./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2371140302 <...> Warning: Permanently added '10.128.1.65' (ED25519) to the list of known hosts. execve("./syz-executor2371140302", ["./syz-executor2371140302"], 0x7ffe704dffb0 /* 10 vars */) = 0 brk(NULL) = 0x5555567a6000 brk(0x5555567a6d00) = 0x5555567a6d00 arch_prctl(ARCH_SET_FS, 0x5555567a6380) = 0 set_tid_address(0x5555567a6650) = 5063 set_robust_list(0x5555567a6660, 24) = 0 rseq(0x5555567a6ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor2371140302", 4096) = 28 getrandom("\x7e\x61\x82\x64\xb5\x99\x72\x8b", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x5555567a6d00 brk(0x5555567c7d00) = 0x5555567c7d00 brk(0x5555567c8000) = 0x5555567c8000 mprotect(0x7f87d0926000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 openat(AT_FDCWD, "/sys/kernel/debug/failslab/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3 write(3, "N", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_futex/ignore-private", O_WRONLY|O_CLOEXEC) = 3 write(3, "N", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-highmem", O_WRONLY|O_CLOEXEC) = 3 write(3, "N", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3 write(3, "N", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/min-order", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5064 attached [pid 5064] set_robust_list(0x5555567a6660, 24) = 0 [pid 5064] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5063] <... clone resumed>, child_tidptr=0x5555567a6650) = 5064 [pid 5064] setpgid(0, 0) = 0 [pid 5064] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5064] write(3, "1000", 4) = 4 [pid 5064] close(3) = 0 [pid 5064] memfd_create("syzkaller", 0) = 3 [pid 5064] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f87c8400000 [pid 5064] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5064] munmap(0x7f87c8400000, 138412032) = 0 [pid 5064] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5064] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5064] close(3) = 0 [pid 5064] close(4) = 0 [pid 5064] mkdir("./file0", 0777) = 0 [ 72.275398][ T5064] loop0: detected capacity change from 0 to 32768 [ 72.307382][ T5064] BTRFS: device fsid e417788f-7a09-42b2-9266-8ddc5d5d35d2 devid 1 transid 8 /dev/loop0 scanned by syz-executor237 (5064) [ 72.336853][ T5064] BTRFS info (device loop0): first mount of filesystem e417788f-7a09-42b2-9266-8ddc5d5d35d2 [ 72.353429][ T5064] BTRFS info (device loop0): using xxhash64 (xxhash64-generic) checksum algorithm [ 72.363257][ T5064] BTRFS info (device loop0): disk space caching is enabled [ 72.414696][ T5064] BTRFS info (device loop0): rebuilding free space tree [ 72.449951][ T5064] BTRFS info (device loop0): disabling free space tree [pid 5064] mount("/dev/loop0", "./file0", "btrfs", MS_NOEXEC|MS_STRICTATIME, "datacow,clear_cache,nodatasum,rescan_uuid_tree,degraded,space_cache=v1,") = 0 [pid 5064] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5064] chdir("./file0") = 0 [pid 5064] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5064] ioctl(4, LOOP_CLR_FD) = 0 [ 72.457080][ T5064] BTRFS info (device loop0): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 72.467487][ T5064] BTRFS info (device loop0): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 72.486201][ T5064] BTRFS info (device loop0): checking UUID tree [pid 5064] close(4) = 0 [pid 5064] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_NONBLOCK|O_SYNC|O_NOATIME, 000) = 4 [pid 5064] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5 [pid 5064] ioctl(5, BTRFS_IOC_QUOTA_CTL, {cmd=BTRFS_QUOTA_CTL_ENABLE}) = 0 [pid 5064] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 5064] write(6, "4", 1) = 1 [ 72.624395][ T5064] FAULT_INJECTION: forcing a failure. [ 72.624395][ T5064] name failslab, interval 1, probability 0, space 0, times 1 [ 72.637594][ T5064] CPU: 0 PID: 5064 Comm: syz-executor237 Not tainted 6.8.0-rc6-syzkaller #0 [ 72.646408][ T5064] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 [ 72.657095][ T5064] Call Trace: [ 72.660407][ T5064] [ 72.663373][ T5064] dump_stack_lvl+0x1e7/0x2e0 [ 72.668132][ T5064] ? __pfx_dump_stack_lvl+0x10/0x10 [ 72.673415][ T5064] ? __pfx__printk+0x10/0x10 [ 72.678166][ T5064] should_fail_ex+0x3ae/0x4e0 [ 72.682891][ T5064] ? ulist_add_merge+0x14c/0x480 [ 72.687872][ T5064] should_failslab+0x9/0x20 [ 72.692421][ T5064] kmalloc_trace+0x76/0x360 [ 72.697426][ T5064] ulist_add_merge+0x14c/0x480 [ 72.702247][ T5064] insert_state_fast+0x18d/0x2a0 [ 72.707234][ T5064] __set_extent_bit+0x14e9/0x1de0 [ 72.711414][ T11] BTRFS info (device loop0): qgroup scan completed (inconsistency flag cleared) [ 72.712312][ T5064] ? __kasan_kmalloc+0x98/0xb0 [ 72.726204][ T5064] ? qgroup_reserve_data+0x1cc/0x8b0 [ 72.731542][ T5064] set_record_extent_bits+0x51/0x90 [ 72.736786][ T5064] qgroup_reserve_data+0x27c/0x8b0 [ 72.741958][ T5064] ? __pfx_fault_in_readable+0x10/0x10 [ 72.747460][ T5064] btrfs_qgroup_reserve_data+0x2e/0xb0 [ 72.752966][ T5064] btrfs_check_data_free_space+0x149/0x240 [ 72.758830][ T5064] btrfs_buffered_write+0x5c6/0x1380 [ 72.764195][ T5064] ? __pfx_btrfs_buffered_write+0x10/0x10 [ 72.769969][ T5064] btrfs_do_write_iter+0x2bb/0x1190 [ 72.775199][ T5064] ? __pfx_lock_acquire+0x10/0x10 [ 72.780474][ T5064] ? __pfx_rcu_read_lock_any_held+0x10/0x10 [ 72.786391][ T5064] ? __pfx_btrfs_do_write_iter+0x10/0x10 [ 72.792041][ T5064] vfs_write+0xa81/0xcb0 [ 72.796309][ T5064] ? __pfx_vfs_write+0x10/0x10 [ 72.801606][ T5064] ? lockdep_hardirqs_on+0x98/0x140 [ 72.806814][ T5064] ? __fdget_pos+0x271/0x320 [ 72.811430][ T5064] ksys_write+0x1a0/0x2c0 [ 72.815778][ T5064] ? __pfx_ksys_write+0x10/0x10 [ 72.820632][ T5064] ? do_syscall_64+0x108/0x240 [ 72.825406][ T5064] ? syscall_trace_enter+0x5e/0x150 [ 72.830622][ T5064] do_syscall_64+0xf9/0x240 [ 72.835160][ T5064] entry_SYSCALL_64_after_hwframe+0x6f/0x77 [ 72.841103][ T5064] RIP: 0033:0x7f87d08aced9 [ 72.845522][ T5064] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 72.865137][ T5064] RSP: 002b:00007fffbcd7ed18 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 72.873560][ T5064] RAX: ffffffffffffffda RBX: 00007fffbcd7ed30 RCX: 00007f87d08aced9 [ 72.881561][ T5064] RDX: 0000000000000002 RSI: 0000000020000080 RDI: 0000000000000004 [ 72.889556][ T5064] RBP: 0000000000000001 R08: 00007fffbcd7eab7 R09: 00005555567a7378 [ 72.897949][ T5064] R10: 0000000000000001 R11: 0000000000000246 R12: 00007fffbcd7ed50 [ 72.905922][ T5064] R13: 00007fffbcd7ef78 R14: 431bde82d7b634db R15: 00007f87d08f601d [ 72.913925][ T5064] [ 72.917646][ T5064] ------------[ cut here ]------------ [ 72.923130][ T5064] kernel BUG at fs/btrfs/extent-io-tree.c:419! [ 72.929341][ T5064] invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI [ 72.935785][ T5064] CPU: 0 PID: 5064 Comm: syz-executor237 Not tainted 6.8.0-rc6-syzkaller #0 [ 72.944464][ T5064] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 [ 72.954525][ T5064] RIP: 0010:insert_state_fast+0x29a/0x2a0 [ 72.960262][ T5064] Code: fe e9 59 ff ff ff 44 89 e1 80 e1 07 80 c1 03 38 c1 0f 8c 4f fe ff ff 4c 89 e7 e8 81 da 29 fe e9 42 fe ff ff e8 17 04 cb fd 90 <0f> 0b 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 72.979965][ T5064] RSP: 0018:ffffc9000447f648 EFLAGS: 00010293 [ 72.986035][ T5064] RAX: ffffffff83c86839 RBX: dffffc0000000000 RCX: ffff88807c8ebb80 [ 72.994005][ T5064] RDX: 0000000000000000 RSI: 00000000fffffff4 RDI: 0000000000000000 [ 73.001985][ T5064] RBP: 00000000fffffff4 R08: ffffffff83c86738 R09: 00000000ffffffff [ 73.009961][ T5064] R10: dffffc0000000000 R11: fffffbfff1c462a3 R12: 0000000000000000 [ 73.017934][ T5064] R13: ffff88802d9db608 R14: ffff888021fb30d0 R15: 0000000000000800 [ 73.025917][ T5064] FS: 00005555567a6380(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000 [ 73.034848][ T5064] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 73.041523][ T5064] CR2: 00007ffefb0f4fb8 CR3: 0000000024e22000 CR4: 00000000003506f0 [ 73.049500][ T5064] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 73.057471][ T5064] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 73.065444][ T5064] Call Trace: [ 73.068727][ T5064] [ 73.071658][ T5064] ? __die_body+0x8b/0xe0 [ 73.075998][ T5064] ? die+0xcf/0x110 [ 73.079815][ T5064] ? do_trap+0x157/0x390 [ 73.084062][ T5064] ? insert_state_fast+0x29a/0x2a0 [ 73.089194][ T5064] ? do_error_trap+0x1dc/0x2c0 [ 73.093958][ T5064] ? insert_state_fast+0x29a/0x2a0 [ 73.099429][ T5064] ? __sanitizer_cov_trace_pc+0x17/0x70 [ 73.104998][ T5064] ? __pfx_do_error_trap+0x10/0x10 [ 73.110115][ T5064] ? handle_invalid_op+0x34/0x40 [ 73.115069][ T5064] ? insert_state_fast+0x29a/0x2a0 [ 73.120178][ T5064] ? exc_invalid_op+0x38/0x50 [ 73.124863][ T5064] ? asm_exc_invalid_op+0x1a/0x20 [ 73.129898][ T5064] ? insert_state_fast+0x198/0x2a0 [ 73.135004][ T5064] ? insert_state_fast+0x299/0x2a0 [ 73.140142][ T5064] ? insert_state_fast+0x29a/0x2a0 [ 73.145253][ T5064] ? insert_state_fast+0x299/0x2a0 [ 73.150365][ T5064] __set_extent_bit+0x14e9/0x1de0 [ 73.155394][ T5064] ? __kasan_kmalloc+0x98/0xb0 [ 73.160154][ T5064] ? qgroup_reserve_data+0x1cc/0x8b0 [ 73.165446][ T5064] set_record_extent_bits+0x51/0x90 [ 73.170650][ T5064] qgroup_reserve_data+0x27c/0x8b0 [ 73.175761][ T5064] ? __pfx_fault_in_readable+0x10/0x10 [ 73.181214][ T5064] btrfs_qgroup_reserve_data+0x2e/0xb0 [ 73.186677][ T5064] btrfs_check_data_free_space+0x149/0x240 [ 73.192490][ T5064] btrfs_buffered_write+0x5c6/0x1380 [ 73.197954][ T5064] ? __pfx_btrfs_buffered_write+0x10/0x10 [ 73.203689][ T5064] btrfs_do_write_iter+0x2bb/0x1190 [ 73.208895][ T5064] ? __pfx_lock_acquire+0x10/0x10 [ 73.213961][ T5064] ? __pfx_rcu_read_lock_any_held+0x10/0x10 [ 73.219887][ T5064] ? __pfx_btrfs_do_write_iter+0x10/0x10 [ 73.225542][ T5064] vfs_write+0xa81/0xcb0 [ 73.229803][ T5064] ? __pfx_vfs_write+0x10/0x10 [ 73.234621][ T5064] ? lockdep_hardirqs_on+0x98/0x140 [ 73.239844][ T5064] ? __fdget_pos+0x271/0x320 [ 73.244487][ T5064] ksys_write+0x1a0/0x2c0 [ 73.248842][ T5064] ? __pfx_ksys_write+0x10/0x10 [ 73.253702][ T5064] ? do_syscall_64+0x108/0x240 [ 73.258488][ T5064] ? syscall_trace_enter+0x5e/0x150 [ 73.263716][ T5064] do_syscall_64+0xf9/0x240 [ 73.268242][ T5064] entry_SYSCALL_64_after_hwframe+0x6f/0x77 [ 73.274154][ T5064] RIP: 0033:0x7f87d08aced9 [ 73.278577][ T5064] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 73.298188][ T5064] RSP: 002b:00007fffbcd7ed18 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 73.306645][ T5064] RAX: ffffffffffffffda RBX: 00007fffbcd7ed30 RCX: 00007f87d08aced9 [ 73.314619][ T5064] RDX: 0000000000000002 RSI: 0000000020000080 RDI: 0000000000000004 [ 73.322587][ T5064] RBP: 0000000000000001 R08: 00007fffbcd7eab7 R09: 00005555567a7378 [ 73.330558][ T5064] R10: 0000000000000001 R11: 0000000000000246 R12: 00007fffbcd7ed50 [ 73.338576][ T5064] R13: 00007fffbcd7ef78 R14: 431bde82d7b634db R15: 00007f87d08f601d [ 73.346567][ T5064] [ 73.349631][ T5064] Modules linked in: [ 73.353833][ T5064] ---[ end trace 0000000000000000 ]--- [ 73.359337][ T5064] RIP: 0010:insert_state_fast+0x29a/0x2a0 [ 73.365093][ T5064] Code: fe e9 59 ff ff ff 44 89 e1 80 e1 07 80 c1 03 38 c1 0f 8c 4f fe ff ff 4c 89 e7 e8 81 da 29 fe e9 42 fe ff ff e8 17 04 cb fd 90 <0f> 0b 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 73.384978][ T5064] RSP: 0018:ffffc9000447f648 EFLAGS: 00010293 [ 73.391086][ T5064] RAX: ffffffff83c86839 RBX: dffffc0000000000 RCX: ffff88807c8ebb80 [ 73.399104][ T5064] RDX: 0000000000000000 RSI: 00000000fffffff4 RDI: 0000000000000000 [ 73.407192][ T5064] RBP: 00000000fffffff4 R08: ffffffff83c86738 R09: 00000000ffffffff [ 73.415162][ T5064] R10: dffffc0000000000 R11: fffffbfff1c462a3 R12: 0000000000000000 [ 73.423165][ T5064] R13: ffff88802d9db608 R14: ffff888021fb30d0 R15: 0000000000000800 [ 73.431187][ T5064] FS: 00005555567a6380(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000 [ 73.440147][ T5064] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 73.446767][ T5064] CR2: 00007ffefb0f4fb8 CR3: 0000000024e22000 CR4: 00000000003506f0 [ 73.454756][ T5064] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 73.462788][ T5064] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 73.470817][ T5064] Kernel panic - not syncing: Fatal exception [ 73.477168][ T5064] Kernel Offset: disabled [ 73.481489][ T5064] Rebooting in 86400 seconds..