./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3927673459
<...>
Warning: Permanently added '10.128.0.101' (ED25519) to the list of known hosts.
execve("./syz-executor3927673459", ["./syz-executor3927673459"], 0x7fff56d0d180 /* 10 vars */) = 0
brk(NULL) = 0x5555759aa000
brk(0x5555759aad00) = 0x5555759aad00
arch_prctl(ARCH_SET_FS, 0x5555759aa380) = 0
set_tid_address(0x5555759aa650) = 5819
set_robust_list(0x5555759aa660, 24) = 0
rseq(0x5555759aaca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor3927673459", 4096) = 28
getrandom("\x89\xe1\x05\x9e\x56\x18\x83\x62", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x5555759aad00
brk(0x5555759cbd00) = 0x5555759cbd00
brk(0x5555759cc000) = 0x5555759cc000
mprotect(0x7f1fc7efd000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
mkdir("./syzkaller.RYXiSB", 0700) = 0
chmod("./syzkaller.RYXiSB", 0777) = 0
chdir("./syzkaller.RYXiSB") = 0
mkdir("./0", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5821 attached
, child_tidptr=0x5555759aa650) = 5821
[pid 5821] set_robust_list(0x5555759aa660, 24) = 0
[pid 5821] chdir("./0") = 0
[pid 5821] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5821] setpgid(0, 0) = 0
[pid 5821] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5821] write(3, "1000", 4) = 4
[pid 5821] close(3) = 0
[pid 5821] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 5821] write(1, "executing program\n", 18) = 18
[pid 5821] memfd_create("syzkaller", 0) = 3
[pid 5821] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1fbfa00000
[pid 5821] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216
[pid 5821] munmap(0x7f1fbfa00000, 138412032) = 0
[pid 5821] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 5821] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 5821] close(3) = 0
[pid 5821] close(4) = 0
[pid 5821] mkdir("./file1", 0777) = 0
syzkaller login: [ 84.359378][ T5821] loop0: detected capacity change from 0 to 32768
[pid 5821] mount("/dev/loop0", "./file1", "jfs", MS_REC|MS_SILENT|MS_POSIXACL|MS_STRICTATIME, "") = 0
[pid 5821] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid 5821] chdir("./file1") = 0
[pid 5821] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy)
[pid 5821] open("./bus", O_RDWR|O_CREAT|O_DIRECT|O_NOATIME|FASYNC, 01210) = 4
[pid 5821] openat(AT_FDCWD, "/dev/vcsu", O_RDONLY|O_NOFOLLOW) = 5
[pid 5821] read(5, "\x20\x00\x00\x00\x20\x00\x00\x00\x20\x00\x00\x00\x20\x00\x00\x00\x20\x00\x00\x00\x20\x00\x00\x00\x20\x00\x00\x00\x20\x00\x00\x00\x20\x00\x00\x00\x20\x00\x00\x00\x20\x00\x00\x00\x20\x00\x00\x00\x20\x00\x00\x00\x20\x00\x00\x00\x20\x00\x00\x00\x20\x00\x00\x00\x20\x00\x00\x00\x20\x00\x00\x00\x20\x00\x00\x00\x20\x00\x00\x00\x20\x00\x00\x00\x20\x00\x00\x00\x20\x00\x00\x00\x20\x00\x00\x00\x20\x00\x00\x00"..., 8224) = 8224
[pid 5821] mount("/dev/loop0", "./bus", NULL, MS_NOSUID|MS_BIND|MS_UNBINDABLE, NULL) = 0
[ 84.428703][ T29] audit: type=1800 audit(1735958727.642:2): pid=5821 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor392" name="bus" dev="loop0" ino=7 res=0 errno=0
[pid 5821] open("./bus", O_RDONLY) = 6
[pid 5821] ioctl(6, LOOP_SET_STATUS, {lo_number=0, lo_offset=0x20, lo_encrypt_type=0x20 /* LO_CRYPT_??? */, lo_encrypt_key_size=32, lo_flags=0x20 /* LO_FLAGS_??? */, lo_name=" ", lo_encrypt_key="\x20\x00\x00\x00\x20\x00\x00\x00\x20\x00\x00\x00\x20\x00\x00\x00\x20\x00\x00\x00\x20\x00\x00\x00\x20\x00\x00\x00\x20\x00\x00\x00", ...}) = 0
[pid 5821] exit_group(0) = ?
[pid 5821] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5821, si_uid=0, si_status=0, si_utime=3 /* 0.03 s */, si_stime=16 /* 0.16 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555759ab6f0 /* 4 entries */, 32768) = 112
umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./0/binderfs") = 0
umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EBUSY (Device or resource busy)
newfstatat(AT_FDCWD, "./0/file1", {st_mode=S_IFDIR|0755, st_size=256, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EBUSY (Device or resource busy)
openat(AT_FDCWD, "./0/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0755, st_size=256, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555759b3730 /* 8 entries */, 32768) = 232
umount2("./0/file1/bus", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./0/file1/bus", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./0/file1/bus", {st_mode=S_IFREG|S_ISVTX|0200, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./0/file1/bus") = 0
umount2("./0/file1/file.cold", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[ 84.531272][ T5821] loop0: detected capacity change from 32768 to 32767
newfstatat(AT_FDCWD, "./0/file1/file.cold", {st_mode=S_IFREG|0755, st_size=100, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./0/file1/file.cold") = 0
umount2("./0/file1/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EIO (Input/output error)
newfstatat(AT_FDCWD, "./0/file1/file0", 0x7fff85775990, AT_SYMLINK_NOFOLLOW) = -1 EIO (Input/output error)
exit_group(1) = ?
+++ exited with 1 +++
[ 84.596066][ T5819] ERROR: (device loop0): diRead: i_ino != di_number
[ 84.596066][ T5819]
[ 84.606386][ T5819] ERROR: (device loop0): remounting filesystem as read-only
[ 84.614201][ T5819] jfs_lookup: iget failed on inum 32
[ 84.621459][ T5819] ERROR: (device loop0): diRead: i_ino != di_number
[ 84.621459][ T5819]
[ 84.631530][ T5819] jfs_lookup: iget failed on inum 32
[ 89.474580][ T115] ------------[ cut here ]------------
[ 89.481254][ T115] UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:2783:24
[ 89.489610][ T115] index 4278845192 is out of range for type 's8[1365]' (aka 'signed char[1365]')
[ 89.500889][ T115] CPU: 1 UID: 0 PID: 115 Comm: jfsCommit Not tainted 6.13.0-rc5-syzkaller-00161-g63676eefb7a0 #0
[ 89.513291][ T115] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
[ 89.523988][ T115] Call Trace:
[ 89.527543][ T115]
[ 89.530757][ T115] dump_stack_lvl+0x241/0x360
[ 89.536231][ T115] ? __pfx_dump_stack_lvl+0x10/0x10
[ 89.541808][ T115] ? __pfx__printk+0x10/0x10
[ 89.547068][ T115] ? lock_metapage+0x3bf/0x450
[ 89.552413][ T115] __ubsan_handle_out_of_bounds+0x121/0x150
[ 89.558890][ T115] dbJoin+0x2ed/0x310
[ 89.563656][ T115] dbFreeBits+0x4db/0xd90
[ 89.568597][ T115] dbFree+0x35b/0x680
[ 89.573156][ T115] txFreeMap+0x96a/0xd50
[ 89.578042][ T115] ? _raw_spin_unlock+0x28/0x50
[ 89.583216][ T115] ? __mark_inode_dirty+0x5b2/0xe90
[ 89.589059][ T115] xtTruncate+0xe65/0x3270
[ 89.594689][ T115] ? __pfx_xtTruncate+0x10/0x10
[ 89.601761][ T115] jfs_free_zero_link+0x46e/0x6e0
[ 89.607771][ T115] ? inode_wait_for_writeback+0x111/0x2a0
[ 89.614265][ T115] ? __pfx_jfs_free_zero_link+0x10/0x10
[ 89.620219][ T115] jfs_evict_inode+0x35f/0x440
[ 89.626409][ T115] ? __pfx_jfs_evict_inode+0x10/0x10
[ 89.632540][ T115] evict+0x4e8/0x9a0
[ 89.636664][ T115] ? __pfx_evict+0x10/0x10
[ 89.641449][ T115] ? iput+0x713/0xa50
[ 89.645680][ T115] txUpdateMap+0x931/0xb10
[ 89.650413][ T115] ? __pfx_txUpdateMap+0x10/0x10
[ 89.655907][ T115] ? __wake_up_common_lock+0x18c/0x1e0
[ 89.661575][ T115] jfs_lazycommit+0x49a/0xb80
[ 89.666903][ T115] ? _raw_spin_unlock_irqrestore+0x8f/0x140
[ 89.674279][ T115] ? lockdep_hardirqs_on+0x99/0x150
[ 89.679972][ T115] ? __pfx_jfs_lazycommit+0x10/0x10
[ 89.685397][ T115] ? __pfx_default_wake_function+0x10/0x10
[ 89.691880][ T115] ? __kthread_parkme+0x169/0x1d0
[ 89.697606][ T115] ? __pfx_jfs_lazycommit+0x10/0x10
[ 89.703143][ T115] kthread+0x2f0/0x390
[ 89.707691][ T115] ? __pfx_jfs_lazycommit+0x10/0x10
[ 89.713376][ T115] ? __pfx_kthread+0x10/0x10
[ 89.718534][ T115] ret_from_fork+0x4b/0x80
[ 89.723213][ T115] ? __pfx_kthread+0x10/0x10
[ 89.728476][ T115] ret_from_fork_asm+0x1a/0x30
[ 89.734181][ T115]
[ 89.738454][ T115] ---[ end trace ]---
[ 89.743053][ T115] Kernel panic - not syncing: UBSAN: panic_on_warn set ...
[ 89.751327][ T115] CPU: 1 UID: 0 PID: 115 Comm: jfsCommit Not tainted 6.13.0-rc5-syzkaller-00161-g63676eefb7a0 #0
[ 89.763048][ T115] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
[ 89.774199][ T115] Call Trace:
[ 89.778039][ T115]
[ 89.781069][ T115] dump_stack_lvl+0x241/0x360
[ 89.786840][ T115] ? __pfx_dump_stack_lvl+0x10/0x10
[ 89.792427][ T115] ? __pfx__printk+0x10/0x10
[ 89.797506][ T115] ? lockdep_hardirqs_on+0x99/0x150
[ 89.803078][ T115] ? vscnprintf+0x5d/0x90
[ 89.807823][ T115] panic+0x349/0x880
[ 89.812108][ T115] ? check_panic_on_warn+0x21/0xb0
[ 89.817425][ T115] ? __pfx_panic+0x10/0x10
[ 89.822295][ T115] ? _printk+0xd5/0x120
[ 89.827523][ T115] ? __pfx__printk+0x10/0x10
[ 89.833381][ T115] ? lock_metapage+0x3bf/0x450
[ 89.839652][ T115] check_panic_on_warn+0x86/0xb0
[ 89.845310][ T115] __ubsan_handle_out_of_bounds+0x141/0x150
[ 89.852258][ T115] dbJoin+0x2ed/0x310
[ 89.856949][ T115] dbFreeBits+0x4db/0xd90
[ 89.861374][ T115] dbFree+0x35b/0x680
[ 89.866002][ T115] txFreeMap+0x96a/0xd50
[ 89.870579][ T115] ? _raw_spin_unlock+0x28/0x50
[ 89.876416][ T115] ? __mark_inode_dirty+0x5b2/0xe90
[ 89.881997][ T115] xtTruncate+0xe65/0x3270
[ 89.886700][ T115] ? __pfx_xtTruncate+0x10/0x10
[ 89.892063][ T115] jfs_free_zero_link+0x46e/0x6e0
[ 89.897532][ T115] ? inode_wait_for_writeback+0x111/0x2a0
[ 89.904264][ T115] ? __pfx_jfs_free_zero_link+0x10/0x10
[ 89.910339][ T115] jfs_evict_inode+0x35f/0x440
[ 89.915980][ T115] ? __pfx_jfs_evict_inode+0x10/0x10
[ 89.922070][ T115] evict+0x4e8/0x9a0
[ 89.926605][ T115] ? __pfx_evict+0x10/0x10
[ 89.931672][ T115] ? iput+0x713/0xa50
[ 89.936438][ T115] txUpdateMap+0x931/0xb10
[ 89.941758][ T115] ? __pfx_txUpdateMap+0x10/0x10
[ 89.948492][ T115] ? __wake_up_common_lock+0x18c/0x1e0
[ 89.955993][ T115] jfs_lazycommit+0x49a/0xb80
[ 89.961025][ T115] ? _raw_spin_unlock_irqrestore+0x8f/0x140
[ 89.967613][ T115] ? lockdep_hardirqs_on+0x99/0x150
[ 89.973266][ T115] ? __pfx_jfs_lazycommit+0x10/0x10
[ 89.978789][ T115] ? __pfx_default_wake_function+0x10/0x10
[ 89.985899][ T115] ? __kthread_parkme+0x169/0x1d0
[ 89.991566][ T115] ? __pfx_jfs_lazycommit+0x10/0x10
[ 89.997592][ T115] kthread+0x2f0/0x390
[ 90.002052][ T115] ? __pfx_jfs_lazycommit+0x10/0x10
[ 90.008573][ T115] ? __pfx_kthread+0x10/0x10
[ 90.013395][ T115] ret_from_fork+0x4b/0x80
[ 90.018803][ T115] ? __pfx_kthread+0x10/0x10
[ 90.024336][ T115] ret_from_fork_asm+0x1a/0x30
[ 90.029923][ T115]
[ 90.033527][ T115] Kernel Offset: disabled
[ 90.038366][ T115] Rebooting in 86400 seconds..