./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1183428835

<...>
Warning: Permanently added '10.128.1.52' (ECDSA) to the list of known hosts.
execve("./syz-executor1183428835", ["./syz-executor1183428835"], 0x7ffff8455290 /* 10 vars */) = 0
brk(NULL)                               = 0x5555562e4000
brk(0x5555562e4c40)                     = 0x5555562e4c40
arch_prctl(ARCH_SET_FS, 0x5555562e4300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor1183428835", 4096) = 28
brk(0x555556305c40)                     = 0x555556305c40
brk(0x555556306000)                     = 0x555556306000
mprotect(0x7f296622f000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
getpid()                                = 4995
mkdir("./syzkaller.dkaqIU", 0700)       = 0
chmod("./syzkaller.dkaqIU", 0777)       = 0
chdir("./syzkaller.dkaqIU")             = 0
mkdir("./0", 0777)                      = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 4997 attached
 <unfinished ...>
[pid  4997] chdir("./0")                = 0
[pid  4997] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  4997] setpgid(0, 0)               = 0
[pid  4995] <... clone resumed>, child_tidptr=0x5555562e45d0) = 4997
[pid  4997] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  4997] write(3, "1000", 4)         = 4
[pid  4997] close(3)                    = 0
[pid  4997] symlink("/dev/binderfs", "./binderfs") = 0
[pid  4997] memfd_create("syzkaller", 0) = 3
[pid  4997] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  4997] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  4997] munmap(0x7f295dd73000, 262144) = 0
[pid  4997] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  4997] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  4997] close(3)                    = 0
[pid  4997] mkdir("./file1", 0777)      = 0
syzkaller login: [   43.921035][ T4997] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=4997 'syz-executor118'
[   43.936746][ T4997] loop0: detected capacity change from 0 to 512
[   43.946961][ T4997] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   43.964259][ T4997] EXT4-fs (loop0): 1 truncate cleaned up
[pid  4997] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  4997] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  4997] chdir("./file1")            = 0
[pid  4997] ioctl(4, LOOP_CLR_FD)       = 0
[pid  4997] close(4)                    = 0
[pid  4997] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  4997] creat("./file1", 0410)      = 4
[pid  4997] exit_group(0)               = ?
[pid  4997] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4997, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./0/binderfs")                  = 0
umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./0/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./0/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./0/file1")                      = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./0")                            = 0
mkdir("./1", 0777)                      = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5000
./strace-static-x86_64: Process 5000 attached
[pid  5000] chdir("./1")                = 0
[pid  5000] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5000] setpgid(0, 0)               = 0
[pid  5000] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5000] write(3, "1000", 4)         = 4
[pid  5000] close(3)                    = 0
[pid  5000] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5000] memfd_create("syzkaller", 0) = 3
[pid  5000] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5000] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5000] munmap(0x7f295dd73000, 262144) = 0
[pid  5000] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   43.969948][ T4997] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[   44.009075][ T4995] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[pid  5000] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5000] close(3)                    = 0
[pid  5000] mkdir("./file1", 0777)      = 0
[pid  5000] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5000] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5000] chdir("./file1")            = 0
[pid  5000] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5000] close(4)                    = 0
[pid  5000] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5000] creat("./file1", 0410)      = 4
[pid  5000] exit_group(0)               = ?
[pid  5000] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5000, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./1/binderfs")                  = 0
[   44.039072][ T5000] loop0: detected capacity change from 0 to 512
[   44.048916][ T5000] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   44.063424][ T5000] EXT4-fs (loop0): 1 truncate cleaned up
[   44.069055][ T5000] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
umount2("./1/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./1/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./1/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./1/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./1/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./1/file1")                      = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./1")                            = 0
mkdir("./2", 0777)                      = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5002
./strace-static-x86_64: Process 5002 attached
[pid  5002] chdir("./2")                = 0
[pid  5002] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5002] setpgid(0, 0)               = 0
[pid  5002] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5002] write(3, "1000", 4)         = 4
[pid  5002] close(3)                    = 0
[pid  5002] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5002] memfd_create("syzkaller", 0) = 3
[pid  5002] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5002] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5002] munmap(0x7f295dd73000, 262144) = 0
[pid  5002] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   44.106534][ T4995] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[pid  5002] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5002] close(3)                    = 0
[pid  5002] mkdir("./file1", 0777)      = 0
[pid  5002] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5002] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5002] chdir("./file1")            = 0
[pid  5002] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5002] close(4)                    = 0
[pid  5002] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5002] creat("./file1", 0410)      = 4
[pid  5002] exit_group(0)               = ?
[pid  5002] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5002, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./2/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./2/binderfs")                  = 0
[   44.154960][ T5002] loop0: detected capacity change from 0 to 512
[   44.165036][ T5002] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   44.179684][ T5002] EXT4-fs (loop0): 1 truncate cleaned up
[   44.185423][ T5002] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./2/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./2/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./2/file1")                      = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./2")                            = 0
mkdir("./3", 0777)                      = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5004
./strace-static-x86_64: Process 5004 attached
[pid  5004] chdir("./3")                = 0
[pid  5004] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5004] setpgid(0, 0)               = 0
[pid  5004] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5004] write(3, "1000", 4)         = 4
[pid  5004] close(3)                    = 0
[pid  5004] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5004] memfd_create("syzkaller", 0) = 3
[pid  5004] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5004] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5004] munmap(0x7f295dd73000, 262144) = 0
[pid  5004] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5004] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5004] close(3)                    = 0
[pid  5004] mkdir("./file1", 0777)      = 0
[   44.215463][ T4995] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[   44.249579][ T5004] loop0: detected capacity change from 0 to 512
[pid  5004] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5004] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5004] chdir("./file1")            = 0
[pid  5004] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5004] close(4)                    = 0
[pid  5004] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5004] creat("./file1", 0410)      = 4
[pid  5004] exit_group(0)               = ?
[pid  5004] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5004, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./3/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./3/binderfs")                  = 0
[   44.258874][ T5004] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   44.273099][ T5004] EXT4-fs (loop0): 1 truncate cleaned up
[   44.278783][ T5004] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./3/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./3/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./3/file1")                      = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./3")                            = 0
mkdir("./4", 0777)                      = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5006
./strace-static-x86_64: Process 5006 attached
[pid  5006] chdir("./4")                = 0
[pid  5006] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5006] setpgid(0, 0)               = 0
[pid  5006] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5006] write(3, "1000", 4)         = 4
[pid  5006] close(3)                    = 0
[pid  5006] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5006] memfd_create("syzkaller", 0) = 3
[pid  5006] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5006] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5006] munmap(0x7f295dd73000, 262144) = 0
[pid  5006] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5006] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5006] close(3)                    = 0
[pid  5006] mkdir("./file1", 0777)      = 0
[   44.313009][ T4995] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[   44.349495][ T5006] loop0: detected capacity change from 0 to 512
[pid  5006] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5006] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5006] chdir("./file1")            = 0
[pid  5006] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5006] close(4)                    = 0
[pid  5006] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5006] creat("./file1", 0410)      = 4
[pid  5006] exit_group(0)               = ?
[pid  5006] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5006, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./4/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./4/binderfs")                  = 0
[   44.359074][ T5006] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   44.373967][ T5006] EXT4-fs (loop0): 1 truncate cleaned up
[   44.379608][ T5006] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./4/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./4/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./4/file1")                      = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./4")                            = 0
mkdir("./5", 0777)                      = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5008
./strace-static-x86_64: Process 5008 attached
[pid  5008] chdir("./5")                = 0
[pid  5008] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5008] setpgid(0, 0)               = 0
[pid  5008] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5008] write(3, "1000", 4)         = 4
[pid  5008] close(3)                    = 0
[pid  5008] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5008] memfd_create("syzkaller", 0) = 3
[pid  5008] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5008] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5008] munmap(0x7f295dd73000, 262144) = 0
[pid  5008] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5008] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5008] close(3)                    = 0
[pid  5008] mkdir("./file1", 0777)      = 0
[   44.418769][ T4995] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[   44.447879][ T5008] loop0: detected capacity change from 0 to 512
[   44.457700][ T5008] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[pid  5008] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5008] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5008] chdir("./file1")            = 0
[pid  5008] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5008] close(4)                    = 0
[pid  5008] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5008] creat("./file1", 0410)      = 4
[pid  5008] exit_group(0)               = ?
[pid  5008] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5008, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./5", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./5/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./5/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./5/binderfs")                  = 0
umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./5/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./5/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./5/file1")                      = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./5")                            = 0
mkdir("./6", 0777)                      = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5010
./strace-static-x86_64: Process 5010 attached
[pid  5010] chdir("./6")                = 0
[pid  5010] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5010] setpgid(0, 0)               = 0
[pid  5010] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5010] write(3, "1000", 4)         = 4
[pid  5010] close(3)                    = 0
[pid  5010] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5010] memfd_create("syzkaller", 0) = 3
[pid  5010] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5010] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5010] munmap(0x7f295dd73000, 262144) = 0
[pid  5010] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   44.473258][ T5008] EXT4-fs (loop0): 1 truncate cleaned up
[   44.479006][ T5008] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[   44.507631][ T4995] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[pid  5010] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5010] close(3)                    = 0
[pid  5010] mkdir("./file1", 0777)      = 0
[pid  5010] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5010] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5010] chdir("./file1")            = 0
[pid  5010] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5010] close(4)                    = 0
[pid  5010] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5010] creat("./file1", 0410)      = 4
[pid  5010] exit_group(0)               = ?
[pid  5010] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5010, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./6", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./6/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./6/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./6/binderfs")                  = 0
[   44.537112][ T5010] loop0: detected capacity change from 0 to 512
[   44.546050][ T5010] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   44.560214][ T5010] EXT4-fs (loop0): 1 truncate cleaned up
[   44.566211][ T5010] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./6/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./6/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./6/file1")                      = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./6")                            = 0
mkdir("./7", 0777)                      = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5012 attached
, child_tidptr=0x5555562e45d0) = 5012
[pid  5012] chdir("./7")                = 0
[pid  5012] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5012] setpgid(0, 0)               = 0
[pid  5012] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5012] write(3, "1000", 4)         = 4
[pid  5012] close(3)                    = 0
[pid  5012] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5012] memfd_create("syzkaller", 0) = 3
[pid  5012] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5012] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5012] munmap(0x7f295dd73000, 262144) = 0
[pid  5012] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   44.602789][ T4995] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[pid  5012] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5012] close(3)                    = 0
[pid  5012] mkdir("./file1", 0777)      = 0
[pid  5012] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5012] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5012] chdir("./file1")            = 0
[pid  5012] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5012] close(4)                    = 0
[pid  5012] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5012] creat("./file1", 0410)      = 4
[pid  5012] exit_group(0)               = ?
[pid  5012] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5012, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./7", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./7/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./7/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./7/binderfs")                  = 0
[   44.653261][ T5012] loop0: detected capacity change from 0 to 512
[   44.661681][ T5012] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   44.676541][ T5012] EXT4-fs (loop0): 1 truncate cleaned up
[   44.682370][ T5012] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./7/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./7/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./7/file1")                      = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./7")                            = 0
mkdir("./8", 0777)                      = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5014
./strace-static-x86_64: Process 5014 attached
[pid  5014] chdir("./8")                = 0
[pid  5014] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5014] setpgid(0, 0)               = 0
[pid  5014] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5014] write(3, "1000", 4)         = 4
[pid  5014] close(3)                    = 0
[pid  5014] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5014] memfd_create("syzkaller", 0) = 3
[pid  5014] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5014] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5014] munmap(0x7f295dd73000, 262144) = 0
[pid  5014] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5014] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5014] close(3)                    = 0
[pid  5014] mkdir("./file1", 0777)      = 0
[   44.713588][ T4995] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[   44.743725][ T5014] loop0: detected capacity change from 0 to 512
[pid  5014] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5014] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5014] chdir("./file1")            = 0
[pid  5014] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5014] close(4)                    = 0
[pid  5014] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5014] creat("./file1", 0410)      = 4
[pid  5014] exit_group(0)               = ?
[pid  5014] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5014, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
umount2("./8", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./8/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./8/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./8/binderfs")                  = 0
umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./8/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./8/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./8/file1")                      = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./8")                            = 0
mkdir("./9", 0777)                      = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5016
./strace-static-x86_64: Process 5016 attached
[pid  5016] chdir("./9")                = 0
[pid  5016] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5016] setpgid(0, 0)               = 0
[pid  5016] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5016] write(3, "1000", 4)         = 4
[pid  5016] close(3)                    = 0
[pid  5016] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5016] memfd_create("syzkaller", 0) = 3
[pid  5016] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5016] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5016] munmap(0x7f295dd73000, 262144) = 0
[pid  5016] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   44.753538][ T5014] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   44.768654][ T5014] EXT4-fs (loop0): 1 truncate cleaned up
[   44.774690][ T5014] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[   44.801095][ T4995] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[pid  5016] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5016] close(3)                    = 0
[pid  5016] mkdir("./file1", 0777)      = 0
[pid  5016] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5016] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5016] chdir("./file1")            = 0
[pid  5016] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5016] close(4)                    = 0
[pid  5016] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5016] creat("./file1", 0410)      = 4
[pid  5016] exit_group(0)               = ?
[pid  5016] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5016, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./9/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./9/binderfs")                  = 0
[   44.845108][ T5016] loop0: detected capacity change from 0 to 512
[   44.853901][ T5016] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   44.868085][ T5016] EXT4-fs (loop0): 1 truncate cleaned up
[   44.873938][ T5016] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./9/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./9/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./9/file1")                      = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./9")                            = 0
mkdir("./10", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5018
./strace-static-x86_64: Process 5018 attached
[pid  5018] chdir("./10")               = 0
[pid  5018] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5018] setpgid(0, 0)               = 0
[pid  5018] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5018] write(3, "1000", 4)         = 4
[pid  5018] close(3)                    = 0
[pid  5018] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5018] memfd_create("syzkaller", 0) = 3
[pid  5018] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5018] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5018] munmap(0x7f295dd73000, 262144) = 0
[pid  5018] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   44.903019][ T4995] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[pid  5018] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5018] close(3)                    = 0
[pid  5018] mkdir("./file1", 0777)      = 0
[pid  5018] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5018] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5018] chdir("./file1")            = 0
[pid  5018] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5018] close(4)                    = 0
[pid  5018] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5018] creat("./file1", 0410)      = 4
[pid  5018] exit_group(0)               = ?
[pid  5018] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5018, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./10/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./10/binderfs")                 = 0
[   44.944489][ T5018] loop0: detected capacity change from 0 to 512
[   44.954885][ T5018] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   44.969225][ T5018] EXT4-fs (loop0): 1 truncate cleaned up
[   44.974952][ T5018] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./10/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./10/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./10/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./10")                           = 0
mkdir("./11", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5020
./strace-static-x86_64: Process 5020 attached
[pid  5020] chdir("./11")               = 0
[pid  5020] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5020] setpgid(0, 0)               = 0
[pid  5020] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5020] write(3, "1000", 4)         = 4
[pid  5020] close(3)                    = 0
[pid  5020] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5020] memfd_create("syzkaller", 0) = 3
[pid  5020] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5020] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5020] munmap(0x7f295dd73000, 262144) = 0
[pid  5020] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5020] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5020] close(3)                    = 0
[pid  5020] mkdir("./file1", 0777)      = 0
[   45.008045][ T4995] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[   45.035623][ T5020] loop0: detected capacity change from 0 to 512
[   45.044338][ T5020] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[pid  5020] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5020] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5020] chdir("./file1")            = 0
[pid  5020] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5020] close(4)                    = 0
[pid  5020] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5020] creat("./file1", 0410)      = 4
[pid  5020] exit_group(0)               = ?
[pid  5020] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5020, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./11/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./11/binderfs")                 = 0
umount2("./11/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./11/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./11/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./11/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./11/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./11/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./11")                           = 0
mkdir("./12", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5022
./strace-static-x86_64: Process 5022 attached
[pid  5022] chdir("./12")               = 0
[pid  5022] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5022] setpgid(0, 0)               = 0
[pid  5022] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5022] write(3, "1000", 4)         = 4
[pid  5022] close(3)                    = 0
[pid  5022] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5022] memfd_create("syzkaller", 0) = 3
[pid  5022] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5022] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5022] munmap(0x7f295dd73000, 262144) = 0
[pid  5022] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   45.058589][ T5020] EXT4-fs (loop0): 1 truncate cleaned up
[   45.064313][ T5020] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[   45.085616][ T4995] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[pid  5022] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5022] close(3)                    = 0
[pid  5022] mkdir("./file1", 0777)      = 0
[pid  5022] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5022] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5022] chdir("./file1")            = 0
[pid  5022] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5022] close(4)                    = 0
[pid  5022] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5022] creat("./file1", 0410)      = 4
[pid  5022] exit_group(0)               = ?
[pid  5022] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5022, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./12", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./12/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./12/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./12/binderfs")                 = 0
[   45.114082][ T5022] loop0: detected capacity change from 0 to 512
[   45.123069][ T5022] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   45.137309][ T5022] EXT4-fs (loop0): 1 truncate cleaned up
[   45.143548][ T5022] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
umount2("./12/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./12/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./12/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./12/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./12/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./12/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./12")                           = 0
mkdir("./13", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5024
./strace-static-x86_64: Process 5024 attached
[pid  5024] chdir("./13")               = 0
[pid  5024] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5024] setpgid(0, 0)               = 0
[pid  5024] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5024] write(3, "1000", 4)         = 4
[pid  5024] close(3)                    = 0
[pid  5024] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5024] memfd_create("syzkaller", 0) = 3
[pid  5024] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5024] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5024] munmap(0x7f295dd73000, 262144) = 0
[pid  5024] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5024] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5024] close(3)                    = 0
[pid  5024] mkdir("./file1", 0777)      = 0
[   45.166100][ T4995] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[   45.202259][ T5024] loop0: detected capacity change from 0 to 512
[pid  5024] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5024] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5024] chdir("./file1")            = 0
[pid  5024] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5024] close(4)                    = 0
[pid  5024] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5024] creat("./file1", 0410)      = 4
[pid  5024] exit_group(0)               = ?
[pid  5024] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5024, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
umount2("./13", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./13/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./13/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./13/binderfs")                 = 0
umount2("./13/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./13/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./13/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./13/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./13/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./13/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./13")                           = 0
mkdir("./14", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5026
./strace-static-x86_64: Process 5026 attached
[pid  5026] chdir("./14")               = 0
[pid  5026] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5026] setpgid(0, 0)               = 0
[pid  5026] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5026] write(3, "1000", 4)         = 4
[pid  5026] close(3)                    = 0
[pid  5026] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5026] memfd_create("syzkaller", 0) = 3
[pid  5026] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5026] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5026] munmap(0x7f295dd73000, 262144) = 0
[pid  5026] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   45.211709][ T5024] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   45.225745][ T5024] EXT4-fs (loop0): 1 truncate cleaned up
[   45.231492][ T5024] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[   45.253339][ T4995] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[pid  5026] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5026] close(3)                    = 0
[pid  5026] mkdir("./file1", 0777)      = 0
[pid  5026] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5026] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5026] chdir("./file1")            = 0
[pid  5026] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5026] close(4)                    = 0
[pid  5026] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5026] creat("./file1", 0410)      = 4
[pid  5026] exit_group(0)               = ?
[pid  5026] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5026, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./14", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./14/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./14/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./14/binderfs")                 = 0
[   45.296773][ T5026] loop0: detected capacity change from 0 to 512
[   45.306868][ T5026] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   45.320880][ T5026] EXT4-fs (loop0): 1 truncate cleaned up
[   45.326525][ T5026] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
umount2("./14/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./14/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./14/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./14/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./14/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./14/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./14")                           = 0
mkdir("./15", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5028
./strace-static-x86_64: Process 5028 attached
[pid  5028] chdir("./15")               = 0
[pid  5028] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5028] setpgid(0, 0)               = 0
[pid  5028] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5028] write(3, "1000", 4)         = 4
[pid  5028] close(3)                    = 0
[pid  5028] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5028] memfd_create("syzkaller", 0) = 3
[pid  5028] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5028] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5028] munmap(0x7f295dd73000, 262144) = 0
[pid  5028] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5028] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5028] close(3)                    = 0
[pid  5028] mkdir("./file1", 0777)      = 0
[   45.358795][ T4995] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[   45.387178][ T5028] loop0: detected capacity change from 0 to 512
[   45.395534][ T5028] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[pid  5028] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5028] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5028] chdir("./file1")            = 0
[pid  5028] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5028] close(4)                    = 0
[pid  5028] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5028] creat("./file1", 0410)      = 4
[pid  5028] exit_group(0)               = ?
[pid  5028] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5028, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./15", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./15/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./15/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./15/binderfs")                 = 0
umount2("./15/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./15/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./15/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./15/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./15/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./15/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./15")                           = 0
mkdir("./16", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5030 attached
 <unfinished ...>
[pid  5030] chdir("./16")               = 0
[pid  5030] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5030] setpgid(0, 0)               = 0
[pid  5030] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5030] write(3, "1000", 4)         = 4
[pid  5030] close(3)                    = 0
[pid  5030] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5030] memfd_create("syzkaller", 0) = 3
[pid  5030] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5030] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 <unfinished ...>
[pid  4995] <... clone resumed>, child_tidptr=0x5555562e45d0) = 5030
[pid  5030] <... write resumed>)        = 262144
[pid  5030] munmap(0x7f295dd73000, 262144) = 0
[   45.409587][ T5028] EXT4-fs (loop0): 1 truncate cleaned up
[   45.415542][ T5028] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[   45.449285][ T4995] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[pid  5030] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5030] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5030] close(3)                    = 0
[pid  5030] mkdir("./file1", 0777)      = 0
[pid  5030] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5030] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5030] chdir("./file1")            = 0
[pid  5030] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5030] close(4)                    = 0
[pid  5030] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5030] creat("./file1", 0410)      = 4
[pid  5030] exit_group(0)               = ?
[pid  5030] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5030, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
umount2("./16", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./16/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./16/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./16/binderfs")                 = 0
[   45.490908][ T5030] loop0: detected capacity change from 0 to 512
[   45.500322][ T5030] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   45.515168][ T5030] EXT4-fs (loop0): 1 truncate cleaned up
[   45.520896][ T5030] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
umount2("./16/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./16/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./16/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./16/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./16/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./16/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./16")                           = 0
mkdir("./17", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5032 attached
 <unfinished ...>
[pid  5032] chdir("./17")               = 0
[pid  5032] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5032] setpgid(0, 0)               = 0
[pid  5032] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5032] write(3, "1000", 4)         = 4
[pid  5032] close(3)                    = 0
[pid  5032] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5032] memfd_create("syzkaller", 0 <unfinished ...>
[pid  4995] <... clone resumed>, child_tidptr=0x5555562e45d0) = 5032
[pid  5032] <... memfd_create resumed>) = 3
[pid  5032] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5032] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5032] munmap(0x7f295dd73000, 262144) = 0
[pid  5032] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   45.545798][ T4995] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[pid  5032] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5032] close(3)                    = 0
[pid  5032] mkdir("./file1", 0777)      = 0
[pid  5032] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5032] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5032] chdir("./file1")            = 0
[pid  5032] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5032] close(4)                    = 0
[pid  5032] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5032] creat("./file1", 0410)      = 4
[pid  5032] exit_group(0)               = ?
[pid  5032] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5032, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./17", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./17/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./17/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./17/binderfs")                 = 0
[   45.586734][ T5032] loop0: detected capacity change from 0 to 512
[   45.596716][ T5032] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   45.610667][ T5032] EXT4-fs (loop0): 1 truncate cleaned up
[   45.616532][ T5032] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
umount2("./17/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./17/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./17/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./17/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./17/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./17/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./17")                           = 0
mkdir("./18", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5034
./strace-static-x86_64: Process 5034 attached
[pid  5034] chdir("./18")               = 0
[pid  5034] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5034] setpgid(0, 0)               = 0
[pid  5034] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5034] write(3, "1000", 4)         = 4
[pid  5034] close(3)                    = 0
[pid  5034] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5034] memfd_create("syzkaller", 0) = 3
[pid  5034] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5034] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5034] munmap(0x7f295dd73000, 262144) = 0
[pid  5034] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   45.651322][ T4995] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[pid  5034] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5034] close(3)                    = 0
[pid  5034] mkdir("./file1", 0777)      = 0
[pid  5034] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5034] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5034] chdir("./file1")            = 0
[pid  5034] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5034] close(4)                    = 0
[pid  5034] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5034] creat("./file1", 0410)      = 4
[pid  5034] exit_group(0)               = ?
[pid  5034] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5034, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
umount2("./18", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./18/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./18/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./18/binderfs")                 = 0
[   45.696927][ T5034] loop0: detected capacity change from 0 to 512
[   45.705499][ T5034] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   45.720401][ T5034] EXT4-fs (loop0): 1 truncate cleaned up
[   45.726163][ T5034] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
umount2("./18/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./18/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./18/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./18/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./18/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./18/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./18")                           = 0
mkdir("./19", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5036
./strace-static-x86_64: Process 5036 attached
[pid  5036] chdir("./19")               = 0
[pid  5036] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5036] setpgid(0, 0)               = 0
[pid  5036] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5036] write(3, "1000", 4)         = 4
[pid  5036] close(3)                    = 0
[pid  5036] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5036] memfd_create("syzkaller", 0) = 3
[pid  5036] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5036] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5036] munmap(0x7f295dd73000, 262144) = 0
[pid  5036] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   45.760825][ T4995] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[pid  5036] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5036] close(3)                    = 0
[pid  5036] mkdir("./file1", 0777)      = 0
[pid  5036] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5036] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5036] chdir("./file1")            = 0
[pid  5036] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5036] close(4)                    = 0
[pid  5036] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5036] creat("./file1", 0410)      = 4
[pid  5036] exit_group(0)               = ?
[pid  5036] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5036, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./19", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./19/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./19/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./19/binderfs")                 = 0
[   45.810054][ T5036] loop0: detected capacity change from 0 to 512
[   45.819336][ T5036] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   45.833506][ T5036] EXT4-fs (loop0): 1 truncate cleaned up
[   45.839158][ T5036] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
umount2("./19/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./19/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./19/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./19/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./19/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./19/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./19")                           = 0
mkdir("./20", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5038
./strace-static-x86_64: Process 5038 attached
[pid  5038] chdir("./20")               = 0
[pid  5038] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5038] setpgid(0, 0)               = 0
[pid  5038] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5038] write(3, "1000", 4)         = 4
[pid  5038] close(3)                    = 0
[pid  5038] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5038] memfd_create("syzkaller", 0) = 3
[pid  5038] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5038] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5038] munmap(0x7f295dd73000, 262144) = 0
[pid  5038] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   45.875986][ T4995] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[pid  5038] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5038] close(3)                    = 0
[pid  5038] mkdir("./file1", 0777)      = 0
[pid  5038] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5038] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5038] chdir("./file1")            = 0
[pid  5038] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5038] close(4)                    = 0
[pid  5038] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5038] creat("./file1", 0410)      = 4
[pid  5038] exit_group(0)               = ?
[pid  5038] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5038, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./20", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./20", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./20/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./20/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./20/binderfs")                 = 0
[   45.924521][ T5038] loop0: detected capacity change from 0 to 512
[   45.934148][ T5038] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   45.948300][ T5038] EXT4-fs (loop0): 1 truncate cleaned up
[   45.954105][ T5038] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
umount2("./20/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./20/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./20/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./20/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./20/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./20/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./20")                           = 0
mkdir("./21", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5040
./strace-static-x86_64: Process 5040 attached
[pid  5040] chdir("./21")               = 0
[pid  5040] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5040] setpgid(0, 0)               = 0
[pid  5040] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5040] write(3, "1000", 4)         = 4
[pid  5040] close(3)                    = 0
[pid  5040] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5040] memfd_create("syzkaller", 0) = 3
[pid  5040] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5040] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5040] munmap(0x7f295dd73000, 262144) = 0
[pid  5040] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5040] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5040] close(3)                    = 0
[pid  5040] mkdir("./file1", 0777)      = 0
[   45.990901][ T4995] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[   46.019013][ T5040] loop0: detected capacity change from 0 to 512
[   46.027400][ T5040] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[pid  5040] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5040] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5040] chdir("./file1")            = 0
[pid  5040] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5040] close(4)                    = 0
[pid  5040] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5040] creat("./file1", 0410)      = 4
[pid  5040] exit_group(0)               = ?
[pid  5040] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5040, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
umount2("./21", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./21", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./21/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./21/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./21/binderfs")                 = 0
umount2("./21/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./21/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./21/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./21/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./21/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./21/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./21")                           = 0
mkdir("./22", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5042
./strace-static-x86_64: Process 5042 attached
[pid  5042] chdir("./22")               = 0
[pid  5042] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5042] setpgid(0, 0)               = 0
[pid  5042] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5042] write(3, "1000", 4)         = 4
[pid  5042] close(3)                    = 0
[pid  5042] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5042] memfd_create("syzkaller", 0) = 3
[pid  5042] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5042] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5042] munmap(0x7f295dd73000, 262144) = 0
[pid  5042] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   46.042710][ T5040] EXT4-fs (loop0): 1 truncate cleaned up
[   46.048455][ T5040] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[   46.070239][ T4995] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[pid  5042] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5042] close(3)                    = 0
[pid  5042] mkdir("./file1", 0777)      = 0
[pid  5042] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5042] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5042] chdir("./file1")            = 0
[pid  5042] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5042] close(4)                    = 0
[pid  5042] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5042] creat("./file1", 0410)      = 4
[pid  5042] exit_group(0)               = ?
[pid  5042] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5042, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
umount2("./22", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./22", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./22/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./22/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./22/binderfs")                 = 0
[   46.116024][ T5042] loop0: detected capacity change from 0 to 512
[   46.125478][ T5042] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   46.139702][ T5042] EXT4-fs (loop0): 1 truncate cleaned up
[   46.145521][ T5042] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
umount2("./22/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./22/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./22/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./22/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./22/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./22/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./22")                           = 0
mkdir("./23", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5044
./strace-static-x86_64: Process 5044 attached
[pid  5044] chdir("./23")               = 0
[pid  5044] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5044] setpgid(0, 0)               = 0
[pid  5044] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5044] write(3, "1000", 4)         = 4
[pid  5044] close(3)                    = 0
[pid  5044] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5044] memfd_create("syzkaller", 0) = 3
[pid  5044] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5044] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5044] munmap(0x7f295dd73000, 262144) = 0
[pid  5044] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   46.174439][ T4995] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[pid  5044] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5044] close(3)                    = 0
[pid  5044] mkdir("./file1", 0777)      = 0
[pid  5044] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5044] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5044] chdir("./file1")            = 0
[pid  5044] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5044] close(4)                    = 0
[pid  5044] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5044] creat("./file1", 0410)      = 4
[pid  5044] exit_group(0)               = ?
[pid  5044] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5044, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
umount2("./23", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./23", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./23/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./23/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./23/binderfs")                 = 0
[   46.220351][ T5044] loop0: detected capacity change from 0 to 512
[   46.230401][ T5044] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   46.244591][ T5044] EXT4-fs (loop0): 1 truncate cleaned up
[   46.250253][ T5044] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
umount2("./23/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./23/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./23/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./23/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./23/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./23/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./23")                           = 0
mkdir("./24", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5046
./strace-static-x86_64: Process 5046 attached
[pid  5046] chdir("./24")               = 0
[pid  5046] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5046] setpgid(0, 0)               = 0
[pid  5046] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5046] write(3, "1000", 4)         = 4
[pid  5046] close(3)                    = 0
[pid  5046] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5046] memfd_create("syzkaller", 0) = 3
[pid  5046] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5046] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5046] munmap(0x7f295dd73000, 262144) = 0
[pid  5046] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5046] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5046] close(3)                    = 0
[pid  5046] mkdir("./file1", 0777)      = 0
[   46.280124][ T4995] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[   46.308705][ T5046] loop0: detected capacity change from 0 to 512
[pid  5046] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5046] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5046] chdir("./file1")            = 0
[pid  5046] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5046] close(4)                    = 0
[pid  5046] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5046] creat("./file1", 0410)      = 4
[pid  5046] exit_group(0)               = ?
[pid  5046] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5046, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
umount2("./24", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./24", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./24/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./24/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./24/binderfs")                 = 0
umount2("./24/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./24/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./24/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./24/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./24/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./24/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./24")                           = 0
mkdir("./25", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5048
./strace-static-x86_64: Process 5048 attached
[pid  5048] chdir("./25")               = 0
[pid  5048] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5048] setpgid(0, 0)               = 0
[pid  5048] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5048] write(3, "1000", 4)         = 4
[pid  5048] close(3)                    = 0
[pid  5048] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5048] memfd_create("syzkaller", 0) = 3
[pid  5048] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5048] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5048] munmap(0x7f295dd73000, 262144) = 0
[pid  5048] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   46.319850][ T5046] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   46.334563][ T5046] EXT4-fs (loop0): 1 truncate cleaned up
[   46.340365][ T5046] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[   46.368012][ T4995] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[pid  5048] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5048] close(3)                    = 0
[pid  5048] mkdir("./file1", 0777)      = 0
[pid  5048] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5048] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5048] chdir("./file1")            = 0
[pid  5048] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5048] close(4)                    = 0
[pid  5048] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5048] creat("./file1", 0410)      = 4
[pid  5048] exit_group(0)               = ?
[pid  5048] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5048, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
umount2("./25", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./25", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./25/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./25/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./25/binderfs")                 = 0
[   46.407258][ T5048] loop0: detected capacity change from 0 to 512
[   46.419345][ T5048] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   46.433623][ T5048] EXT4-fs (loop0): 1 truncate cleaned up
[   46.439394][ T5048] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
umount2("./25/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./25/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./25/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./25/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./25/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./25/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./25")                           = 0
mkdir("./26", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5050
./strace-static-x86_64: Process 5050 attached
[pid  5050] chdir("./26")               = 0
[pid  5050] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5050] setpgid(0, 0)               = 0
[pid  5050] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5050] write(3, "1000", 4)         = 4
[pid  5050] close(3)                    = 0
[pid  5050] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5050] memfd_create("syzkaller", 0) = 3
[pid  5050] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5050] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5050] munmap(0x7f295dd73000, 262144) = 0
[pid  5050] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5050] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5050] close(3)                    = 0
[pid  5050] mkdir("./file1", 0777)      = 0
[   46.465479][ T4995] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[   46.493018][ T5050] loop0: detected capacity change from 0 to 512
[   46.502172][ T5050] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[pid  5050] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5050] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5050] chdir("./file1")            = 0
[pid  5050] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5050] close(4)                    = 0
[pid  5050] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5050] creat("./file1", 0410)      = 4
[pid  5050] exit_group(0)               = ?
[pid  5050] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5050, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./26", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./26", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./26/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./26/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./26/binderfs")                 = 0
umount2("./26/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./26/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./26/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./26/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./26/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./26/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./26")                           = 0
mkdir("./27", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5052
./strace-static-x86_64: Process 5052 attached
[pid  5052] chdir("./27")               = 0
[pid  5052] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5052] setpgid(0, 0)               = 0
[pid  5052] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5052] write(3, "1000", 4)         = 4
[pid  5052] close(3)                    = 0
[pid  5052] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5052] memfd_create("syzkaller", 0) = 3
[pid  5052] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5052] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5052] munmap(0x7f295dd73000, 262144) = 0
[pid  5052] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   46.515932][ T5050] EXT4-fs (loop0): 1 truncate cleaned up
[   46.521876][ T5050] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[   46.550664][ T4995] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[pid  5052] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5052] close(3)                    = 0
[pid  5052] mkdir("./file1", 0777)      = 0
[pid  5052] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5052] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5052] chdir("./file1")            = 0
[pid  5052] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5052] close(4)                    = 0
[pid  5052] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5052] creat("./file1", 0410)      = 4
[pid  5052] exit_group(0)               = ?
[pid  5052] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5052, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./27", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./27", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./27/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./27/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./27/binderfs")                 = 0
[   46.578631][ T5052] loop0: detected capacity change from 0 to 512
[   46.587040][ T5052] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   46.601004][ T5052] EXT4-fs (loop0): 1 truncate cleaned up
[   46.606688][ T5052] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
umount2("./27/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./27/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./27/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./27/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./27/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./27/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./27")                           = 0
mkdir("./28", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5054 attached
, child_tidptr=0x5555562e45d0) = 5054
[pid  5054] chdir("./28")               = 0
[pid  5054] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5054] setpgid(0, 0)               = 0
[pid  5054] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5054] write(3, "1000", 4)         = 4
[pid  5054] close(3)                    = 0
[pid  5054] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5054] memfd_create("syzkaller", 0) = 3
[pid  5054] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5054] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5054] munmap(0x7f295dd73000, 262144) = 0
[pid  5054] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   46.639439][ T4995] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[pid  5054] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5054] close(3)                    = 0
[pid  5054] mkdir("./file1", 0777)      = 0
[pid  5054] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5054] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5054] chdir("./file1")            = 0
[pid  5054] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5054] close(4)                    = 0
[pid  5054] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5054] creat("./file1", 0410)      = 4
[pid  5054] exit_group(0)               = ?
[pid  5054] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5054, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
umount2("./28", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./28", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./28/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./28/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./28/binderfs")                 = 0
[   46.693186][ T5054] loop0: detected capacity change from 0 to 512
[   46.701776][ T5054] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   46.715890][ T5054] EXT4-fs (loop0): 1 truncate cleaned up
[   46.721638][ T5054] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
umount2("./28/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./28/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./28/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./28/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./28/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./28/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./28")                           = 0
mkdir("./29", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5056
./strace-static-x86_64: Process 5056 attached
[pid  5056] chdir("./29")               = 0
[pid  5056] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5056] setpgid(0, 0)               = 0
[pid  5056] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5056] write(3, "1000", 4)         = 4
[pid  5056] close(3)                    = 0
[pid  5056] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5056] memfd_create("syzkaller", 0) = 3
[pid  5056] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5056] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5056] munmap(0x7f295dd73000, 262144) = 0
[pid  5056] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5056] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5056] close(3)                    = 0
[pid  5056] mkdir("./file1", 0777)      = 0
[   46.755251][ T4995] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[   46.785279][ T5056] loop0: detected capacity change from 0 to 512
[pid  5056] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5056] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5056] chdir("./file1")            = 0
[pid  5056] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5056] close(4)                    = 0
[pid  5056] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5056] creat("./file1", 0410)      = 4
[pid  5056] exit_group(0)               = ?
[pid  5056] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5056, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
umount2("./29", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./29", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./29/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./29/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./29/binderfs")                 = 0
umount2("./29/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./29/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./29/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./29/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./29/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./29/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./29")                           = 0
mkdir("./30", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5058
./strace-static-x86_64: Process 5058 attached
[pid  5058] chdir("./30")               = 0
[pid  5058] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5058] setpgid(0, 0)               = 0
[pid  5058] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5058] write(3, "1000", 4)         = 4
[pid  5058] close(3)                    = 0
[pid  5058] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5058] memfd_create("syzkaller", 0) = 3
[pid  5058] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5058] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[   46.794579][ T5056] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   46.808945][ T5056] EXT4-fs (loop0): 1 truncate cleaned up
[   46.814918][ T5056] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[   46.839542][ T4995] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[pid  5058] munmap(0x7f295dd73000, 262144) = 0
[pid  5058] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5058] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5058] close(3)                    = 0
[pid  5058] mkdir("./file1", 0777)      = 0
[pid  5058] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5058] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5058] chdir("./file1")            = 0
[pid  5058] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5058] close(4)                    = 0
[pid  5058] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5058] creat("./file1", 0410)      = 4
[pid  5058] exit_group(0)               = ?
[pid  5058] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5058, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
umount2("./30", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./30", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
[   46.888109][ T5058] loop0: detected capacity change from 0 to 512
[   46.898420][ T5058] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   46.913435][ T5058] EXT4-fs (loop0): 1 truncate cleaned up
[   46.919260][ T5058] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
umount2("./30/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./30/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./30/binderfs")                 = 0
umount2("./30/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./30/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./30/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./30/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./30/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./30/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./30")                           = 0
mkdir("./31", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5060
./strace-static-x86_64: Process 5060 attached
[pid  5060] chdir("./31")               = 0
[pid  5060] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5060] setpgid(0, 0)               = 0
[pid  5060] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5060] write(3, "1000", 4)         = 4
[pid  5060] close(3)                    = 0
[pid  5060] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5060] memfd_create("syzkaller", 0) = 3
[pid  5060] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5060] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5060] munmap(0x7f295dd73000, 262144) = 0
[pid  5060] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   46.953249][ T4995] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[pid  5060] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5060] close(3)                    = 0
[pid  5060] mkdir("./file1", 0777)      = 0
[pid  5060] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5060] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5060] chdir("./file1")            = 0
[pid  5060] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5060] close(4)                    = 0
[pid  5060] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5060] creat("./file1", 0410)      = 4
[pid  5060] exit_group(0)               = ?
[pid  5060] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5060, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./31", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./31", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./31/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./31/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./31/binderfs")                 = 0
[   47.004257][ T5060] loop0: detected capacity change from 0 to 512
[   47.013481][ T5060] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   47.027340][ T5060] EXT4-fs (loop0): 1 truncate cleaned up
[   47.033424][ T5060] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
umount2("./31/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./31/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./31/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./31/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./31/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./31/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./31")                           = 0
mkdir("./32", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5062 attached
, child_tidptr=0x5555562e45d0) = 5062
[pid  5062] chdir("./32")               = 0
[pid  5062] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5062] setpgid(0, 0)               = 0
[pid  5062] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5062] write(3, "1000", 4)         = 4
[pid  5062] close(3)                    = 0
[pid  5062] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5062] memfd_create("syzkaller", 0) = 3
[pid  5062] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5062] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5062] munmap(0x7f295dd73000, 262144) = 0
[pid  5062] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   47.067434][ T4995] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[pid  5062] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5062] close(3)                    = 0
[pid  5062] mkdir("./file1", 0777)      = 0
[pid  5062] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5062] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5062] chdir("./file1")            = 0
[pid  5062] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5062] close(4)                    = 0
[pid  5062] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5062] creat("./file1", 0410)      = 4
[pid  5062] exit_group(0)               = ?
[pid  5062] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5062, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./32", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./32", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./32/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./32/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./32/binderfs")                 = 0
umount2("./32/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./32/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./32/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./32/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./32/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./32/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./32")                           = 0
mkdir("./33", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5064
./strace-static-x86_64: Process 5064 attached
[pid  5064] chdir("./33")               = 0
[pid  5064] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5064] setpgid(0, 0)               = 0
[pid  5064] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5064] write(3, "1000", 4)         = 4
[pid  5064] close(3)                    = 0
[pid  5064] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5064] memfd_create("syzkaller", 0) = 3
[pid  5064] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5064] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5064] munmap(0x7f295dd73000, 262144) = 0
[pid  5064] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   47.115863][ T5062] loop0: detected capacity change from 0 to 512
[   47.125763][ T5062] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   47.140227][ T5062] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5064] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5064] close(3)                    = 0
[pid  5064] mkdir("./file1", 0777)      = 0
[pid  5064] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5064] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5064] chdir("./file1")            = 0
[pid  5064] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5064] close(4)                    = 0
[pid  5064] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5064] creat("./file1", 0410)      = 4
[pid  5064] exit_group(0)               = ?
[pid  5064] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5064, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./33", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./33", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./33/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./33/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./33/binderfs")                 = 0
umount2("./33/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./33/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./33/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./33/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./33/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./33/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./33")                           = 0
mkdir("./34", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5066
./strace-static-x86_64: Process 5066 attached
[pid  5066] chdir("./34")               = 0
[pid  5066] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5066] setpgid(0, 0)               = 0
[pid  5066] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5066] write(3, "1000", 4)         = 4
[pid  5066] close(3)                    = 0
[pid  5066] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5066] memfd_create("syzkaller", 0) = 3
[pid  5066] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[   47.194002][ T5064] loop0: detected capacity change from 0 to 512
[   47.203897][ T5064] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   47.218368][ T5064] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5066] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5066] munmap(0x7f295dd73000, 262144) = 0
[pid  5066] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5066] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5066] close(3)                    = 0
[pid  5066] mkdir("./file1", 0777)      = 0
[pid  5066] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5066] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5066] chdir("./file1")            = 0
[pid  5066] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5066] close(4)                    = 0
[pid  5066] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5066] creat("./file1", 0410)      = 4
[pid  5066] exit_group(0)               = ?
[pid  5066] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5066, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
umount2("./34", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./34", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./34/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./34/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./34/binderfs")                 = 0
umount2("./34/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./34/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./34/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./34/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./34/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./34/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./34")                           = 0
mkdir("./35", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5068
./strace-static-x86_64: Process 5068 attached
[pid  5068] chdir("./35")               = 0
[pid  5068] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5068] setpgid(0, 0)               = 0
[pid  5068] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5068] write(3, "1000", 4)         = 4
[pid  5068] close(3)                    = 0
[pid  5068] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5068] memfd_create("syzkaller", 0) = 3
[pid  5068] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[   47.281706][ T5066] loop0: detected capacity change from 0 to 512
[   47.290355][ T5066] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   47.304790][ T5066] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5068] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5068] munmap(0x7f295dd73000, 262144) = 0
[pid  5068] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5068] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5068] close(3)                    = 0
[pid  5068] mkdir("./file1", 0777)      = 0
[pid  5068] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5068] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5068] chdir("./file1")            = 0
[pid  5068] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5068] close(4)                    = 0
[pid  5068] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5068] creat("./file1", 0410)      = 4
[pid  5068] exit_group(0)               = ?
[pid  5068] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5068, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./35", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./35", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./35/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./35/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./35/binderfs")                 = 0
umount2("./35/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./35/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./35/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./35/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./35/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./35/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./35")                           = 0
mkdir("./36", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5070
./strace-static-x86_64: Process 5070 attached
[pid  5070] chdir("./36")               = 0
[pid  5070] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5070] setpgid(0, 0)               = 0
[pid  5070] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5070] write(3, "1000", 4)         = 4
[pid  5070] close(3)                    = 0
[   47.368096][ T5068] loop0: detected capacity change from 0 to 512
[   47.377238][ T5068] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   47.391992][ T5068] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5070] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5070] memfd_create("syzkaller", 0) = 3
[pid  5070] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5070] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5070] munmap(0x7f295dd73000, 262144) = 0
[pid  5070] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5070] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5070] close(3)                    = 0
[pid  5070] mkdir("./file1", 0777)      = 0
[pid  5070] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5070] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5070] chdir("./file1")            = 0
[pid  5070] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5070] close(4)                    = 0
[pid  5070] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5070] creat("./file1", 0410)      = 4
[pid  5070] exit_group(0)               = ?
[pid  5070] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5070, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./36", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./36", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./36/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./36/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./36/binderfs")                 = 0
umount2("./36/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./36/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./36/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./36/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./36/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./36/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./36")                           = 0
mkdir("./37", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5072 attached
 <unfinished ...>
[pid  5072] chdir("./37")               = 0
[pid  5072] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5072] setpgid(0, 0)               = 0
[pid  5072] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5072] write(3, "1000", 4)         = 4
[pid  5072] close(3)                    = 0
[pid  5072] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5072] memfd_create("syzkaller", 0) = 3
[pid  5072] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  4995] <... clone resumed>, child_tidptr=0x5555562e45d0) = 5072
[pid  5072] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5072] munmap(0x7f295dd73000, 262144) = 0
[   47.455866][ T5070] loop0: detected capacity change from 0 to 512
[   47.464669][ T5070] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   47.478633][ T5070] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5072] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5072] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5072] close(3)                    = 0
[pid  5072] mkdir("./file1", 0777)      = 0
[pid  5072] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5072] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5072] chdir("./file1")            = 0
[pid  5072] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5072] close(4)                    = 0
[pid  5072] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5072] creat("./file1", 0410)      = 4
[pid  5072] exit_group(0)               = ?
[pid  5072] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5072, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./37", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./37", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./37/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./37/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./37/binderfs")                 = 0
umount2("./37/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./37/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./37/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./37/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./37/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./37/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./37")                           = 0
mkdir("./38", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5074
./strace-static-x86_64: Process 5074 attached
[pid  5074] chdir("./38")               = 0
[pid  5074] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5074] setpgid(0, 0)               = 0
[pid  5074] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5074] write(3, "1000", 4)         = 4
[pid  5074] close(3)                    = 0
[pid  5074] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5074] memfd_create("syzkaller", 0) = 3
[pid  5074] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5074] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[   47.537761][ T5072] loop0: detected capacity change from 0 to 512
[   47.546846][ T5072] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   47.562209][ T5072] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5074] munmap(0x7f295dd73000, 262144) = 0
[pid  5074] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5074] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5074] close(3)                    = 0
[pid  5074] mkdir("./file1", 0777)      = 0
[pid  5074] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5074] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5074] chdir("./file1")            = 0
[pid  5074] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5074] close(4)                    = 0
[pid  5074] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5074] creat("./file1", 0410)      = 4
[pid  5074] exit_group(0)               = ?
[pid  5074] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5074, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
umount2("./38", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./38", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./38/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./38/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./38/binderfs")                 = 0
umount2("./38/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./38/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./38/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./38/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./38/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./38/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./38")                           = 0
mkdir("./39", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
[   47.620227][ T5074] loop0: detected capacity change from 0 to 512
[   47.629106][ T5074] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   47.643562][ T5074] EXT4-fs (loop0): 1 truncate cleaned up
ioctl(3, LOOP_CLR_FD)                   = 0
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5076
./strace-static-x86_64: Process 5076 attached
[pid  5076] chdir("./39")               = 0
[pid  5076] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5076] setpgid(0, 0)               = 0
[pid  5076] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5076] write(3, "1000", 4)         = 4
[pid  5076] close(3)                    = 0
[pid  5076] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5076] memfd_create("syzkaller", 0) = 3
[pid  5076] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5076] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5076] munmap(0x7f295dd73000, 262144) = 0
[pid  5076] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5076] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5076] close(3)                    = 0
[pid  5076] mkdir("./file1", 0777)      = 0
[pid  5076] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5076] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5076] chdir("./file1")            = 0
[pid  5076] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5076] close(4)                    = 0
[pid  5076] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5076] creat("./file1", 0410)      = 4
[pid  5076] exit_group(0)               = ?
[pid  5076] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5076, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./39", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./39", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./39/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./39/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./39/binderfs")                 = 0
umount2("./39/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./39/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./39/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./39/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./39/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./39/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./39")                           = 0
mkdir("./40", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5078
./strace-static-x86_64: Process 5078 attached
[   47.738619][ T5076] loop0: detected capacity change from 0 to 512
[   47.747347][ T5076] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   47.762411][ T5076] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5078] chdir("./40")               = 0
[pid  5078] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5078] setpgid(0, 0)               = 0
[pid  5078] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5078] write(3, "1000", 4)         = 4
[pid  5078] close(3)                    = 0
[pid  5078] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5078] memfd_create("syzkaller", 0) = 3
[pid  5078] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5078] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5078] munmap(0x7f295dd73000, 262144) = 0
[pid  5078] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5078] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5078] close(3)                    = 0
[pid  5078] mkdir("./file1", 0777)      = 0
[pid  5078] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5078] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5078] chdir("./file1")            = 0
[pid  5078] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5078] close(4)                    = 0
[pid  5078] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5078] creat("./file1", 0410)      = 4
[pid  5078] exit_group(0)               = ?
[pid  5078] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5078, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
umount2("./40", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./40", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./40/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./40/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./40/binderfs")                 = 0
umount2("./40/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./40/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./40/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./40/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./40/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./40/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./40")                           = 0
mkdir("./41", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5080 attached
, child_tidptr=0x5555562e45d0) = 5080
[pid  5080] chdir("./41")               = 0
[pid  5080] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5080] setpgid(0, 0)               = 0
[pid  5080] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5080] write(3, "1000", 4)         = 4
[pid  5080] close(3)                    = 0
[pid  5080] symlink("/dev/binderfs", "./binderfs") = 0
[   47.831104][ T5078] loop0: detected capacity change from 0 to 512
[   47.840300][ T5078] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   47.855914][ T5078] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5080] memfd_create("syzkaller", 0) = 3
[pid  5080] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5080] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5080] munmap(0x7f295dd73000, 262144) = 0
[pid  5080] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5080] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5080] close(3)                    = 0
[pid  5080] mkdir("./file1", 0777)      = 0
[pid  5080] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5080] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5080] chdir("./file1")            = 0
[pid  5080] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5080] close(4)                    = 0
[pid  5080] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5080] creat("./file1", 0410)      = 4
[pid  5080] exit_group(0)               = ?
[pid  5080] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5080, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./41", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./41", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./41/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./41/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./41/binderfs")                 = 0
umount2("./41/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./41/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./41/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./41/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./41/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./41/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./41")                           = 0
mkdir("./42", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5082 attached
, child_tidptr=0x5555562e45d0) = 5082
[pid  5082] chdir("./42")               = 0
[pid  5082] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5082] setpgid(0, 0)               = 0
[pid  5082] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5082] write(3, "1000", 4)         = 4
[pid  5082] close(3)                    = 0
[pid  5082] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5082] memfd_create("syzkaller", 0) = 3
[pid  5082] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5082] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5082] munmap(0x7f295dd73000, 262144) = 0
[pid  5082] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   47.921175][ T5080] loop0: detected capacity change from 0 to 512
[   47.931371][ T5080] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   47.945540][ T5080] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5082] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5082] close(3)                    = 0
[pid  5082] mkdir("./file1", 0777)      = 0
[pid  5082] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5082] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5082] chdir("./file1")            = 0
[pid  5082] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5082] close(4)                    = 0
[pid  5082] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5082] creat("./file1", 0410)      = 4
[pid  5082] exit_group(0)               = ?
[pid  5082] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5082, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
umount2("./42", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./42", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./42/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./42/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./42/binderfs")                 = 0
umount2("./42/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./42/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./42/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./42/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./42/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./42/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./42")                           = 0
mkdir("./43", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5084 attached
, child_tidptr=0x5555562e45d0) = 5084
[pid  5084] chdir("./43")               = 0
[pid  5084] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5084] setpgid(0, 0)               = 0
[pid  5084] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5084] write(3, "1000", 4)         = 4
[pid  5084] close(3)                    = 0
[pid  5084] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5084] memfd_create("syzkaller", 0) = 3
[pid  5084] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5084] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5084] munmap(0x7f295dd73000, 262144) = 0
[pid  5084] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   47.998701][ T5082] loop0: detected capacity change from 0 to 512
[   48.007196][ T5082] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   48.021303][ T5082] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5084] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5084] close(3)                    = 0
[pid  5084] mkdir("./file1", 0777)      = 0
[pid  5084] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5084] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5084] chdir("./file1")            = 0
[pid  5084] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5084] close(4)                    = 0
[pid  5084] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5084] creat("./file1", 0410)      = 4
[pid  5084] exit_group(0)               = ?
[pid  5084] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5084, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./43", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./43", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./43/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./43/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./43/binderfs")                 = 0
umount2("./43/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./43/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./43/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./43/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./43/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./43/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./43")                           = 0
mkdir("./44", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5086
./strace-static-x86_64: Process 5086 attached
[pid  5086] chdir("./44")               = 0
[pid  5086] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5086] setpgid(0, 0)               = 0
[pid  5086] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5086] write(3, "1000", 4)         = 4
[pid  5086] close(3)                    = 0
[pid  5086] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5086] memfd_create("syzkaller", 0) = 3
[pid  5086] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5086] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5086] munmap(0x7f295dd73000, 262144) = 0
[pid  5086] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   48.074801][ T5084] loop0: detected capacity change from 0 to 512
[   48.083619][ T5084] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   48.098084][ T5084] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5086] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5086] close(3)                    = 0
[pid  5086] mkdir("./file1", 0777)      = 0
[pid  5086] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5086] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5086] chdir("./file1")            = 0
[pid  5086] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5086] close(4)                    = 0
[pid  5086] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5086] creat("./file1", 0410)      = 4
[pid  5086] exit_group(0)               = ?
[pid  5086] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5086, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./44", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./44", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./44/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./44/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./44/binderfs")                 = 0
umount2("./44/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./44/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./44/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./44/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./44/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./44/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./44")                           = 0
mkdir("./45", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5088
./strace-static-x86_64: Process 5088 attached
[pid  5088] chdir("./45")               = 0
[pid  5088] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5088] setpgid(0, 0)               = 0
[   48.154640][ T5086] loop0: detected capacity change from 0 to 512
[   48.164353][ T5086] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   48.178589][ T5086] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5088] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5088] write(3, "1000", 4)         = 4
[pid  5088] close(3)                    = 0
[pid  5088] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5088] memfd_create("syzkaller", 0) = 3
[pid  5088] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5088] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5088] munmap(0x7f295dd73000, 262144) = 0
[pid  5088] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5088] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5088] close(3)                    = 0
[pid  5088] mkdir("./file1", 0777)      = 0
[pid  5088] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5088] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5088] chdir("./file1")            = 0
[pid  5088] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5088] close(4)                    = 0
[pid  5088] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5088] creat("./file1", 0410)      = 4
[pid  5088] exit_group(0)               = ?
[pid  5088] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5088, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./45", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./45", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./45/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./45/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./45/binderfs")                 = 0
umount2("./45/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./45/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./45/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./45/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./45/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./45/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./45")                           = 0
mkdir("./46", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5090
./strace-static-x86_64: Process 5090 attached
[pid  5090] chdir("./46")               = 0
[pid  5090] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5090] setpgid(0, 0)               = 0
[   48.238613][ T5088] loop0: detected capacity change from 0 to 512
[   48.248463][ T5088] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   48.263029][ T5088] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5090] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5090] write(3, "1000", 4)         = 4
[pid  5090] close(3)                    = 0
[pid  5090] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5090] memfd_create("syzkaller", 0) = 3
[pid  5090] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5090] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5090] munmap(0x7f295dd73000, 262144) = 0
[pid  5090] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5090] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5090] close(3)                    = 0
[pid  5090] mkdir("./file1", 0777)      = 0
[pid  5090] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5090] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5090] chdir("./file1")            = 0
[pid  5090] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5090] close(4)                    = 0
[pid  5090] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5090] creat("./file1", 0410)      = 4
[pid  5090] exit_group(0)               = ?
[pid  5090] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5090, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./46", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./46", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./46/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./46/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./46/binderfs")                 = 0
umount2("./46/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./46/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./46/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./46/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./46/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./46/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./46")                           = 0
mkdir("./47", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5093
./strace-static-x86_64: Process 5093 attached
[pid  5093] chdir("./47")               = 0
[pid  5093] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5093] setpgid(0, 0)               = 0
[pid  5093] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5093] write(3, "1000", 4)         = 4
[pid  5093] close(3)                    = 0
[pid  5093] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5093] memfd_create("syzkaller", 0) = 3
[pid  5093] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5093] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5093] munmap(0x7f295dd73000, 262144) = 0
[pid  5093] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   48.327336][ T5090] loop0: detected capacity change from 0 to 512
[   48.336002][ T5090] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   48.350090][ T5090] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5093] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5093] close(3)                    = 0
[pid  5093] mkdir("./file1", 0777)      = 0
[pid  5093] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5093] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5093] chdir("./file1")            = 0
[pid  5093] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5093] close(4)                    = 0
[pid  5093] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5093] creat("./file1", 0410)      = 4
[pid  5093] exit_group(0)               = ?
[pid  5093] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5093, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./47", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./47", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./47/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./47/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./47/binderfs")                 = 0
umount2("./47/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./47/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./47/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./47/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./47/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./47/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./47")                           = 0
mkdir("./48", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5095
./strace-static-x86_64: Process 5095 attached
[pid  5095] chdir("./48")               = 0
[pid  5095] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5095] setpgid(0, 0)               = 0
[pid  5095] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5095] write(3, "1000", 4)         = 4
[pid  5095] close(3)                    = 0
[pid  5095] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5095] memfd_create("syzkaller", 0) = 3
[pid  5095] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5095] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5095] munmap(0x7f295dd73000, 262144) = 0
[pid  5095] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   48.404838][ T5093] loop0: detected capacity change from 0 to 512
[   48.414139][ T5093] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   48.429223][ T5093] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5095] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5095] close(3)                    = 0
[pid  5095] mkdir("./file1", 0777)      = 0
[pid  5095] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5095] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5095] chdir("./file1")            = 0
[pid  5095] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5095] close(4)                    = 0
[pid  5095] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5095] creat("./file1", 0410)      = 4
[pid  5095] exit_group(0)               = ?
[pid  5095] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5095, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
umount2("./48", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./48", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./48/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./48/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./48/binderfs")                 = 0
umount2("./48/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./48/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./48/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./48/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./48/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./48/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./48")                           = 0
mkdir("./49", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = 0
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5097
./strace-static-x86_64: Process 5097 attached
[pid  5097] chdir("./49")               = 0
[pid  5097] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5097] setpgid(0, 0)               = 0
[pid  5097] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5097] write(3, "1000", 4)         = 4
[pid  5097] close(3)                    = 0
[pid  5097] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5097] memfd_create("syzkaller", 0) = 3
[pid  5097] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5097] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5097] munmap(0x7f295dd73000, 262144) = 0
[pid  5097] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   48.476231][ T5095] loop0: detected capacity change from 0 to 512
[   48.485212][ T5095] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   48.499631][ T5095] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5097] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5097] close(3)                    = 0
[pid  5097] mkdir("./file1", 0777)      = 0
[pid  5097] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5097] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5097] chdir("./file1")            = 0
[pid  5097] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5097] close(4)                    = 0
[pid  5097] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5097] creat("./file1", 0410)      = 4
[pid  5097] exit_group(0)               = ?
[pid  5097] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5097, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./49", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./49", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./49/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./49/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./49/binderfs")                 = 0
umount2("./49/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./49/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./49/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./49/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./49/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./49/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./49")                           = 0
mkdir("./50", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5099
./strace-static-x86_64: Process 5099 attached
[pid  5099] chdir("./50")               = 0
[pid  5099] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5099] setpgid(0, 0)               = 0
[pid  5099] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5099] write(3, "1000", 4)         = 4
[pid  5099] close(3)                    = 0
[pid  5099] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5099] memfd_create("syzkaller", 0) = 3
[pid  5099] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5099] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5099] munmap(0x7f295dd73000, 262144) = 0
[pid  5099] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   48.542998][ T5097] loop0: detected capacity change from 0 to 512
[   48.552209][ T5097] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   48.566233][ T5097] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5099] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5099] close(3)                    = 0
[pid  5099] mkdir("./file1", 0777)      = 0
[pid  5099] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5099] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5099] chdir("./file1")            = 0
[pid  5099] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5099] close(4)                    = 0
[pid  5099] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5099] creat("./file1", 0410)      = 4
[pid  5099] exit_group(0)               = ?
[pid  5099] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5099, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./50", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./50", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./50/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./50/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./50/binderfs")                 = 0
umount2("./50/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./50/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./50/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./50/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./50/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./50/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./50")                           = 0
mkdir("./51", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5101
./strace-static-x86_64: Process 5101 attached
[pid  5101] chdir("./51")               = 0
[pid  5101] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5101] setpgid(0, 0)               = 0
[pid  5101] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[   48.615509][ T5099] loop0: detected capacity change from 0 to 512
[   48.623979][ T5099] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   48.638113][ T5099] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5101] write(3, "1000", 4)         = 4
[pid  5101] close(3)                    = 0
[pid  5101] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5101] memfd_create("syzkaller", 0) = 3
[pid  5101] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5101] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5101] munmap(0x7f295dd73000, 262144) = 0
[pid  5101] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5101] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5101] close(3)                    = 0
[pid  5101] mkdir("./file1", 0777)      = 0
[pid  5101] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5101] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5101] chdir("./file1")            = 0
[pid  5101] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5101] close(4)                    = 0
[pid  5101] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5101] creat("./file1", 0410)      = 4
[pid  5101] exit_group(0)               = ?
[pid  5101] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5101, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
umount2("./51", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./51", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./51/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./51/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./51/binderfs")                 = 0
umount2("./51/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./51/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./51/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./51/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./51/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./51/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./51")                           = 0
mkdir("./52", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = 0
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5104
./strace-static-x86_64: Process 5104 attached
[pid  5104] chdir("./52")               = 0
[pid  5104] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5104] setpgid(0, 0)               = 0
[pid  5104] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5104] write(3, "1000", 4)         = 4
[pid  5104] close(3)                    = 0
[pid  5104] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5104] memfd_create("syzkaller", 0) = 3
[pid  5104] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5104] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5104] munmap(0x7f295dd73000, 262144) = 0
[pid  5104] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   48.706577][ T5101] loop0: detected capacity change from 0 to 512
[   48.715910][ T5101] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   48.730593][ T5101] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5104] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5104] close(3)                    = 0
[pid  5104] mkdir("./file1", 0777)      = 0
[pid  5104] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5104] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5104] chdir("./file1")            = 0
[pid  5104] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5104] close(4)                    = 0
[pid  5104] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5104] creat("./file1", 0410)      = 4
[pid  5104] exit_group(0)               = ?
[pid  5104] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5104, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./52", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./52", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./52/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./52/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./52/binderfs")                 = 0
umount2("./52/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./52/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./52/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./52/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./52/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./52/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./52")                           = 0
mkdir("./53", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5106 attached
 <unfinished ...>
[pid  5106] chdir("./53")               = 0
[pid  5106] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5106] setpgid(0, 0)               = 0
[pid  5106] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5106] write(3, "1000", 4)         = 4
[pid  5106] close(3)                    = 0
[pid  5106] symlink("/dev/binderfs", "./binderfs") = 0
[pid  4995] <... clone resumed>, child_tidptr=0x5555562e45d0) = 5106
[pid  5106] memfd_create("syzkaller", 0) = 3
[pid  5106] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[   48.771848][ T5104] loop0: detected capacity change from 0 to 512
[   48.781438][ T5104] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   48.794810][ T5104] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5106] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5106] munmap(0x7f295dd73000, 262144) = 0
[pid  5106] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5106] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5106] close(3)                    = 0
[pid  5106] mkdir("./file1", 0777)      = 0
[pid  5106] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5106] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5106] chdir("./file1")            = 0
[pid  5106] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5106] close(4)                    = 0
[pid  5106] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5106] creat("./file1", 0410)      = 4
[pid  5106] exit_group(0)               = ?
[pid  5106] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5106, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./53", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./53", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./53/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./53/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./53/binderfs")                 = 0
umount2("./53/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./53/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./53/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./53/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./53/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./53/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./53")                           = 0
mkdir("./54", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5108 attached
 <unfinished ...>
[pid  5108] chdir("./54")               = 0
[pid  5108] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5108] setpgid(0, 0)               = 0
[pid  5108] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5108] write(3, "1000", 4)         = 4
[pid  5108] close(3)                    = 0
[pid  5108] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5108] memfd_create("syzkaller", 0) = 3
[pid  5108] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  4995] <... clone resumed>, child_tidptr=0x5555562e45d0) = 5108
[pid  5108] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5108] munmap(0x7f295dd73000, 262144) = 0
[pid  5108] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   48.854702][ T5106] loop0: detected capacity change from 0 to 512
[   48.863250][ T5106] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   48.877845][ T5106] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5108] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5108] close(3)                    = 0
[pid  5108] mkdir("./file1", 0777)      = 0
[pid  5108] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5108] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5108] chdir("./file1")            = 0
[pid  5108] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5108] close(4)                    = 0
[pid  5108] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5108] creat("./file1", 0410)      = 4
[pid  5108] exit_group(0)               = ?
[pid  5108] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5108, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
umount2("./54", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./54", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./54/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./54/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./54/binderfs")                 = 0
umount2("./54/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./54/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./54/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./54/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./54/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./54/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./54")                           = 0
mkdir("./55", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5110
./strace-static-x86_64: Process 5110 attached
[pid  5110] chdir("./55")               = 0
[pid  5110] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5110] setpgid(0, 0)               = 0
[pid  5110] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5110] write(3, "1000", 4)         = 4
[pid  5110] close(3)                    = 0
[pid  5110] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5110] memfd_create("syzkaller", 0) = 3
[pid  5110] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5110] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5110] munmap(0x7f295dd73000, 262144) = 0
[pid  5110] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   48.935560][ T5108] loop0: detected capacity change from 0 to 512
[   48.945601][ T5108] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   48.959550][ T5108] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5110] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5110] close(3)                    = 0
[pid  5110] mkdir("./file1", 0777)      = 0
[pid  5110] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5110] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5110] chdir("./file1")            = 0
[pid  5110] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5110] close(4)                    = 0
[pid  5110] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5110] creat("./file1", 0410)      = 4
[pid  5110] exit_group(0)               = ?
[pid  5110] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5110, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
umount2("./55", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./55", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./55/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./55/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./55/binderfs")                 = 0
umount2("./55/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./55/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./55/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./55/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./55/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./55/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./55")                           = 0
mkdir("./56", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5112
./strace-static-x86_64: Process 5112 attached
[pid  5112] chdir("./56")               = 0
[pid  5112] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5112] setpgid(0, 0)               = 0
[pid  5112] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5112] write(3, "1000", 4)         = 4
[pid  5112] close(3)                    = 0
[pid  5112] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5112] memfd_create("syzkaller", 0) = 3
[pid  5112] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5112] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5112] munmap(0x7f295dd73000, 262144) = 0
[pid  5112] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   49.008620][ T5110] loop0: detected capacity change from 0 to 512
[   49.018596][ T5110] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   49.034165][ T5110] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5112] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5112] close(3)                    = 0
[pid  5112] mkdir("./file1", 0777)      = 0
[pid  5112] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5112] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5112] chdir("./file1")            = 0
[pid  5112] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5112] close(4)                    = 0
[pid  5112] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5112] creat("./file1", 0410)      = 4
[pid  5112] exit_group(0)               = ?
[pid  5112] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5112, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./56", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./56", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./56/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./56/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./56/binderfs")                 = 0
umount2("./56/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./56/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./56/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./56/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./56/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./56/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./56")                           = 0
mkdir("./57", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5114
./strace-static-x86_64: Process 5114 attached
[pid  5114] chdir("./57")               = 0
[pid  5114] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5114] setpgid(0, 0)               = 0
[pid  5114] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5114] write(3, "1000", 4)         = 4
[pid  5114] close(3)                    = 0
[pid  5114] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5114] memfd_create("syzkaller", 0) = 3
[pid  5114] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5114] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5114] munmap(0x7f295dd73000, 262144) = 0
[pid  5114] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   49.088660][ T5112] loop0: detected capacity change from 0 to 512
[   49.097492][ T5112] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   49.112045][ T5112] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5114] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5114] close(3)                    = 0
[pid  5114] mkdir("./file1", 0777)      = 0
[pid  5114] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5114] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5114] chdir("./file1")            = 0
[pid  5114] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5114] close(4)                    = 0
[pid  5114] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5114] creat("./file1", 0410)      = 4
[pid  5114] exit_group(0)               = ?
[pid  5114] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5114, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./57", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./57", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./57/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./57/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./57/binderfs")                 = 0
umount2("./57/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./57/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./57/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./57/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./57/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./57/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./57")                           = 0
mkdir("./58", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5116
./strace-static-x86_64: Process 5116 attached
[pid  5116] chdir("./58")               = 0
[pid  5116] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5116] setpgid(0, 0)               = 0
[pid  5116] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5116] write(3, "1000", 4)         = 4
[pid  5116] close(3)                    = 0
[pid  5116] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5116] memfd_create("syzkaller", 0) = 3
[pid  5116] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5116] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5116] munmap(0x7f295dd73000, 262144) = 0
[pid  5116] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   49.164217][ T5114] loop0: detected capacity change from 0 to 512
[   49.174178][ T5114] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   49.188779][ T5114] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5116] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5116] close(3)                    = 0
[pid  5116] mkdir("./file1", 0777)      = 0
[pid  5116] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5116] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5116] chdir("./file1")            = 0
[pid  5116] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5116] close(4)                    = 0
[pid  5116] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[   49.231320][ T5116] loop0: detected capacity change from 0 to 512
[   49.239931][ T5116] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   49.254121][ T5116] EXT4-fs (loop0): 1 truncate cleaned up
[   49.269629][ T5116] 
[   49.272016][ T5116] ======================================================
[   49.279011][ T5116] WARNING: possible circular locking dependency detected
[   49.286019][ T5116] 6.4.0-syzkaller-10098-g995b406c7e97 #0 Not tainted
[   49.292671][ T5116] ------------------------------------------------------
[   49.299671][ T5116] syz-executor118/5116 is trying to acquire lock:
[   49.306071][ T5116] ffff888077fdc000 (&ea_inode->i_rwsem#8/1){+.+.}-{3:3}, at: ext4_xattr_inode_iget+0x173/0x400
[   49.316431][ T5116] 
[   49.316431][ T5116] but task is already holding lock:
[   49.323783][ T5116] ffff888077fdc888 (&ei->i_data_sem/3){++++}-{3:3}, at: ext4_setattr+0x1988/0x2880
[   49.333078][ T5116] 
[   49.333078][ T5116] which lock already depends on the new lock.
[   49.333078][ T5116] 
[   49.343558][ T5116] 
[   49.343558][ T5116] the existing dependency chain (in reverse order) is:
[   49.352557][ T5116] 
[   49.352557][ T5116] -> #1 (&ei->i_data_sem/3){++++}-{3:3}:
[   49.360365][ T5116]        down_write+0x92/0x200
[   49.365111][ T5116]        ext4_xattr_set_entry+0x3046/0x3810
[   49.371025][ T5116]        ext4_xattr_ibody_set+0x131/0x3a0
[   49.376747][ T5116]        ext4_xattr_set_handle+0x968/0x1510
[   49.382632][ T5116]        ext4_xattr_set+0x144/0x360
[   49.387822][ T5116]        ext4_xattr_user_set+0xbd/0x100
[   49.393356][ T5116]        __vfs_setxattr+0x173/0x1e0
[   49.398543][ T5116]        __vfs_setxattr_noperm+0x129/0x5f0
[   49.404335][ T5116]        __vfs_setxattr_locked+0x1d3/0x260
[   49.410131][ T5116]        vfs_setxattr+0x143/0x340
[   49.415152][ T5116]        do_setxattr+0x147/0x190
[   49.420074][ T5116]        setxattr+0x146/0x160
[   49.424772][ T5116]        path_setxattr+0x197/0x1c0
[   49.429881][ T5116]        __x64_sys_setxattr+0xc4/0x160
[   49.435331][ T5116]        do_syscall_64+0x39/0xb0
[   49.440283][ T5116]        entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   49.446710][ T5116] 
[   49.446710][ T5116] -> #0 (&ea_inode->i_rwsem#8/1){+.+.}-{3:3}:
[   49.454974][ T5116]        __lock_acquire+0x2e9d/0x5e20
[   49.460344][ T5116]        lock_acquire+0x1b1/0x520
[   49.465358][ T5116]        down_write+0x92/0x200
[   49.470110][ T5116]        ext4_xattr_inode_iget+0x173/0x400
[   49.475923][ T5116]        ext4_xattr_inode_get+0x162/0x830
[   49.481649][ T5116]        ext4_expand_extra_isize_ea+0xf51/0x1810
[   49.487969][ T5116]        __ext4_expand_extra_isize+0x33e/0x470
[   49.494119][ T5116]        __ext4_mark_inode_dirty+0x51b/0x800
[   49.500101][ T5116]        ext4_setattr+0x1a02/0x2880
[   49.505292][ T5116]        notify_change+0xb2c/0x1180
[   49.510481][ T5116]        do_truncate+0x143/0x200
[   49.515406][ T5116]        path_openat+0x2047/0x2710
[   49.520503][ T5116]        do_filp_open+0x1ba/0x410
[   49.525517][ T5116]        do_sys_openat2+0x160/0x1c0
[   49.530708][ T5116]        __x64_sys_creat+0xcd/0x120
[   49.535896][ T5116]        do_syscall_64+0x39/0xb0
[   49.540910][ T5116]        entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   49.547317][ T5116] 
[   49.547317][ T5116] other info that might help us debug this:
[   49.547317][ T5116] 
[   49.557529][ T5116]  Possible unsafe locking scenario:
[   49.557529][ T5116] 
[   49.564960][ T5116]        CPU0                    CPU1
[   49.570302][ T5116]        ----                    ----
[   49.575658][ T5116]   lock(&ei->i_data_sem/3);
[   49.580243][ T5116]                                lock(&ea_inode->i_rwsem#8/1);
[   49.587783][ T5116]                                lock(&ei->i_data_sem/3);
[   49.594883][ T5116]   lock(&ea_inode->i_rwsem#8/1);
[   49.599905][ T5116] 
[   49.599905][ T5116]  *** DEADLOCK ***
[   49.599905][ T5116] 
[   49.608029][ T5116] 5 locks held by syz-executor118/5116:
[   49.613556][ T5116]  #0: ffff888078b76410 (sb_writers#4){.+.+}-{0:0}, at: path_openat+0x1959/0x2710
[   49.622776][ T5116]  #1: ffff888077fdca00 (&sb->s_type->i_mutex_key#8){++++}-{3:3}, at: do_truncate+0x131/0x200
[   49.633038][ T5116]  #2: ffff888077fdcba0 (mapping.invalidate_lock){++++}-{3:3}, at: ext4_setattr+0x6f2/0x2880
[   49.643210][ T5116]  #3: ffff888077fdc888 (&ei->i_data_sem/3){++++}-{3:3}, at: ext4_setattr+0x1988/0x2880
[   49.652950][ T5116]  #4: ffff888077fdc6c8 (&ei->xattr_sem){++++}-{3:3}, at: __ext4_mark_inode_dirty+0x48f/0x800
[   49.663209][ T5116] 
[   49.663209][ T5116] stack backtrace:
[   49.669079][ T5116] CPU: 1 PID: 5116 Comm: syz-executor118 Not tainted 6.4.0-syzkaller-10098-g995b406c7e97 #0
[   49.679222][ T5116] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
[   49.689270][ T5116] Call Trace:
[   49.692536][ T5116]  <TASK>
[   49.695455][ T5116]  dump_stack_lvl+0xd9/0x150
[   49.700042][ T5116]  check_noncircular+0x2df/0x3b0
[   49.704980][ T5116]  ? print_circular_bug+0x740/0x740
[   49.710173][ T5116]  __lock_acquire+0x2e9d/0x5e20
[   49.715020][ T5116]  ? lockdep_hardirqs_on_prepare+0x410/0x410
[   49.721085][ T5116]  ? do_raw_spin_unlock+0x175/0x230
[   49.726283][ T5116]  lock_acquire+0x1b1/0x520
[   49.730782][ T5116]  ? ext4_xattr_inode_iget+0x173/0x400
[   49.736335][ T5116]  ? lock_sync+0x190/0x190
[   49.740742][ T5116]  ? do_truncate+0x143/0x200
[   49.745325][ T5116]  down_write+0x92/0x200
[   49.749554][ T5116]  ? ext4_xattr_inode_iget+0x173/0x400
[   49.755007][ T5116]  ? rwsem_down_write_slowpath+0x1220/0x1220
[   49.761080][ T5116]  ? ext4_xattr_inode_set_class+0x19b/0x240
[   49.766966][ T5116]  ext4_xattr_inode_iget+0x173/0x400
[   49.772249][ T5116]  ext4_xattr_inode_get+0x162/0x830
[   49.777441][ T5116]  ? ext4_xattr_inode_iget+0x400/0x400
[   49.782891][ T5116]  ? kvmalloc_node+0xa2/0x1a0
[   49.787555][ T5116]  ? rcu_is_watching+0x12/0xb0
[   49.792312][ T5116]  ? __kmalloc_node+0xfb/0x1a0
[   49.797154][ T5116]  ext4_expand_extra_isize_ea+0xf51/0x1810
[   49.802959][ T5116]  ? ext4_xattr_set+0x360/0x360
[   49.807802][ T5116]  ? dquot_initialize_needed+0x18c/0x290
[   49.813429][ T5116]  ? __ext4_mark_inode_dirty+0x48f/0x800
[   49.819056][ T5116]  __ext4_expand_extra_isize+0x33e/0x470
[   49.824689][ T5116]  __ext4_mark_inode_dirty+0x51b/0x800
[   49.830143][ T5116]  ? ext4_expand_extra_isize+0x5e0/0x5e0
[   49.835774][ T5116]  ? rwsem_down_write_slowpath+0x1220/0x1220
[   49.841756][ T5116]  ? __ext4_journal_start_sb+0x1fc/0x5d0
[   49.847384][ T5116]  ? ext4_setattr+0x86a/0x2880
[   49.852174][ T5116]  ext4_setattr+0x1a02/0x2880
[   49.856855][ T5116]  ? ext4_journalled_write_end+0xfc0/0xfc0
[   49.862672][ T5116]  notify_change+0xb2c/0x1180
[   49.867345][ T5116]  ? do_truncate+0x143/0x200
[   49.871924][ T5116]  do_truncate+0x143/0x200
[   49.876332][ T5116]  ? file_open_root+0x460/0x460
[   49.881170][ T5116]  ? common_perm_cond+0x22f/0x830
[   49.886187][ T5116]  path_openat+0x2047/0x2710
[   49.890768][ T5116]  ? path_lookupat+0x840/0x840
[   49.895519][ T5116]  do_filp_open+0x1ba/0x410
[   49.900006][ T5116]  ? may_open_dev+0xf0/0xf0
[   49.904494][ T5116]  ? find_held_lock+0x2d/0x110
[   49.909250][ T5116]  ? do_raw_spin_lock+0x124/0x2b0
[   49.914263][ T5116]  ? spin_bug+0x1c0/0x1c0
[   49.918584][ T5116]  ? _raw_spin_unlock+0x28/0x40
[   49.923420][ T5116]  ? alloc_fd+0x2e4/0x750
[   49.927745][ T5116]  do_sys_openat2+0x160/0x1c0
[   49.932413][ T5116]  ? build_open_flags+0x720/0x720
[   49.937430][ T5116]  ? ptrace_notify+0xfe/0x140
[   49.942269][ T5116]  ? lock_downgrade+0x690/0x690
[   49.947116][ T5116]  __x64_sys_creat+0xcd/0x120
[   49.951787][ T5116]  ? __x64_compat_sys_openat+0x1f0/0x1f0
[   49.957408][ T5116]  ? _raw_spin_unlock_irq+0x2e/0x50
[   49.962594][ T5116]  ? ptrace_notify+0xfe/0x140
[   49.967257][ T5116]  ? syscall_trace_enter.constprop.0+0xb0/0x1e0
[   49.973499][ T5116]  do_syscall_64+0x39/0xb0
[   49.977913][ T5116]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   49.983799][ T5116] RIP: 0033:0x7f29661c09c9
[   49.988198][ T5116] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[   50.007825][ T5116] RSP: 002b:00007ffd8f5d8168 EFLAGS: 00000246 ORIG_RAX: 0000000000000055
[   50.016240][ T5116] RAX: ffffffffffffffda RBX: 0031656c69662f2e RCX: 00007f29661c09c9
[   50.024204][ T5116] RDX: 00007f29661c09c9 RSI: 0000000000000108 RDI: 0000000020000000
[pid  5116] creat("./file1", 0410)      = 4
[pid  5116] exit_group(0)               = ?
[pid  5116] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5116, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./58", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./58", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./58/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./58/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./58/binderfs")                 = 0
umount2("./58/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./58/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./58/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./58/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./58/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./58/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./58")                           = 0
mkdir("./59", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5118
./strace-static-x86_64: Process 5118 attached
[pid  5118] chdir("./59")               = 0
[pid  5118] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5118] setpgid(0, 0)               = 0
[pid  5118] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5118] write(3, "1000", 4)         = 4
[pid  5118] close(3)                    = 0
[pid  5118] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5118] memfd_create("syzkaller", 0) = 3
[pid  5118] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5118] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5118] munmap(0x7f295dd73000, 262144) = 0
[pid  5118] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   50.032168][ T5116] RBP: 0000000000000000 R08: 00007ffd8f5d8190 R09: 00007ffd8f5d8190
[   50.040136][ T5116] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd8f5d818c
[   50.048092][ T5116] R13: 00007ffd8f5d81c0 R14: 00007ffd8f5d81a0 R15: 000000000000003a
[   50.056082][ T5116]  </TASK>
[pid  5118] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5118] close(3)                    = 0
[pid  5118] mkdir("./file1", 0777)      = 0
[pid  5118] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5118] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5118] chdir("./file1")            = 0
[pid  5118] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5118] close(4)                    = 0
[pid  5118] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5118] creat("./file1", 0410)      = 4
[pid  5118] exit_group(0)               = ?
[pid  5118] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5118, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./59", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./59", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./59/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./59/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./59/binderfs")                 = 0
umount2("./59/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./59/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./59/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./59/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./59/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./59/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./59")                           = 0
mkdir("./60", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5120
./strace-static-x86_64: Process 5120 attached
[pid  5120] chdir("./60")               = 0
[pid  5120] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5120] setpgid(0, 0)               = 0
[pid  5120] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5120] write(3, "1000", 4)         = 4
[pid  5120] close(3)                    = 0
[pid  5120] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5120] memfd_create("syzkaller", 0) = 3
[pid  5120] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5120] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5120] munmap(0x7f295dd73000, 262144) = 0
[pid  5120] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   50.083970][ T5118] loop0: detected capacity change from 0 to 512
[   50.092703][ T5118] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   50.106166][ T5118] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5120] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5120] close(3)                    = 0
[pid  5120] mkdir("./file1", 0777)      = 0
[pid  5120] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5120] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5120] chdir("./file1")            = 0
[pid  5120] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5120] close(4)                    = 0
[pid  5120] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5120] creat("./file1", 0410)      = 4
[pid  5120] exit_group(0)               = ?
[pid  5120] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5120, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./60", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./60", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./60/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./60/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./60/binderfs")                 = 0
umount2("./60/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./60/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./60/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./60/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./60/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./60/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./60")                           = 0
mkdir("./61", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5122
./strace-static-x86_64: Process 5122 attached
[pid  5122] chdir("./61")               = 0
[pid  5122] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5122] setpgid(0, 0)               = 0
[pid  5122] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5122] write(3, "1000", 4)         = 4
[pid  5122] close(3)                    = 0
[pid  5122] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5122] memfd_create("syzkaller", 0) = 3
[pid  5122] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5122] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5122] munmap(0x7f295dd73000, 262144) = 0
[pid  5122] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   50.149295][ T5120] loop0: detected capacity change from 0 to 512
[   50.158236][ T5120] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   50.172604][ T5120] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5122] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5122] close(3)                    = 0
[pid  5122] mkdir("./file1", 0777)      = 0
[pid  5122] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5122] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5122] chdir("./file1")            = 0
[pid  5122] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5122] close(4)                    = 0
[pid  5122] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5122] creat("./file1", 0410)      = 4
[pid  5122] exit_group(0)               = ?
[pid  5122] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5122, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./61", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./61", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./61/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./61/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./61/binderfs")                 = 0
umount2("./61/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./61/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./61/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./61/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./61/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./61/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./61")                           = 0
mkdir("./62", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5124
./strace-static-x86_64: Process 5124 attached
[pid  5124] chdir("./62")               = 0
[pid  5124] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5124] setpgid(0, 0)               = 0
[pid  5124] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5124] write(3, "1000", 4)         = 4
[pid  5124] close(3)                    = 0
[pid  5124] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5124] memfd_create("syzkaller", 0) = 3
[pid  5124] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5124] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5124] munmap(0x7f295dd73000, 262144) = 0
[pid  5124] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   50.211271][ T5122] loop0: detected capacity change from 0 to 512
[   50.219989][ T5122] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   50.233300][ T5122] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5124] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5124] close(3)                    = 0
[pid  5124] mkdir("./file1", 0777)      = 0
[pid  5124] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5124] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5124] chdir("./file1")            = 0
[pid  5124] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5124] close(4)                    = 0
[pid  5124] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5124] creat("./file1", 0410)      = 4
[pid  5124] exit_group(0)               = ?
[pid  5124] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5124, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./62", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./62", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./62/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./62/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./62/binderfs")                 = 0
umount2("./62/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./62/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./62/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./62/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./62/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./62/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./62")                           = 0
mkdir("./63", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5126
./strace-static-x86_64: Process 5126 attached
[pid  5126] chdir("./63")               = 0
[pid  5126] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5126] setpgid(0, 0)               = 0
[pid  5126] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5126] write(3, "1000", 4)         = 4
[pid  5126] close(3)                    = 0
[pid  5126] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5126] memfd_create("syzkaller", 0) = 3
[pid  5126] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5126] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5126] munmap(0x7f295dd73000, 262144) = 0
[pid  5126] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   50.273151][ T5124] loop0: detected capacity change from 0 to 512
[   50.281669][ T5124] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   50.294990][ T5124] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5126] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5126] close(3)                    = 0
[pid  5126] mkdir("./file1", 0777)      = 0
[pid  5126] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5126] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5126] chdir("./file1")            = 0
[pid  5126] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5126] close(4)                    = 0
[pid  5126] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5126] creat("./file1", 0410)      = 4
[pid  5126] exit_group(0)               = ?
[pid  5126] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5126, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./63", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./63", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./63/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./63/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./63/binderfs")                 = 0
umount2("./63/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./63/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./63/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./63/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./63/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./63/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./63")                           = 0
mkdir("./64", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5128
./strace-static-x86_64: Process 5128 attached
[pid  5128] chdir("./64")               = 0
[pid  5128] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5128] setpgid(0, 0)               = 0
[pid  5128] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5128] write(3, "1000", 4)         = 4
[pid  5128] close(3)                    = 0
[pid  5128] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5128] memfd_create("syzkaller", 0) = 3
[pid  5128] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5128] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5128] munmap(0x7f295dd73000, 262144) = 0
[pid  5128] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   50.325738][ T5126] loop0: detected capacity change from 0 to 512
[   50.333580][ T5126] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   50.346836][ T5126] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5128] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5128] close(3)                    = 0
[pid  5128] mkdir("./file1", 0777)      = 0
[pid  5128] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5128] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5128] chdir("./file1")            = 0
[pid  5128] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5128] close(4)                    = 0
[pid  5128] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5128] creat("./file1", 0410)      = 4
[pid  5128] exit_group(0)               = ?
[pid  5128] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5128, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
umount2("./64", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./64", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./64/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./64/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./64/binderfs")                 = 0
umount2("./64/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./64/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./64/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./64/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./64/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./64/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./64")                           = 0
mkdir("./65", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5130
./strace-static-x86_64: Process 5130 attached
[pid  5130] chdir("./65")               = 0
[pid  5130] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5130] setpgid(0, 0)               = 0
[pid  5130] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5130] write(3, "1000", 4)         = 4
[pid  5130] close(3)                    = 0
[pid  5130] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5130] memfd_create("syzkaller", 0) = 3
[pid  5130] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5130] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5130] munmap(0x7f295dd73000, 262144) = 0
[pid  5130] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   50.395010][ T5128] loop0: detected capacity change from 0 to 512
[   50.403587][ T5128] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   50.417344][ T5128] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5130] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5130] close(3)                    = 0
[pid  5130] mkdir("./file1", 0777)      = 0
[pid  5130] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5130] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5130] chdir("./file1")            = 0
[pid  5130] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5130] close(4)                    = 0
[pid  5130] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5130] creat("./file1", 0410)      = 4
[pid  5130] exit_group(0)               = ?
[pid  5130] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5130, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
umount2("./65", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./65", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./65/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./65/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./65/binderfs")                 = 0
umount2("./65/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./65/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./65/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./65/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./65/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./65/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./65")                           = 0
mkdir("./66", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5132
./strace-static-x86_64: Process 5132 attached
[pid  5132] chdir("./66")               = 0
[pid  5132] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5132] setpgid(0, 0)               = 0
[pid  5132] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5132] write(3, "1000", 4)         = 4
[pid  5132] close(3)                    = 0
[pid  5132] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5132] memfd_create("syzkaller", 0) = 3
[pid  5132] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5132] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5132] munmap(0x7f295dd73000, 262144) = 0
[pid  5132] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   50.447830][ T5130] loop0: detected capacity change from 0 to 512
[   50.455676][ T5130] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   50.469317][ T5130] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5132] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5132] close(3)                    = 0
[pid  5132] mkdir("./file1", 0777)      = 0
[pid  5132] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5132] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5132] chdir("./file1")            = 0
[pid  5132] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5132] close(4)                    = 0
[pid  5132] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5132] creat("./file1", 0410)      = 4
[pid  5132] exit_group(0)               = ?
[pid  5132] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5132, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./66", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./66", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./66/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./66/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./66/binderfs")                 = 0
umount2("./66/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./66/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./66/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./66/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./66/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./66/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./66")                           = 0
mkdir("./67", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5134
./strace-static-x86_64: Process 5134 attached
[pid  5134] chdir("./67")               = 0
[pid  5134] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5134] setpgid(0, 0)               = 0
[pid  5134] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5134] write(3, "1000", 4)         = 4
[pid  5134] close(3)                    = 0
[pid  5134] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5134] memfd_create("syzkaller", 0) = 3
[pid  5134] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5134] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5134] munmap(0x7f295dd73000, 262144) = 0
[pid  5134] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   50.505602][ T5132] loop0: detected capacity change from 0 to 512
[   50.514590][ T5132] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   50.527740][ T5132] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5134] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5134] close(3)                    = 0
[pid  5134] mkdir("./file1", 0777)      = 0
[pid  5134] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5134] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5134] chdir("./file1")            = 0
[pid  5134] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5134] close(4)                    = 0
[pid  5134] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5134] creat("./file1", 0410)      = 4
[pid  5134] exit_group(0)               = ?
[pid  5134] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5134, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./67", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./67", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./67/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./67/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./67/binderfs")                 = 0
umount2("./67/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./67/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./67/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./67/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./67/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./67/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./67")                           = 0
mkdir("./68", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5136 attached
, child_tidptr=0x5555562e45d0) = 5136
[pid  5136] chdir("./68")               = 0
[pid  5136] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5136] setpgid(0, 0)               = 0
[pid  5136] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5136] write(3, "1000", 4)         = 4
[pid  5136] close(3)                    = 0
[pid  5136] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5136] memfd_create("syzkaller", 0) = 3
[pid  5136] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5136] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5136] munmap(0x7f295dd73000, 262144) = 0
[pid  5136] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   50.575105][ T5134] loop0: detected capacity change from 0 to 512
[   50.583878][ T5134] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   50.597552][ T5134] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5136] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5136] close(3)                    = 0
[pid  5136] mkdir("./file1", 0777)      = 0
[pid  5136] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5136] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5136] chdir("./file1")            = 0
[pid  5136] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5136] close(4)                    = 0
[pid  5136] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5136] creat("./file1", 0410)      = 4
[pid  5136] exit_group(0)               = ?
[pid  5136] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5136, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./68", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./68", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./68/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./68/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./68/binderfs")                 = 0
umount2("./68/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./68/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./68/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./68/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./68/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./68/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./68")                           = 0
mkdir("./69", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5138
./strace-static-x86_64: Process 5138 attached
[pid  5138] chdir("./69")               = 0
[pid  5138] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5138] setpgid(0, 0)               = 0
[pid  5138] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5138] write(3, "1000", 4)         = 4
[pid  5138] close(3)                    = 0
[pid  5138] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5138] memfd_create("syzkaller", 0) = 3
[pid  5138] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5138] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5138] munmap(0x7f295dd73000, 262144) = 0
[pid  5138] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   50.645833][ T5136] loop0: detected capacity change from 0 to 512
[   50.654557][ T5136] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   50.668008][ T5136] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5138] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5138] close(3)                    = 0
[pid  5138] mkdir("./file1", 0777)      = 0
[pid  5138] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5138] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5138] chdir("./file1")            = 0
[pid  5138] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5138] close(4)                    = 0
[pid  5138] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5138] creat("./file1", 0410)      = 4
[pid  5138] exit_group(0)               = ?
[pid  5138] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5138, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./69", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./69", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./69/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./69/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./69/binderfs")                 = 0
umount2("./69/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./69/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./69/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./69/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./69/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./69/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./69")                           = 0
mkdir("./70", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5140
./strace-static-x86_64: Process 5140 attached
[pid  5140] chdir("./70")               = 0
[pid  5140] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5140] setpgid(0, 0)               = 0
[pid  5140] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5140] write(3, "1000", 4)         = 4
[pid  5140] close(3)                    = 0
[pid  5140] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5140] memfd_create("syzkaller", 0) = 3
[pid  5140] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5140] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5140] munmap(0x7f295dd73000, 262144) = 0
[pid  5140] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   50.714792][ T5138] loop0: detected capacity change from 0 to 512
[   50.723788][ T5138] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   50.737089][ T5138] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5140] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5140] close(3)                    = 0
[pid  5140] mkdir("./file1", 0777)      = 0
[pid  5140] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5140] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5140] chdir("./file1")            = 0
[pid  5140] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5140] close(4)                    = 0
[pid  5140] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5140] creat("./file1", 0410)      = 4
[pid  5140] exit_group(0)               = ?
[pid  5140] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5140, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
umount2("./70", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./70", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./70/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./70/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./70/binderfs")                 = 0
umount2("./70/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./70/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./70/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./70/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./70/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./70/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./70")                           = 0
mkdir("./71", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5142
./strace-static-x86_64: Process 5142 attached
[pid  5142] chdir("./71")               = 0
[pid  5142] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5142] setpgid(0, 0)               = 0
[pid  5142] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5142] write(3, "1000", 4)         = 4
[pid  5142] close(3)                    = 0
[pid  5142] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5142] memfd_create("syzkaller", 0) = 3
[pid  5142] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5142] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5142] munmap(0x7f295dd73000, 262144) = 0
[pid  5142] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   50.776101][ T5140] loop0: detected capacity change from 0 to 512
[   50.785099][ T5140] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   50.798640][ T5140] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5142] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5142] close(3)                    = 0
[pid  5142] mkdir("./file1", 0777)      = 0
[pid  5142] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5142] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5142] chdir("./file1")            = 0
[pid  5142] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5142] close(4)                    = 0
[pid  5142] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5142] creat("./file1", 0410)      = 4
[pid  5142] exit_group(0)               = ?
[pid  5142] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5142, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
umount2("./71", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./71", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./71/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./71/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./71/binderfs")                 = 0
umount2("./71/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./71/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./71/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./71/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./71/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./71/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./71")                           = 0
mkdir("./72", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = 0
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5144
./strace-static-x86_64: Process 5144 attached
[pid  5144] chdir("./72")               = 0
[pid  5144] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5144] setpgid(0, 0)               = 0
[pid  5144] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5144] write(3, "1000", 4)         = 4
[pid  5144] close(3)                    = 0
[pid  5144] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5144] memfd_create("syzkaller", 0) = 3
[pid  5144] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5144] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5144] munmap(0x7f295dd73000, 262144) = 0
[pid  5144] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   50.831944][ T5142] loop0: detected capacity change from 0 to 512
[   50.839731][ T5142] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   50.853159][ T5142] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5144] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5144] close(3)                    = 0
[pid  5144] mkdir("./file1", 0777)      = 0
[pid  5144] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5144] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5144] chdir("./file1")            = 0
[pid  5144] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5144] close(4)                    = 0
[pid  5144] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5144] creat("./file1", 0410)      = 4
[pid  5144] exit_group(0)               = ?
[pid  5144] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5144, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./72", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./72", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./72/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./72/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./72/binderfs")                 = 0
umount2("./72/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./72/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./72/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./72/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./72/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./72/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./72")                           = 0
mkdir("./73", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5146
./strace-static-x86_64: Process 5146 attached
[pid  5146] chdir("./73")               = 0
[pid  5146] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5146] setpgid(0, 0)               = 0
[pid  5146] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5146] write(3, "1000", 4)         = 4
[pid  5146] close(3)                    = 0
[pid  5146] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5146] memfd_create("syzkaller", 0) = 3
[pid  5146] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5146] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5146] munmap(0x7f295dd73000, 262144) = 0
[pid  5146] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   50.886313][ T5144] loop0: detected capacity change from 0 to 512
[   50.894949][ T5144] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   50.910118][ T5144] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5146] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5146] close(3)                    = 0
[pid  5146] mkdir("./file1", 0777)      = 0
[pid  5146] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5146] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5146] chdir("./file1")            = 0
[pid  5146] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5146] close(4)                    = 0
[pid  5146] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5146] creat("./file1", 0410)      = 4
[pid  5146] exit_group(0)               = ?
[pid  5146] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5146, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./73", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./73", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./73/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./73/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./73/binderfs")                 = 0
umount2("./73/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./73/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./73/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./73/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./73/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./73/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./73")                           = 0
mkdir("./74", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5148 attached
, child_tidptr=0x5555562e45d0) = 5148
[pid  5148] chdir("./74")               = 0
[pid  5148] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5148] setpgid(0, 0)               = 0
[pid  5148] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5148] write(3, "1000", 4)         = 4
[pid  5148] close(3)                    = 0
[pid  5148] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5148] memfd_create("syzkaller", 0) = 3
[pid  5148] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5148] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5148] munmap(0x7f295dd73000, 262144) = 0
[pid  5148] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   50.952191][ T5146] loop0: detected capacity change from 0 to 512
[   50.960246][ T5146] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   50.974031][ T5146] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5148] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5148] close(3)                    = 0
[pid  5148] mkdir("./file1", 0777)      = 0
[pid  5148] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5148] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5148] chdir("./file1")            = 0
[pid  5148] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5148] close(4)                    = 0
[pid  5148] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5148] creat("./file1", 0410)      = 4
[pid  5148] exit_group(0)               = ?
[pid  5148] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5148, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./74", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./74", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./74/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./74/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./74/binderfs")                 = 0
umount2("./74/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./74/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./74/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./74/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./74/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./74/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./74")                           = 0
mkdir("./75", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5150 attached
, child_tidptr=0x5555562e45d0) = 5150
[pid  5150] chdir("./75")               = 0
[pid  5150] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5150] setpgid(0, 0)               = 0
[pid  5150] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5150] write(3, "1000", 4)         = 4
[pid  5150] close(3)                    = 0
[pid  5150] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5150] memfd_create("syzkaller", 0) = 3
[pid  5150] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5150] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5150] munmap(0x7f295dd73000, 262144) = 0
[pid  5150] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   51.018262][ T5148] loop0: detected capacity change from 0 to 512
[   51.026334][ T5148] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   51.040010][ T5148] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5150] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5150] close(3)                    = 0
[pid  5150] mkdir("./file1", 0777)      = 0
[pid  5150] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5150] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5150] chdir("./file1")            = 0
[pid  5150] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5150] close(4)                    = 0
[pid  5150] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5150] creat("./file1", 0410)      = 4
[pid  5150] exit_group(0)               = ?
[pid  5150] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5150, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./75", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./75", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./75/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./75/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./75/binderfs")                 = 0
umount2("./75/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./75/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./75/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./75/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./75/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./75/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./75")                           = 0
mkdir("./76", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5152
./strace-static-x86_64: Process 5152 attached
[pid  5152] chdir("./76")               = 0
[pid  5152] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5152] setpgid(0, 0)               = 0
[pid  5152] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5152] write(3, "1000", 4)         = 4
[pid  5152] close(3)                    = 0
[pid  5152] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5152] memfd_create("syzkaller", 0) = 3
[pid  5152] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5152] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5152] munmap(0x7f295dd73000, 262144) = 0
[pid  5152] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   51.087398][ T5150] loop0: detected capacity change from 0 to 512
[   51.096651][ T5150] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   51.109917][ T5150] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5152] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5152] close(3)                    = 0
[pid  5152] mkdir("./file1", 0777)      = 0
[pid  5152] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5152] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5152] chdir("./file1")            = 0
[pid  5152] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5152] close(4)                    = 0
[pid  5152] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5152] creat("./file1", 0410)      = 4
[pid  5152] exit_group(0)               = ?
[pid  5152] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5152, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./76", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./76", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./76/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./76/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./76/binderfs")                 = 0
umount2("./76/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./76/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./76/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./76/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./76/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./76/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./76")                           = 0
mkdir("./77", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5154
./strace-static-x86_64: Process 5154 attached
[pid  5154] chdir("./77")               = 0
[pid  5154] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5154] setpgid(0, 0)               = 0
[pid  5154] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5154] write(3, "1000", 4)         = 4
[pid  5154] close(3)                    = 0
[pid  5154] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5154] memfd_create("syzkaller", 0) = 3
[pid  5154] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5154] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5154] munmap(0x7f295dd73000, 262144) = 0
[pid  5154] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   51.147886][ T5152] loop0: detected capacity change from 0 to 512
[   51.155955][ T5152] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   51.169667][ T5152] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5154] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5154] close(3)                    = 0
[pid  5154] mkdir("./file1", 0777)      = 0
[pid  5154] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5154] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5154] chdir("./file1")            = 0
[pid  5154] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5154] close(4)                    = 0
[pid  5154] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5154] creat("./file1", 0410)      = 4
[pid  5154] exit_group(0)               = ?
[pid  5154] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5154, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./77", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./77", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./77/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./77/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./77/binderfs")                 = 0
umount2("./77/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./77/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./77/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./77/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./77/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./77/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./77")                           = 0
mkdir("./78", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5156
./strace-static-x86_64: Process 5156 attached
[pid  5156] chdir("./78")               = 0
[pid  5156] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5156] setpgid(0, 0)               = 0
[pid  5156] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5156] write(3, "1000", 4)         = 4
[pid  5156] close(3)                    = 0
[pid  5156] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5156] memfd_create("syzkaller", 0) = 3
[pid  5156] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5156] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5156] munmap(0x7f295dd73000, 262144) = 0
[pid  5156] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   51.217432][ T5154] loop0: detected capacity change from 0 to 512
[   51.225211][ T5154] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   51.238429][ T5154] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5156] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5156] close(3)                    = 0
[pid  5156] mkdir("./file1", 0777)      = 0
[pid  5156] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5156] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5156] chdir("./file1")            = 0
[pid  5156] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5156] close(4)                    = 0
[pid  5156] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5156] creat("./file1", 0410)      = 4
[pid  5156] exit_group(0)               = ?
[pid  5156] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5156, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
umount2("./78", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./78", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./78/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./78/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./78/binderfs")                 = 0
umount2("./78/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./78/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./78/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./78/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./78/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./78/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./78")                           = 0
mkdir("./79", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5158
./strace-static-x86_64: Process 5158 attached
[pid  5158] chdir("./79")               = 0
[pid  5158] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5158] setpgid(0, 0)               = 0
[pid  5158] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5158] write(3, "1000", 4)         = 4
[pid  5158] close(3)                    = 0
[pid  5158] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5158] memfd_create("syzkaller", 0) = 3
[pid  5158] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5158] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5158] munmap(0x7f295dd73000, 262144) = 0
[pid  5158] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   51.286924][ T5156] loop0: detected capacity change from 0 to 512
[   51.295720][ T5156] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   51.309155][ T5156] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5158] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5158] close(3)                    = 0
[pid  5158] mkdir("./file1", 0777)      = 0
[pid  5158] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5158] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5158] chdir("./file1")            = 0
[pid  5158] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5158] close(4)                    = 0
[pid  5158] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5158] creat("./file1", 0410)      = 4
[pid  5158] exit_group(0)               = ?
[pid  5158] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5158, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./79", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./79", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./79/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./79/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./79/binderfs")                 = 0
umount2("./79/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./79/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./79/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./79/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./79/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./79/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./79")                           = 0
mkdir("./80", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5160
./strace-static-x86_64: Process 5160 attached
[pid  5160] chdir("./80")               = 0
[pid  5160] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5160] setpgid(0, 0)               = 0
[pid  5160] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5160] write(3, "1000", 4)         = 4
[pid  5160] close(3)                    = 0
[pid  5160] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5160] memfd_create("syzkaller", 0) = 3
[pid  5160] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5160] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5160] munmap(0x7f295dd73000, 262144) = 0
[pid  5160] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   51.355047][ T5158] loop0: detected capacity change from 0 to 512
[   51.363717][ T5158] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   51.377311][ T5158] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5160] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5160] close(3)                    = 0
[pid  5160] mkdir("./file1", 0777)      = 0
[pid  5160] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5160] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5160] chdir("./file1")            = 0
[pid  5160] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5160] close(4)                    = 0
[pid  5160] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5160] creat("./file1", 0410)      = 4
[pid  5160] exit_group(0)               = ?
[pid  5160] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5160, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
umount2("./80", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./80", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./80/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./80/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./80/binderfs")                 = 0
umount2("./80/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./80/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./80/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./80/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./80/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./80/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./80")                           = 0
mkdir("./81", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5162
./strace-static-x86_64: Process 5162 attached
[pid  5162] chdir("./81")               = 0
[pid  5162] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5162] setpgid(0, 0)               = 0
[pid  5162] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5162] write(3, "1000", 4)         = 4
[pid  5162] close(3)                    = 0
[pid  5162] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5162] memfd_create("syzkaller", 0) = 3
[pid  5162] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5162] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5162] munmap(0x7f295dd73000, 262144) = 0
[pid  5162] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   51.427146][ T5160] loop0: detected capacity change from 0 to 512
[   51.435152][ T5160] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   51.448449][ T5160] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5162] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5162] close(3)                    = 0
[pid  5162] mkdir("./file1", 0777)      = 0
[pid  5162] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5162] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5162] chdir("./file1")            = 0
[pid  5162] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5162] close(4)                    = 0
[pid  5162] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5162] creat("./file1", 0410)      = 4
[pid  5162] exit_group(0)               = ?
[pid  5162] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5162, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./81", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./81", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./81/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./81/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./81/binderfs")                 = 0
umount2("./81/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./81/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./81/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./81/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./81/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./81/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./81")                           = 0
mkdir("./82", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5164 attached
, child_tidptr=0x5555562e45d0) = 5164
[pid  5164] chdir("./82")               = 0
[pid  5164] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5164] setpgid(0, 0)               = 0
[pid  5164] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5164] write(3, "1000", 4)         = 4
[pid  5164] close(3)                    = 0
[pid  5164] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5164] memfd_create("syzkaller", 0) = 3
[pid  5164] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5164] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5164] munmap(0x7f295dd73000, 262144) = 0
[pid  5164] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   51.479788][ T5162] loop0: detected capacity change from 0 to 512
[   51.487642][ T5162] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   51.501577][ T5162] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5164] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5164] close(3)                    = 0
[pid  5164] mkdir("./file1", 0777)      = 0
[pid  5164] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5164] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5164] chdir("./file1")            = 0
[pid  5164] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5164] close(4)                    = 0
[pid  5164] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5164] creat("./file1", 0410)      = 4
[pid  5164] exit_group(0)               = ?
[pid  5164] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5164, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./82", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./82", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./82/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./82/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./82/binderfs")                 = 0
umount2("./82/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./82/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./82/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./82/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./82/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./82/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./82")                           = 0
mkdir("./83", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5166 attached
, child_tidptr=0x5555562e45d0) = 5166
[pid  5166] chdir("./83")               = 0
[pid  5166] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5166] setpgid(0, 0)               = 0
[pid  5166] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5166] write(3, "1000", 4)         = 4
[pid  5166] close(3)                    = 0
[pid  5166] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5166] memfd_create("syzkaller", 0) = 3
[pid  5166] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5166] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5166] munmap(0x7f295dd73000, 262144) = 0
[pid  5166] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   51.536727][ T5164] loop0: detected capacity change from 0 to 512
[   51.544854][ T5164] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   51.558779][ T5164] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5166] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5166] close(3)                    = 0
[pid  5166] mkdir("./file1", 0777)      = 0
[pid  5166] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5166] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5166] chdir("./file1")            = 0
[pid  5166] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5166] close(4)                    = 0
[pid  5166] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5166] creat("./file1", 0410)      = 4
[pid  5166] exit_group(0)               = ?
[pid  5166] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5166, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./83", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./83", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./83/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./83/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./83/binderfs")                 = 0
umount2("./83/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./83/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./83/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./83/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./83/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./83/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./83")                           = 0
mkdir("./84", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5168
./strace-static-x86_64: Process 5168 attached
[pid  5168] chdir("./84")               = 0
[pid  5168] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5168] setpgid(0, 0)               = 0
[pid  5168] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5168] write(3, "1000", 4)         = 4
[pid  5168] close(3)                    = 0
[pid  5168] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5168] memfd_create("syzkaller", 0) = 3
[pid  5168] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5168] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5168] munmap(0x7f295dd73000, 262144) = 0
[pid  5168] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   51.594092][ T5166] loop0: detected capacity change from 0 to 512
[   51.603083][ T5166] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   51.616776][ T5166] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5168] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5168] close(3)                    = 0
[pid  5168] mkdir("./file1", 0777)      = 0
[pid  5168] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5168] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5168] chdir("./file1")            = 0
[pid  5168] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5168] close(4)                    = 0
[pid  5168] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5168] creat("./file1", 0410)      = 4
[pid  5168] exit_group(0)               = ?
[pid  5168] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5168, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./84", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./84", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./84/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./84/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./84/binderfs")                 = 0
umount2("./84/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./84/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./84/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./84/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./84/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./84/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./84")                           = 0
mkdir("./85", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5170
./strace-static-x86_64: Process 5170 attached
[pid  5170] chdir("./85")               = 0
[pid  5170] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5170] setpgid(0, 0)               = 0
[pid  5170] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5170] write(3, "1000", 4)         = 4
[pid  5170] close(3)                    = 0
[pid  5170] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5170] memfd_create("syzkaller", 0) = 3
[pid  5170] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5170] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5170] munmap(0x7f295dd73000, 262144) = 0
[pid  5170] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   51.664441][ T5168] loop0: detected capacity change from 0 to 512
[   51.673064][ T5168] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   51.686648][ T5168] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5170] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5170] close(3)                    = 0
[pid  5170] mkdir("./file1", 0777)      = 0
[pid  5170] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5170] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5170] chdir("./file1")            = 0
[pid  5170] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5170] close(4)                    = 0
[pid  5170] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5170] creat("./file1", 0410)      = 4
[pid  5170] exit_group(0)               = ?
[pid  5170] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5170, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
umount2("./85", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./85", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./85/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./85/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./85/binderfs")                 = 0
umount2("./85/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./85/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./85/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./85/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./85/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./85/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./85")                           = 0
mkdir("./86", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5172 attached
, child_tidptr=0x5555562e45d0) = 5172
[pid  5172] chdir("./86")               = 0
[pid  5172] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5172] setpgid(0, 0)               = 0
[pid  5172] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5172] write(3, "1000", 4)         = 4
[pid  5172] close(3)                    = 0
[pid  5172] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5172] memfd_create("syzkaller", 0) = 3
[pid  5172] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5172] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5172] munmap(0x7f295dd73000, 262144) = 0
[pid  5172] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   51.734800][ T5170] loop0: detected capacity change from 0 to 512
[   51.743520][ T5170] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   51.757091][ T5170] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5172] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5172] close(3)                    = 0
[pid  5172] mkdir("./file1", 0777)      = 0
[pid  5172] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5172] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5172] chdir("./file1")            = 0
[pid  5172] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5172] close(4)                    = 0
[pid  5172] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5172] creat("./file1", 0410)      = 4
[pid  5172] exit_group(0)               = ?
[pid  5172] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5172, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./86", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./86", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./86/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./86/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./86/binderfs")                 = 0
umount2("./86/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./86/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./86/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./86/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./86/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./86/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./86")                           = 0
mkdir("./87", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5174
./strace-static-x86_64: Process 5174 attached
[pid  5174] chdir("./87")               = 0
[pid  5174] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5174] setpgid(0, 0)               = 0
[pid  5174] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5174] write(3, "1000", 4)         = 4
[pid  5174] close(3)                    = 0
[pid  5174] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5174] memfd_create("syzkaller", 0) = 3
[pid  5174] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5174] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5174] munmap(0x7f295dd73000, 262144) = 0
[pid  5174] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   51.813778][ T5172] loop0: detected capacity change from 0 to 512
[   51.822821][ T5172] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   51.836066][ T5172] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5174] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5174] close(3)                    = 0
[pid  5174] mkdir("./file1", 0777)      = 0
[pid  5174] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5174] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5174] chdir("./file1")            = 0
[pid  5174] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5174] close(4)                    = 0
[pid  5174] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5174] creat("./file1", 0410)      = 4
[pid  5174] exit_group(0)               = ?
[pid  5174] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5174, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
umount2("./87", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./87", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./87/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./87/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./87/binderfs")                 = 0
umount2("./87/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./87/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./87/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./87/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./87/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./87/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./87")                           = 0
mkdir("./88", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5176
./strace-static-x86_64: Process 5176 attached
[pid  5176] chdir("./88")               = 0
[pid  5176] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5176] setpgid(0, 0)               = 0
[pid  5176] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5176] write(3, "1000", 4)         = 4
[pid  5176] close(3)                    = 0
[pid  5176] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5176] memfd_create("syzkaller", 0) = 3
[pid  5176] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5176] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5176] munmap(0x7f295dd73000, 262144) = 0
[pid  5176] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   51.869557][ T5174] loop0: detected capacity change from 0 to 512
[   51.877640][ T5174] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   51.891686][ T5174] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5176] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5176] close(3)                    = 0
[pid  5176] mkdir("./file1", 0777)      = 0
[pid  5176] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5176] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5176] chdir("./file1")            = 0
[pid  5176] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5176] close(4)                    = 0
[pid  5176] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5176] creat("./file1", 0410)      = 4
[pid  5176] exit_group(0)               = ?
[pid  5176] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5176, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./88", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./88", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./88/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./88/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./88/binderfs")                 = 0
umount2("./88/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./88/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./88/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./88/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./88/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./88/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./88")                           = 0
mkdir("./89", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5178
./strace-static-x86_64: Process 5178 attached
[pid  5178] chdir("./89")               = 0
[pid  5178] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5178] setpgid(0, 0)               = 0
[pid  5178] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5178] write(3, "1000", 4)         = 4
[pid  5178] close(3)                    = 0
[pid  5178] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5178] memfd_create("syzkaller", 0) = 3
[pid  5178] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5178] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5178] munmap(0x7f295dd73000, 262144) = 0
[pid  5178] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   51.936102][ T5176] loop0: detected capacity change from 0 to 512
[   51.944265][ T5176] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   51.958458][ T5176] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5178] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5178] close(3)                    = 0
[pid  5178] mkdir("./file1", 0777)      = 0
[pid  5178] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5178] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5178] chdir("./file1")            = 0
[pid  5178] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5178] close(4)                    = 0
[pid  5178] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5178] creat("./file1", 0410)      = 4
[pid  5178] exit_group(0)               = ?
[pid  5178] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5178, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
umount2("./89", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./89", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./89/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./89/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./89/binderfs")                 = 0
umount2("./89/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./89/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./89/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./89/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./89/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./89/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./89")                           = 0
mkdir("./90", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5180
./strace-static-x86_64: Process 5180 attached
[pid  5180] chdir("./90")               = 0
[pid  5180] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5180] setpgid(0, 0)               = 0
[pid  5180] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5180] write(3, "1000", 4)         = 4
[pid  5180] close(3)                    = 0
[pid  5180] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5180] memfd_create("syzkaller", 0) = 3
[pid  5180] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5180] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5180] munmap(0x7f295dd73000, 262144) = 0
[pid  5180] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   52.007014][ T5178] loop0: detected capacity change from 0 to 512
[   52.015115][ T5178] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   52.028653][ T5178] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5180] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5180] close(3)                    = 0
[pid  5180] mkdir("./file1", 0777)      = 0
[pid  5180] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5180] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5180] chdir("./file1")            = 0
[pid  5180] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5180] close(4)                    = 0
[pid  5180] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5180] creat("./file1", 0410)      = 4
[pid  5180] exit_group(0)               = ?
[pid  5180] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5180, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./90", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./90", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./90/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./90/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./90/binderfs")                 = 0
umount2("./90/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./90/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./90/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./90/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./90/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./90/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./90")                           = 0
mkdir("./91", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5182 attached
, child_tidptr=0x5555562e45d0) = 5182
[pid  5182] chdir("./91")               = 0
[pid  5182] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5182] setpgid(0, 0)               = 0
[pid  5182] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5182] write(3, "1000", 4)         = 4
[pid  5182] close(3)                    = 0
[pid  5182] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5182] memfd_create("syzkaller", 0) = 3
[pid  5182] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5182] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5182] munmap(0x7f295dd73000, 262144) = 0
[pid  5182] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   52.062903][ T5180] loop0: detected capacity change from 0 to 512
[   52.070485][ T5180] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   52.083684][ T5180] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5182] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5182] close(3)                    = 0
[pid  5182] mkdir("./file1", 0777)      = 0
[pid  5182] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5182] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5182] chdir("./file1")            = 0
[pid  5182] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5182] close(4)                    = 0
[pid  5182] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5182] creat("./file1", 0410)      = 4
[pid  5182] exit_group(0)               = ?
[pid  5182] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5182, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./91", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./91", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./91/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./91/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./91/binderfs")                 = 0
umount2("./91/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./91/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./91/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./91/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./91/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./91/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./91")                           = 0
mkdir("./92", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5184
./strace-static-x86_64: Process 5184 attached
[pid  5184] chdir("./92")               = 0
[pid  5184] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5184] setpgid(0, 0)               = 0
[pid  5184] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5184] write(3, "1000", 4)         = 4
[pid  5184] close(3)                    = 0
[pid  5184] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5184] memfd_create("syzkaller", 0) = 3
[pid  5184] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5184] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5184] munmap(0x7f295dd73000, 262144) = 0
[pid  5184] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   52.125298][ T5182] loop0: detected capacity change from 0 to 512
[   52.133369][ T5182] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   52.146614][ T5182] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5184] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5184] close(3)                    = 0
[pid  5184] mkdir("./file1", 0777)      = 0
[pid  5184] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5184] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5184] chdir("./file1")            = 0
[pid  5184] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5184] close(4)                    = 0
[pid  5184] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5184] creat("./file1", 0410)      = 4
[pid  5184] exit_group(0)               = ?
[pid  5184] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5184, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
umount2("./92", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./92", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./92/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./92/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./92/binderfs")                 = 0
umount2("./92/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./92/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./92/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./92/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./92/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./92/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./92")                           = 0
mkdir("./93", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5186
./strace-static-x86_64: Process 5186 attached
[pid  5186] chdir("./93")               = 0
[pid  5186] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5186] setpgid(0, 0)               = 0
[pid  5186] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5186] write(3, "1000", 4)         = 4
[pid  5186] close(3)                    = 0
[pid  5186] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5186] memfd_create("syzkaller", 0) = 3
[pid  5186] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5186] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5186] munmap(0x7f295dd73000, 262144) = 0
[pid  5186] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   52.200536][ T5184] loop0: detected capacity change from 0 to 512
[   52.210875][ T5184] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   52.224335][ T5184] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5186] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5186] close(3)                    = 0
[pid  5186] mkdir("./file1", 0777)      = 0
[pid  5186] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5186] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5186] chdir("./file1")            = 0
[pid  5186] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5186] close(4)                    = 0
[pid  5186] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5186] creat("./file1", 0410)      = 4
[pid  5186] exit_group(0)               = ?
[pid  5186] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5186, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./93", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./93", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./93/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./93/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./93/binderfs")                 = 0
umount2("./93/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./93/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./93/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./93/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./93/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./93/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./93")                           = 0
mkdir("./94", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5188
./strace-static-x86_64: Process 5188 attached
[pid  5188] chdir("./94")               = 0
[pid  5188] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5188] setpgid(0, 0)               = 0
[pid  5188] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5188] write(3, "1000", 4)         = 4
[pid  5188] close(3)                    = 0
[pid  5188] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5188] memfd_create("syzkaller", 0) = 3
[pid  5188] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5188] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5188] munmap(0x7f295dd73000, 262144) = 0
[pid  5188] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   52.267402][ T5186] loop0: detected capacity change from 0 to 512
[   52.275519][ T5186] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   52.288803][ T5186] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5188] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5188] close(3)                    = 0
[pid  5188] mkdir("./file1", 0777)      = 0
[pid  5188] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5188] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5188] chdir("./file1")            = 0
[pid  5188] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5188] close(4)                    = 0
[pid  5188] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5188] creat("./file1", 0410)      = 4
[pid  5188] exit_group(0)               = ?
[pid  5188] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5188, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./94", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./94", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./94/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./94/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./94/binderfs")                 = 0
umount2("./94/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./94/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./94/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./94/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./94/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./94/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./94")                           = 0
mkdir("./95", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5191
./strace-static-x86_64: Process 5191 attached
[pid  5191] chdir("./95")               = 0
[pid  5191] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5191] setpgid(0, 0)               = 0
[pid  5191] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5191] write(3, "1000", 4)         = 4
[pid  5191] close(3)                    = 0
[pid  5191] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5191] memfd_create("syzkaller", 0) = 3
[pid  5191] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5191] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5191] munmap(0x7f295dd73000, 262144) = 0
[pid  5191] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   52.338772][ T5188] loop0: detected capacity change from 0 to 512
[   52.346730][ T5188] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   52.360271][ T5188] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5191] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5191] close(3)                    = 0
[pid  5191] mkdir("./file1", 0777)      = 0
[pid  5191] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5191] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5191] chdir("./file1")            = 0
[pid  5191] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5191] close(4)                    = 0
[pid  5191] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5191] creat("./file1", 0410)      = 4
[pid  5191] exit_group(0)               = ?
[pid  5191] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5191, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./95", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./95", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./95/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./95/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./95/binderfs")                 = 0
umount2("./95/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./95/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./95/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./95/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./95/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./95/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./95")                           = 0
mkdir("./96", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5193
./strace-static-x86_64: Process 5193 attached
[pid  5193] chdir("./96")               = 0
[pid  5193] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5193] setpgid(0, 0)               = 0
[pid  5193] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5193] write(3, "1000", 4)         = 4
[pid  5193] close(3)                    = 0
[pid  5193] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5193] memfd_create("syzkaller", 0) = 3
[pid  5193] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5193] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5193] munmap(0x7f295dd73000, 262144) = 0
[pid  5193] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   52.393414][ T5191] loop0: detected capacity change from 0 to 512
[   52.401494][ T5191] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   52.415101][ T5191] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5193] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5193] close(3)                    = 0
[pid  5193] mkdir("./file1", 0777)      = 0
[pid  5193] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5193] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5193] chdir("./file1")            = 0
[pid  5193] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5193] close(4)                    = 0
[pid  5193] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5193] creat("./file1", 0410)      = 4
[pid  5193] exit_group(0)               = ?
[pid  5193] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5193, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./96", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./96", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./96/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./96/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./96/binderfs")                 = 0
umount2("./96/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./96/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./96/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./96/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./96/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./96/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./96")                           = 0
mkdir("./97", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5195
./strace-static-x86_64: Process 5195 attached
[pid  5195] chdir("./97")               = 0
[pid  5195] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5195] setpgid(0, 0)               = 0
[pid  5195] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5195] write(3, "1000", 4)         = 4
[pid  5195] close(3)                    = 0
[pid  5195] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5195] memfd_create("syzkaller", 0) = 3
[pid  5195] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5195] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5195] munmap(0x7f295dd73000, 262144) = 0
[pid  5195] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   52.442306][ T5193] loop0: detected capacity change from 0 to 512
[   52.451693][ T5193] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   52.465021][ T5193] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5195] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5195] close(3)                    = 0
[pid  5195] mkdir("./file1", 0777)      = 0
[pid  5195] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5195] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5195] chdir("./file1")            = 0
[pid  5195] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5195] close(4)                    = 0
[pid  5195] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5195] creat("./file1", 0410)      = 4
[pid  5195] exit_group(0)               = ?
[pid  5195] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5195, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./97", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./97", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./97/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./97/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./97/binderfs")                 = 0
umount2("./97/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./97/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./97/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./97/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./97/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./97/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./97")                           = 0
mkdir("./98", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = 0
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5197
./strace-static-x86_64: Process 5197 attached
[pid  5197] chdir("./98")               = 0
[pid  5197] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5197] setpgid(0, 0)               = 0
[pid  5197] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5197] write(3, "1000", 4)         = 4
[pid  5197] close(3)                    = 0
[pid  5197] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5197] memfd_create("syzkaller", 0) = 3
[pid  5197] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5197] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5197] munmap(0x7f295dd73000, 262144) = 0
[pid  5197] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   52.492878][ T5195] loop0: detected capacity change from 0 to 512
[   52.501003][ T5195] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   52.513806][ T5195] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5197] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5197] close(3)                    = 0
[pid  5197] mkdir("./file1", 0777)      = 0
[pid  5197] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5197] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5197] chdir("./file1")            = 0
[pid  5197] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5197] close(4)                    = 0
[pid  5197] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5197] creat("./file1", 0410)      = 4
[pid  5197] exit_group(0)               = ?
[pid  5197] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5197, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./98", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./98", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./98/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./98/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./98/binderfs")                 = 0
umount2("./98/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./98/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./98/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./98/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./98/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./98/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./98")                           = 0
mkdir("./99", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5199
./strace-static-x86_64: Process 5199 attached
[pid  5199] chdir("./99")               = 0
[pid  5199] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5199] setpgid(0, 0)               = 0
[pid  5199] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5199] write(3, "1000", 4)         = 4
[pid  5199] close(3)                    = 0
[pid  5199] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5199] memfd_create("syzkaller", 0) = 3
[pid  5199] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5199] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5199] munmap(0x7f295dd73000, 262144) = 0
[pid  5199] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   52.551580][ T5197] loop0: detected capacity change from 0 to 512
[   52.560050][ T5197] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   52.573184][ T5197] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5199] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5199] close(3)                    = 0
[pid  5199] mkdir("./file1", 0777)      = 0
[pid  5199] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5199] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5199] chdir("./file1")            = 0
[pid  5199] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5199] close(4)                    = 0
[pid  5199] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5199] creat("./file1", 0410)      = 4
[pid  5199] exit_group(0)               = ?
[pid  5199] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5199, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./99", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./99", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./99/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./99/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./99/binderfs")                 = 0
umount2("./99/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./99/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./99/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./99/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./99/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./99/file1")                     = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./99")                           = 0
mkdir("./100", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5201 attached
 <unfinished ...>
[pid  5201] chdir("./100")              = 0
[pid  5201] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5201] setpgid(0, 0)               = 0
[pid  5201] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5201] write(3, "1000", 4)         = 4
[pid  5201] close(3)                    = 0
[pid  5201] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5201] memfd_create("syzkaller", 0) = 3
[pid  5201] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  4995] <... clone resumed>, child_tidptr=0x5555562e45d0) = 5201
[pid  5201] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5201] munmap(0x7f295dd73000, 262144) = 0
[pid  5201] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   52.620359][ T5199] loop0: detected capacity change from 0 to 512
[   52.628289][ T5199] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   52.642409][ T5199] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5201] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5201] close(3)                    = 0
[pid  5201] mkdir("./file1", 0777)      = 0
[pid  5201] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5201] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5201] chdir("./file1")            = 0
[pid  5201] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5201] close(4)                    = 0
[pid  5201] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5201] creat("./file1", 0410)      = 4
[pid  5201] exit_group(0)               = ?
[pid  5201] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5201, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./100", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./100", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./100/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./100/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./100/binderfs")                = 0
umount2("./100/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./100/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./100/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./100/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./100/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./100/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./100")                          = 0
mkdir("./101", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5203
./strace-static-x86_64: Process 5203 attached
[pid  5203] chdir("./101")              = 0
[pid  5203] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5203] setpgid(0, 0)               = 0
[pid  5203] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5203] write(3, "1000", 4)         = 4
[pid  5203] close(3)                    = 0
[pid  5203] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5203] memfd_create("syzkaller", 0) = 3
[pid  5203] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5203] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5203] munmap(0x7f295dd73000, 262144) = 0
[pid  5203] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   52.682205][ T5201] loop0: detected capacity change from 0 to 512
[   52.690594][ T5201] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   52.703987][ T5201] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5203] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5203] close(3)                    = 0
[pid  5203] mkdir("./file1", 0777)      = 0
[pid  5203] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5203] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5203] chdir("./file1")            = 0
[pid  5203] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5203] close(4)                    = 0
[pid  5203] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5203] creat("./file1", 0410)      = 4
[pid  5203] exit_group(0)               = ?
[pid  5203] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5203, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./101", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./101", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./101/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./101/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./101/binderfs")                = 0
umount2("./101/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./101/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./101/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./101/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./101/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./101/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./101")                          = 0
mkdir("./102", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5205
./strace-static-x86_64: Process 5205 attached
[pid  5205] chdir("./102")              = 0
[pid  5205] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5205] setpgid(0, 0)               = 0
[pid  5205] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5205] write(3, "1000", 4)         = 4
[pid  5205] close(3)                    = 0
[pid  5205] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5205] memfd_create("syzkaller", 0) = 3
[pid  5205] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5205] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5205] munmap(0x7f295dd73000, 262144) = 0
[pid  5205] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   52.746866][ T5203] loop0: detected capacity change from 0 to 512
[   52.755259][ T5203] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   52.768654][ T5203] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5205] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5205] close(3)                    = 0
[pid  5205] mkdir("./file1", 0777)      = 0
[pid  5205] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5205] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5205] chdir("./file1")            = 0
[pid  5205] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5205] close(4)                    = 0
[pid  5205] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5205] creat("./file1", 0410)      = 4
[pid  5205] exit_group(0)               = ?
[pid  5205] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5205, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
umount2("./102", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./102", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./102/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./102/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./102/binderfs")                = 0
umount2("./102/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./102/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./102/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./102/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./102/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./102/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./102")                          = 0
mkdir("./103", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5207
./strace-static-x86_64: Process 5207 attached
[pid  5207] chdir("./103")              = 0
[pid  5207] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5207] setpgid(0, 0)               = 0
[pid  5207] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5207] write(3, "1000", 4)         = 4
[pid  5207] close(3)                    = 0
[pid  5207] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5207] memfd_create("syzkaller", 0) = 3
[pid  5207] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5207] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5207] munmap(0x7f295dd73000, 262144) = 0
[pid  5207] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   52.814391][ T5205] loop0: detected capacity change from 0 to 512
[   52.823257][ T5205] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   52.836705][ T5205] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5207] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5207] close(3)                    = 0
[pid  5207] mkdir("./file1", 0777)      = 0
[pid  5207] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5207] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5207] chdir("./file1")            = 0
[pid  5207] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5207] close(4)                    = 0
[pid  5207] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5207] creat("./file1", 0410)      = 4
[pid  5207] exit_group(0)               = ?
[pid  5207] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5207, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
umount2("./103", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./103", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./103/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./103/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./103/binderfs")                = 0
umount2("./103/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./103/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./103/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./103/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./103/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./103/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./103")                          = 0
mkdir("./104", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5209
./strace-static-x86_64: Process 5209 attached
[pid  5209] chdir("./104")              = 0
[pid  5209] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5209] setpgid(0, 0)               = 0
[pid  5209] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5209] write(3, "1000", 4)         = 4
[pid  5209] close(3)                    = 0
[pid  5209] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5209] memfd_create("syzkaller", 0) = 3
[pid  5209] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5209] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5209] munmap(0x7f295dd73000, 262144) = 0
[pid  5209] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   52.882012][ T5207] loop0: detected capacity change from 0 to 512
[   52.889482][ T5207] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   52.902833][ T5207] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5209] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5209] close(3)                    = 0
[pid  5209] mkdir("./file1", 0777)      = 0
[pid  5209] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5209] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5209] chdir("./file1")            = 0
[pid  5209] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5209] close(4)                    = 0
[pid  5209] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5209] creat("./file1", 0410)      = 4
[pid  5209] exit_group(0)               = ?
[pid  5209] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5209, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./104", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./104", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./104/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./104/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./104/binderfs")                = 0
umount2("./104/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./104/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./104/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./104/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./104/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./104/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./104")                          = 0
mkdir("./105", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5211 attached
, child_tidptr=0x5555562e45d0) = 5211
[pid  5211] chdir("./105")              = 0
[pid  5211] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5211] setpgid(0, 0)               = 0
[pid  5211] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5211] write(3, "1000", 4)         = 4
[pid  5211] close(3)                    = 0
[pid  5211] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5211] memfd_create("syzkaller", 0) = 3
[pid  5211] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5211] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5211] munmap(0x7f295dd73000, 262144) = 0
[pid  5211] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   52.939795][ T5209] loop0: detected capacity change from 0 to 512
[   52.947991][ T5209] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   52.961612][ T5209] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5211] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5211] close(3)                    = 0
[pid  5211] mkdir("./file1", 0777)      = 0
[pid  5211] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5211] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5211] chdir("./file1")            = 0
[pid  5211] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5211] close(4)                    = 0
[pid  5211] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5211] creat("./file1", 0410)      = 4
[pid  5211] exit_group(0)               = ?
[pid  5211] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5211, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
umount2("./105", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./105", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./105/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./105/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./105/binderfs")                = 0
umount2("./105/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./105/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./105/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./105/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./105/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./105/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./105")                          = 0
mkdir("./106", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5213
./strace-static-x86_64: Process 5213 attached
[pid  5213] chdir("./106")              = 0
[pid  5213] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5213] setpgid(0, 0)               = 0
[pid  5213] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5213] write(3, "1000", 4)         = 4
[pid  5213] close(3)                    = 0
[pid  5213] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5213] memfd_create("syzkaller", 0) = 3
[pid  5213] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5213] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5213] munmap(0x7f295dd73000, 262144) = 0
[pid  5213] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   53.000519][ T5211] loop0: detected capacity change from 0 to 512
[   53.008747][ T5211] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   53.022251][ T5211] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5213] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5213] close(3)                    = 0
[pid  5213] mkdir("./file1", 0777)      = 0
[pid  5213] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5213] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5213] chdir("./file1")            = 0
[pid  5213] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5213] close(4)                    = 0
[pid  5213] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5213] creat("./file1", 0410)      = 4
[pid  5213] exit_group(0)               = ?
[pid  5213] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5213, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./106", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./106", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./106/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./106/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./106/binderfs")                = 0
umount2("./106/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./106/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./106/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./106/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./106/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./106/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./106")                          = 0
mkdir("./107", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5215 attached
 <unfinished ...>
[pid  5215] chdir("./107")              = 0
[pid  5215] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5215] setpgid(0, 0)               = 0
[pid  5215] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5215] write(3, "1000", 4)         = 4
[pid  5215] close(3)                    = 0
[pid  5215] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5215] memfd_create("syzkaller", 0) = 3
[pid  5215] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  4995] <... clone resumed>, child_tidptr=0x5555562e45d0) = 5215
[pid  5215] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5215] munmap(0x7f295dd73000, 262144) = 0
[pid  5215] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   53.058895][ T5213] loop0: detected capacity change from 0 to 512
[   53.067677][ T5213] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   53.081542][ T5213] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5215] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5215] close(3)                    = 0
[pid  5215] mkdir("./file1", 0777)      = 0
[pid  5215] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5215] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5215] chdir("./file1")            = 0
[pid  5215] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5215] close(4)                    = 0
[pid  5215] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5215] creat("./file1", 0410)      = 4
[pid  5215] exit_group(0)               = ?
[pid  5215] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5215, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./107", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./107", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./107/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./107/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./107/binderfs")                = 0
umount2("./107/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./107/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./107/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./107/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./107/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./107/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./107")                          = 0
mkdir("./108", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5217
./strace-static-x86_64: Process 5217 attached
[pid  5217] chdir("./108")              = 0
[pid  5217] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5217] setpgid(0, 0)               = 0
[pid  5217] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5217] write(3, "1000", 4)         = 4
[pid  5217] close(3)                    = 0
[pid  5217] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5217] memfd_create("syzkaller", 0) = 3
[pid  5217] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5217] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5217] munmap(0x7f295dd73000, 262144) = 0
[pid  5217] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   53.122982][ T5215] loop0: detected capacity change from 0 to 512
[   53.131596][ T5215] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   53.145515][ T5215] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5217] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5217] close(3)                    = 0
[pid  5217] mkdir("./file1", 0777)      = 0
[pid  5217] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5217] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5217] chdir("./file1")            = 0
[pid  5217] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5217] close(4)                    = 0
[pid  5217] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5217] creat("./file1", 0410)      = 4
[pid  5217] exit_group(0)               = ?
[pid  5217] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5217, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./108", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./108", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./108/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./108/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./108/binderfs")                = 0
umount2("./108/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./108/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./108/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./108/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./108/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./108/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./108")                          = 0
mkdir("./109", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5219
./strace-static-x86_64: Process 5219 attached
[pid  5219] chdir("./109")              = 0
[pid  5219] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5219] setpgid(0, 0)               = 0
[pid  5219] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5219] write(3, "1000", 4)         = 4
[pid  5219] close(3)                    = 0
[pid  5219] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5219] memfd_create("syzkaller", 0) = 3
[pid  5219] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5219] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5219] munmap(0x7f295dd73000, 262144) = 0
[pid  5219] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   53.187637][ T5217] loop0: detected capacity change from 0 to 512
[   53.195493][ T5217] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   53.209088][ T5217] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5219] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5219] close(3)                    = 0
[pid  5219] mkdir("./file1", 0777)      = 0
[pid  5219] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5219] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5219] chdir("./file1")            = 0
[pid  5219] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5219] close(4)                    = 0
[pid  5219] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5219] creat("./file1", 0410)      = 4
[pid  5219] exit_group(0)               = ?
[pid  5219] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5219, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./109", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./109", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./109/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./109/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./109/binderfs")                = 0
umount2("./109/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./109/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./109/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./109/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./109/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./109/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./109")                          = 0
mkdir("./110", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5221
./strace-static-x86_64: Process 5221 attached
[pid  5221] chdir("./110")              = 0
[pid  5221] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5221] setpgid(0, 0)               = 0
[pid  5221] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5221] write(3, "1000", 4)         = 4
[pid  5221] close(3)                    = 0
[pid  5221] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5221] memfd_create("syzkaller", 0) = 3
[pid  5221] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5221] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5221] munmap(0x7f295dd73000, 262144) = 0
[pid  5221] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   53.249194][ T5219] loop0: detected capacity change from 0 to 512
[   53.257511][ T5219] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   53.271426][ T5219] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5221] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5221] close(3)                    = 0
[pid  5221] mkdir("./file1", 0777)      = 0
[pid  5221] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5221] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5221] chdir("./file1")            = 0
[pid  5221] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5221] close(4)                    = 0
[pid  5221] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5221] creat("./file1", 0410)      = 4
[pid  5221] exit_group(0)               = ?
[pid  5221] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5221, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./110", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./110", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./110/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./110/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./110/binderfs")                = 0
umount2("./110/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./110/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./110/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./110/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./110/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./110/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./110")                          = 0
mkdir("./111", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5223
./strace-static-x86_64: Process 5223 attached
[pid  5223] chdir("./111")              = 0
[pid  5223] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5223] setpgid(0, 0)               = 0
[pid  5223] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5223] write(3, "1000", 4)         = 4
[pid  5223] close(3)                    = 0
[pid  5223] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5223] memfd_create("syzkaller", 0) = 3
[pid  5223] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5223] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5223] munmap(0x7f295dd73000, 262144) = 0
[pid  5223] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   53.311118][ T5221] loop0: detected capacity change from 0 to 512
[   53.319879][ T5221] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   53.333458][ T5221] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5223] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5223] close(3)                    = 0
[pid  5223] mkdir("./file1", 0777)      = 0
[pid  5223] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5223] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5223] chdir("./file1")            = 0
[pid  5223] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5223] close(4)                    = 0
[pid  5223] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5223] creat("./file1", 0410)      = 4
[pid  5223] exit_group(0)               = ?
[pid  5223] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5223, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./111", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./111", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./111/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./111/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./111/binderfs")                = 0
umount2("./111/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./111/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./111/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./111/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./111/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./111/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./111")                          = 0
mkdir("./112", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5225 attached
, child_tidptr=0x5555562e45d0) = 5225
[pid  5225] chdir("./112")              = 0
[pid  5225] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5225] setpgid(0, 0)               = 0
[pid  5225] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5225] write(3, "1000", 4)         = 4
[pid  5225] close(3)                    = 0
[pid  5225] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5225] memfd_create("syzkaller", 0) = 3
[pid  5225] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5225] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5225] munmap(0x7f295dd73000, 262144) = 0
[pid  5225] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   53.366671][ T5223] loop0: detected capacity change from 0 to 512
[   53.374782][ T5223] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   53.388171][ T5223] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5225] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5225] close(3)                    = 0
[pid  5225] mkdir("./file1", 0777)      = 0
[pid  5225] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5225] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5225] chdir("./file1")            = 0
[pid  5225] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5225] close(4)                    = 0
[pid  5225] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5225] creat("./file1", 0410)      = 4
[pid  5225] exit_group(0)               = ?
[pid  5225] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5225, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./112", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./112", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./112/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./112/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./112/binderfs")                = 0
umount2("./112/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./112/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./112/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./112/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./112/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./112/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./112")                          = 0
mkdir("./113", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5227
./strace-static-x86_64: Process 5227 attached
[pid  5227] chdir("./113")              = 0
[pid  5227] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5227] setpgid(0, 0)               = 0
[pid  5227] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5227] write(3, "1000", 4)         = 4
[pid  5227] close(3)                    = 0
[pid  5227] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5227] memfd_create("syzkaller", 0) = 3
[pid  5227] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5227] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5227] munmap(0x7f295dd73000, 262144) = 0
[pid  5227] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   53.422814][ T5225] loop0: detected capacity change from 0 to 512
[   53.431575][ T5225] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   53.444797][ T5225] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5227] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5227] close(3)                    = 0
[pid  5227] mkdir("./file1", 0777)      = 0
[pid  5227] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5227] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5227] chdir("./file1")            = 0
[pid  5227] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5227] close(4)                    = 0
[pid  5227] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5227] creat("./file1", 0410)      = 4
[pid  5227] exit_group(0)               = ?
[pid  5227] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5227, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./113", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./113", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./113/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./113/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./113/binderfs")                = 0
umount2("./113/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./113/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./113/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./113/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./113/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./113/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./113")                          = 0
mkdir("./114", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5229
./strace-static-x86_64: Process 5229 attached
[pid  5229] chdir("./114")              = 0
[pid  5229] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5229] setpgid(0, 0)               = 0
[pid  5229] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5229] write(3, "1000", 4)         = 4
[pid  5229] close(3)                    = 0
[pid  5229] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5229] memfd_create("syzkaller", 0) = 3
[pid  5229] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5229] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5229] munmap(0x7f295dd73000, 262144) = 0
[pid  5229] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   53.478472][ T5227] loop0: detected capacity change from 0 to 512
[   53.486917][ T5227] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   53.500214][ T5227] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5229] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5229] close(3)                    = 0
[pid  5229] mkdir("./file1", 0777)      = 0
[pid  5229] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5229] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5229] chdir("./file1")            = 0
[pid  5229] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5229] close(4)                    = 0
[pid  5229] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5229] creat("./file1", 0410)      = 4
[pid  5229] exit_group(0)               = ?
[pid  5229] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5229, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
umount2("./114", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./114", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./114/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./114/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./114/binderfs")                = 0
umount2("./114/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./114/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./114/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./114/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./114/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./114/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./114")                          = 0
mkdir("./115", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5231 attached
 <unfinished ...>
[pid  5231] chdir("./115")              = 0
[pid  5231] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5231] setpgid(0, 0)               = 0
[pid  5231] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4995] <... clone resumed>, child_tidptr=0x5555562e45d0) = 5231
[pid  5231] <... openat resumed>)       = 3
[pid  5231] write(3, "1000", 4)         = 4
[pid  5231] close(3)                    = 0
[pid  5231] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5231] memfd_create("syzkaller", 0) = 3
[pid  5231] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5231] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5231] munmap(0x7f295dd73000, 262144) = 0
[pid  5231] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   53.547461][ T5229] loop0: detected capacity change from 0 to 512
[   53.555602][ T5229] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   53.568973][ T5229] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5231] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5231] close(3)                    = 0
[pid  5231] mkdir("./file1", 0777)      = 0
[pid  5231] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5231] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5231] chdir("./file1")            = 0
[pid  5231] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5231] close(4)                    = 0
[pid  5231] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5231] creat("./file1", 0410)      = 4
[pid  5231] exit_group(0)               = ?
[pid  5231] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5231, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
umount2("./115", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./115", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./115/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./115/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./115/binderfs")                = 0
umount2("./115/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./115/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./115/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./115/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./115/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./115/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./115")                          = 0
mkdir("./116", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5233 attached
, child_tidptr=0x5555562e45d0) = 5233
[pid  5233] chdir("./116")              = 0
[pid  5233] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5233] setpgid(0, 0)               = 0
[pid  5233] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5233] write(3, "1000", 4)         = 4
[pid  5233] close(3)                    = 0
[pid  5233] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5233] memfd_create("syzkaller", 0) = 3
[pid  5233] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5233] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5233] munmap(0x7f295dd73000, 262144) = 0
[pid  5233] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   53.626266][ T5231] loop0: detected capacity change from 0 to 512
[   53.635303][ T5231] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   53.648867][ T5231] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5233] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5233] close(3)                    = 0
[pid  5233] mkdir("./file1", 0777)      = 0
[pid  5233] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5233] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5233] chdir("./file1")            = 0
[pid  5233] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5233] close(4)                    = 0
[pid  5233] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5233] creat("./file1", 0410)      = 4
[pid  5233] exit_group(0)               = ?
[pid  5233] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5233, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./116", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./116", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./116/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./116/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./116/binderfs")                = 0
umount2("./116/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./116/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./116/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./116/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./116/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./116/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./116")                          = 0
mkdir("./117", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5235
./strace-static-x86_64: Process 5235 attached
[pid  5235] chdir("./117")              = 0
[pid  5235] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5235] setpgid(0, 0)               = 0
[pid  5235] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5235] write(3, "1000", 4)         = 4
[pid  5235] close(3)                    = 0
[pid  5235] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5235] memfd_create("syzkaller", 0) = 3
[pid  5235] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5235] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5235] munmap(0x7f295dd73000, 262144) = 0
[pid  5235] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   53.678519][ T5233] loop0: detected capacity change from 0 to 512
[   53.687941][ T5233] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   53.702038][ T5233] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5235] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5235] close(3)                    = 0
[pid  5235] mkdir("./file1", 0777)      = 0
[pid  5235] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5235] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5235] chdir("./file1")            = 0
[pid  5235] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5235] close(4)                    = 0
[pid  5235] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5235] creat("./file1", 0410)      = 4
[pid  5235] exit_group(0)               = ?
[pid  5235] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5235, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./117", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./117", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./117/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./117/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./117/binderfs")                = 0
umount2("./117/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./117/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./117/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./117/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./117/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./117/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./117")                          = 0
mkdir("./118", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5237 attached
, child_tidptr=0x5555562e45d0) = 5237
[pid  5237] chdir("./118")              = 0
[pid  5237] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5237] setpgid(0, 0)               = 0
[pid  5237] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5237] write(3, "1000", 4)         = 4
[pid  5237] close(3)                    = 0
[pid  5237] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5237] memfd_create("syzkaller", 0) = 3
[pid  5237] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5237] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5237] munmap(0x7f295dd73000, 262144) = 0
[pid  5237] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   53.747260][ T5235] loop0: detected capacity change from 0 to 512
[   53.756568][ T5235] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   53.769723][ T5235] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5237] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5237] close(3)                    = 0
[pid  5237] mkdir("./file1", 0777)      = 0
[pid  5237] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5237] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5237] chdir("./file1")            = 0
[pid  5237] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5237] close(4)                    = 0
[pid  5237] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5237] creat("./file1", 0410)      = 4
[pid  5237] exit_group(0)               = ?
[pid  5237] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5237, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
umount2("./118", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./118", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./118/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./118/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./118/binderfs")                = 0
umount2("./118/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./118/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./118/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./118/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./118/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./118/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./118")                          = 0
mkdir("./119", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5239
./strace-static-x86_64: Process 5239 attached
[pid  5239] chdir("./119")              = 0
[pid  5239] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5239] setpgid(0, 0)               = 0
[pid  5239] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5239] write(3, "1000", 4)         = 4
[pid  5239] close(3)                    = 0
[pid  5239] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5239] memfd_create("syzkaller", 0) = 3
[pid  5239] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5239] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5239] munmap(0x7f295dd73000, 262144) = 0
[pid  5239] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   53.809020][ T5237] loop0: detected capacity change from 0 to 512
[   53.818134][ T5237] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   53.831975][ T5237] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5239] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5239] close(3)                    = 0
[pid  5239] mkdir("./file1", 0777)      = 0
[pid  5239] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5239] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5239] chdir("./file1")            = 0
[pid  5239] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5239] close(4)                    = 0
[pid  5239] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5239] creat("./file1", 0410)      = 4
[pid  5239] exit_group(0)               = ?
[pid  5239] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5239, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./119", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./119", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./119/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./119/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./119/binderfs")                = 0
umount2("./119/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./119/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./119/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./119/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./119/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./119/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./119")                          = 0
mkdir("./120", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5241
./strace-static-x86_64: Process 5241 attached
[pid  5241] chdir("./120")              = 0
[pid  5241] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5241] setpgid(0, 0)               = 0
[pid  5241] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5241] write(3, "1000", 4)         = 4
[pid  5241] close(3)                    = 0
[pid  5241] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5241] memfd_create("syzkaller", 0) = 3
[pid  5241] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5241] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5241] munmap(0x7f295dd73000, 262144) = 0
[   53.865232][ T5239] loop0: detected capacity change from 0 to 512
[   53.873305][ T5239] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   53.887255][ T5239] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5241] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5241] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5241] close(3)                    = 0
[pid  5241] mkdir("./file1", 0777)      = 0
[pid  5241] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5241] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5241] chdir("./file1")            = 0
[pid  5241] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5241] close(4)                    = 0
[pid  5241] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5241] creat("./file1", 0410)      = 4
[pid  5241] exit_group(0)               = ?
[pid  5241] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5241, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./120", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./120", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./120/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./120/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./120/binderfs")                = 0
umount2("./120/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./120/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./120/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./120/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./120/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./120/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./120")                          = 0
mkdir("./121", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5243
./strace-static-x86_64: Process 5243 attached
[pid  5243] chdir("./121")              = 0
[pid  5243] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5243] setpgid(0, 0)               = 0
[pid  5243] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5243] write(3, "1000", 4)         = 4
[pid  5243] close(3)                    = 0
[pid  5243] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5243] memfd_create("syzkaller", 0) = 3
[pid  5243] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5243] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5243] munmap(0x7f295dd73000, 262144) = 0
[pid  5243] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   53.947296][ T5241] loop0: detected capacity change from 0 to 512
[   53.955370][ T5241] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   53.969049][ T5241] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5243] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5243] close(3)                    = 0
[pid  5243] mkdir("./file1", 0777)      = 0
[pid  5243] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5243] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5243] chdir("./file1")            = 0
[pid  5243] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5243] close(4)                    = 0
[pid  5243] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5243] creat("./file1", 0410)      = 4
[pid  5243] exit_group(0)               = ?
[pid  5243] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5243, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./121", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./121", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./121/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./121/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./121/binderfs")                = 0
umount2("./121/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./121/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./121/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./121/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./121/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./121/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./121")                          = 0
mkdir("./122", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5245
./strace-static-x86_64: Process 5245 attached
[pid  5245] chdir("./122")              = 0
[pid  5245] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5245] setpgid(0, 0)               = 0
[pid  5245] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5245] write(3, "1000", 4)         = 4
[pid  5245] close(3)                    = 0
[pid  5245] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5245] memfd_create("syzkaller", 0) = 3
[pid  5245] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5245] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5245] munmap(0x7f295dd73000, 262144) = 0
[pid  5245] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   54.010988][ T5243] loop0: detected capacity change from 0 to 512
[   54.019267][ T5243] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   54.034205][ T5243] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5245] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5245] close(3)                    = 0
[pid  5245] mkdir("./file1", 0777)      = 0
[pid  5245] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5245] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5245] chdir("./file1")            = 0
[pid  5245] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5245] close(4)                    = 0
[pid  5245] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5245] creat("./file1", 0410)      = 4
[pid  5245] exit_group(0)               = ?
[pid  5245] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5245, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
umount2("./122", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./122", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./122/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./122/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./122/binderfs")                = 0
umount2("./122/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./122/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./122/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./122/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./122/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./122/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./122")                          = 0
mkdir("./123", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5247
./strace-static-x86_64: Process 5247 attached
[pid  5247] chdir("./123")              = 0
[pid  5247] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5247] setpgid(0, 0)               = 0
[pid  5247] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5247] write(3, "1000", 4)         = 4
[pid  5247] close(3)                    = 0
[pid  5247] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5247] memfd_create("syzkaller", 0) = 3
[pid  5247] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5247] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5247] munmap(0x7f295dd73000, 262144) = 0
[pid  5247] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   54.082020][ T5245] loop0: detected capacity change from 0 to 512
[   54.089754][ T5245] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   54.102867][ T5245] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5247] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5247] close(3)                    = 0
[pid  5247] mkdir("./file1", 0777)      = 0
[pid  5247] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5247] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5247] chdir("./file1")            = 0
[pid  5247] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5247] close(4)                    = 0
[pid  5247] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5247] creat("./file1", 0410)      = 4
[pid  5247] exit_group(0)               = ?
[pid  5247] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5247, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./123", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./123", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./123/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./123/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./123/binderfs")                = 0
umount2("./123/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./123/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./123/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./123/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./123/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./123/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./123")                          = 0
mkdir("./124", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5249 attached
, child_tidptr=0x5555562e45d0) = 5249
[pid  5249] chdir("./124")              = 0
[pid  5249] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5249] setpgid(0, 0)               = 0
[pid  5249] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5249] write(3, "1000", 4)         = 4
[pid  5249] close(3)                    = 0
[pid  5249] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5249] memfd_create("syzkaller", 0) = 3
[pid  5249] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5249] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5249] munmap(0x7f295dd73000, 262144) = 0
[pid  5249] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   54.136630][ T5247] loop0: detected capacity change from 0 to 512
[   54.145969][ T5247] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   54.159474][ T5247] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5249] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5249] close(3)                    = 0
[pid  5249] mkdir("./file1", 0777)      = 0
[pid  5249] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5249] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5249] chdir("./file1")            = 0
[pid  5249] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5249] close(4)                    = 0
[pid  5249] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5249] creat("./file1", 0410)      = 4
[pid  5249] exit_group(0)               = ?
[pid  5249] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5249, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./124", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./124", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./124/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./124/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./124/binderfs")                = 0
umount2("./124/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./124/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./124/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./124/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./124/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./124/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./124")                          = 0
mkdir("./125", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5251
./strace-static-x86_64: Process 5251 attached
[pid  5251] chdir("./125")              = 0
[pid  5251] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5251] setpgid(0, 0)               = 0
[pid  5251] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5251] write(3, "1000", 4)         = 4
[pid  5251] close(3)                    = 0
[pid  5251] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5251] memfd_create("syzkaller", 0) = 3
[pid  5251] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5251] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5251] munmap(0x7f295dd73000, 262144) = 0
[pid  5251] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   54.204888][ T5249] loop0: detected capacity change from 0 to 512
[   54.214131][ T5249] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   54.227152][ T5249] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5251] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5251] close(3)                    = 0
[pid  5251] mkdir("./file1", 0777)      = 0
[pid  5251] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5251] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5251] chdir("./file1")            = 0
[pid  5251] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5251] close(4)                    = 0
[pid  5251] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5251] creat("./file1", 0410)      = 4
[pid  5251] exit_group(0)               = ?
[pid  5251] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5251, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
umount2("./125", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./125", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./125/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./125/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./125/binderfs")                = 0
umount2("./125/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./125/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./125/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./125/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./125/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./125/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./125")                          = 0
mkdir("./126", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5253
./strace-static-x86_64: Process 5253 attached
[pid  5253] chdir("./126")              = 0
[pid  5253] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5253] setpgid(0, 0)               = 0
[pid  5253] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5253] write(3, "1000", 4)         = 4
[pid  5253] close(3)                    = 0
[pid  5253] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5253] memfd_create("syzkaller", 0) = 3
[pid  5253] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5253] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5253] munmap(0x7f295dd73000, 262144) = 0
[pid  5253] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   54.260363][ T5251] loop0: detected capacity change from 0 to 512
[   54.270152][ T5251] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   54.284944][ T5251] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5253] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5253] close(3)                    = 0
[pid  5253] mkdir("./file1", 0777)      = 0
[pid  5253] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5253] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5253] chdir("./file1")            = 0
[pid  5253] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5253] close(4)                    = 0
[pid  5253] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5253] creat("./file1", 0410)      = 4
[pid  5253] exit_group(0)               = ?
[pid  5253] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5253, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./126", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./126", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./126/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./126/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./126/binderfs")                = 0
umount2("./126/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./126/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./126/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./126/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./126/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./126/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./126")                          = 0
mkdir("./127", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5255
./strace-static-x86_64: Process 5255 attached
[pid  5255] chdir("./127")              = 0
[pid  5255] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5255] setpgid(0, 0)               = 0
[pid  5255] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5255] write(3, "1000", 4)         = 4
[pid  5255] close(3)                    = 0
[pid  5255] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5255] memfd_create("syzkaller", 0) = 3
[pid  5255] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5255] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5255] munmap(0x7f295dd73000, 262144) = 0
[pid  5255] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   54.322037][ T5253] loop0: detected capacity change from 0 to 512
[   54.330201][ T5253] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   54.343273][ T5253] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5255] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5255] close(3)                    = 0
[pid  5255] mkdir("./file1", 0777)      = 0
[pid  5255] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5255] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5255] chdir("./file1")            = 0
[pid  5255] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5255] close(4)                    = 0
[pid  5255] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5255] creat("./file1", 0410)      = 4
[pid  5255] exit_group(0)               = ?
[pid  5255] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5255, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./127", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./127", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./127/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./127/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./127/binderfs")                = 0
umount2("./127/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./127/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./127/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./127/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./127/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./127/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./127")                          = 0
mkdir("./128", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5257
./strace-static-x86_64: Process 5257 attached
[pid  5257] chdir("./128")              = 0
[pid  5257] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5257] setpgid(0, 0)               = 0
[pid  5257] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5257] write(3, "1000", 4)         = 4
[pid  5257] close(3)                    = 0
[pid  5257] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5257] memfd_create("syzkaller", 0) = 3
[pid  5257] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5257] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5257] munmap(0x7f295dd73000, 262144) = 0
[pid  5257] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   54.380430][ T5255] loop0: detected capacity change from 0 to 512
[   54.388134][ T5255] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   54.402053][ T5255] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5257] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5257] close(3)                    = 0
[pid  5257] mkdir("./file1", 0777)      = 0
[pid  5257] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5257] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5257] chdir("./file1")            = 0
[pid  5257] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5257] close(4)                    = 0
[pid  5257] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5257] creat("./file1", 0410)      = 4
[pid  5257] exit_group(0)               = ?
[pid  5257] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5257, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
umount2("./128", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./128", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./128/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./128/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./128/binderfs")                = 0
umount2("./128/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./128/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./128/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./128/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./128/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./128/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./128")                          = 0
mkdir("./129", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5259
./strace-static-x86_64: Process 5259 attached
[pid  5259] chdir("./129")              = 0
[pid  5259] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5259] setpgid(0, 0)               = 0
[pid  5259] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5259] write(3, "1000", 4)         = 4
[pid  5259] close(3)                    = 0
[pid  5259] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5259] memfd_create("syzkaller", 0) = 3
[pid  5259] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5259] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5259] munmap(0x7f295dd73000, 262144) = 0
[pid  5259] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   54.437370][ T5257] loop0: detected capacity change from 0 to 512
[   54.445174][ T5257] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   54.458586][ T5257] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5259] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5259] close(3)                    = 0
[pid  5259] mkdir("./file1", 0777)      = 0
[pid  5259] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5259] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5259] chdir("./file1")            = 0
[pid  5259] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5259] close(4)                    = 0
[pid  5259] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5259] creat("./file1", 0410)      = 4
[pid  5259] exit_group(0)               = ?
[pid  5259] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5259, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./129", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./129", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./129/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./129/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./129/binderfs")                = 0
umount2("./129/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./129/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./129/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./129/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./129/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./129/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./129")                          = 0
mkdir("./130", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5261
./strace-static-x86_64: Process 5261 attached
[pid  5261] chdir("./130")              = 0
[pid  5261] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5261] setpgid(0, 0)               = 0
[pid  5261] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5261] write(3, "1000", 4)         = 4
[pid  5261] close(3)                    = 0
[pid  5261] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5261] memfd_create("syzkaller", 0) = 3
[pid  5261] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5261] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5261] munmap(0x7f295dd73000, 262144) = 0
[pid  5261] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   54.506961][ T5259] loop0: detected capacity change from 0 to 512
[   54.514857][ T5259] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   54.527913][ T5259] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5261] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5261] close(3)                    = 0
[pid  5261] mkdir("./file1", 0777)      = 0
[pid  5261] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5261] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5261] chdir("./file1")            = 0
[pid  5261] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5261] close(4)                    = 0
[pid  5261] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5261] creat("./file1", 0410)      = 4
[pid  5261] exit_group(0)               = ?
[pid  5261] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5261, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
umount2("./130", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./130", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./130/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./130/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./130/binderfs")                = 0
umount2("./130/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./130/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./130/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./130/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./130/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./130/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./130")                          = 0
mkdir("./131", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5263
./strace-static-x86_64: Process 5263 attached
[pid  5263] chdir("./131")              = 0
[pid  5263] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5263] setpgid(0, 0)               = 0
[pid  5263] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5263] write(3, "1000", 4)         = 4
[pid  5263] close(3)                    = 0
[pid  5263] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5263] memfd_create("syzkaller", 0) = 3
[pid  5263] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5263] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5263] munmap(0x7f295dd73000, 262144) = 0
[pid  5263] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   54.565540][ T5261] loop0: detected capacity change from 0 to 512
[   54.573531][ T5261] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   54.587300][ T5261] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5263] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5263] close(3)                    = 0
[pid  5263] mkdir("./file1", 0777)      = 0
[pid  5263] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5263] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5263] chdir("./file1")            = 0
[pid  5263] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5263] close(4)                    = 0
[pid  5263] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5263] creat("./file1", 0410)      = 4
[pid  5263] exit_group(0)               = ?
[pid  5263] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5263, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
umount2("./131", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./131", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./131/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./131/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./131/binderfs")                = 0
umount2("./131/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./131/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./131/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./131/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./131/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./131/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./131")                          = 0
mkdir("./132", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5265
./strace-static-x86_64: Process 5265 attached
[pid  5265] chdir("./132")              = 0
[pid  5265] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5265] setpgid(0, 0)               = 0
[pid  5265] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5265] write(3, "1000", 4)         = 4
[pid  5265] close(3)                    = 0
[pid  5265] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5265] memfd_create("syzkaller", 0) = 3
[pid  5265] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5265] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5265] munmap(0x7f295dd73000, 262144) = 0
[pid  5265] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   54.614495][ T5263] loop0: detected capacity change from 0 to 512
[   54.622517][ T5263] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   54.635929][ T5263] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5265] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5265] close(3)                    = 0
[pid  5265] mkdir("./file1", 0777)      = 0
[pid  5265] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5265] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5265] chdir("./file1")            = 0
[pid  5265] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5265] close(4)                    = 0
[pid  5265] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5265] creat("./file1", 0410)      = 4
[pid  5265] exit_group(0)               = ?
[pid  5265] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5265, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./132", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./132", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./132/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./132/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./132/binderfs")                = 0
umount2("./132/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./132/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./132/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./132/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./132/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./132/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./132")                          = 0
mkdir("./133", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5267 attached
, child_tidptr=0x5555562e45d0) = 5267
[pid  5267] chdir("./133")              = 0
[pid  5267] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5267] setpgid(0, 0)               = 0
[pid  5267] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5267] write(3, "1000", 4)         = 4
[pid  5267] close(3)                    = 0
[pid  5267] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5267] memfd_create("syzkaller", 0) = 3
[pid  5267] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5267] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5267] munmap(0x7f295dd73000, 262144) = 0
[pid  5267] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   54.666675][ T5265] loop0: detected capacity change from 0 to 512
[   54.674583][ T5265] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   54.687883][ T5265] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5267] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5267] close(3)                    = 0
[pid  5267] mkdir("./file1", 0777)      = 0
[pid  5267] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5267] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5267] chdir("./file1")            = 0
[pid  5267] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5267] close(4)                    = 0
[pid  5267] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5267] creat("./file1", 0410)      = 4
[pid  5267] exit_group(0)               = ?
[pid  5267] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5267, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
umount2("./133", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./133", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./133/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./133/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./133/binderfs")                = 0
umount2("./133/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./133/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./133/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./133/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./133/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./133/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./133")                          = 0
mkdir("./134", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5269
./strace-static-x86_64: Process 5269 attached
[pid  5269] chdir("./134")              = 0
[pid  5269] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5269] setpgid(0, 0)               = 0
[pid  5269] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5269] write(3, "1000", 4)         = 4
[pid  5269] close(3)                    = 0
[pid  5269] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5269] memfd_create("syzkaller", 0) = 3
[pid  5269] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5269] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5269] munmap(0x7f295dd73000, 262144) = 0
[pid  5269] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   54.727344][ T5267] loop0: detected capacity change from 0 to 512
[   54.736361][ T5267] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   54.750033][ T5267] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5269] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5269] close(3)                    = 0
[pid  5269] mkdir("./file1", 0777)      = 0
[pid  5269] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5269] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5269] chdir("./file1")            = 0
[pid  5269] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5269] close(4)                    = 0
[pid  5269] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5269] creat("./file1", 0410)      = 4
[pid  5269] exit_group(0)               = ?
[pid  5269] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5269, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./134", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./134", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./134/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./134/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./134/binderfs")                = 0
umount2("./134/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./134/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./134/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./134/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./134/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./134/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./134")                          = 0
mkdir("./135", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5271 attached
, child_tidptr=0x5555562e45d0) = 5271
[pid  5271] chdir("./135")              = 0
[pid  5271] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5271] setpgid(0, 0)               = 0
[pid  5271] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5271] write(3, "1000", 4)         = 4
[pid  5271] close(3)                    = 0
[pid  5271] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5271] memfd_create("syzkaller", 0) = 3
[pid  5271] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5271] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5271] munmap(0x7f295dd73000, 262144) = 0
[pid  5271] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   54.782772][ T5269] loop0: detected capacity change from 0 to 512
[   54.791230][ T5269] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   54.804798][ T5269] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5271] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5271] close(3)                    = 0
[pid  5271] mkdir("./file1", 0777)      = 0
[pid  5271] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5271] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5271] chdir("./file1")            = 0
[pid  5271] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5271] close(4)                    = 0
[pid  5271] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5271] creat("./file1", 0410)      = 4
[pid  5271] exit_group(0)               = ?
[pid  5271] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5271, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./135", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./135", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./135/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./135/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./135/binderfs")                = 0
umount2("./135/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./135/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./135/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./135/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./135/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./135/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./135")                          = 0
mkdir("./136", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5273
./strace-static-x86_64: Process 5273 attached
[pid  5273] chdir("./136")              = 0
[pid  5273] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5273] setpgid(0, 0)               = 0
[pid  5273] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5273] write(3, "1000", 4)         = 4
[pid  5273] close(3)                    = 0
[pid  5273] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5273] memfd_create("syzkaller", 0) = 3
[pid  5273] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5273] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5273] munmap(0x7f295dd73000, 262144) = 0
[pid  5273] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   54.850506][ T5271] loop0: detected capacity change from 0 to 512
[   54.858602][ T5271] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   54.872168][ T5271] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5273] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5273] close(3)                    = 0
[pid  5273] mkdir("./file1", 0777)      = 0
[pid  5273] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5273] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5273] chdir("./file1")            = 0
[pid  5273] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5273] close(4)                    = 0
[pid  5273] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5273] creat("./file1", 0410)      = 4
[pid  5273] exit_group(0)               = ?
[pid  5273] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5273, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./136", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./136", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./136/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./136/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./136/binderfs")                = 0
umount2("./136/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./136/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./136/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./136/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./136/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./136/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./136")                          = 0
mkdir("./137", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5275
./strace-static-x86_64: Process 5275 attached
[pid  5275] chdir("./137")              = 0
[pid  5275] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5275] setpgid(0, 0)               = 0
[pid  5275] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5275] write(3, "1000", 4)         = 4
[pid  5275] close(3)                    = 0
[pid  5275] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5275] memfd_create("syzkaller", 0) = 3
[pid  5275] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5275] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5275] munmap(0x7f295dd73000, 262144) = 0
[pid  5275] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   54.913385][ T5273] loop0: detected capacity change from 0 to 512
[   54.921597][ T5273] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   54.935186][ T5273] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5275] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5275] close(3)                    = 0
[pid  5275] mkdir("./file1", 0777)      = 0
[pid  5275] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5275] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5275] chdir("./file1")            = 0
[pid  5275] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5275] close(4)                    = 0
[pid  5275] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5275] creat("./file1", 0410)      = 4
[pid  5275] exit_group(0)               = ?
[pid  5275] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5275, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./137", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./137", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./137/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./137/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./137/binderfs")                = 0
umount2("./137/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./137/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./137/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./137/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./137/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./137/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./137")                          = 0
mkdir("./138", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5277
./strace-static-x86_64: Process 5277 attached
[pid  5277] chdir("./138")              = 0
[pid  5277] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5277] setpgid(0, 0)               = 0
[pid  5277] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5277] write(3, "1000", 4)         = 4
[pid  5277] close(3)                    = 0
[pid  5277] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5277] memfd_create("syzkaller", 0) = 3
[pid  5277] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5277] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5277] munmap(0x7f295dd73000, 262144) = 0
[pid  5277] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   54.970121][ T5275] loop0: detected capacity change from 0 to 512
[   54.978114][ T5275] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   54.992191][ T5275] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5277] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5277] close(3)                    = 0
[pid  5277] mkdir("./file1", 0777)      = 0
[pid  5277] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5277] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5277] chdir("./file1")            = 0
[pid  5277] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5277] close(4)                    = 0
[pid  5277] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5277] creat("./file1", 0410)      = 4
[pid  5277] exit_group(0)               = ?
[pid  5277] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5277, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./138", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./138", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./138/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./138/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./138/binderfs")                = 0
umount2("./138/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./138/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./138/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./138/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./138/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./138/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./138")                          = 0
mkdir("./139", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5279
./strace-static-x86_64: Process 5279 attached
[pid  5279] chdir("./139")              = 0
[pid  5279] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5279] setpgid(0, 0)               = 0
[pid  5279] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5279] write(3, "1000", 4)         = 4
[pid  5279] close(3)                    = 0
[pid  5279] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5279] memfd_create("syzkaller", 0) = 3
[pid  5279] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5279] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5279] munmap(0x7f295dd73000, 262144) = 0
[pid  5279] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   55.035870][ T5277] loop0: detected capacity change from 0 to 512
[   55.043696][ T5277] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   55.057220][ T5277] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5279] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5279] close(3)                    = 0
[pid  5279] mkdir("./file1", 0777)      = 0
[pid  5279] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5279] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5279] chdir("./file1")            = 0
[pid  5279] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5279] close(4)                    = 0
[pid  5279] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5279] creat("./file1", 0410)      = 4
[pid  5279] exit_group(0)               = ?
[pid  5279] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5279, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
umount2("./139", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./139", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./139/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./139/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./139/binderfs")                = 0
umount2("./139/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./139/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./139/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./139/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./139/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./139/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./139")                          = 0
mkdir("./140", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5281
./strace-static-x86_64: Process 5281 attached
[pid  5281] chdir("./140")              = 0
[pid  5281] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5281] setpgid(0, 0)               = 0
[pid  5281] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5281] write(3, "1000", 4)         = 4
[pid  5281] close(3)                    = 0
[pid  5281] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5281] memfd_create("syzkaller", 0) = 3
[pid  5281] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5281] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5281] munmap(0x7f295dd73000, 262144) = 0
[pid  5281] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   55.081128][ T5279] loop0: detected capacity change from 0 to 512
[   55.089045][ T5279] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   55.102498][ T5279] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5281] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5281] close(3)                    = 0
[pid  5281] mkdir("./file1", 0777)      = 0
[pid  5281] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5281] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5281] chdir("./file1")            = 0
[pid  5281] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5281] close(4)                    = 0
[pid  5281] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5281] creat("./file1", 0410)      = 4
[pid  5281] exit_group(0)               = ?
[pid  5281] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5281, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
umount2("./140", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./140", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./140/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./140/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./140/binderfs")                = 0
umount2("./140/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./140/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./140/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./140/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./140/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./140/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./140")                          = 0
mkdir("./141", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5283
./strace-static-x86_64: Process 5283 attached
[pid  5283] chdir("./141")              = 0
[pid  5283] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5283] setpgid(0, 0)               = 0
[pid  5283] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5283] write(3, "1000", 4)         = 4
[pid  5283] close(3)                    = 0
[pid  5283] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5283] memfd_create("syzkaller", 0) = 3
[pid  5283] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5283] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5283] munmap(0x7f295dd73000, 262144) = 0
[pid  5283] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   55.138994][ T5281] loop0: detected capacity change from 0 to 512
[   55.147086][ T5281] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   55.160471][ T5281] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5283] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5283] close(3)                    = 0
[pid  5283] mkdir("./file1", 0777)      = 0
[pid  5283] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5283] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5283] chdir("./file1")            = 0
[pid  5283] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5283] close(4)                    = 0
[pid  5283] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5283] creat("./file1", 0410)      = 4
[pid  5283] exit_group(0)               = ?
[pid  5283] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5283, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./141", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./141", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./141/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./141/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./141/binderfs")                = 0
umount2("./141/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./141/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./141/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./141/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./141/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./141/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./141")                          = 0
mkdir("./142", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5285 attached
 <unfinished ...>
[pid  5285] chdir("./142" <unfinished ...>
[pid  4995] <... clone resumed>, child_tidptr=0x5555562e45d0) = 5285
[pid  5285] <... chdir resumed>)        = 0
[pid  5285] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5285] setpgid(0, 0)               = 0
[pid  5285] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5285] write(3, "1000", 4)         = 4
[pid  5285] close(3)                    = 0
[pid  5285] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5285] memfd_create("syzkaller", 0) = 3
[pid  5285] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5285] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5285] munmap(0x7f295dd73000, 262144) = 0
[pid  5285] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   55.199481][ T5283] loop0: detected capacity change from 0 to 512
[   55.207676][ T5283] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   55.221679][ T5283] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5285] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5285] close(3)                    = 0
[pid  5285] mkdir("./file1", 0777)      = 0
[pid  5285] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5285] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5285] chdir("./file1")            = 0
[pid  5285] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5285] close(4)                    = 0
[pid  5285] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5285] creat("./file1", 0410)      = 4
[pid  5285] exit_group(0)               = ?
[pid  5285] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5285, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
umount2("./142", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./142", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./142/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./142/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./142/binderfs")                = 0
umount2("./142/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./142/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./142/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./142/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./142/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./142/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./142")                          = 0
mkdir("./143", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5287
./strace-static-x86_64: Process 5287 attached
[pid  5287] chdir("./143")              = 0
[pid  5287] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5287] setpgid(0, 0)               = 0
[pid  5287] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5287] write(3, "1000", 4)         = 4
[pid  5287] close(3)                    = 0
[pid  5287] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5287] memfd_create("syzkaller", 0) = 3
[pid  5287] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5287] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5287] munmap(0x7f295dd73000, 262144) = 0
[pid  5287] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   55.265235][ T5285] loop0: detected capacity change from 0 to 512
[   55.273780][ T5285] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   55.287284][ T5285] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5287] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5287] close(3)                    = 0
[pid  5287] mkdir("./file1", 0777)      = 0
[pid  5287] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5287] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5287] chdir("./file1")            = 0
[pid  5287] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5287] close(4)                    = 0
[pid  5287] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5287] creat("./file1", 0410)      = 4
[pid  5287] exit_group(0)               = ?
[pid  5287] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5287, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
umount2("./143", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./143", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./143/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./143/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./143/binderfs")                = 0
umount2("./143/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./143/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./143/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./143/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./143/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./143/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./143")                          = 0
mkdir("./144", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5289
./strace-static-x86_64: Process 5289 attached
[pid  5289] chdir("./144")              = 0
[pid  5289] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5289] setpgid(0, 0)               = 0
[pid  5289] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5289] write(3, "1000", 4)         = 4
[pid  5289] close(3)                    = 0
[pid  5289] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5289] memfd_create("syzkaller", 0) = 3
[pid  5289] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5289] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5289] munmap(0x7f295dd73000, 262144) = 0
[pid  5289] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   55.313123][ T5287] loop0: detected capacity change from 0 to 512
[   55.321406][ T5287] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   55.334586][ T5287] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5289] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5289] close(3)                    = 0
[pid  5289] mkdir("./file1", 0777)      = 0
[pid  5289] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5289] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5289] chdir("./file1")            = 0
[pid  5289] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5289] close(4)                    = 0
[pid  5289] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5289] creat("./file1", 0410)      = 4
[pid  5289] exit_group(0)               = ?
[pid  5289] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5289, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./144", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./144", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./144/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./144/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./144/binderfs")                = 0
umount2("./144/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./144/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./144/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./144/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./144/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./144/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./144")                          = 0
mkdir("./145", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5291
./strace-static-x86_64: Process 5291 attached
[pid  5291] chdir("./145")              = 0
[pid  5291] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5291] setpgid(0, 0)               = 0
[pid  5291] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5291] write(3, "1000", 4)         = 4
[pid  5291] close(3)                    = 0
[pid  5291] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5291] memfd_create("syzkaller", 0) = 3
[pid  5291] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5291] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5291] munmap(0x7f295dd73000, 262144) = 0
[pid  5291] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   55.359025][ T5289] loop0: detected capacity change from 0 to 512
[   55.370135][ T5289] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   55.383902][ T5289] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5291] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5291] close(3)                    = 0
[pid  5291] mkdir("./file1", 0777)      = 0
[pid  5291] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5291] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5291] chdir("./file1")            = 0
[pid  5291] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5291] close(4)                    = 0
[pid  5291] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5291] creat("./file1", 0410)      = 4
[pid  5291] exit_group(0)               = ?
[pid  5291] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5291, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./145", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./145", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./145/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./145/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./145/binderfs")                = 0
umount2("./145/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./145/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./145/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./145/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./145/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./145/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./145")                          = 0
mkdir("./146", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5293
./strace-static-x86_64: Process 5293 attached
[pid  5293] chdir("./146")              = 0
[pid  5293] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5293] setpgid(0, 0)               = 0
[pid  5293] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5293] write(3, "1000", 4)         = 4
[pid  5293] close(3)                    = 0
[pid  5293] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5293] memfd_create("syzkaller", 0) = 3
[pid  5293] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5293] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5293] munmap(0x7f295dd73000, 262144) = 0
[pid  5293] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   55.425288][ T5291] loop0: detected capacity change from 0 to 512
[   55.443394][ T5291] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   55.457105][ T5291] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5293] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5293] close(3)                    = 0
[pid  5293] mkdir("./file1", 0777)      = 0
[pid  5293] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5293] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5293] chdir("./file1")            = 0
[pid  5293] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5293] close(4)                    = 0
[pid  5293] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5293] creat("./file1", 0410)      = 4
[pid  5293] exit_group(0)               = ?
[pid  5293] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5293, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./146", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./146", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./146/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./146/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./146/binderfs")                = 0
umount2("./146/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./146/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./146/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./146/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./146/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./146/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./146")                          = 0
mkdir("./147", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5295
./strace-static-x86_64: Process 5295 attached
[pid  5295] chdir("./147")              = 0
[pid  5295] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5295] setpgid(0, 0)               = 0
[pid  5295] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5295] write(3, "1000", 4)         = 4
[pid  5295] close(3)                    = 0
[pid  5295] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5295] memfd_create("syzkaller", 0) = 3
[pid  5295] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5295] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5295] munmap(0x7f295dd73000, 262144) = 0
[pid  5295] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   55.488452][ T5293] loop0: detected capacity change from 0 to 512
[   55.496644][ T5293] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   55.510001][ T5293] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5295] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5295] close(3)                    = 0
[pid  5295] mkdir("./file1", 0777)      = 0
[pid  5295] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5295] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5295] chdir("./file1")            = 0
[pid  5295] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5295] close(4)                    = 0
[pid  5295] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5295] creat("./file1", 0410)      = 4
[pid  5295] exit_group(0)               = ?
[pid  5295] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5295, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./147", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./147", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./147/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./147/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./147/binderfs")                = 0
umount2("./147/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./147/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./147/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./147/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./147/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./147/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./147")                          = 0
mkdir("./148", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5297
./strace-static-x86_64: Process 5297 attached
[pid  5297] chdir("./148")              = 0
[pid  5297] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5297] setpgid(0, 0)               = 0
[pid  5297] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5297] write(3, "1000", 4)         = 4
[pid  5297] close(3)                    = 0
[pid  5297] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5297] memfd_create("syzkaller", 0) = 3
[pid  5297] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5297] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5297] munmap(0x7f295dd73000, 262144) = 0
[pid  5297] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   55.550320][ T5295] loop0: detected capacity change from 0 to 512
[   55.558917][ T5295] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   55.572818][ T5295] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5297] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5297] close(3)                    = 0
[pid  5297] mkdir("./file1", 0777)      = 0
[pid  5297] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5297] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5297] chdir("./file1")            = 0
[pid  5297] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5297] close(4)                    = 0
[pid  5297] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5297] creat("./file1", 0410)      = 4
[pid  5297] exit_group(0)               = ?
[pid  5297] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5297, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./148", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./148", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./148/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./148/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./148/binderfs")                = 0
umount2("./148/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./148/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./148/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./148/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./148/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./148/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./148")                          = 0
mkdir("./149", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5299
./strace-static-x86_64: Process 5299 attached
[pid  5299] chdir("./149")              = 0
[pid  5299] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5299] setpgid(0, 0)               = 0
[pid  5299] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5299] write(3, "1000", 4)         = 4
[pid  5299] close(3)                    = 0
[pid  5299] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5299] memfd_create("syzkaller", 0) = 3
[pid  5299] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5299] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5299] munmap(0x7f295dd73000, 262144) = 0
[pid  5299] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   55.608278][ T5297] loop0: detected capacity change from 0 to 512
[   55.616417][ T5297] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   55.630501][ T5297] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5299] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5299] close(3)                    = 0
[pid  5299] mkdir("./file1", 0777)      = 0
[pid  5299] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5299] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5299] chdir("./file1")            = 0
[pid  5299] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5299] close(4)                    = 0
[pid  5299] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5299] creat("./file1", 0410)      = 4
[pid  5299] exit_group(0)               = ?
[pid  5299] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5299, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./149", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./149", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./149/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./149/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./149/binderfs")                = 0
umount2("./149/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./149/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./149/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./149/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./149/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./149/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./149")                          = 0
mkdir("./150", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5301
./strace-static-x86_64: Process 5301 attached
[pid  5301] chdir("./150")              = 0
[pid  5301] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5301] setpgid(0, 0)               = 0
[pid  5301] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5301] write(3, "1000", 4)         = 4
[pid  5301] close(3)                    = 0
[pid  5301] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5301] memfd_create("syzkaller", 0) = 3
[pid  5301] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5301] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5301] munmap(0x7f295dd73000, 262144) = 0
[pid  5301] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   55.673869][ T5299] loop0: detected capacity change from 0 to 512
[   55.681983][ T5299] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   55.695723][ T5299] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5301] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5301] close(3)                    = 0
[pid  5301] mkdir("./file1", 0777)      = 0
[pid  5301] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5301] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5301] chdir("./file1")            = 0
[pid  5301] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5301] close(4)                    = 0
[pid  5301] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5301] creat("./file1", 0410)      = 4
[pid  5301] exit_group(0)               = ?
[pid  5301] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5301, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./150", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./150", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./150/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./150/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./150/binderfs")                = 0
umount2("./150/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./150/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./150/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./150/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./150/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./150/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./150")                          = 0
mkdir("./151", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5303
./strace-static-x86_64: Process 5303 attached
[pid  5303] chdir("./151")              = 0
[pid  5303] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5303] setpgid(0, 0)               = 0
[pid  5303] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5303] write(3, "1000", 4)         = 4
[pid  5303] close(3)                    = 0
[pid  5303] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5303] memfd_create("syzkaller", 0) = 3
[pid  5303] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5303] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5303] munmap(0x7f295dd73000, 262144) = 0
[pid  5303] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   55.742721][ T5301] loop0: detected capacity change from 0 to 512
[   55.750841][ T5301] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   55.764604][ T5301] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5303] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5303] close(3)                    = 0
[pid  5303] mkdir("./file1", 0777)      = 0
[pid  5303] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5303] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5303] chdir("./file1")            = 0
[pid  5303] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5303] close(4)                    = 0
[pid  5303] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5303] creat("./file1", 0410)      = 4
[pid  5303] exit_group(0)               = ?
[pid  5303] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5303, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./151", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./151", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./151/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./151/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./151/binderfs")                = 0
umount2("./151/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./151/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./151/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./151/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./151/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./151/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./151")                          = 0
mkdir("./152", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5305 attached
, child_tidptr=0x5555562e45d0) = 5305
[pid  5305] chdir("./152")              = 0
[pid  5305] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5305] setpgid(0, 0)               = 0
[pid  5305] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5305] write(3, "1000", 4)         = 4
[pid  5305] close(3)                    = 0
[pid  5305] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5305] memfd_create("syzkaller", 0) = 3
[pid  5305] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5305] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5305] munmap(0x7f295dd73000, 262144) = 0
[pid  5305] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   55.799764][ T5303] loop0: detected capacity change from 0 to 512
[   55.807851][ T5303] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   55.821724][ T5303] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5305] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5305] close(3)                    = 0
[pid  5305] mkdir("./file1", 0777)      = 0
[pid  5305] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5305] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5305] chdir("./file1")            = 0
[pid  5305] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5305] close(4)                    = 0
[pid  5305] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5305] creat("./file1", 0410)      = 4
[pid  5305] exit_group(0)               = ?
[pid  5305] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5305, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./152", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./152", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./152/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./152/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./152/binderfs")                = 0
umount2("./152/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./152/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./152/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./152/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./152/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./152/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./152")                          = 0
mkdir("./153", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5307
./strace-static-x86_64: Process 5307 attached
[pid  5307] chdir("./153")              = 0
[pid  5307] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5307] setpgid(0, 0)               = 0
[pid  5307] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5307] write(3, "1000", 4)         = 4
[pid  5307] close(3)                    = 0
[pid  5307] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5307] memfd_create("syzkaller", 0) = 3
[pid  5307] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5307] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5307] munmap(0x7f295dd73000, 262144) = 0
[pid  5307] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   55.871392][ T5305] loop0: detected capacity change from 0 to 512
[   55.879176][ T5305] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   55.892800][ T5305] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5307] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5307] close(3)                    = 0
[pid  5307] mkdir("./file1", 0777)      = 0
[pid  5307] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5307] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5307] chdir("./file1")            = 0
[pid  5307] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5307] close(4)                    = 0
[pid  5307] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5307] creat("./file1", 0410)      = 4
[pid  5307] exit_group(0)               = ?
[pid  5307] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5307, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
umount2("./153", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./153", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./153/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./153/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./153/binderfs")                = 0
umount2("./153/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./153/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./153/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./153/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./153/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./153/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./153")                          = 0
mkdir("./154", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5309 attached
, child_tidptr=0x5555562e45d0) = 5309
[pid  5309] chdir("./154")              = 0
[pid  5309] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5309] setpgid(0, 0)               = 0
[pid  5309] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5309] write(3, "1000", 4)         = 4
[pid  5309] close(3)                    = 0
[pid  5309] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5309] memfd_create("syzkaller", 0) = 3
[pid  5309] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5309] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5309] munmap(0x7f295dd73000, 262144) = 0
[pid  5309] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   55.933506][ T5307] loop0: detected capacity change from 0 to 512
[   55.941642][ T5307] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   55.955301][ T5307] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5309] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5309] close(3)                    = 0
[pid  5309] mkdir("./file1", 0777)      = 0
[pid  5309] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5309] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5309] chdir("./file1")            = 0
[pid  5309] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5309] close(4)                    = 0
[pid  5309] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5309] creat("./file1", 0410)      = 4
[pid  5309] exit_group(0)               = ?
[pid  5309] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5309, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
umount2("./154", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./154", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./154/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./154/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./154/binderfs")                = 0
umount2("./154/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./154/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./154/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./154/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./154/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./154/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./154")                          = 0
mkdir("./155", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5311
./strace-static-x86_64: Process 5311 attached
[pid  5311] chdir("./155")              = 0
[pid  5311] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5311] setpgid(0, 0)               = 0
[pid  5311] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5311] write(3, "1000", 4)         = 4
[pid  5311] close(3)                    = 0
[pid  5311] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5311] memfd_create("syzkaller", 0) = 3
[pid  5311] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5311] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5311] munmap(0x7f295dd73000, 262144) = 0
[pid  5311] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   55.988072][ T5309] loop0: detected capacity change from 0 to 512
[   55.996183][ T5309] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   56.009543][ T5309] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5311] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5311] close(3)                    = 0
[pid  5311] mkdir("./file1", 0777)      = 0
[pid  5311] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5311] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5311] chdir("./file1")            = 0
[pid  5311] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5311] close(4)                    = 0
[pid  5311] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5311] creat("./file1", 0410)      = 4
[pid  5311] exit_group(0)               = ?
[pid  5311] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5311, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
umount2("./155", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./155", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./155/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./155/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./155/binderfs")                = 0
umount2("./155/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./155/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./155/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./155/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./155/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./155/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./155")                          = 0
mkdir("./156", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5313
./strace-static-x86_64: Process 5313 attached
[pid  5313] chdir("./156")              = 0
[pid  5313] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5313] setpgid(0, 0)               = 0
[pid  5313] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5313] write(3, "1000", 4)         = 4
[pid  5313] close(3)                    = 0
[pid  5313] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5313] memfd_create("syzkaller", 0) = 3
[pid  5313] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5313] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5313] munmap(0x7f295dd73000, 262144) = 0
[pid  5313] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   56.050782][ T5311] loop0: detected capacity change from 0 to 512
[   56.058936][ T5311] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   56.073186][ T5311] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5313] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5313] close(3)                    = 0
[pid  5313] mkdir("./file1", 0777)      = 0
[pid  5313] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5313] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5313] chdir("./file1")            = 0
[pid  5313] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5313] close(4)                    = 0
[pid  5313] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5313] creat("./file1", 0410)      = 4
[pid  5313] exit_group(0)               = ?
[pid  5313] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5313, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./156", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./156", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./156/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./156/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./156/binderfs")                = 0
umount2("./156/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./156/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./156/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./156/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./156/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./156/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./156")                          = 0
mkdir("./157", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5315
./strace-static-x86_64: Process 5315 attached
[pid  5315] chdir("./157")              = 0
[pid  5315] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5315] setpgid(0, 0)               = 0
[pid  5315] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5315] write(3, "1000", 4)         = 4
[pid  5315] close(3)                    = 0
[pid  5315] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5315] memfd_create("syzkaller", 0) = 3
[pid  5315] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5315] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5315] munmap(0x7f295dd73000, 262144) = 0
[pid  5315] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   56.100900][ T5313] loop0: detected capacity change from 0 to 512
[   56.109066][ T5313] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   56.122857][ T5313] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5315] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5315] close(3)                    = 0
[pid  5315] mkdir("./file1", 0777)      = 0
[pid  5315] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5315] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5315] chdir("./file1")            = 0
[pid  5315] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5315] close(4)                    = 0
[pid  5315] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5315] creat("./file1", 0410)      = 4
[pid  5315] exit_group(0)               = ?
[pid  5315] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5315, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./157", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./157", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./157/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./157/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./157/binderfs")                = 0
umount2("./157/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./157/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./157/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./157/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./157/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./157/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./157")                          = 0
mkdir("./158", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5317 attached
, child_tidptr=0x5555562e45d0) = 5317
[pid  5317] chdir("./158")              = 0
[pid  5317] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5317] setpgid(0, 0)               = 0
[pid  5317] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5317] write(3, "1000", 4)         = 4
[pid  5317] close(3)                    = 0
[pid  5317] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5317] memfd_create("syzkaller", 0) = 3
[pid  5317] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5317] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5317] munmap(0x7f295dd73000, 262144) = 0
[pid  5317] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   56.155261][ T5315] loop0: detected capacity change from 0 to 512
[   56.164890][ T5315] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   56.177825][ T5315] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5317] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5317] close(3)                    = 0
[pid  5317] mkdir("./file1", 0777)      = 0
[pid  5317] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5317] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5317] chdir("./file1")            = 0
[pid  5317] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5317] close(4)                    = 0
[pid  5317] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5317] creat("./file1", 0410)      = 4
[pid  5317] exit_group(0)               = ?
[pid  5317] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5317, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./158", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./158", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./158/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./158/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./158/binderfs")                = 0
umount2("./158/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./158/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./158/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./158/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./158/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./158/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./158")                          = 0
mkdir("./159", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5319
./strace-static-x86_64: Process 5319 attached
[pid  5319] chdir("./159")              = 0
[pid  5319] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5319] setpgid(0, 0)               = 0
[pid  5319] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5319] write(3, "1000", 4)         = 4
[pid  5319] close(3)                    = 0
[pid  5319] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5319] memfd_create("syzkaller", 0) = 3
[pid  5319] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[   56.214494][ T5317] loop0: detected capacity change from 0 to 512
[   56.222830][ T5317] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   56.236212][ T5317] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5319] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5319] munmap(0x7f295dd73000, 262144) = 0
[pid  5319] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5319] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5319] close(3)                    = 0
[pid  5319] mkdir("./file1", 0777)      = 0
[pid  5319] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5319] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5319] chdir("./file1")            = 0
[pid  5319] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5319] close(4)                    = 0
[pid  5319] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5319] creat("./file1", 0410)      = 4
[pid  5319] exit_group(0)               = ?
[pid  5319] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5319, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./159", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./159", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./159/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./159/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./159/binderfs")                = 0
umount2("./159/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./159/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./159/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./159/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./159/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./159/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./159")                          = 0
mkdir("./160", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = 0
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5321
./strace-static-x86_64: Process 5321 attached
[pid  5321] chdir("./160")              = 0
[pid  5321] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5321] setpgid(0, 0)               = 0
[pid  5321] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5321] write(3, "1000", 4)         = 4
[pid  5321] close(3)                    = 0
[pid  5321] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5321] memfd_create("syzkaller", 0) = 3
[pid  5321] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5321] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5321] munmap(0x7f295dd73000, 262144) = 0
[pid  5321] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   56.267802][ T5319] loop0: detected capacity change from 0 to 512
[   56.276184][ T5319] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   56.289060][ T5319] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5321] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5321] close(3)                    = 0
[pid  5321] mkdir("./file1", 0777)      = 0
[pid  5321] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5321] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5321] chdir("./file1")            = 0
[pid  5321] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5321] close(4)                    = 0
[pid  5321] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5321] creat("./file1", 0410)      = 4
[pid  5321] exit_group(0)               = ?
[pid  5321] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5321, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./160", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./160", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./160/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./160/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./160/binderfs")                = 0
umount2("./160/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./160/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./160/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./160/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./160/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./160/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./160")                          = 0
mkdir("./161", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5323 attached
 <unfinished ...>
[pid  5323] chdir("./161" <unfinished ...>
[pid  4995] <... clone resumed>, child_tidptr=0x5555562e45d0) = 5323
[pid  5323] <... chdir resumed>)        = 0
[pid  5323] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5323] setpgid(0, 0)               = 0
[pid  5323] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5323] write(3, "1000", 4)         = 4
[pid  5323] close(3)                    = 0
[pid  5323] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5323] memfd_create("syzkaller", 0) = 3
[pid  5323] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5323] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5323] munmap(0x7f295dd73000, 262144) = 0
[pid  5323] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   56.318724][ T5321] loop0: detected capacity change from 0 to 512
[   56.326660][ T5321] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   56.340012][ T5321] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5323] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5323] close(3)                    = 0
[pid  5323] mkdir("./file1", 0777)      = 0
[pid  5323] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5323] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5323] chdir("./file1")            = 0
[pid  5323] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5323] close(4)                    = 0
[pid  5323] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5323] creat("./file1", 0410)      = 4
[pid  5323] exit_group(0)               = ?
[pid  5323] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5323, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
umount2("./161", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./161", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./161/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./161/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./161/binderfs")                = 0
umount2("./161/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./161/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./161/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./161/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./161/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./161/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./161")                          = 0
mkdir("./162", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5325 attached
, child_tidptr=0x5555562e45d0) = 5325
[pid  5325] chdir("./162")              = 0
[pid  5325] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5325] setpgid(0, 0)               = 0
[pid  5325] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5325] write(3, "1000", 4)         = 4
[pid  5325] close(3)                    = 0
[pid  5325] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5325] memfd_create("syzkaller", 0) = 3
[pid  5325] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5325] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5325] munmap(0x7f295dd73000, 262144) = 0
[pid  5325] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   56.386320][ T5323] loop0: detected capacity change from 0 to 512
[   56.394570][ T5323] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   56.408164][ T5323] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5325] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5325] close(3)                    = 0
[pid  5325] mkdir("./file1", 0777)      = 0
[pid  5325] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5325] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5325] chdir("./file1")            = 0
[pid  5325] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5325] close(4)                    = 0
[pid  5325] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5325] creat("./file1", 0410)      = 4
[pid  5325] exit_group(0)               = ?
[pid  5325] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5325, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./162", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./162", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./162/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./162/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./162/binderfs")                = 0
umount2("./162/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./162/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./162/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./162/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./162/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./162/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./162")                          = 0
mkdir("./163", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5327
./strace-static-x86_64: Process 5327 attached
[pid  5327] chdir("./163")              = 0
[pid  5327] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5327] setpgid(0, 0)               = 0
[pid  5327] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5327] write(3, "1000", 4)         = 4
[pid  5327] close(3)                    = 0
[pid  5327] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5327] memfd_create("syzkaller", 0) = 3
[pid  5327] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5327] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5327] munmap(0x7f295dd73000, 262144) = 0
[pid  5327] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   56.444918][ T5325] loop0: detected capacity change from 0 to 512
[   56.453607][ T5325] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   56.467940][ T5325] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5327] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5327] close(3)                    = 0
[pid  5327] mkdir("./file1", 0777)      = 0
[pid  5327] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5327] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5327] chdir("./file1")            = 0
[pid  5327] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5327] close(4)                    = 0
[pid  5327] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5327] creat("./file1", 0410)      = 4
[pid  5327] exit_group(0)               = ?
[pid  5327] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5327, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./163", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./163", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./163/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./163/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./163/binderfs")                = 0
umount2("./163/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./163/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./163/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./163/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./163/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./163/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./163")                          = 0
mkdir("./164", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5329
./strace-static-x86_64: Process 5329 attached
[pid  5329] chdir("./164")              = 0
[pid  5329] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5329] setpgid(0, 0)               = 0
[pid  5329] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5329] write(3, "1000", 4)         = 4
[pid  5329] close(3)                    = 0
[pid  5329] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5329] memfd_create("syzkaller", 0) = 3
[pid  5329] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5329] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5329] munmap(0x7f295dd73000, 262144) = 0
[pid  5329] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   56.512390][ T5327] loop0: detected capacity change from 0 to 512
[   56.521595][ T5327] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   56.534920][ T5327] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5329] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5329] close(3)                    = 0
[pid  5329] mkdir("./file1", 0777)      = 0
[pid  5329] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5329] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5329] chdir("./file1")            = 0
[pid  5329] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5329] close(4)                    = 0
[pid  5329] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5329] creat("./file1", 0410)      = 4
[pid  5329] exit_group(0)               = ?
[pid  5329] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5329, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./164", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./164", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./164/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./164/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./164/binderfs")                = 0
umount2("./164/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./164/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./164/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./164/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./164/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./164/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./164")                          = 0
mkdir("./165", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5331 attached
 <unfinished ...>
[pid  5331] chdir("./165")              = 0
[pid  5331] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5331] setpgid(0, 0)               = 0
[pid  5331] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5331] write(3, "1000", 4)         = 4
[pid  5331] close(3)                    = 0
[pid  5331] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5331] memfd_create("syzkaller", 0) = 3
[pid  5331] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  4995] <... clone resumed>, child_tidptr=0x5555562e45d0) = 5331
[pid  5331] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5331] munmap(0x7f295dd73000, 262144) = 0
[pid  5331] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   56.569264][ T5329] loop0: detected capacity change from 0 to 512
[   56.577668][ T5329] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   56.591047][ T5329] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5331] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5331] close(3)                    = 0
[pid  5331] mkdir("./file1", 0777)      = 0
[pid  5331] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5331] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5331] chdir("./file1")            = 0
[pid  5331] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5331] close(4)                    = 0
[pid  5331] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5331] creat("./file1", 0410)      = 4
[pid  5331] exit_group(0)               = ?
[pid  5331] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5331, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./165", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./165", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./165/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./165/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./165/binderfs")                = 0
umount2("./165/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./165/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./165/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./165/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./165/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./165/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./165")                          = 0
mkdir("./166", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5333
./strace-static-x86_64: Process 5333 attached
[pid  5333] chdir("./166")              = 0
[pid  5333] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5333] setpgid(0, 0)               = 0
[pid  5333] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5333] write(3, "1000", 4)         = 4
[pid  5333] close(3)                    = 0
[pid  5333] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5333] memfd_create("syzkaller", 0) = 3
[pid  5333] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5333] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5333] munmap(0x7f295dd73000, 262144) = 0
[pid  5333] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   56.628265][ T5331] loop0: detected capacity change from 0 to 512
[   56.636771][ T5331] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   56.650892][ T5331] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5333] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5333] close(3)                    = 0
[pid  5333] mkdir("./file1", 0777)      = 0
[pid  5333] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5333] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5333] chdir("./file1")            = 0
[pid  5333] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5333] close(4)                    = 0
[pid  5333] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5333] creat("./file1", 0410)      = 4
[pid  5333] exit_group(0)               = ?
[pid  5333] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5333, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
umount2("./166", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./166", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./166/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./166/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./166/binderfs")                = 0
umount2("./166/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./166/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./166/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./166/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./166/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./166/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./166")                          = 0
mkdir("./167", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5335
./strace-static-x86_64: Process 5335 attached
[pid  5335] chdir("./167")              = 0
[pid  5335] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5335] setpgid(0, 0)               = 0
[pid  5335] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5335] write(3, "1000", 4)         = 4
[pid  5335] close(3)                    = 0
[pid  5335] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5335] memfd_create("syzkaller", 0) = 3
[pid  5335] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5335] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5335] munmap(0x7f295dd73000, 262144) = 0
[pid  5335] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   56.684721][ T5333] loop0: detected capacity change from 0 to 512
[   56.693607][ T5333] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   56.706858][ T5333] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5335] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5335] close(3)                    = 0
[pid  5335] mkdir("./file1", 0777)      = 0
[pid  5335] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5335] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5335] chdir("./file1")            = 0
[pid  5335] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5335] close(4)                    = 0
[pid  5335] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5335] creat("./file1", 0410)      = 4
[pid  5335] exit_group(0)               = ?
[pid  5335] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5335, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./167", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./167", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./167/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./167/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./167/binderfs")                = 0
umount2("./167/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./167/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./167/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./167/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./167/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./167/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./167")                          = 0
mkdir("./168", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5337 attached
 <unfinished ...>
[pid  5337] chdir("./168")              = 0
[pid  5337] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5337] setpgid(0, 0)               = 0
[pid  5337] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5337] write(3, "1000", 4)         = 4
[pid  5337] close(3)                    = 0
[pid  5337] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5337] memfd_create("syzkaller", 0) = 3
[pid  5337] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  4995] <... clone resumed>, child_tidptr=0x5555562e45d0) = 5337
[pid  5337] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5337] munmap(0x7f295dd73000, 262144) = 0
[pid  5337] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   56.747653][ T5335] loop0: detected capacity change from 0 to 512
[   56.755554][ T5335] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   56.768878][ T5335] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5337] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5337] close(3)                    = 0
[pid  5337] mkdir("./file1", 0777)      = 0
[pid  5337] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5337] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5337] chdir("./file1")            = 0
[pid  5337] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5337] close(4)                    = 0
[pid  5337] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5337] creat("./file1", 0410)      = 4
[pid  5337] exit_group(0)               = ?
[pid  5337] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5337, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
umount2("./168", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./168", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./168/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./168/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./168/binderfs")                = 0
umount2("./168/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./168/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./168/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./168/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./168/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./168/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./168")                          = 0
mkdir("./169", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5339
./strace-static-x86_64: Process 5339 attached
[pid  5339] chdir("./169")              = 0
[pid  5339] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5339] setpgid(0, 0)               = 0
[pid  5339] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5339] write(3, "1000", 4)         = 4
[pid  5339] close(3)                    = 0
[pid  5339] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5339] memfd_create("syzkaller", 0) = 3
[pid  5339] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5339] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5339] munmap(0x7f295dd73000, 262144) = 0
[pid  5339] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   56.811312][ T5337] loop0: detected capacity change from 0 to 512
[   56.819503][ T5337] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   56.833310][ T5337] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5339] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5339] close(3)                    = 0
[pid  5339] mkdir("./file1", 0777)      = 0
[pid  5339] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5339] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5339] chdir("./file1")            = 0
[pid  5339] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5339] close(4)                    = 0
[pid  5339] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5339] creat("./file1", 0410)      = 4
[pid  5339] exit_group(0)               = ?
[pid  5339] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5339, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./169", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./169", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./169/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./169/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./169/binderfs")                = 0
umount2("./169/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./169/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./169/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./169/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./169/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./169/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./169")                          = 0
mkdir("./170", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5341
./strace-static-x86_64: Process 5341 attached
[pid  5341] chdir("./170")              = 0
[pid  5341] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5341] setpgid(0, 0)               = 0
[pid  5341] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5341] write(3, "1000", 4)         = 4
[pid  5341] close(3)                    = 0
[pid  5341] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5341] memfd_create("syzkaller", 0) = 3
[pid  5341] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5341] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5341] munmap(0x7f295dd73000, 262144) = 0
[pid  5341] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   56.880184][ T5339] loop0: detected capacity change from 0 to 512
[   56.889580][ T5339] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   56.903195][ T5339] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5341] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5341] close(3)                    = 0
[pid  5341] mkdir("./file1", 0777)      = 0
[pid  5341] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5341] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5341] chdir("./file1")            = 0
[pid  5341] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5341] close(4)                    = 0
[pid  5341] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5341] creat("./file1", 0410)      = 4
[pid  5341] exit_group(0)               = ?
[pid  5341] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5341, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./170", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./170", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./170/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./170/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./170/binderfs")                = 0
umount2("./170/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./170/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./170/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./170/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./170/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./170/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./170")                          = 0
mkdir("./171", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5343
./strace-static-x86_64: Process 5343 attached
[pid  5343] chdir("./171")              = 0
[pid  5343] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5343] setpgid(0, 0)               = 0
[pid  5343] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5343] write(3, "1000", 4)         = 4
[pid  5343] close(3)                    = 0
[pid  5343] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5343] memfd_create("syzkaller", 0) = 3
[pid  5343] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5343] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5343] munmap(0x7f295dd73000, 262144) = 0
[pid  5343] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   56.949942][ T5341] loop0: detected capacity change from 0 to 512
[   56.958150][ T5341] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   56.971948][ T5341] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5343] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5343] close(3)                    = 0
[pid  5343] mkdir("./file1", 0777)      = 0
[pid  5343] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5343] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5343] chdir("./file1")            = 0
[pid  5343] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5343] close(4)                    = 0
[pid  5343] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5343] creat("./file1", 0410)      = 4
[pid  5343] exit_group(0)               = ?
[pid  5343] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5343, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./171", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./171", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./171/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./171/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./171/binderfs")                = 0
umount2("./171/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./171/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./171/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./171/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./171/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./171/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./171")                          = 0
mkdir("./172", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5345
./strace-static-x86_64: Process 5345 attached
[pid  5345] chdir("./172")              = 0
[pid  5345] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5345] setpgid(0, 0)               = 0
[pid  5345] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5345] write(3, "1000", 4)         = 4
[pid  5345] close(3)                    = 0
[pid  5345] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5345] memfd_create("syzkaller", 0) = 3
[pid  5345] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5345] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5345] munmap(0x7f295dd73000, 262144) = 0
[pid  5345] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   57.012028][ T5343] loop0: detected capacity change from 0 to 512
[   57.020337][ T5343] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   57.034176][ T5343] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5345] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5345] close(3)                    = 0
[pid  5345] mkdir("./file1", 0777)      = 0
[pid  5345] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5345] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5345] chdir("./file1")            = 0
[pid  5345] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5345] close(4)                    = 0
[pid  5345] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5345] creat("./file1", 0410)      = 4
[pid  5345] exit_group(0)               = ?
[pid  5345] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5345, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./172", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./172", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./172/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./172/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./172/binderfs")                = 0
umount2("./172/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./172/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./172/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./172/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./172/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./172/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./172")                          = 0
mkdir("./173", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5347 attached
, child_tidptr=0x5555562e45d0) = 5347
[pid  5347] chdir("./173")              = 0
[pid  5347] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5347] setpgid(0, 0)               = 0
[pid  5347] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5347] write(3, "1000", 4)         = 4
[pid  5347] close(3)                    = 0
[pid  5347] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5347] memfd_create("syzkaller", 0) = 3
[pid  5347] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5347] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5347] munmap(0x7f295dd73000, 262144) = 0
[pid  5347] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   57.066585][ T5345] loop0: detected capacity change from 0 to 512
[   57.075194][ T5345] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   57.088649][ T5345] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5347] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5347] close(3)                    = 0
[pid  5347] mkdir("./file1", 0777)      = 0
[pid  5347] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5347] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5347] chdir("./file1")            = 0
[pid  5347] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5347] close(4)                    = 0
[pid  5347] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5347] creat("./file1", 0410)      = 4
[pid  5347] exit_group(0)               = ?
[pid  5347] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5347, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./173", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./173", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./173/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./173/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./173/binderfs")                = 0
umount2("./173/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./173/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./173/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./173/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./173/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./173/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./173")                          = 0
mkdir("./174", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5349 attached
, child_tidptr=0x5555562e45d0) = 5349
[pid  5349] chdir("./174")              = 0
[pid  5349] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5349] setpgid(0, 0)               = 0
[pid  5349] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5349] write(3, "1000", 4)         = 4
[pid  5349] close(3)                    = 0
[pid  5349] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5349] memfd_create("syzkaller", 0) = 3
[pid  5349] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5349] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5349] munmap(0x7f295dd73000, 262144) = 0
[pid  5349] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   57.133779][ T5347] loop0: detected capacity change from 0 to 512
[   57.142480][ T5347] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   57.156272][ T5347] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5349] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5349] close(3)                    = 0
[pid  5349] mkdir("./file1", 0777)      = 0
[pid  5349] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5349] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5349] chdir("./file1")            = 0
[pid  5349] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5349] close(4)                    = 0
[pid  5349] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5349] creat("./file1", 0410)      = 4
[pid  5349] exit_group(0)               = ?
[pid  5349] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5349, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./174", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./174", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./174/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./174/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./174/binderfs")                = 0
umount2("./174/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./174/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./174/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./174/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./174/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./174/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./174")                          = 0
mkdir("./175", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5351
./strace-static-x86_64: Process 5351 attached
[pid  5351] chdir("./175")              = 0
[pid  5351] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5351] setpgid(0, 0)               = 0
[pid  5351] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5351] write(3, "1000", 4)         = 4
[pid  5351] close(3)                    = 0
[pid  5351] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5351] memfd_create("syzkaller", 0) = 3
[pid  5351] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5351] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5351] munmap(0x7f295dd73000, 262144) = 0
[pid  5351] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   57.195864][ T5349] loop0: detected capacity change from 0 to 512
[   57.204476][ T5349] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   57.222110][ T5349] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5351] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5351] close(3)                    = 0
[pid  5351] mkdir("./file1", 0777)      = 0
[pid  5351] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5351] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5351] chdir("./file1")            = 0
[pid  5351] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5351] close(4)                    = 0
[pid  5351] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5351] creat("./file1", 0410)      = 4
[pid  5351] exit_group(0)               = ?
[pid  5351] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5351, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./175", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./175", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./175/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./175/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./175/binderfs")                = 0
umount2("./175/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./175/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./175/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./175/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./175/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./175/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./175")                          = 0
mkdir("./176", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5353
./strace-static-x86_64: Process 5353 attached
[pid  5353] chdir("./176")              = 0
[pid  5353] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5353] setpgid(0, 0)               = 0
[pid  5353] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5353] write(3, "1000", 4)         = 4
[pid  5353] close(3)                    = 0
[pid  5353] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5353] memfd_create("syzkaller", 0) = 3
[pid  5353] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5353] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5353] munmap(0x7f295dd73000, 262144) = 0
[pid  5353] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   57.262118][ T5351] loop0: detected capacity change from 0 to 512
[   57.270934][ T5351] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   57.285119][ T5351] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5353] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5353] close(3)                    = 0
[pid  5353] mkdir("./file1", 0777)      = 0
[pid  5353] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5353] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5353] chdir("./file1")            = 0
[pid  5353] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5353] close(4)                    = 0
[pid  5353] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5353] creat("./file1", 0410)      = 4
[pid  5353] exit_group(0)               = ?
[pid  5353] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5353, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./176", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./176", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./176/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./176/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./176/binderfs")                = 0
umount2("./176/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./176/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./176/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./176/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./176/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./176/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./176")                          = 0
mkdir("./177", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5355
./strace-static-x86_64: Process 5355 attached
[pid  5355] chdir("./177")              = 0
[pid  5355] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5355] setpgid(0, 0)               = 0
[pid  5355] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5355] write(3, "1000", 4)         = 4
[pid  5355] close(3)                    = 0
[pid  5355] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5355] memfd_create("syzkaller", 0) = 3
[pid  5355] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5355] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5355] munmap(0x7f295dd73000, 262144) = 0
[pid  5355] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   57.318966][ T5353] loop0: detected capacity change from 0 to 512
[   57.327384][ T5353] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   57.341453][ T5353] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5355] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5355] close(3)                    = 0
[pid  5355] mkdir("./file1", 0777)      = 0
[pid  5355] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5355] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5355] chdir("./file1")            = 0
[pid  5355] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5355] close(4)                    = 0
[pid  5355] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5355] creat("./file1", 0410)      = 4
[pid  5355] exit_group(0)               = ?
[pid  5355] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5355, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./177", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./177", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./177/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./177/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./177/binderfs")                = 0
umount2("./177/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./177/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./177/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./177/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./177/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./177/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./177")                          = 0
mkdir("./178", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = 0
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5357
./strace-static-x86_64: Process 5357 attached
[pid  5357] chdir("./178")              = 0
[pid  5357] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5357] setpgid(0, 0)               = 0
[pid  5357] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5357] write(3, "1000", 4)         = 4
[pid  5357] close(3)                    = 0
[pid  5357] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5357] memfd_create("syzkaller", 0) = 3
[pid  5357] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5357] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5357] munmap(0x7f295dd73000, 262144) = 0
[pid  5357] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   57.371061][ T5355] loop0: detected capacity change from 0 to 512
[   57.378865][ T5355] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   57.392008][ T5355] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5357] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5357] close(3)                    = 0
[pid  5357] mkdir("./file1", 0777)      = 0
[pid  5357] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5357] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5357] chdir("./file1")            = 0
[pid  5357] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5357] close(4)                    = 0
[pid  5357] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5357] creat("./file1", 0410)      = 4
[pid  5357] exit_group(0)               = ?
[pid  5357] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5357, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./178", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./178", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./178/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./178/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./178/binderfs")                = 0
umount2("./178/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./178/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./178/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./178/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./178/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./178/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./178")                          = 0
mkdir("./179", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5359 attached
, child_tidptr=0x5555562e45d0) = 5359
[pid  5359] chdir("./179")              = 0
[pid  5359] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5359] setpgid(0, 0)               = 0
[pid  5359] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5359] write(3, "1000", 4)         = 4
[pid  5359] close(3)                    = 0
[pid  5359] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5359] memfd_create("syzkaller", 0) = 3
[pid  5359] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5359] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5359] munmap(0x7f295dd73000, 262144) = 0
[pid  5359] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   57.422548][ T5357] loop0: detected capacity change from 0 to 512
[   57.430916][ T5357] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   57.443778][ T5357] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5359] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5359] close(3)                    = 0
[pid  5359] mkdir("./file1", 0777)      = 0
[pid  5359] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5359] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5359] chdir("./file1")            = 0
[pid  5359] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5359] close(4)                    = 0
[pid  5359] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5359] creat("./file1", 0410)      = 4
[pid  5359] exit_group(0)               = ?
[pid  5359] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5359, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./179", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./179", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./179/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./179/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./179/binderfs")                = 0
umount2("./179/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./179/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./179/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./179/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./179/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./179/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./179")                          = 0
mkdir("./180", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5361
./strace-static-x86_64: Process 5361 attached
[pid  5361] chdir("./180")              = 0
[pid  5361] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5361] setpgid(0, 0)               = 0
[pid  5361] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5361] write(3, "1000", 4)         = 4
[pid  5361] close(3)                    = 0
[pid  5361] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5361] memfd_create("syzkaller", 0) = 3
[pid  5361] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5361] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5361] munmap(0x7f295dd73000, 262144) = 0
[pid  5361] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   57.485676][ T5359] loop0: detected capacity change from 0 to 512
[   57.494220][ T5359] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   57.507408][ T5359] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5361] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5361] close(3)                    = 0
[pid  5361] mkdir("./file1", 0777)      = 0
[pid  5361] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5361] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5361] chdir("./file1")            = 0
[pid  5361] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5361] close(4)                    = 0
[pid  5361] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5361] creat("./file1", 0410)      = 4
[pid  5361] exit_group(0)               = ?
[pid  5361] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5361, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./180", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./180", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./180/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./180/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./180/binderfs")                = 0
umount2("./180/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./180/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./180/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./180/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./180/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./180/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./180")                          = 0
mkdir("./181", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5363
./strace-static-x86_64: Process 5363 attached
[pid  5363] chdir("./181")              = 0
[pid  5363] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5363] setpgid(0, 0)               = 0
[pid  5363] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5363] write(3, "1000", 4)         = 4
[pid  5363] close(3)                    = 0
[pid  5363] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5363] memfd_create("syzkaller", 0) = 3
[pid  5363] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5363] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5363] munmap(0x7f295dd73000, 262144) = 0
[pid  5363] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   57.545863][ T5361] loop0: detected capacity change from 0 to 512
[   57.553922][ T5361] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   57.567127][ T5361] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5363] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5363] close(3)                    = 0
[pid  5363] mkdir("./file1", 0777)      = 0
[pid  5363] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5363] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5363] chdir("./file1")            = 0
[pid  5363] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5363] close(4)                    = 0
[pid  5363] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5363] creat("./file1", 0410)      = 4
[pid  5363] exit_group(0)               = ?
[pid  5363] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5363, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./181", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./181", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./181/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./181/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./181/binderfs")                = 0
umount2("./181/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./181/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./181/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./181/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./181/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./181/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./181")                          = 0
mkdir("./182", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5365
./strace-static-x86_64: Process 5365 attached
[pid  5365] chdir("./182")              = 0
[pid  5365] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5365] setpgid(0, 0)               = 0
[pid  5365] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5365] write(3, "1000", 4)         = 4
[pid  5365] close(3)                    = 0
[pid  5365] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5365] memfd_create("syzkaller", 0) = 3
[pid  5365] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5365] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5365] munmap(0x7f295dd73000, 262144) = 0
[pid  5365] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   57.611366][ T5363] loop0: detected capacity change from 0 to 512
[   57.619113][ T5363] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   57.632780][ T5363] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5365] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5365] close(3)                    = 0
[pid  5365] mkdir("./file1", 0777)      = 0
[pid  5365] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5365] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5365] chdir("./file1")            = 0
[pid  5365] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5365] close(4)                    = 0
[pid  5365] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5365] creat("./file1", 0410)      = 4
[pid  5365] exit_group(0)               = ?
[pid  5365] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5365, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
umount2("./182", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./182", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./182/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./182/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./182/binderfs")                = 0
umount2("./182/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./182/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./182/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./182/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./182/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./182/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./182")                          = 0
mkdir("./183", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = 0
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5367
./strace-static-x86_64: Process 5367 attached
[pid  5367] chdir("./183")              = 0
[pid  5367] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5367] setpgid(0, 0)               = 0
[pid  5367] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5367] write(3, "1000", 4)         = 4
[pid  5367] close(3)                    = 0
[pid  5367] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5367] memfd_create("syzkaller", 0) = 3
[pid  5367] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5367] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5367] munmap(0x7f295dd73000, 262144) = 0
[pid  5367] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   57.667643][ T5365] loop0: detected capacity change from 0 to 512
[   57.676077][ T5365] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   57.689293][ T5365] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5367] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5367] close(3)                    = 0
[pid  5367] mkdir("./file1", 0777)      = 0
[pid  5367] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5367] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5367] chdir("./file1")            = 0
[pid  5367] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5367] close(4)                    = 0
[pid  5367] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5367] creat("./file1", 0410)      = 4
[pid  5367] exit_group(0)               = ?
[pid  5367] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5367, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
umount2("./183", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./183", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./183/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./183/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./183/binderfs")                = 0
umount2("./183/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./183/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./183/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./183/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./183/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./183/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./183")                          = 0
mkdir("./184", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5369
./strace-static-x86_64: Process 5369 attached
[pid  5369] chdir("./184")              = 0
[pid  5369] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5369] setpgid(0, 0)               = 0
[pid  5369] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5369] write(3, "1000", 4)         = 4
[pid  5369] close(3)                    = 0
[pid  5369] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5369] memfd_create("syzkaller", 0) = 3
[pid  5369] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5369] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5369] munmap(0x7f295dd73000, 262144) = 0
[pid  5369] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   57.713864][ T5367] loop0: detected capacity change from 0 to 512
[   57.723016][ T5367] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   57.736327][ T5367] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5369] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5369] close(3)                    = 0
[pid  5369] mkdir("./file1", 0777)      = 0
[pid  5369] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5369] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5369] chdir("./file1")            = 0
[pid  5369] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5369] close(4)                    = 0
[pid  5369] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5369] creat("./file1", 0410)      = 4
[pid  5369] exit_group(0)               = ?
[pid  5369] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5369, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
umount2("./184", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./184", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./184/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./184/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./184/binderfs")                = 0
umount2("./184/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./184/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./184/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./184/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./184/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./184/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./184")                          = 0
mkdir("./185", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5371
./strace-static-x86_64: Process 5371 attached
[pid  5371] chdir("./185")              = 0
[pid  5371] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5371] setpgid(0, 0)               = 0
[pid  5371] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5371] write(3, "1000", 4)         = 4
[pid  5371] close(3)                    = 0
[pid  5371] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5371] memfd_create("syzkaller", 0) = 3
[pid  5371] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5371] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5371] munmap(0x7f295dd73000, 262144) = 0
[   57.765489][ T5369] loop0: detected capacity change from 0 to 512
[   57.773365][ T5369] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   57.786598][ T5369] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5371] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5371] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5371] close(3)                    = 0
[pid  5371] mkdir("./file1", 0777)      = 0
[pid  5371] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5371] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5371] chdir("./file1")            = 0
[pid  5371] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5371] close(4)                    = 0
[pid  5371] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5371] creat("./file1", 0410)      = 4
[pid  5371] exit_group(0)               = ?
[pid  5371] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5371, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./185", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./185", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./185/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./185/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./185/binderfs")                = 0
umount2("./185/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./185/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./185/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./185/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./185/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./185/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./185")                          = 0
mkdir("./186", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5373
./strace-static-x86_64: Process 5373 attached
[pid  5373] chdir("./186")              = 0
[pid  5373] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5373] setpgid(0, 0)               = 0
[pid  5373] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5373] write(3, "1000", 4)         = 4
[pid  5373] close(3)                    = 0
[pid  5373] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5373] memfd_create("syzkaller", 0) = 3
[pid  5373] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5373] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5373] munmap(0x7f295dd73000, 262144) = 0
[pid  5373] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   57.832145][ T5371] loop0: detected capacity change from 0 to 512
[   57.840170][ T5371] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   57.854060][ T5371] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5373] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5373] close(3)                    = 0
[pid  5373] mkdir("./file1", 0777)      = 0
[pid  5373] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5373] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5373] chdir("./file1")            = 0
[pid  5373] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5373] close(4)                    = 0
[pid  5373] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5373] creat("./file1", 0410)      = 4
[pid  5373] exit_group(0)               = ?
[pid  5373] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5373, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./186", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./186", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./186/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./186/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./186/binderfs")                = 0
umount2("./186/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./186/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./186/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./186/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./186/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./186/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./186")                          = 0
mkdir("./187", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5375 attached
, child_tidptr=0x5555562e45d0) = 5375
[pid  5375] chdir("./187")              = 0
[pid  5375] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5375] setpgid(0, 0)               = 0
[pid  5375] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5375] write(3, "1000", 4)         = 4
[pid  5375] close(3)                    = 0
[pid  5375] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5375] memfd_create("syzkaller", 0) = 3
[pid  5375] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5375] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5375] munmap(0x7f295dd73000, 262144) = 0
[pid  5375] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   57.894886][ T5373] loop0: detected capacity change from 0 to 512
[   57.903239][ T5373] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   57.916720][ T5373] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5375] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5375] close(3)                    = 0
[pid  5375] mkdir("./file1", 0777)      = 0
[pid  5375] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5375] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5375] chdir("./file1")            = 0
[pid  5375] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5375] close(4)                    = 0
[pid  5375] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5375] creat("./file1", 0410)      = 4
[pid  5375] exit_group(0)               = ?
[pid  5375] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5375, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./187", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./187", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./187/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./187/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./187/binderfs")                = 0
umount2("./187/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./187/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./187/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./187/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./187/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./187/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./187")                          = 0
mkdir("./188", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5377
./strace-static-x86_64: Process 5377 attached
[pid  5377] chdir("./188")              = 0
[pid  5377] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5377] setpgid(0, 0)               = 0
[pid  5377] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5377] write(3, "1000", 4)         = 4
[pid  5377] close(3)                    = 0
[pid  5377] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5377] memfd_create("syzkaller", 0) = 3
[pid  5377] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5377] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5377] munmap(0x7f295dd73000, 262144) = 0
[pid  5377] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   57.955372][ T5375] loop0: detected capacity change from 0 to 512
[   57.963424][ T5375] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   57.977079][ T5375] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5377] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5377] close(3)                    = 0
[pid  5377] mkdir("./file1", 0777)      = 0
[pid  5377] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5377] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5377] chdir("./file1")            = 0
[pid  5377] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5377] close(4)                    = 0
[pid  5377] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5377] creat("./file1", 0410)      = 4
[pid  5377] exit_group(0)               = ?
[pid  5377] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5377, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./188", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./188", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./188/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./188/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./188/binderfs")                = 0
umount2("./188/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./188/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./188/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./188/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./188/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./188/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./188")                          = 0
mkdir("./189", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5379
./strace-static-x86_64: Process 5379 attached
[pid  5379] chdir("./189")              = 0
[pid  5379] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5379] setpgid(0, 0)               = 0
[pid  5379] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5379] write(3, "1000", 4)         = 4
[pid  5379] close(3)                    = 0
[pid  5379] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5379] memfd_create("syzkaller", 0) = 3
[pid  5379] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5379] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5379] munmap(0x7f295dd73000, 262144) = 0
[pid  5379] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   58.005995][ T5377] loop0: detected capacity change from 0 to 512
[   58.014117][ T5377] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   58.027062][ T5377] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5379] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5379] close(3)                    = 0
[pid  5379] mkdir("./file1", 0777)      = 0
[pid  5379] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5379] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5379] chdir("./file1")            = 0
[pid  5379] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5379] close(4)                    = 0
[pid  5379] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5379] creat("./file1", 0410)      = 4
[pid  5379] exit_group(0)               = ?
[pid  5379] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5379, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
umount2("./189", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./189", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./189/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./189/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./189/binderfs")                = 0
umount2("./189/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./189/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./189/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./189/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./189/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./189/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./189")                          = 0
mkdir("./190", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5381
./strace-static-x86_64: Process 5381 attached
[pid  5381] chdir("./190")              = 0
[pid  5381] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5381] setpgid(0, 0)               = 0
[pid  5381] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5381] write(3, "1000", 4)         = 4
[pid  5381] close(3)                    = 0
[pid  5381] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5381] memfd_create("syzkaller", 0) = 3
[pid  5381] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5381] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5381] munmap(0x7f295dd73000, 262144) = 0
[pid  5381] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   58.060534][ T5379] loop0: detected capacity change from 0 to 512
[   58.069270][ T5379] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   58.082777][ T5379] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5381] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5381] close(3)                    = 0
[pid  5381] mkdir("./file1", 0777)      = 0
[pid  5381] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5381] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5381] chdir("./file1")            = 0
[pid  5381] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5381] close(4)                    = 0
[pid  5381] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5381] creat("./file1", 0410)      = 4
[pid  5381] exit_group(0)               = ?
[pid  5381] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5381, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./190", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./190", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./190/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./190/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./190/binderfs")                = 0
umount2("./190/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./190/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./190/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./190/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./190/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./190/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./190")                          = 0
mkdir("./191", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5383 attached
 <unfinished ...>
[pid  5383] chdir("./191")              = 0
[pid  5383] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5383] setpgid(0, 0)               = 0
[pid  5383] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  4995] <... clone resumed>, child_tidptr=0x5555562e45d0) = 5383
[pid  5383] <... openat resumed>)       = 3
[pid  5383] write(3, "1000", 4)         = 4
[pid  5383] close(3)                    = 0
[pid  5383] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5383] memfd_create("syzkaller", 0) = 3
[pid  5383] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5383] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5383] munmap(0x7f295dd73000, 262144) = 0
[pid  5383] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   58.128553][ T5381] loop0: detected capacity change from 0 to 512
[   58.136539][ T5381] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   58.150287][ T5381] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5383] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5383] close(3)                    = 0
[pid  5383] mkdir("./file1", 0777)      = 0
[pid  5383] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5383] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5383] chdir("./file1")            = 0
[pid  5383] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5383] close(4)                    = 0
[pid  5383] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5383] creat("./file1", 0410)      = 4
[pid  5383] exit_group(0)               = ?
[pid  5383] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5383, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./191", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./191", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./191/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./191/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./191/binderfs")                = 0
umount2("./191/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./191/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./191/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./191/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./191/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./191/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./191")                          = 0
mkdir("./192", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5385
./strace-static-x86_64: Process 5385 attached
[pid  5385] chdir("./192")              = 0
[pid  5385] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5385] setpgid(0, 0)               = 0
[pid  5385] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5385] write(3, "1000", 4)         = 4
[pid  5385] close(3)                    = 0
[pid  5385] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5385] memfd_create("syzkaller", 0) = 3
[pid  5385] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5385] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5385] munmap(0x7f295dd73000, 262144) = 0
[pid  5385] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   58.192300][ T5383] loop0: detected capacity change from 0 to 512
[   58.200360][ T5383] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   58.213669][ T5383] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5385] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5385] close(3)                    = 0
[pid  5385] mkdir("./file1", 0777)      = 0
[pid  5385] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5385] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5385] chdir("./file1")            = 0
[pid  5385] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5385] close(4)                    = 0
[pid  5385] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5385] creat("./file1", 0410)      = 4
[pid  5385] exit_group(0)               = ?
[pid  5385] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5385, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
umount2("./192", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./192", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./192/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./192/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./192/binderfs")                = 0
umount2("./192/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./192/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./192/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./192/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./192/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./192/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./192")                          = 0
mkdir("./193", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5387
./strace-static-x86_64: Process 5387 attached
[pid  5387] chdir("./193")              = 0
[pid  5387] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5387] setpgid(0, 0)               = 0
[pid  5387] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5387] write(3, "1000", 4)         = 4
[pid  5387] close(3)                    = 0
[pid  5387] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5387] memfd_create("syzkaller", 0) = 3
[pid  5387] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5387] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5387] munmap(0x7f295dd73000, 262144) = 0
[pid  5387] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   58.254480][ T5385] loop0: detected capacity change from 0 to 512
[   58.263259][ T5385] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   58.276738][ T5385] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5387] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5387] close(3)                    = 0
[pid  5387] mkdir("./file1", 0777)      = 0
[pid  5387] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5387] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5387] chdir("./file1")            = 0
[pid  5387] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5387] close(4)                    = 0
[pid  5387] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5387] creat("./file1", 0410)      = 4
[pid  5387] exit_group(0)               = ?
[pid  5387] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5387, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./193", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./193", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./193/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./193/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./193/binderfs")                = 0
umount2("./193/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./193/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./193/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./193/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./193/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./193/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./193")                          = 0
mkdir("./194", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5389 attached
, child_tidptr=0x5555562e45d0) = 5389
[pid  5389] chdir("./194")              = 0
[pid  5389] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5389] setpgid(0, 0)               = 0
[pid  5389] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5389] write(3, "1000", 4)         = 4
[pid  5389] close(3)                    = 0
[pid  5389] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5389] memfd_create("syzkaller", 0) = 3
[pid  5389] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5389] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5389] munmap(0x7f295dd73000, 262144) = 0
[pid  5389] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   58.326477][ T5387] loop0: detected capacity change from 0 to 512
[   58.335096][ T5387] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   58.349876][ T5387] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5389] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5389] close(3)                    = 0
[pid  5389] mkdir("./file1", 0777)      = 0
[pid  5389] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5389] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5389] chdir("./file1")            = 0
[pid  5389] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5389] close(4)                    = 0
[pid  5389] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5389] creat("./file1", 0410)      = 4
[pid  5389] exit_group(0)               = ?
[pid  5389] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5389, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./194", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./194", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./194/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./194/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./194/binderfs")                = 0
umount2("./194/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./194/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./194/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./194/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./194/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./194/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./194")                          = 0
mkdir("./195", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5391
./strace-static-x86_64: Process 5391 attached
[pid  5391] chdir("./195")              = 0
[pid  5391] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5391] setpgid(0, 0)               = 0
[pid  5391] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5391] write(3, "1000", 4)         = 4
[pid  5391] close(3)                    = 0
[pid  5391] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5391] memfd_create("syzkaller", 0) = 3
[pid  5391] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5391] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5391] munmap(0x7f295dd73000, 262144) = 0
[pid  5391] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   58.397287][ T5389] loop0: detected capacity change from 0 to 512
[   58.405020][ T5389] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   58.419349][ T5389] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5391] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5391] close(3)                    = 0
[pid  5391] mkdir("./file1", 0777)      = 0
[pid  5391] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5391] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5391] chdir("./file1")            = 0
[pid  5391] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5391] close(4)                    = 0
[pid  5391] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5391] creat("./file1", 0410)      = 4
[pid  5391] exit_group(0)               = ?
[pid  5391] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5391, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./195", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./195", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./195/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./195/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./195/binderfs")                = 0
umount2("./195/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./195/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./195/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./195/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./195/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./195/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./195")                          = 0
mkdir("./196", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5393
./strace-static-x86_64: Process 5393 attached
[pid  5393] chdir("./196")              = 0
[pid  5393] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5393] setpgid(0, 0)               = 0
[   58.466311][ T5391] loop0: detected capacity change from 0 to 512
[   58.475490][ T5391] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   58.489062][ T5391] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5393] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5393] write(3, "1000", 4)         = 4
[pid  5393] close(3)                    = 0
[pid  5393] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5393] memfd_create("syzkaller", 0) = 3
[pid  5393] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5393] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5393] munmap(0x7f295dd73000, 262144) = 0
[pid  5393] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5393] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5393] close(3)                    = 0
[pid  5393] mkdir("./file1", 0777)      = 0
[pid  5393] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5393] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5393] chdir("./file1")            = 0
[pid  5393] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5393] close(4)                    = 0
[pid  5393] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5393] creat("./file1", 0410)      = 4
[pid  5393] exit_group(0)               = ?
[pid  5393] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5393, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./196", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./196", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./196/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./196/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./196/binderfs")                = 0
umount2("./196/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./196/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./196/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./196/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./196/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./196/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./196")                          = 0
mkdir("./197", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5395 attached
, child_tidptr=0x5555562e45d0) = 5395
[pid  5395] chdir("./197")              = 0
[pid  5395] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5395] setpgid(0, 0)               = 0
[pid  5395] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5395] write(3, "1000", 4)         = 4
[pid  5395] close(3)                    = 0
[pid  5395] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5395] memfd_create("syzkaller", 0) = 3
[pid  5395] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5395] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5395] munmap(0x7f295dd73000, 262144) = 0
[pid  5395] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   58.516270][ T5393] loop0: detected capacity change from 0 to 512
[   58.523964][ T5393] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   58.537774][ T5393] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5395] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5395] close(3)                    = 0
[pid  5395] mkdir("./file1", 0777)      = 0
[pid  5395] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5395] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5395] chdir("./file1")            = 0
[pid  5395] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5395] close(4)                    = 0
[pid  5395] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5395] creat("./file1", 0410)      = 4
[pid  5395] exit_group(0)               = ?
[pid  5395] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5395, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
umount2("./197", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./197", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./197/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./197/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./197/binderfs")                = 0
umount2("./197/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./197/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./197/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./197/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./197/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./197/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./197")                          = 0
mkdir("./198", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5397
./strace-static-x86_64: Process 5397 attached
[pid  5397] chdir("./198")              = 0
[pid  5397] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5397] setpgid(0, 0)               = 0
[pid  5397] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5397] write(3, "1000", 4)         = 4
[pid  5397] close(3)                    = 0
[pid  5397] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5397] memfd_create("syzkaller", 0) = 3
[pid  5397] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5397] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5397] munmap(0x7f295dd73000, 262144) = 0
[pid  5397] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   58.570643][ T5395] loop0: detected capacity change from 0 to 512
[   58.578629][ T5395] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   58.592418][ T5395] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5397] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5397] close(3)                    = 0
[pid  5397] mkdir("./file1", 0777)      = 0
[pid  5397] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5397] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5397] chdir("./file1")            = 0
[pid  5397] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5397] close(4)                    = 0
[pid  5397] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5397] creat("./file1", 0410)      = 4
[pid  5397] exit_group(0)               = ?
[pid  5397] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5397, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./198", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./198", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./198/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./198/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./198/binderfs")                = 0
umount2("./198/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./198/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./198/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./198/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./198/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./198/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./198")                          = 0
mkdir("./199", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5399 attached
, child_tidptr=0x5555562e45d0) = 5399
[pid  5399] chdir("./199")              = 0
[pid  5399] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5399] setpgid(0, 0)               = 0
[pid  5399] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5399] write(3, "1000", 4)         = 4
[pid  5399] close(3)                    = 0
[pid  5399] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5399] memfd_create("syzkaller", 0) = 3
[pid  5399] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5399] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5399] munmap(0x7f295dd73000, 262144) = 0
[pid  5399] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   58.642188][ T5397] loop0: detected capacity change from 0 to 512
[   58.649867][ T5397] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   58.664060][ T5397] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5399] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5399] close(3)                    = 0
[pid  5399] mkdir("./file1", 0777)      = 0
[pid  5399] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5399] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5399] chdir("./file1")            = 0
[pid  5399] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5399] close(4)                    = 0
[pid  5399] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5399] creat("./file1", 0410)      = 4
[pid  5399] exit_group(0)               = ?
[pid  5399] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5399, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./199", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./199", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./199/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./199/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./199/binderfs")                = 0
umount2("./199/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./199/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./199/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./199/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./199/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./199/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./199")                          = 0
mkdir("./200", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5401
./strace-static-x86_64: Process 5401 attached
[pid  5401] chdir("./200")              = 0
[pid  5401] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5401] setpgid(0, 0)               = 0
[pid  5401] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5401] write(3, "1000", 4)         = 4
[pid  5401] close(3)                    = 0
[pid  5401] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5401] memfd_create("syzkaller", 0) = 3
[pid  5401] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5401] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5401] munmap(0x7f295dd73000, 262144) = 0
[pid  5401] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   58.707645][ T5399] loop0: detected capacity change from 0 to 512
[   58.715657][ T5399] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   58.728923][ T5399] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5401] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5401] close(3)                    = 0
[pid  5401] mkdir("./file1", 0777)      = 0
[pid  5401] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5401] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5401] chdir("./file1")            = 0
[pid  5401] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5401] close(4)                    = 0
[pid  5401] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5401] creat("./file1", 0410)      = 4
[pid  5401] exit_group(0)               = ?
[pid  5401] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5401, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./200", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./200", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./200/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./200/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./200/binderfs")                = 0
umount2("./200/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./200/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./200/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./200/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./200/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./200/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./200")                          = 0
mkdir("./201", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5403
./strace-static-x86_64: Process 5403 attached
[pid  5403] chdir("./201")              = 0
[pid  5403] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5403] setpgid(0, 0)               = 0
[pid  5403] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5403] write(3, "1000", 4)         = 4
[pid  5403] close(3)                    = 0
[pid  5403] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5403] memfd_create("syzkaller", 0) = 3
[pid  5403] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5403] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5403] munmap(0x7f295dd73000, 262144) = 0
[pid  5403] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   58.773883][ T5401] loop0: detected capacity change from 0 to 512
[   58.782805][ T5401] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   58.796221][ T5401] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5403] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5403] close(3)                    = 0
[pid  5403] mkdir("./file1", 0777)      = 0
[pid  5403] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5403] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5403] chdir("./file1")            = 0
[pid  5403] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5403] close(4)                    = 0
[pid  5403] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5403] creat("./file1", 0410)      = 4
[pid  5403] exit_group(0)               = ?
[pid  5403] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5403, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./201", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./201", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./201/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./201/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./201/binderfs")                = 0
umount2("./201/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./201/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./201/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./201/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./201/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./201/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./201")                          = 0
mkdir("./202", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5405 attached
 <unfinished ...>
[pid  5405] chdir("./202" <unfinished ...>
[pid  4995] <... clone resumed>, child_tidptr=0x5555562e45d0) = 5405
[pid  5405] <... chdir resumed>)        = 0
[pid  5405] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5405] setpgid(0, 0)               = 0
[pid  5405] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5405] write(3, "1000", 4)         = 4
[pid  5405] close(3)                    = 0
[pid  5405] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5405] memfd_create("syzkaller", 0) = 3
[pid  5405] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5405] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5405] munmap(0x7f295dd73000, 262144) = 0
[   58.843003][ T5403] loop0: detected capacity change from 0 to 512
[   58.852054][ T5403] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   58.865534][ T5403] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5405] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5405] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5405] close(3)                    = 0
[pid  5405] mkdir("./file1", 0777)      = 0
[pid  5405] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5405] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5405] chdir("./file1")            = 0
[pid  5405] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5405] close(4)                    = 0
[pid  5405] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5405] creat("./file1", 0410)      = 4
[pid  5405] exit_group(0)               = ?
[pid  5405] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5405, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./202", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./202", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./202/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./202/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./202/binderfs")                = 0
umount2("./202/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./202/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./202/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./202/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./202/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./202/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./202")                          = 0
mkdir("./203", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5407
./strace-static-x86_64: Process 5407 attached
[pid  5407] chdir("./203")              = 0
[pid  5407] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5407] setpgid(0, 0)               = 0
[pid  5407] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5407] write(3, "1000", 4)         = 4
[pid  5407] close(3)                    = 0
[pid  5407] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5407] memfd_create("syzkaller", 0) = 3
[pid  5407] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5407] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5407] munmap(0x7f295dd73000, 262144) = 0
[pid  5407] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   58.901501][ T5405] loop0: detected capacity change from 0 to 512
[   58.910302][ T5405] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   58.924091][ T5405] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5407] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5407] close(3)                    = 0
[pid  5407] mkdir("./file1", 0777)      = 0
[pid  5407] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5407] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5407] chdir("./file1")            = 0
[pid  5407] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5407] close(4)                    = 0
[pid  5407] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5407] creat("./file1", 0410)      = 4
[pid  5407] exit_group(0)               = ?
[pid  5407] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5407, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./203", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./203", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./203/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./203/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./203/binderfs")                = 0
umount2("./203/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./203/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./203/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./203/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./203/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./203/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./203")                          = 0
mkdir("./204", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5409
./strace-static-x86_64: Process 5409 attached
[pid  5409] chdir("./204")              = 0
[pid  5409] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5409] setpgid(0, 0)               = 0
[pid  5409] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5409] write(3, "1000", 4)         = 4
[pid  5409] close(3)                    = 0
[pid  5409] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5409] memfd_create("syzkaller", 0) = 3
[pid  5409] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5409] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[   58.956135][ T5407] loop0: detected capacity change from 0 to 512
[   58.964123][ T5407] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   58.977117][ T5407] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5409] munmap(0x7f295dd73000, 262144) = 0
[pid  5409] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5409] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5409] close(3)                    = 0
[pid  5409] mkdir("./file1", 0777)      = 0
[pid  5409] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5409] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5409] chdir("./file1")            = 0
[pid  5409] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5409] close(4)                    = 0
[pid  5409] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5409] creat("./file1", 0410)      = 4
[pid  5409] exit_group(0)               = ?
[pid  5409] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5409, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./204", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./204", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./204/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./204/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./204/binderfs")                = 0
umount2("./204/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./204/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./204/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./204/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./204/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./204/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./204")                          = 0
mkdir("./205", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5411
./strace-static-x86_64: Process 5411 attached
[pid  5411] chdir("./205")              = 0
[pid  5411] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5411] setpgid(0, 0)               = 0
[pid  5411] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5411] write(3, "1000", 4)         = 4
[pid  5411] close(3)                    = 0
[pid  5411] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5411] memfd_create("syzkaller", 0) = 3
[pid  5411] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5411] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5411] munmap(0x7f295dd73000, 262144) = 0
[pid  5411] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   59.008909][ T5409] loop0: detected capacity change from 0 to 512
[   59.016879][ T5409] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   59.034502][ T5409] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5411] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5411] close(3)                    = 0
[pid  5411] mkdir("./file1", 0777)      = 0
[pid  5411] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5411] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5411] chdir("./file1")            = 0
[pid  5411] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5411] close(4)                    = 0
[pid  5411] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5411] creat("./file1", 0410)      = 4
[pid  5411] exit_group(0)               = ?
[pid  5411] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5411, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
umount2("./205", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./205", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./205/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./205/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./205/binderfs")                = 0
umount2("./205/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./205/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./205/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./205/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./205/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./205/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./205")                          = 0
mkdir("./206", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5413
./strace-static-x86_64: Process 5413 attached
[pid  5413] chdir("./206")              = 0
[pid  5413] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5413] setpgid(0, 0)               = 0
[pid  5413] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5413] write(3, "1000", 4)         = 4
[pid  5413] close(3)                    = 0
[pid  5413] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5413] memfd_create("syzkaller", 0) = 3
[pid  5413] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5413] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5413] munmap(0x7f295dd73000, 262144) = 0
[pid  5413] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   59.078969][ T5411] loop0: detected capacity change from 0 to 512
[   59.087305][ T5411] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   59.102289][ T5411] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5413] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5413] close(3)                    = 0
[pid  5413] mkdir("./file1", 0777)      = 0
[pid  5413] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5413] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5413] chdir("./file1")            = 0
[pid  5413] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5413] close(4)                    = 0
[pid  5413] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5413] creat("./file1", 0410)      = 4
[pid  5413] exit_group(0)               = ?
[pid  5413] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5413, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./206", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./206", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./206/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./206/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./206/binderfs")                = 0
umount2("./206/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./206/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./206/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./206/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./206/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./206/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./206")                          = 0
mkdir("./207", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5415 attached
, child_tidptr=0x5555562e45d0) = 5415
[pid  5415] chdir("./207")              = 0
[pid  5415] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5415] setpgid(0, 0)               = 0
[pid  5415] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5415] write(3, "1000", 4)         = 4
[pid  5415] close(3)                    = 0
[pid  5415] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5415] memfd_create("syzkaller", 0) = 3
[pid  5415] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5415] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5415] munmap(0x7f295dd73000, 262144) = 0
[pid  5415] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   59.141818][ T5413] loop0: detected capacity change from 0 to 512
[   59.149589][ T5413] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   59.163213][ T5413] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5415] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5415] close(3)                    = 0
[pid  5415] mkdir("./file1", 0777)      = 0
[pid  5415] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5415] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5415] chdir("./file1")            = 0
[pid  5415] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5415] close(4)                    = 0
[pid  5415] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5415] creat("./file1", 0410)      = 4
[pid  5415] exit_group(0)               = ?
[pid  5415] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5415, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
umount2("./207", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./207", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./207/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./207/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./207/binderfs")                = 0
umount2("./207/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./207/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./207/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./207/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./207/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./207/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./207")                          = 0
mkdir("./208", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5417
./strace-static-x86_64: Process 5417 attached
[pid  5417] chdir("./208")              = 0
[pid  5417] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5417] setpgid(0, 0)               = 0
[pid  5417] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5417] write(3, "1000", 4)         = 4
[pid  5417] close(3)                    = 0
[pid  5417] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5417] memfd_create("syzkaller", 0) = 3
[pid  5417] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5417] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5417] munmap(0x7f295dd73000, 262144) = 0
[pid  5417] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   59.201032][ T5415] loop0: detected capacity change from 0 to 512
[   59.209146][ T5415] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[   59.223272][ T5415] EXT4-fs (loop0): 1 truncate cleaned up
[pid  5417] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5417] close(3)                    = 0
[pid  5417] mkdir("./file1", 0777)      = 0
[pid  5417] mount("/dev/loop0", "./file1", "ext4", 0, "inode_readahead_blks=0x0000000000000000,nogrpid,debug_want_extra_isize=0x0000000000000066,dioread_no"...) = 0
[pid  5417] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5417] chdir("./file1")            = 0
[pid  5417] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5417] close(4)                    = 0
[pid  5417] setxattr("./file1", "user.incfs.metadata", "\x3b\xca\x3e\x8e\xec\x60\xdb\x6d\xa7\x28\xee\x8e\x29\xfa\x00\xfa\x21\x03\x9b\x37\x80\xdd\x17\x54\x0b\xcd\xff\x62\xd7\x13\x4b\xa5\x3e\x25\xf5\x9a\xf9\x2d\xd4\x65\xa8\x39\x65\x8e\xad\x1f\x48\xc4\x42\xf9\x96\xdd\x68\x49\x56\xb1\x12\x67\xdb\x59\xfd\x65\x72\x81\xe9\x0a\x34\xe6\x3a\x4a\x3f\xeb\x92\xde\x49\xe5\x7c\xea\x7f\xec\x40\xeb\x97\x08\xf4\xc4\x39\x65\xc6\xae\x13\x8b\x7e\x6a\xe8\x40\x58\x14\x26\x34"..., 881, 0) = 0
[pid  5417] creat("./file1", 0410)      = 4
[pid  5417] exit_group(0)               = ?
[pid  5417] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5417, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./208", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./208", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x5555562e5620 /* 4 entries */, 32768) = 112
umount2("./208/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./208/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./208/binderfs")                = 0
umount2("./208/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./208/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./208/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./208/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./208/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x5555562ed660 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555562ed660 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./208/file1")                    = 0
getdents64(3, 0x5555562e5620 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./208")                          = 0
mkdir("./209", 0777)                    = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562e45d0) = 5419
./strace-static-x86_64: Process 5419 attached
[pid  5419] chdir("./209")              = 0
[pid  5419] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5419] setpgid(0, 0)               = 0
[pid  5419] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5419] write(3, "1000", 4)         = 4
[pid  5419] close(3)                    = 0
[pid  5419] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5419] memfd_create("syzkaller", 0) = 3
[pid  5419] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f295dd73000
[pid  5419] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid  5419] munmap(0x7f295dd73000, 262144) = 0
[pid  5419] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4