5605] close(26) = -1 EBADF (Bad file descriptor) [pid 5605] close(27) = -1 EBADF (Bad file descriptor) [pid 5605] close(28) = -1 EBADF (Bad file descriptor) [pid 5605] close(29) = -1 EBADF (Bad file descriptor) [pid 5605] exit_group(0) = ? [pid 5605] +++ exited with 0 +++ [ 167.010921][ T5607] CPU: 0 PID: 5607 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 167.020986][ T5607] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 167.031110][ T5607] Call Trace: [ 167.034444][ T5607] [ 167.037417][ T5607] dump_stack_lvl+0x136/0x150 [ 167.042158][ T5607] dump_header+0x10a/0xd70 [ 167.046641][ T5607] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 167.052803][ T5607] out_of_memory+0xd64/0x1660 [ 167.057569][ T5607] ? oom_killer_disable+0x2b0/0x2b0 [ 167.062863][ T5607] mem_cgroup_out_of_memory+0x206/0x270 [ 167.068487][ T5607] ? mem_cgroup_margin+0x130/0x130 [ 167.073705][ T5607] memory_max_write+0x2f9/0x3c0 [ 167.078635][ T5607] ? mem_cgroup_force_empty_write+0x160/0x160 [ 167.084774][ T5607] ? lock_sync+0x190/0x190 [ 167.089235][ T5607] cgroup_file_write+0x1e2/0x7b0 [ 167.094226][ T5607] ? mem_cgroup_force_empty_write+0x160/0x160 [ 167.100339][ T5607] ? kill_css+0x3b0/0x3b0 [ 167.104714][ T5607] ? lock_acquire+0x32/0xc0 [ 167.109296][ T5607] ? kill_css+0x3b0/0x3b0 [ 167.113668][ T5607] kernfs_fop_write_iter+0x3f1/0x600 [ 167.119017][ T5607] vfs_write+0x9ed/0xe10 [ 167.123321][ T5607] ? kernel_write+0x670/0x670 [ 167.128053][ T5607] ? find_held_lock+0x2d/0x110 [ 167.132872][ T5607] ? __fget_light+0x20a/0x270 [ 167.137615][ T5607] ksys_write+0x12b/0x250 [ 167.142002][ T5607] ? __ia32_sys_read+0xb0/0xb0 [ 167.146812][ T5607] ? lockdep_hardirqs_on+0x7d/0x100 [ 167.152056][ T5607] ? _raw_spin_unlock_irq+0x2e/0x50 [ 167.157297][ T5607] ? ptrace_notify+0xfe/0x140 [ 167.162015][ T5607] do_syscall_64+0x39/0xb0 [ 167.166479][ T5607] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 167.172433][ T5607] RIP: 0033:0x7faecf034129 [ 167.176894][ T5607] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 167.196549][ T5607] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 5086] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=24, si_uid=0, si_status=0, si_utime=0, si_stime=6 /* 0.06 s */} --- [pid 5086] umount2("./22", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] openat(AT_FDCWD, "./22", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5086] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5086] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5086] umount2("./22/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./22/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [ 167.205000][ T5607] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 167.213003][ T5607] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 167.221001][ T5607] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 167.229002][ T5607] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 167.237000][ T5607] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000019 [ 167.245023][ T5607] [pid 5086] unlink("./22/binderfs") = 0 [pid 5086] umount2("./22/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./22/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5086] unlink("./22/cgroup") = 0 [pid 5086] umount2("./22/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./22/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5086] unlink("./22/cgroup.net") = 0 [ 167.267977][ T5607] memory: usage 8kB, limit 0kB, failcnt 36 [ 167.275734][ T5607] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 167.283327][ T5607] Memory cgroup stats for /syz1: [ 167.283629][ T5607] anon 0 [ 167.283629][ T5607] file 0 [ 167.283629][ T5607] kernel 8192 [ 167.283629][ T5607] kernel_stack 0 [ 167.283629][ T5607] pagetables 0 [ 167.283629][ T5607] sec_pagetables 0 [ 167.283629][ T5607] percpu 0 [ 167.283629][ T5607] sock 0 [ 167.283629][ T5607] vmalloc 0 [ 167.283629][ T5607] shmem 0 [ 167.283629][ T5607] zswap 0 [ 167.283629][ T5607] zswapped 0 [ 167.283629][ T5607] file_mapped 0 [ 167.283629][ T5607] file_dirty 0 [ 167.283629][ T5607] file_writeback 0 [ 167.283629][ T5607] swapcached 0 [ 167.283629][ T5607] anon_thp 0 [ 167.283629][ T5607] file_thp 0 [ 167.283629][ T5607] shmem_thp 0 [ 167.283629][ T5607] inactive_anon 0 [ 167.283629][ T5607] active_anon 0 [ 167.283629][ T5607] inactive_file 0 [ 167.283629][ T5607] active_file 0 [ 167.283629][ T5607] unevictable 0 [ 167.283629][ T5607] slab_reclaimable 6752 [ 167.283629][ T5607] slab_unreclaimable 0 [ 167.283629][ T5607] slab 6752 [ 167.283629][ T5607] workingset_refault_anon 0 [ 167.283629][ T5607] workingset_refault_file 0 [ 167.283629][ T5607] workingset_activate_anon 0 [ 167.283629][ T5607] workingset_activate_file 0 [ 167.283629][ T5607] workingset_restore_anon 0 [ 167.283629][ T5607] workingset_restore_file 0 [ 167.283629][ T5607] workingset_nodereclaim 0 [ 167.283629][ T5607] pgscan 831 [ 167.283629][ T5607] pgsteal 2 [ 167.283629][ T5607] pgscan_kswapd 0 [ 167.283629][ T5607] pgscan_direct 831 [ 167.283629][ T5607] pgscan_khugepaged 0 [ 167.283629][ T5607] pgsteal_kswapd 0 [ 167.283629][ T5607] pgsteal_direct 2 [ 167.283629][ T5607] pgsteal_khugepaged 0 [ 167.283629][ T5607] pgfault 21 [ 167.283629][ T5607] pgmajfault 0 [ 167.283629][ T5607] pgrefill 830 [ 167.283629][ T5607] pgactivate 829 [ 167.283629][ T5607] pgdeactivate 830 [ 167.283629][ T5607] pglazyfree 0 [ 167.283629][ T5607] pglazyfreed 0 [ 167.283629][ T5607] zswpin 0 [ 167.283629][ T5607] zswpout 0 [ 167.283629][ T5607] thp_fault_alloc 0 [pid 5086] umount2("./22/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5086] umount2("./22/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./22/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5086] umount2("./22/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] openat(AT_FDCWD, "./22/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5086] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5086] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5086] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5086] close(4) = 0 [pid 5086] rmdir("./22/file0") = 0 [pid 5086] umount2("./22/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./22/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5086] unlink("./22/cgroup.cpu") = 0 [pid 5086] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5086] close(3) = 0 [pid 5086] rmdir("./22") = 0 [pid 5086] mkdir("./23", 0777) = 0 [pid 5086] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5612 attached [pid 5612] chdir("./23" [pid 5086] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 25 [pid 5612] <... chdir resumed>) = 0 [pid 5612] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5612] setpgid(0, 0) = 0 [ 167.283629][ T5607] thp_collapse_alloc 0 [ 167.484370][ T5607] Tasks state (memory values in pages): [ 167.491082][ T5607] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 167.510072][ T5607] Out of memory and no killable processes... [pid 5612] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [pid 5612] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 5612] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 5612] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5612] write(3, "1000", 4) = 4 [pid 5612] close(3) = 0 [pid 5607] <... write resumed>) = 18 [pid 5612] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5612] mkdir("./file0", 000) = 0 [pid 5612] open("./file0", O_RDONLY) = 3 [pid 5612] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5612] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5612] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5612] openat(5, "memory.max", O_RDWR) = 6 [ 167.517915][ T5608] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 167.529300][ T5608] CPU: 0 PID: 5608 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 167.539275][ T5608] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 167.549394][ T5608] Call Trace: [ 167.552724][ T5608] [ 167.555714][ T5608] dump_stack_lvl+0x136/0x150 [ 167.560461][ T5608] dump_header+0x10a/0xd70 [ 167.564938][ T5608] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 167.571098][ T5608] out_of_memory+0xd64/0x1660 [ 167.575855][ T5608] ? oom_killer_disable+0x2b0/0x2b0 [ 167.581137][ T5608] mem_cgroup_out_of_memory+0x206/0x270 [ 167.586759][ T5608] ? mem_cgroup_margin+0x130/0x130 [ 167.591968][ T5608] memory_max_write+0x2f9/0x3c0 [ 167.596901][ T5608] ? mem_cgroup_force_empty_write+0x160/0x160 [ 167.603056][ T5608] ? lock_sync+0x190/0x190 [ 167.607548][ T5608] cgroup_file_write+0x1e2/0x7b0 [ 167.612575][ T5608] ? mem_cgroup_force_empty_write+0x160/0x160 [pid 5612] write(6, "0x000000000000040e", 18 [pid 5607] close(3) = 0 [pid 5607] close(4) = 0 [pid 5607] close(5) = 0 [pid 5607] close(6) = 0 [pid 5607] close(7) = -1 EBADF (Bad file descriptor) [pid 5607] close(8) = -1 EBADF (Bad file descriptor) [pid 5607] close(9) = -1 EBADF (Bad file descriptor) [pid 5607] close(10) = -1 EBADF (Bad file descriptor) [pid 5607] close(11) = -1 EBADF (Bad file descriptor) [pid 5607] close(12) = -1 EBADF (Bad file descriptor) [pid 5607] close(13) = -1 EBADF (Bad file descriptor) [pid 5607] close(14) = -1 EBADF (Bad file descriptor) [pid 5607] close(15) = -1 EBADF (Bad file descriptor) [pid 5607] close(16) = -1 EBADF (Bad file descriptor) [pid 5607] close(17) = -1 EBADF (Bad file descriptor) [pid 5607] close(18) = -1 EBADF (Bad file descriptor) [pid 5607] close(19) = -1 EBADF (Bad file descriptor) [ 167.618788][ T5608] ? kill_css+0x3b0/0x3b0 [ 167.623196][ T5608] ? lock_acquire+0x32/0xc0 [ 167.627782][ T5608] ? kill_css+0x3b0/0x3b0 [ 167.632188][ T5608] kernfs_fop_write_iter+0x3f1/0x600 [ 167.637579][ T5608] vfs_write+0x9ed/0xe10 [ 167.641919][ T5608] ? kernel_write+0x670/0x670 [ 167.646690][ T5608] ? find_held_lock+0x2d/0x110 [ 167.651548][ T5608] ? __fget_light+0x20a/0x270 [ 167.656320][ T5608] ksys_write+0x12b/0x250 [ 167.660739][ T5608] ? __ia32_sys_read+0xb0/0xb0 [pid 5607] close(20) = -1 EBADF (Bad file descriptor) [pid 5607] close(21) = -1 EBADF (Bad file descriptor) [pid 5607] close(22) = -1 EBADF (Bad file descriptor) [pid 5607] close(23) = -1 EBADF (Bad file descriptor) [pid 5607] close(24) = -1 EBADF (Bad file descriptor) [pid 5607] close(25) = -1 EBADF (Bad file descriptor) [pid 5607] close(26) = -1 EBADF (Bad file descriptor) [pid 5607] close(27) = -1 EBADF (Bad file descriptor) [pid 5607] close(28) = -1 EBADF (Bad file descriptor) [pid 5607] close(29) = -1 EBADF (Bad file descriptor) [pid 5607] exit_group(0) = ? [pid 5607] +++ exited with 0 +++ [ 167.665579][ T5608] ? lockdep_hardirqs_on+0x7d/0x100 [ 167.670893][ T5608] ? _raw_spin_unlock_irq+0x2e/0x50 [ 167.676170][ T5608] ? ptrace_notify+0xfe/0x140 [ 167.680930][ T5608] do_syscall_64+0x39/0xb0 [ 167.685433][ T5608] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 167.691397][ T5608] RIP: 0033:0x7faecf034129 [ 167.695866][ T5608] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 5090] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=27, si_uid=0, si_status=0, si_utime=0, si_stime=7 /* 0.07 s */} --- [pid 5090] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5090] umount2("./25", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] openat(AT_FDCWD, "./25", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5090] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5090] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5090] umount2("./25/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./25/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5090] unlink("./25/binderfs") = 0 [pid 5090] umount2("./25/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./25/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5090] unlink("./25/cgroup") = 0 [pid 5090] umount2("./25/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./25/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5090] unlink("./25/cgroup.net") = 0 [pid 5090] umount2("./25/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5090] umount2("./25/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./25/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5090] umount2("./25/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] openat(AT_FDCWD, "./25/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5090] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [ 167.715536][ T5608] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 167.724019][ T5608] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 167.732046][ T5608] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 167.740070][ T5608] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 167.748099][ T5608] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 167.756130][ T5608] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000019 [ 167.764191][ T5608] [pid 5090] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5090] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5090] close(4) = 0 [pid 5090] rmdir("./25/file0") = 0 [pid 5090] umount2("./25/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./25/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5090] unlink("./25/cgroup.cpu") = 0 [pid 5090] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5090] close(3) = 0 [pid 5090] rmdir("./25") = 0 [pid 5090] mkdir("./26", 0777) = 0 [pid 5090] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555c0c5d0) = 28 ./strace-static-x86_64: Process 5613 attached [pid 5613] chdir("./26") = 0 [pid 5613] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5613] setpgid(0, 0) = 0 [pid 5613] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 5613] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 5613] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [ 167.781839][ T5608] memory: usage 8kB, limit 0kB, failcnt 36 [ 167.788763][ T5608] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 167.805407][ T5608] Memory cgroup stats for /syz1: [ 167.805716][ T5608] anon 0 [ 167.805716][ T5608] file 0 [ 167.805716][ T5608] kernel 8192 [ 167.805716][ T5608] kernel_stack 0 [ 167.805716][ T5608] pagetables 0 [ 167.805716][ T5608] sec_pagetables 0 [pid 5613] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5613] write(3, "1000", 4) = 4 [pid 5613] close(3) = 0 [pid 5613] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5613] mkdir("./file0", 000) = 0 [pid 5613] open("./file0", O_RDONLY) = 3 [pid 5613] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5613] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5613] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5613] openat(5, "memory.max", O_RDWR) = 6 [ 167.805716][ T5608] percpu 0 [ 167.805716][ T5608] sock 0 [ 167.805716][ T5608] vmalloc 0 [ 167.805716][ T5608] shmem 0 [ 167.805716][ T5608] zswap 0 [ 167.805716][ T5608] zswapped 0 [ 167.805716][ T5608] file_mapped 0 [ 167.805716][ T5608] file_dirty 0 [ 167.805716][ T5608] file_writeback 0 [ 167.805716][ T5608] swapcached 0 [ 167.805716][ T5608] anon_thp 0 [ 167.805716][ T5608] file_thp 0 [ 167.805716][ T5608] shmem_thp 0 [ 167.805716][ T5608] inactive_anon 0 [ 167.805716][ T5608] active_anon 0 [ 167.805716][ T5608] inactive_file 0 [ 167.805716][ T5608] active_file 0 [ 167.805716][ T5608] unevictable 0 [ 167.805716][ T5608] slab_reclaimable 6752 [ 167.805716][ T5608] slab_unreclaimable 0 [ 167.805716][ T5608] slab 6752 [ 167.805716][ T5608] workingset_refault_anon 0 [ 167.805716][ T5608] workingset_refault_file 0 [ 167.805716][ T5608] workingset_activate_anon 0 [ 167.805716][ T5608] workingset_activate_file 0 [ 167.805716][ T5608] workingset_restore_anon 0 [ 167.805716][ T5608] workingset_restore_file 0 [ 167.805716][ T5608] workingset_nodereclaim 0 [ 167.805716][ T5608] pgscan 831 [ 167.805716][ T5608] pgsteal 2 [ 167.805716][ T5608] pgscan_kswapd 0 [ 167.805716][ T5608] pgscan_direct 831 [ 167.805716][ T5608] pgscan_khugepaged 0 [ 167.805716][ T5608] pgsteal_kswapd 0 [ 167.805716][ T5608] pgsteal_direct 2 [ 167.805716][ T5608] pgsteal_khugepaged 0 [ 167.805716][ T5608] pgfault 21 [ 167.805716][ T5608] pgmajfault 0 [ 167.805716][ T5608] pgrefill 830 [ 167.805716][ T5608] pgactivate 829 [ 167.805716][ T5608] pgdeactivate 830 [ 167.805716][ T5608] pglazyfree 0 [ 167.805716][ T5608] pglazyfreed 0 [ 167.805716][ T5608] zswpin 0 [ 167.805716][ T5608] zswpout 0 [ 167.805716][ T5608] thp_fault_alloc 0 [ 167.805716][ T5608] thp_collapse_alloc 0 [ 168.007046][ T5608] Tasks state (memory values in pages): [ 168.014545][ T5608] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 168.025566][ T5608] Out of memory and no killable processes... [pid 5613] write(6, "0x000000000000040e", 18 [pid 5608] <... write resumed>) = 18 [ 168.034958][ T5609] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 168.046076][ T5609] CPU: 0 PID: 5609 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 168.056048][ T5609] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 168.066155][ T5609] Call Trace: [ 168.069475][ T5609] [ 168.072448][ T5609] dump_stack_lvl+0x136/0x150 [ 168.077200][ T5609] dump_header+0x10a/0xd70 [ 168.081682][ T5609] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 168.087839][ T5609] out_of_memory+0xd64/0x1660 [ 168.092600][ T5609] ? oom_killer_disable+0x2b0/0x2b0 [ 168.097890][ T5609] mem_cgroup_out_of_memory+0x206/0x270 [ 168.103502][ T5609] ? mem_cgroup_margin+0x130/0x130 [ 168.108682][ T5609] memory_max_write+0x2f9/0x3c0 [ 168.113592][ T5609] ? mem_cgroup_force_empty_write+0x160/0x160 [ 168.119712][ T5609] ? lock_sync+0x190/0x190 [ 168.124174][ T5609] cgroup_file_write+0x1e2/0x7b0 [ 168.129164][ T5609] ? mem_cgroup_force_empty_write+0x160/0x160 [ 168.135277][ T5609] ? kill_css+0x3b0/0x3b0 [ 168.139645][ T5609] ? lock_acquire+0x32/0xc0 [ 168.144195][ T5609] ? kill_css+0x3b0/0x3b0 [ 168.148581][ T5609] kernfs_fop_write_iter+0x3f1/0x600 [ 168.153913][ T5609] vfs_write+0x9ed/0xe10 [ 168.158216][ T5609] ? kernel_write+0x670/0x670 [ 168.162960][ T5609] ? find_held_lock+0x2d/0x110 [ 168.167771][ T5609] ? __fget_light+0x20a/0x270 [ 168.172497][ T5609] ksys_write+0x12b/0x250 [ 168.176902][ T5609] ? __ia32_sys_read+0xb0/0xb0 [ 168.181729][ T5609] ? lockdep_hardirqs_on+0x7d/0x100 [ 168.186971][ T5609] ? _raw_spin_unlock_irq+0x2e/0x50 [ 168.192242][ T5609] ? ptrace_notify+0xfe/0x140 [ 168.196961][ T5609] do_syscall_64+0x39/0xb0 [ 168.201427][ T5609] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 168.207420][ T5609] RIP: 0033:0x7faecf034129 [ 168.211866][ T5609] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 5608] close(3) = 0 [pid 5608] close(4) = 0 [pid 5608] close(5) = 0 [pid 5608] close(6) = 0 [pid 5608] close(7) = -1 EBADF (Bad file descriptor) [pid 5608] close(8) = -1 EBADF (Bad file descriptor) [pid 5608] close(9) = -1 EBADF (Bad file descriptor) [pid 5608] close(10) = -1 EBADF (Bad file descriptor) [pid 5608] close(11) = -1 EBADF (Bad file descriptor) [pid 5608] close(12) = -1 EBADF (Bad file descriptor) [pid 5608] close(13) = -1 EBADF (Bad file descriptor) [pid 5608] close(14) = -1 EBADF (Bad file descriptor) [pid 5608] close(15) = -1 EBADF (Bad file descriptor) [pid 5608] close(16) = -1 EBADF (Bad file descriptor) [pid 5608] close(17) = -1 EBADF (Bad file descriptor) [pid 5608] close(18) = -1 EBADF (Bad file descriptor) [pid 5608] close(19) = -1 EBADF (Bad file descriptor) [pid 5608] close(20) = -1 EBADF (Bad file descriptor) [pid 5608] close(21) = -1 EBADF (Bad file descriptor) [pid 5608] close(22) = -1 EBADF (Bad file descriptor) [pid 5608] close(23) = -1 EBADF (Bad file descriptor) [pid 5608] close(24) = -1 EBADF (Bad file descriptor) [pid 5608] close(25) = -1 EBADF (Bad file descriptor) [pid 5608] close(26) = -1 EBADF (Bad file descriptor) [pid 5608] close(27) = -1 EBADF (Bad file descriptor) [pid 5608] close(28) = -1 EBADF (Bad file descriptor) [pid 5608] close(29) = -1 EBADF (Bad file descriptor) [pid 5608] exit_group(0) = ? [pid 5608] +++ exited with 0 +++ [pid 5089] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=27, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- [ 168.231509][ T5609] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 168.239978][ T5609] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 168.247973][ T5609] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 168.255972][ T5609] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 168.263966][ T5609] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 168.271964][ T5609] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000018 [ 168.279987][ T5609] [pid 5089] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5089] umount2("./25", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] openat(AT_FDCWD, "./25", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5089] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5089] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5089] umount2("./25/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./25/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5089] unlink("./25/binderfs") = 0 [pid 5089] umount2("./25/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./25/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5089] unlink("./25/cgroup") = 0 [pid 5089] umount2("./25/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./25/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5089] unlink("./25/cgroup.net") = 0 [ 168.313431][ T5609] memory: usage 8kB, limit 0kB, failcnt 36 [ 168.319723][ T5609] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 168.328141][ T5609] Memory cgroup stats for /syz1: [ 168.328496][ T5609] anon 0 [ 168.328496][ T5609] file 0 [ 168.328496][ T5609] kernel 8192 [ 168.328496][ T5609] kernel_stack 0 [ 168.328496][ T5609] pagetables 0 [ 168.328496][ T5609] sec_pagetables 0 [ 168.328496][ T5609] percpu 0 [ 168.328496][ T5609] sock 0 [ 168.328496][ T5609] vmalloc 0 [ 168.328496][ T5609] shmem 0 [ 168.328496][ T5609] zswap 0 [ 168.328496][ T5609] zswapped 0 [ 168.328496][ T5609] file_mapped 0 [ 168.328496][ T5609] file_dirty 0 [ 168.328496][ T5609] file_writeback 0 [ 168.328496][ T5609] swapcached 0 [ 168.328496][ T5609] anon_thp 0 [ 168.328496][ T5609] file_thp 0 [ 168.328496][ T5609] shmem_thp 0 [ 168.328496][ T5609] inactive_anon 0 [ 168.328496][ T5609] active_anon 0 [ 168.328496][ T5609] inactive_file 0 [ 168.328496][ T5609] active_file 0 [ 168.328496][ T5609] unevictable 0 [ 168.328496][ T5609] slab_reclaimable 6752 [ 168.328496][ T5609] slab_unreclaimable 0 [ 168.328496][ T5609] slab 6752 [ 168.328496][ T5609] workingset_refault_anon 0 [ 168.328496][ T5609] workingset_refault_file 0 [ 168.328496][ T5609] workingset_activate_anon 0 [ 168.328496][ T5609] workingset_activate_file 0 [ 168.328496][ T5609] workingset_restore_anon 0 [ 168.328496][ T5609] workingset_restore_file 0 [ 168.328496][ T5609] workingset_nodereclaim 0 [ 168.328496][ T5609] pgscan 831 [ 168.328496][ T5609] pgsteal 2 [ 168.328496][ T5609] pgscan_kswapd 0 [ 168.328496][ T5609] pgscan_direct 831 [ 168.328496][ T5609] pgscan_khugepaged 0 [ 168.328496][ T5609] pgsteal_kswapd 0 [ 168.328496][ T5609] pgsteal_direct 2 [ 168.328496][ T5609] pgsteal_khugepaged 0 [ 168.328496][ T5609] pgfault 21 [ 168.328496][ T5609] pgmajfault 0 [ 168.328496][ T5609] pgrefill 830 [ 168.328496][ T5609] pgactivate 829 [ 168.328496][ T5609] pgdeactivate 830 [ 168.328496][ T5609] pglazyfree 0 [ 168.328496][ T5609] pglazyfreed 0 [ 168.328496][ T5609] zswpin 0 [ 168.328496][ T5609] zswpout 0 [ 168.328496][ T5609] thp_fault_alloc 0 [ 168.328496][ T5609] thp_collapse_alloc 0 [pid 5089] umount2("./25/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5089] umount2("./25/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./25/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5089] umount2("./25/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] openat(AT_FDCWD, "./25/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5089] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5089] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5089] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5089] close(4) = 0 [pid 5089] rmdir("./25/file0") = 0 [pid 5609] <... write resumed>) = 18 [pid 5609] close(3) = 0 [pid 5609] close(4) = 0 [pid 5609] close(5) = 0 [pid 5609] close(6) = 0 [pid 5609] close(7) = -1 EBADF (Bad file descriptor) [pid 5609] close(8) = -1 EBADF (Bad file descriptor) [pid 5609] close(9) = -1 EBADF (Bad file descriptor) [pid 5609] close(10) = -1 EBADF (Bad file descriptor) [pid 5609] close(11) = -1 EBADF (Bad file descriptor) [pid 5609] close(12) = -1 EBADF (Bad file descriptor) [pid 5609] close(13) = -1 EBADF (Bad file descriptor) [pid 5609] close(14) = -1 EBADF (Bad file descriptor) [pid 5609] close(15) = -1 EBADF (Bad file descriptor) [pid 5609] close(16) = -1 EBADF (Bad file descriptor) [pid 5609] close(17) = -1 EBADF (Bad file descriptor) [pid 5609] close(18) = -1 EBADF (Bad file descriptor) [pid 5609] close(19) = -1 EBADF (Bad file descriptor) [pid 5609] close(20) = -1 EBADF (Bad file descriptor) [pid 5089] umount2("./25/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./25/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5089] unlink("./25/cgroup.cpu") = 0 [pid 5089] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5089] close(3) = 0 [pid 5609] close(21 [pid 5089] rmdir("./25") = 0 [ 168.522237][ T5609] Tasks state (memory values in pages): [ 168.527849][ T5609] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 168.538189][ T5609] Out of memory and no killable processes... [ 168.546222][ T5610] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5089] mkdir("./26", 0777) = 0 [pid 5089] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5614 attached [pid 5614] chdir("./26" [pid 5089] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 28 [pid 5614] <... chdir resumed>) = 0 [pid 5614] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5614] setpgid(0, 0) = 0 [pid 5614] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 5614] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [pid 5614] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 5614] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5614] write(3, "1000", 4) = 4 [pid 5614] close(3) = 0 [pid 5614] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5614] mkdir("./file0", 000) = 0 [pid 5614] open("./file0", O_RDONLY) = 3 [pid 5614] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5614] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5614] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5614] openat(5, "memory.max", O_RDWR) = 6 [ 168.567118][ T5610] CPU: 1 PID: 5610 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 168.577105][ T5610] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 168.587219][ T5610] Call Trace: [ 168.590553][ T5610] [ 168.593545][ T5610] dump_stack_lvl+0x136/0x150 [ 168.598292][ T5610] dump_header+0x10a/0xd70 [ 168.602784][ T5610] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 168.608950][ T5610] out_of_memory+0xd64/0x1660 [ 168.613716][ T5610] ? oom_killer_disable+0x2b0/0x2b0 [pid 5614] write(6, "0x000000000000040e", 18 [pid 5609] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5609] close(22) = -1 EBADF (Bad file descriptor) [pid 5609] close(23) = -1 EBADF (Bad file descriptor) [pid 5609] close(24) = -1 EBADF (Bad file descriptor) [pid 5609] close(25) = -1 EBADF (Bad file descriptor) [pid 5609] close(26) = -1 EBADF (Bad file descriptor) [pid 5609] close(27) = -1 EBADF (Bad file descriptor) [pid 5609] close(28) = -1 EBADF (Bad file descriptor) [pid 5609] close(29) = -1 EBADF (Bad file descriptor) [pid 5609] exit_group(0) = ? [ 168.619037][ T5610] mem_cgroup_out_of_memory+0x206/0x270 [ 168.624661][ T5610] ? mem_cgroup_margin+0x130/0x130 [ 168.629890][ T5610] memory_max_write+0x2f9/0x3c0 [ 168.634840][ T5610] ? mem_cgroup_force_empty_write+0x160/0x160 [ 168.640997][ T5610] ? lock_sync+0x190/0x190 [ 168.645491][ T5610] cgroup_file_write+0x1e2/0x7b0 [ 168.650531][ T5610] ? mem_cgroup_force_empty_write+0x160/0x160 [ 168.656684][ T5610] ? kill_css+0x3b0/0x3b0 [ 168.661093][ T5610] ? lock_acquire+0x32/0xc0 [ 168.665676][ T5610] ? kill_css+0x3b0/0x3b0 [pid 5609] +++ exited with 0 +++ [pid 5087] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=26, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- [pid 5087] umount2("./24", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] openat(AT_FDCWD, "./24", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5087] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5087] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5087] umount2("./24/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./24/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5087] unlink("./24/binderfs") = 0 [pid 5087] umount2("./24/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./24/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5087] unlink("./24/cgroup") = 0 [pid 5087] umount2("./24/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./24/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5087] unlink("./24/cgroup.net") = 0 [ 168.670087][ T5610] kernfs_fop_write_iter+0x3f1/0x600 [ 168.675455][ T5610] vfs_write+0x9ed/0xe10 [ 168.679789][ T5610] ? kernel_write+0x670/0x670 [ 168.684575][ T5610] ? find_held_lock+0x2d/0x110 [ 168.689434][ T5610] ? __fget_light+0x20a/0x270 [ 168.694204][ T5610] ksys_write+0x12b/0x250 [ 168.698619][ T5610] ? __ia32_sys_read+0xb0/0xb0 [ 168.703461][ T5610] ? lockdep_hardirqs_on+0x7d/0x100 [ 168.708734][ T5610] ? _raw_spin_unlock_irq+0x2e/0x50 [ 168.714011][ T5610] ? ptrace_notify+0xfe/0x140 [ 168.718762][ T5610] do_syscall_64+0x39/0xb0 [ 168.723262][ T5610] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 168.729227][ T5610] RIP: 0033:0x7faecf034129 [ 168.733691][ T5610] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 168.753367][ T5610] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 168.761861][ T5610] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [pid 5087] umount2("./24/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5087] umount2("./24/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./24/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5087] umount2("./24/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] openat(AT_FDCWD, "./24/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5087] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [ 168.769890][ T5610] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 168.777919][ T5610] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 168.785974][ T5610] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 168.793996][ T5610] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000016 [ 168.802052][ T5610] [pid 5087] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5087] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5087] close(4) = 0 [pid 5087] rmdir("./24/file0") = 0 [pid 5087] umount2("./24/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./24/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5087] unlink("./24/cgroup.cpu") = 0 [pid 5087] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5087] close(3) = 0 [pid 5087] rmdir("./24") = 0 [pid 5087] mkdir("./25", 0777) = 0 [pid 5087] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555c0c5d0) = 27 ./strace-static-x86_64: Process 5615 attached [pid 5615] chdir("./25") = 0 [pid 5615] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5615] setpgid(0, 0) = 0 [pid 5615] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 5615] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 5615] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [ 168.824374][ T5610] memory: usage 8kB, limit 0kB, failcnt 36 [ 168.830273][ T5610] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 168.846058][ T5610] Memory cgroup stats for /syz1: [ 168.846347][ T5610] anon 0 [ 168.846347][ T5610] file 0 [ 168.846347][ T5610] kernel 8192 [ 168.846347][ T5610] kernel_stack 0 [ 168.846347][ T5610] pagetables 0 [ 168.846347][ T5610] sec_pagetables 0 [ 168.846347][ T5610] percpu 0 [pid 5615] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5615] write(3, "1000", 4) = 4 [pid 5615] close(3) = 0 [pid 5615] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5615] mkdir("./file0", 000) = 0 [pid 5615] open("./file0", O_RDONLY) = 3 [pid 5615] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5615] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5615] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5615] openat(5, "memory.max", O_RDWR) = 6 [ 168.846347][ T5610] sock 0 [ 168.846347][ T5610] vmalloc 0 [ 168.846347][ T5610] shmem 0 [ 168.846347][ T5610] zswap 0 [ 168.846347][ T5610] zswapped 0 [ 168.846347][ T5610] file_mapped 0 [ 168.846347][ T5610] file_dirty 0 [ 168.846347][ T5610] file_writeback 0 [ 168.846347][ T5610] swapcached 0 [ 168.846347][ T5610] anon_thp 0 [ 168.846347][ T5610] file_thp 0 [ 168.846347][ T5610] shmem_thp 0 [ 168.846347][ T5610] inactive_anon 0 [ 168.846347][ T5610] active_anon 0 [ 168.846347][ T5610] inactive_file 0 [ 168.846347][ T5610] active_file 0 [ 168.846347][ T5610] unevictable 0 [ 168.846347][ T5610] slab_reclaimable 6752 [ 168.846347][ T5610] slab_unreclaimable 0 [ 168.846347][ T5610] slab 6752 [ 168.846347][ T5610] workingset_refault_anon 0 [ 168.846347][ T5610] workingset_refault_file 0 [ 168.846347][ T5610] workingset_activate_anon 0 [ 168.846347][ T5610] workingset_activate_file 0 [ 168.846347][ T5610] workingset_restore_anon 0 [ 168.846347][ T5610] workingset_restore_file 0 [ 168.846347][ T5610] workingset_nodereclaim 0 [ 168.846347][ T5610] pgscan 831 [ 168.846347][ T5610] pgsteal 2 [ 168.846347][ T5610] pgscan_kswapd 0 [ 168.846347][ T5610] pgscan_direct 831 [ 168.846347][ T5610] pgscan_khugepaged 0 [ 168.846347][ T5610] pgsteal_kswapd 0 [ 168.846347][ T5610] pgsteal_direct 2 [ 168.846347][ T5610] pgsteal_khugepaged 0 [ 168.846347][ T5610] pgfault 21 [ 168.846347][ T5610] pgmajfault 0 [ 168.846347][ T5610] pgrefill 830 [ 168.846347][ T5610] pgactivate 829 [ 168.846347][ T5610] pgdeactivate 830 [ 168.846347][ T5610] pglazyfree 0 [ 168.846347][ T5610] pglazyfreed 0 [ 168.846347][ T5610] zswpin 0 [ 168.846347][ T5610] zswpout 0 [pid 5615] write(6, "0x000000000000040e", 18 [pid 5610] <... write resumed>) = 18 [pid 5610] close(3) = 0 [pid 5610] close(4) = 0 [pid 5610] close(5) = 0 [ 168.846347][ T5610] thp_fault_alloc 0 [ 168.846347][ T5610] thp_collapse_alloc 0 [ 169.033764][ T5610] Tasks state (memory values in pages): [ 169.040412][ T5610] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 169.059381][ T5610] Out of memory and no killable processes... [pid 5610] close(6) = 0 [pid 5610] close(7) = -1 EBADF (Bad file descriptor) [pid 5610] close(8) = -1 EBADF (Bad file descriptor) [pid 5610] close(9) = -1 EBADF (Bad file descriptor) [pid 5610] close(10) = -1 EBADF (Bad file descriptor) [pid 5610] close(11) = -1 EBADF (Bad file descriptor) [pid 5610] close(12) = -1 EBADF (Bad file descriptor) [pid 5610] close(13) = -1 EBADF (Bad file descriptor) [pid 5610] close(14) = -1 EBADF (Bad file descriptor) [pid 5610] close(15) = -1 EBADF (Bad file descriptor) [pid 5610] close(16) = -1 EBADF (Bad file descriptor) [pid 5610] close(17) = -1 EBADF (Bad file descriptor) [pid 5610] close(18) = -1 EBADF (Bad file descriptor) [pid 5610] close(19) = -1 EBADF (Bad file descriptor) [pid 5610] close(20) = -1 EBADF (Bad file descriptor) [pid 5610] close(21) = -1 EBADF (Bad file descriptor) [pid 5610] close(22) = -1 EBADF (Bad file descriptor) [pid 5610] close(23) = -1 EBADF (Bad file descriptor) [pid 5610] close(24) = -1 EBADF (Bad file descriptor) [pid 5610] close(25) = -1 EBADF (Bad file descriptor) [pid 5610] close(26) = -1 EBADF (Bad file descriptor) [pid 5610] close(27) = -1 EBADF (Bad file descriptor) [ 169.068986][ T5612] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 169.089629][ T5612] CPU: 1 PID: 5612 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 169.099615][ T5612] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 169.109728][ T5612] Call Trace: [ 169.113057][ T5612] [ 169.116043][ T5612] dump_stack_lvl+0x136/0x150 [ 169.120794][ T5612] dump_header+0x10a/0xd70 [pid 5610] close(28) = -1 EBADF (Bad file descriptor) [pid 5610] close(29) = -1 EBADF (Bad file descriptor) [pid 5610] exit_group(0) = ? [pid 5610] +++ exited with 0 +++ [pid 5085] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=24, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- [pid 5085] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5085] umount2("./22", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] openat(AT_FDCWD, "./22", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5085] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5085] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5085] umount2("./22/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./22/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5085] unlink("./22/binderfs") = 0 [pid 5085] umount2("./22/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./22/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5085] unlink("./22/cgroup") = 0 [pid 5085] umount2("./22/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./22/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5085] unlink("./22/cgroup.net") = 0 [ 169.125282][ T5612] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 169.131447][ T5612] out_of_memory+0xd64/0x1660 [ 169.136235][ T5612] ? oom_killer_disable+0x2b0/0x2b0 [ 169.141533][ T5612] mem_cgroup_out_of_memory+0x206/0x270 [ 169.147170][ T5612] ? mem_cgroup_margin+0x130/0x130 [ 169.152494][ T5612] memory_max_write+0x2f9/0x3c0 [ 169.157449][ T5612] ? mem_cgroup_force_empty_write+0x160/0x160 [ 169.163617][ T5612] ? lock_sync+0x190/0x190 [ 169.168124][ T5612] cgroup_file_write+0x1e2/0x7b0 [ 169.173154][ T5612] ? mem_cgroup_force_empty_write+0x160/0x160 [ 169.179321][ T5612] ? kill_css+0x3b0/0x3b0 [ 169.183727][ T5612] ? lock_acquire+0x32/0xc0 [ 169.188289][ T5612] ? kill_css+0x3b0/0x3b0 [ 169.192704][ T5612] kernfs_fop_write_iter+0x3f1/0x600 [ 169.198081][ T5612] vfs_write+0x9ed/0xe10 [ 169.202387][ T5612] ? kernel_write+0x670/0x670 [ 169.207170][ T5612] ? find_held_lock+0x2d/0x110 [ 169.211994][ T5612] ? __fget_light+0x20a/0x270 [ 169.216725][ T5612] ksys_write+0x12b/0x250 [ 169.221173][ T5612] ? __ia32_sys_read+0xb0/0xb0 [ 169.226007][ T5612] ? lockdep_hardirqs_on+0x7d/0x100 [ 169.231233][ T5612] ? _raw_spin_unlock_irq+0x2e/0x50 [ 169.236476][ T5612] ? ptrace_notify+0xfe/0x140 [ 169.241225][ T5612] do_syscall_64+0x39/0xb0 [ 169.245714][ T5612] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 169.251658][ T5612] RIP: 0033:0x7faecf034129 [ 169.256130][ T5612] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 169.275802][ T5612] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 169.284281][ T5612] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 169.292309][ T5612] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 169.300365][ T5612] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 169.308394][ T5612] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 169.316421][ T5612] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000017 [ 169.324483][ T5612] [ 169.333944][ T5612] memory: usage 8kB, limit 0kB, failcnt 36 [ 169.342009][ T5612] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 169.348923][ T5612] Memory cgroup stats for /syz1: [ 169.349210][ T5612] anon 0 [ 169.349210][ T5612] file 0 [ 169.349210][ T5612] kernel 8192 [ 169.349210][ T5612] kernel_stack 0 [ 169.349210][ T5612] pagetables 0 [ 169.349210][ T5612] sec_pagetables 0 [ 169.349210][ T5612] percpu 0 [ 169.349210][ T5612] sock 0 [ 169.349210][ T5612] vmalloc 0 [ 169.349210][ T5612] shmem 0 [ 169.349210][ T5612] zswap 0 [ 169.349210][ T5612] zswapped 0 [ 169.349210][ T5612] file_mapped 0 [ 169.349210][ T5612] file_dirty 0 [ 169.349210][ T5612] file_writeback 0 [ 169.349210][ T5612] swapcached 0 [ 169.349210][ T5612] anon_thp 0 [ 169.349210][ T5612] file_thp 0 [ 169.349210][ T5612] shmem_thp 0 [ 169.349210][ T5612] inactive_anon 0 [ 169.349210][ T5612] active_anon 0 [ 169.349210][ T5612] inactive_file 0 [ 169.349210][ T5612] active_file 0 [ 169.349210][ T5612] unevictable 0 [ 169.349210][ T5612] slab_reclaimable 6752 [ 169.349210][ T5612] slab_unreclaimable 0 [ 169.349210][ T5612] slab 6752 [ 169.349210][ T5612] workingset_refault_anon 0 [ 169.349210][ T5612] workingset_refault_file 0 [ 169.349210][ T5612] workingset_activate_anon 0 [ 169.349210][ T5612] workingset_activate_file 0 [ 169.349210][ T5612] workingset_restore_anon 0 [ 169.349210][ T5612] workingset_restore_file 0 [ 169.349210][ T5612] workingset_nodereclaim 0 [ 169.349210][ T5612] pgscan 831 [ 169.349210][ T5612] pgsteal 2 [ 169.349210][ T5612] pgscan_kswapd 0 [ 169.349210][ T5612] pgscan_direct 831 [ 169.349210][ T5612] pgscan_khugepaged 0 [ 169.349210][ T5612] pgsteal_kswapd 0 [ 169.349210][ T5612] pgsteal_direct 2 [ 169.349210][ T5612] pgsteal_khugepaged 0 [ 169.349210][ T5612] pgfault 21 [ 169.349210][ T5612] pgmajfault 0 [ 169.349210][ T5612] pgrefill 830 [ 169.349210][ T5612] pgactivate 829 [ 169.349210][ T5612] pgdeactivate 830 [ 169.349210][ T5612] pglazyfree 0 [ 169.349210][ T5612] pglazyfreed 0 [ 169.349210][ T5612] zswpin 0 [ 169.349210][ T5612] zswpout 0 [pid 5085] umount2("./22/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5085] umount2("./22/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./22/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5085] umount2("./22/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] openat(AT_FDCWD, "./22/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5085] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5085] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5085] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5085] close(4) = 0 [pid 5085] rmdir("./22/file0") = 0 [pid 5085] umount2("./22/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./22/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5085] unlink("./22/cgroup.cpu") = 0 [pid 5085] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5085] close(3) = 0 [pid 5085] rmdir("./22") = 0 [pid 5085] mkdir("./23", 0777) = 0 [pid 5085] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5616 attached [pid 5616] chdir("./23" [pid 5085] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 25 [pid 5616] <... chdir resumed>) = 0 [pid 5616] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5616] setpgid(0, 0) = 0 [pid 5616] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 5616] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 5616] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 5616] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5616] write(3, "1000", 4) = 4 [pid 5616] close(3) = 0 [pid 5616] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5616] mkdir("./file0", 000) = 0 [pid 5616] open("./file0", O_RDONLY) = 3 [pid 5616] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5616] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5616] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5616] openat(5, "memory.max", O_RDWR) = 6 [ 169.349210][ T5612] thp_fault_alloc 0 [ 169.349210][ T5612] thp_collapse_alloc 0 [ 169.579928][ T5612] Tasks state (memory values in pages): [ 169.610107][ T5612] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5616] write(6, "0x000000000000040e", 18 [pid 5612] <... write resumed>) = 18 [pid 5612] close(3) = 0 [pid 5612] close(4) = 0 [pid 5612] close(5) = 0 [ 169.652982][ T5612] Out of memory and no killable processes... [ 169.659112][ T5613] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 169.677434][ T5613] CPU: 1 PID: 5613 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 169.687431][ T5613] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 169.697544][ T5613] Call Trace: [ 169.700867][ T5613] [ 169.703839][ T5613] dump_stack_lvl+0x136/0x150 [ 169.708586][ T5613] dump_header+0x10a/0xd70 [ 169.713068][ T5613] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 169.719255][ T5613] out_of_memory+0xd64/0x1660 [ 169.724009][ T5613] ? oom_killer_disable+0x2b0/0x2b0 [ 169.729295][ T5613] mem_cgroup_out_of_memory+0x206/0x270 [ 169.734916][ T5613] ? mem_cgroup_margin+0x130/0x130 [ 169.740134][ T5613] memory_max_write+0x2f9/0x3c0 [ 169.745062][ T5613] ? mem_cgroup_force_empty_write+0x160/0x160 [ 169.751209][ T5613] ? lock_sync+0x190/0x190 [ 169.755741][ T5613] cgroup_file_write+0x1e2/0x7b0 [ 169.760845][ T5613] ? mem_cgroup_force_empty_write+0x160/0x160 [ 169.766988][ T5613] ? kill_css+0x3b0/0x3b0 [ 169.771401][ T5613] ? lock_acquire+0x32/0xc0 [ 169.775982][ T5613] ? kill_css+0x3b0/0x3b0 [ 169.780392][ T5613] kernfs_fop_write_iter+0x3f1/0x600 [ 169.785753][ T5613] vfs_write+0x9ed/0xe10 [ 169.790075][ T5613] ? kernel_write+0x670/0x670 [ 169.794836][ T5613] ? find_held_lock+0x2d/0x110 [ 169.799675][ T5613] ? __fget_light+0x20a/0x270 [ 169.804434][ T5613] ksys_write+0x12b/0x250 [ 169.808872][ T5613] ? __ia32_sys_read+0xb0/0xb0 [ 169.813710][ T5613] ? lockdep_hardirqs_on+0x7d/0x100 [ 169.818973][ T5613] ? _raw_spin_unlock_irq+0x2e/0x50 [ 169.824245][ T5613] ? ptrace_notify+0xfe/0x140 [ 169.829001][ T5613] do_syscall_64+0x39/0xb0 [ 169.833502][ T5613] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 169.839462][ T5613] RIP: 0033:0x7faecf034129 [ 169.843922][ T5613] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 169.863607][ T5613] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 169.872089][ T5613] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 169.880120][ T5613] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 169.888138][ T5613] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 169.896164][ T5613] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [pid 5612] close(6) = 0 [pid 5612] close(7) = -1 EBADF (Bad file descriptor) [pid 5612] close(8) = -1 EBADF (Bad file descriptor) [pid 5612] close(9) = -1 EBADF (Bad file descriptor) [pid 5612] close(10) = -1 EBADF (Bad file descriptor) [pid 5612] close(11) = -1 EBADF (Bad file descriptor) [pid 5612] close(12) = -1 EBADF (Bad file descriptor) [pid 5612] close(13) = -1 EBADF (Bad file descriptor) [pid 5612] close(14) = -1 EBADF (Bad file descriptor) [pid 5612] close(15) = -1 EBADF (Bad file descriptor) [pid 5612] close(16) = -1 EBADF (Bad file descriptor) [pid 5612] close(17) = -1 EBADF (Bad file descriptor) [pid 5612] close(18) = -1 EBADF (Bad file descriptor) [ 169.904199][ T5613] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 000000000000001a [ 169.912251][ T5613] [pid 5612] close(19) = -1 EBADF (Bad file descriptor) [pid 5612] close(20) = -1 EBADF (Bad file descriptor) [pid 5612] close(21) = -1 EBADF (Bad file descriptor) [pid 5612] close(22) = -1 EBADF (Bad file descriptor) [pid 5612] close(23) = -1 EBADF (Bad file descriptor) [pid 5612] close(24) = -1 EBADF (Bad file descriptor) [pid 5612] close(25) = -1 EBADF (Bad file descriptor) [pid 5612] close(26) = -1 EBADF (Bad file descriptor) [pid 5612] close(27) = -1 EBADF (Bad file descriptor) [pid 5612] close(28) = -1 EBADF (Bad file descriptor) [pid 5612] close(29) = -1 EBADF (Bad file descriptor) [pid 5612] exit_group(0) = ? [pid 5612] +++ exited with 0 +++ [pid 5086] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=25, si_uid=0, si_status=0, si_utime=0, si_stime=9 /* 0.09 s */} --- [pid 5086] umount2("./23", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] openat(AT_FDCWD, "./23", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5086] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5086] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5086] umount2("./23/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./23/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5086] unlink("./23/binderfs") = 0 [pid 5086] umount2("./23/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./23/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5086] unlink("./23/cgroup") = 0 [pid 5086] umount2("./23/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./23/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5086] unlink("./23/cgroup.net") = 0 [pid 5086] umount2("./23/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5086] umount2("./23/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./23/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5086] umount2("./23/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 169.950446][ T5613] memory: usage 8kB, limit 0kB, failcnt 36 [ 169.977294][ T5613] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 170.006485][ T5613] Memory cgroup stats for /syz1: [ 170.006774][ T5613] anon 0 [ 170.006774][ T5613] file 0 [ 170.006774][ T5613] kernel 8192 [ 170.006774][ T5613] kernel_stack 0 [ 170.006774][ T5613] pagetables 0 [ 170.006774][ T5613] sec_pagetables 0 [ 170.006774][ T5613] percpu 0 [ 170.006774][ T5613] sock 0 [ 170.006774][ T5613] vmalloc 0 [ 170.006774][ T5613] shmem 0 [ 170.006774][ T5613] zswap 0 [ 170.006774][ T5613] zswapped 0 [ 170.006774][ T5613] file_mapped 0 [ 170.006774][ T5613] file_dirty 0 [pid 5086] openat(AT_FDCWD, "./23/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [ 170.006774][ T5613] file_writeback 0 [ 170.006774][ T5613] swapcached 0 [ 170.006774][ T5613] anon_thp 0 [ 170.006774][ T5613] file_thp 0 [ 170.006774][ T5613] shmem_thp 0 [ 170.006774][ T5613] inactive_anon 0 [ 170.006774][ T5613] active_anon 0 [ 170.006774][ T5613] inactive_file 0 [ 170.006774][ T5613] active_file 0 [ 170.006774][ T5613] unevictable 0 [ 170.006774][ T5613] slab_reclaimable 6752 [ 170.006774][ T5613] slab_unreclaimable 0 [ 170.006774][ T5613] slab 6752 [ 170.006774][ T5613] workingset_refault_anon 0 [ 170.006774][ T5613] workingset_refault_file 0 [pid 5086] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5086] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5086] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5086] close(4) = 0 [pid 5086] rmdir("./23/file0") = 0 [pid 5086] umount2("./23/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./23/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5086] unlink("./23/cgroup.cpu") = 0 [pid 5086] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5086] close(3) = 0 [pid 5086] rmdir("./23") = 0 [ 170.006774][ T5613] workingset_activate_anon 0 [ 170.006774][ T5613] workingset_activate_file 0 [ 170.006774][ T5613] workingset_restore_anon 0 [ 170.006774][ T5613] workingset_restore_file 0 [ 170.006774][ T5613] workingset_nodereclaim 0 [ 170.006774][ T5613] pgscan 831 [ 170.006774][ T5613] pgsteal 2 [ 170.006774][ T5613] pgscan_kswapd 0 [ 170.006774][ T5613] pgscan_direct 831 [ 170.006774][ T5613] pgscan_khugepaged 0 [ 170.006774][ T5613] pgsteal_kswapd 0 [ 170.006774][ T5613] pgsteal_direct 2 [ 170.006774][ T5613] pgsteal_khugepaged 0 [pid 5086] mkdir("./24", 0777) = 0 [pid 5086] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555c0c5d0) = 26 ./strace-static-x86_64: Process 5629 attached [pid 5629] chdir("./24") = 0 [pid 5629] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5629] setpgid(0, 0) = 0 [ 170.006774][ T5613] pgfault 21 [ 170.006774][ T5613] pgmajfault 0 [ 170.006774][ T5613] pgrefill 830 [ 170.006774][ T5613] pgactivate 829 [ 170.006774][ T5613] pgdeactivate 830 [ 170.006774][ T5613] pglazyfree 0 [ 170.006774][ T5613] pglazyfreed 0 [ 170.006774][ T5613] zswpin 0 [ 170.006774][ T5613] zswpout 0 [ 170.006774][ T5613] thp_fault_alloc 0 [ 170.006774][ T5613] thp_collapse_alloc 0 [pid 5629] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [pid 5629] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 5629] symlink("/syzcgroup/net/syz3", "./cgroup.net" [pid 5613] <... write resumed>) = 18 [pid 5629] <... symlink resumed>) = 0 [pid 5613] close(3 [pid 5629] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5613] <... close resumed>) = 0 [pid 5629] <... openat resumed>) = 3 [pid 5613] close(4 [pid 5629] write(3, "1000", 4 [pid 5613] <... close resumed>) = 0 [pid 5629] <... write resumed>) = 4 [pid 5613] close(5 [pid 5629] close(3 [pid 5613] <... close resumed>) = 0 [pid 5629] <... close resumed>) = 0 [ 170.215397][ T5613] Tasks state (memory values in pages): [ 170.221022][ T5613] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 170.240394][ T5613] Out of memory and no killable processes... [ 170.248198][ T5614] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 170.273913][ T5614] CPU: 0 PID: 5614 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 170.283899][ T5614] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 170.294008][ T5614] Call Trace: [ 170.297325][ T5614] [ 170.300301][ T5614] dump_stack_lvl+0x136/0x150 [ 170.305067][ T5614] dump_header+0x10a/0xd70 [ 170.309557][ T5614] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 170.315716][ T5614] out_of_memory+0xd64/0x1660 [ 170.320455][ T5614] ? oom_killer_disable+0x2b0/0x2b0 [ 170.325710][ T5614] mem_cgroup_out_of_memory+0x206/0x270 [ 170.331306][ T5614] ? mem_cgroup_margin+0x130/0x130 [ 170.336512][ T5614] memory_max_write+0x2f9/0x3c0 [ 170.341523][ T5614] ? mem_cgroup_force_empty_write+0x160/0x160 [ 170.347654][ T5614] ? lock_sync+0x190/0x190 [ 170.352116][ T5614] cgroup_file_write+0x1e2/0x7b0 [ 170.357105][ T5614] ? mem_cgroup_force_empty_write+0x160/0x160 [ 170.363256][ T5614] ? kill_css+0x3b0/0x3b0 [ 170.367646][ T5614] ? lock_acquire+0x32/0xc0 [ 170.372205][ T5614] ? kill_css+0x3b0/0x3b0 [ 170.376582][ T5614] kernfs_fop_write_iter+0x3f1/0x600 [ 170.381929][ T5614] vfs_write+0x9ed/0xe10 [ 170.386243][ T5614] ? kernel_write+0x670/0x670 [ 170.390986][ T5614] ? find_held_lock+0x2d/0x110 [ 170.395800][ T5614] ? __fget_light+0x20a/0x270 [ 170.400530][ T5614] ksys_write+0x12b/0x250 [ 170.404930][ T5614] ? __ia32_sys_read+0xb0/0xb0 [ 170.409757][ T5614] ? lockdep_hardirqs_on+0x7d/0x100 [ 170.415009][ T5614] ? _raw_spin_unlock_irq+0x2e/0x50 [ 170.420261][ T5614] ? ptrace_notify+0xfe/0x140 [ 170.424993][ T5614] do_syscall_64+0x39/0xb0 [ 170.429466][ T5614] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 170.435399][ T5614] RIP: 0033:0x7faecf034129 [ 170.439849][ T5614] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 170.459510][ T5614] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 5613] close(6 [pid 5629] symlink("/dev/binderfs", "./binderfs" [pid 5613] <... close resumed>) = 0 [pid 5629] <... symlink resumed>) = 0 [pid 5613] close(7 [pid 5629] mkdir("./file0", 000 [pid 5613] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5629] <... mkdir resumed>) = 0 [pid 5613] close(8 [pid 5629] open("./file0", O_RDONLY [pid 5613] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5629] <... open resumed>) = 3 [pid 5613] close(9 [pid 5629] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5613] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5629] <... mount resumed>) = 0 [pid 5613] close(10 [pid 5629] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5613] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5629] <... openat resumed>) = 4 [pid 5613] close(11 [pid 5629] openat(4, "syz1", O_RDWR|O_PATH [pid 5613] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5629] <... openat resumed>) = 5 [pid 5613] close(12 [pid 5629] openat(5, "memory.max", O_RDWR [pid 5613] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5629] <... openat resumed>) = 6 [pid 5613] close(13 [pid 5629] write(6, "0x000000000000040e", 18 [pid 5613] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5613] close(14) = -1 EBADF (Bad file descriptor) [pid 5613] close(15) = -1 EBADF (Bad file descriptor) [pid 5613] close(16) = -1 EBADF (Bad file descriptor) [pid 5613] close(17) = -1 EBADF (Bad file descriptor) [pid 5613] close(18) = -1 EBADF (Bad file descriptor) [pid 5613] close(19) = -1 EBADF (Bad file descriptor) [pid 5613] close(20) = -1 EBADF (Bad file descriptor) [pid 5613] close(21) = -1 EBADF (Bad file descriptor) [ 170.467953][ T5614] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 170.475948][ T5614] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 170.483956][ T5614] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 170.491955][ T5614] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 170.499957][ T5614] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 000000000000001a [ 170.507980][ T5614] [pid 5613] close(22) = -1 EBADF (Bad file descriptor) [pid 5613] close(23) = -1 EBADF (Bad file descriptor) [pid 5613] close(24) = -1 EBADF (Bad file descriptor) [pid 5613] close(25) = -1 EBADF (Bad file descriptor) [pid 5613] close(26) = -1 EBADF (Bad file descriptor) [pid 5613] close(27) = -1 EBADF (Bad file descriptor) [pid 5613] close(28) = -1 EBADF (Bad file descriptor) [pid 5613] close(29) = -1 EBADF (Bad file descriptor) [pid 5613] exit_group(0) = ? [pid 5613] +++ exited with 0 +++ [pid 5090] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=28, si_uid=0, si_status=0, si_utime=0, si_stime=9 /* 0.09 s */} --- [pid 5090] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5090] umount2("./26", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] openat(AT_FDCWD, "./26", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5090] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5090] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5090] umount2("./26/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./26/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5090] unlink("./26/binderfs") = 0 [pid 5090] umount2("./26/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./26/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5090] unlink("./26/cgroup") = 0 [pid 5090] umount2("./26/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./26/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5090] unlink("./26/cgroup.net") = 0 [ 170.587054][ T5614] memory: usage 8kB, limit 0kB, failcnt 36 [ 170.599522][ T5614] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 170.616632][ T5614] Memory cgroup stats for /syz1: [ 170.616991][ T5614] anon 0 [ 170.616991][ T5614] file 0 [ 170.616991][ T5614] kernel 8192 [ 170.616991][ T5614] kernel_stack 0 [ 170.616991][ T5614] pagetables 0 [ 170.616991][ T5614] sec_pagetables 0 [ 170.616991][ T5614] percpu 0 [ 170.616991][ T5614] sock 0 [ 170.616991][ T5614] vmalloc 0 [ 170.616991][ T5614] shmem 0 [ 170.616991][ T5614] zswap 0 [ 170.616991][ T5614] zswapped 0 [ 170.616991][ T5614] file_mapped 0 [ 170.616991][ T5614] file_dirty 0 [ 170.616991][ T5614] file_writeback 0 [ 170.616991][ T5614] swapcached 0 [ 170.616991][ T5614] anon_thp 0 [ 170.616991][ T5614] file_thp 0 [ 170.616991][ T5614] shmem_thp 0 [ 170.616991][ T5614] inactive_anon 0 [ 170.616991][ T5614] active_anon 0 [ 170.616991][ T5614] inactive_file 0 [ 170.616991][ T5614] active_file 0 [ 170.616991][ T5614] unevictable 0 [ 170.616991][ T5614] slab_reclaimable 6752 [ 170.616991][ T5614] slab_unreclaimable 0 [ 170.616991][ T5614] slab 6752 [ 170.616991][ T5614] workingset_refault_anon 0 [ 170.616991][ T5614] workingset_refault_file 0 [ 170.616991][ T5614] workingset_activate_anon 0 [ 170.616991][ T5614] workingset_activate_file 0 [ 170.616991][ T5614] workingset_restore_anon 0 [ 170.616991][ T5614] workingset_restore_file 0 [ 170.616991][ T5614] workingset_nodereclaim 0 [ 170.616991][ T5614] pgscan 831 [ 170.616991][ T5614] pgsteal 2 [ 170.616991][ T5614] pgscan_kswapd 0 [ 170.616991][ T5614] pgscan_direct 831 [ 170.616991][ T5614] pgscan_khugepaged 0 [ 170.616991][ T5614] pgsteal_kswapd 0 [ 170.616991][ T5614] pgsteal_direct 2 [ 170.616991][ T5614] pgsteal_khugepaged 0 [ 170.616991][ T5614] pgfault 21 [ 170.616991][ T5614] pgmajfault 0 [ 170.616991][ T5614] pgrefill 830 [ 170.616991][ T5614] pgactivate 829 [ 170.616991][ T5614] pgdeactivate 830 [ 170.616991][ T5614] pglazyfree 0 [pid 5090] umount2("./26/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5090] umount2("./26/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./26/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5090] umount2("./26/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] openat(AT_FDCWD, "./26/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5090] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5090] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5090] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5090] close(4) = 0 [pid 5090] rmdir("./26/file0") = 0 [pid 5090] umount2("./26/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./26/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [ 170.616991][ T5614] pglazyfreed 0 [ 170.616991][ T5614] zswpin 0 [ 170.616991][ T5614] zswpout 0 [ 170.616991][ T5614] thp_fault_alloc 0 [ 170.616991][ T5614] thp_collapse_alloc 0 [ 170.818753][ T5614] Tasks state (memory values in pages): [ 170.826330][ T5614] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5090] unlink("./26/cgroup.cpu") = 0 [pid 5090] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5090] close(3 [pid 5614] <... write resumed>) = 18 [pid 5090] <... close resumed>) = 0 [pid 5090] rmdir("./26" [pid 5614] close(3 [pid 5090] <... rmdir resumed>) = 0 [pid 5614] <... close resumed>) = 0 [pid 5090] mkdir("./27", 0777 [pid 5614] close(4 [pid 5090] <... mkdir resumed>) = 0 [pid 5614] <... close resumed>) = 0 [pid 5090] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5635 attached [pid 5614] close(5 [pid 5635] chdir("./27" [pid 5614] <... close resumed>) = 0 [pid 5090] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 29 [pid 5635] <... chdir resumed>) = 0 [pid 5614] close(6 [pid 5635] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5614] <... close resumed>) = 0 [ 170.844895][ T5614] Out of memory and no killable processes... [ 170.851004][ T5615] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 170.880224][ T5615] CPU: 0 PID: 5615 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 170.890207][ T5615] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 170.900335][ T5615] Call Trace: [ 170.903657][ T5615] [ 170.906631][ T5615] dump_stack_lvl+0x136/0x150 [ 170.911378][ T5615] dump_header+0x10a/0xd70 [ 170.915848][ T5615] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 170.921976][ T5615] out_of_memory+0xd64/0x1660 [ 170.926704][ T5615] ? oom_killer_disable+0x2b0/0x2b0 [ 170.931946][ T5615] ? find_held_lock+0x2d/0x110 [ 170.936749][ T5615] mem_cgroup_out_of_memory+0x206/0x270 [ 170.942351][ T5615] ? mem_cgroup_margin+0x130/0x130 [ 170.947517][ T5615] ? _raw_spin_unlock_irqrestore+0x54/0x70 [ 170.953469][ T5615] memory_max_write+0x2f9/0x3c0 [ 170.958373][ T5615] ? mem_cgroup_force_empty_write+0x160/0x160 [ 170.964492][ T5615] ? lock_sync+0x190/0x190 [ 170.968956][ T5615] cgroup_file_write+0x1e2/0x7b0 [ 170.973953][ T5615] ? mem_cgroup_force_empty_write+0x160/0x160 [ 170.980068][ T5615] ? kill_css+0x3b0/0x3b0 [ 170.984448][ T5615] ? lock_acquire+0x32/0xc0 [ 170.989002][ T5615] ? kill_css+0x3b0/0x3b0 [ 170.993380][ T5615] kernfs_fop_write_iter+0x3f1/0x600 [ 170.998719][ T5615] vfs_write+0x9ed/0xe10 [ 171.003020][ T5615] ? kernel_write+0x670/0x670 [ 171.007752][ T5615] ? find_held_lock+0x2d/0x110 [ 171.012561][ T5615] ? __fget_light+0x20a/0x270 [ 171.017293][ T5615] ksys_write+0x12b/0x250 [ 171.021679][ T5615] ? __ia32_sys_read+0xb0/0xb0 [ 171.026490][ T5615] ? lockdep_hardirqs_on+0x7d/0x100 [ 171.031745][ T5615] ? _raw_spin_unlock_irq+0x2e/0x50 [ 171.036985][ T5615] ? ptrace_notify+0xfe/0x140 [ 171.041704][ T5615] do_syscall_64+0x39/0xb0 [ 171.046171][ T5615] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 171.052107][ T5615] RIP: 0033:0x7faecf034129 [ 171.056548][ T5615] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 171.076188][ T5615] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 171.084661][ T5615] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [pid 5635] <... prctl resumed>) = 0 [pid 5614] close(7 [pid 5635] setpgid(0, 0 [pid 5614] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5635] <... setpgid resumed>) = 0 [pid 5614] close(8 [pid 5635] symlink("/syzcgroup/unified/syz4", "./cgroup" [pid 5614] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5635] <... symlink resumed>) = 0 [pid 5614] close(9 [pid 5635] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu" [pid 5614] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5635] <... symlink resumed>) = 0 [pid 5614] close(10 [pid 5635] symlink("/syzcgroup/net/syz4", "./cgroup.net" [pid 5614] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5635] <... symlink resumed>) = 0 [pid 5614] close(11 [pid 5635] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5614] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5635] <... openat resumed>) = 3 [pid 5614] close(12 [pid 5635] write(3, "1000", 4 [pid 5614] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5635] <... write resumed>) = 4 [pid 5614] close(13 [pid 5635] close(3 [pid 5614] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5635] <... close resumed>) = 0 [pid 5614] close(14 [pid 5635] symlink("/dev/binderfs", "./binderfs" [pid 5614] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5635] <... symlink resumed>) = 0 [pid 5614] close(15 [pid 5635] mkdir("./file0", 000 [pid 5614] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5635] <... mkdir resumed>) = 0 [pid 5614] close(16 [pid 5635] open("./file0", O_RDONLY [pid 5614] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5635] <... open resumed>) = 3 [ 171.092671][ T5615] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 171.100675][ T5615] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 171.108680][ T5615] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 171.116679][ T5615] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000019 [ 171.124701][ T5615] [pid 5614] close(17 [pid 5635] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5614] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5635] <... mount resumed>) = 0 [pid 5614] close(18 [pid 5635] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5614] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5635] <... openat resumed>) = 4 [pid 5614] close(19 [pid 5635] openat(4, "syz1", O_RDWR|O_PATH [pid 5614] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5635] <... openat resumed>) = 5 [pid 5614] close(20 [pid 5635] openat(5, "memory.max", O_RDWR [pid 5614] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5635] <... openat resumed>) = 6 [pid 5614] close(21 [pid 5635] write(6, "0x000000000000040e", 18 [pid 5614] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5614] close(22) = -1 EBADF (Bad file descriptor) [pid 5614] close(23) = -1 EBADF (Bad file descriptor) [pid 5614] close(24) = -1 EBADF (Bad file descriptor) [pid 5614] close(25) = -1 EBADF (Bad file descriptor) [pid 5614] close(26) = -1 EBADF (Bad file descriptor) [pid 5614] close(27) = -1 EBADF (Bad file descriptor) [pid 5614] close(28) = -1 EBADF (Bad file descriptor) [pid 5614] close(29) = -1 EBADF (Bad file descriptor) [pid 5614] exit_group(0) = ? [pid 5614] +++ exited with 0 +++ [pid 5089] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=28, si_uid=0, si_status=0, si_utime=0, si_stime=10 /* 0.10 s */} --- [pid 5089] umount2("./26", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] openat(AT_FDCWD, "./26", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5089] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5089] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5089] umount2("./26/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./26/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5089] unlink("./26/binderfs") = 0 [pid 5089] umount2("./26/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./26/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [ 171.191978][ T5615] memory: usage 8kB, limit 0kB, failcnt 36 [ 171.220434][ T5615] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 171.253780][ T5615] Memory cgroup stats for /syz1: [ 171.254077][ T5615] anon 0 [ 171.254077][ T5615] file 0 [ 171.254077][ T5615] kernel 8192 [ 171.254077][ T5615] kernel_stack 0 [ 171.254077][ T5615] pagetables 0 [ 171.254077][ T5615] sec_pagetables 0 [ 171.254077][ T5615] percpu 0 [ 171.254077][ T5615] sock 0 [ 171.254077][ T5615] vmalloc 0 [ 171.254077][ T5615] shmem 0 [ 171.254077][ T5615] zswap 0 [ 171.254077][ T5615] zswapped 0 [ 171.254077][ T5615] file_mapped 0 [ 171.254077][ T5615] file_dirty 0 [ 171.254077][ T5615] file_writeback 0 [ 171.254077][ T5615] swapcached 0 [ 171.254077][ T5615] anon_thp 0 [ 171.254077][ T5615] file_thp 0 [ 171.254077][ T5615] shmem_thp 0 [ 171.254077][ T5615] inactive_anon 0 [ 171.254077][ T5615] active_anon 0 [ 171.254077][ T5615] inactive_file 0 [ 171.254077][ T5615] active_file 0 [ 171.254077][ T5615] unevictable 0 [ 171.254077][ T5615] slab_reclaimable 6752 [ 171.254077][ T5615] slab_unreclaimable 0 [ 171.254077][ T5615] slab 6752 [ 171.254077][ T5615] workingset_refault_anon 0 [ 171.254077][ T5615] workingset_refault_file 0 [ 171.254077][ T5615] workingset_activate_anon 0 [ 171.254077][ T5615] workingset_activate_file 0 [ 171.254077][ T5615] workingset_restore_anon 0 [ 171.254077][ T5615] workingset_restore_file 0 [ 171.254077][ T5615] workingset_nodereclaim 0 [ 171.254077][ T5615] pgscan 831 [ 171.254077][ T5615] pgsteal 2 [ 171.254077][ T5615] pgscan_kswapd 0 [ 171.254077][ T5615] pgscan_direct 831 [ 171.254077][ T5615] pgscan_khugepaged 0 [ 171.254077][ T5615] pgsteal_kswapd 0 [ 171.254077][ T5615] pgsteal_direct 2 [ 171.254077][ T5615] pgsteal_khugepaged 0 [pid 5089] unlink("./26/cgroup") = 0 [pid 5089] umount2("./26/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./26/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5089] unlink("./26/cgroup.net") = 0 [pid 5089] umount2("./26/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5089] umount2("./26/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./26/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5089] umount2("./26/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] openat(AT_FDCWD, "./26/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5089] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5089] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5089] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5089] close(4) = 0 [pid 5089] rmdir("./26/file0") = 0 [pid 5089] umount2("./26/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./26/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5089] unlink("./26/cgroup.cpu") = 0 [pid 5089] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5089] close(3) = 0 [pid 5089] rmdir("./26") = 0 [pid 5089] mkdir("./27", 0777) = 0 [pid 5089] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5639 attached [pid 5639] chdir("./27" [pid 5089] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 29 [pid 5639] <... chdir resumed>) = 0 [pid 5639] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5639] setpgid(0, 0) = 0 [pid 5639] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 5639] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [ 171.254077][ T5615] pgfault 21 [ 171.254077][ T5615] pgmajfault 0 [ 171.254077][ T5615] pgrefill 830 [ 171.254077][ T5615] pgactivate 829 [ 171.254077][ T5615] pgdeactivate 830 [ 171.254077][ T5615] pglazyfree 0 [ 171.254077][ T5615] pglazyfreed 0 [ 171.254077][ T5615] zswpin 0 [ 171.254077][ T5615] zswpout 0 [ 171.254077][ T5615] thp_fault_alloc 0 [ 171.254077][ T5615] thp_collapse_alloc 0 [pid 5639] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 5639] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5639] write(3, "1000", 4) = 4 [pid 5639] close(3) = 0 [pid 5639] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5639] mkdir("./file0", 000) = 0 [pid 5639] open("./file0", O_RDONLY) = 3 [pid 5639] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5639] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5639] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5639] openat(5, "memory.max", O_RDWR) = 6 [pid 5639] write(6, "0x000000000000040e", 18 [pid 5615] <... write resumed>) = 18 [pid 5615] close(3) = 0 [pid 5615] close(4) = 0 [pid 5615] close(5) = 0 [pid 5615] close(6) = 0 [pid 5615] close(7) = -1 EBADF (Bad file descriptor) [pid 5615] close(8) = -1 EBADF (Bad file descriptor) [pid 5615] close(9) = -1 EBADF (Bad file descriptor) [pid 5615] close(10) = -1 EBADF (Bad file descriptor) [pid 5615] close(11) = -1 EBADF (Bad file descriptor) [pid 5615] close(12) = -1 EBADF (Bad file descriptor) [pid 5615] close(13) = -1 EBADF (Bad file descriptor) [pid 5615] close(14) = -1 EBADF (Bad file descriptor) [ 171.523300][ T5615] Tasks state (memory values in pages): [ 171.531389][ T5615] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 171.543942][ T5615] Out of memory and no killable processes... [ 171.558589][ T5616] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5615] close(15) = -1 EBADF (Bad file descriptor) [pid 5615] close(16) = -1 EBADF (Bad file descriptor) [pid 5615] close(17) = -1 EBADF (Bad file descriptor) [pid 5615] close(18) = -1 EBADF (Bad file descriptor) [pid 5615] close(19) = -1 EBADF (Bad file descriptor) [pid 5615] close(20) = -1 EBADF (Bad file descriptor) [pid 5615] close(21) = -1 EBADF (Bad file descriptor) [pid 5615] close(22) = -1 EBADF (Bad file descriptor) [pid 5615] close(23) = -1 EBADF (Bad file descriptor) [pid 5615] close(24) = -1 EBADF (Bad file descriptor) [pid 5615] close(25) = -1 EBADF (Bad file descriptor) [pid 5615] close(26) = -1 EBADF (Bad file descriptor) [pid 5615] close(27) = -1 EBADF (Bad file descriptor) [pid 5615] close(28) = -1 EBADF (Bad file descriptor) [pid 5615] close(29) = -1 EBADF (Bad file descriptor) [pid 5615] exit_group(0) = ? [pid 5615] +++ exited with 0 +++ [ 171.592027][ T5616] CPU: 1 PID: 5616 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 171.602020][ T5616] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 171.612131][ T5616] Call Trace: [ 171.615464][ T5616] [ 171.618450][ T5616] dump_stack_lvl+0x136/0x150 [ 171.623204][ T5616] dump_header+0x10a/0xd70 [ 171.627697][ T5616] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 171.633842][ T5616] out_of_memory+0xd64/0x1660 [ 171.638576][ T5616] ? oom_killer_disable+0x2b0/0x2b0 [ 171.643818][ T5616] ? find_held_lock+0x2d/0x110 [ 171.648620][ T5616] mem_cgroup_out_of_memory+0x206/0x270 [ 171.654210][ T5616] ? mem_cgroup_margin+0x130/0x130 [ 171.659377][ T5616] ? _raw_spin_unlock_irqrestore+0x54/0x70 [ 171.665241][ T5616] memory_max_write+0x2f9/0x3c0 [ 171.670141][ T5616] ? mem_cgroup_force_empty_write+0x160/0x160 [ 171.676263][ T5616] ? lock_sync+0x190/0x190 [ 171.680722][ T5616] cgroup_file_write+0x1e2/0x7b0 [ 171.685709][ T5616] ? mem_cgroup_force_empty_write+0x160/0x160 [ 171.691830][ T5616] ? kill_css+0x3b0/0x3b0 [ 171.696209][ T5616] ? lock_acquire+0x32/0xc0 [ 171.700760][ T5616] ? kill_css+0x3b0/0x3b0 [ 171.705135][ T5616] kernfs_fop_write_iter+0x3f1/0x600 [ 171.710471][ T5616] vfs_write+0x9ed/0xe10 [ 171.714768][ T5616] ? kernel_write+0x670/0x670 [ 171.719499][ T5616] ? find_held_lock+0x2d/0x110 [ 171.724307][ T5616] ? __fget_light+0x20a/0x270 [ 171.729037][ T5616] ksys_write+0x12b/0x250 [ 171.733419][ T5616] ? __ia32_sys_read+0xb0/0xb0 [ 171.738264][ T5616] ? lockdep_hardirqs_on+0x7d/0x100 [ 171.743509][ T5616] ? _raw_spin_unlock_irq+0x2e/0x50 [ 171.748756][ T5616] ? ptrace_notify+0xfe/0x140 [ 171.753477][ T5616] do_syscall_64+0x39/0xb0 [ 171.757943][ T5616] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 171.763875][ T5616] RIP: 0033:0x7faecf034129 [ 171.768320][ T5616] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 171.787958][ T5616] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 171.796408][ T5616] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 171.804412][ T5616] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 171.812439][ T5616] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 171.820447][ T5616] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 171.828443][ T5616] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000017 [ 171.836464][ T5616] [pid 5087] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=27, si_uid=0, si_status=0, si_utime=0, si_stime=6 /* 0.06 s */} --- [pid 5087] umount2("./25", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 171.846354][ T5616] memory: usage 8kB, limit 0kB, failcnt 36 [ 171.852665][ T5616] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 171.859747][ T5616] Memory cgroup stats for /syz1: [ 171.860037][ T5616] anon 0 [ 171.860037][ T5616] file 0 [ 171.860037][ T5616] kernel 8192 [ 171.860037][ T5616] kernel_stack 0 [ 171.860037][ T5616] pagetables 0 [ 171.860037][ T5616] sec_pagetables 0 [ 171.860037][ T5616] percpu 0 [ 171.860037][ T5616] sock 0 [ 171.860037][ T5616] vmalloc 0 [ 171.860037][ T5616] shmem 0 [ 171.860037][ T5616] zswap 0 [ 171.860037][ T5616] zswapped 0 [ 171.860037][ T5616] file_mapped 0 [ 171.860037][ T5616] file_dirty 0 [ 171.860037][ T5616] file_writeback 0 [ 171.860037][ T5616] swapcached 0 [ 171.860037][ T5616] anon_thp 0 [ 171.860037][ T5616] file_thp 0 [ 171.860037][ T5616] shmem_thp 0 [ 171.860037][ T5616] inactive_anon 0 [ 171.860037][ T5616] active_anon 0 [ 171.860037][ T5616] inactive_file 0 [ 171.860037][ T5616] active_file 0 [ 171.860037][ T5616] unevictable 0 [ 171.860037][ T5616] slab_reclaimable 6752 [pid 5087] openat(AT_FDCWD, "./25", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5087] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5087] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5087] umount2("./25/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./25/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5087] unlink("./25/binderfs") = 0 [pid 5087] umount2("./25/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./25/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5087] unlink("./25/cgroup") = 0 [pid 5087] umount2("./25/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 171.860037][ T5616] slab_unreclaimable 0 [ 171.860037][ T5616] slab 6752 [ 171.860037][ T5616] workingset_refault_anon 0 [ 171.860037][ T5616] workingset_refault_file 0 [ 171.860037][ T5616] workingset_activate_anon 0 [ 171.860037][ T5616] workingset_activate_file 0 [ 171.860037][ T5616] workingset_restore_anon 0 [ 171.860037][ T5616] workingset_restore_file 0 [ 171.860037][ T5616] workingset_nodereclaim 0 [ 171.860037][ T5616] pgscan 831 [ 171.860037][ T5616] pgsteal 2 [ 171.860037][ T5616] pgscan_kswapd 0 [ 171.860037][ T5616] pgscan_direct 831 [ 171.860037][ T5616] pgscan_khugepaged 0 [ 171.860037][ T5616] pgsteal_kswapd 0 [ 171.860037][ T5616] pgsteal_direct 2 [ 171.860037][ T5616] pgsteal_khugepaged 0 [ 171.860037][ T5616] pgfault 21 [ 171.860037][ T5616] pgmajfault 0 [ 171.860037][ T5616] pgrefill 830 [ 171.860037][ T5616] pgactivate 829 [ 171.860037][ T5616] pgdeactivate 830 [ 171.860037][ T5616] pglazyfree 0 [ 171.860037][ T5616] pglazyfreed 0 [ 171.860037][ T5616] zswpin 0 [ 171.860037][ T5616] zswpout 0 [ 171.860037][ T5616] thp_fault_alloc 0 [ 171.860037][ T5616] thp_collapse_alloc 0 [pid 5087] lstat("./25/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5087] unlink("./25/cgroup.net") = 0 [pid 5087] umount2("./25/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5087] umount2("./25/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./25/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5087] umount2("./25/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] openat(AT_FDCWD, "./25/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5087] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5087] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5087] getdents64(4, [pid 5616] <... write resumed>) = 18 [pid 5087] <... getdents64 resumed>0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5087] close(4) = 0 [pid 5087] rmdir("./25/file0") = 0 [pid 5087] umount2("./25/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./25/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5087] unlink("./25/cgroup.cpu") = 0 [ 172.056700][ T5616] Tasks state (memory values in pages): [ 172.063023][ T5616] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 172.073181][ T5616] Out of memory and no killable processes... [ 172.079447][ T5629] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 172.091019][ T5629] CPU: 1 PID: 5629 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [pid 5087] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5087] close(3) = 0 [pid 5087] rmdir("./25") = 0 [pid 5087] mkdir("./26", 0777) = 0 [pid 5087] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555c0c5d0) = 28 [pid 5616] close(3) = 0 [pid 5616] close(4) = 0 [pid 5616] close(5) = 0 [pid 5616] close(6) = 0 [pid 5616] close(7) = -1 EBADF (Bad file descriptor) [pid 5616] close(8) = -1 EBADF (Bad file descriptor) [pid 5616] close(9) = -1 EBADF (Bad file descriptor) [pid 5616] close(10) = -1 EBADF (Bad file descriptor) [pid 5616] close(11) = -1 EBADF (Bad file descriptor) [pid 5616] close(12) = -1 EBADF (Bad file descriptor) [pid 5616] close(13) = -1 EBADF (Bad file descriptor) [pid 5616] close(14) = -1 EBADF (Bad file descriptor) [pid 5616] close(15) = -1 EBADF (Bad file descriptor) [pid 5616] close(16) = -1 EBADF (Bad file descriptor) [pid 5616] close(17) = -1 EBADF (Bad file descriptor) [pid 5616] close(18) = -1 EBADF (Bad file descriptor) [pid 5616] close(19) = -1 EBADF (Bad file descriptor) [pid 5616] close(20) = -1 EBADF (Bad file descriptor) [ 172.100980][ T5629] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 172.111079][ T5629] Call Trace: [ 172.114407][ T5629] [ 172.117387][ T5629] dump_stack_lvl+0x136/0x150 [ 172.122133][ T5629] dump_header+0x10a/0xd70 [ 172.126639][ T5629] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 172.132799][ T5629] out_of_memory+0xd64/0x1660 [ 172.137581][ T5629] ? oom_killer_disable+0x2b0/0x2b0 [ 172.142892][ T5629] mem_cgroup_out_of_memory+0x206/0x270 [ 172.148504][ T5629] ? mem_cgroup_margin+0x130/0x130 [pid 5616] close(21) = -1 EBADF (Bad file descriptor) [pid 5616] close(22) = -1 EBADF (Bad file descriptor) [pid 5616] close(23) = -1 EBADF (Bad file descriptor) [pid 5616] close(24) = -1 EBADF (Bad file descriptor) [pid 5616] close(25) = -1 EBADF (Bad file descriptor) [pid 5616] close(26) = -1 EBADF (Bad file descriptor) [pid 5616] close(27) = -1 EBADF (Bad file descriptor) [pid 5616] close(28) = -1 EBADF (Bad file descriptor) [pid 5616] close(29) = -1 EBADF (Bad file descriptor) [pid 5616] exit_group(0) = ? [pid 5616] +++ exited with 0 +++ [pid 5085] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=25, si_uid=0, si_status=0, si_utime=0, si_stime=10 /* 0.10 s */} --- [pid 5085] umount2("./23", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] openat(AT_FDCWD, "./23", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5085] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5085] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5085] umount2("./23/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 172.153728][ T5629] memory_max_write+0x2f9/0x3c0 [ 172.158680][ T5629] ? mem_cgroup_force_empty_write+0x160/0x160 [ 172.164843][ T5629] ? lock_sync+0x190/0x190 [ 172.169339][ T5629] cgroup_file_write+0x1e2/0x7b0 [ 172.174366][ T5629] ? mem_cgroup_force_empty_write+0x160/0x160 [ 172.180519][ T5629] ? kill_css+0x3b0/0x3b0 [ 172.184934][ T5629] ? lock_acquire+0x32/0xc0 [ 172.189522][ T5629] ? kill_css+0x3b0/0x3b0 [ 172.193926][ T5629] kernfs_fop_write_iter+0x3f1/0x600 [ 172.199267][ T5629] vfs_write+0x9ed/0xe10 [ 172.203567][ T5629] ? kernel_write+0x670/0x670 [ 172.208301][ T5629] ? find_held_lock+0x2d/0x110 [ 172.213113][ T5629] ? __fget_light+0x20a/0x270 [ 172.217853][ T5629] ksys_write+0x12b/0x250 [ 172.222246][ T5629] ? __ia32_sys_read+0xb0/0xb0 [ 172.227058][ T5629] ? lockdep_hardirqs_on+0x7d/0x100 [ 172.232295][ T5629] ? _raw_spin_unlock_irq+0x2e/0x50 [ 172.237537][ T5629] ? ptrace_notify+0xfe/0x140 [ 172.242259][ T5629] do_syscall_64+0x39/0xb0 [ 172.246726][ T5629] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 172.252663][ T5629] RIP: 0033:0x7faecf034129 [ 172.257105][ T5629] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 172.276746][ T5629] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 172.285200][ T5629] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 172.293203][ T5629] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [pid 5085] lstat("./23/binderfs", ./strace-static-x86_64: Process 5641 attached {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5641] chdir("./26" [pid 5085] unlink("./23/binderfs" [pid 5641] <... chdir resumed>) = 0 [pid 5641] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5641] setpgid(0, 0) = 0 [pid 5641] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 5085] <... unlink resumed>) = 0 [pid 5641] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu" [pid 5085] umount2("./23/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5641] <... symlink resumed>) = 0 [pid 5641] symlink("/syzcgroup/net/syz2", "./cgroup.net" [pid 5085] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5641] <... symlink resumed>) = 0 [pid 5641] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5085] lstat("./23/cgroup", [pid 5641] <... openat resumed>) = 3 [pid 5641] write(3, "1000", 4 [pid 5085] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5641] <... write resumed>) = 4 [pid 5641] close(3 [pid 5085] unlink("./23/cgroup" [pid 5641] <... close resumed>) = 0 [pid 5641] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5085] <... unlink resumed>) = 0 [ 172.301203][ T5629] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 172.309203][ T5629] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 172.317198][ T5629] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000018 [ 172.325219][ T5629] [pid 5641] mkdir("./file0", 000 [pid 5085] umount2("./23/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5641] <... mkdir resumed>) = 0 [pid 5641] open("./file0", O_RDONLY [pid 5085] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5641] <... open resumed>) = 3 [pid 5085] lstat("./23/cgroup.net", [pid 5641] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5085] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5085] unlink("./23/cgroup.net" [pid 5641] <... mount resumed>) = 0 [pid 5085] <... unlink resumed>) = 0 [pid 5641] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5085] umount2("./23/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5641] <... openat resumed>) = 4 [pid 5085] <... umount2 resumed>) = 0 [pid 5085] umount2("./23/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5641] openat(4, "syz1", O_RDWR|O_PATH [pid 5085] lstat("./23/file0", [pid 5641] <... openat resumed>) = 5 [pid 5085] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5085] umount2("./23/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5641] openat(5, "memory.max", O_RDWR [pid 5085] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5641] <... openat resumed>) = 6 [pid 5085] openat(AT_FDCWD, "./23/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5641] write(6, "0x000000000000040e", 18 [pid 5085] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5085] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5085] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5085] close(4) = 0 [pid 5085] rmdir("./23/file0") = 0 [pid 5085] umount2("./23/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./23/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [ 172.357747][ T5629] memory: usage 8kB, limit 0kB, failcnt 36 [ 172.368527][ T5629] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 172.378963][ T5629] Memory cgroup stats for /syz1: [ 172.393226][ T5629] anon 0 [ 172.393226][ T5629] file 0 [ 172.393226][ T5629] kernel 8192 [ 172.393226][ T5629] kernel_stack 0 [ 172.393226][ T5629] pagetables 0 [ 172.393226][ T5629] sec_pagetables 0 [ 172.393226][ T5629] percpu 0 [ 172.393226][ T5629] sock 0 [ 172.393226][ T5629] vmalloc 0 [ 172.393226][ T5629] shmem 0 [ 172.393226][ T5629] zswap 0 [ 172.393226][ T5629] zswapped 0 [ 172.393226][ T5629] file_mapped 0 [ 172.393226][ T5629] file_dirty 0 [ 172.393226][ T5629] file_writeback 0 [ 172.393226][ T5629] swapcached 0 [ 172.393226][ T5629] anon_thp 0 [ 172.393226][ T5629] file_thp 0 [ 172.393226][ T5629] shmem_thp 0 [ 172.393226][ T5629] inactive_anon 0 [ 172.393226][ T5629] active_anon 0 [ 172.393226][ T5629] inactive_file 0 [ 172.393226][ T5629] active_file 0 [ 172.393226][ T5629] unevictable 0 [ 172.393226][ T5629] slab_reclaimable 6752 [ 172.393226][ T5629] slab_unreclaimable 0 [ 172.393226][ T5629] slab 6752 [ 172.393226][ T5629] workingset_refault_anon 0 [ 172.393226][ T5629] workingset_refault_file 0 [ 172.393226][ T5629] workingset_activate_anon 0 [ 172.393226][ T5629] workingset_activate_file 0 [ 172.393226][ T5629] workingset_restore_anon 0 [ 172.393226][ T5629] workingset_restore_file 0 [ 172.393226][ T5629] workingset_nodereclaim 0 [ 172.393226][ T5629] pgscan 831 [ 172.393226][ T5629] pgsteal 2 [ 172.393226][ T5629] pgscan_kswapd 0 [ 172.393226][ T5629] pgscan_direct 831 [ 172.393226][ T5629] pgscan_khugepaged 0 [ 172.393226][ T5629] pgsteal_kswapd 0 [ 172.393226][ T5629] pgsteal_direct 2 [ 172.393226][ T5629] pgsteal_khugepaged 0 [ 172.393226][ T5629] pgfault 21 [ 172.393226][ T5629] pgmajfault 0 [ 172.393226][ T5629] pgrefill 830 [ 172.393226][ T5629] pgactivate 829 [pid 5085] unlink("./23/cgroup.cpu") = 0 [pid 5085] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5085] close(3) = 0 [pid 5085] rmdir("./23") = 0 [pid 5085] mkdir("./24", 0777) = 0 [ 172.393226][ T5629] pgdeactivate 830 [ 172.393226][ T5629] pglazyfree 0 [ 172.393226][ T5629] pglazyfreed 0 [ 172.393226][ T5629] zswpin 0 [ 172.393226][ T5629] zswpout 0 [ 172.393226][ T5629] thp_fault_alloc 0 [ 172.393226][ T5629] thp_collapse_alloc 0 [ 172.587904][ T5629] Tasks state (memory values in pages): [ 172.594253][ T5629] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5085] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5642 attached [pid 5642] chdir("./24" [pid 5085] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 26 [pid 5642] <... chdir resumed>) = 0 [pid 5642] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5642] setpgid(0, 0) = 0 [pid 5642] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 5642] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 5642] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 5629] <... write resumed>) = 18 [pid 5642] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5642] write(3, "1000", 4) = 4 [pid 5642] close(3) = 0 [pid 5642] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5642] mkdir("./file0", 000) = 0 [pid 5642] open("./file0", O_RDONLY) = 3 [pid 5642] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5642] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5642] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5642] openat(5, "memory.max", O_RDWR) = 6 [ 172.604329][ T5629] Out of memory and no killable processes... [ 172.619666][ T5635] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 172.630771][ T5635] CPU: 1 PID: 5635 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 172.640759][ T5635] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 172.650885][ T5635] Call Trace: [ 172.654223][ T5635] [pid 5642] write(6, "0x000000000000040e", 18 [pid 5629] close(3) = 0 [pid 5629] close(4) = 0 [pid 5629] close(5) = 0 [pid 5629] close(6) = 0 [pid 5629] close(7) = -1 EBADF (Bad file descriptor) [pid 5629] close(8) = -1 EBADF (Bad file descriptor) [pid 5629] close(9) = -1 EBADF (Bad file descriptor) [ 172.657207][ T5635] dump_stack_lvl+0x136/0x150 [ 172.661962][ T5635] dump_header+0x10a/0xd70 [ 172.666445][ T5635] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 172.672606][ T5635] out_of_memory+0xd64/0x1660 [ 172.677364][ T5635] ? oom_killer_disable+0x2b0/0x2b0 [ 172.682640][ T5635] ? find_held_lock+0x2d/0x110 [ 172.687475][ T5635] mem_cgroup_out_of_memory+0x206/0x270 [ 172.693100][ T5635] ? mem_cgroup_margin+0x130/0x130 [ 172.698300][ T5635] ? _raw_spin_unlock_irqrestore+0x54/0x70 [ 172.704196][ T5635] memory_max_write+0x2f9/0x3c0 [pid 5629] close(10) = -1 EBADF (Bad file descriptor) [pid 5629] close(11) = -1 EBADF (Bad file descriptor) [pid 5629] close(12) = -1 EBADF (Bad file descriptor) [pid 5629] close(13) = -1 EBADF (Bad file descriptor) [pid 5629] close(14) = -1 EBADF (Bad file descriptor) [pid 5629] close(15) = -1 EBADF (Bad file descriptor) [pid 5629] close(16) = -1 EBADF (Bad file descriptor) [pid 5629] close(17) = -1 EBADF (Bad file descriptor) [pid 5629] close(18) = -1 EBADF (Bad file descriptor) [pid 5629] close(19) = -1 EBADF (Bad file descriptor) [pid 5629] close(20) = -1 EBADF (Bad file descriptor) [pid 5629] close(21) = -1 EBADF (Bad file descriptor) [pid 5629] close(22) = -1 EBADF (Bad file descriptor) [pid 5629] close(23) = -1 EBADF (Bad file descriptor) [pid 5629] close(24) = -1 EBADF (Bad file descriptor) [pid 5629] close(25) = -1 EBADF (Bad file descriptor) [pid 5629] close(26) = -1 EBADF (Bad file descriptor) [pid 5629] close(27) = -1 EBADF (Bad file descriptor) [pid 5629] close(28) = -1 EBADF (Bad file descriptor) [pid 5629] close(29) = -1 EBADF (Bad file descriptor) [pid 5629] exit_group(0) = ? [pid 5629] +++ exited with 0 +++ [pid 5086] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=26, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- [ 172.709130][ T5635] ? mem_cgroup_force_empty_write+0x160/0x160 [ 172.715306][ T5635] ? lock_sync+0x190/0x190 [ 172.719804][ T5635] cgroup_file_write+0x1e2/0x7b0 [ 172.724826][ T5635] ? mem_cgroup_force_empty_write+0x160/0x160 [ 172.730975][ T5635] ? kill_css+0x3b0/0x3b0 [ 172.735383][ T5635] ? lock_acquire+0x32/0xc0 [ 172.739966][ T5635] ? kill_css+0x3b0/0x3b0 [ 172.744381][ T5635] kernfs_fop_write_iter+0x3f1/0x600 [ 172.749758][ T5635] vfs_write+0x9ed/0xe10 [ 172.754101][ T5635] ? kernel_write+0x670/0x670 [pid 5086] umount2("./24", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] openat(AT_FDCWD, "./24", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5086] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5086] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5086] umount2("./24/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./24/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5086] unlink("./24/binderfs") = 0 [pid 5086] umount2("./24/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./24/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5086] unlink("./24/cgroup") = 0 [pid 5086] umount2("./24/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./24/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5086] unlink("./24/cgroup.net") = 0 [ 172.758867][ T5635] ? find_held_lock+0x2d/0x110 [ 172.763714][ T5635] ? __fget_light+0x20a/0x270 [ 172.768494][ T5635] ksys_write+0x12b/0x250 [ 172.772907][ T5635] ? __ia32_sys_read+0xb0/0xb0 [ 172.777753][ T5635] ? lockdep_hardirqs_on+0x7d/0x100 [ 172.783023][ T5635] ? _raw_spin_unlock_irq+0x2e/0x50 [ 172.788299][ T5635] ? ptrace_notify+0xfe/0x140 [ 172.793053][ T5635] do_syscall_64+0x39/0xb0 [ 172.797551][ T5635] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 172.803517][ T5635] RIP: 0033:0x7faecf034129 [ 172.807979][ T5635] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 172.827636][ T5635] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 172.836074][ T5635] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 172.844077][ T5635] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 172.852103][ T5635] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [pid 5086] umount2("./24/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5086] umount2("./24/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./24/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5086] umount2("./24/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] openat(AT_FDCWD, "./24/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5086] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5086] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [ 172.860128][ T5635] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 172.868147][ T5635] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 000000000000001b [ 172.876197][ T5635] [ 172.897874][ T5635] memory: usage 8kB, limit 0kB, failcnt 36 [pid 5086] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5086] close(4) = 0 [pid 5086] rmdir("./24/file0") = 0 [pid 5086] umount2("./24/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./24/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5086] unlink("./24/cgroup.cpu") = 0 [pid 5086] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5086] close(3) = 0 [pid 5086] rmdir("./24") = 0 [pid 5086] mkdir("./25", 0777) = 0 [pid 5086] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5644 attached [pid 5644] chdir("./25" [pid 5086] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 27 [pid 5644] <... chdir resumed>) = 0 [pid 5644] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5644] setpgid(0, 0) = 0 [pid 5644] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [ 172.911675][ T5635] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 172.918605][ T5635] Memory cgroup stats for /syz1: [ 172.918876][ T5635] anon 0 [ 172.918876][ T5635] file 0 [ 172.918876][ T5635] kernel 8192 [ 172.918876][ T5635] kernel_stack 0 [ 172.918876][ T5635] pagetables 0 [ 172.918876][ T5635] sec_pagetables 0 [ 172.918876][ T5635] percpu 0 [ 172.918876][ T5635] sock 0 [ 172.918876][ T5635] vmalloc 0 [ 172.918876][ T5635] shmem 0 [ 172.918876][ T5635] zswap 0 [ 172.918876][ T5635] zswapped 0 [pid 5644] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 5644] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 5644] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5644] write(3, "1000", 4) = 4 [pid 5644] close(3) = 0 [pid 5644] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5644] mkdir("./file0", 000) = 0 [pid 5644] open("./file0", O_RDONLY) = 3 [pid 5644] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5644] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5644] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5644] openat(5, "memory.max", O_RDWR) = 6 [ 172.918876][ T5635] file_mapped 0 [ 172.918876][ T5635] file_dirty 0 [ 172.918876][ T5635] file_writeback 0 [ 172.918876][ T5635] swapcached 0 [ 172.918876][ T5635] anon_thp 0 [ 172.918876][ T5635] file_thp 0 [ 172.918876][ T5635] shmem_thp 0 [ 172.918876][ T5635] inactive_anon 0 [ 172.918876][ T5635] active_anon 0 [ 172.918876][ T5635] inactive_file 0 [ 172.918876][ T5635] active_file 0 [ 172.918876][ T5635] unevictable 0 [ 172.918876][ T5635] slab_reclaimable 6752 [ 172.918876][ T5635] slab_unreclaimable 0 [ 172.918876][ T5635] slab 6752 [ 172.918876][ T5635] workingset_refault_anon 0 [ 172.918876][ T5635] workingset_refault_file 0 [ 172.918876][ T5635] workingset_activate_anon 0 [ 172.918876][ T5635] workingset_activate_file 0 [ 172.918876][ T5635] workingset_restore_anon 0 [ 172.918876][ T5635] workingset_restore_file 0 [ 172.918876][ T5635] workingset_nodereclaim 0 [ 172.918876][ T5635] pgscan 831 [ 172.918876][ T5635] pgsteal 2 [ 172.918876][ T5635] pgscan_kswapd 0 [ 172.918876][ T5635] pgscan_direct 831 [ 172.918876][ T5635] pgscan_khugepaged 0 [ 172.918876][ T5635] pgsteal_kswapd 0 [ 172.918876][ T5635] pgsteal_direct 2 [ 172.918876][ T5635] pgsteal_khugepaged 0 [ 172.918876][ T5635] pgfault 21 [ 172.918876][ T5635] pgmajfault 0 [ 172.918876][ T5635] pgrefill 830 [ 172.918876][ T5635] pgactivate 829 [ 172.918876][ T5635] pgdeactivate 830 [ 172.918876][ T5635] pglazyfree 0 [ 172.918876][ T5635] pglazyfreed 0 [ 172.918876][ T5635] zswpin 0 [ 172.918876][ T5635] zswpout 0 [ 172.918876][ T5635] thp_fault_alloc 0 [ 172.918876][ T5635] thp_collapse_alloc 0 [pid 5644] write(6, "0x000000000000040e", 18 [pid 5635] <... write resumed>) = 18 [pid 5635] close(3) = 0 [pid 5635] close(4) = 0 [pid 5635] close(5) = 0 [pid 5635] close(6) = 0 [pid 5635] close(7) = -1 EBADF (Bad file descriptor) [pid 5635] close(8) = -1 EBADF (Bad file descriptor) [pid 5635] close(9) = -1 EBADF (Bad file descriptor) [pid 5635] close(10) = -1 EBADF (Bad file descriptor) [pid 5635] close(11) = -1 EBADF (Bad file descriptor) [pid 5635] close(12) = -1 EBADF (Bad file descriptor) [pid 5635] close(13) = -1 EBADF (Bad file descriptor) [pid 5635] close(14) = -1 EBADF (Bad file descriptor) [pid 5635] close(15) = -1 EBADF (Bad file descriptor) [ 173.107886][ T5635] Tasks state (memory values in pages): [ 173.121719][ T5635] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 173.131493][ T5635] Out of memory and no killable processes... [ 173.140017][ T5639] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5635] close(16) = -1 EBADF (Bad file descriptor) [pid 5635] close(17) = -1 EBADF (Bad file descriptor) [pid 5635] close(18) = -1 EBADF (Bad file descriptor) [pid 5635] close(19) = -1 EBADF (Bad file descriptor) [pid 5635] close(20) = -1 EBADF (Bad file descriptor) [pid 5635] close(21) = -1 EBADF (Bad file descriptor) [pid 5635] close(22) = -1 EBADF (Bad file descriptor) [pid 5635] close(23) = -1 EBADF (Bad file descriptor) [pid 5635] close(24) = -1 EBADF (Bad file descriptor) [pid 5635] close(25) = -1 EBADF (Bad file descriptor) [pid 5635] close(26) = -1 EBADF (Bad file descriptor) [pid 5635] close(27) = -1 EBADF (Bad file descriptor) [pid 5635] close(28) = -1 EBADF (Bad file descriptor) [pid 5635] close(29) = -1 EBADF (Bad file descriptor) [pid 5635] exit_group(0) = ? [pid 5635] +++ exited with 0 +++ [pid 5090] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=29, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- [pid 5090] umount2("./27", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] openat(AT_FDCWD, "./27", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5090] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5090] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5090] umount2("./27/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./27/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5090] unlink("./27/binderfs") = 0 [pid 5090] umount2("./27/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 173.155165][ T5639] CPU: 0 PID: 5639 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 173.165148][ T5639] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 173.175272][ T5639] Call Trace: [ 173.178601][ T5639] [ 173.181580][ T5639] dump_stack_lvl+0x136/0x150 [ 173.186332][ T5639] dump_header+0x10a/0xd70 [ 173.190822][ T5639] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 173.196983][ T5639] out_of_memory+0xd64/0x1660 [ 173.201750][ T5639] ? oom_killer_disable+0x2b0/0x2b0 [ 173.207013][ T5639] ? find_held_lock+0x2d/0x110 [pid 5090] lstat("./27/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5090] unlink("./27/cgroup") = 0 [pid 5090] umount2("./27/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./27/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5090] unlink("./27/cgroup.net") = 0 [ 173.211839][ T5639] mem_cgroup_out_of_memory+0x206/0x270 [ 173.217462][ T5639] ? mem_cgroup_margin+0x130/0x130 [ 173.222677][ T5639] ? _raw_spin_unlock_irqrestore+0x54/0x70 [ 173.228650][ T5639] memory_max_write+0x2f9/0x3c0 [ 173.233559][ T5639] ? mem_cgroup_force_empty_write+0x160/0x160 [ 173.239709][ T5639] ? lock_sync+0x190/0x190 [ 173.244176][ T5639] cgroup_file_write+0x1e2/0x7b0 [ 173.249214][ T5639] ? mem_cgroup_force_empty_write+0x160/0x160 [ 173.255362][ T5639] ? kill_css+0x3b0/0x3b0 [ 173.259758][ T5639] ? lock_acquire+0x32/0xc0 [ 173.264325][ T5639] ? kill_css+0x3b0/0x3b0 [ 173.268732][ T5639] kernfs_fop_write_iter+0x3f1/0x600 [ 173.274103][ T5639] vfs_write+0x9ed/0xe10 [ 173.278433][ T5639] ? kernel_write+0x670/0x670 [ 173.283208][ T5639] ? find_held_lock+0x2d/0x110 [ 173.288052][ T5639] ? __fget_light+0x20a/0x270 [ 173.292798][ T5639] ksys_write+0x12b/0x250 [ 173.297189][ T5639] ? __ia32_sys_read+0xb0/0xb0 [ 173.302035][ T5639] ? lockdep_hardirqs_on+0x7d/0x100 [ 173.307287][ T5639] ? _raw_spin_unlock_irq+0x2e/0x50 [ 173.312524][ T5639] ? ptrace_notify+0xfe/0x140 [ 173.317253][ T5639] do_syscall_64+0x39/0xb0 [ 173.321751][ T5639] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 173.327714][ T5639] RIP: 0033:0x7faecf034129 [ 173.332197][ T5639] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 173.351874][ T5639] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 5090] umount2("./27/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5090] umount2("./27/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./27/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [ 173.360353][ T5639] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 173.368372][ T5639] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 173.376384][ T5639] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 173.384395][ T5639] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 173.392430][ T5639] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 000000000000001b [ 173.400485][ T5639] [pid 5090] umount2("./27/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] openat(AT_FDCWD, "./27/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5090] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5090] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5090] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5090] close(4) = 0 [pid 5090] rmdir("./27/file0") = 0 [pid 5090] umount2("./27/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./27/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5090] unlink("./27/cgroup.cpu") = 0 [pid 5090] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5090] close(3) = 0 [pid 5090] rmdir("./27") = 0 [pid 5090] mkdir("./28", 0777) = 0 [pid 5090] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5645 attached [pid 5645] chdir("./28" [pid 5090] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 30 [pid 5645] <... chdir resumed>) = 0 [pid 5645] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5645] setpgid(0, 0) = 0 [pid 5645] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [ 173.416813][ T5639] memory: usage 8kB, limit 0kB, failcnt 36 [ 173.444393][ T5639] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 173.455775][ T5639] Memory cgroup stats for /syz1: [ 173.456061][ T5639] anon 0 [pid 5645] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 5645] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [pid 5645] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5645] write(3, "1000", 4) = 4 [pid 5645] close(3) = 0 [pid 5645] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5645] mkdir("./file0", 000) = 0 [pid 5645] open("./file0", O_RDONLY) = 3 [pid 5645] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5645] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5645] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5645] openat(5, "memory.max", O_RDWR) = 6 [ 173.456061][ T5639] file 0 [ 173.456061][ T5639] kernel 8192 [ 173.456061][ T5639] kernel_stack 0 [ 173.456061][ T5639] pagetables 0 [ 173.456061][ T5639] sec_pagetables 0 [ 173.456061][ T5639] percpu 0 [ 173.456061][ T5639] sock 0 [ 173.456061][ T5639] vmalloc 0 [ 173.456061][ T5639] shmem 0 [ 173.456061][ T5639] zswap 0 [ 173.456061][ T5639] zswapped 0 [ 173.456061][ T5639] file_mapped 0 [ 173.456061][ T5639] file_dirty 0 [ 173.456061][ T5639] file_writeback 0 [ 173.456061][ T5639] swapcached 0 [ 173.456061][ T5639] anon_thp 0 [ 173.456061][ T5639] file_thp 0 [ 173.456061][ T5639] shmem_thp 0 [ 173.456061][ T5639] inactive_anon 0 [ 173.456061][ T5639] active_anon 0 [ 173.456061][ T5639] inactive_file 0 [ 173.456061][ T5639] active_file 0 [ 173.456061][ T5639] unevictable 0 [ 173.456061][ T5639] slab_reclaimable 6752 [ 173.456061][ T5639] slab_unreclaimable 0 [ 173.456061][ T5639] slab 6752 [ 173.456061][ T5639] workingset_refault_anon 0 [ 173.456061][ T5639] workingset_refault_file 0 [ 173.456061][ T5639] workingset_activate_anon 0 [ 173.456061][ T5639] workingset_activate_file 0 [ 173.456061][ T5639] workingset_restore_anon 0 [ 173.456061][ T5639] workingset_restore_file 0 [ 173.456061][ T5639] workingset_nodereclaim 0 [ 173.456061][ T5639] pgscan 831 [ 173.456061][ T5639] pgsteal 2 [ 173.456061][ T5639] pgscan_kswapd 0 [ 173.456061][ T5639] pgscan_direct 831 [ 173.456061][ T5639] pgscan_khugepaged 0 [ 173.456061][ T5639] pgsteal_kswapd 0 [ 173.456061][ T5639] pgsteal_direct 2 [ 173.456061][ T5639] pgsteal_khugepaged 0 [ 173.456061][ T5639] pgfault 21 [ 173.456061][ T5639] pgmajfault 0 [ 173.456061][ T5639] pgrefill 830 [ 173.456061][ T5639] pgactivate 829 [ 173.456061][ T5639] pgdeactivate 830 [ 173.456061][ T5639] pglazyfree 0 [ 173.456061][ T5639] pglazyfreed 0 [ 173.456061][ T5639] zswpin 0 [ 173.456061][ T5639] zswpout 0 [ 173.456061][ T5639] thp_fault_alloc 0 [ 173.456061][ T5639] thp_collapse_alloc 0 [ 173.649273][ T5639] Tasks state (memory values in pages): [ 173.656189][ T5639] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5645] write(6, "0x000000000000040e", 18 [pid 5639] <... write resumed>) = 18 [pid 5639] close(3) = 0 [pid 5639] close(4) = 0 [pid 5639] close(5) = 0 [pid 5639] close(6) = 0 [pid 5639] close(7) = -1 EBADF (Bad file descriptor) [ 173.666080][ T5639] Out of memory and no killable processes... [ 173.672448][ T5641] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 173.683009][ T5641] CPU: 0 PID: 5641 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 173.692970][ T5641] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 173.703080][ T5641] Call Trace: [ 173.706401][ T5641] [ 173.709374][ T5641] dump_stack_lvl+0x136/0x150 [ 173.714124][ T5641] dump_header+0x10a/0xd70 [pid 5639] close(8) = -1 EBADF (Bad file descriptor) [pid 5639] close(9) = -1 EBADF (Bad file descriptor) [pid 5639] close(10) = -1 EBADF (Bad file descriptor) [pid 5639] close(11) = -1 EBADF (Bad file descriptor) [pid 5639] close(12) = -1 EBADF (Bad file descriptor) [pid 5639] close(13) = -1 EBADF (Bad file descriptor) [pid 5639] close(14) = -1 EBADF (Bad file descriptor) [pid 5639] close(15) = -1 EBADF (Bad file descriptor) [pid 5639] close(16) = -1 EBADF (Bad file descriptor) [pid 5639] close(17) = -1 EBADF (Bad file descriptor) [pid 5639] close(18) = -1 EBADF (Bad file descriptor) [pid 5639] close(19) = -1 EBADF (Bad file descriptor) [pid 5639] close(20) = -1 EBADF (Bad file descriptor) [pid 5639] close(21) = -1 EBADF (Bad file descriptor) [pid 5639] close(22) = -1 EBADF (Bad file descriptor) [pid 5639] close(23) = -1 EBADF (Bad file descriptor) [pid 5639] close(24) = -1 EBADF (Bad file descriptor) [ 173.718620][ T5641] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 173.724780][ T5641] out_of_memory+0xd64/0x1660 [ 173.729539][ T5641] ? oom_killer_disable+0x2b0/0x2b0 [ 173.734813][ T5641] ? find_held_lock+0x2d/0x110 [ 173.739646][ T5641] mem_cgroup_out_of_memory+0x206/0x270 [ 173.745272][ T5641] ? mem_cgroup_margin+0x130/0x130 [ 173.750481][ T5641] ? _raw_spin_unlock_irqrestore+0x54/0x70 [ 173.756380][ T5641] memory_max_write+0x2f9/0x3c0 [ 173.761316][ T5641] ? mem_cgroup_force_empty_write+0x160/0x160 [ 173.767477][ T5641] ? lock_sync+0x190/0x190 [ 173.771970][ T5641] cgroup_file_write+0x1e2/0x7b0 [ 173.776985][ T5641] ? mem_cgroup_force_empty_write+0x160/0x160 [ 173.783133][ T5641] ? kill_css+0x3b0/0x3b0 [ 173.787550][ T5641] ? lock_acquire+0x32/0xc0 [ 173.792141][ T5641] ? kill_css+0x3b0/0x3b0 [ 173.796556][ T5641] kernfs_fop_write_iter+0x3f1/0x600 [ 173.801928][ T5641] vfs_write+0x9ed/0xe10 [ 173.806248][ T5641] ? kernel_write+0x670/0x670 [ 173.811005][ T5641] ? find_held_lock+0x2d/0x110 [ 173.815940][ T5641] ? __fget_light+0x20a/0x270 [ 173.820682][ T5641] ksys_write+0x12b/0x250 [ 173.825068][ T5641] ? __ia32_sys_read+0xb0/0xb0 [ 173.829929][ T5641] ? lockdep_hardirqs_on+0x7d/0x100 [ 173.835196][ T5641] ? _raw_spin_unlock_irq+0x2e/0x50 [ 173.840463][ T5641] ? ptrace_notify+0xfe/0x140 [ 173.845238][ T5641] do_syscall_64+0x39/0xb0 [ 173.849723][ T5641] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 173.855661][ T5641] RIP: 0033:0x7faecf034129 [ 173.860165][ T5641] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 173.879837][ T5641] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 173.888321][ T5641] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 173.896350][ T5641] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 173.904383][ T5641] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [pid 5639] close(25) = -1 EBADF (Bad file descriptor) [pid 5639] close(26) = -1 EBADF (Bad file descriptor) [pid 5639] close(27) = -1 EBADF (Bad file descriptor) [pid 5639] close(28) = -1 EBADF (Bad file descriptor) [pid 5639] close(29) = -1 EBADF (Bad file descriptor) [pid 5639] exit_group(0) = ? [pid 5639] +++ exited with 0 +++ [pid 5089] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=29, si_uid=0, si_status=0, si_utime=0, si_stime=10 /* 0.10 s */} --- [pid 5089] umount2("./27", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] openat(AT_FDCWD, "./27", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5089] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5089] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5089] umount2("./27/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./27/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5089] unlink("./27/binderfs") = 0 [pid 5089] umount2("./27/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./27/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5089] unlink("./27/cgroup") = 0 [pid 5089] umount2("./27/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./27/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5089] unlink("./27/cgroup.net") = 0 [pid 5089] umount2("./27/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5089] umount2("./27/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./27/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5089] umount2("./27/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] openat(AT_FDCWD, "./27/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5089] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5089] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5089] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5089] close(4) = 0 [pid 5089] rmdir("./27/file0") = 0 [pid 5089] umount2("./27/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./27/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5089] unlink("./27/cgroup.cpu") = 0 [pid 5089] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [ 173.912411][ T5641] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 173.920438][ T5641] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 000000000000001a [ 173.928495][ T5641] [ 173.953748][ T5641] memory: usage 8kB, limit 0kB, failcnt 36 [pid 5089] close(3) = 0 [pid 5089] rmdir("./27") = 0 [pid 5089] mkdir("./28", 0777) = 0 [pid 5089] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555c0c5d0) = 30 [ 173.971428][ T5641] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 173.979331][ T5641] Memory cgroup stats for /syz1: [ 173.979647][ T5641] anon 0 [ 173.979647][ T5641] file 0 [ 173.979647][ T5641] kernel 8192 [ 173.979647][ T5641] kernel_stack 0 [ 173.979647][ T5641] pagetables 0 [ 173.979647][ T5641] sec_pagetables 0 [ 173.979647][ T5641] percpu 0 [ 173.979647][ T5641] sock 0 [ 173.979647][ T5641] vmalloc 0 [ 173.979647][ T5641] shmem 0 [ 173.979647][ T5641] zswap 0 [ 173.979647][ T5641] zswapped 0 ./strace-static-x86_64: Process 5647 attached [pid 5647] chdir("./28") = 0 [pid 5647] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5647] setpgid(0, 0) = 0 [pid 5647] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [ 173.979647][ T5641] file_mapped 0 [ 173.979647][ T5641] file_dirty 0 [ 173.979647][ T5641] file_writeback 0 [ 173.979647][ T5641] swapcached 0 [ 173.979647][ T5641] anon_thp 0 [ 173.979647][ T5641] file_thp 0 [ 173.979647][ T5641] shmem_thp 0 [ 173.979647][ T5641] inactive_anon 0 [ 173.979647][ T5641] active_anon 0 [ 173.979647][ T5641] inactive_file 0 [ 173.979647][ T5641] active_file 0 [ 173.979647][ T5641] unevictable 0 [ 173.979647][ T5641] slab_reclaimable 6752 [ 173.979647][ T5641] slab_unreclaimable 0 [ 173.979647][ T5641] slab 6752 [ 173.979647][ T5641] workingset_refault_anon 0 [ 173.979647][ T5641] workingset_refault_file 0 [ 173.979647][ T5641] workingset_activate_anon 0 [ 173.979647][ T5641] workingset_activate_file 0 [ 173.979647][ T5641] workingset_restore_anon 0 [ 173.979647][ T5641] workingset_restore_file 0 [ 173.979647][ T5641] workingset_nodereclaim 0 [ 173.979647][ T5641] pgscan 831 [ 173.979647][ T5641] pgsteal 2 [ 173.979647][ T5641] pgscan_kswapd 0 [ 173.979647][ T5641] pgscan_direct 831 [ 173.979647][ T5641] pgscan_khugepaged 0 [ 173.979647][ T5641] pgsteal_kswapd 0 [pid 5647] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [pid 5647] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 5647] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5647] write(3, "1000", 4) = 4 [pid 5647] close(3) = 0 [pid 5647] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5647] mkdir("./file0", 000) = 0 [pid 5647] open("./file0", O_RDONLY) = 3 [ 173.979647][ T5641] pgsteal_direct 2 [ 173.979647][ T5641] pgsteal_khugepaged 0 [ 173.979647][ T5641] pgfault 21 [ 173.979647][ T5641] pgmajfault 0 [ 173.979647][ T5641] pgrefill 830 [ 173.979647][ T5641] pgactivate 829 [ 173.979647][ T5641] pgdeactivate 830 [ 173.979647][ T5641] pglazyfree 0 [ 173.979647][ T5641] pglazyfreed 0 [ 173.979647][ T5641] zswpin 0 [ 173.979647][ T5641] zswpout 0 [ 173.979647][ T5641] thp_fault_alloc 0 [ 173.979647][ T5641] thp_collapse_alloc 0 [pid 5647] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5647] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5647] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5647] openat(5, "memory.max", O_RDWR) = 6 [pid 5647] write(6, "0x000000000000040e", 18 [pid 5641] <... write resumed>) = 18 [ 174.269468][ T5641] Tasks state (memory values in pages): [ 174.280430][ T5641] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 174.307449][ T5641] Out of memory and no killable processes... [ 174.318394][ T5642] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 174.329939][ T5642] CPU: 0 PID: 5642 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 174.339915][ T5642] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 174.350023][ T5642] Call Trace: [ 174.353372][ T5642] [ 174.356344][ T5642] dump_stack_lvl+0x136/0x150 [ 174.361095][ T5642] dump_header+0x10a/0xd70 [ 174.365577][ T5642] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 174.371736][ T5642] out_of_memory+0xd64/0x1660 [ 174.376480][ T5642] ? oom_killer_disable+0x2b0/0x2b0 [ 174.381760][ T5642] mem_cgroup_out_of_memory+0x206/0x270 [ 174.387362][ T5642] ? mem_cgroup_margin+0x130/0x130 [ 174.392537][ T5642] memory_max_write+0x2f9/0x3c0 [ 174.397438][ T5642] ? mem_cgroup_force_empty_write+0x160/0x160 [ 174.403555][ T5642] ? lock_sync+0x190/0x190 [ 174.408011][ T5642] cgroup_file_write+0x1e2/0x7b0 [ 174.412995][ T5642] ? mem_cgroup_force_empty_write+0x160/0x160 [ 174.419107][ T5642] ? kill_css+0x3b0/0x3b0 [ 174.423484][ T5642] ? lock_acquire+0x32/0xc0 [ 174.428036][ T5642] ? kill_css+0x3b0/0x3b0 [ 174.432406][ T5642] kernfs_fop_write_iter+0x3f1/0x600 [ 174.437741][ T5642] vfs_write+0x9ed/0xe10 [ 174.442034][ T5642] ? kernel_write+0x670/0x670 [ 174.446760][ T5642] ? find_held_lock+0x2d/0x110 [ 174.451572][ T5642] ? __fget_light+0x20a/0x270 [ 174.456313][ T5642] ksys_write+0x12b/0x250 [ 174.460689][ T5642] ? __ia32_sys_read+0xb0/0xb0 [ 174.465494][ T5642] ? lockdep_hardirqs_on+0x7d/0x100 [ 174.470729][ T5642] ? _raw_spin_unlock_irq+0x2e/0x50 [ 174.475972][ T5642] ? ptrace_notify+0xfe/0x140 [ 174.480692][ T5642] do_syscall_64+0x39/0xb0 [ 174.485158][ T5642] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 174.491089][ T5642] RIP: 0033:0x7faecf034129 [ 174.495538][ T5642] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 5641] close(3) = 0 [ 174.515179][ T5642] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 174.523625][ T5642] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 174.531635][ T5642] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 174.539636][ T5642] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 174.547639][ T5642] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 174.555638][ T5642] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000018 [ 174.563668][ T5642] [pid 5641] close(4) = 0 [pid 5641] close(5) = 0 [pid 5641] close(6) = 0 [pid 5641] close(7) = -1 EBADF (Bad file descriptor) [pid 5641] close(8) = -1 EBADF (Bad file descriptor) [pid 5641] close(9) = -1 EBADF (Bad file descriptor) [pid 5641] close(10) = -1 EBADF (Bad file descriptor) [pid 5641] close(11) = -1 EBADF (Bad file descriptor) [pid 5641] close(12) = -1 EBADF (Bad file descriptor) [pid 5641] close(13) = -1 EBADF (Bad file descriptor) [pid 5641] close(14) = -1 EBADF (Bad file descriptor) [pid 5641] close(15) = -1 EBADF (Bad file descriptor) [pid 5641] close(16) = -1 EBADF (Bad file descriptor) [pid 5641] close(17) = -1 EBADF (Bad file descriptor) [pid 5641] close(18) = -1 EBADF (Bad file descriptor) [pid 5641] close(19) = -1 EBADF (Bad file descriptor) [pid 5641] close(20) = -1 EBADF (Bad file descriptor) [pid 5641] close(21) = -1 EBADF (Bad file descriptor) [pid 5641] close(22) = -1 EBADF (Bad file descriptor) [pid 5641] close(23) = -1 EBADF (Bad file descriptor) [pid 5641] close(24) = -1 EBADF (Bad file descriptor) [pid 5641] close(25) = -1 EBADF (Bad file descriptor) [pid 5641] close(26) = -1 EBADF (Bad file descriptor) [pid 5641] close(27) = -1 EBADF (Bad file descriptor) [pid 5641] close(28) = -1 EBADF (Bad file descriptor) [pid 5641] close(29) = -1 EBADF (Bad file descriptor) [pid 5641] exit_group(0) = ? [ 174.572271][ T5642] memory: usage 8kB, limit 0kB, failcnt 36 [ 174.578164][ T5642] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 174.634690][ T5642] Memory cgroup stats for /syz1: [ 174.634978][ T5642] anon 0 [ 174.634978][ T5642] file 0 [ 174.634978][ T5642] kernel 8192 [ 174.634978][ T5642] kernel_stack 0 [ 174.634978][ T5642] pagetables 0 [ 174.634978][ T5642] sec_pagetables 0 [ 174.634978][ T5642] percpu 0 [ 174.634978][ T5642] sock 0 [ 174.634978][ T5642] vmalloc 0 [ 174.634978][ T5642] shmem 0 [ 174.634978][ T5642] zswap 0 [ 174.634978][ T5642] zswapped 0 [ 174.634978][ T5642] file_mapped 0 [ 174.634978][ T5642] file_dirty 0 [pid 5641] +++ exited with 0 +++ [pid 5087] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=28, si_uid=0, si_status=0, si_utime=0, si_stime=11 /* 0.11 s */} --- [pid 5087] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5087] umount2("./26", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] openat(AT_FDCWD, "./26", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5087] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5087] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [ 174.634978][ T5642] file_writeback 0 [ 174.634978][ T5642] swapcached 0 [ 174.634978][ T5642] anon_thp 0 [ 174.634978][ T5642] file_thp 0 [ 174.634978][ T5642] shmem_thp 0 [ 174.634978][ T5642] inactive_anon 0 [ 174.634978][ T5642] active_anon 0 [ 174.634978][ T5642] inactive_file 0 [ 174.634978][ T5642] active_file 0 [ 174.634978][ T5642] unevictable 0 [ 174.634978][ T5642] slab_reclaimable 6752 [ 174.634978][ T5642] slab_unreclaimable 0 [ 174.634978][ T5642] slab 6752 [ 174.634978][ T5642] workingset_refault_anon 0 [ 174.634978][ T5642] workingset_refault_file 0 [pid 5087] umount2("./26/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./26/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5087] unlink("./26/binderfs") = 0 [pid 5087] umount2("./26/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./26/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5087] unlink("./26/cgroup") = 0 [pid 5087] umount2("./26/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./26/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5087] unlink("./26/cgroup.net") = 0 [ 174.634978][ T5642] workingset_activate_anon 0 [ 174.634978][ T5642] workingset_activate_file 0 [ 174.634978][ T5642] workingset_restore_anon 0 [ 174.634978][ T5642] workingset_restore_file 0 [ 174.634978][ T5642] workingset_nodereclaim 0 [ 174.634978][ T5642] pgscan 831 [ 174.634978][ T5642] pgsteal 2 [ 174.634978][ T5642] pgscan_kswapd 0 [ 174.634978][ T5642] pgscan_direct 831 [ 174.634978][ T5642] pgscan_khugepaged 0 [ 174.634978][ T5642] pgsteal_kswapd 0 [ 174.634978][ T5642] pgsteal_direct 2 [ 174.634978][ T5642] pgsteal_khugepaged 0 [pid 5087] umount2("./26/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5087] umount2("./26/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./26/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5087] umount2("./26/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] openat(AT_FDCWD, "./26/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5087] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5087] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5087] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5087] close(4) = 0 [pid 5087] rmdir("./26/file0") = 0 [pid 5087] umount2("./26/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5087] lstat("./26/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [ 174.634978][ T5642] pgfault 21 [ 174.634978][ T5642] pgmajfault 0 [ 174.634978][ T5642] pgrefill 830 [ 174.634978][ T5642] pgactivate 829 [ 174.634978][ T5642] pgdeactivate 830 [ 174.634978][ T5642] pglazyfree 0 [ 174.634978][ T5642] pglazyfreed 0 [ 174.634978][ T5642] zswpin 0 [ 174.634978][ T5642] zswpout 0 [ 174.634978][ T5642] thp_fault_alloc 0 [ 174.634978][ T5642] thp_collapse_alloc 0 [pid 5087] unlink("./26/cgroup.cpu") = 0 [pid 5087] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5087] close(3) = 0 [pid 5087] rmdir("./26") = 0 [pid 5087] mkdir("./27", 0777) = 0 [pid 5087] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555c0c5d0) = 29 ./strace-static-x86_64: Process 5656 attached [pid 5656] chdir("./27") = 0 [ 174.846926][ T5642] Tasks state (memory values in pages): [ 174.864178][ T5642] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 174.875879][ T5642] Out of memory and no killable processes... [ 174.883220][ T5644] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5642] <... write resumed>) = 18 [pid 5656] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5642] close(3 [pid 5656] setpgid(0, 0) = 0 [pid 5642] <... close resumed>) = 0 [pid 5656] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 5642] close(4 [pid 5656] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 5642] <... close resumed>) = 0 [pid 5656] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 5642] close(5 [pid 5656] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5642] <... close resumed>) = 0 [pid 5656] write(3, "1000", 4) = 4 [pid 5642] close(6 [pid 5656] close(3 [pid 5642] <... close resumed>) = 0 [pid 5656] <... close resumed>) = 0 [pid 5642] close(7 [pid 5656] symlink("/dev/binderfs", "./binderfs" [pid 5642] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5656] <... symlink resumed>) = 0 [pid 5642] close(8 [pid 5656] mkdir("./file0", 000 [pid 5642] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5656] <... mkdir resumed>) = 0 [pid 5642] close(9 [pid 5656] open("./file0", O_RDONLY [pid 5642] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5656] <... open resumed>) = 3 [pid 5642] close(10 [pid 5656] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5642] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5656] <... mount resumed>) = 0 [pid 5642] close(11 [pid 5656] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5642] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5656] <... openat resumed>) = 4 [pid 5642] close(12 [pid 5656] openat(4, "syz1", O_RDWR|O_PATH [pid 5642] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5656] <... openat resumed>) = 5 [pid 5642] close(13 [pid 5656] openat(5, "memory.max", O_RDWR [pid 5642] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5656] <... openat resumed>) = 6 [pid 5642] close(14 [pid 5656] write(6, "0x000000000000040e", 18 [pid 5642] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5642] close(15) = -1 EBADF (Bad file descriptor) [pid 5642] close(16) = -1 EBADF (Bad file descriptor) [ 174.899739][ T5644] CPU: 1 PID: 5644 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 174.909736][ T5644] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 174.919856][ T5644] Call Trace: [ 174.923189][ T5644] [ 174.926196][ T5644] dump_stack_lvl+0x136/0x150 [ 174.930959][ T5644] dump_header+0x10a/0xd70 [ 174.935447][ T5644] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 174.941606][ T5644] out_of_memory+0xd64/0x1660 [pid 5642] close(17) = -1 EBADF (Bad file descriptor) [pid 5642] close(18) = -1 EBADF (Bad file descriptor) [pid 5642] close(19) = -1 EBADF (Bad file descriptor) [pid 5642] close(20) = -1 EBADF (Bad file descriptor) [pid 5642] close(21) = -1 EBADF (Bad file descriptor) [pid 5642] close(22) = -1 EBADF (Bad file descriptor) [pid 5642] close(23) = -1 EBADF (Bad file descriptor) [pid 5642] close(24) = -1 EBADF (Bad file descriptor) [pid 5642] close(25) = -1 EBADF (Bad file descriptor) [pid 5642] close(26) = -1 EBADF (Bad file descriptor) [pid 5642] close(27) = -1 EBADF (Bad file descriptor) [pid 5642] close(28) = -1 EBADF (Bad file descriptor) [pid 5642] close(29) = -1 EBADF (Bad file descriptor) [pid 5642] exit_group(0) = ? [pid 5642] +++ exited with 0 +++ [ 174.946366][ T5644] ? oom_killer_disable+0x2b0/0x2b0 [ 174.951652][ T5644] mem_cgroup_out_of_memory+0x206/0x270 [ 174.957278][ T5644] ? mem_cgroup_margin+0x130/0x130 [ 174.962512][ T5644] memory_max_write+0x2f9/0x3c0 [ 174.967451][ T5644] ? mem_cgroup_force_empty_write+0x160/0x160 [ 174.973620][ T5644] ? lock_sync+0x190/0x190 [ 174.978125][ T5644] cgroup_file_write+0x1e2/0x7b0 [ 174.983171][ T5644] ? mem_cgroup_force_empty_write+0x160/0x160 [ 174.989335][ T5644] ? kill_css+0x3b0/0x3b0 [ 174.993749][ T5644] ? lock_acquire+0x32/0xc0 [ 174.998332][ T5644] ? kill_css+0x3b0/0x3b0 [ 175.002742][ T5644] kernfs_fop_write_iter+0x3f1/0x600 [ 175.008115][ T5644] vfs_write+0x9ed/0xe10 [ 175.012460][ T5644] ? kernel_write+0x670/0x670 [ 175.017235][ T5644] ? find_held_lock+0x2d/0x110 [ 175.022092][ T5644] ? __fget_light+0x20a/0x270 [ 175.026922][ T5644] ksys_write+0x12b/0x250 [ 175.031339][ T5644] ? __ia32_sys_read+0xb0/0xb0 [ 175.036181][ T5644] ? lockdep_hardirqs_on+0x7d/0x100 [ 175.041459][ T5644] ? _raw_spin_unlock_irq+0x2e/0x50 [ 175.046734][ T5644] ? ptrace_notify+0xfe/0x140 [ 175.051486][ T5644] do_syscall_64+0x39/0xb0 [ 175.055983][ T5644] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 175.061959][ T5644] RIP: 0033:0x7faecf034129 [ 175.066434][ T5644] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 175.086106][ T5644] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 5085] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=26, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- [pid 5085] umount2("./24", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] openat(AT_FDCWD, "./24", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5085] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5085] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5085] umount2("./24/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 175.094585][ T5644] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 175.102656][ T5644] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 175.110701][ T5644] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 175.118728][ T5644] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 175.126758][ T5644] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 0000000000000019 [ 175.134819][ T5644] [pid 5085] lstat("./24/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [ 175.164552][ T5644] memory: usage 8kB, limit 0kB, failcnt 36 [ 175.170515][ T5644] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 175.186669][ T5644] Memory cgroup stats for /syz1: [ 175.186960][ T5644] anon 0 [ 175.186960][ T5644] file 0 [ 175.186960][ T5644] kernel 8192 [ 175.186960][ T5644] kernel_stack 0 [ 175.186960][ T5644] pagetables 0 [ 175.186960][ T5644] sec_pagetables 0 [ 175.186960][ T5644] percpu 0 [ 175.186960][ T5644] sock 0 [ 175.186960][ T5644] vmalloc 0 [ 175.186960][ T5644] shmem 0 [ 175.186960][ T5644] zswap 0 [ 175.186960][ T5644] zswapped 0 [ 175.186960][ T5644] file_mapped 0 [ 175.186960][ T5644] file_dirty 0 [ 175.186960][ T5644] file_writeback 0 [ 175.186960][ T5644] swapcached 0 [ 175.186960][ T5644] anon_thp 0 [ 175.186960][ T5644] file_thp 0 [ 175.186960][ T5644] shmem_thp 0 [ 175.186960][ T5644] inactive_anon 0 [ 175.186960][ T5644] active_anon 0 [ 175.186960][ T5644] inactive_file 0 [ 175.186960][ T5644] active_file 0 [ 175.186960][ T5644] unevictable 0 [ 175.186960][ T5644] slab_reclaimable 6752 [ 175.186960][ T5644] slab_unreclaimable 0 [ 175.186960][ T5644] slab 6752 [ 175.186960][ T5644] workingset_refault_anon 0 [ 175.186960][ T5644] workingset_refault_file 0 [ 175.186960][ T5644] workingset_activate_anon 0 [ 175.186960][ T5644] workingset_activate_file 0 [ 175.186960][ T5644] workingset_restore_anon 0 [ 175.186960][ T5644] workingset_restore_file 0 [ 175.186960][ T5644] workingset_nodereclaim 0 [ 175.186960][ T5644] pgscan 831 [ 175.186960][ T5644] pgsteal 2 [ 175.186960][ T5644] pgscan_kswapd 0 [ 175.186960][ T5644] pgscan_direct 831 [ 175.186960][ T5644] pgscan_khugepaged 0 [ 175.186960][ T5644] pgsteal_kswapd 0 [ 175.186960][ T5644] pgsteal_direct 2 [ 175.186960][ T5644] pgsteal_khugepaged 0 [ 175.186960][ T5644] pgfault 21 [ 175.186960][ T5644] pgmajfault 0 [ 175.186960][ T5644] pgrefill 830 [ 175.186960][ T5644] pgactivate 829 [ 175.186960][ T5644] pgdeactivate 830 [ 175.186960][ T5644] pglazyfree 0 [ 175.186960][ T5644] pglazyfreed 0 [ 175.186960][ T5644] zswpin 0 [ 175.186960][ T5644] zswpout 0 [pid 5085] unlink("./24/binderfs") = 0 [pid 5085] umount2("./24/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./24/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5085] unlink("./24/cgroup") = 0 [pid 5085] umount2("./24/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./24/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5085] unlink("./24/cgroup.net") = 0 [pid 5085] umount2("./24/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5085] umount2("./24/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./24/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5085] umount2("./24/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] openat(AT_FDCWD, "./24/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5085] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [ 175.186960][ T5644] thp_fault_alloc 0 [ 175.186960][ T5644] thp_collapse_alloc 0 [pid 5085] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5085] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5085] close(4) = 0 [pid 5085] rmdir("./24/file0") = 0 [pid 5085] umount2("./24/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5085] lstat("./24/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5085] unlink("./24/cgroup.cpu" [pid 5644] <... write resumed>) = 18 [ 175.426839][ T5644] Tasks state (memory values in pages): [ 175.436709][ T5644] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 175.455643][ T5644] Out of memory and no killable processes... [ 175.466579][ T5645] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5644] close(3 [pid 5085] <... unlink resumed>) = 0 [ 175.491496][ T5645] CPU: 1 PID: 5645 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 175.501483][ T5645] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 175.511609][ T5645] Call Trace: [ 175.514934][ T5645] [ 175.517930][ T5645] dump_stack_lvl+0x136/0x150 [ 175.522680][ T5645] dump_header+0x10a/0xd70 [ 175.527165][ T5645] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 175.533333][ T5645] out_of_memory+0xd64/0x1660 [ 175.538090][ T5645] ? oom_killer_disable+0x2b0/0x2b0 [ 175.543382][ T5645] mem_cgroup_out_of_memory+0x206/0x270 [ 175.549006][ T5645] ? mem_cgroup_margin+0x130/0x130 [ 175.554231][ T5645] memory_max_write+0x2f9/0x3c0 [ 175.559173][ T5645] ? mem_cgroup_force_empty_write+0x160/0x160 [ 175.565324][ T5645] ? lock_sync+0x190/0x190 [ 175.569817][ T5645] cgroup_file_write+0x1e2/0x7b0 [ 175.574836][ T5645] ? mem_cgroup_force_empty_write+0x160/0x160 [ 175.580985][ T5645] ? kill_css+0x3b0/0x3b0 [ 175.585397][ T5645] ? lock_acquire+0x32/0xc0 [ 175.589985][ T5645] ? kill_css+0x3b0/0x3b0 [ 175.594387][ T5645] kernfs_fop_write_iter+0x3f1/0x600 [ 175.599727][ T5645] vfs_write+0x9ed/0xe10 [ 175.604022][ T5645] ? kernel_write+0x670/0x670 [ 175.608753][ T5645] ? find_held_lock+0x2d/0x110 [ 175.613562][ T5645] ? __fget_light+0x20a/0x270 [ 175.618308][ T5645] ksys_write+0x12b/0x250 [ 175.622687][ T5645] ? __ia32_sys_read+0xb0/0xb0 [ 175.627497][ T5645] ? lockdep_hardirqs_on+0x7d/0x100 [ 175.632731][ T5645] ? _raw_spin_unlock_irq+0x2e/0x50 [ 175.637976][ T5645] ? ptrace_notify+0xfe/0x140 [ 175.642696][ T5645] do_syscall_64+0x39/0xb0 [ 175.647171][ T5645] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 175.653114][ T5645] RIP: 0033:0x7faecf034129 [ 175.657570][ T5645] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 175.677209][ T5645] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 175.685658][ T5645] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 175.693656][ T5645] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 175.701652][ T5645] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 175.709648][ T5645] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 175.717644][ T5645] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 000000000000001c [ 175.725667][ T5645] [ 175.732548][ T5645] memory: usage 8kB, limit 0kB, failcnt 36 [pid 5644] <... close resumed>) = 0 [pid 5085] getdents64(3, [pid 5644] close(4 [pid 5085] <... getdents64 resumed>0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5644] <... close resumed>) = 0 [pid 5085] close(3 [pid 5644] close(5 [pid 5085] <... close resumed>) = 0 [pid 5644] <... close resumed>) = 0 [pid 5085] rmdir("./24" [pid 5644] close(6 [pid 5085] <... rmdir resumed>) = 0 [pid 5644] <... close resumed>) = 0 [pid 5644] close(7 [pid 5085] mkdir("./25", 0777 [pid 5644] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5085] <... mkdir resumed>) = 0 [pid 5644] close(8) = -1 EBADF (Bad file descriptor) [pid 5085] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5662 attached [pid 5644] close(9) = -1 EBADF (Bad file descriptor) [pid 5644] close(10 [pid 5085] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 27 [pid 5662] chdir("./25" [pid 5644] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5644] close(11 [pid 5662] <... chdir resumed>) = 0 [pid 5644] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5662] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5644] close(12) = -1 EBADF (Bad file descriptor) [pid 5662] <... prctl resumed>) = 0 [pid 5644] close(13) = -1 EBADF (Bad file descriptor) [pid 5644] close(14 [pid 5662] setpgid(0, 0 [pid 5644] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5644] close(15) = -1 EBADF (Bad file descriptor) [pid 5644] close(16) = -1 EBADF (Bad file descriptor) [pid 5662] <... setpgid resumed>) = 0 [pid 5644] close(17) = -1 EBADF (Bad file descriptor) [pid 5644] close(18 [pid 5662] symlink("/syzcgroup/unified/syz0", "./cgroup" [pid 5644] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5644] close(19) = -1 EBADF (Bad file descriptor) [pid 5662] <... symlink resumed>) = 0 [pid 5644] close(20 [pid 5662] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu" [pid 5644] <... close resumed>) = -1 EBADF (Bad file descriptor) [ 175.738423][ T5645] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [pid 5662] <... symlink resumed>) = 0 [pid 5644] close(21) = -1 EBADF (Bad file descriptor) [pid 5644] close(22) = -1 EBADF (Bad file descriptor) [pid 5644] close(23) = -1 EBADF (Bad file descriptor) [pid 5644] close(24) = -1 EBADF (Bad file descriptor) [pid 5644] close(25) = -1 EBADF (Bad file descriptor) [pid 5644] close(26) = -1 EBADF (Bad file descriptor) [pid 5644] close(27) = -1 EBADF (Bad file descriptor) [pid 5644] close(28) = -1 EBADF (Bad file descriptor) [pid 5644] close(29) = -1 EBADF (Bad file descriptor) [pid 5644] exit_group(0) = ? [pid 5644] +++ exited with 0 +++ [ 175.774393][ T5645] Memory cgroup stats for /syz1: [ 175.774703][ T5645] anon 0 [ 175.774703][ T5645] file 0 [ 175.774703][ T5645] kernel 8192 [ 175.774703][ T5645] kernel_stack 0 [ 175.774703][ T5645] pagetables 0 [ 175.774703][ T5645] sec_pagetables 0 [ 175.774703][ T5645] percpu 0 [ 175.774703][ T5645] sock 0 [ 175.774703][ T5645] vmalloc 0 [ 175.774703][ T5645] shmem 0 [ 175.774703][ T5645] zswap 0 [ 175.774703][ T5645] zswapped 0 [ 175.774703][ T5645] file_mapped 0 [ 175.774703][ T5645] file_dirty 0 [ 175.774703][ T5645] file_writeback 0 [ 175.774703][ T5645] swapcached 0 [ 175.774703][ T5645] anon_thp 0 [ 175.774703][ T5645] file_thp 0 [ 175.774703][ T5645] shmem_thp 0 [ 175.774703][ T5645] inactive_anon 0 [ 175.774703][ T5645] active_anon 0 [ 175.774703][ T5645] inactive_file 0 [ 175.774703][ T5645] active_file 0 [ 175.774703][ T5645] unevictable 0 [ 175.774703][ T5645] slab_reclaimable 6752 [ 175.774703][ T5645] slab_unreclaimable 0 [ 175.774703][ T5645] slab 6752 [ 175.774703][ T5645] workingset_refault_anon 0 [ 175.774703][ T5645] workingset_refault_file 0 [ 175.774703][ T5645] workingset_activate_anon 0 [ 175.774703][ T5645] workingset_activate_file 0 [ 175.774703][ T5645] workingset_restore_anon 0 [ 175.774703][ T5645] workingset_restore_file 0 [ 175.774703][ T5645] workingset_nodereclaim 0 [ 175.774703][ T5645] pgscan 831 [ 175.774703][ T5645] pgsteal 2 [ 175.774703][ T5645] pgscan_kswapd 0 [ 175.774703][ T5645] pgscan_direct 831 [ 175.774703][ T5645] pgscan_khugepaged 0 [ 175.774703][ T5645] pgsteal_kswapd 0 [ 175.774703][ T5645] pgsteal_direct 2 [ 175.774703][ T5645] pgsteal_khugepaged 0 [pid 5662] symlink("/syzcgroup/net/syz0", "./cgroup.net" [pid 5086] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=27, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- [ 175.774703][ T5645] pgfault 21 [ 175.774703][ T5645] pgmajfault 0 [ 175.774703][ T5645] pgrefill 830 [ 175.774703][ T5645] pgactivate 829 [ 175.774703][ T5645] pgdeactivate 830 [ 175.774703][ T5645] pglazyfree 0 [ 175.774703][ T5645] pglazyfreed 0 [ 175.774703][ T5645] zswpin 0 [ 175.774703][ T5645] zswpout 0 [ 175.774703][ T5645] thp_fault_alloc 0 [ 175.774703][ T5645] thp_collapse_alloc 0 [ 175.962495][ T5645] Tasks state (memory values in pages): [pid 5662] <... symlink resumed>) = 0 [pid 5086] umount2("./25", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5662] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5086] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5662] <... openat resumed>) = 3 [pid 5086] openat(AT_FDCWD, "./25", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5662] write(3, "1000", 4 [pid 5086] <... openat resumed>) = 3 [pid 5662] <... write resumed>) = 4 [pid 5086] fstat(3, [pid 5662] close(3) = 0 [pid 5086] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5662] symlink("/dev/binderfs", "./binderfs" [ 175.968099][ T5645] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5086] getdents64(3, [pid 5662] <... symlink resumed>) = 0 [pid 5086] <... getdents64 resumed>0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5662] mkdir("./file0", 000 [pid 5086] umount2("./25/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5662] <... mkdir resumed>) = 0 [pid 5645] <... write resumed>) = 18 [ 176.003438][ T5645] Out of memory and no killable processes... [ 176.010217][ T5647] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 176.023092][ T5647] CPU: 0 PID: 5647 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 176.033071][ T5647] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 176.043186][ T5647] Call Trace: [ 176.046508][ T5647] [ 176.049484][ T5647] dump_stack_lvl+0x136/0x150 [ 176.054234][ T5647] dump_header+0x10a/0xd70 [ 176.058718][ T5647] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 176.064880][ T5647] out_of_memory+0xd64/0x1660 [ 176.069641][ T5647] ? oom_killer_disable+0x2b0/0x2b0 [ 176.074936][ T5647] mem_cgroup_out_of_memory+0x206/0x270 [ 176.080570][ T5647] ? mem_cgroup_margin+0x130/0x130 [ 176.085786][ T5647] memory_max_write+0x2f9/0x3c0 [ 176.090723][ T5647] ? mem_cgroup_force_empty_write+0x160/0x160 [ 176.096880][ T5647] ? lock_sync+0x190/0x190 [ 176.101365][ T5647] cgroup_file_write+0x1e2/0x7b0 [ 176.106387][ T5647] ? mem_cgroup_force_empty_write+0x160/0x160 [ 176.112542][ T5647] ? kill_css+0x3b0/0x3b0 [ 176.116954][ T5647] ? lock_acquire+0x32/0xc0 [ 176.121535][ T5647] ? kill_css+0x3b0/0x3b0 [ 176.125961][ T5647] kernfs_fop_write_iter+0x3f1/0x600 [ 176.131320][ T5647] vfs_write+0x9ed/0xe10 [ 176.135619][ T5647] ? kernel_write+0x670/0x670 [ 176.140348][ T5647] ? find_held_lock+0x2d/0x110 [ 176.145174][ T5647] ? __fget_light+0x20a/0x270 [ 176.149926][ T5647] ksys_write+0x12b/0x250 [ 176.154315][ T5647] ? __ia32_sys_read+0xb0/0xb0 [ 176.159139][ T5647] ? lockdep_hardirqs_on+0x7d/0x100 [ 176.164389][ T5647] ? _raw_spin_unlock_irq+0x2e/0x50 [ 176.169633][ T5647] ? ptrace_notify+0xfe/0x140 [ 176.174353][ T5647] do_syscall_64+0x39/0xb0 [ 176.178814][ T5647] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 176.184742][ T5647] RIP: 0033:0x7faecf034129 [ 176.189183][ T5647] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 176.208824][ T5647] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 176.217268][ T5647] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 176.225284][ T5647] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 176.233287][ T5647] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 176.241284][ T5647] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [pid 5086] lstat("./25/binderfs", [pid 5662] open("./file0", O_RDONLY [pid 5645] close(3 [pid 5086] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5662] <... open resumed>) = 3 [pid 5645] <... close resumed>) = 0 [pid 5662] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5086] unlink("./25/binderfs" [pid 5662] <... mount resumed>) = 0 [pid 5645] close(4 [pid 5662] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5086] <... unlink resumed>) = 0 [pid 5645] <... close resumed>) = 0 [pid 5662] <... openat resumed>) = 4 [pid 5086] umount2("./25/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5645] close(5 [pid 5662] openat(4, "syz1", O_RDWR|O_PATH [pid 5645] <... close resumed>) = 0 [pid 5086] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5662] <... openat resumed>) = 5 [ 176.249298][ T5647] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 000000000000001c [ 176.257319][ T5647] [ 176.277321][ T5647] memory: usage 8kB, limit 0kB, failcnt 36 [ 176.284309][ T5647] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 176.292762][ T5647] Memory cgroup stats for /syz1: [ 176.293339][ T5647] anon 0 [ 176.293339][ T5647] file 0 [pid 5645] close(6) = 0 [pid 5645] close(7) = -1 EBADF (Bad file descriptor) [pid 5645] close(8) = -1 EBADF (Bad file descriptor) [pid 5645] close(9) = -1 EBADF (Bad file descriptor) [pid 5645] close(10) = -1 EBADF (Bad file descriptor) [pid 5645] close(11) = -1 EBADF (Bad file descriptor) [pid 5645] close(12) = -1 EBADF (Bad file descriptor) [pid 5645] close(13) = -1 EBADF (Bad file descriptor) [ 176.293339][ T5647] kernel 8192 [ 176.293339][ T5647] kernel_stack 0 [ 176.293339][ T5647] pagetables 0 [ 176.293339][ T5647] sec_pagetables 0 [ 176.293339][ T5647] percpu 0 [ 176.293339][ T5647] sock 0 [ 176.293339][ T5647] vmalloc 0 [ 176.293339][ T5647] shmem 0 [ 176.293339][ T5647] zswap 0 [ 176.293339][ T5647] zswapped 0 [ 176.293339][ T5647] file_mapped 0 [ 176.293339][ T5647] file_dirty 0 [ 176.293339][ T5647] file_writeback 0 [ 176.293339][ T5647] swapcached 0 [ 176.293339][ T5647] anon_thp 0 [ 176.293339][ T5647] file_thp 0 [pid 5645] close(14) = -1 EBADF (Bad file descriptor) [pid 5645] close(15) = -1 EBADF (Bad file descriptor) [pid 5645] close(16) = -1 EBADF (Bad file descriptor) [pid 5645] close(17) = -1 EBADF (Bad file descriptor) [pid 5645] close(18) = -1 EBADF (Bad file descriptor) [pid 5645] close(19) = -1 EBADF (Bad file descriptor) [pid 5645] close(20) = -1 EBADF (Bad file descriptor) [pid 5645] close(21) = -1 EBADF (Bad file descriptor) [pid 5645] close(22) = -1 EBADF (Bad file descriptor) [ 176.293339][ T5647] shmem_thp 0 [ 176.293339][ T5647] inactive_anon 0 [ 176.293339][ T5647] active_anon 0 [ 176.293339][ T5647] inactive_file 0 [ 176.293339][ T5647] active_file 0 [ 176.293339][ T5647] unevictable 0 [ 176.293339][ T5647] slab_reclaimable 6752 [ 176.293339][ T5647] slab_unreclaimable 0 [ 176.293339][ T5647] slab 6752 [ 176.293339][ T5647] workingset_refault_anon 0 [ 176.293339][ T5647] workingset_refault_file 0 [ 176.293339][ T5647] workingset_activate_anon 0 [ 176.293339][ T5647] workingset_activate_file 0 [ 176.293339][ T5647] workingset_restore_anon 0 [ 176.293339][ T5647] workingset_restore_file 0 [ 176.293339][ T5647] workingset_nodereclaim 0 [ 176.293339][ T5647] pgscan 831 [ 176.293339][ T5647] pgsteal 2 [ 176.293339][ T5647] pgscan_kswapd 0 [ 176.293339][ T5647] pgscan_direct 831 [ 176.293339][ T5647] pgscan_khugepaged 0 [ 176.293339][ T5647] pgsteal_kswapd 0 [ 176.293339][ T5647] pgsteal_direct 2 [ 176.293339][ T5647] pgsteal_khugepaged 0 [ 176.293339][ T5647] pgfault 21 [ 176.293339][ T5647] pgmajfault 0 [ 176.293339][ T5647] pgrefill 830 [pid 5645] close(23) = -1 EBADF (Bad file descriptor) [pid 5645] close(24) = -1 EBADF (Bad file descriptor) [pid 5645] close(25) = -1 EBADF (Bad file descriptor) [pid 5645] close(26) = -1 EBADF (Bad file descriptor) [pid 5645] close(27) = -1 EBADF (Bad file descriptor) [pid 5645] close(28) = -1 EBADF (Bad file descriptor) [pid 5645] close(29) = -1 EBADF (Bad file descriptor) [pid 5645] exit_group(0) = ? [pid 5645] +++ exited with 0 +++ [pid 5090] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=30, si_uid=0, si_status=0, si_utime=0, si_stime=6 /* 0.06 s */} --- [pid 5090] umount2("./28", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] openat(AT_FDCWD, "./28", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5090] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5090] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5090] umount2("./28/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./28/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5090] unlink("./28/binderfs") = 0 [pid 5090] umount2("./28/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./28/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5090] unlink("./28/cgroup") = 0 [pid 5090] umount2("./28/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./28/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5090] unlink("./28/cgroup.net") = 0 [pid 5090] umount2("./28/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5662] openat(5, "memory.max", O_RDWR [pid 5090] <... umount2 resumed>) = 0 [pid 5086] lstat("./25/cgroup", [pid 5090] umount2("./28/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5662] <... openat resumed>) = 6 [pid 5090] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5086] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5662] write(6, "0x000000000000040e", 18 [pid 5090] lstat("./28/file0", [pid 5086] unlink("./25/cgroup" [pid 5090] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5086] <... unlink resumed>) = 0 [pid 5090] umount2("./28/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] umount2("./25/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5090] openat(AT_FDCWD, "./28/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5086] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5090] <... openat resumed>) = 4 [pid 5090] fstat(4, [pid 5086] lstat("./25/cgroup.net", [pid 5090] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5086] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5090] getdents64(4, [pid 5086] unlink("./25/cgroup.net" [pid 5090] <... getdents64 resumed>0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5090] getdents64(4, [pid 5086] <... unlink resumed>) = 0 [pid 5090] <... getdents64 resumed>0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5086] umount2("./25/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5090] close(4) = 0 [ 176.293339][ T5647] pgactivate 829 [ 176.293339][ T5647] pgdeactivate 830 [ 176.293339][ T5647] pglazyfree 0 [ 176.293339][ T5647] pglazyfreed 0 [ 176.293339][ T5647] zswpin 0 [ 176.293339][ T5647] zswpout 0 [ 176.293339][ T5647] thp_fault_alloc 0 [ 176.293339][ T5647] thp_collapse_alloc 0 [pid 5090] rmdir("./28/file0") = 0 [pid 5090] umount2("./28/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5090] lstat("./28/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5090] unlink("./28/cgroup.cpu") = 0 [pid 5090] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5090] close(3) = 0 [pid 5090] rmdir("./28") = 0 [pid 5090] mkdir("./29", 0777) = 0 [pid 5090] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5667 attached [pid 5667] chdir("./29" [pid 5090] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 31 [pid 5667] <... chdir resumed>) = 0 [pid 5667] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5667] setpgid(0, 0) = 0 [pid 5667] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 5667] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 5667] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [pid 5086] <... umount2 resumed>) = 0 [pid 5667] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5086] umount2("./25/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5667] <... openat resumed>) = 3 [pid 5086] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5667] write(3, "1000", 4 [pid 5086] lstat("./25/file0", [pid 5667] <... write resumed>) = 4 [pid 5667] close(3 [pid 5086] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5667] <... close resumed>) = 0 [pid 5086] umount2("./25/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5667] symlink("/dev/binderfs", "./binderfs" [pid 5086] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5667] <... symlink resumed>) = 0 [pid 5086] openat(AT_FDCWD, "./25/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5667] mkdir("./file0", 000) = 0 [pid 5086] <... openat resumed>) = 4 [pid 5667] open("./file0", O_RDONLY [pid 5086] fstat(4, [pid 5667] <... open resumed>) = 3 [pid 5667] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5086] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5667] <... mount resumed>) = 0 [pid 5086] getdents64(4, [pid 5667] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5086] <... getdents64 resumed>0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5667] <... openat resumed>) = 4 [pid 5667] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5667] openat(5, "memory.max", O_RDWR) = 6 [pid 5086] getdents64(4, [pid 5667] write(6, "0x000000000000040e", 18 [pid 5086] <... getdents64 resumed>0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5086] close(4) = 0 [pid 5086] rmdir("./25/file0") = 0 [pid 5086] umount2("./25/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5086] lstat("./25/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5086] unlink("./25/cgroup.cpu") = 0 [pid 5086] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5086] close(3) = 0 [pid 5086] rmdir("./25") = 0 [pid 5086] mkdir("./26", 0777) = 0 [pid 5086] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5647] <... write resumed>) = 18 [ 176.579864][ T5647] Tasks state (memory values in pages): [ 176.590293][ T5647] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 176.616389][ T5647] Out of memory and no killable processes... [pid 5647] close(3) = 0 [pid 5647] close(4) = 0 [pid 5647] close(5) = 0 [pid 5647] close(6) = 0 [pid 5647] close(7) = -1 EBADF (Bad file descriptor) [pid 5647] close(8) = -1 EBADF (Bad file descriptor) [pid 5647] close(9./strace-static-x86_64: Process 5670 attached ) = -1 EBADF (Bad file descriptor) [pid 5670] chdir("./26" [pid 5647] close(10 [pid 5086] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 28 [pid 5670] <... chdir resumed>) = 0 [pid 5647] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5670] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5647] close(11 [pid 5670] <... prctl resumed>) = 0 [pid 5647] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5670] setpgid(0, 0 [pid 5647] close(12 [pid 5670] <... setpgid resumed>) = 0 [pid 5647] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5670] symlink("/syzcgroup/unified/syz3", "./cgroup" [pid 5647] close(13 [pid 5670] <... symlink resumed>) = 0 [pid 5647] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5670] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu" [pid 5647] close(14) = -1 EBADF (Bad file descriptor) [pid 5670] <... symlink resumed>) = 0 [pid 5647] close(15 [pid 5670] symlink("/syzcgroup/net/syz3", "./cgroup.net" [pid 5647] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5670] <... symlink resumed>) = 0 [pid 5647] close(16 [pid 5670] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5647] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5670] <... openat resumed>) = 3 [pid 5647] close(17 [pid 5670] write(3, "1000", 4 [pid 5647] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5670] <... write resumed>) = 4 [pid 5647] close(18 [pid 5670] close(3 [pid 5647] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5647] close(19) = -1 EBADF (Bad file descriptor) [pid 5647] close(20) = -1 EBADF (Bad file descriptor) [pid 5647] close(21) = -1 EBADF (Bad file descriptor) [pid 5647] close(22) = -1 EBADF (Bad file descriptor) [pid 5647] close(23) = -1 EBADF (Bad file descriptor) [pid 5647] close(24) = -1 EBADF (Bad file descriptor) [ 176.629547][ T5656] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 176.669846][ T5656] CPU: 0 PID: 5656 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [pid 5647] close(25) = -1 EBADF (Bad file descriptor) [pid 5670] <... close resumed>) = 0 [pid 5647] close(26 [pid 5670] symlink("/dev/binderfs", "./binderfs" [pid 5647] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5670] <... symlink resumed>) = 0 [pid 5647] close(27 [pid 5670] mkdir("./file0", 000 [pid 5647] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5670] <... mkdir resumed>) = 0 [pid 5647] close(28 [pid 5670] open("./file0", O_RDONLY [pid 5647] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5670] <... open resumed>) = 3 [pid 5647] close(29 [pid 5670] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5647] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5670] <... mount resumed>) = 0 [pid 5647] exit_group(0 [pid 5670] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5647] <... exit_group resumed>) = ? [pid 5670] <... openat resumed>) = 4 [pid 5647] +++ exited with 0 +++ [ 176.679955][ T5656] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 176.690078][ T5656] Call Trace: [ 176.693410][ T5656] [ 176.696393][ T5656] dump_stack_lvl+0x136/0x150 [ 176.701136][ T5656] dump_header+0x10a/0xd70 [ 176.705616][ T5656] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 176.711778][ T5656] out_of_memory+0xd64/0x1660 [ 176.716535][ T5656] ? oom_killer_disable+0x2b0/0x2b0 [ 176.721815][ T5656] mem_cgroup_out_of_memory+0x206/0x270 [pid 5670] openat(4, "syz1", O_RDWR|O_PATH [pid 5089] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=30, si_uid=0, si_status=0, si_utime=0, si_stime=9 /* 0.09 s */} --- [pid 5670] <... openat resumed>) = 5 [pid 5670] openat(5, "memory.max", O_RDWR) = 6 [pid 5089] umount2("./28", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5670] write(6, "0x000000000000040e", 18 [pid 5089] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [ 176.727413][ T5656] ? mem_cgroup_margin+0x130/0x130 [ 176.732589][ T5656] memory_max_write+0x2f9/0x3c0 [ 176.737495][ T5656] ? mem_cgroup_force_empty_write+0x160/0x160 [ 176.743619][ T5656] ? lock_sync+0x190/0x190 [ 176.748081][ T5656] cgroup_file_write+0x1e2/0x7b0 [ 176.753069][ T5656] ? mem_cgroup_force_empty_write+0x160/0x160 [ 176.759186][ T5656] ? kill_css+0x3b0/0x3b0 [ 176.763562][ T5656] ? lock_acquire+0x32/0xc0 [ 176.768117][ T5656] ? kill_css+0x3b0/0x3b0 [ 176.772490][ T5656] kernfs_fop_write_iter+0x3f1/0x600 [ 176.777828][ T5656] vfs_write+0x9ed/0xe10 [ 176.782130][ T5656] ? kernel_write+0x670/0x670 [ 176.786878][ T5656] ? find_held_lock+0x2d/0x110 [ 176.791692][ T5656] ? __fget_light+0x20a/0x270 [ 176.796425][ T5656] ksys_write+0x12b/0x250 [ 176.800802][ T5656] ? __ia32_sys_read+0xb0/0xb0 [ 176.805627][ T5656] ? lockdep_hardirqs_on+0x7d/0x100 [ 176.810865][ T5656] ? _raw_spin_unlock_irq+0x2e/0x50 [ 176.816113][ T5656] ? ptrace_notify+0xfe/0x140 [ 176.820832][ T5656] do_syscall_64+0x39/0xb0 [ 176.825314][ T5656] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 176.831253][ T5656] RIP: 0033:0x7faecf034129 [ 176.835696][ T5656] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 176.855346][ T5656] RSP: 002b:00007fff01927a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 176.863791][ T5656] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faecf034129 [ 176.871790][ T5656] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [pid 5089] openat(AT_FDCWD, "./28", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5089] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5089] getdents64(3, 0x555555c0d620 /* 7 entries */, 32768) = 208 [pid 5089] umount2("./28/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./28/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5089] unlink("./28/binderfs") = 0 [pid 5089] umount2("./28/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./28/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5089] unlink("./28/cgroup") = 0 [pid 5089] umount2("./28/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./28/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5089] unlink("./28/cgroup.net") = 0 [pid 5089] umount2("./28/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [ 176.879785][ T5656] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007fff01927a80 [ 176.887783][ T5656] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff01927a7c [ 176.895783][ T5656] R13: 00007fff01927a90 R14: 00007fff01927ad0 R15: 000000000000001b [ 176.903802][ T5656] [pid 5089] umount2("./28/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./28/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5089] umount2("./28/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] openat(AT_FDCWD, "./28/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5089] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5089] getdents64(4, 0x555555c15660 /* 2 entries */, 32768) = 48 [pid 5089] getdents64(4, 0x555555c15660 /* 0 entries */, 32768) = 0 [pid 5089] close(4) = 0 [pid 5089] rmdir("./28/file0") = 0 [pid 5089] umount2("./28/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5089] lstat("./28/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5089] unlink("./28/cgroup.cpu") = 0 [pid 5089] getdents64(3, 0x555555c0d620 /* 0 entries */, 32768) = 0 [pid 5089] close(3) = 0 [pid 5089] rmdir("./28") = 0 [pid 5089] mkdir("./29", 0777) = 0 [pid 5089] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5671 attached [pid 5671] chdir("./29" [pid 5089] <... clone resumed>, child_tidptr=0x555555c0c5d0) = 31 [pid 5671] <... chdir resumed>) = 0 [pid 5671] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5671] setpgid(0, 0) = 0 [pid 5671] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 5671] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [pid 5671] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 5671] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5671] write(3, "1000", 4) = 4 [pid 5671] close(3) = 0 [pid 5671] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5671] mkdir("./file0", 000) = 0 [pid 5671] open("./file0", O_RDONLY) = 3 [pid 5671] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5671] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5671] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5671] openat(5, "memory.max", O_RDWR) = 6 [ 177.031217][ T5656] memory: usage 8kB, limit 0kB, failcnt 36 [ 177.039751][ T5656] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 177.049251][ T5656] Memory cgroup stats for /syz1: [ 177.049522][ T5656] anon 0 [ 177.049522][ T5656] file 0 [ 177.049522][ T5656] kernel 8192 [ 177.049522][ T5656] kernel_stack 0 [ 177.049522][ T5656] pagetables 0 [ 177.049522][ T5656] sec_pagetables 0 [ 177.049522][ T5656] percpu 0 [ 177.049522][ T5656] sock 0 [ 177.049522][ T5656] vmalloc 0 [ 177.049522][ T5656] shmem 0 [ 177.049522][ T5656] zswap 0 [ 177.049522][ T5656] zswapped 0 [ 177.049522][ T5656] file_mapped 0 [ 177.049522][ T5656] file_dirty 0 [ 177.049522][ T5656] file_writeback 0 [ 177.049522][ T5656] swapcached 0 [ 177.049522][ T5656] anon_thp 0 [ 177.049522][ T5656] file_thp 0 [ 177.049522][ T5656] shmem_thp 0 [ 177.049522][ T5656] inactive_anon 0 [ 177.049522][ T5656] active_anon 0 [ 177.049522][ T5656] inactive_file 0 [ 177.049522][ T5656] active_file 0 [ 177.049522][ T5656] unevictable 0 [ 177.049522][ T5656] slab_reclaimable 6752 [ 177.049522][ T5656] slab_unreclaimable 0 [ 177.049522][ T5656] slab 6752 [ 177.049522][ T5656] workingset_refault_anon 0 [ 177.049522][ T5656] workingset_refault_file 0 [ 177.049522][ T5656] workingset_activate_anon 0 [ 177.049522][ T5656] workingset_activate_file 0 [ 177.049522][ T5656] workingset_restore_anon 0 [ 177.049522][ T5656] workingset_restore_file 0 [ 177.049522][ T5656] workingset_nodereclaim 0 [ 177.049522][ T5656] pgscan 831 [ 177.049522][ T5656] pgsteal 2 [ 177.049522][ T5656] pgscan_kswapd 0 [ 177.049522][ T5656] pgscan_direct 831 [ 177.049522][ T5656] pgscan_khugepaged 0 [ 177.049522][ T5656] pgsteal_kswapd 0 [ 177.049522][ T5656] pgsteal_direct 2 [ 177.049522][ T5656] pgsteal_khugepaged 0 [ 177.049522][ T5656] pgfault 21 [ 177.049522][ T5656] pgmajfault 0 [ 177.049522][ T5656] pgrefill 830 [ 177.049522][ T5656] pgactivate 829 [ 177.049522][ T5656] pgdeactivate 830 [ 177.049522][ T5656] pglazyfree 0 [ 177.049522][ T5656] pglazyfreed 0 [ 177.049522][ T5656] zswpin 0 [ 177.049522][ T5656] zswpout 0 [ 177.049522][ T5656] thp_fault_alloc 0 [pid 5671] write(6, "0x000000000000040e", 18 [pid 5656] <... write resumed>) = 18 [pid 5656] close(3) = 0 [pid 5656] close(4) = 0 [pid 5656] close(5) = 0 [pid 5656] close(6) = 0 [pid 5656] close(7) = -1 EBADF (Bad file descriptor) [pid 5656] close(8) = -1 EBADF (Bad file descriptor) [pid 5656] close(9) = -1 EBADF (Bad file descriptor) [pid 5656] close(10) = -1 EBADF (Bad file descriptor) [ 177.049522][ T5656] thp_collapse_alloc 0 [ 177.240744][ T5656] Tasks state (memory values in pages): [ 177.246459][ T5656] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 177.256261][ T5656] Out of memory and no killable processes... [ 177.263784][ T5662] syz-executor384 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5656] close(11) = -1 EBADF (Bad file descriptor) [pid 5656] close(12) = -1 EBADF (Bad file descriptor) [pid 5656] close(13) = -1 EBADF (Bad file descriptor) [pid 5656] close(14) = -1 EBADF (Bad file descriptor) [pid 5656] close(15) = -1 EBADF (Bad file descriptor) [pid 5656] close(16) = -1 EBADF (Bad file descriptor) [pid 5656] close(17) = -1 EBADF (Bad file descriptor) [pid 5656] close(18) = -1 EBADF (Bad file descriptor) [ 177.286863][ T5662] CPU: 0 PID: 5662 Comm: syz-executor384 Not tainted 6.2.0-rc7-next-20230208-syzkaller #0 [ 177.296849][ T5662] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 177.306958][ T5662] Call Trace: [ 177.310281][ T5662] [ 177.313261][ T5662] dump_stack_lvl+0x136/0x150 [ 177.318008][ T5662] dump_header+0x10a/0xd70 [ 177.322495][ T5662] ? mem_cgroup_print_oom_meminfo+0x440/0x440 [ 177.328659][ T5662] out_of_memory+0xd64/0x1660 [pid 5656] close(19) = -1 EBADF (Bad file descriptor) [pid 5656] close(20) = -1 EBADF (Bad file descriptor) [pid 5656] close(21) = -1 EBADF (Bad file descriptor) [pid 5656] close(22) = -1 EBADF (Bad file descriptor) [pid 5656] close(23) = -1 EBADF (Bad file descriptor) [pid 5656] close(24) = -1 EBADF (Bad file descriptor) [pid 5656] close(25) = -1 EBADF (Bad file descriptor) [pid 5656] close(26) = -1 EBADF (Bad file descriptor) [pid 5656] close(27) = -1 EBADF (Bad file descriptor) [pid 5656] close(28) = -1 EBADF (Bad file descriptor) [ 177.333416][ T5662] ? oom_killer_disable+0x2b0/0x2b0 [ 177.338711][ T5662] mem_cgroup_out_of_memory+0x206/0x270 [ 177.344341][ T5662] ? mem_cgroup_margin+0x130/0x130 [ 177.349564][ T5662] memory_max_write+0x2f9/0x3c0 [ 177.354513][ T5662] ? mem_cgroup_force_empty_write+0x160/0x160 [ 177.360679][ T5662] ? lock_sync+0x190/0x190 [ 177.365165][ T5662] cgroup_file_write+0x1e2/0x7b0 [ 177.370160][ T5662] ? mem_cgroup_force_empty_write+0x160/0x160 [ 177.376273][ T5662] ? kill_css+0x3b0/0x3b0 [ 177.380644][ T5662] ? lock_acquire+0x32/0xc0 [ 177.385194][ T5662] ? kill_css+0x3b0/0x3b0 [ 177.389565][ T5662] kernfs_fop_write_iter+0x3f1/0x600 [ 177.394901][ T5662] vfs_write+0x9ed/0xe10 [ 177.399199][ T5662] ? kernel_write+0x670/0x670 [ 177.403928][ T5662] ? find_held_lock+0x2d/0x110 [ 177.408740][ T5662] ? __fget_light+0x20a/0x270 [ 177.413465][ T5662] ksys_write+0x12b/0x250 [ 177.417847][ T5662] ? __ia32_sys_read+0xb0/0xb0 [ 177.422658][ T5662] ? lockdep_hardirqs_on+0x7d/0x100 [ 177.427916][ T5662] ? _raw_spin_unlock_irq+0x2e/0x50 [ 177.433167][ T5662] ? ptrace_notify+0xfe/0x140 [ 177.437885][ T5662] do_syscall_64+0x39/0xb0 [ 177.442355][ T5662] entry_SYSCALL_64_after_hwframe+0x63/0xcd [