./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1314596245 <...> file descriptor) [pid 5259] close(22) = -1 EBADF (Bad file descriptor) [pid 5259] close(23) = -1 EBADF (Bad file descriptor) [pid 5259] close(24) = -1 EBADF (Bad file descriptor) [pid 5259] close(25) = -1 EBADF (Bad file descriptor) [pid 5259] close(26) = -1 EBADF (Bad file descriptor) [pid 5259] close(27) = -1 EBADF (Bad file descriptor) [ 107.327082][ T5266] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 107.333127][ T5266] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 107.339175][ T5266] do_syscall_64+0x41/0xc0 [ 107.343645][ T5266] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 107.349592][ T5266] RIP: 0033:0x7fd49ce20129 [ 107.354048][ T5266] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 5259] close(28) = -1 EBADF (Bad file descriptor) [pid 5259] close(29) = -1 EBADF (Bad file descriptor) [pid 5259] exit_group(0) = ? [pid 5259] +++ exited with 0 +++ [pid 5072] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=9, si_uid=0, si_status=0, si_utime=0, si_stime=9 /* 0.09 s */} --- [pid 5072] umount2("./7", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5072] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5072] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5072] umount2("./7/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./7/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5072] unlink("./7/binderfs") = 0 [pid 5072] umount2("./7/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./7/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5072] unlink("./7/cgroup") = 0 [pid 5072] umount2("./7/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./7/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5072] unlink("./7/cgroup.net") = 0 [pid 5072] umount2("./7/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5072] umount2("./7/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./7/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5072] umount2("./7/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] openat(AT_FDCWD, "./7/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5072] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5072] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5072] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [ 107.373703][ T5266] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 107.382173][ T5266] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 107.390193][ T5266] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 107.398227][ T5266] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 107.406245][ T5266] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 107.414256][ T5266] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 000000000000000d [ 107.422739][ T5266] [pid 5072] close(4) = 0 [pid 5072] rmdir("./7/file0") = 0 [pid 5072] umount2("./7/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./7/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5072] unlink("./7/cgroup.cpu") = 0 [pid 5072] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5072] close(3) = 0 [pid 5072] rmdir("./7") = 0 [pid 5072] mkdir("./8", 0777) = 0 [pid 5072] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5282 attached [pid 5282] chdir("./8" [pid 5072] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 10 [pid 5282] <... chdir resumed>) = 0 [pid 5282] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5282] setpgid(0, 0) = 0 [pid 5282] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [ 107.437522][ T5266] memory: usage 12kB, limit 0kB, failcnt 55 [ 107.444273][ T5266] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 107.452665][ T5266] Memory cgroup stats for /syz1: [ 107.452887][ T5266] anon 0 [ 107.452887][ T5266] file 0 [ 107.452887][ T5266] kernel 12288 [ 107.452887][ T5266] kernel_stack 0 [ 107.452887][ T5266] pagetables 0 [ 107.452887][ T5266] sec_pagetables 0 [ 107.452887][ T5266] percpu 0 [ 107.452887][ T5266] sock 0 [ 107.452887][ T5266] vmalloc 0 [ 107.452887][ T5266] shmem 0 [pid 5282] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [pid 5282] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 5282] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5282] write(3, "1000", 4) = 4 [pid 5282] close(3) = 0 [pid 5282] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5282] mkdir("./file0", 000) = 0 [pid 5282] open("./file0", O_RDONLY) = 3 [ 107.452887][ T5266] zswap 0 [ 107.452887][ T5266] zswapped 0 [ 107.452887][ T5266] file_mapped 0 [ 107.452887][ T5266] file_dirty 0 [ 107.452887][ T5266] file_writeback 0 [ 107.452887][ T5266] swapcached 0 [ 107.452887][ T5266] anon_thp 0 [ 107.452887][ T5266] file_thp 0 [ 107.452887][ T5266] shmem_thp 0 [ 107.452887][ T5266] inactive_anon 0 [ 107.452887][ T5266] active_anon 0 [ 107.452887][ T5266] inactive_file 0 [ 107.452887][ T5266] active_file 0 [ 107.452887][ T5266] unevictable 0 [ 107.452887][ T5266] slab_reclaimable 9328 [pid 5282] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5282] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5282] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5282] openat(5, "memory.max", O_RDWR) = 6 [ 107.452887][ T5266] slab_unreclaimable 0 [ 107.452887][ T5266] slab 9328 [ 107.452887][ T5266] workingset_refault_anon 0 [ 107.557521][ T5266] Tasks state (memory values in pages): [ 107.563298][ T5266] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 107.575780][ T5266] Out of memory and no killable processes... [pid 5282] write(6, "0x000000000000040e", 18 [pid 5266] <... write resumed>) = 18 [ 107.582508][ T5270] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 107.593724][ T5270] CPU: 1 PID: 5270 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 107.604194][ T5270] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 107.614296][ T5270] Call Trace: [ 107.617615][ T5270] [ 107.620586][ T5270] dump_stack_lvl+0x1e7/0x2d0 [ 107.625322][ T5270] ? nf_tcp_handle_invalid+0x640/0x640 [ 107.630833][ T5270] ? panic+0x770/0x770 [ 107.634972][ T5270] dump_header+0xdc/0x940 [ 107.639354][ T5270] out_of_memory+0xf21/0x12c0 [ 107.644090][ T5270] ? mutex_lock_io_nested+0x60/0x60 [ 107.649351][ T5270] ? preempt_schedule+0xdd/0xf0 [ 107.654255][ T5270] ? unregister_oom_notifier+0x20/0x20 [ 107.659858][ T5270] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 107.665907][ T5270] mem_cgroup_out_of_memory+0x263/0x3b0 [ 107.671509][ T5270] ? preempt_schedule_thunk+0x1a/0x20 [ 107.676932][ T5270] ? mem_cgroup_oom_trylock+0x210/0x210 [ 107.682516][ T5270] ? cgroup_file_notify+0x127/0x190 [ 107.687755][ T5270] memory_max_write+0x355/0x470 [ 107.692660][ T5270] ? memory_max_show+0xa0/0xa0 [ 107.697449][ T5270] ? read_lock_is_recursive+0x20/0x20 [ 107.702852][ T5270] ? memory_max_show+0xa0/0xa0 [ 107.707729][ T5270] cgroup_file_write+0x2b1/0x780 [ 107.712711][ T5270] ? cgroup_seqfile_stop+0xd0/0xd0 [ 107.717863][ T5270] ? __virt_addr_valid+0x22f/0x2e0 [ 107.723012][ T5270] ? cgroup_seqfile_stop+0xd0/0xd0 [ 107.728142][ T5270] kernfs_fop_write_iter+0x3a6/0x4f0 [ 107.733459][ T5270] vfs_write+0x7b2/0xbb0 [ 107.737733][ T5270] ? file_end_write+0x240/0x240 [ 107.742611][ T5270] ? do_raw_spin_unlock+0x13b/0x8b0 [ 107.747826][ T5270] ? lockdep_hardirqs_on+0x98/0x140 [ 107.753044][ T5270] ? __fdget_pos+0x265/0x2f0 [ 107.757652][ T5270] ksys_write+0x1a0/0x2c0 [ 107.762004][ T5270] ? __ia32_sys_read+0x90/0x90 [ 107.766787][ T5270] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 107.772793][ T5270] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 107.778801][ T5270] do_syscall_64+0x41/0xc0 [ 107.783237][ T5270] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 107.789152][ T5270] RIP: 0033:0x7fd49ce20129 [ 107.793578][ T5270] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 107.813196][ T5270] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 107.821622][ T5270] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 107.829633][ T5270] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [pid 5266] close(3) = 0 [pid 5266] close(4) = 0 [pid 5266] close(5) = 0 [pid 5266] close(6) = 0 [pid 5266] close(7) = -1 EBADF (Bad file descriptor) [pid 5266] close(8) = -1 EBADF (Bad file descriptor) [pid 5266] close(9) = -1 EBADF (Bad file descriptor) [pid 5266] close(10) = -1 EBADF (Bad file descriptor) [pid 5266] close(11) = -1 EBADF (Bad file descriptor) [pid 5266] close(12) = -1 EBADF (Bad file descriptor) [pid 5266] close(13) = -1 EBADF (Bad file descriptor) [pid 5266] close(14) = -1 EBADF (Bad file descriptor) [pid 5266] close(15) = -1 EBADF (Bad file descriptor) [pid 5266] close(16) = -1 EBADF (Bad file descriptor) [pid 5266] close(17) = -1 EBADF (Bad file descriptor) [pid 5266] close(18) = -1 EBADF (Bad file descriptor) [pid 5266] close(19) = -1 EBADF (Bad file descriptor) [pid 5266] close(20) = -1 EBADF (Bad file descriptor) [pid 5266] close(21) = -1 EBADF (Bad file descriptor) [pid 5266] close(22) = -1 EBADF (Bad file descriptor) [pid 5266] close(23) = -1 EBADF (Bad file descriptor) [pid 5266] close(24) = -1 EBADF (Bad file descriptor) [pid 5266] close(25) = -1 EBADF (Bad file descriptor) [pid 5266] close(26) = -1 EBADF (Bad file descriptor) [pid 5266] close(27) = -1 EBADF (Bad file descriptor) [pid 5266] close(28) = -1 EBADF (Bad file descriptor) [pid 5266] close(29) = -1 EBADF (Bad file descriptor) [pid 5266] exit_group(0) = ? [ 107.837635][ T5270] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 107.845626][ T5270] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 107.853608][ T5270] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 000000000000000d [ 107.861608][ T5270] [ 107.876722][ T5270] memory: usage 12kB, limit 0kB, failcnt 55 [ 107.883439][ T5270] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [pid 5266] +++ exited with 0 +++ [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=15, si_uid=0, si_status=0, si_utime=0, si_stime=7 /* 0.07 s */} --- [pid 5074] umount2("./13", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5074] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5074] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5074] umount2("./13/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./13/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5074] unlink("./13/binderfs") = 0 [pid 5074] umount2("./13/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./13/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5074] unlink("./13/cgroup") = 0 [pid 5074] umount2("./13/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./13/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5074] unlink("./13/cgroup.net") = 0 [ 107.902496][ T5270] Memory cgroup stats for /syz1: [ 107.902732][ T5270] anon 0 [ 107.902732][ T5270] file 0 [ 107.902732][ T5270] kernel 12288 [ 107.902732][ T5270] kernel_stack 0 [ 107.902732][ T5270] pagetables 0 [ 107.902732][ T5270] sec_pagetables 0 [ 107.902732][ T5270] percpu 0 [ 107.902732][ T5270] sock 0 [ 107.902732][ T5270] vmalloc 0 [ 107.902732][ T5270] shmem 0 [ 107.902732][ T5270] zswap 0 [ 107.902732][ T5270] zswapped 0 [ 107.902732][ T5270] file_mapped 0 [ 107.902732][ T5270] file_dirty 0 [pid 5074] umount2("./13/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5074] umount2("./13/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./13/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5074] umount2("./13/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] openat(AT_FDCWD, "./13/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5074] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5074] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5074] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5074] close(4) = 0 [pid 5074] rmdir("./13/file0") = 0 [pid 5074] umount2("./13/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./13/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5074] unlink("./13/cgroup.cpu") = 0 [ 107.902732][ T5270] file_writeback 0 [ 107.902732][ T5270] swapcached 0 [ 107.902732][ T5270] anon_thp 0 [ 107.902732][ T5270] file_thp 0 [ 107.902732][ T5270] shmem_thp 0 [ 107.902732][ T5270] inactive_anon 0 [ 107.902732][ T5270] active_anon 0 [ 107.902732][ T5270] inactive_file 0 [ 107.902732][ T5270] active_file 0 [ 107.902732][ T5270] unevictable 0 [ 107.902732][ T5270] slab_reclaimable 9328 [ 107.902732][ T5270] slab_unreclaimable 0 [ 107.902732][ T5270] slab 9328 [ 107.902732][ T5270] workingset_refault_anon 0 [pid 5074] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5074] close(3) = 0 [pid 5074] rmdir("./13") = 0 [pid 5074] mkdir("./14", 0777) = 0 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5284 attached [pid 5284] chdir("./14" [pid 5074] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 16 [pid 5284] <... chdir resumed>) = 0 [pid 5284] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5284] setpgid(0, 0) = 0 [pid 5284] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [pid 5284] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 5284] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 5284] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [ 108.051935][ T5270] Tasks state (memory values in pages): [ 108.058755][ T5270] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 108.084386][ T5270] Out of memory and no killable processes... [ 108.091587][ T5275] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5284] write(3, "1000", 4 [pid 5270] <... write resumed>) = 18 [ 108.102298][ T5275] CPU: 0 PID: 5275 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 108.112776][ T5275] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 108.122878][ T5275] Call Trace: [ 108.126206][ T5275] [ 108.129182][ T5275] dump_stack_lvl+0x1e7/0x2d0 [ 108.133913][ T5275] ? nf_tcp_handle_invalid+0x640/0x640 [ 108.139423][ T5275] ? panic+0x770/0x770 [ 108.143563][ T5275] dump_header+0xdc/0x940 [ 108.147947][ T5275] out_of_memory+0xf21/0x12c0 [ 108.152690][ T5275] ? mutex_lock_io_nested+0x60/0x60 [ 108.157959][ T5275] ? preempt_schedule+0xdd/0xf0 [ 108.162855][ T5275] ? unregister_oom_notifier+0x20/0x20 [ 108.168345][ T5275] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 108.174375][ T5275] mem_cgroup_out_of_memory+0x263/0x3b0 [ 108.180038][ T5275] ? preempt_schedule_thunk+0x1a/0x20 [ 108.185435][ T5275] ? mem_cgroup_oom_trylock+0x210/0x210 [ 108.191015][ T5275] ? cgroup_file_notify+0x127/0x190 [ 108.196238][ T5275] memory_max_write+0x355/0x470 [ 108.201127][ T5275] ? memory_max_show+0xa0/0xa0 [ 108.205956][ T5275] ? read_lock_is_recursive+0x20/0x20 [ 108.211355][ T5275] ? memory_max_show+0xa0/0xa0 [ 108.216139][ T5275] cgroup_file_write+0x2b1/0x780 [ 108.221097][ T5275] ? cgroup_seqfile_stop+0xd0/0xd0 [ 108.226228][ T5275] ? __virt_addr_valid+0x22f/0x2e0 [ 108.231369][ T5275] ? cgroup_seqfile_stop+0xd0/0xd0 [ 108.236495][ T5275] kernfs_fop_write_iter+0x3a6/0x4f0 [ 108.241821][ T5275] vfs_write+0x7b2/0xbb0 [ 108.246089][ T5275] ? file_end_write+0x240/0x240 [ 108.250975][ T5275] ? do_raw_spin_unlock+0x13b/0x8b0 [ 108.256191][ T5275] ? lockdep_hardirqs_on+0x98/0x140 [ 108.261413][ T5275] ? __fdget_pos+0x265/0x2f0 [ 108.266026][ T5275] ksys_write+0x1a0/0x2c0 [ 108.270377][ T5275] ? __ia32_sys_read+0x90/0x90 [ 108.275157][ T5275] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 108.281164][ T5275] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 108.287186][ T5275] do_syscall_64+0x41/0xc0 [ 108.291624][ T5275] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 108.297558][ T5275] RIP: 0033:0x7fd49ce20129 [ 108.301983][ T5275] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 108.321615][ T5275] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 108.330079][ T5275] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 108.338120][ T5275] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 108.346118][ T5275] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 108.354113][ T5275] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 108.362108][ T5275] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000007 [ 108.370115][ T5275] [ 108.379098][ T5275] memory: usage 12kB, limit 0kB, failcnt 55 [ 108.385064][ T5275] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 108.396040][ T5275] Memory cgroup stats for /syz1: [ 108.396214][ T5275] anon 0 [ 108.396214][ T5275] file 0 [ 108.396214][ T5275] kernel 12288 [ 108.396214][ T5275] kernel_stack 0 [ 108.396214][ T5275] pagetables 0 [ 108.396214][ T5275] sec_pagetables 0 [ 108.396214][ T5275] percpu 0 [ 108.396214][ T5275] sock 0 [ 108.396214][ T5275] vmalloc 0 [ 108.396214][ T5275] shmem 0 [ 108.396214][ T5275] zswap 0 [ 108.396214][ T5275] zswapped 0 [ 108.396214][ T5275] file_mapped 0 [ 108.396214][ T5275] file_dirty 0 [ 108.396214][ T5275] file_writeback 0 [ 108.396214][ T5275] swapcached 0 [ 108.396214][ T5275] anon_thp 0 [pid 5284] <... write resumed>) = 4 [pid 5270] close(3 [pid 5284] close(3 [pid 5270] <... close resumed>) = 0 [pid 5284] <... close resumed>) = 0 [pid 5270] close(4 [pid 5284] symlink("/dev/binderfs", "./binderfs" [pid 5270] <... close resumed>) = 0 [pid 5284] <... symlink resumed>) = 0 [pid 5270] close(5 [pid 5284] mkdir("./file0", 000 [pid 5270] <... close resumed>) = 0 [pid 5284] <... mkdir resumed>) = 0 [pid 5270] close(6 [pid 5284] open("./file0", O_RDONLY [pid 5270] <... close resumed>) = 0 [pid 5284] <... open resumed>) = 3 [pid 5270] close(7 [pid 5284] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5270] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5284] <... mount resumed>) = 0 [pid 5270] close(8 [pid 5284] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5270] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5284] <... openat resumed>) = 4 [pid 5270] close(9 [pid 5284] openat(4, "syz1", O_RDWR|O_PATH [pid 5270] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5284] <... openat resumed>) = 5 [pid 5270] close(10 [pid 5284] openat(5, "memory.max", O_RDWR [pid 5270] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5284] <... openat resumed>) = 6 [pid 5270] close(11 [pid 5284] write(6, "0x000000000000040e", 18 [pid 5270] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5270] close(12) = -1 EBADF (Bad file descriptor) [pid 5270] close(13) = -1 EBADF (Bad file descriptor) [pid 5270] close(14) = -1 EBADF (Bad file descriptor) [pid 5270] close(15) = -1 EBADF (Bad file descriptor) [pid 5270] close(16) = -1 EBADF (Bad file descriptor) [pid 5270] close(17) = -1 EBADF (Bad file descriptor) [pid 5270] close(18) = -1 EBADF (Bad file descriptor) [pid 5270] close(19) = -1 EBADF (Bad file descriptor) [pid 5270] close(20) = -1 EBADF (Bad file descriptor) [pid 5270] close(21) = -1 EBADF (Bad file descriptor) [pid 5270] close(22) = -1 EBADF (Bad file descriptor) [pid 5270] close(23) = -1 EBADF (Bad file descriptor) [pid 5270] close(24) = -1 EBADF (Bad file descriptor) [pid 5270] close(25) = -1 EBADF (Bad file descriptor) [pid 5270] close(26) = -1 EBADF (Bad file descriptor) [pid 5270] close(27) = -1 EBADF (Bad file descriptor) [pid 5270] close(28) = -1 EBADF (Bad file descriptor) [pid 5270] close(29) = -1 EBADF (Bad file descriptor) [pid 5270] exit_group(0) = ? [pid 5270] +++ exited with 0 +++ [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=15, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- [pid 5075] umount2("./13", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5075] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5075] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5075] umount2("./13/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./13/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5075] unlink("./13/binderfs") = 0 [pid 5075] umount2("./13/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./13/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5075] unlink("./13/cgroup") = 0 [pid 5075] umount2("./13/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./13/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5075] unlink("./13/cgroup.net") = 0 [ 108.396214][ T5275] file_thp 0 [ 108.396214][ T5275] shmem_thp 0 [ 108.396214][ T5275] inactive_anon 0 [ 108.396214][ T5275] active_anon 0 [ 108.396214][ T5275] inactive_file 0 [ 108.396214][ T5275] active_file 0 [ 108.396214][ T5275] unevictable 0 [ 108.396214][ T5275] slab_reclaimable 9328 [ 108.396214][ T5275] slab_unreclaimable 0 [ 108.396214][ T5275] slab 9328 [ 108.396214][ T5275] workingset_refault_anon 0 [ 108.495240][ T5275] Tasks state (memory values in pages): [pid 5075] umount2("./13/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5075] umount2("./13/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./13/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5075] umount2("./13/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] openat(AT_FDCWD, "./13/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5075] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5075] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5075] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5075] close(4) = 0 [pid 5075] rmdir("./13/file0") = 0 [pid 5075] umount2("./13/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./13/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5075] unlink("./13/cgroup.cpu") = 0 [pid 5075] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5075] close(3) = 0 [pid 5075] rmdir("./13") = 0 [pid 5075] mkdir("./14", 0777) = 0 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5287 attached [pid 5287] chdir("./14" [pid 5075] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 16 [pid 5287] <... chdir resumed>) = 0 [pid 5287] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5287] setpgid(0, 0) = 0 [pid 5287] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 5287] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 5287] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 5287] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5287] write(3, "1000", 4) = 4 [pid 5287] close(3) = 0 [pid 5287] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5287] mkdir("./file0", 000) = 0 [pid 5287] open("./file0", O_RDONLY) = 3 [pid 5287] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5287] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [ 108.502077][ T5275] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5287] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5287] openat(5, "memory.max", O_RDWR) = 6 [pid 5287] write(6, "0x000000000000040e", 18 [pid 5275] <... write resumed>) = 18 [pid 5275] close(3) = 0 [pid 5275] close(4) = 0 [pid 5275] close(5) = 0 [pid 5275] close(6) = 0 [pid 5275] close(7) = -1 EBADF (Bad file descriptor) [pid 5275] close(8) = -1 EBADF (Bad file descriptor) [pid 5275] close(9) = -1 EBADF (Bad file descriptor) [pid 5275] close(10) = -1 EBADF (Bad file descriptor) [pid 5275] close(11) = -1 EBADF (Bad file descriptor) [pid 5275] close(12) = -1 EBADF (Bad file descriptor) [pid 5275] close(13) = -1 EBADF (Bad file descriptor) [pid 5275] close(14) = -1 EBADF (Bad file descriptor) [pid 5275] close(15) = -1 EBADF (Bad file descriptor) [pid 5275] close(16) = -1 EBADF (Bad file descriptor) [pid 5275] close(17) = -1 EBADF (Bad file descriptor) [pid 5275] close(18) = -1 EBADF (Bad file descriptor) [pid 5275] close(19) = -1 EBADF (Bad file descriptor) [pid 5275] close(20) = -1 EBADF (Bad file descriptor) [pid 5275] close(21) = -1 EBADF (Bad file descriptor) [pid 5275] close(22) = -1 EBADF (Bad file descriptor) [pid 5275] close(23) = -1 EBADF (Bad file descriptor) [ 108.587365][ T5275] Out of memory and no killable processes... [ 108.603309][ T5278] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 108.650602][ T5278] CPU: 0 PID: 5278 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 108.661104][ T5278] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 108.671214][ T5278] Call Trace: [ 108.674530][ T5278] [ 108.677509][ T5278] dump_stack_lvl+0x1e7/0x2d0 [ 108.682249][ T5278] ? nf_tcp_handle_invalid+0x640/0x640 [ 108.687758][ T5278] ? panic+0x770/0x770 [ 108.691893][ T5278] dump_header+0xdc/0x940 [ 108.696458][ T5278] out_of_memory+0xf21/0x12c0 [ 108.701230][ T5278] ? mutex_lock_io_nested+0x60/0x60 [ 108.706491][ T5278] ? mark_lock+0x9a/0x340 [ 108.710854][ T5278] ? unregister_oom_notifier+0x20/0x20 [ 108.716332][ T5278] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 108.722355][ T5278] mem_cgroup_out_of_memory+0x263/0x3b0 [ 108.727944][ T5278] ? mem_cgroup_oom_trylock+0x210/0x210 [ 108.733537][ T5278] ? cgroup_file_notify+0x127/0x190 [ 108.738772][ T5278] memory_max_write+0x355/0x470 [ 108.743659][ T5278] ? memory_max_show+0xa0/0xa0 [ 108.748462][ T5278] ? read_lock_is_recursive+0x20/0x20 [ 108.753866][ T5278] ? memory_max_show+0xa0/0xa0 [ 108.758646][ T5278] cgroup_file_write+0x2b1/0x780 [ 108.763603][ T5278] ? cgroup_seqfile_stop+0xd0/0xd0 [ 108.768728][ T5278] ? __virt_addr_valid+0x22f/0x2e0 [ 108.773867][ T5278] ? cgroup_seqfile_stop+0xd0/0xd0 [ 108.778990][ T5278] kernfs_fop_write_iter+0x3a6/0x4f0 [ 108.784302][ T5278] vfs_write+0x7b2/0xbb0 [ 108.788572][ T5278] ? file_end_write+0x240/0x240 [ 108.793547][ T5278] ? do_raw_spin_unlock+0x13b/0x8b0 [ 108.798766][ T5278] ? lockdep_hardirqs_on+0x98/0x140 [ 108.803987][ T5278] ? __fdget_pos+0x265/0x2f0 [ 108.808638][ T5278] ksys_write+0x1a0/0x2c0 [ 108.813342][ T5278] ? __ia32_sys_read+0x90/0x90 [ 108.818143][ T5278] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 108.824160][ T5278] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 108.830183][ T5278] do_syscall_64+0x41/0xc0 [ 108.834625][ T5278] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 108.840543][ T5278] RIP: 0033:0x7fd49ce20129 [ 108.845080][ T5278] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 108.864731][ T5278] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 108.873166][ T5278] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 108.881149][ T5278] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 108.889128][ T5278] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 108.897111][ T5278] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 108.905384][ T5278] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 000000000000000a [ 108.913399][ T5278] [ 108.921728][ T5278] memory: usage 12kB, limit 0kB, failcnt 55 [ 108.935934][ T5278] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 108.943759][ T5278] Memory cgroup stats for /syz1: [ 108.943969][ T5278] anon 0 [ 108.943969][ T5278] file 0 [ 108.943969][ T5278] kernel 12288 [ 108.943969][ T5278] kernel_stack 0 [ 108.943969][ T5278] pagetables 0 [ 108.943969][ T5278] sec_pagetables 0 [ 108.943969][ T5278] percpu 0 [ 108.943969][ T5278] sock 0 [ 108.943969][ T5278] vmalloc 0 [ 108.943969][ T5278] shmem 0 [ 108.943969][ T5278] zswap 0 [ 108.943969][ T5278] zswapped 0 [ 108.943969][ T5278] file_mapped 0 [ 108.943969][ T5278] file_dirty 0 [ 108.943969][ T5278] file_writeback 0 [ 108.943969][ T5278] swapcached 0 [ 108.943969][ T5278] anon_thp 0 [pid 5275] close(24) = -1 EBADF (Bad file descriptor) [ 108.943969][ T5278] file_thp 0 [ 108.943969][ T5278] shmem_thp 0 [ 108.943969][ T5278] inactive_anon 0 [ 108.943969][ T5278] active_anon 0 [ 108.943969][ T5278] inactive_file 0 [ 108.943969][ T5278] active_file 0 [ 108.943969][ T5278] unevictable 0 [ 108.943969][ T5278] slab_reclaimable 9328 [ 108.943969][ T5278] slab_unreclaimable 0 [ 108.943969][ T5278] slab 9328 [ 108.943969][ T5278] workingset_refault_anon 0 [ 109.044383][ T5278] Tasks state (memory values in pages): [pid 5275] close(25) = -1 EBADF (Bad file descriptor) [pid 5275] close(26) = -1 EBADF (Bad file descriptor) [pid 5275] close(27) = -1 EBADF (Bad file descriptor) [pid 5275] close(28) = -1 EBADF (Bad file descriptor) [pid 5275] close(29) = -1 EBADF (Bad file descriptor) [pid 5275] exit_group(0) = ? [pid 5275] +++ exited with 0 +++ [pid 5070] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=9, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- [pid 5278] <... write resumed>) = 18 [pid 5278] close(3) = 0 [pid 5278] close(4) = 0 [pid 5278] close(5) = 0 [pid 5278] close(6) = 0 [pid 5278] close(7) = -1 EBADF (Bad file descriptor) [pid 5278] close(8) = -1 EBADF (Bad file descriptor) [pid 5278] close(9) = -1 EBADF (Bad file descriptor) [pid 5278] close(10) = -1 EBADF (Bad file descriptor) [pid 5278] close(11) = -1 EBADF (Bad file descriptor) [pid 5278] close(12) = -1 EBADF (Bad file descriptor) [pid 5278] close(13) = -1 EBADF (Bad file descriptor) [pid 5278] close(14) = -1 EBADF (Bad file descriptor) [pid 5278] close(15) = -1 EBADF (Bad file descriptor) [pid 5278] close(16) = -1 EBADF (Bad file descriptor) [pid 5278] close(17) = -1 EBADF (Bad file descriptor) [pid 5278] close(18) = -1 EBADF (Bad file descriptor) [pid 5278] close(19) = -1 EBADF (Bad file descriptor) [pid 5278] close(20) = -1 EBADF (Bad file descriptor) [pid 5278] close(21) = -1 EBADF (Bad file descriptor) [pid 5278] close(22) = -1 EBADF (Bad file descriptor) [pid 5278] close(23) = -1 EBADF (Bad file descriptor) [pid 5278] close(24) = -1 EBADF (Bad file descriptor) [pid 5278] close(25) = -1 EBADF (Bad file descriptor) [pid 5278] close(26) = -1 EBADF (Bad file descriptor) [pid 5278] close(27) = -1 EBADF (Bad file descriptor) [pid 5278] close(28) = -1 EBADF (Bad file descriptor) [pid 5278] close(29) = -1 EBADF (Bad file descriptor) [pid 5278] exit_group(0) = ? [pid 5278] +++ exited with 0 +++ [ 109.051448][ T5278] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 109.062375][ T5278] Out of memory and no killable processes... [ 109.075761][ T5282] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 109.087483][ T5282] CPU: 0 PID: 5282 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 109.097962][ T5282] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 109.108063][ T5282] Call Trace: [ 109.111389][ T5282] [ 109.114357][ T5282] dump_stack_lvl+0x1e7/0x2d0 [ 109.119090][ T5282] ? nf_tcp_handle_invalid+0x640/0x640 [ 109.124611][ T5282] ? panic+0x770/0x770 [ 109.128752][ T5282] dump_header+0xdc/0x940 [ 109.133147][ T5282] out_of_memory+0xf21/0x12c0 [ 109.137885][ T5282] ? mutex_lock_io_nested+0x60/0x60 [ 109.143171][ T5282] ? preempt_schedule+0xdd/0xf0 [ 109.148094][ T5282] ? unregister_oom_notifier+0x20/0x20 [ 109.153595][ T5282] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 109.159611][ T5282] mem_cgroup_out_of_memory+0x263/0x3b0 [ 109.165179][ T5282] ? preempt_schedule_thunk+0x1a/0x20 [ 109.171606][ T5282] ? mem_cgroup_oom_trylock+0x210/0x210 [ 109.178962][ T5282] ? cgroup_file_notify+0x127/0x190 [ 109.184182][ T5282] memory_max_write+0x355/0x470 [ 109.189056][ T5282] ? memory_max_show+0xa0/0xa0 [ 109.193837][ T5282] ? read_lock_is_recursive+0x20/0x20 [ 109.199230][ T5282] ? memory_max_show+0xa0/0xa0 [ 109.204010][ T5282] cgroup_file_write+0x2b1/0x780 [ 109.208966][ T5282] ? cgroup_seqfile_stop+0xd0/0xd0 [ 109.214090][ T5282] ? __virt_addr_valid+0x22f/0x2e0 [ 109.219236][ T5282] ? cgroup_seqfile_stop+0xd0/0xd0 [ 109.224356][ T5282] kernfs_fop_write_iter+0x3a6/0x4f0 [ 109.229665][ T5282] vfs_write+0x7b2/0xbb0 [ 109.233930][ T5282] ? file_end_write+0x240/0x240 [ 109.238802][ T5282] ? do_raw_spin_unlock+0x13b/0x8b0 [ 109.244017][ T5282] ? lockdep_hardirqs_on+0x98/0x140 [ 109.249258][ T5282] ? __fdget_pos+0x265/0x2f0 [ 109.253866][ T5282] ksys_write+0x1a0/0x2c0 [ 109.258215][ T5282] ? __ia32_sys_read+0x90/0x90 [ 109.262992][ T5282] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 109.268998][ T5282] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 109.275001][ T5282] do_syscall_64+0x41/0xc0 [ 109.279438][ T5282] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 109.285350][ T5282] RIP: 0033:0x7fd49ce20129 [ 109.289774][ T5282] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 109.309388][ T5282] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 109.317833][ T5282] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 109.325820][ T5282] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 109.333804][ T5282] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 109.341784][ T5282] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [pid 5070] restart_syscall(<... resuming interrupted clone ...> [pid 5073] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=12, si_uid=0, si_status=0, si_utime=0, si_stime=11 /* 0.11 s */} --- [pid 5073] umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5070] <... restart_syscall resumed>) = 0 [pid 5073] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5073] getdents64(3, [pid 5070] umount2("./7", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] <... getdents64 resumed>0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5073] umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./10/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5073] unlink("./10/binderfs" [pid 5070] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5073] <... unlink resumed>) = 0 [pid 5070] <... openat resumed>) = 3 [pid 5073] umount2("./10/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./10/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5070] fstat(3, [pid 5073] unlink("./10/cgroup" [pid 5070] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5073] <... unlink resumed>) = 0 [pid 5070] getdents64(3, [pid 5073] umount2("./10/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./10/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5070] <... getdents64 resumed>0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5073] unlink("./10/cgroup.net" [pid 5070] umount2("./7/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5073] <... unlink resumed>) = 0 [pid 5070] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./7/binderfs", [pid 5073] umount2("./10/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5070] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5070] unlink("./7/binderfs" [pid 5073] <... umount2 resumed>) = 0 [pid 5070] <... unlink resumed>) = 0 [pid 5073] umount2("./10/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5070] umount2("./7/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5073] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./10/file0", [pid 5070] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5073] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5070] lstat("./7/cgroup", [pid 5073] umount2("./10/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5073] openat(AT_FDCWD, "./10/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5070] unlink("./7/cgroup" [pid 5073] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5070] <... unlink resumed>) = 0 [pid 5073] getdents64(4, [pid 5070] umount2("./7/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5073] <... getdents64 resumed>0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5070] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5073] getdents64(4, [pid 5070] lstat("./7/cgroup.net", [pid 5073] <... getdents64 resumed>0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5073] close(4 [pid 5070] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5073] <... close resumed>) = 0 [pid 5070] unlink("./7/cgroup.net" [pid 5073] rmdir("./10/file0") = 0 [pid 5070] <... unlink resumed>) = 0 [pid 5073] umount2("./10/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5070] umount2("./7/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5073] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./10/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5070] <... umount2 resumed>) = 0 [pid 5073] unlink("./10/cgroup.cpu" [pid 5070] umount2("./7/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5073] <... unlink resumed>) = 0 [pid 5073] getdents64(3, [pid 5070] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5073] <... getdents64 resumed>0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5070] lstat("./7/file0", [pid 5073] close(3 [pid 5070] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5073] <... close resumed>) = 0 [pid 5070] umount2("./7/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] openat(AT_FDCWD, "./7/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5073] rmdir("./10" [pid 5070] <... openat resumed>) = 4 [pid 5073] <... rmdir resumed>) = 0 [pid 5070] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5070] getdents64(4, [pid 5073] mkdir("./11", 0777 [pid 5070] <... getdents64 resumed>0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5073] <... mkdir resumed>) = 0 [pid 5070] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5073] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5070] close(4./strace-static-x86_64: Process 5294 attached ) = 0 [pid 5070] rmdir("./7/file0" [pid 5294] chdir("./11" [pid 5073] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 13 [pid 5294] <... chdir resumed>) = 0 [pid 5294] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5070] <... rmdir resumed>) = 0 [pid 5070] umount2("./7/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5294] <... prctl resumed>) = 0 [pid 5294] setpgid(0, 0 [pid 5070] lstat("./7/cgroup.cpu", [pid 5294] <... setpgid resumed>) = 0 [pid 5294] symlink("/syzcgroup/unified/syz4", "./cgroup" [ 109.349769][ T5282] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000008 [ 109.357768][ T5282] [ 109.368263][ T5282] memory: usage 12kB, limit 0kB, failcnt 55 [ 109.374205][ T5282] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 109.416430][ T5282] Memory cgroup stats for /syz1: [ 109.432210][ T5282] anon 0 [ 109.432210][ T5282] file 0 [ 109.432210][ T5282] kernel 12288 [ 109.432210][ T5282] kernel_stack 0 [ 109.432210][ T5282] pagetables 0 [ 109.432210][ T5282] sec_pagetables 0 [ 109.432210][ T5282] percpu 0 [ 109.432210][ T5282] sock 0 [ 109.432210][ T5282] vmalloc 0 [ 109.432210][ T5282] shmem 0 [ 109.432210][ T5282] zswap 0 [ 109.432210][ T5282] zswapped 0 [ 109.432210][ T5282] file_mapped 0 [ 109.432210][ T5282] file_dirty 0 [pid 5070] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5294] <... symlink resumed>) = 0 [pid 5070] unlink("./7/cgroup.cpu" [pid 5294] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 5070] <... unlink resumed>) = 0 [pid 5294] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [pid 5294] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5294] write(3, "1000", 4) = 4 [pid 5294] close(3) = 0 [pid 5294] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5294] mkdir("./file0", 000) = 0 [pid 5294] open("./file0", O_RDONLY [pid 5070] getdents64(3, [pid 5294] <... open resumed>) = 3 [pid 5070] <... getdents64 resumed>0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5294] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5070] close(3 [pid 5294] <... mount resumed>) = 0 [pid 5070] <... close resumed>) = 0 [pid 5294] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5070] rmdir("./7" [pid 5294] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5294] openat(5, "memory.max", O_RDWR [pid 5070] <... rmdir resumed>) = 0 [pid 5294] <... openat resumed>) = 6 [pid 5070] mkdir("./8", 0777 [pid 5294] write(6, "0x000000000000040e", 18 [pid 5070] <... mkdir resumed>) = 0 [pid 5070] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5296 attached [pid 5296] chdir("./8" [pid 5070] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 10 [pid 5296] <... chdir resumed>) = 0 [pid 5296] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5296] setpgid(0, 0) = 0 [ 109.432210][ T5282] file_writeback 0 [ 109.432210][ T5282] swapcached 0 [ 109.432210][ T5282] anon_thp 0 [ 109.432210][ T5282] file_thp 0 [ 109.432210][ T5282] shmem_thp 0 [ 109.432210][ T5282] inactive_anon 0 [ 109.432210][ T5282] active_anon 0 [ 109.432210][ T5282] inactive_file 0 [ 109.432210][ T5282] active_file 0 [ 109.432210][ T5282] unevictable 0 [ 109.432210][ T5282] slab_reclaimable 9328 [ 109.432210][ T5282] slab_unreclaimable 0 [ 109.432210][ T5282] slab 9328 [ 109.432210][ T5282] workingset_refault_anon 0 [pid 5296] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 5296] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 5296] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 5296] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5296] write(3, "1000", 4) = 4 [pid 5296] close(3) = 0 [pid 5296] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5296] mkdir("./file0", 000) = 0 [pid 5296] open("./file0", O_RDONLY) = 3 [pid 5296] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5296] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5296] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5296] openat(5, "memory.max", O_RDWR) = 6 [ 109.594104][ T5282] Tasks state (memory values in pages): [ 109.602150][ T5282] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5296] write(6, "0x000000000000040e", 18 [pid 5282] <... write resumed>) = 18 [pid 5282] close(3) = 0 [ 109.639569][ T5282] Out of memory and no killable processes... [ 109.645667][ T5284] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 109.673651][ T5284] CPU: 0 PID: 5284 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 109.684145][ T5284] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 109.694241][ T5284] Call Trace: [ 109.697566][ T5284] [ 109.700537][ T5284] dump_stack_lvl+0x1e7/0x2d0 [ 109.705276][ T5284] ? nf_tcp_handle_invalid+0x640/0x640 [ 109.710790][ T5284] ? panic+0x770/0x770 [ 109.714921][ T5284] dump_header+0xdc/0x940 [ 109.719303][ T5284] out_of_memory+0xf21/0x12c0 [ 109.724045][ T5284] ? mutex_lock_io_nested+0x60/0x60 [ 109.729310][ T5284] ? mark_lock+0x9a/0x340 [ 109.733690][ T5284] ? unregister_oom_notifier+0x20/0x20 [ 109.739201][ T5284] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 109.745250][ T5284] mem_cgroup_out_of_memory+0x263/0x3b0 [ 109.750854][ T5284] ? mem_cgroup_oom_trylock+0x210/0x210 [ 109.756471][ T5284] ? cgroup_file_notify+0x127/0x190 [ 109.761728][ T5284] memory_max_write+0x355/0x470 [ 109.766643][ T5284] ? memory_max_show+0xa0/0xa0 [ 109.771461][ T5284] ? read_lock_is_recursive+0x20/0x20 [ 109.776885][ T5284] ? memory_max_show+0xa0/0xa0 [ 109.781700][ T5284] cgroup_file_write+0x2b1/0x780 [ 109.786702][ T5284] ? cgroup_seqfile_stop+0xd0/0xd0 [ 109.791862][ T5284] ? __virt_addr_valid+0x22f/0x2e0 [ 109.797045][ T5284] ? cgroup_seqfile_stop+0xd0/0xd0 [ 109.802197][ T5284] kernfs_fop_write_iter+0x3a6/0x4f0 [ 109.807537][ T5284] vfs_write+0x7b2/0xbb0 [ 109.811834][ T5284] ? file_end_write+0x240/0x240 [ 109.816745][ T5284] ? do_raw_spin_unlock+0x13b/0x8b0 [ 109.821998][ T5284] ? lockdep_hardirqs_on+0x98/0x140 [ 109.827272][ T5284] ? __fdget_pos+0x265/0x2f0 [ 109.831918][ T5284] ksys_write+0x1a0/0x2c0 [ 109.836327][ T5284] ? __ia32_sys_read+0x90/0x90 [ 109.841142][ T5284] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 109.848293][ T5284] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 109.854426][ T5284] do_syscall_64+0x41/0xc0 [ 109.858898][ T5284] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 109.864852][ T5284] RIP: 0033:0x7fd49ce20129 [ 109.869304][ T5284] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 5282] close(4) = 0 [pid 5282] close(5) = 0 [pid 5282] close(6) = 0 [pid 5282] close(7) = -1 EBADF (Bad file descriptor) [pid 5282] close(8) = -1 EBADF (Bad file descriptor) [pid 5282] close(9) = -1 EBADF (Bad file descriptor) [pid 5282] close(10) = -1 EBADF (Bad file descriptor) [pid 5282] close(11) = -1 EBADF (Bad file descriptor) [pid 5282] close(12) = -1 EBADF (Bad file descriptor) [pid 5282] close(13) = -1 EBADF (Bad file descriptor) [pid 5282] close(14) = -1 EBADF (Bad file descriptor) [pid 5282] close(15) = -1 EBADF (Bad file descriptor) [pid 5282] close(16) = -1 EBADF (Bad file descriptor) [pid 5282] close(17) = -1 EBADF (Bad file descriptor) [pid 5282] close(18) = -1 EBADF (Bad file descriptor) [pid 5282] close(19) = -1 EBADF (Bad file descriptor) [pid 5282] close(20) = -1 EBADF (Bad file descriptor) [pid 5282] close(21) = -1 EBADF (Bad file descriptor) [pid 5282] close(22) = -1 EBADF (Bad file descriptor) [pid 5282] close(23) = -1 EBADF (Bad file descriptor) [pid 5282] close(24) = -1 EBADF (Bad file descriptor) [pid 5282] close(25) = -1 EBADF (Bad file descriptor) [pid 5282] close(26) = -1 EBADF (Bad file descriptor) [pid 5282] close(27) = -1 EBADF (Bad file descriptor) [pid 5282] close(28) = -1 EBADF (Bad file descriptor) [pid 5282] close(29) = -1 EBADF (Bad file descriptor) [pid 5282] exit_group(0) = ? [pid 5282] +++ exited with 0 +++ [pid 5072] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=10, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- [pid 5072] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5072] umount2("./8", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5072] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5072] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5072] umount2("./8/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./8/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5072] unlink("./8/binderfs") = 0 [pid 5072] umount2("./8/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./8/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5072] unlink("./8/cgroup") = 0 [pid 5072] umount2("./8/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./8/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5072] unlink("./8/cgroup.net") = 0 [ 109.888958][ T5284] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 109.897439][ T5284] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 109.905466][ T5284] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 109.913484][ T5284] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 109.921489][ T5284] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 109.929517][ T5284] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 000000000000000e [ 109.937552][ T5284] [ 109.951512][ T5284] memory: usage 12kB, limit 0kB, failcnt 55 [ 109.960030][ T5284] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 109.967247][ T5284] Memory cgroup stats for /syz1: [ 109.967464][ T5284] anon 0 [ 109.967464][ T5284] file 0 [ 109.967464][ T5284] kernel 12288 [ 109.967464][ T5284] kernel_stack 0 [ 109.967464][ T5284] pagetables 0 [ 109.967464][ T5284] sec_pagetables 0 [ 109.967464][ T5284] percpu 0 [ 109.967464][ T5284] sock 0 [ 109.967464][ T5284] vmalloc 0 [ 109.967464][ T5284] shmem 0 [ 109.967464][ T5284] zswap 0 [ 109.967464][ T5284] zswapped 0 [ 109.967464][ T5284] file_mapped 0 [ 109.967464][ T5284] file_dirty 0 [ 109.967464][ T5284] file_writeback 0 [ 109.967464][ T5284] swapcached 0 [ 109.967464][ T5284] anon_thp 0 [ 109.967464][ T5284] file_thp 0 [ 109.967464][ T5284] shmem_thp 0 [ 109.967464][ T5284] inactive_anon 0 [ 109.967464][ T5284] active_anon 0 [ 109.967464][ T5284] inactive_file 0 [ 109.967464][ T5284] active_file 0 [ 109.967464][ T5284] unevictable 0 [ 109.967464][ T5284] slab_reclaimable 9328 [pid 5072] umount2("./8/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5072] umount2("./8/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./8/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5072] umount2("./8/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] openat(AT_FDCWD, "./8/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5072] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5072] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5072] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5072] close(4) = 0 [pid 5072] rmdir("./8/file0") = 0 [pid 5072] umount2("./8/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./8/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5072] unlink("./8/cgroup.cpu") = 0 [pid 5072] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5072] close(3) = 0 [pid 5072] rmdir("./8") = 0 [pid 5072] mkdir("./9", 0777) = 0 [pid 5072] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555574ac5d0) = 11 ./strace-static-x86_64: Process 5308 attached [pid 5308] chdir("./9") = 0 [pid 5308] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5308] setpgid(0, 0) = 0 [pid 5308] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 5308] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [ 109.967464][ T5284] slab_unreclaimable 0 [ 109.967464][ T5284] slab 9328 [ 109.967464][ T5284] workingset_refault_anon 0 [ 110.075869][ T5284] Tasks state (memory values in pages): [ 110.086090][ T5284] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5308] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 5308] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5284] <... write resumed>) = 18 [pid 5308] <... openat resumed>) = 3 [ 110.100318][ T5284] Out of memory and no killable processes... [ 110.106742][ T5287] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 110.119603][ T5287] CPU: 1 PID: 5287 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 110.130080][ T5287] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 110.140180][ T5287] Call Trace: [ 110.143500][ T5287] [ 110.146468][ T5287] dump_stack_lvl+0x1e7/0x2d0 [ 110.151206][ T5287] ? nf_tcp_handle_invalid+0x640/0x640 [ 110.156718][ T5287] ? panic+0x770/0x770 [ 110.160883][ T5287] dump_header+0xdc/0x940 [ 110.165272][ T5287] out_of_memory+0xf21/0x12c0 [ 110.170003][ T5287] ? mutex_lock_io_nested+0x60/0x60 [ 110.175264][ T5287] ? preempt_schedule+0xdd/0xf0 [ 110.180165][ T5287] ? unregister_oom_notifier+0x20/0x20 [ 110.185674][ T5287] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 110.191723][ T5287] mem_cgroup_out_of_memory+0x263/0x3b0 [ 110.197329][ T5287] ? preempt_schedule_thunk+0x1a/0x20 [ 110.202775][ T5287] ? mem_cgroup_oom_trylock+0x210/0x210 [ 110.208396][ T5287] ? cgroup_file_notify+0x127/0x190 [ 110.213631][ T5287] memory_max_write+0x355/0x470 [ 110.218518][ T5287] ? memory_max_show+0xa0/0xa0 [ 110.223308][ T5287] ? read_lock_is_recursive+0x20/0x20 [ 110.228706][ T5287] ? memory_max_show+0xa0/0xa0 [ 110.233487][ T5287] cgroup_file_write+0x2b1/0x780 [ 110.238449][ T5287] ? cgroup_seqfile_stop+0xd0/0xd0 [ 110.243575][ T5287] ? __virt_addr_valid+0x22f/0x2e0 [ 110.248754][ T5287] ? cgroup_seqfile_stop+0xd0/0xd0 [ 110.253898][ T5287] kernfs_fop_write_iter+0x3a6/0x4f0 [ 110.259221][ T5287] vfs_write+0x7b2/0xbb0 [ 110.263498][ T5287] ? file_end_write+0x240/0x240 [ 110.268375][ T5287] ? do_raw_spin_unlock+0x13b/0x8b0 [ 110.273595][ T5287] ? lockdep_hardirqs_on+0x98/0x140 [ 110.278821][ T5287] ? __fdget_pos+0x265/0x2f0 [ 110.283436][ T5287] ksys_write+0x1a0/0x2c0 [ 110.287794][ T5287] ? __ia32_sys_read+0x90/0x90 [ 110.292610][ T5287] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 110.298630][ T5287] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 110.304648][ T5287] do_syscall_64+0x41/0xc0 [ 110.309093][ T5287] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 110.315012][ T5287] RIP: 0033:0x7fd49ce20129 [ 110.319442][ T5287] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 110.339080][ T5287] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 5308] write(3, "1000", 4 [pid 5284] close(3 [pid 5308] <... write resumed>) = 4 [pid 5284] <... close resumed>) = 0 [pid 5308] close(3 [pid 5284] close(4 [pid 5308] <... close resumed>) = 0 [pid 5284] <... close resumed>) = 0 [pid 5308] symlink("/dev/binderfs", "./binderfs" [pid 5284] close(5 [pid 5308] <... symlink resumed>) = 0 [pid 5284] <... close resumed>) = 0 [pid 5284] close(6) = 0 [pid 5284] close(7 [pid 5308] mkdir("./file0", 000 [pid 5284] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5284] close(8) = -1 EBADF (Bad file descriptor) [pid 5284] close(9) = -1 EBADF (Bad file descriptor) [pid 5284] close(10) = -1 EBADF (Bad file descriptor) [pid 5284] close(11) = -1 EBADF (Bad file descriptor) [pid 5284] close(12) = -1 EBADF (Bad file descriptor) [pid 5284] close(13 [pid 5308] <... mkdir resumed>) = 0 [pid 5284] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5308] open("./file0", O_RDONLY [pid 5284] close(14) = -1 EBADF (Bad file descriptor) [pid 5308] <... open resumed>) = 3 [pid 5284] close(15 [pid 5308] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5284] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5284] close(16) = -1 EBADF (Bad file descriptor) [pid 5308] <... mount resumed>) = 0 [pid 5284] close(17 [pid 5308] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5284] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5284] close(18 [pid 5308] <... openat resumed>) = 4 [pid 5284] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5284] close(19 [pid 5308] openat(4, "syz1", O_RDWR|O_PATH [pid 5284] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5308] <... openat resumed>) = 5 [pid 5284] close(20 [pid 5308] openat(5, "memory.max", O_RDWR [ 110.347521][ T5287] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 110.355507][ T5287] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 110.363496][ T5287] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 110.371499][ T5287] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 110.379488][ T5287] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 000000000000000e [ 110.387537][ T5287] [pid 5284] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5308] <... openat resumed>) = 6 [pid 5284] close(21 [pid 5308] write(6, "0x000000000000040e", 18 [pid 5284] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5284] close(22) = -1 EBADF (Bad file descriptor) [pid 5284] close(23) = -1 EBADF (Bad file descriptor) [pid 5284] close(24) = -1 EBADF (Bad file descriptor) [pid 5284] close(25) = -1 EBADF (Bad file descriptor) [pid 5284] close(26) = -1 EBADF (Bad file descriptor) [pid 5284] close(27) = -1 EBADF (Bad file descriptor) [pid 5284] close(28) = -1 EBADF (Bad file descriptor) [pid 5284] close(29) = -1 EBADF (Bad file descriptor) [pid 5284] exit_group(0) = ? [pid 5284] +++ exited with 0 +++ [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=16, si_uid=0, si_status=0, si_utime=0, si_stime=9 /* 0.09 s */} --- [pid 5074] umount2("./14", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5074] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5074] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5074] umount2("./14/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 110.434905][ T5287] memory: usage 12kB, limit 0kB, failcnt 55 [pid 5074] lstat("./14/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5074] unlink("./14/binderfs") = 0 [pid 5074] umount2("./14/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./14/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5074] unlink("./14/cgroup") = 0 [pid 5074] umount2("./14/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./14/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5074] unlink("./14/cgroup.net") = 0 [pid 5074] umount2("./14/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5074] umount2("./14/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./14/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5074] umount2("./14/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] openat(AT_FDCWD, "./14/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5074] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5074] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5074] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5074] close(4) = 0 [pid 5074] rmdir("./14/file0") = 0 [pid 5074] umount2("./14/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./14/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5074] unlink("./14/cgroup.cpu") = 0 [pid 5074] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5074] close(3) = 0 [pid 5074] rmdir("./14") = 0 [pid 5074] mkdir("./15", 0777) = 0 [ 110.478260][ T5287] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 110.494710][ T5287] Memory cgroup stats for /syz1: [ 110.494874][ T5287] anon 0 [ 110.494874][ T5287] file 0 [ 110.494874][ T5287] kernel 12288 [ 110.494874][ T5287] kernel_stack 0 [ 110.494874][ T5287] pagetables 0 [ 110.494874][ T5287] sec_pagetables 0 [ 110.494874][ T5287] percpu 0 [ 110.494874][ T5287] sock 0 [ 110.494874][ T5287] vmalloc 0 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5311 attached [pid 5311] chdir("./15" [pid 5074] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 17 [pid 5311] <... chdir resumed>) = 0 [pid 5311] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5311] setpgid(0, 0) = 0 [pid 5311] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [ 110.494874][ T5287] shmem 0 [ 110.494874][ T5287] zswap 0 [ 110.494874][ T5287] zswapped 0 [ 110.494874][ T5287] file_mapped 0 [ 110.494874][ T5287] file_dirty 0 [ 110.494874][ T5287] file_writeback 0 [ 110.494874][ T5287] swapcached 0 [ 110.494874][ T5287] anon_thp 0 [ 110.494874][ T5287] file_thp 0 [ 110.494874][ T5287] shmem_thp 0 [ 110.494874][ T5287] inactive_anon 0 [ 110.494874][ T5287] active_anon 0 [ 110.494874][ T5287] inactive_file 0 [ 110.494874][ T5287] active_file 0 [ 110.494874][ T5287] unevictable 0 [pid 5311] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 5311] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 5311] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5311] write(3, "1000", 4) = 4 [pid 5311] close(3) = 0 [pid 5311] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5311] mkdir("./file0", 000) = 0 [pid 5311] open("./file0", O_RDONLY) = 3 [pid 5311] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5311] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5311] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5311] openat(5, "memory.max", O_RDWR) = 6 [ 110.494874][ T5287] slab_reclaimable 9328 [ 110.494874][ T5287] slab_unreclaimable 0 [ 110.494874][ T5287] slab 9328 [ 110.494874][ T5287] workingset_refault_anon 0 [ 110.605219][ T5287] Tasks state (memory values in pages): [ 110.618251][ T5287] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5311] write(6, "0x000000000000040e", 18 [pid 5287] <... write resumed>) = 18 [pid 5287] close(3) = 0 [pid 5287] close(4) = 0 [ 110.637245][ T5287] Out of memory and no killable processes... [ 110.643620][ T5294] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 110.664922][ T5294] CPU: 1 PID: 5294 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 110.675416][ T5294] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 110.685517][ T5294] Call Trace: [ 110.688835][ T5294] [ 110.691814][ T5294] dump_stack_lvl+0x1e7/0x2d0 [ 110.696557][ T5294] ? nf_tcp_handle_invalid+0x640/0x640 [ 110.702050][ T5294] ? panic+0x770/0x770 [ 110.706133][ T5294] ? lockdep_hardirqs_on+0x98/0x140 [ 110.711378][ T5294] dump_header+0xdc/0x940 [ 110.715734][ T5294] out_of_memory+0xf21/0x12c0 [ 110.720461][ T5294] ? mutex_lock_io_nested+0x60/0x60 [ 110.725703][ T5294] ? preempt_schedule+0xdd/0xf0 [ 110.730573][ T5294] ? unregister_oom_notifier+0x20/0x20 [ 110.736050][ T5294] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 110.742058][ T5294] mem_cgroup_out_of_memory+0x263/0x3b0 [ 110.747625][ T5294] ? preempt_schedule_thunk+0x1a/0x20 [ 110.753016][ T5294] ? mem_cgroup_oom_trylock+0x210/0x210 [ 110.758592][ T5294] ? cgroup_file_notify+0x127/0x190 [ 110.763810][ T5294] memory_max_write+0x355/0x470 [ 110.768692][ T5294] ? memory_max_show+0xa0/0xa0 [ 110.773477][ T5294] ? read_lock_is_recursive+0x20/0x20 [ 110.778874][ T5294] ? memory_max_show+0xa0/0xa0 [ 110.783659][ T5294] cgroup_file_write+0x2b1/0x780 [ 110.788617][ T5294] ? cgroup_seqfile_stop+0xd0/0xd0 [ 110.793738][ T5294] ? __virt_addr_valid+0x22f/0x2e0 [ 110.798877][ T5294] ? cgroup_seqfile_stop+0xd0/0xd0 [ 110.803997][ T5294] kernfs_fop_write_iter+0x3a6/0x4f0 [ 110.809304][ T5294] vfs_write+0x7b2/0xbb0 [ 110.813570][ T5294] ? file_end_write+0x240/0x240 [ 110.818437][ T5294] ? do_raw_spin_unlock+0x13b/0x8b0 [ 110.823668][ T5294] ? lockdep_hardirqs_on+0x98/0x140 [ 110.828889][ T5294] ? __fdget_pos+0x265/0x2f0 [ 110.833496][ T5294] ksys_write+0x1a0/0x2c0 [ 110.837847][ T5294] ? __ia32_sys_read+0x90/0x90 [ 110.842626][ T5294] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 110.848632][ T5294] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 110.854634][ T5294] do_syscall_64+0x41/0xc0 [ 110.859070][ T5294] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 110.864998][ T5294] RIP: 0033:0x7fd49ce20129 [ 110.869429][ T5294] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 110.889042][ T5294] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 110.897471][ T5294] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 110.905494][ T5294] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 110.913502][ T5294] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 110.921499][ T5294] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 110.929492][ T5294] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 000000000000000b [pid 5287] close(5) = 0 [pid 5287] close(6) = 0 [pid 5287] close(7) = -1 EBADF (Bad file descriptor) [pid 5287] close(8) = -1 EBADF (Bad file descriptor) [pid 5287] close(9) = -1 EBADF (Bad file descriptor) [pid 5287] close(10) = -1 EBADF (Bad file descriptor) [pid 5287] close(11) = -1 EBADF (Bad file descriptor) [pid 5287] close(12) = -1 EBADF (Bad file descriptor) [pid 5287] close(13) = -1 EBADF (Bad file descriptor) [ 110.937505][ T5294] [ 110.944424][ T5294] memory: usage 12kB, limit 0kB, failcnt 55 [ 110.950542][ T5294] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 110.958906][ T5294] Memory cgroup stats for /syz1: [ 110.959121][ T5294] anon 0 [ 110.959121][ T5294] file 0 [ 110.959121][ T5294] kernel 12288 [ 110.959121][ T5294] kernel_stack 0 [ 110.959121][ T5294] pagetables 0 [ 110.959121][ T5294] sec_pagetables 0 [ 110.959121][ T5294] percpu 0 [ 110.959121][ T5294] sock 0 [ 110.959121][ T5294] vmalloc 0 [ 110.959121][ T5294] shmem 0 [ 110.959121][ T5294] zswap 0 [ 110.959121][ T5294] zswapped 0 [ 110.959121][ T5294] file_mapped 0 [ 110.959121][ T5294] file_dirty 0 [ 110.959121][ T5294] file_writeback 0 [ 110.959121][ T5294] swapcached 0 [ 110.959121][ T5294] anon_thp 0 [ 110.959121][ T5294] file_thp 0 [ 110.959121][ T5294] shmem_thp 0 [ 110.959121][ T5294] inactive_anon 0 [ 110.959121][ T5294] active_anon 0 [ 110.959121][ T5294] inactive_file 0 [ 110.959121][ T5294] active_file 0 [pid 5287] close(14) = -1 EBADF (Bad file descriptor) [pid 5287] close(15) = -1 EBADF (Bad file descriptor) [pid 5287] close(16) = -1 EBADF (Bad file descriptor) [pid 5287] close(17) = -1 EBADF (Bad file descriptor) [pid 5287] close(18) = -1 EBADF (Bad file descriptor) [pid 5287] close(19) = -1 EBADF (Bad file descriptor) [pid 5287] close(20) = -1 EBADF (Bad file descriptor) [pid 5287] close(21) = -1 EBADF (Bad file descriptor) [pid 5287] close(22) = -1 EBADF (Bad file descriptor) [pid 5287] close(23) = -1 EBADF (Bad file descriptor) [pid 5287] close(24) = -1 EBADF (Bad file descriptor) [pid 5287] close(25) = -1 EBADF (Bad file descriptor) [pid 5287] close(26) = -1 EBADF (Bad file descriptor) [pid 5287] close(27) = -1 EBADF (Bad file descriptor) [pid 5287] close(28) = -1 EBADF (Bad file descriptor) [pid 5287] close(29) = -1 EBADF (Bad file descriptor) [pid 5287] exit_group(0) = ? [pid 5287] +++ exited with 0 +++ [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=16, si_uid=0, si_status=0, si_utime=0, si_stime=11 /* 0.11 s */} --- [ 110.959121][ T5294] unevictable 0 [ 110.959121][ T5294] slab_reclaimable 9328 [ 110.959121][ T5294] slab_unreclaimable 0 [ 110.959121][ T5294] slab 9328 [ 110.959121][ T5294] workingset_refault_anon 0 [ 111.059411][ T5294] Tasks state (memory values in pages): [ 111.065090][ T5294] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 111.075285][ T5294] Out of memory and no killable processes... [pid 5075] umount2("./14", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [ 111.082297][ T5296] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 111.094147][ T5296] CPU: 0 PID: 5296 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 111.104701][ T5296] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 111.114794][ T5296] Call Trace: [ 111.118107][ T5296] [ 111.121070][ T5296] dump_stack_lvl+0x1e7/0x2d0 [ 111.125803][ T5296] ? nf_tcp_handle_invalid+0x640/0x640 [ 111.131338][ T5296] ? panic+0x770/0x770 [ 111.135465][ T5296] dump_header+0xdc/0x940 [ 111.139836][ T5296] out_of_memory+0xf21/0x12c0 [ 111.144563][ T5296] ? mutex_lock_io_nested+0x60/0x60 [ 111.149814][ T5296] ? mark_lock+0x9a/0x340 [ 111.154180][ T5296] ? unregister_oom_notifier+0x20/0x20 [ 111.159687][ T5296] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 111.165752][ T5296] mem_cgroup_out_of_memory+0x263/0x3b0 [ 111.171365][ T5296] ? mem_cgroup_oom_trylock+0x210/0x210 [ 111.176985][ T5296] ? cgroup_file_notify+0x10a/0x190 [ 111.182271][ T5296] memory_max_write+0x355/0x470 [ 111.187193][ T5296] ? memory_max_show+0xa0/0xa0 [ 111.192012][ T5296] ? read_lock_is_recursive+0x20/0x20 [ 111.197433][ T5296] ? memory_max_show+0xa0/0xa0 [ 111.202221][ T5296] cgroup_file_write+0x2b1/0x780 [ 111.207199][ T5296] ? cgroup_seqfile_stop+0xd0/0xd0 [ 111.212322][ T5296] ? __virt_addr_valid+0x22f/0x2e0 [ 111.217465][ T5296] ? cgroup_seqfile_stop+0xd0/0xd0 [ 111.222592][ T5296] kernfs_fop_write_iter+0x3a6/0x4f0 [ 111.227902][ T5296] vfs_write+0x7b2/0xbb0 [ 111.232168][ T5296] ? file_end_write+0x240/0x240 [ 111.237043][ T5296] ? do_raw_spin_unlock+0x13b/0x8b0 [ 111.242268][ T5296] ? lockdep_hardirqs_on+0x98/0x140 [ 111.247496][ T5296] ? __fdget_pos+0x265/0x2f0 [ 111.252108][ T5296] ksys_write+0x1a0/0x2c0 [ 111.256458][ T5296] ? __ia32_sys_read+0x90/0x90 [ 111.261241][ T5296] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 111.267250][ T5296] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 111.273256][ T5296] do_syscall_64+0x41/0xc0 [ 111.277696][ T5296] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 111.283622][ T5296] RIP: 0033:0x7fd49ce20129 [ 111.288049][ T5296] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 111.307686][ T5296] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 111.316113][ T5296] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 111.324094][ T5296] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 111.332076][ T5296] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [pid 5075] fstat(3, [pid 5294] <... write resumed>) = 18 [pid 5075] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5075] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5075] umount2("./14/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./14/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5294] close(3) = 0 [pid 5075] unlink("./14/binderfs") = 0 [pid 5294] close(4 [pid 5075] umount2("./14/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5294] <... close resumed>) = 0 [pid 5294] close(5 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5294] <... close resumed>) = 0 [pid 5075] lstat("./14/cgroup", [pid 5294] close(6) = 0 [pid 5075] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5294] close(7 [pid 5075] unlink("./14/cgroup" [pid 5294] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... unlink resumed>) = 0 [pid 5294] close(8 [pid 5075] umount2("./14/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5294] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5294] close(9 [pid 5075] lstat("./14/cgroup.net", [pid 5294] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5294] close(10 [pid 5075] unlink("./14/cgroup.net" [pid 5294] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... unlink resumed>) = 0 [pid 5294] close(11 [pid 5075] umount2("./14/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5294] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5294] close(12 [pid 5075] <... umount2 resumed>) = 0 [pid 5294] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] umount2("./14/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5294] close(13 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5294] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] lstat("./14/file0", [pid 5294] close(14 [pid 5075] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5294] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] umount2("./14/file0", MNT_DETACH|UMOUNT_NOFOLLOW [ 111.340058][ T5296] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 111.348037][ T5296] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000008 [ 111.356034][ T5296] [pid 5294] close(15 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5294] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5294] close(16 [pid 5075] openat(AT_FDCWD, "./14/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5294] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5294] close(17 [pid 5075] <... openat resumed>) = 4 [pid 5294] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5294] close(18 [pid 5075] fstat(4, [pid 5294] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5294] close(19 [pid 5075] getdents64(4, [pid 5294] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5294] close(20 [pid 5075] <... getdents64 resumed>0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5294] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] getdents64(4, [pid 5294] close(21 [pid 5075] <... getdents64 resumed>0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5294] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] close(4 [pid 5294] close(22 [pid 5075] <... close resumed>) = 0 [pid 5294] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] rmdir("./14/file0" [pid 5294] close(23) = -1 EBADF (Bad file descriptor) [pid 5075] <... rmdir resumed>) = 0 [ 111.389772][ T5296] memory: usage 12kB, limit 0kB, failcnt 55 [ 111.395855][ T5296] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 111.415276][ T5296] Memory cgroup stats for /syz1: [ 111.415501][ T5296] anon 0 [ 111.415501][ T5296] file 0 [ 111.415501][ T5296] kernel 12288 [ 111.415501][ T5296] kernel_stack 0 [ 111.415501][ T5296] pagetables 0 [ 111.415501][ T5296] sec_pagetables 0 [ 111.415501][ T5296] percpu 0 [ 111.415501][ T5296] sock 0 [ 111.415501][ T5296] vmalloc 0 [ 111.415501][ T5296] shmem 0 [ 111.415501][ T5296] zswap 0 [ 111.415501][ T5296] zswapped 0 [ 111.415501][ T5296] file_mapped 0 [ 111.415501][ T5296] file_dirty 0 [ 111.415501][ T5296] file_writeback 0 [ 111.415501][ T5296] swapcached 0 [ 111.415501][ T5296] anon_thp 0 [ 111.415501][ T5296] file_thp 0 [ 111.415501][ T5296] shmem_thp 0 [ 111.415501][ T5296] inactive_anon 0 [ 111.415501][ T5296] active_anon 0 [ 111.415501][ T5296] inactive_file 0 [pid 5294] close(24 [pid 5075] umount2("./14/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5294] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] lstat("./14/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5075] unlink("./14/cgroup.cpu") = 0 [pid 5075] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5075] close(3) = 0 [ 111.415501][ T5296] active_file 0 [ 111.415501][ T5296] unevictable 0 [ 111.415501][ T5296] slab_reclaimable 9328 [ 111.415501][ T5296] slab_unreclaimable 0 [ 111.415501][ T5296] slab 9328 [ 111.415501][ T5296] workingset_refault_anon 0 [ 111.517334][ T5296] Tasks state (memory values in pages): [ 111.522963][ T5296] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5075] rmdir("./14") = 0 [pid 5075] mkdir("./15", 0777) = 0 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5320 attached , child_tidptr=0x5555574ac5d0) = 17 [pid 5320] chdir("./15") = 0 [pid 5320] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5320] setpgid(0, 0) = 0 [pid 5320] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 5320] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu" [pid 5296] <... write resumed>) = 18 [pid 5320] <... symlink resumed>) = 0 [pid 5296] close(3 [pid 5320] symlink("/syzcgroup/net/syz2", "./cgroup.net" [pid 5296] <... close resumed>) = 0 [pid 5294] close(25 [pid 5320] <... symlink resumed>) = 0 [pid 5296] close(4 [pid 5320] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5296] <... close resumed>) = 0 [pid 5320] write(3, "1000", 4 [pid 5296] close(5 [pid 5320] <... write resumed>) = 4 [pid 5296] <... close resumed>) = 0 [pid 5320] close(3 [ 111.537740][ T5296] Out of memory and no killable processes... [ 111.546426][ T5308] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 111.573562][ T5308] CPU: 0 PID: 5308 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [pid 5296] close(6 [pid 5320] <... close resumed>) = 0 [pid 5296] <... close resumed>) = 0 [pid 5320] symlink("/dev/binderfs", "./binderfs" [pid 5296] close(7 [pid 5320] <... symlink resumed>) = 0 [pid 5296] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5320] mkdir("./file0", 000 [pid 5296] close(8 [pid 5320] <... mkdir resumed>) = 0 [pid 5296] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5320] open("./file0", O_RDONLY [pid 5296] close(9 [pid 5320] <... open resumed>) = 3 [pid 5296] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5320] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5296] close(10 [pid 5320] <... mount resumed>) = 0 [pid 5296] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5320] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5296] close(11 [pid 5320] <... openat resumed>) = 4 [pid 5296] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5320] openat(4, "syz1", O_RDWR|O_PATH [pid 5296] close(12 [pid 5320] <... openat resumed>) = 5 [pid 5296] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5320] openat(5, "memory.max", O_RDWR [pid 5296] close(13 [pid 5320] <... openat resumed>) = 6 [pid 5296] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5320] write(6, "0x000000000000040e", 18 [pid 5296] close(14) = -1 EBADF (Bad file descriptor) [pid 5296] close(15) = -1 EBADF (Bad file descriptor) [pid 5296] close(16) = -1 EBADF (Bad file descriptor) [pid 5296] close(17) = -1 EBADF (Bad file descriptor) [pid 5296] close(18) = -1 EBADF (Bad file descriptor) [pid 5296] close(19) = -1 EBADF (Bad file descriptor) [pid 5296] close(20) = -1 EBADF (Bad file descriptor) [pid 5296] close(21) = -1 EBADF (Bad file descriptor) [pid 5296] close(22) = -1 EBADF (Bad file descriptor) [pid 5296] close(23) = -1 EBADF (Bad file descriptor) [pid 5296] close(24) = -1 EBADF (Bad file descriptor) [pid 5296] close(25) = -1 EBADF (Bad file descriptor) [pid 5296] close(26) = -1 EBADF (Bad file descriptor) [pid 5296] close(27) = -1 EBADF (Bad file descriptor) [pid 5296] close(28) = -1 EBADF (Bad file descriptor) [pid 5296] close(29) = -1 EBADF (Bad file descriptor) [pid 5296] exit_group(0) = ? [pid 5296] +++ exited with 0 +++ [pid 5070] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=10, si_uid=0, si_status=0, si_utime=0, si_stime=7 /* 0.07 s */} --- [pid 5070] umount2("./8", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5070] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5070] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5070] umount2("./8/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./8/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [ 111.584065][ T5308] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 111.594172][ T5308] Call Trace: [ 111.597497][ T5308] [ 111.600473][ T5308] dump_stack_lvl+0x1e7/0x2d0 [ 111.605220][ T5308] ? nf_tcp_handle_invalid+0x640/0x640 [ 111.610736][ T5308] ? panic+0x770/0x770 [ 111.614883][ T5308] dump_header+0xdc/0x940 [ 111.619276][ T5308] out_of_memory+0xf21/0x12c0 [ 111.624013][ T5308] ? mutex_lock_io_nested+0x60/0x60 [ 111.629272][ T5308] ? preempt_schedule+0xdd/0xf0 [ 111.634174][ T5308] ? unregister_oom_notifier+0x20/0x20 [pid 5070] unlink("./8/binderfs") = 0 [pid 5070] umount2("./8/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./8/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5070] unlink("./8/cgroup") = 0 [pid 5070] umount2("./8/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./8/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5070] unlink("./8/cgroup.net") = 0 [ 111.639690][ T5308] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 111.645753][ T5308] mem_cgroup_out_of_memory+0x263/0x3b0 [ 111.651456][ T5308] ? preempt_schedule_thunk+0x1a/0x20 [ 111.657049][ T5308] ? mem_cgroup_oom_trylock+0x210/0x210 [ 111.662672][ T5308] ? cgroup_file_notify+0x127/0x190 [ 111.667946][ T5308] memory_max_write+0x355/0x470 [ 111.672865][ T5308] ? memory_max_show+0xa0/0xa0 [ 111.677691][ T5308] ? read_lock_is_recursive+0x20/0x20 [ 111.683121][ T5308] ? memory_max_show+0xa0/0xa0 [ 111.687934][ T5308] cgroup_file_write+0x2b1/0x780 [ 111.692930][ T5308] ? cgroup_seqfile_stop+0xd0/0xd0 [ 111.698087][ T5308] ? __virt_addr_valid+0x22f/0x2e0 [ 111.703269][ T5308] ? cgroup_seqfile_stop+0xd0/0xd0 [ 111.708423][ T5308] kernfs_fop_write_iter+0x3a6/0x4f0 [ 111.713774][ T5308] vfs_write+0x7b2/0xbb0 [ 111.718087][ T5308] ? file_end_write+0x240/0x240 [ 111.722993][ T5308] ? do_raw_spin_unlock+0x13b/0x8b0 [ 111.728244][ T5308] ? lockdep_hardirqs_on+0x98/0x140 [ 111.733520][ T5308] ? __fdget_pos+0x265/0x2f0 [pid 5070] umount2("./8/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5294] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5294] close(26) = -1 EBADF (Bad file descriptor) [pid 5294] close(27) = -1 EBADF (Bad file descriptor) [pid 5294] close(28) = -1 EBADF (Bad file descriptor) [pid 5294] close(29) = -1 EBADF (Bad file descriptor) [pid 5294] exit_group(0) = ? [pid 5294] +++ exited with 0 +++ [pid 5073] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=13, si_uid=0, si_status=0, si_utime=0, si_stime=10 /* 0.10 s */} --- [pid 5073] umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5073] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5073] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5073] umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 111.738255][ T5308] ksys_write+0x1a0/0x2c0 [ 111.742650][ T5308] ? __ia32_sys_read+0x90/0x90 [ 111.747472][ T5308] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 111.753516][ T5308] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 111.759555][ T5308] do_syscall_64+0x41/0xc0 [ 111.764064][ T5308] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 111.770017][ T5308] RIP: 0033:0x7fd49ce20129 [pid 5073] lstat("./11/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5073] unlink("./11/binderfs") = 0 [pid 5073] umount2("./11/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./11/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5073] unlink("./11/cgroup") = 0 [pid 5073] umount2("./11/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./11/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5073] unlink("./11/cgroup.net") = 0 [ 111.774478][ T5308] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 111.794138][ T5308] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 111.802606][ T5308] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 111.810621][ T5308] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 111.818633][ T5308] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 111.826648][ T5308] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [pid 5073] umount2("./11/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5070] <... umount2 resumed>) = 0 [pid 5073] umount2("./11/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5070] umount2("./8/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5073] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5070] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./11/file0", [pid 5070] lstat("./8/file0", [pid 5073] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5070] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5073] umount2("./11/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5070] umount2("./8/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5073] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5070] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5073] openat(AT_FDCWD, "./11/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5070] openat(AT_FDCWD, "./8/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5073] <... openat resumed>) = 4 [pid 5070] <... openat resumed>) = 4 [pid 5073] fstat(4, [pid 5070] fstat(4, [pid 5073] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5070] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5073] getdents64(4, [pid 5070] getdents64(4, [pid 5073] <... getdents64 resumed>0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5070] <... getdents64 resumed>0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5073] getdents64(4, [pid 5070] getdents64(4, [pid 5073] <... getdents64 resumed>0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5070] <... getdents64 resumed>0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5073] close(4 [pid 5070] close(4 [pid 5073] <... close resumed>) = 0 [pid 5070] <... close resumed>) = 0 [ 111.834663][ T5308] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000009 [ 111.842707][ T5308] [pid 5073] rmdir("./11/file0" [pid 5070] rmdir("./8/file0" [pid 5073] <... rmdir resumed>) = 0 [pid 5070] <... rmdir resumed>) = 0 [pid 5073] umount2("./11/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5070] umount2("./8/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5073] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5070] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./11/cgroup.cpu", [pid 5070] lstat("./8/cgroup.cpu", [pid 5073] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5070] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5073] unlink("./11/cgroup.cpu" [pid 5070] unlink("./8/cgroup.cpu" [pid 5073] <... unlink resumed>) = 0 [pid 5070] <... unlink resumed>) = 0 [pid 5073] getdents64(3, [pid 5070] getdents64(3, [pid 5073] <... getdents64 resumed>0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5070] <... getdents64 resumed>0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5073] close(3 [pid 5070] close(3 [pid 5073] <... close resumed>) = 0 [pid 5070] <... close resumed>) = 0 [pid 5073] rmdir("./11" [pid 5070] rmdir("./8" [pid 5073] <... rmdir resumed>) = 0 [pid 5070] <... rmdir resumed>) = 0 [pid 5073] mkdir("./12", 0777 [pid 5070] mkdir("./9", 0777 [pid 5073] <... mkdir resumed>) = 0 [pid 5070] <... mkdir resumed>) = 0 [pid 5073] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5070] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5325 attached ./strace-static-x86_64: Process 5324 attached [pid 5325] chdir("./9" [pid 5324] chdir("./12" [pid 5073] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 14 [pid 5070] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 11 [pid 5325] <... chdir resumed>) = 0 [pid 5324] <... chdir resumed>) = 0 [pid 5325] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5324] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5325] <... prctl resumed>) = 0 [pid 5324] <... prctl resumed>) = 0 [pid 5325] setpgid(0, 0 [pid 5324] setpgid(0, 0 [pid 5325] <... setpgid resumed>) = 0 [pid 5324] <... setpgid resumed>) = 0 [pid 5325] symlink("/syzcgroup/unified/syz0", "./cgroup" [pid 5324] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 5324] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 5325] <... symlink resumed>) = 0 [pid 5324] symlink("/syzcgroup/net/syz4", "./cgroup.net" [pid 5325] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu" [pid 5324] <... symlink resumed>) = 0 [pid 5325] <... symlink resumed>) = 0 [pid 5324] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [ 111.882375][ T5308] memory: usage 12kB, limit 0kB, failcnt 55 [ 111.892945][ T5308] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [pid 5324] write(3, "1000", 4) = 4 [pid 5324] close(3) = 0 [pid 5324] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5324] mkdir("./file0", 000) = 0 [pid 5324] open("./file0", O_RDONLY) = 3 [pid 5324] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5324] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5324] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5324] openat(5, "memory.max", O_RDWR) = 6 [ 111.925509][ T5308] Memory cgroup stats for /syz1: [ 111.925730][ T5308] anon 0 [ 111.925730][ T5308] file 0 [ 111.925730][ T5308] kernel 12288 [ 111.925730][ T5308] kernel_stack 0 [ 111.925730][ T5308] pagetables 0 [ 111.925730][ T5308] sec_pagetables 0 [ 111.925730][ T5308] percpu 0 [ 111.925730][ T5308] sock 0 [ 111.925730][ T5308] vmalloc 0 [ 111.925730][ T5308] shmem 0 [ 111.925730][ T5308] zswap 0 [ 111.925730][ T5308] zswapped 0 [ 111.925730][ T5308] file_mapped 0 [ 111.925730][ T5308] file_dirty 0 [pid 5324] write(6, "0x000000000000040e", 18 [pid 5325] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 5325] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5325] write(3, "1000", 4) = 4 [pid 5325] close(3) = 0 [pid 5325] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5325] mkdir("./file0", 000) = 0 [pid 5325] open("./file0", O_RDONLY) = 3 [pid 5325] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5325] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5325] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5325] openat(5, "memory.max", O_RDWR) = 6 [ 111.925730][ T5308] file_writeback 0 [ 111.925730][ T5308] swapcached 0 [ 111.925730][ T5308] anon_thp 0 [ 111.925730][ T5308] file_thp 0 [ 111.925730][ T5308] shmem_thp 0 [ 111.925730][ T5308] inactive_anon 0 [ 111.925730][ T5308] active_anon 0 [ 111.925730][ T5308] inactive_file 0 [ 111.925730][ T5308] active_file 0 [ 111.925730][ T5308] unevictable 0 [ 111.925730][ T5308] slab_reclaimable 9328 [ 111.925730][ T5308] slab_unreclaimable 0 [ 111.925730][ T5308] slab 9328 [ 111.925730][ T5308] workingset_refault_anon 0 [pid 5325] write(6, "0x000000000000040e", 18 [pid 5308] <... write resumed>) = 18 [pid 5308] close(3) = 0 [pid 5308] close(4) = 0 [pid 5308] close(5) = 0 [pid 5308] close(6) = 0 [pid 5308] close(7) = -1 EBADF (Bad file descriptor) [ 112.061412][ T5308] Tasks state (memory values in pages): [ 112.067772][ T5308] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 112.079490][ T5308] Out of memory and no killable processes... [ 112.087983][ T5311] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5308] close(8) = -1 EBADF (Bad file descriptor) [pid 5308] close(9) = -1 EBADF (Bad file descriptor) [pid 5308] close(10) = -1 EBADF (Bad file descriptor) [pid 5308] close(11) = -1 EBADF (Bad file descriptor) [pid 5308] close(12) = -1 EBADF (Bad file descriptor) [pid 5308] close(13) = -1 EBADF (Bad file descriptor) [pid 5308] close(14) = -1 EBADF (Bad file descriptor) [pid 5308] close(15) = -1 EBADF (Bad file descriptor) [pid 5308] close(16) = -1 EBADF (Bad file descriptor) [pid 5308] close(17) = -1 EBADF (Bad file descriptor) [pid 5308] close(18) = -1 EBADF (Bad file descriptor) [pid 5308] close(19) = -1 EBADF (Bad file descriptor) [pid 5308] close(20) = -1 EBADF (Bad file descriptor) [pid 5308] close(21) = -1 EBADF (Bad file descriptor) [pid 5308] close(22) = -1 EBADF (Bad file descriptor) [pid 5308] close(23) = -1 EBADF (Bad file descriptor) [pid 5308] close(24) = -1 EBADF (Bad file descriptor) [pid 5308] close(25) = -1 EBADF (Bad file descriptor) [pid 5308] close(26) = -1 EBADF (Bad file descriptor) [pid 5308] close(27) = -1 EBADF (Bad file descriptor) [pid 5308] close(28) = -1 EBADF (Bad file descriptor) [pid 5308] close(29) = -1 EBADF (Bad file descriptor) [pid 5308] exit_group(0) = ? [pid 5308] +++ exited with 0 +++ [pid 5072] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=11, si_uid=0, si_status=0, si_utime=0, si_stime=10 /* 0.10 s */} --- [pid 5072] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5072] umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5072] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [ 112.114049][ T5311] CPU: 0 PID: 5311 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 112.124573][ T5311] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 112.134687][ T5311] Call Trace: [ 112.138051][ T5311] [ 112.141027][ T5311] dump_stack_lvl+0x1e7/0x2d0 [ 112.145770][ T5311] ? nf_tcp_handle_invalid+0x640/0x640 [ 112.151298][ T5311] ? panic+0x770/0x770 [ 112.155447][ T5311] dump_header+0xdc/0x940 [ 112.159835][ T5311] out_of_memory+0xf21/0x12c0 [pid 5072] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5072] umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./9/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5072] unlink("./9/binderfs") = 0 [pid 5072] umount2("./9/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./9/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5072] unlink("./9/cgroup") = 0 [pid 5072] umount2("./9/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./9/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5072] unlink("./9/cgroup.net") = 0 [ 112.164581][ T5311] ? mutex_lock_io_nested+0x60/0x60 [ 112.169851][ T5311] ? preempt_schedule+0xdd/0xf0 [ 112.174821][ T5311] ? unregister_oom_notifier+0x20/0x20 [ 112.180340][ T5311] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 112.186406][ T5311] mem_cgroup_out_of_memory+0x263/0x3b0 [ 112.192020][ T5311] ? preempt_schedule_thunk+0x1a/0x20 [ 112.197471][ T5311] ? mem_cgroup_oom_trylock+0x210/0x210 [ 112.203098][ T5311] ? cgroup_file_notify+0x127/0x190 [ 112.208359][ T5311] memory_max_write+0x355/0x470 [ 112.213282][ T5311] ? memory_max_show+0xa0/0xa0 [ 112.218114][ T5311] ? read_lock_is_recursive+0x20/0x20 [ 112.223546][ T5311] ? memory_max_show+0xa0/0xa0 [ 112.228365][ T5311] cgroup_file_write+0x2b1/0x780 [ 112.233361][ T5311] ? cgroup_seqfile_stop+0xd0/0xd0 [ 112.238516][ T5311] ? __virt_addr_valid+0x22f/0x2e0 [ 112.243703][ T5311] ? cgroup_seqfile_stop+0xd0/0xd0 [ 112.248852][ T5311] kernfs_fop_write_iter+0x3a6/0x4f0 [ 112.254198][ T5311] vfs_write+0x7b2/0xbb0 [ 112.258508][ T5311] ? file_end_write+0x240/0x240 [ 112.263413][ T5311] ? do_raw_spin_unlock+0x13b/0x8b0 [ 112.268651][ T5311] ? lockdep_hardirqs_on+0x98/0x140 [ 112.273881][ T5311] ? __fdget_pos+0x265/0x2f0 [ 112.278492][ T5311] ksys_write+0x1a0/0x2c0 [ 112.282844][ T5311] ? __ia32_sys_read+0x90/0x90 [ 112.287624][ T5311] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 112.293632][ T5311] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 112.299636][ T5311] do_syscall_64+0x41/0xc0 [ 112.304071][ T5311] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 112.309985][ T5311] RIP: 0033:0x7fd49ce20129 [ 112.314410][ T5311] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 112.334028][ T5311] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 112.342457][ T5311] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 112.350438][ T5311] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 112.358418][ T5311] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 112.366396][ T5311] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 112.374375][ T5311] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 000000000000000f [ 112.382377][ T5311] [ 112.388805][ T5311] memory: usage 12kB, limit 0kB, failcnt 55 [ 112.394769][ T5311] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 112.401739][ T5311] Memory cgroup stats for /syz1: [ 112.401942][ T5311] anon 0 [ 112.401942][ T5311] file 0 [ 112.401942][ T5311] kernel 12288 [ 112.401942][ T5311] kernel_stack 0 [ 112.401942][ T5311] pagetables 0 [ 112.401942][ T5311] sec_pagetables 0 [ 112.401942][ T5311] percpu 0 [ 112.401942][ T5311] sock 0 [ 112.401942][ T5311] vmalloc 0 [ 112.401942][ T5311] shmem 0 [ 112.401942][ T5311] zswap 0 [ 112.401942][ T5311] zswapped 0 [ 112.401942][ T5311] file_mapped 0 [ 112.401942][ T5311] file_dirty 0 [ 112.401942][ T5311] file_writeback 0 [ 112.401942][ T5311] swapcached 0 [ 112.401942][ T5311] anon_thp 0 [ 112.401942][ T5311] file_thp 0 [ 112.401942][ T5311] shmem_thp 0 [pid 5072] umount2("./9/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5072] umount2("./9/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 112.401942][ T5311] inactive_anon 0 [ 112.401942][ T5311] active_anon 0 [ 112.401942][ T5311] inactive_file 0 [ 112.401942][ T5311] active_file 0 [ 112.401942][ T5311] unevictable 0 [ 112.401942][ T5311] slab_reclaimable 9328 [ 112.401942][ T5311] slab_unreclaimable 0 [ 112.401942][ T5311] slab 9328 [ 112.401942][ T5311] workingset_refault_anon 0 [ 112.505111][ T5311] Tasks state (memory values in pages): [pid 5072] lstat("./9/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5072] umount2("./9/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] openat(AT_FDCWD, "./9/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5072] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5072] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5072] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5072] close(4 [pid 5311] <... write resumed>) = 18 [pid 5072] <... close resumed>) = 0 [ 112.510943][ T5311] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 112.522923][ T5311] Out of memory and no killable processes... [ 112.533878][ T5320] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 112.546902][ T5320] CPU: 1 PID: 5320 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 112.557377][ T5320] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 112.567460][ T5320] Call Trace: [ 112.570761][ T5320] [ 112.573707][ T5320] dump_stack_lvl+0x1e7/0x2d0 [ 112.578420][ T5320] ? nf_tcp_handle_invalid+0x640/0x640 [ 112.583899][ T5320] ? panic+0x770/0x770 [ 112.587997][ T5320] dump_header+0xdc/0x940 [ 112.592348][ T5320] out_of_memory+0xf21/0x12c0 [ 112.597065][ T5320] ? mutex_lock_io_nested+0x60/0x60 [ 112.602291][ T5320] ? preempt_schedule+0xdd/0xf0 [ 112.607165][ T5320] ? unregister_oom_notifier+0x20/0x20 [ 112.612645][ T5320] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 112.618661][ T5320] mem_cgroup_out_of_memory+0x263/0x3b0 [ 112.624234][ T5320] ? preempt_schedule_thunk+0x1a/0x20 [ 112.629633][ T5320] ? mem_cgroup_oom_trylock+0x210/0x210 [ 112.635216][ T5320] ? cgroup_file_notify+0x127/0x190 [ 112.640439][ T5320] memory_max_write+0x355/0x470 [ 112.645312][ T5320] ? memory_max_show+0xa0/0xa0 [ 112.650100][ T5320] ? read_lock_is_recursive+0x20/0x20 [ 112.655493][ T5320] ? memory_max_show+0xa0/0xa0 [ 112.660271][ T5320] cgroup_file_write+0x2b1/0x780 [ 112.665234][ T5320] ? cgroup_seqfile_stop+0xd0/0xd0 [ 112.670370][ T5320] ? __virt_addr_valid+0x22f/0x2e0 [ 112.675507][ T5320] ? cgroup_seqfile_stop+0xd0/0xd0 [ 112.680631][ T5320] kernfs_fop_write_iter+0x3a6/0x4f0 [ 112.685954][ T5320] vfs_write+0x7b2/0xbb0 [ 112.690287][ T5320] ? file_end_write+0x240/0x240 [ 112.695199][ T5320] ? do_raw_spin_unlock+0x13b/0x8b0 [ 112.700428][ T5320] ? lockdep_hardirqs_on+0x98/0x140 [ 112.705660][ T5320] ? __fdget_pos+0x265/0x2f0 [ 112.710277][ T5320] ksys_write+0x1a0/0x2c0 [ 112.714631][ T5320] ? __ia32_sys_read+0x90/0x90 [ 112.719412][ T5320] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 112.725417][ T5320] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 112.731418][ T5320] do_syscall_64+0x41/0xc0 [ 112.735851][ T5320] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 112.741767][ T5320] RIP: 0033:0x7fd49ce20129 [ 112.746195][ T5320] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 5072] rmdir("./9/file0" [pid 5311] close(3) = 0 [pid 5311] close(4 [pid 5072] <... rmdir resumed>) = 0 [pid 5311] <... close resumed>) = 0 [pid 5072] umount2("./9/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5311] close(5 [pid 5072] lstat("./9/cgroup.cpu", [pid 5311] <... close resumed>) = 0 [pid 5072] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5072] unlink("./9/cgroup.cpu" [pid 5311] close(6 [pid 5072] <... unlink resumed>) = 0 [pid 5311] <... close resumed>) = 0 [pid 5072] getdents64(3, [pid 5311] close(7) = -1 EBADF (Bad file descriptor) [pid 5072] <... getdents64 resumed>0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5311] close(8 [pid 5072] close(3 [pid 5311] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5311] close(9 [pid 5072] <... close resumed>) = 0 [pid 5311] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5072] rmdir("./9" [pid 5311] close(10) = -1 EBADF (Bad file descriptor) [ 112.765820][ T5320] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 112.774252][ T5320] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 112.782235][ T5320] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 112.790214][ T5320] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 112.798199][ T5320] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 112.806198][ T5320] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 000000000000000f [ 112.814219][ T5320] [pid 5311] close(11 [pid 5072] <... rmdir resumed>) = 0 [pid 5311] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5072] mkdir("./10", 0777 [pid 5311] close(12) = -1 EBADF (Bad file descriptor) [pid 5311] close(13) = -1 EBADF (Bad file descriptor) [pid 5311] close(14) = -1 EBADF (Bad file descriptor) [pid 5072] <... mkdir resumed>) = 0 [pid 5311] close(15) = -1 EBADF (Bad file descriptor) [pid 5072] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5311] close(16) = -1 EBADF (Bad file descriptor) [pid 5311] close(17) = -1 EBADF (Bad file descriptor) [pid 5311] close(18) = -1 EBADF (Bad file descriptor) ./strace-static-x86_64: Process 5330 attached [pid 5311] close(19 [pid 5072] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 12 [pid 5330] chdir("./10" [pid 5311] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5330] <... chdir resumed>) = 0 [pid 5311] close(20 [pid 5330] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5311] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5330] <... prctl resumed>) = 0 [pid 5311] close(21 [pid 5330] setpgid(0, 0 [pid 5311] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5330] <... setpgid resumed>) = 0 [pid 5311] close(22) = -1 EBADF (Bad file descriptor) [pid 5330] symlink("/syzcgroup/unified/syz5", "./cgroup" [pid 5311] close(23) = -1 EBADF (Bad file descriptor) [pid 5330] <... symlink resumed>) = 0 [pid 5330] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu" [pid 5311] close(24) = -1 EBADF (Bad file descriptor) [pid 5330] <... symlink resumed>) = 0 [pid 5311] close(25 [pid 5330] symlink("/syzcgroup/net/syz5", "./cgroup.net" [pid 5311] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5311] close(26 [pid 5330] <... symlink resumed>) = 0 [pid 5311] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5330] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5311] close(27 [pid 5330] <... openat resumed>) = 3 [pid 5311] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5330] write(3, "1000", 4 [pid 5311] close(28 [pid 5330] <... write resumed>) = 4 [pid 5311] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5330] close(3 [pid 5311] close(29 [pid 5330] <... close resumed>) = 0 [pid 5311] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5330] symlink("/dev/binderfs", "./binderfs" [pid 5311] exit_group(0 [pid 5330] <... symlink resumed>) = 0 [pid 5311] <... exit_group resumed>) = ? [pid 5330] mkdir("./file0", 000 [pid 5311] +++ exited with 0 +++ [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=17, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- [pid 5330] <... mkdir resumed>) = 0 [pid 5330] open("./file0", O_RDONLY) = 3 [pid 5330] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5074] umount2("./15", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5330] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5330] <... openat resumed>) = 4 [pid 5074] openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5330] openat(4, "syz1", O_RDWR|O_PATH [pid 5074] <... openat resumed>) = 3 [pid 5330] <... openat resumed>) = 5 [pid 5074] fstat(3, [pid 5330] openat(5, "memory.max", O_RDWR [pid 5074] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5330] <... openat resumed>) = 6 [pid 5074] getdents64(3, [pid 5330] write(6, "0x000000000000040e", 18 [pid 5074] <... getdents64 resumed>0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5074] umount2("./15/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./15/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5074] unlink("./15/binderfs") = 0 [pid 5074] umount2("./15/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./15/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5074] unlink("./15/cgroup") = 0 [pid 5074] umount2("./15/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./15/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5074] unlink("./15/cgroup.net") = 0 [pid 5074] umount2("./15/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5074] umount2("./15/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./15/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5074] umount2("./15/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] openat(AT_FDCWD, "./15/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5074] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5074] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5074] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5074] close(4) = 0 [pid 5074] rmdir("./15/file0") = 0 [pid 5074] umount2("./15/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./15/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5074] unlink("./15/cgroup.cpu") = 0 [pid 5074] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5074] close(3) = 0 [pid 5074] rmdir("./15") = 0 [pid 5074] mkdir("./16", 0777) = 0 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5333 attached [pid 5333] chdir("./16") = 0 [pid 5074] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 18 [pid 5333] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5333] setpgid(0, 0) = 0 [pid 5333] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [pid 5333] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 5333] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 5333] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5333] write(3, "1000", 4) = 4 [pid 5333] close(3) = 0 [pid 5333] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5333] mkdir("./file0", 000) = 0 [pid 5333] open("./file0", O_RDONLY) = 3 [pid 5333] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5333] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5333] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5333] openat(5, "memory.max", O_RDWR) = 6 [ 112.975611][ T5320] memory: usage 12kB, limit 0kB, failcnt 55 [ 112.988053][ T5320] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 113.014968][ T5320] Memory cgroup stats for /syz1: [ 113.015663][ T5320] anon 0 [ 113.015663][ T5320] file 0 [ 113.015663][ T5320] kernel 12288 [ 113.015663][ T5320] kernel_stack 0 [ 113.015663][ T5320] pagetables 0 [ 113.015663][ T5320] sec_pagetables 0 [ 113.015663][ T5320] percpu 0 [ 113.015663][ T5320] sock 0 [ 113.015663][ T5320] vmalloc 0 [ 113.015663][ T5320] shmem 0 [ 113.015663][ T5320] zswap 0 [ 113.015663][ T5320] zswapped 0 [ 113.015663][ T5320] file_mapped 0 [ 113.015663][ T5320] file_dirty 0 [ 113.015663][ T5320] file_writeback 0 [ 113.015663][ T5320] swapcached 0 [ 113.015663][ T5320] anon_thp 0 [ 113.015663][ T5320] file_thp 0 [ 113.015663][ T5320] shmem_thp 0 [ 113.015663][ T5320] inactive_anon 0 [ 113.015663][ T5320] active_anon 0 [ 113.015663][ T5320] inactive_file 0 [ 113.015663][ T5320] active_file 0 [ 113.015663][ T5320] unevictable 0 [ 113.015663][ T5320] slab_reclaimable 9328 [ 113.015663][ T5320] slab_unreclaimable 0 [ 113.015663][ T5320] slab 9328 [ 113.015663][ T5320] workingset_refault_anon 0 [ 113.148205][ T5320] Tasks state (memory values in pages): [ 113.153916][ T5320] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 113.172507][ T5320] Out of memory and no killable processes... [ 113.180810][ T5324] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 113.199016][ T5324] CPU: 0 PID: 5324 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 113.209504][ T5324] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 113.219611][ T5324] Call Trace: [ 113.222930][ T5324] [ 113.225905][ T5324] dump_stack_lvl+0x1e7/0x2d0 [ 113.230636][ T5324] ? nf_tcp_handle_invalid+0x640/0x640 [ 113.236147][ T5324] ? panic+0x770/0x770 [ 113.240287][ T5324] dump_header+0xdc/0x940 [ 113.244674][ T5324] out_of_memory+0xf21/0x12c0 [pid 5333] write(6, "0x000000000000040e", 18 [pid 5320] <... write resumed>) = 18 [pid 5320] close(3) = 0 [pid 5320] close(4) = 0 [pid 5320] close(5) = 0 [ 113.249411][ T5324] ? mutex_lock_io_nested+0x60/0x60 [ 113.254677][ T5324] ? preempt_schedule+0xdd/0xf0 [ 113.259589][ T5324] ? unregister_oom_notifier+0x20/0x20 [ 113.265097][ T5324] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 113.271153][ T5324] mem_cgroup_out_of_memory+0x263/0x3b0 [ 113.276776][ T5324] ? preempt_schedule_thunk+0x1a/0x20 [ 113.282207][ T5324] ? mem_cgroup_oom_trylock+0x210/0x210 [ 113.287849][ T5324] ? cgroup_file_notify+0x127/0x190 [ 113.293119][ T5324] memory_max_write+0x355/0x470 [pid 5320] close(6) = 0 [pid 5320] close(7) = -1 EBADF (Bad file descriptor) [pid 5320] close(8) = -1 EBADF (Bad file descriptor) [pid 5320] close(9) = -1 EBADF (Bad file descriptor) [pid 5320] close(10) = -1 EBADF (Bad file descriptor) [pid 5320] close(11) = -1 EBADF (Bad file descriptor) [pid 5320] close(12) = -1 EBADF (Bad file descriptor) [pid 5320] close(13) = -1 EBADF (Bad file descriptor) [pid 5320] close(14) = -1 EBADF (Bad file descriptor) [pid 5320] close(15) = -1 EBADF (Bad file descriptor) [pid 5320] close(16) = -1 EBADF (Bad file descriptor) [pid 5320] close(17) = -1 EBADF (Bad file descriptor) [pid 5320] close(18) = -1 EBADF (Bad file descriptor) [pid 5320] close(19) = -1 EBADF (Bad file descriptor) [pid 5320] close(20) = -1 EBADF (Bad file descriptor) [pid 5320] close(21) = -1 EBADF (Bad file descriptor) [pid 5320] close(22) = -1 EBADF (Bad file descriptor) [ 113.298043][ T5324] ? memory_max_show+0xa0/0xa0 [ 113.302878][ T5324] ? read_lock_is_recursive+0x20/0x20 [ 113.308318][ T5324] ? memory_max_show+0xa0/0xa0 [ 113.313138][ T5324] cgroup_file_write+0x2b1/0x780 [ 113.318136][ T5324] ? cgroup_seqfile_stop+0xd0/0xd0 [ 113.323306][ T5324] ? __virt_addr_valid+0x22f/0x2e0 [ 113.328488][ T5324] ? cgroup_seqfile_stop+0xd0/0xd0 [ 113.333644][ T5324] kernfs_fop_write_iter+0x3a6/0x4f0 [ 113.338995][ T5324] vfs_write+0x7b2/0xbb0 [ 113.343313][ T5324] ? file_end_write+0x240/0x240 [pid 5320] close(23) = -1 EBADF (Bad file descriptor) [pid 5320] close(24) = -1 EBADF (Bad file descriptor) [pid 5320] close(25) = -1 EBADF (Bad file descriptor) [pid 5320] close(26) = -1 EBADF (Bad file descriptor) [pid 5320] close(27) = -1 EBADF (Bad file descriptor) [pid 5320] close(28) = -1 EBADF (Bad file descriptor) [pid 5320] close(29) = -1 EBADF (Bad file descriptor) [pid 5320] exit_group(0) = ? [pid 5320] +++ exited with 0 +++ [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=17, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- [pid 5075] umount2("./15", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5075] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5075] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5075] umount2("./15/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./15/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5075] unlink("./15/binderfs") = 0 [pid 5075] umount2("./15/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./15/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5075] unlink("./15/cgroup") = 0 [pid 5075] umount2("./15/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./15/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5075] unlink("./15/cgroup.net") = 0 [ 113.348230][ T5324] ? do_raw_spin_unlock+0x13b/0x8b0 [ 113.353483][ T5324] ? lockdep_hardirqs_on+0x98/0x140 [ 113.358753][ T5324] ? __fdget_pos+0x265/0x2f0 [ 113.363401][ T5324] ksys_write+0x1a0/0x2c0 [ 113.367798][ T5324] ? __ia32_sys_read+0x90/0x90 [ 113.372618][ T5324] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 113.378663][ T5324] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 113.384712][ T5324] do_syscall_64+0x41/0xc0 [ 113.389194][ T5324] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 113.395154][ T5324] RIP: 0033:0x7fd49ce20129 [ 113.399619][ T5324] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 113.419294][ T5324] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 113.427769][ T5324] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 113.435792][ T5324] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [pid 5075] umount2("./15/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5075] umount2("./15/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./15/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5075] umount2("./15/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] openat(AT_FDCWD, "./15/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5075] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5075] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5075] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5075] close(4) = 0 [pid 5075] rmdir("./15/file0") = 0 [pid 5075] umount2("./15/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 113.443813][ T5324] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 113.451830][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 113.459857][ T5324] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 000000000000000c [ 113.467906][ T5324] [ 113.489679][ T5324] memory: usage 12kB, limit 0kB, failcnt 55 [pid 5075] lstat("./15/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5075] unlink("./15/cgroup.cpu") = 0 [pid 5075] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5075] close(3) = 0 [pid 5075] rmdir("./15") = 0 [pid 5075] mkdir("./16", 0777) = 0 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555574ac5d0) = 18 [ 113.495728][ T5324] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 113.510733][ T5324] Memory cgroup stats for /syz1: [ 113.510948][ T5324] anon 0 [ 113.510948][ T5324] file 0 [ 113.510948][ T5324] kernel 12288 [ 113.510948][ T5324] kernel_stack 0 [ 113.510948][ T5324] pagetables 0 [ 113.510948][ T5324] sec_pagetables 0 [ 113.510948][ T5324] percpu 0 [ 113.510948][ T5324] sock 0 [ 113.510948][ T5324] vmalloc 0 [ 113.510948][ T5324] shmem 0 [ 113.510948][ T5324] zswap 0 [ 113.510948][ T5324] zswapped 0 [ 113.510948][ T5324] file_mapped 0 [ 113.510948][ T5324] file_dirty 0 [ 113.510948][ T5324] file_writeback 0 [ 113.510948][ T5324] swapcached 0 [ 113.510948][ T5324] anon_thp 0 [ 113.510948][ T5324] file_thp 0 [ 113.510948][ T5324] shmem_thp 0 [ 113.510948][ T5324] inactive_anon 0 [ 113.510948][ T5324] active_anon 0 [ 113.510948][ T5324] inactive_file 0 [ 113.510948][ T5324] active_file 0 [ 113.510948][ T5324] unevictable 0 [ 113.510948][ T5324] slab_reclaimable 9328 [ 113.510948][ T5324] slab_unreclaimable 0 ./strace-static-x86_64: Process 5339 attached [pid 5339] chdir("./16") = 0 [pid 5339] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5339] setpgid(0, 0) = 0 [pid 5339] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 5339] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 5339] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 5339] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5339] write(3, "1000", 4) = 4 [pid 5339] close(3) = 0 [pid 5339] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5339] mkdir("./file0", 000) = 0 [ 113.510948][ T5324] slab 9328 [ 113.510948][ T5324] workingset_refault_anon 0 [ 113.611531][ T5324] Tasks state (memory values in pages): [ 113.620011][ T5324] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 113.640287][ T5324] Out of memory and no killable processes... [pid 5339] open("./file0", O_RDONLY [pid 5324] <... write resumed>) = 18 [pid 5324] close(3) = 0 [pid 5324] close(4) = 0 [pid 5324] close(5) = 0 [pid 5339] <... open resumed>) = 3 [pid 5324] close(6) = 0 [pid 5324] close(7) = -1 EBADF (Bad file descriptor) [pid 5324] close(8 [pid 5339] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5324] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5339] <... mount resumed>) = 0 [pid 5324] close(9 [pid 5339] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5324] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5339] <... openat resumed>) = 4 [pid 5324] close(10) = -1 EBADF (Bad file descriptor) [pid 5324] close(11) = -1 EBADF (Bad file descriptor) [pid 5324] close(12) = -1 EBADF (Bad file descriptor) [pid 5324] close(13) = -1 EBADF (Bad file descriptor) [pid 5324] close(14) = -1 EBADF (Bad file descriptor) [pid 5324] close(15) = -1 EBADF (Bad file descriptor) [pid 5324] close(16) = -1 EBADF (Bad file descriptor) [pid 5324] close(17) = -1 EBADF (Bad file descriptor) [pid 5324] close(18) = -1 EBADF (Bad file descriptor) [pid 5324] close(19) = -1 EBADF (Bad file descriptor) [ 113.652257][ T5325] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 113.682153][ T5325] CPU: 0 PID: 5325 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 113.692647][ T5325] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [pid 5324] close(20) = -1 EBADF (Bad file descriptor) [pid 5324] close(21) = -1 EBADF (Bad file descriptor) [pid 5324] close(22) = -1 EBADF (Bad file descriptor) [pid 5324] close(23) = -1 EBADF (Bad file descriptor) [pid 5324] close(24) = -1 EBADF (Bad file descriptor) [pid 5324] close(25) = -1 EBADF (Bad file descriptor) [pid 5324] close(26) = -1 EBADF (Bad file descriptor) [pid 5324] close(27) = -1 EBADF (Bad file descriptor) [pid 5324] close(28) = -1 EBADF (Bad file descriptor) [pid 5324] close(29) = -1 EBADF (Bad file descriptor) [pid 5324] exit_group(0) = ? [pid 5324] +++ exited with 0 +++ [pid 5073] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=14, si_uid=0, si_status=0, si_utime=0, si_stime=9 /* 0.09 s */} --- [pid 5073] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5073] umount2("./12", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5073] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5073] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5073] umount2("./12/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./12/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5073] unlink("./12/binderfs") = 0 [pid 5073] umount2("./12/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./12/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5073] unlink("./12/cgroup") = 0 [pid 5073] umount2("./12/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 113.702757][ T5325] Call Trace: [ 113.706087][ T5325] [ 113.709069][ T5325] dump_stack_lvl+0x1e7/0x2d0 [ 113.713813][ T5325] ? nf_tcp_handle_invalid+0x640/0x640 [ 113.719343][ T5325] ? panic+0x770/0x770 [ 113.723487][ T5325] dump_header+0xdc/0x940 [ 113.727879][ T5325] out_of_memory+0xf21/0x12c0 [ 113.732622][ T5325] ? mutex_lock_io_nested+0x60/0x60 [ 113.737886][ T5325] ? mark_lock+0x9a/0x340 [ 113.742259][ T5325] ? unregister_oom_notifier+0x20/0x20 [pid 5073] lstat("./12/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5073] unlink("./12/cgroup.net") = 0 [pid 5073] umount2("./12/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5339] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5339] openat(5, "memory.max", O_RDWR) = 6 [ 113.747776][ T5325] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 113.753829][ T5325] mem_cgroup_out_of_memory+0x263/0x3b0 [ 113.759437][ T5325] ? mem_cgroup_oom_trylock+0x210/0x210 [ 113.765057][ T5325] ? cgroup_file_notify+0x127/0x190 [ 113.770315][ T5325] memory_max_write+0x355/0x470 [ 113.775292][ T5325] ? memory_max_show+0xa0/0xa0 [ 113.780112][ T5325] ? read_lock_is_recursive+0x20/0x20 [ 113.785542][ T5325] ? memory_max_show+0xa0/0xa0 [ 113.790365][ T5325] cgroup_file_write+0x2b1/0x780 [ 113.795359][ T5325] ? cgroup_seqfile_stop+0xd0/0xd0 [ 113.800512][ T5325] ? __virt_addr_valid+0x22f/0x2e0 [ 113.805691][ T5325] ? cgroup_seqfile_stop+0xd0/0xd0 [ 113.810849][ T5325] kernfs_fop_write_iter+0x3a6/0x4f0 [ 113.816197][ T5325] vfs_write+0x7b2/0xbb0 [ 113.820499][ T5325] ? file_end_write+0x240/0x240 [ 113.825445][ T5325] ? do_raw_spin_unlock+0x13b/0x8b0 [ 113.830696][ T5325] ? lockdep_hardirqs_on+0x98/0x140 [ 113.836047][ T5325] ? __fdget_pos+0x265/0x2f0 [ 113.840702][ T5325] ksys_write+0x1a0/0x2c0 [ 113.845116][ T5325] ? __ia32_sys_read+0x90/0x90 [ 113.849943][ T5325] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 113.856084][ T5325] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 113.862179][ T5325] do_syscall_64+0x41/0xc0 [ 113.866658][ T5325] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 113.872617][ T5325] RIP: 0033:0x7fd49ce20129 [ 113.877085][ T5325] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 5339] write(6, "0x000000000000040e", 18 [pid 5073] <... umount2 resumed>) = 0 [pid 5073] umount2("./12/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./12/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5073] umount2("./12/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] openat(AT_FDCWD, "./12/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5073] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5073] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5073] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5073] close(4) = 0 [pid 5073] rmdir("./12/file0") = 0 [pid 5073] umount2("./12/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./12/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5073] unlink("./12/cgroup.cpu") = 0 [ 113.896755][ T5325] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 113.905231][ T5325] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 113.913257][ T5325] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 113.921287][ T5325] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 113.929315][ T5325] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 113.937333][ T5325] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000009 [ 113.945379][ T5325] [pid 5073] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5073] close(3) = 0 [pid 5073] rmdir("./12") = 0 [pid 5073] mkdir("./13", 0777) = 0 [pid 5073] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555574ac5d0) = 15 ./strace-static-x86_64: Process 5341 attached [pid 5341] chdir("./13") = 0 [ 113.993936][ T5325] memory: usage 12kB, limit 0kB, failcnt 55 [ 114.000573][ T5325] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 114.015863][ T5325] Memory cgroup stats for /syz1: [ 114.016088][ T5325] anon 0 [ 114.016088][ T5325] file 0 [ 114.016088][ T5325] kernel 12288 [ 114.016088][ T5325] kernel_stack 0 [ 114.016088][ T5325] pagetables 0 [ 114.016088][ T5325] sec_pagetables 0 [ 114.016088][ T5325] percpu 0 [pid 5341] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5341] setpgid(0, 0) = 0 [pid 5341] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 5341] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 5341] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [pid 5341] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [ 114.016088][ T5325] sock 0 [ 114.016088][ T5325] vmalloc 0 [ 114.016088][ T5325] shmem 0 [ 114.016088][ T5325] zswap 0 [ 114.016088][ T5325] zswapped 0 [ 114.016088][ T5325] file_mapped 0 [ 114.016088][ T5325] file_dirty 0 [ 114.016088][ T5325] file_writeback 0 [ 114.016088][ T5325] swapcached 0 [ 114.016088][ T5325] anon_thp 0 [ 114.016088][ T5325] file_thp 0 [ 114.016088][ T5325] shmem_thp 0 [ 114.016088][ T5325] inactive_anon 0 [ 114.016088][ T5325] active_anon 0 [ 114.016088][ T5325] inactive_file 0 [ 114.016088][ T5325] active_file 0 [pid 5341] write(3, "1000", 4) = 4 [pid 5341] close(3) = 0 [pid 5341] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5341] mkdir("./file0", 000) = 0 [pid 5341] open("./file0", O_RDONLY) = 3 [pid 5341] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5341] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5341] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5341] openat(5, "memory.max", O_RDWR) = 6 [ 114.016088][ T5325] unevictable 0 [ 114.016088][ T5325] slab_reclaimable 9328 [ 114.016088][ T5325] slab_unreclaimable 0 [ 114.016088][ T5325] slab 9328 [ 114.016088][ T5325] workingset_refault_anon 0 [ 114.124423][ T5325] Tasks state (memory values in pages): [ 114.133282][ T5325] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5341] write(6, "0x000000000000040e", 18 [pid 5325] <... write resumed>) = 18 [pid 5325] close(3) = 0 [pid 5325] close(4) = 0 [pid 5325] close(5) = 0 [ 114.150920][ T5325] Out of memory and no killable processes... [ 114.160353][ T5330] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 114.178416][ T5330] CPU: 1 PID: 5330 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 114.188900][ T5330] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 114.198992][ T5330] Call Trace: [ 114.202319][ T5330] [ 114.205282][ T5330] dump_stack_lvl+0x1e7/0x2d0 [ 114.210018][ T5330] ? nf_tcp_handle_invalid+0x640/0x640 [ 114.215528][ T5330] ? panic+0x770/0x770 [ 114.219668][ T5330] dump_header+0xdc/0x940 [ 114.224048][ T5330] out_of_memory+0xf21/0x12c0 [ 114.228764][ T5330] ? mutex_lock_io_nested+0x60/0x60 [ 114.233992][ T5330] ? preempt_schedule+0xdd/0xf0 [ 114.238863][ T5330] ? unregister_oom_notifier+0x20/0x20 [ 114.244340][ T5330] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 114.250350][ T5330] mem_cgroup_out_of_memory+0x263/0x3b0 [ 114.255919][ T5330] ? preempt_schedule_thunk+0x1a/0x20 [ 114.261314][ T5330] ? mem_cgroup_oom_trylock+0x210/0x210 [ 114.266892][ T5330] ? cgroup_file_notify+0x127/0x190 [ 114.272116][ T5330] memory_max_write+0x355/0x470 [ 114.276997][ T5330] ? memory_max_show+0xa0/0xa0 [ 114.281779][ T5330] ? read_lock_is_recursive+0x20/0x20 [ 114.287176][ T5330] ? memory_max_show+0xa0/0xa0 [ 114.291955][ T5330] cgroup_file_write+0x2b1/0x780 [ 114.296918][ T5330] ? cgroup_seqfile_stop+0xd0/0xd0 [ 114.302048][ T5330] ? __virt_addr_valid+0x22f/0x2e0 [ 114.307189][ T5330] ? cgroup_seqfile_stop+0xd0/0xd0 [ 114.312309][ T5330] kernfs_fop_write_iter+0x3a6/0x4f0 [ 114.317634][ T5330] vfs_write+0x7b2/0xbb0 [ 114.321898][ T5330] ? file_end_write+0x240/0x240 [ 114.326785][ T5330] ? do_raw_spin_unlock+0x13b/0x8b0 [ 114.332019][ T5330] ? lockdep_hardirqs_on+0x98/0x140 [ 114.337241][ T5330] ? __fdget_pos+0x265/0x2f0 [ 114.341852][ T5330] ksys_write+0x1a0/0x2c0 [ 114.346210][ T5330] ? __ia32_sys_read+0x90/0x90 [ 114.350996][ T5330] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 114.357014][ T5330] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 114.363018][ T5330] do_syscall_64+0x41/0xc0 [ 114.367478][ T5330] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 114.373395][ T5330] RIP: 0033:0x7fd49ce20129 [ 114.377853][ T5330] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 5325] close(6) = 0 [pid 5325] close(7) = -1 EBADF (Bad file descriptor) [pid 5325] close(8) = -1 EBADF (Bad file descriptor) [ 114.397497][ T5330] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 114.405927][ T5330] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 114.413914][ T5330] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 114.421918][ T5330] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 114.429916][ T5330] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 114.437915][ T5330] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 000000000000000a [ 114.445956][ T5330] [pid 5325] close(9) = -1 EBADF (Bad file descriptor) [ 114.457882][ T5330] memory: usage 12kB, limit 0kB, failcnt 55 [ 114.463861][ T5330] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 114.471372][ T5330] Memory cgroup stats for /syz1: [ 114.471586][ T5330] anon 0 [ 114.471586][ T5330] file 0 [ 114.471586][ T5330] kernel 12288 [ 114.471586][ T5330] kernel_stack 0 [ 114.471586][ T5330] pagetables 0 [ 114.471586][ T5330] sec_pagetables 0 [ 114.471586][ T5330] percpu 0 [ 114.471586][ T5330] sock 0 [ 114.471586][ T5330] vmalloc 0 [ 114.471586][ T5330] shmem 0 [pid 5325] close(10) = -1 EBADF (Bad file descriptor) [pid 5325] close(11) = -1 EBADF (Bad file descriptor) [pid 5325] close(12) = -1 EBADF (Bad file descriptor) [pid 5325] close(13) = -1 EBADF (Bad file descriptor) [pid 5325] close(14) = -1 EBADF (Bad file descriptor) [pid 5325] close(15) = -1 EBADF (Bad file descriptor) [pid 5325] close(16) = -1 EBADF (Bad file descriptor) [pid 5325] close(17) = -1 EBADF (Bad file descriptor) [pid 5325] close(18) = -1 EBADF (Bad file descriptor) [pid 5325] close(19) = -1 EBADF (Bad file descriptor) [pid 5325] close(20) = -1 EBADF (Bad file descriptor) [pid 5325] close(21) = -1 EBADF (Bad file descriptor) [pid 5325] close(22) = -1 EBADF (Bad file descriptor) [pid 5325] close(23) = -1 EBADF (Bad file descriptor) [pid 5325] close(24) = -1 EBADF (Bad file descriptor) [pid 5325] close(25) = -1 EBADF (Bad file descriptor) [pid 5325] close(26) = -1 EBADF (Bad file descriptor) [pid 5325] close(27) = -1 EBADF (Bad file descriptor) [pid 5325] close(28) = -1 EBADF (Bad file descriptor) [pid 5325] close(29) = -1 EBADF (Bad file descriptor) [pid 5325] exit_group(0) = ? [pid 5325] +++ exited with 0 +++ [ 114.471586][ T5330] zswap 0 [ 114.471586][ T5330] zswapped 0 [ 114.471586][ T5330] file_mapped 0 [ 114.471586][ T5330] file_dirty 0 [ 114.471586][ T5330] file_writeback 0 [ 114.471586][ T5330] swapcached 0 [ 114.471586][ T5330] anon_thp 0 [ 114.471586][ T5330] file_thp 0 [ 114.471586][ T5330] shmem_thp 0 [ 114.471586][ T5330] inactive_anon 0 [ 114.471586][ T5330] active_anon 0 [ 114.471586][ T5330] inactive_file 0 [ 114.471586][ T5330] active_file 0 [ 114.471586][ T5330] unevictable 0 [ 114.471586][ T5330] slab_reclaimable 9328 [pid 5070] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=11, si_uid=0, si_status=0, si_utime=0, si_stime=12 /* 0.12 s */} --- [pid 5070] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5070] umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5070] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5070] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5070] umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./9/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5070] unlink("./9/binderfs") = 0 [pid 5070] umount2("./9/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5330] <... write resumed>) = 18 [ 114.471586][ T5330] slab_unreclaimable 0 [ 114.471586][ T5330] slab 9328 [ 114.471586][ T5330] workingset_refault_anon 0 [ 114.572021][ T5330] Tasks state (memory values in pages): [ 114.578486][ T5330] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 114.588097][ T5330] Out of memory and no killable processes... [ 114.594232][ T5333] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5070] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./9/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5070] unlink("./9/cgroup") = 0 [pid 5070] umount2("./9/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./9/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5070] unlink("./9/cgroup.net") = 0 [ 114.604696][ T5333] CPU: 0 PID: 5333 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 114.615162][ T5333] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 114.625270][ T5333] Call Trace: [ 114.628586][ T5333] [ 114.631555][ T5333] dump_stack_lvl+0x1e7/0x2d0 [ 114.636295][ T5333] ? nf_tcp_handle_invalid+0x640/0x640 [ 114.641807][ T5333] ? panic+0x770/0x770 [ 114.645945][ T5333] dump_header+0xdc/0x940 [ 114.650334][ T5333] out_of_memory+0xf21/0x12c0 [ 114.655067][ T5333] ? mutex_lock_io_nested+0x60/0x60 [ 114.660329][ T5333] ? mark_lock+0x9a/0x340 [ 114.664698][ T5333] ? unregister_oom_notifier+0x20/0x20 [ 114.670204][ T5333] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 114.676258][ T5333] mem_cgroup_out_of_memory+0x263/0x3b0 [ 114.681880][ T5333] ? mem_cgroup_oom_trylock+0x210/0x210 [ 114.687532][ T5333] ? cgroup_file_notify+0x127/0x190 [ 114.692801][ T5333] memory_max_write+0x355/0x470 [ 114.697727][ T5333] ? memory_max_show+0xa0/0xa0 [ 114.702552][ T5333] ? read_lock_is_recursive+0x20/0x20 [ 114.707986][ T5333] ? memory_max_show+0xa0/0xa0 [ 114.712786][ T5333] cgroup_file_write+0x2b1/0x780 [ 114.717817][ T5333] ? cgroup_seqfile_stop+0xd0/0xd0 [ 114.722953][ T5333] ? __virt_addr_valid+0x22f/0x2e0 [ 114.728107][ T5333] ? cgroup_seqfile_stop+0xd0/0xd0 [ 114.733232][ T5333] kernfs_fop_write_iter+0x3a6/0x4f0 [ 114.738544][ T5333] vfs_write+0x7b2/0xbb0 [ 114.742902][ T5333] ? file_end_write+0x240/0x240 [ 114.747780][ T5333] ? do_raw_spin_unlock+0x13b/0x8b0 [ 114.752998][ T5333] ? lockdep_hardirqs_on+0x98/0x140 [ 114.758236][ T5333] ? __fdget_pos+0x265/0x2f0 [ 114.762873][ T5333] ksys_write+0x1a0/0x2c0 [ 114.767260][ T5333] ? __ia32_sys_read+0x90/0x90 [ 114.772059][ T5333] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 114.778069][ T5333] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 114.784079][ T5333] do_syscall_64+0x41/0xc0 [ 114.788667][ T5333] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 114.794632][ T5333] RIP: 0033:0x7fd49ce20129 [ 114.799072][ T5333] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 114.818706][ T5333] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 114.827137][ T5333] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 114.835141][ T5333] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 114.843126][ T5333] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 114.851107][ T5333] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [pid 5070] umount2("./9/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5330] close(3 [pid 5070] <... umount2 resumed>) = 0 [pid 5070] umount2("./9/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./9/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5070] umount2("./9/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] openat(AT_FDCWD, "./9/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5070] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5070] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5070] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5070] close(4) = 0 [pid 5070] rmdir("./9/file0") = 0 [pid 5070] umount2("./9/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./9/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5070] unlink("./9/cgroup.cpu" [pid 5330] <... close resumed>) = 0 [pid 5070] <... unlink resumed>) = 0 [pid 5330] close(4 [pid 5070] getdents64(3, [pid 5330] <... close resumed>) = 0 [pid 5070] <... getdents64 resumed>0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5330] close(5 [pid 5070] close(3 [pid 5330] <... close resumed>) = 0 [pid 5070] <... close resumed>) = 0 [pid 5330] close(6 [pid 5070] rmdir("./9" [pid 5330] <... close resumed>) = 0 [pid 5070] <... rmdir resumed>) = 0 [pid 5330] close(7 [pid 5070] mkdir("./10", 0777 [pid 5330] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5070] <... mkdir resumed>) = 0 [pid 5330] close(8 [pid 5070] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5346 attached [pid 5330] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5346] chdir("./10" [pid 5330] close(9 [pid 5346] <... chdir resumed>) = 0 [pid 5330] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5070] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 12 [pid 5346] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5330] close(10 [pid 5346] <... prctl resumed>) = 0 [pid 5330] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5346] setpgid(0, 0 [ 114.859092][ T5333] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000010 [ 114.867109][ T5333] [pid 5330] close(11 [pid 5346] <... setpgid resumed>) = 0 [pid 5330] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5346] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 5346] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu" [pid 5330] close(12 [pid 5346] <... symlink resumed>) = 0 [pid 5330] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5346] symlink("/syzcgroup/net/syz0", "./cgroup.net" [pid 5330] close(13 [pid 5346] <... symlink resumed>) = 0 [pid 5330] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5346] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5330] close(14 [pid 5346] <... openat resumed>) = 3 [pid 5330] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5346] write(3, "1000", 4 [pid 5330] close(15 [pid 5346] <... write resumed>) = 4 [pid 5330] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5346] close(3 [pid 5330] close(16 [pid 5346] <... close resumed>) = 0 [pid 5330] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5346] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5346] mkdir("./file0", 000 [pid 5330] close(17 [pid 5346] <... mkdir resumed>) = 0 [pid 5330] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5346] open("./file0", O_RDONLY [pid 5330] close(18 [pid 5346] <... open resumed>) = 3 [pid 5330] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5346] mount(NULL, "./file0", "cgroup2", 0, NULL [ 114.916670][ T5333] memory: usage 12kB, limit 0kB, failcnt 55 [ 114.922652][ T5333] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 114.957596][ T5333] Memory cgroup stats for /syz1: [ 114.957805][ T5333] anon 0 [ 114.957805][ T5333] file 0 [ 114.957805][ T5333] kernel 12288 [ 114.957805][ T5333] kernel_stack 0 [ 114.957805][ T5333] pagetables 0 [ 114.957805][ T5333] sec_pagetables 0 [ 114.957805][ T5333] percpu 0 [ 114.957805][ T5333] sock 0 [ 114.957805][ T5333] vmalloc 0 [ 114.957805][ T5333] shmem 0 [ 114.957805][ T5333] zswap 0 [ 114.957805][ T5333] zswapped 0 [ 114.957805][ T5333] file_mapped 0 [ 114.957805][ T5333] file_dirty 0 [pid 5330] close(19 [pid 5346] <... mount resumed>) = 0 [pid 5330] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5346] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5330] close(20 [pid 5346] <... openat resumed>) = 4 [pid 5330] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5346] openat(4, "syz1", O_RDWR|O_PATH [pid 5330] close(21 [pid 5346] <... openat resumed>) = 5 [pid 5330] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5346] openat(5, "memory.max", O_RDWR [pid 5330] close(22 [pid 5346] <... openat resumed>) = 6 [pid 5330] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5346] write(6, "0x000000000000040e", 18 [pid 5330] close(23) = -1 EBADF (Bad file descriptor) [ 114.957805][ T5333] file_writeback 0 [ 114.957805][ T5333] swapcached 0 [ 114.957805][ T5333] anon_thp 0 [ 114.957805][ T5333] file_thp 0 [ 114.957805][ T5333] shmem_thp 0 [ 114.957805][ T5333] inactive_anon 0 [ 114.957805][ T5333] active_anon 0 [ 114.957805][ T5333] inactive_file 0 [ 114.957805][ T5333] active_file 0 [ 114.957805][ T5333] unevictable 0 [ 114.957805][ T5333] slab_reclaimable 9328 [ 114.957805][ T5333] slab_unreclaimable 0 [ 114.957805][ T5333] slab 9328 [ 114.957805][ T5333] workingset_refault_anon 0 [pid 5330] close(24) = -1 EBADF (Bad file descriptor) [pid 5330] close(25) = -1 EBADF (Bad file descriptor) [pid 5330] close(26) = -1 EBADF (Bad file descriptor) [pid 5330] close(27) = -1 EBADF (Bad file descriptor) [pid 5330] close(28) = -1 EBADF (Bad file descriptor) [pid 5330] close(29) = -1 EBADF (Bad file descriptor) [pid 5333] <... write resumed>) = 18 [pid 5330] exit_group(0 [pid 5333] close(3 [pid 5330] <... exit_group resumed>) = ? [pid 5333] <... close resumed>) = 0 [ 115.075336][ T5333] Tasks state (memory values in pages): [ 115.084318][ T5333] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 115.094778][ T5333] Out of memory and no killable processes... [ 115.112683][ T5339] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 115.126246][ T5339] CPU: 1 PID: 5339 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 115.136724][ T5339] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 115.146822][ T5339] Call Trace: [ 115.150130][ T5339] [ 115.153093][ T5339] dump_stack_lvl+0x1e7/0x2d0 [ 115.157824][ T5339] ? nf_tcp_handle_invalid+0x640/0x640 [ 115.163323][ T5339] ? panic+0x770/0x770 [ 115.167423][ T5339] dump_header+0xdc/0x940 [ 115.171776][ T5339] out_of_memory+0xf21/0x12c0 [ 115.176475][ T5339] ? mutex_lock_io_nested+0x60/0x60 [ 115.181699][ T5339] ? mark_lock+0x9a/0x340 [ 115.186044][ T5339] ? unregister_oom_notifier+0x20/0x20 [ 115.191522][ T5339] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 115.197530][ T5339] mem_cgroup_out_of_memory+0x263/0x3b0 [ 115.203098][ T5339] ? mem_cgroup_oom_trylock+0x210/0x210 [ 115.208674][ T5339] ? cgroup_file_notify+0x127/0x190 [ 115.213899][ T5339] memory_max_write+0x355/0x470 [ 115.218773][ T5339] ? memory_max_show+0xa0/0xa0 [ 115.223554][ T5339] ? read_lock_is_recursive+0x20/0x20 [ 115.228950][ T5339] ? memory_max_show+0xa0/0xa0 [ 115.233731][ T5339] cgroup_file_write+0x2b1/0x780 [ 115.238687][ T5339] ? cgroup_seqfile_stop+0xd0/0xd0 [ 115.243808][ T5339] ? __virt_addr_valid+0x22f/0x2e0 [ 115.248963][ T5339] ? cgroup_seqfile_stop+0xd0/0xd0 [ 115.254090][ T5339] kernfs_fop_write_iter+0x3a6/0x4f0 [ 115.259400][ T5339] vfs_write+0x7b2/0xbb0 [ 115.263670][ T5339] ? file_end_write+0x240/0x240 [ 115.268557][ T5339] ? do_raw_spin_unlock+0x13b/0x8b0 [ 115.273794][ T5339] ? lockdep_hardirqs_on+0x98/0x140 [ 115.279036][ T5339] ? __fdget_pos+0x265/0x2f0 [ 115.283661][ T5339] ksys_write+0x1a0/0x2c0 [ 115.288018][ T5339] ? __ia32_sys_read+0x90/0x90 [ 115.292798][ T5339] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 115.298818][ T5339] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 115.304820][ T5339] do_syscall_64+0x41/0xc0 [ 115.309256][ T5339] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 115.315175][ T5339] RIP: 0033:0x7fd49ce20129 [ 115.319600][ T5339] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 115.339214][ T5339] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 115.347640][ T5339] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 115.355619][ T5339] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 115.363599][ T5339] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [pid 5333] close(4 [pid 5330] +++ exited with 0 +++ [pid 5333] <... close resumed>) = 0 [pid 5333] close(5) = 0 [pid 5072] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=12, si_uid=0, si_status=0, si_utime=0, si_stime=9 /* 0.09 s */} --- [pid 5333] close(6 [pid 5072] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5333] <... close resumed>) = 0 [pid 5333] close(7) = -1 EBADF (Bad file descriptor) [pid 5333] close(8) = -1 EBADF (Bad file descriptor) [pid 5333] close(9) = -1 EBADF (Bad file descriptor) [pid 5072] umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5333] close(10 [pid 5072] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5072] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5333] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5072] <... openat resumed>) = 3 [pid 5333] close(11) = -1 EBADF (Bad file descriptor) [pid 5072] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5072] getdents64(3, [pid 5333] close(12) = -1 EBADF (Bad file descriptor) [pid 5072] <... getdents64 resumed>0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5333] close(13 [pid 5072] umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5333] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5333] close(14 [pid 5072] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5333] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5072] lstat("./10/binderfs", [pid 5333] close(15) = -1 EBADF (Bad file descriptor) [pid 5072] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5333] close(16 [pid 5072] unlink("./10/binderfs" [pid 5333] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5333] close(17) = -1 EBADF (Bad file descriptor) [pid 5333] close(18 [pid 5072] <... unlink resumed>) = 0 [pid 5333] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5072] umount2("./10/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5333] close(19) = -1 EBADF (Bad file descriptor) [pid 5072] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5333] close(20) = -1 EBADF (Bad file descriptor) [pid 5072] lstat("./10/cgroup", [pid 5333] close(21 [pid 5072] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5333] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5072] unlink("./10/cgroup" [pid 5333] close(22) = -1 EBADF (Bad file descriptor) [pid 5333] close(23) = -1 EBADF (Bad file descriptor) [pid 5333] close(24) = -1 EBADF (Bad file descriptor) [pid 5333] close(25) = -1 EBADF (Bad file descriptor) [pid 5072] <... unlink resumed>) = 0 [pid 5333] close(26 [pid 5072] umount2("./10/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5333] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5333] close(27 [pid 5072] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5333] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5333] close(28) = -1 EBADF (Bad file descriptor) [pid 5072] lstat("./10/cgroup.net", [pid 5333] close(29) = -1 EBADF (Bad file descriptor) [pid 5333] exit_group(0 [pid 5072] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5333] <... exit_group resumed>) = ? [pid 5333] +++ exited with 0 +++ [pid 5072] unlink("./10/cgroup.net" [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=18, si_uid=0, si_status=0, si_utime=0, si_stime=9 /* 0.09 s */} --- [pid 5072] <... unlink resumed>) = 0 [pid 5074] umount2("./16", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5072] umount2("./10/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5072] <... umount2 resumed>) = 0 [pid 5074] fstat(3, [ 115.371581][ T5339] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 115.379562][ T5339] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000010 [ 115.387560][ T5339] [ 115.393839][ T5339] memory: usage 12kB, limit 0kB, failcnt 55 [ 115.400924][ T5339] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [pid 5072] umount2("./10/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5072] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] getdents64(3, [pid 5072] lstat("./10/file0", [pid 5074] <... getdents64 resumed>0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5074] umount2("./16/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./16/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5074] unlink("./16/binderfs") = 0 [pid 5074] umount2("./16/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./16/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5074] unlink("./16/cgroup") = 0 [pid 5074] umount2("./16/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./16/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5074] unlink("./16/cgroup.net") = 0 [pid 5074] umount2("./16/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5072] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5072] umount2("./10/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] openat(AT_FDCWD, "./10/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5072] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5072] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5072] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5072] close(4) = 0 [pid 5072] rmdir("./10/file0") = 0 [pid 5072] umount2("./10/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./10/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5072] unlink("./10/cgroup.cpu") = 0 [pid 5072] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5072] close(3) = 0 [pid 5072] rmdir("./10") = 0 [ 115.459197][ T5339] Memory cgroup stats for /syz1: [ 115.459688][ T5339] anon 0 [ 115.459688][ T5339] file 0 [ 115.459688][ T5339] kernel 12288 [ 115.459688][ T5339] kernel_stack 0 [ 115.459688][ T5339] pagetables 0 [ 115.459688][ T5339] sec_pagetables 0 [ 115.459688][ T5339] percpu 0 [ 115.459688][ T5339] sock 0 [ 115.459688][ T5339] vmalloc 0 [ 115.459688][ T5339] shmem 0 [ 115.459688][ T5339] zswap 0 [ 115.459688][ T5339] zswapped 0 [ 115.459688][ T5339] file_mapped 0 [ 115.459688][ T5339] file_dirty 0 [pid 5072] mkdir("./11", 0777) = 0 [pid 5072] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555574ac5d0) = 13 ./strace-static-x86_64: Process 5352 attached [pid 5352] chdir("./11") = 0 [pid 5352] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5352] setpgid(0, 0) = 0 [pid 5352] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 5352] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [pid 5352] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 5352] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5352] write(3, "1000", 4) = 4 [pid 5352] close(3) = 0 [pid 5352] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5352] mkdir("./file0", 000) = 0 [pid 5352] open("./file0", O_RDONLY) = 3 [pid 5352] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5352] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [ 115.459688][ T5339] file_writeback 0 [ 115.459688][ T5339] swapcached 0 [ 115.459688][ T5339] anon_thp 0 [ 115.459688][ T5339] file_thp 0 [ 115.459688][ T5339] shmem_thp 0 [ 115.459688][ T5339] inactive_anon 0 [ 115.459688][ T5339] active_anon 0 [ 115.459688][ T5339] inactive_file 0 [ 115.459688][ T5339] active_file 0 [ 115.459688][ T5339] unevictable 0 [ 115.459688][ T5339] slab_reclaimable 9328 [ 115.459688][ T5339] slab_unreclaimable 0 [ 115.459688][ T5339] slab 9328 [ 115.459688][ T5339] workingset_refault_anon 0 [pid 5074] <... umount2 resumed>) = 0 [pid 5074] umount2("./16/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./16/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5074] umount2("./16/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] openat(AT_FDCWD, "./16/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5074] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5074] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5074] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5074] close(4) = 0 [pid 5074] rmdir("./16/file0") = 0 [pid 5074] umount2("./16/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./16/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5074] unlink("./16/cgroup.cpu") = 0 [pid 5074] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5352] openat(4, "syz1", O_RDWR|O_PATH [pid 5074] close(3 [pid 5352] <... openat resumed>) = 5 [pid 5074] <... close resumed>) = 0 [pid 5352] openat(5, "memory.max", O_RDWR [pid 5074] rmdir("./16" [pid 5352] <... openat resumed>) = 6 [pid 5074] <... rmdir resumed>) = 0 [pid 5352] write(6, "0x000000000000040e", 18 [pid 5074] mkdir("./17", 0777) = 0 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5355 attached [pid 5355] chdir("./17" [pid 5074] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 19 [pid 5355] <... chdir resumed>) = 0 [pid 5355] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [ 115.562549][ T5339] Tasks state (memory values in pages): [ 115.574435][ T5339] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5355] setpgid(0, 0) = 0 [pid 5355] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [pid 5355] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 5355] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 5355] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5339] <... write resumed>) = 18 [pid 5339] close(3 [pid 5355] write(3, "1000", 4 [pid 5339] <... close resumed>) = 0 [pid 5339] close(4) = 0 [pid 5339] close(5) = 0 [pid 5339] close(6 [pid 5355] <... write resumed>) = 4 [pid 5339] <... close resumed>) = 0 [pid 5355] close(3 [pid 5339] close(7 [pid 5355] <... close resumed>) = 0 [pid 5339] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5355] symlink("/dev/binderfs", "./binderfs" [pid 5339] close(8 [pid 5355] <... symlink resumed>) = 0 [pid 5339] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5355] mkdir("./file0", 000 [pid 5339] close(9 [pid 5355] <... mkdir resumed>) = 0 [pid 5339] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5355] open("./file0", O_RDONLY [pid 5339] close(10 [pid 5355] <... open resumed>) = 3 [pid 5339] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5355] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5339] close(11 [pid 5355] <... mount resumed>) = 0 [pid 5339] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5355] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5355] openat(4, "syz1", O_RDWR|O_PATH) = 5 [ 115.606229][ T5339] Out of memory and no killable processes... [ 115.625238][ T5341] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5339] close(12 [pid 5355] openat(5, "memory.max", O_RDWR) = 6 [ 115.668998][ T5341] CPU: 0 PID: 5341 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 115.679497][ T5341] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 115.689591][ T5341] Call Trace: [ 115.692906][ T5341] [ 115.695878][ T5341] dump_stack_lvl+0x1e7/0x2d0 [ 115.700618][ T5341] ? nf_tcp_handle_invalid+0x640/0x640 [ 115.706129][ T5341] ? panic+0x770/0x770 [ 115.710264][ T5341] dump_header+0xdc/0x940 [ 115.714665][ T5341] out_of_memory+0xf21/0x12c0 [ 115.719397][ T5341] ? mutex_lock_io_nested+0x60/0x60 [ 115.724654][ T5341] ? preempt_schedule+0xdd/0xf0 [ 115.729551][ T5341] ? unregister_oom_notifier+0x20/0x20 [ 115.735121][ T5341] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 115.741289][ T5341] mem_cgroup_out_of_memory+0x263/0x3b0 [ 115.747066][ T5341] ? preempt_schedule_thunk+0x1a/0x20 [ 115.752510][ T5341] ? mem_cgroup_oom_trylock+0x210/0x210 [ 115.758134][ T5341] ? cgroup_file_notify+0x127/0x190 [ 115.763469][ T5341] memory_max_write+0x355/0x470 [ 115.768467][ T5341] ? memory_max_show+0xa0/0xa0 [ 115.773280][ T5341] ? read_lock_is_recursive+0x20/0x20 [ 115.778689][ T5341] ? memory_max_show+0xa0/0xa0 [ 115.783500][ T5341] cgroup_file_write+0x2b1/0x780 [ 115.788530][ T5341] ? cgroup_seqfile_stop+0xd0/0xd0 [ 115.793698][ T5341] ? __virt_addr_valid+0x22f/0x2e0 [ 115.798865][ T5341] ? cgroup_seqfile_stop+0xd0/0xd0 [ 115.803997][ T5341] kernfs_fop_write_iter+0x3a6/0x4f0 [ 115.809322][ T5341] vfs_write+0x7b2/0xbb0 [ 115.813601][ T5341] ? file_end_write+0x240/0x240 [ 115.818492][ T5341] ? do_raw_spin_unlock+0x13b/0x8b0 [ 115.823747][ T5341] ? lockdep_hardirqs_on+0x98/0x140 [ 115.828990][ T5341] ? __fdget_pos+0x265/0x2f0 [ 115.833607][ T5341] ksys_write+0x1a0/0x2c0 [ 115.837980][ T5341] ? __ia32_sys_read+0x90/0x90 [ 115.842758][ T5341] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 115.848761][ T5341] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 115.854764][ T5341] do_syscall_64+0x41/0xc0 [ 115.859202][ T5341] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 115.865115][ T5341] RIP: 0033:0x7fd49ce20129 [ 115.869545][ T5341] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 115.889235][ T5341] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 115.897681][ T5341] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 115.905786][ T5341] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [pid 5355] write(6, "0x000000000000040e", 18 [pid 5339] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5339] close(13) = -1 EBADF (Bad file descriptor) [pid 5339] close(14) = -1 EBADF (Bad file descriptor) [pid 5339] close(15) = -1 EBADF (Bad file descriptor) [pid 5339] close(16) = -1 EBADF (Bad file descriptor) [pid 5339] close(17) = -1 EBADF (Bad file descriptor) [pid 5339] close(18) = -1 EBADF (Bad file descriptor) [pid 5339] close(19) = -1 EBADF (Bad file descriptor) [pid 5339] close(20) = -1 EBADF (Bad file descriptor) [pid 5339] close(21) = -1 EBADF (Bad file descriptor) [pid 5339] close(22) = -1 EBADF (Bad file descriptor) [pid 5339] close(23) = -1 EBADF (Bad file descriptor) [pid 5339] close(24) = -1 EBADF (Bad file descriptor) [pid 5339] close(25) = -1 EBADF (Bad file descriptor) [pid 5339] close(26) = -1 EBADF (Bad file descriptor) [pid 5339] close(27) = -1 EBADF (Bad file descriptor) [pid 5339] close(28) = -1 EBADF (Bad file descriptor) [pid 5339] close(29) = -1 EBADF (Bad file descriptor) [pid 5339] exit_group(0) = ? [ 115.913768][ T5341] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 115.921776][ T5341] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 115.929819][ T5341] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 000000000000000d [ 115.937921][ T5341] [pid 5339] +++ exited with 0 +++ [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=18, si_uid=0, si_status=0, si_utime=0, si_stime=9 /* 0.09 s */} --- [pid 5075] umount2("./16", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5075] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5075] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5075] umount2("./16/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./16/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5075] unlink("./16/binderfs") = 0 [pid 5075] umount2("./16/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./16/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5075] unlink("./16/cgroup") = 0 [pid 5075] umount2("./16/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./16/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5075] unlink("./16/cgroup.net") = 0 [ 115.960882][ T5341] memory: usage 12kB, limit 0kB, failcnt 55 [ 115.967571][ T5341] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 115.974915][ T5341] Memory cgroup stats for /syz1: [ 115.975295][ T5341] anon 0 [ 115.975295][ T5341] file 0 [ 115.975295][ T5341] kernel 12288 [ 115.975295][ T5341] kernel_stack 0 [ 115.975295][ T5341] pagetables 0 [ 115.975295][ T5341] sec_pagetables 0 [ 115.975295][ T5341] percpu 0 [ 115.975295][ T5341] sock 0 [ 115.975295][ T5341] vmalloc 0 [ 115.975295][ T5341] shmem 0 [ 115.975295][ T5341] zswap 0 [ 115.975295][ T5341] zswapped 0 [ 115.975295][ T5341] file_mapped 0 [ 115.975295][ T5341] file_dirty 0 [ 115.975295][ T5341] file_writeback 0 [ 115.975295][ T5341] swapcached 0 [ 115.975295][ T5341] anon_thp 0 [ 115.975295][ T5341] file_thp 0 [ 115.975295][ T5341] shmem_thp 0 [ 115.975295][ T5341] inactive_anon 0 [ 115.975295][ T5341] active_anon 0 [ 115.975295][ T5341] inactive_file 0 [ 115.975295][ T5341] active_file 0 [ 115.975295][ T5341] unevictable 0 [ 115.975295][ T5341] slab_reclaimable 9328 [pid 5075] umount2("./16/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5075] umount2("./16/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./16/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5341] <... write resumed>) = 18 [ 115.975295][ T5341] slab_unreclaimable 0 [ 115.975295][ T5341] slab 9328 [ 115.975295][ T5341] workingset_refault_anon 0 [ 116.074581][ T5341] Tasks state (memory values in pages): [ 116.080798][ T5341] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 116.090757][ T5341] Out of memory and no killable processes... [ 116.097236][ T5346] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 116.108175][ T5346] CPU: 1 PID: 5346 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 116.118649][ T5346] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 116.128753][ T5346] Call Trace: [ 116.132062][ T5346] [ 116.135039][ T5346] dump_stack_lvl+0x1e7/0x2d0 [ 116.139779][ T5346] ? nf_tcp_handle_invalid+0x640/0x640 [ 116.145299][ T5346] ? panic+0x770/0x770 [ 116.149437][ T5346] dump_header+0xdc/0x940 [ 116.153827][ T5346] out_of_memory+0xf21/0x12c0 [ 116.158564][ T5346] ? mutex_lock_io_nested+0x60/0x60 [ 116.163824][ T5346] ? mark_lock+0x9a/0x340 [ 116.168202][ T5346] ? unregister_oom_notifier+0x20/0x20 [ 116.173714][ T5346] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 116.179767][ T5346] mem_cgroup_out_of_memory+0x263/0x3b0 [ 116.185377][ T5346] ? mem_cgroup_oom_trylock+0x210/0x210 [ 116.190998][ T5346] ? cgroup_file_notify+0x127/0x190 [ 116.196252][ T5346] memory_max_write+0x355/0x470 [ 116.201160][ T5346] ? memory_max_show+0xa0/0xa0 [ 116.205999][ T5346] ? read_lock_is_recursive+0x20/0x20 [ 116.211440][ T5346] ? memory_max_show+0xa0/0xa0 [ 116.216265][ T5346] cgroup_file_write+0x2b1/0x780 [ 116.221258][ T5346] ? cgroup_seqfile_stop+0xd0/0xd0 [ 116.226428][ T5346] ? __virt_addr_valid+0x22f/0x2e0 [ 116.231608][ T5346] ? cgroup_seqfile_stop+0xd0/0xd0 [ 116.236767][ T5346] kernfs_fop_write_iter+0x3a6/0x4f0 [ 116.242128][ T5346] vfs_write+0x7b2/0xbb0 [ 116.246439][ T5346] ? file_end_write+0x240/0x240 [ 116.251347][ T5346] ? do_raw_spin_unlock+0x13b/0x8b0 [ 116.256596][ T5346] ? lockdep_hardirqs_on+0x98/0x140 [pid 5075] umount2("./16/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] openat(AT_FDCWD, "./16/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5075] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5075] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [ 116.261852][ T5346] ? __fdget_pos+0x265/0x2f0 [ 116.266495][ T5346] ksys_write+0x1a0/0x2c0 [ 116.270886][ T5346] ? __ia32_sys_read+0x90/0x90 [ 116.275708][ T5346] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 116.281770][ T5346] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 116.287824][ T5346] do_syscall_64+0x41/0xc0 [ 116.292301][ T5346] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 116.298264][ T5346] RIP: 0033:0x7fd49ce20129 [ 116.302722][ T5346] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 116.322382][ T5346] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 116.330861][ T5346] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 116.338882][ T5346] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 116.346899][ T5346] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 116.354913][ T5346] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [pid 5075] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5075] close(4) = 0 [pid 5075] rmdir("./16/file0") = 0 [pid 5075] umount2("./16/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./16/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5075] unlink("./16/cgroup.cpu") = 0 [pid 5075] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5075] close(3) = 0 [pid 5075] rmdir("./16") = 0 [pid 5075] mkdir("./17", 0777) = 0 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555574ac5d0) = 19 [pid 5341] close(3) = 0 [pid 5341] close(4) = 0 [pid 5341] close(5) = 0 [pid 5341] close(6) = 0 [pid 5341] close(7) = -1 EBADF (Bad file descriptor) [pid 5341] close(8) = -1 EBADF (Bad file descriptor) [pid 5341] close(9) = -1 EBADF (Bad file descriptor) [pid 5341] close(10) = -1 EBADF (Bad file descriptor) [pid 5341] close(11) = -1 EBADF (Bad file descriptor) [pid 5341] close(12) = -1 EBADF (Bad file descriptor) [pid 5341] close(13) = -1 EBADF (Bad file descriptor) [pid 5341] close(14) = -1 EBADF (Bad file descriptor) [pid 5341] close(15) = -1 EBADF (Bad file descriptor) [pid 5341] close(16) = -1 EBADF (Bad file descriptor) [pid 5341] close(17) = -1 EBADF (Bad file descriptor) [pid 5341] close(18) = -1 EBADF (Bad file descriptor) [pid 5341] close(19) = -1 EBADF (Bad file descriptor) [pid 5341] close(20) = -1 EBADF (Bad file descriptor) [pid 5341] close(21) = -1 EBADF (Bad file descriptor) [pid 5341] close(22) = -1 EBADF (Bad file descriptor) [pid 5341] close(23) = -1 EBADF (Bad file descriptor) [pid 5341] close(24) = -1 EBADF (Bad file descriptor) [pid 5341] close(25) = -1 EBADF (Bad file descriptor) [pid 5341] close(26) = -1 EBADF (Bad file descriptor) [pid 5341] close(27) = -1 EBADF (Bad file descriptor) [pid 5341] close(28) = -1 EBADF (Bad file descriptor) [pid 5341] close(29) = -1 EBADF (Bad file descriptor) [pid 5341] exit_group(0./strace-static-x86_64: Process 5358 attached ) = ? [pid 5358] chdir("./17" [pid 5341] +++ exited with 0 +++ [pid 5358] <... chdir resumed>) = 0 [pid 5073] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=15, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- [pid 5358] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5073] restart_syscall(<... resuming interrupted clone ...> [pid 5358] <... prctl resumed>) = 0 [pid 5073] <... restart_syscall resumed>) = 0 [pid 5358] setpgid(0, 0) = 0 [pid 5073] umount2("./13", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5358] symlink("/syzcgroup/unified/syz2", "./cgroup" [pid 5073] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5358] <... symlink resumed>) = 0 [pid 5073] openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5358] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu" [pid 5073] <... openat resumed>) = 3 [pid 5073] fstat(3, [pid 5358] <... symlink resumed>) = 0 [pid 5073] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5358] symlink("/syzcgroup/net/syz2", "./cgroup.net" [pid 5073] getdents64(3, [pid 5358] <... symlink resumed>) = 0 [pid 5073] <... getdents64 resumed>0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5358] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5073] umount2("./13/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5358] <... openat resumed>) = 3 [pid 5073] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5358] write(3, "1000", 4 [pid 5073] lstat("./13/binderfs", [pid 5358] <... write resumed>) = 4 [pid 5073] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5358] close(3 [pid 5073] unlink("./13/binderfs" [pid 5358] <... close resumed>) = 0 [pid 5073] <... unlink resumed>) = 0 [pid 5358] symlink("/dev/binderfs", "./binderfs" [ 116.362932][ T5346] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 000000000000000a [ 116.370979][ T5346] [pid 5073] umount2("./13/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5358] <... symlink resumed>) = 0 [pid 5073] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5358] mkdir("./file0", 000 [pid 5073] lstat("./13/cgroup", [pid 5358] <... mkdir resumed>) = 0 [pid 5073] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5358] open("./file0", O_RDONLY [pid 5073] unlink("./13/cgroup" [pid 5358] <... open resumed>) = 3 [pid 5073] <... unlink resumed>) = 0 [pid 5358] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5073] umount2("./13/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5358] <... mount resumed>) = 0 [pid 5073] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5358] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5073] lstat("./13/cgroup.net", [pid 5358] <... openat resumed>) = 4 [pid 5073] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5358] openat(4, "syz1", O_RDWR|O_PATH [pid 5073] unlink("./13/cgroup.net" [pid 5358] <... openat resumed>) = 5 [pid 5073] <... unlink resumed>) = 0 [pid 5358] openat(5, "memory.max", O_RDWR [pid 5073] umount2("./13/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5358] <... openat resumed>) = 6 [pid 5358] write(6, "0x000000000000040e", 18 [pid 5073] <... umount2 resumed>) = 0 [pid 5073] umount2("./13/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./13/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5073] umount2("./13/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] openat(AT_FDCWD, "./13/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5073] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5073] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5073] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5073] close(4) = 0 [pid 5073] rmdir("./13/file0") = 0 [pid 5073] umount2("./13/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./13/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5073] unlink("./13/cgroup.cpu") = 0 [pid 5073] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [ 116.446727][ T5346] memory: usage 12kB, limit 0kB, failcnt 55 [ 116.452718][ T5346] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 116.486682][ T5346] Memory cgroup stats for /syz1: [ 116.486890][ T5346] anon 0 [ 116.486890][ T5346] file 0 [ 116.486890][ T5346] kernel 12288 [ 116.486890][ T5346] kernel_stack 0 [ 116.486890][ T5346] pagetables 0 [ 116.486890][ T5346] sec_pagetables 0 [ 116.486890][ T5346] percpu 0 [ 116.486890][ T5346] sock 0 [ 116.486890][ T5346] vmalloc 0 [ 116.486890][ T5346] shmem 0 [ 116.486890][ T5346] zswap 0 [ 116.486890][ T5346] zswapped 0 [ 116.486890][ T5346] file_mapped 0 [ 116.486890][ T5346] file_dirty 0 [pid 5073] close(3) = 0 [pid 5073] rmdir("./13") = 0 [pid 5073] mkdir("./14", 0777) = 0 [pid 5073] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5361 attached [pid 5361] chdir("./14" [pid 5073] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 16 [pid 5361] <... chdir resumed>) = 0 [pid 5361] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5361] setpgid(0, 0) = 0 [pid 5361] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 5361] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 5361] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [pid 5361] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5361] write(3, "1000", 4) = 4 [pid 5361] close(3) = 0 [ 116.486890][ T5346] file_writeback 0 [ 116.486890][ T5346] swapcached 0 [ 116.486890][ T5346] anon_thp 0 [ 116.486890][ T5346] file_thp 0 [ 116.486890][ T5346] shmem_thp 0 [ 116.486890][ T5346] inactive_anon 0 [ 116.486890][ T5346] active_anon 0 [ 116.486890][ T5346] inactive_file 0 [ 116.486890][ T5346] active_file 0 [ 116.486890][ T5346] unevictable 0 [ 116.486890][ T5346] slab_reclaimable 9328 [ 116.486890][ T5346] slab_unreclaimable 0 [ 116.486890][ T5346] slab 9328 [ 116.486890][ T5346] workingset_refault_anon 0 [pid 5361] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5361] mkdir("./file0", 000) = 0 [pid 5361] open("./file0", O_RDONLY) = 3 [pid 5361] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5361] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5361] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5361] openat(5, "memory.max", O_RDWR) = 6 [pid 5361] write(6, "0x000000000000040e", 18 [pid 5346] <... write resumed>) = 18 [pid 5346] close(3) = 0 [pid 5346] close(4) = 0 [pid 5346] close(5) = 0 [pid 5346] close(6) = 0 [pid 5346] close(7) = -1 EBADF (Bad file descriptor) [pid 5346] close(8) = -1 EBADF (Bad file descriptor) [pid 5346] close(9) = -1 EBADF (Bad file descriptor) [pid 5346] close(10) = -1 EBADF (Bad file descriptor) [ 116.631570][ T5346] Tasks state (memory values in pages): [ 116.640790][ T5346] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 116.653929][ T5346] Out of memory and no killable processes... [ 116.664656][ T5352] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5346] close(11) = -1 EBADF (Bad file descriptor) [pid 5346] close(12) = -1 EBADF (Bad file descriptor) [pid 5346] close(13) = -1 EBADF (Bad file descriptor) [pid 5346] close(14) = -1 EBADF (Bad file descriptor) [pid 5346] close(15) = -1 EBADF (Bad file descriptor) [pid 5346] close(16) = -1 EBADF (Bad file descriptor) [pid 5346] close(17) = -1 EBADF (Bad file descriptor) [pid 5346] close(18) = -1 EBADF (Bad file descriptor) [pid 5346] close(19) = -1 EBADF (Bad file descriptor) [pid 5346] close(20) = -1 EBADF (Bad file descriptor) [pid 5346] close(21) = -1 EBADF (Bad file descriptor) [pid 5346] close(22) = -1 EBADF (Bad file descriptor) [pid 5346] close(23) = -1 EBADF (Bad file descriptor) [ 116.684286][ T5352] CPU: 1 PID: 5352 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 116.694780][ T5352] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 116.704887][ T5352] Call Trace: [ 116.708212][ T5352] [ 116.711193][ T5352] dump_stack_lvl+0x1e7/0x2d0 [ 116.715939][ T5352] ? nf_tcp_handle_invalid+0x640/0x640 [ 116.721454][ T5352] ? panic+0x770/0x770 [ 116.725590][ T5352] dump_header+0xdc/0x940 [ 116.729976][ T5352] out_of_memory+0xf21/0x12c0 [pid 5346] close(24) = -1 EBADF (Bad file descriptor) [pid 5346] close(25) = -1 EBADF (Bad file descriptor) [pid 5346] close(26) = -1 EBADF (Bad file descriptor) [pid 5346] close(27) = -1 EBADF (Bad file descriptor) [pid 5346] close(28) = -1 EBADF (Bad file descriptor) [pid 5346] close(29) = -1 EBADF (Bad file descriptor) [pid 5346] exit_group(0) = ? [pid 5346] +++ exited with 0 +++ [pid 5070] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=12, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- [ 116.734707][ T5352] ? mutex_lock_io_nested+0x60/0x60 [ 116.739964][ T5352] ? preempt_schedule+0xdd/0xf0 [ 116.744869][ T5352] ? unregister_oom_notifier+0x20/0x20 [ 116.750380][ T5352] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 116.756428][ T5352] mem_cgroup_out_of_memory+0x263/0x3b0 [ 116.762021][ T5352] ? preempt_schedule_thunk+0x1a/0x20 [ 116.767421][ T5352] ? mem_cgroup_oom_trylock+0x210/0x210 [ 116.772999][ T5352] ? cgroup_file_notify+0x127/0x190 [ 116.778241][ T5352] memory_max_write+0x355/0x470 [ 116.783119][ T5352] ? memory_max_show+0xa0/0xa0 [ 116.787904][ T5352] ? read_lock_is_recursive+0x20/0x20 [ 116.793295][ T5352] ? memory_max_show+0xa0/0xa0 [ 116.798074][ T5352] cgroup_file_write+0x2b1/0x780 [ 116.803049][ T5352] ? cgroup_seqfile_stop+0xd0/0xd0 [ 116.808175][ T5352] ? __virt_addr_valid+0x22f/0x2e0 [ 116.813326][ T5352] ? cgroup_seqfile_stop+0xd0/0xd0 [ 116.818461][ T5352] kernfs_fop_write_iter+0x3a6/0x4f0 [ 116.823772][ T5352] vfs_write+0x7b2/0xbb0 [ 116.828044][ T5352] ? file_end_write+0x240/0x240 [ 116.832919][ T5352] ? do_raw_spin_unlock+0x13b/0x8b0 [ 116.838134][ T5352] ? lockdep_hardirqs_on+0x98/0x140 [ 116.843361][ T5352] ? __fdget_pos+0x265/0x2f0 [ 116.847974][ T5352] ksys_write+0x1a0/0x2c0 [ 116.852364][ T5352] ? __ia32_sys_read+0x90/0x90 [ 116.857185][ T5352] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 116.863233][ T5352] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 116.869272][ T5352] do_syscall_64+0x41/0xc0 [ 116.873721][ T5352] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 116.879653][ T5352] RIP: 0033:0x7fd49ce20129 [ 116.884082][ T5352] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 116.903700][ T5352] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 116.912127][ T5352] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 116.920131][ T5352] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [pid 5070] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5070] umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5070] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5070] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5070] umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./10/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5070] unlink("./10/binderfs") = 0 [pid 5070] umount2("./10/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./10/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5070] unlink("./10/cgroup") = 0 [ 116.928113][ T5352] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 116.936093][ T5352] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 116.944091][ T5352] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 000000000000000b [ 116.952180][ T5352] [ 116.962856][ T5352] memory: usage 12kB, limit 0kB, failcnt 55 [ 116.970296][ T5352] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [pid 5070] umount2("./10/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./10/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5070] unlink("./10/cgroup.net") = 0 [ 116.978780][ T5352] Memory cgroup stats for /syz1: [ 116.980193][ T5352] anon 0 [ 116.980193][ T5352] file 0 [ 116.980193][ T5352] kernel 12288 [ 116.980193][ T5352] kernel_stack 0 [ 116.980193][ T5352] pagetables 0 [ 116.980193][ T5352] sec_pagetables 0 [ 116.980193][ T5352] percpu 0 [ 116.980193][ T5352] sock 0 [ 116.980193][ T5352] vmalloc 0 [ 116.980193][ T5352] shmem 0 [ 116.980193][ T5352] zswap 0 [ 116.980193][ T5352] zswapped 0 [ 116.980193][ T5352] file_mapped 0 [ 116.980193][ T5352] file_dirty 0 [ 116.980193][ T5352] file_writeback 0 [pid 5070] umount2("./10/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [ 116.980193][ T5352] swapcached 0 [ 116.980193][ T5352] anon_thp 0 [ 116.980193][ T5352] file_thp 0 [ 116.980193][ T5352] shmem_thp 0 [ 116.980193][ T5352] inactive_anon 0 [ 116.980193][ T5352] active_anon 0 [ 116.980193][ T5352] inactive_file 0 [ 116.980193][ T5352] active_file 0 [ 116.980193][ T5352] unevictable 0 [ 116.980193][ T5352] slab_reclaimable 9328 [ 116.980193][ T5352] slab_unreclaimable 0 [ 116.980193][ T5352] slab 9328 [ 116.980193][ T5352] workingset_refault_anon 0 [pid 5070] umount2("./10/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./10/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5070] umount2("./10/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] openat(AT_FDCWD, "./10/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5070] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5070] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5070] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5070] close(4) = 0 [pid 5070] rmdir("./10/file0") = 0 [ 117.081949][ T5352] Tasks state (memory values in pages): [pid 5070] umount2("./10/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./10/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5070] unlink("./10/cgroup.cpu") = 0 [pid 5070] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5070] close(3) = 0 [pid 5070] rmdir("./10") = 0 [pid 5070] mkdir("./11", 0777) = 0 [pid 5070] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5366 attached [pid 5366] chdir("./11" [pid 5070] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 13 [pid 5352] <... write resumed>) = 18 [pid 5352] close(3) = 0 [pid 5352] close(4) = 0 [pid 5352] close(5) = 0 [pid 5352] close(6) = 0 [pid 5352] close(7) = -1 EBADF (Bad file descriptor) [pid 5352] close(8) = -1 EBADF (Bad file descriptor) [pid 5352] close(9) = -1 EBADF (Bad file descriptor) [pid 5352] close(10) = -1 EBADF (Bad file descriptor) [pid 5352] close(11) = -1 EBADF (Bad file descriptor) [pid 5352] close(12) = -1 EBADF (Bad file descriptor) [pid 5352] close(13) = -1 EBADF (Bad file descriptor) [ 117.117592][ T5352] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 117.141360][ T5352] Out of memory and no killable processes... [ 117.156905][ T5355] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5352] close(14) = -1 EBADF (Bad file descriptor) [pid 5352] close(15 [pid 5366] <... chdir resumed>) = 0 [pid 5352] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5352] close(16) = -1 EBADF (Bad file descriptor) [pid 5352] close(17) = -1 EBADF (Bad file descriptor) [pid 5352] close(18) = -1 EBADF (Bad file descriptor) [pid 5352] close(19) = -1 EBADF (Bad file descriptor) [pid 5352] close(20) = -1 EBADF (Bad file descriptor) [pid 5352] close(21) = -1 EBADF (Bad file descriptor) [pid 5352] close(22) = -1 EBADF (Bad file descriptor) [pid 5352] close(23) = -1 EBADF (Bad file descriptor) [pid 5352] close(24) = -1 EBADF (Bad file descriptor) [pid 5352] close(25) = -1 EBADF (Bad file descriptor) [pid 5352] close(26) = -1 EBADF (Bad file descriptor) [pid 5352] close(27) = -1 EBADF (Bad file descriptor) [pid 5352] close(28) = -1 EBADF (Bad file descriptor) [pid 5352] close(29) = -1 EBADF (Bad file descriptor) [pid 5352] exit_group(0) = ? [pid 5352] +++ exited with 0 +++ [pid 5366] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5072] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=13, si_uid=0, si_status=0, si_utime=0, si_stime=12 /* 0.12 s */} --- [pid 5072] umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5072] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5072] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5072] umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./11/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5072] unlink("./11/binderfs") = 0 [pid 5072] umount2("./11/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./11/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5072] unlink("./11/cgroup") = 0 [pid 5072] umount2("./11/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./11/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5072] unlink("./11/cgroup.net") = 0 [ 117.168907][ T5355] CPU: 1 PID: 5355 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 117.179378][ T5355] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 117.189480][ T5355] Call Trace: [ 117.192809][ T5355] [ 117.195793][ T5355] dump_stack_lvl+0x1e7/0x2d0 [ 117.200537][ T5355] ? nf_tcp_handle_invalid+0x640/0x640 [ 117.206053][ T5355] ? panic+0x770/0x770 [ 117.210187][ T5355] dump_header+0xdc/0x940 [ 117.214572][ T5355] out_of_memory+0xf21/0x12c0 [pid 5072] umount2("./11/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5366] <... prctl resumed>) = 0 [pid 5366] setpgid(0, 0) = 0 [pid 5366] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 5366] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 5366] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 5366] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5366] write(3, "1000", 4) = 4 [pid 5366] close(3) = 0 [pid 5366] symlink("/dev/binderfs", "./binderfs") = 0 [ 117.219309][ T5355] ? mutex_lock_io_nested+0x60/0x60 [ 117.224565][ T5355] ? mark_lock+0x9a/0x340 [ 117.228935][ T5355] ? unregister_oom_notifier+0x20/0x20 [ 117.234453][ T5355] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 117.240502][ T5355] mem_cgroup_out_of_memory+0x263/0x3b0 [ 117.246122][ T5355] ? mem_cgroup_oom_trylock+0x210/0x210 [ 117.251770][ T5355] ? cgroup_file_notify+0x10a/0x190 [ 117.257032][ T5355] memory_max_write+0x355/0x470 [ 117.261955][ T5355] ? memory_max_show+0xa0/0xa0 [ 117.266780][ T5355] ? read_lock_is_recursive+0x20/0x20 [ 117.272213][ T5355] ? memory_max_show+0xa0/0xa0 [ 117.277036][ T5355] cgroup_file_write+0x2b1/0x780 [ 117.282026][ T5355] ? cgroup_seqfile_stop+0xd0/0xd0 [ 117.287178][ T5355] ? __virt_addr_valid+0x22f/0x2e0 [ 117.292355][ T5355] ? cgroup_seqfile_stop+0xd0/0xd0 [ 117.297505][ T5355] kernfs_fop_write_iter+0x3a6/0x4f0 [ 117.302847][ T5355] vfs_write+0x7b2/0xbb0 [ 117.307147][ T5355] ? file_end_write+0x240/0x240 [ 117.312052][ T5355] ? do_raw_spin_unlock+0x13b/0x8b0 [ 117.317299][ T5355] ? lockdep_hardirqs_on+0x98/0x140 [ 117.322554][ T5355] ? __fdget_pos+0x265/0x2f0 [ 117.327195][ T5355] ksys_write+0x1a0/0x2c0 [ 117.331578][ T5355] ? __ia32_sys_read+0x90/0x90 [ 117.336384][ T5355] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 117.342421][ T5355] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 117.348454][ T5355] do_syscall_64+0x41/0xc0 [ 117.352919][ T5355] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 117.358986][ T5355] RIP: 0033:0x7fd49ce20129 [ 117.363461][ T5355] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 117.383117][ T5355] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 117.391591][ T5355] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 117.399608][ T5355] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 117.407623][ T5355] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [pid 5366] mkdir("./file0", 000) = 0 [pid 5366] open("./file0", O_RDONLY) = 3 [pid 5366] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5366] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5366] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5366] openat(5, "memory.max", O_RDWR) = 6 [pid 5366] write(6, "0x000000000000040e", 18 [pid 5072] <... umount2 resumed>) = 0 [pid 5072] umount2("./11/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./11/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5072] umount2("./11/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] openat(AT_FDCWD, "./11/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5072] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5072] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [ 117.415635][ T5355] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 117.423654][ T5355] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000011 [ 117.431712][ T5355] [ 117.445963][ T5355] memory: usage 12kB, limit 0kB, failcnt 55 [ 117.452380][ T5355] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 117.460477][ T5355] Memory cgroup stats for /syz1: [ 117.460684][ T5355] anon 0 [ 117.460684][ T5355] file 0 [ 117.460684][ T5355] kernel 12288 [ 117.460684][ T5355] kernel_stack 0 [ 117.460684][ T5355] pagetables 0 [ 117.460684][ T5355] sec_pagetables 0 [ 117.460684][ T5355] percpu 0 [ 117.460684][ T5355] sock 0 [ 117.460684][ T5355] vmalloc 0 [ 117.460684][ T5355] shmem 0 [ 117.460684][ T5355] zswap 0 [ 117.460684][ T5355] zswapped 0 [ 117.460684][ T5355] file_mapped 0 [ 117.460684][ T5355] file_dirty 0 [ 117.460684][ T5355] file_writeback 0 [ 117.460684][ T5355] swapcached 0 [ 117.460684][ T5355] anon_thp 0 [ 117.460684][ T5355] file_thp 0 [pid 5072] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5072] close(4) = 0 [pid 5072] rmdir("./11/file0") = 0 [pid 5072] umount2("./11/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./11/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5072] unlink("./11/cgroup.cpu") = 0 [pid 5072] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5072] close(3) = 0 [pid 5072] rmdir("./11") = 0 [pid 5072] mkdir("./12", 0777) = 0 [pid 5072] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5368 attached [pid 5368] chdir("./12" [pid 5072] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 14 [pid 5368] <... chdir resumed>) = 0 [pid 5368] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5368] setpgid(0, 0) = 0 [pid 5368] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 5368] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [pid 5368] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 5368] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5368] write(3, "1000", 4) = 4 [ 117.460684][ T5355] shmem_thp 0 [ 117.460684][ T5355] inactive_anon 0 [ 117.460684][ T5355] active_anon 0 [ 117.460684][ T5355] inactive_file 0 [ 117.460684][ T5355] active_file 0 [ 117.460684][ T5355] unevictable 0 [ 117.460684][ T5355] slab_reclaimable 9328 [ 117.460684][ T5355] slab_unreclaimable 0 [ 117.460684][ T5355] slab 9328 [ 117.460684][ T5355] workingset_refault_anon 0 [pid 5368] close(3) = 0 [pid 5368] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5368] mkdir("./file0", 000) = 0 [pid 5368] open("./file0", O_RDONLY) = 3 [pid 5368] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5368] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5368] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5368] openat(5, "memory.max", O_RDWR) = 6 [pid 5368] write(6, "0x000000000000040e", 18 [pid 5355] <... write resumed>) = 18 [pid 5355] close(3) = 0 [pid 5355] close(4) = 0 [pid 5355] close(5) = 0 [pid 5355] close(6) = 0 [pid 5355] close(7) = -1 EBADF (Bad file descriptor) [pid 5355] close(8) = -1 EBADF (Bad file descriptor) [pid 5355] close(9) = -1 EBADF (Bad file descriptor) [pid 5355] close(10) = -1 EBADF (Bad file descriptor) [pid 5355] close(11) = -1 EBADF (Bad file descriptor) [pid 5355] close(12) = -1 EBADF (Bad file descriptor) [ 117.625565][ T5355] Tasks state (memory values in pages): [ 117.633364][ T5355] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 117.645175][ T5355] Out of memory and no killable processes... [ 117.653654][ T5358] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 117.690474][ T5358] CPU: 0 PID: 5358 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 117.700965][ T5358] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 117.711059][ T5358] Call Trace: [ 117.714382][ T5358] [ 117.717345][ T5358] dump_stack_lvl+0x1e7/0x2d0 [ 117.722075][ T5358] ? nf_tcp_handle_invalid+0x640/0x640 [ 117.727579][ T5358] ? panic+0x770/0x770 [ 117.731706][ T5358] dump_header+0xdc/0x940 [ 117.736089][ T5358] out_of_memory+0xf21/0x12c0 [ 117.740812][ T5358] ? mutex_lock_io_nested+0x60/0x60 [ 117.746070][ T5358] ? preempt_schedule+0xdd/0xf0 [ 117.751003][ T5358] ? unregister_oom_notifier+0x20/0x20 [ 117.756497][ T5358] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 117.762515][ T5358] mem_cgroup_out_of_memory+0x263/0x3b0 [ 117.768091][ T5358] ? preempt_schedule_thunk+0x1a/0x20 [ 117.773497][ T5358] ? mem_cgroup_oom_trylock+0x210/0x210 [ 117.779082][ T5358] ? cgroup_file_notify+0x127/0x190 [ 117.784305][ T5358] memory_max_write+0x355/0x470 [ 117.789199][ T5358] ? memory_max_show+0xa0/0xa0 [ 117.793979][ T5358] ? read_lock_is_recursive+0x20/0x20 [ 117.799376][ T5358] ? memory_max_show+0xa0/0xa0 [ 117.804154][ T5358] cgroup_file_write+0x2b1/0x780 [ 117.809109][ T5358] ? cgroup_seqfile_stop+0xd0/0xd0 [ 117.814232][ T5358] ? __virt_addr_valid+0x22f/0x2e0 [ 117.819370][ T5358] ? cgroup_seqfile_stop+0xd0/0xd0 [ 117.824492][ T5358] kernfs_fop_write_iter+0x3a6/0x4f0 [ 117.829800][ T5358] vfs_write+0x7b2/0xbb0 [ 117.834065][ T5358] ? file_end_write+0x240/0x240 [ 117.838929][ T5358] ? do_raw_spin_unlock+0x13b/0x8b0 [ 117.844138][ T5358] ? lockdep_hardirqs_on+0x98/0x140 [ 117.849365][ T5358] ? __fdget_pos+0x265/0x2f0 [ 117.853976][ T5358] ksys_write+0x1a0/0x2c0 [ 117.858322][ T5358] ? __ia32_sys_read+0x90/0x90 [ 117.863097][ T5358] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 117.869099][ T5358] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 117.875122][ T5358] do_syscall_64+0x41/0xc0 [ 117.879569][ T5358] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 117.885497][ T5358] RIP: 0033:0x7fd49ce20129 [ 117.889935][ T5358] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 117.909579][ T5358] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 117.918019][ T5358] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 117.926018][ T5358] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 117.933998][ T5358] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [pid 5355] close(13) = -1 EBADF (Bad file descriptor) [pid 5355] close(14) = -1 EBADF (Bad file descriptor) [pid 5355] close(15) = -1 EBADF (Bad file descriptor) [pid 5355] close(16) = -1 EBADF (Bad file descriptor) [pid 5355] close(17) = -1 EBADF (Bad file descriptor) [pid 5355] close(18) = -1 EBADF (Bad file descriptor) [pid 5355] close(19) = -1 EBADF (Bad file descriptor) [pid 5355] close(20) = -1 EBADF (Bad file descriptor) [pid 5355] close(21) = -1 EBADF (Bad file descriptor) [pid 5355] close(22) = -1 EBADF (Bad file descriptor) [ 117.941981][ T5358] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 117.949963][ T5358] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000011 [ 117.957962][ T5358] [ 117.964766][ T5358] memory: usage 12kB, limit 0kB, failcnt 55 [ 117.977312][ T5358] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 117.984367][ T5358] Memory cgroup stats for /syz1: [pid 5355] close(23) = -1 EBADF (Bad file descriptor) [pid 5355] close(24) = -1 EBADF (Bad file descriptor) [pid 5355] close(25) = -1 EBADF (Bad file descriptor) [pid 5355] close(26) = -1 EBADF (Bad file descriptor) [pid 5355] close(27) = -1 EBADF (Bad file descriptor) [pid 5355] close(28) = -1 EBADF (Bad file descriptor) [pid 5355] close(29) = -1 EBADF (Bad file descriptor) [pid 5355] exit_group(0) = ? [pid 5355] +++ exited with 0 +++ [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=19, si_uid=0, si_status=0, si_utime=0, si_stime=10 /* 0.10 s */} --- [pid 5074] restart_syscall(<... resuming interrupted clone ...>) = 0 [ 117.984559][ T5358] anon 0 [ 117.984559][ T5358] file 0 [ 117.984559][ T5358] kernel 12288 [ 117.984559][ T5358] kernel_stack 0 [ 117.984559][ T5358] pagetables 0 [ 117.984559][ T5358] sec_pagetables 0 [ 117.984559][ T5358] percpu 0 [ 117.984559][ T5358] sock 0 [ 117.984559][ T5358] vmalloc 0 [ 117.984559][ T5358] shmem 0 [ 117.984559][ T5358] zswap 0 [ 117.984559][ T5358] zswapped 0 [ 117.984559][ T5358] file_mapped 0 [ 117.984559][ T5358] file_dirty 0 [ 117.984559][ T5358] file_writeback 0 [ 117.984559][ T5358] swapcached 0 [ 117.984559][ T5358] anon_thp 0 [pid 5074] umount2("./17", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5074] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5074] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5074] umount2("./17/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./17/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5074] unlink("./17/binderfs") = 0 [pid 5074] umount2("./17/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./17/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5074] unlink("./17/cgroup") = 0 [pid 5074] umount2("./17/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./17/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5074] unlink("./17/cgroup.net") = 0 [ 117.984559][ T5358] file_thp 0 [ 117.984559][ T5358] shmem_thp 0 [ 117.984559][ T5358] inactive_anon 0 [ 117.984559][ T5358] active_anon 0 [ 117.984559][ T5358] inactive_file 0 [ 117.984559][ T5358] active_file 0 [ 117.984559][ T5358] unevictable 0 [ 117.984559][ T5358] slab_reclaimable 9328 [ 117.984559][ T5358] slab_unreclaimable 0 [ 117.984559][ T5358] slab 9328 [ 117.984559][ T5358] workingset_refault_anon 0 [pid 5074] umount2("./17/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5074] umount2("./17/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./17/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5074] umount2("./17/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5358] <... write resumed>) = 18 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5358] close(3 [pid 5074] openat(AT_FDCWD, "./17/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5358] <... close resumed>) = 0 [pid 5358] close(4) = 0 [pid 5358] close(5) = 0 [pid 5358] close(6) = 0 [pid 5074] <... openat resumed>) = 4 [pid 5074] fstat(4, [pid 5358] close(7 [pid 5074] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5074] getdents64(4, [pid 5358] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5358] close(8 [pid 5074] <... getdents64 resumed>0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5358] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5074] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5074] close(4) = 0 [pid 5074] rmdir("./17/file0" [pid 5358] close(9) = -1 EBADF (Bad file descriptor) [pid 5358] close(10) = -1 EBADF (Bad file descriptor) [pid 5074] <... rmdir resumed>) = 0 [pid 5074] umount2("./17/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5358] close(11) = -1 EBADF (Bad file descriptor) [pid 5358] close(12 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./17/cgroup.cpu", [pid 5358] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5074] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5074] unlink("./17/cgroup.cpu" [pid 5358] close(13) = -1 EBADF (Bad file descriptor) [pid 5074] <... unlink resumed>) = 0 [pid 5074] getdents64(3, [pid 5358] close(14 [pid 5074] <... getdents64 resumed>0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5074] close(3 [pid 5358] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5074] <... close resumed>) = 0 [pid 5358] close(15 [pid 5074] rmdir("./17" [pid 5358] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5358] close(16) = -1 EBADF (Bad file descriptor) [pid 5358] close(17) = -1 EBADF (Bad file descriptor) [pid 5358] close(18) = -1 EBADF (Bad file descriptor) [pid 5358] close(19) = -1 EBADF (Bad file descriptor) [pid 5358] close(20) = -1 EBADF (Bad file descriptor) [pid 5358] close(21) = -1 EBADF (Bad file descriptor) [pid 5358] close(22) = -1 EBADF (Bad file descriptor) [pid 5074] <... rmdir resumed>) = 0 [pid 5074] mkdir("./18", 0777 [pid 5358] close(23) = -1 EBADF (Bad file descriptor) [pid 5358] close(24) = -1 EBADF (Bad file descriptor) [pid 5358] close(25) = -1 EBADF (Bad file descriptor) [pid 5358] close(26 [pid 5074] <... mkdir resumed>) = 0 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5358] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5358] close(27) = -1 EBADF (Bad file descriptor) ./strace-static-x86_64: Process 5373 attached [pid 5358] close(28 [pid 5373] chdir("./18" [pid 5358] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5373] <... chdir resumed>) = 0 [pid 5358] close(29 [pid 5074] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 20 [pid 5373] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5358] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5373] <... prctl resumed>) = 0 [ 118.088656][ T5358] Tasks state (memory values in pages): [ 118.094429][ T5358] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 118.106350][ T5358] Out of memory and no killable processes... [ 118.113736][ T5361] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 118.166980][ T5361] CPU: 1 PID: 5361 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 118.177491][ T5361] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 118.187589][ T5361] Call Trace: [ 118.190886][ T5361] [ 118.193831][ T5361] dump_stack_lvl+0x1e7/0x2d0 [ 118.198534][ T5361] ? nf_tcp_handle_invalid+0x640/0x640 [ 118.204051][ T5361] ? panic+0x770/0x770 [ 118.208181][ T5361] dump_header+0xdc/0x940 [ 118.212551][ T5361] out_of_memory+0xf21/0x12c0 [ 118.217259][ T5361] ? mutex_lock_io_nested+0x60/0x60 [ 118.222493][ T5361] ? mark_lock+0x9a/0x340 [ 118.226841][ T5361] ? unregister_oom_notifier+0x20/0x20 [ 118.232321][ T5361] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 118.238332][ T5361] mem_cgroup_out_of_memory+0x263/0x3b0 [ 118.243906][ T5361] ? mem_cgroup_oom_trylock+0x210/0x210 [ 118.249482][ T5361] ? cgroup_file_notify+0x127/0x190 [ 118.254703][ T5361] memory_max_write+0x355/0x470 [ 118.259596][ T5361] ? memory_max_show+0xa0/0xa0 [ 118.264378][ T5361] ? read_lock_is_recursive+0x20/0x20 [ 118.269770][ T5361] ? memory_max_show+0xa0/0xa0 [ 118.274547][ T5361] cgroup_file_write+0x2b1/0x780 [ 118.279503][ T5361] ? cgroup_seqfile_stop+0xd0/0xd0 [ 118.284643][ T5361] ? __virt_addr_valid+0x22f/0x2e0 [ 118.289813][ T5361] ? cgroup_seqfile_stop+0xd0/0xd0 [ 118.294938][ T5361] kernfs_fop_write_iter+0x3a6/0x4f0 [ 118.300261][ T5361] vfs_write+0x7b2/0xbb0 [ 118.304530][ T5361] ? file_end_write+0x240/0x240 [ 118.309400][ T5361] ? do_raw_spin_unlock+0x13b/0x8b0 [ 118.314613][ T5361] ? lockdep_hardirqs_on+0x98/0x140 [ 118.319835][ T5361] ? __fdget_pos+0x265/0x2f0 [ 118.324438][ T5361] ksys_write+0x1a0/0x2c0 [ 118.328788][ T5361] ? __ia32_sys_read+0x90/0x90 [ 118.333563][ T5361] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 118.339565][ T5361] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 118.345583][ T5361] do_syscall_64+0x41/0xc0 [ 118.350032][ T5361] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 118.355968][ T5361] RIP: 0033:0x7fd49ce20129 [ 118.360392][ T5361] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 118.380011][ T5361] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 118.388456][ T5361] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 118.396436][ T5361] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 118.404416][ T5361] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [pid 5358] exit_group(0 [pid 5373] setpgid(0, 0 [pid 5358] <... exit_group resumed>) = ? [pid 5373] <... setpgid resumed>) = 0 [pid 5358] +++ exited with 0 +++ [pid 5373] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=19, si_uid=0, si_status=0, si_utime=0, si_stime=7 /* 0.07 s */} --- [pid 5373] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 5075] restart_syscall(<... resuming interrupted clone ...> [pid 5373] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 5075] <... restart_syscall resumed>) = 0 [pid 5373] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5373] write(3, "1000", 4) = 4 [pid 5373] close(3) = 0 [pid 5373] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5373] mkdir("./file0", 000 [pid 5075] umount2("./17", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5373] <... mkdir resumed>) = 0 [pid 5373] open("./file0", O_RDONLY) = 3 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5373] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5075] openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5373] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5373] openat(4, "syz1", O_RDWR|O_PATH [pid 5075] <... openat resumed>) = 3 [pid 5373] <... openat resumed>) = 5 [pid 5373] openat(5, "memory.max", O_RDWR) = 6 [pid 5075] fstat(3, [pid 5373] write(6, "0x000000000000040e", 18 [pid 5075] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [ 118.412401][ T5361] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 118.420390][ T5361] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 000000000000000e [ 118.428388][ T5361] [pid 5075] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5075] umount2("./17/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./17/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5075] unlink("./17/binderfs") = 0 [pid 5075] umount2("./17/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./17/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5075] unlink("./17/cgroup") = 0 [pid 5075] umount2("./17/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./17/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5075] unlink("./17/cgroup.net") = 0 [ 118.495256][ T5361] memory: usage 12kB, limit 0kB, failcnt 55 [ 118.504193][ T5361] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 118.517976][ T5361] Memory cgroup stats for /syz1: [ 118.518192][ T5361] anon 0 [ 118.518192][ T5361] file 0 [ 118.518192][ T5361] kernel 12288 [ 118.518192][ T5361] kernel_stack 0 [ 118.518192][ T5361] pagetables 0 [ 118.518192][ T5361] sec_pagetables 0 [ 118.518192][ T5361] percpu 0 [ 118.518192][ T5361] sock 0 [ 118.518192][ T5361] vmalloc 0 [ 118.518192][ T5361] shmem 0 [ 118.518192][ T5361] zswap 0 [ 118.518192][ T5361] zswapped 0 [ 118.518192][ T5361] file_mapped 0 [ 118.518192][ T5361] file_dirty 0 [ 118.518192][ T5361] file_writeback 0 [ 118.518192][ T5361] swapcached 0 [ 118.518192][ T5361] anon_thp 0 [ 118.518192][ T5361] file_thp 0 [ 118.518192][ T5361] shmem_thp 0 [ 118.518192][ T5361] inactive_anon 0 [ 118.518192][ T5361] active_anon 0 [ 118.518192][ T5361] inactive_file 0 [ 118.518192][ T5361] active_file 0 [pid 5075] umount2("./17/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5075] umount2("./17/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./17/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5075] umount2("./17/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] openat(AT_FDCWD, "./17/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5075] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5075] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5075] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5075] close(4) = 0 [pid 5075] rmdir("./17/file0") = 0 [pid 5075] umount2("./17/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./17/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [ 118.518192][ T5361] unevictable 0 [ 118.518192][ T5361] slab_reclaimable 9328 [ 118.518192][ T5361] slab_unreclaimable 0 [ 118.518192][ T5361] slab 9328 [ 118.518192][ T5361] workingset_refault_anon 0 [pid 5075] unlink("./17/cgroup.cpu") = 0 [pid 5075] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5075] close(3) = 0 [pid 5075] rmdir("./17") = 0 [pid 5075] mkdir("./18", 0777) = 0 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555574ac5d0) = 20 ./strace-static-x86_64: Process 5377 attached [pid 5377] chdir("./18") = 0 [pid 5377] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5377] setpgid(0, 0) = 0 [pid 5377] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 5377] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 5377] symlink("/syzcgroup/net/syz2", "./cgroup.net" [pid 5361] <... write resumed>) = 18 [pid 5377] <... symlink resumed>) = 0 [pid 5377] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5361] close(3 [pid 5377] <... openat resumed>) = 3 [pid 5361] <... close resumed>) = 0 [pid 5377] write(3, "1000", 4 [pid 5361] close(4 [pid 5377] <... write resumed>) = 4 [pid 5361] <... close resumed>) = 0 [pid 5377] close(3 [pid 5361] close(5 [pid 5377] <... close resumed>) = 0 [pid 5361] <... close resumed>) = 0 [pid 5377] symlink("/dev/binderfs", "./binderfs" [pid 5361] close(6 [pid 5377] <... symlink resumed>) = 0 [pid 5361] <... close resumed>) = 0 [pid 5377] mkdir("./file0", 000 [pid 5361] close(7 [pid 5377] <... mkdir resumed>) = 0 [pid 5361] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5377] open("./file0", O_RDONLY [ 118.645833][ T5361] Tasks state (memory values in pages): [ 118.651914][ T5361] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 118.670868][ T5361] Out of memory and no killable processes... [ 118.681190][ T5366] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5361] close(8 [pid 5377] <... open resumed>) = 3 [pid 5361] <... close resumed>) = -1 EBADF (Bad file descriptor) [ 118.712660][ T5366] CPU: 0 PID: 5366 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 118.723167][ T5366] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 118.733270][ T5366] Call Trace: [ 118.736585][ T5366] [ 118.739555][ T5366] dump_stack_lvl+0x1e7/0x2d0 [ 118.744309][ T5366] ? nf_tcp_handle_invalid+0x640/0x640 [ 118.749821][ T5366] ? panic+0x770/0x770 [ 118.754046][ T5366] dump_header+0xdc/0x940 [ 118.758437][ T5366] out_of_memory+0xf21/0x12c0 [ 118.763164][ T5366] ? mutex_lock_io_nested+0x60/0x60 [ 118.768417][ T5366] ? preempt_schedule+0xdd/0xf0 [ 118.773318][ T5366] ? unregister_oom_notifier+0x20/0x20 [ 118.778834][ T5366] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 118.784879][ T5366] mem_cgroup_out_of_memory+0x263/0x3b0 [ 118.790562][ T5366] ? preempt_schedule_thunk+0x1a/0x20 [ 118.795997][ T5366] ? mem_cgroup_oom_trylock+0x210/0x210 [ 118.801610][ T5366] ? cgroup_file_notify+0x127/0x190 [ 118.806866][ T5366] memory_max_write+0x355/0x470 [ 118.811780][ T5366] ? memory_max_show+0xa0/0xa0 [ 118.816593][ T5366] ? read_lock_is_recursive+0x20/0x20 [ 118.822016][ T5366] ? memory_max_show+0xa0/0xa0 [ 118.826827][ T5366] cgroup_file_write+0x2b1/0x780 [ 118.831823][ T5366] ? cgroup_seqfile_stop+0xd0/0xd0 [ 118.836991][ T5366] ? __virt_addr_valid+0x22f/0x2e0 [ 118.842180][ T5366] ? cgroup_seqfile_stop+0xd0/0xd0 [ 118.847337][ T5366] kernfs_fop_write_iter+0x3a6/0x4f0 [ 118.852682][ T5366] vfs_write+0x7b2/0xbb0 [ 118.856985][ T5366] ? file_end_write+0x240/0x240 [ 118.861897][ T5366] ? do_raw_spin_unlock+0x13b/0x8b0 [ 118.867164][ T5366] ? lockdep_hardirqs_on+0x98/0x140 [ 118.872417][ T5366] ? __fdget_pos+0x265/0x2f0 [ 118.877063][ T5366] ksys_write+0x1a0/0x2c0 [ 118.881458][ T5366] ? __ia32_sys_read+0x90/0x90 [ 118.886285][ T5366] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 118.892325][ T5366] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 118.898395][ T5366] do_syscall_64+0x41/0xc0 [ 118.902870][ T5366] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 118.908821][ T5366] RIP: 0033:0x7fd49ce20129 [ 118.913280][ T5366] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 118.932933][ T5366] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 118.941407][ T5366] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 118.949429][ T5366] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [pid 5377] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5377] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5377] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5377] openat(5, "memory.max", O_RDWR) = 6 [pid 5377] write(6, "0x000000000000040e", 18 [pid 5361] close(9) = -1 EBADF (Bad file descriptor) [pid 5361] close(10) = -1 EBADF (Bad file descriptor) [pid 5361] close(11) = -1 EBADF (Bad file descriptor) [pid 5361] close(12) = -1 EBADF (Bad file descriptor) [pid 5361] close(13) = -1 EBADF (Bad file descriptor) [pid 5361] close(14) = -1 EBADF (Bad file descriptor) [pid 5361] close(15) = -1 EBADF (Bad file descriptor) [pid 5361] close(16) = -1 EBADF (Bad file descriptor) [pid 5361] close(17) = -1 EBADF (Bad file descriptor) [ 118.957445][ T5366] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 118.965458][ T5366] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 118.973474][ T5366] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 000000000000000b [ 118.981538][ T5366] [pid 5361] close(18) = -1 EBADF (Bad file descriptor) [pid 5361] close(19) = -1 EBADF (Bad file descriptor) [pid 5361] close(20) = -1 EBADF (Bad file descriptor) [pid 5361] close(21) = -1 EBADF (Bad file descriptor) [pid 5361] close(22) = -1 EBADF (Bad file descriptor) [pid 5361] close(23) = -1 EBADF (Bad file descriptor) [pid 5361] close(24) = -1 EBADF (Bad file descriptor) [pid 5361] close(25) = -1 EBADF (Bad file descriptor) [pid 5361] close(26) = -1 EBADF (Bad file descriptor) [pid 5361] close(27) = -1 EBADF (Bad file descriptor) [pid 5361] close(28) = -1 EBADF (Bad file descriptor) [ 119.024623][ T5366] memory: usage 12kB, limit 0kB, failcnt 55 [ 119.033770][ T5366] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 119.045368][ T5366] Memory cgroup stats for /syz1: [ 119.045634][ T5366] anon 0 [ 119.045634][ T5366] file 0 [ 119.045634][ T5366] kernel 12288 [ 119.045634][ T5366] kernel_stack 0 [ 119.045634][ T5366] pagetables 0 [ 119.045634][ T5366] sec_pagetables 0 [ 119.045634][ T5366] percpu 0 [pid 5361] close(29) = -1 EBADF (Bad file descriptor) [pid 5361] exit_group(0) = ? [pid 5361] +++ exited with 0 +++ [pid 5073] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=16, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- [pid 5073] umount2("./14", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5073] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5073] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5073] umount2("./14/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./14/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5073] unlink("./14/binderfs") = 0 [pid 5073] umount2("./14/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./14/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5073] unlink("./14/cgroup") = 0 [pid 5073] umount2("./14/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./14/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5073] unlink("./14/cgroup.net") = 0 [ 119.045634][ T5366] sock 0 [ 119.045634][ T5366] vmalloc 0 [ 119.045634][ T5366] shmem 0 [ 119.045634][ T5366] zswap 0 [ 119.045634][ T5366] zswapped 0 [ 119.045634][ T5366] file_mapped 0 [ 119.045634][ T5366] file_dirty 0 [ 119.045634][ T5366] file_writeback 0 [ 119.045634][ T5366] swapcached 0 [ 119.045634][ T5366] anon_thp 0 [ 119.045634][ T5366] file_thp 0 [ 119.045634][ T5366] shmem_thp 0 [ 119.045634][ T5366] inactive_anon 0 [ 119.045634][ T5366] active_anon 0 [ 119.045634][ T5366] inactive_file 0 [ 119.045634][ T5366] active_file 0 [pid 5073] umount2("./14/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5073] umount2("./14/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./14/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5073] umount2("./14/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] openat(AT_FDCWD, "./14/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5073] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5073] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5073] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5073] close(4) = 0 [pid 5073] rmdir("./14/file0") = 0 [pid 5073] umount2("./14/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./14/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5073] unlink("./14/cgroup.cpu") = 0 [pid 5073] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5073] close(3) = 0 [pid 5073] rmdir("./14") = 0 [pid 5073] mkdir("./15", 0777) = 0 [ 119.045634][ T5366] unevictable 0 [ 119.045634][ T5366] slab_reclaimable 9328 [ 119.045634][ T5366] slab_unreclaimable 0 [ 119.045634][ T5366] slab 9328 [ 119.045634][ T5366] workingset_refault_anon 0 [ 119.147156][ T5366] Tasks state (memory values in pages): [ 119.153582][ T5366] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5073] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5384 attached [pid 5384] chdir("./15" [pid 5073] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 17 [pid 5384] <... chdir resumed>) = 0 [pid 5384] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5384] setpgid(0, 0) = 0 [pid 5384] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 5384] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 5384] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [pid 5384] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5384] write(3, "1000", 4) = 4 [pid 5384] close(3) = 0 [pid 5384] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5384] mkdir("./file0", 000) = 0 [pid 5384] open("./file0", O_RDONLY) = 3 [pid 5384] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5366] <... write resumed>) = 18 [pid 5366] close(3 [pid 5384] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5366] <... close resumed>) = 0 [pid 5366] close(4 [pid 5384] <... openat resumed>) = 4 [pid 5384] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5384] openat(5, "memory.max", O_RDWR) = 6 [ 119.184755][ T5366] Out of memory and no killable processes... [ 119.199998][ T5368] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 119.219261][ T5368] CPU: 0 PID: 5368 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 119.229755][ T5368] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 119.239848][ T5368] Call Trace: [ 119.243156][ T5368] [ 119.246119][ T5368] dump_stack_lvl+0x1e7/0x2d0 [ 119.250855][ T5368] ? nf_tcp_handle_invalid+0x640/0x640 [ 119.256373][ T5368] ? panic+0x770/0x770 [ 119.260520][ T5368] dump_header+0xdc/0x940 [ 119.264906][ T5368] out_of_memory+0xf21/0x12c0 [ 119.269640][ T5368] ? mutex_lock_io_nested+0x60/0x60 [ 119.274894][ T5368] ? mark_lock+0x9a/0x340 [ 119.279269][ T5368] ? unregister_oom_notifier+0x20/0x20 [ 119.284788][ T5368] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 119.290894][ T5368] mem_cgroup_out_of_memory+0x263/0x3b0 [ 119.296466][ T5368] ? mem_cgroup_oom_trylock+0x210/0x210 [ 119.302047][ T5368] ? cgroup_file_notify+0x127/0x190 [ 119.307274][ T5368] memory_max_write+0x355/0x470 [ 119.312149][ T5368] ? memory_max_show+0xa0/0xa0 [ 119.316952][ T5368] ? read_lock_is_recursive+0x20/0x20 [ 119.322348][ T5368] ? memory_max_show+0xa0/0xa0 [ 119.327132][ T5368] cgroup_file_write+0x2b1/0x780 [ 119.332096][ T5368] ? cgroup_seqfile_stop+0xd0/0xd0 [ 119.337219][ T5368] ? __virt_addr_valid+0x22f/0x2e0 [ 119.342361][ T5368] ? cgroup_seqfile_stop+0xd0/0xd0 [ 119.347484][ T5368] kernfs_fop_write_iter+0x3a6/0x4f0 [ 119.352804][ T5368] vfs_write+0x7b2/0xbb0 [ 119.357072][ T5368] ? file_end_write+0x240/0x240 [ 119.361942][ T5368] ? do_raw_spin_unlock+0x13b/0x8b0 [ 119.367262][ T5368] ? lockdep_hardirqs_on+0x98/0x140 [ 119.372487][ T5368] ? __fdget_pos+0x265/0x2f0 [ 119.377106][ T5368] ksys_write+0x1a0/0x2c0 [ 119.381454][ T5368] ? __ia32_sys_read+0x90/0x90 [ 119.386248][ T5368] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 119.392253][ T5368] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 119.398257][ T5368] do_syscall_64+0x41/0xc0 [ 119.402691][ T5368] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 119.408623][ T5368] RIP: 0033:0x7fd49ce20129 [ 119.413050][ T5368] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 119.432680][ T5368] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 119.441109][ T5368] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 119.449091][ T5368] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 119.457070][ T5368] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 119.465048][ T5368] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 119.473027][ T5368] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 000000000000000c [ 119.481027][ T5368] [pid 5384] write(6, "0x000000000000040e", 18 [pid 5366] <... close resumed>) = 0 [pid 5366] close(5) = 0 [pid 5366] close(6) = 0 [ 119.487326][ T5368] memory: usage 12kB, limit 0kB, failcnt 55 [ 119.493519][ T5368] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 119.500728][ T5368] Memory cgroup stats for /syz1: [ 119.501178][ T5368] anon 0 [ 119.501178][ T5368] file 0 [ 119.501178][ T5368] kernel 12288 [ 119.501178][ T5368] kernel_stack 0 [ 119.501178][ T5368] pagetables 0 [ 119.501178][ T5368] sec_pagetables 0 [ 119.501178][ T5368] percpu 0 [ 119.501178][ T5368] sock 0 [ 119.501178][ T5368] vmalloc 0 [ 119.501178][ T5368] shmem 0 [ 119.501178][ T5368] zswap 0 [ 119.501178][ T5368] zswapped 0 [ 119.501178][ T5368] file_mapped 0 [ 119.501178][ T5368] file_dirty 0 [ 119.501178][ T5368] file_writeback 0 [ 119.501178][ T5368] swapcached 0 [ 119.501178][ T5368] anon_thp 0 [ 119.501178][ T5368] file_thp 0 [ 119.501178][ T5368] shmem_thp 0 [ 119.501178][ T5368] inactive_anon 0 [ 119.501178][ T5368] active_anon 0 [ 119.501178][ T5368] inactive_file 0 [ 119.501178][ T5368] active_file 0 [ 119.501178][ T5368] unevictable 0 [ 119.501178][ T5368] slab_reclaimable 9328 [pid 5366] close(7) = -1 EBADF (Bad file descriptor) [pid 5366] close(8) = -1 EBADF (Bad file descriptor) [pid 5366] close(9) = -1 EBADF (Bad file descriptor) [pid 5366] close(10) = -1 EBADF (Bad file descriptor) [pid 5366] close(11) = -1 EBADF (Bad file descriptor) [pid 5366] close(12) = -1 EBADF (Bad file descriptor) [pid 5366] close(13) = -1 EBADF (Bad file descriptor) [pid 5366] close(14) = -1 EBADF (Bad file descriptor) [pid 5366] close(15) = -1 EBADF (Bad file descriptor) [pid 5366] close(16) = -1 EBADF (Bad file descriptor) [pid 5366] close(17) = -1 EBADF (Bad file descriptor) [pid 5366] close(18) = -1 EBADF (Bad file descriptor) [pid 5366] close(19) = -1 EBADF (Bad file descriptor) [pid 5366] close(20) = -1 EBADF (Bad file descriptor) [pid 5366] close(21) = -1 EBADF (Bad file descriptor) [pid 5366] close(22) = -1 EBADF (Bad file descriptor) [pid 5366] close(23) = -1 EBADF (Bad file descriptor) [pid 5366] close(24) = -1 EBADF (Bad file descriptor) [pid 5366] close(25) = -1 EBADF (Bad file descriptor) [pid 5366] close(26) = -1 EBADF (Bad file descriptor) [pid 5366] close(27) = -1 EBADF (Bad file descriptor) [pid 5366] close(28) = -1 EBADF (Bad file descriptor) [pid 5366] close(29) = -1 EBADF (Bad file descriptor) [pid 5366] exit_group(0) = ? [pid 5366] +++ exited with 0 +++ [ 119.501178][ T5368] slab_unreclaimable 0 [ 119.501178][ T5368] slab 9328 [ 119.501178][ T5368] workingset_refault_anon 0 [ 119.600418][ T5368] Tasks state (memory values in pages): [ 119.606484][ T5368] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 119.623812][ T5368] Out of memory and no killable processes... [pid 5070] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=13, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- [pid 5070] umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5368] <... write resumed>) = 18 [pid 5070] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5368] close(3 [pid 5070] <... openat resumed>) = 3 [pid 5070] fstat(3, [pid 5368] <... close resumed>) = 0 [pid 5368] close(4 [pid 5070] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5368] <... close resumed>) = 0 [pid 5070] getdents64(3, [pid 5368] close(5 [pid 5070] <... getdents64 resumed>0x5555574ad620 /* 7 entries */, 32768) = 208 [ 119.630343][ T5373] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 119.652408][ T5373] CPU: 0 PID: 5373 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 119.662905][ T5373] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 119.673042][ T5373] Call Trace: [ 119.676362][ T5373] [ 119.679330][ T5373] dump_stack_lvl+0x1e7/0x2d0 [pid 5070] umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./11/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5070] unlink("./11/binderfs") = 0 [pid 5070] umount2("./11/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./11/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5070] unlink("./11/cgroup") = 0 [pid 5070] umount2("./11/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./11/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5070] unlink("./11/cgroup.net") = 0 [ 119.684066][ T5373] ? nf_tcp_handle_invalid+0x640/0x640 [ 119.689581][ T5373] ? panic+0x770/0x770 [ 119.693722][ T5373] dump_header+0xdc/0x940 [ 119.698114][ T5373] out_of_memory+0xf21/0x12c0 [ 119.702855][ T5373] ? mutex_lock_io_nested+0x60/0x60 [ 119.708117][ T5373] ? preempt_schedule+0xdd/0xf0 [ 119.713020][ T5373] ? unregister_oom_notifier+0x20/0x20 [ 119.718532][ T5373] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 119.724574][ T5373] mem_cgroup_out_of_memory+0x263/0x3b0 [ 119.730176][ T5373] ? preempt_schedule_thunk+0x1a/0x20 [ 119.735604][ T5373] ? mem_cgroup_oom_trylock+0x210/0x210 [ 119.741223][ T5373] ? cgroup_file_notify+0x127/0x190 [ 119.746499][ T5373] memory_max_write+0x355/0x470 [ 119.751396][ T5373] ? memory_max_show+0xa0/0xa0 [ 119.756184][ T5373] ? read_lock_is_recursive+0x20/0x20 [ 119.761607][ T5373] ? memory_max_show+0xa0/0xa0 [ 119.766394][ T5373] cgroup_file_write+0x2b1/0x780 [ 119.771362][ T5373] ? cgroup_seqfile_stop+0xd0/0xd0 [ 119.776487][ T5373] ? __virt_addr_valid+0x22f/0x2e0 [ 119.781634][ T5373] ? cgroup_seqfile_stop+0xd0/0xd0 [ 119.786755][ T5373] kernfs_fop_write_iter+0x3a6/0x4f0 [ 119.792067][ T5373] vfs_write+0x7b2/0xbb0 [ 119.796352][ T5373] ? file_end_write+0x240/0x240 [ 119.801227][ T5373] ? do_raw_spin_unlock+0x13b/0x8b0 [ 119.806444][ T5373] ? lockdep_hardirqs_on+0x98/0x140 [ 119.811669][ T5373] ? __fdget_pos+0x265/0x2f0 [ 119.816293][ T5373] ksys_write+0x1a0/0x2c0 [ 119.820642][ T5373] ? __ia32_sys_read+0x90/0x90 [ 119.825419][ T5373] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 119.831475][ T5373] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 119.837524][ T5373] do_syscall_64+0x41/0xc0 [ 119.841969][ T5373] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 119.847887][ T5373] RIP: 0033:0x7fd49ce20129 [ 119.852312][ T5373] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 119.871948][ T5373] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 119.880398][ T5373] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [pid 5070] umount2("./11/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5368] <... close resumed>) = 0 [pid 5070] <... umount2 resumed>) = 0 [pid 5368] close(6) = 0 [pid 5368] close(7) = -1 EBADF (Bad file descriptor) [pid 5368] close(8) = -1 EBADF (Bad file descriptor) [pid 5368] close(9 [pid 5070] umount2("./11/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5368] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5070] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5368] close(10) = -1 EBADF (Bad file descriptor) [pid 5368] close(11) = -1 EBADF (Bad file descriptor) [pid 5368] close(12) = -1 EBADF (Bad file descriptor) [pid 5368] close(13) = -1 EBADF (Bad file descriptor) [pid 5368] close(14) = -1 EBADF (Bad file descriptor) [pid 5368] close(15) = -1 EBADF (Bad file descriptor) [pid 5368] close(16) = -1 EBADF (Bad file descriptor) [pid 5070] lstat("./11/file0", [pid 5368] close(17) = -1 EBADF (Bad file descriptor) [pid 5070] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5368] close(18 [pid 5070] umount2("./11/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5368] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5368] close(19 [pid 5070] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5070] openat(AT_FDCWD, "./11/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5368] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5368] close(20) = -1 EBADF (Bad file descriptor) [pid 5070] <... openat resumed>) = 4 [pid 5368] close(21 [pid 5070] fstat(4, [pid 5368] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5368] close(22 [pid 5070] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5368] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5070] getdents64(4, [pid 5368] close(23) = -1 EBADF (Bad file descriptor) [pid 5368] close(24 [pid 5070] <... getdents64 resumed>0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5368] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5070] getdents64(4, [pid 5368] close(25 [pid 5070] <... getdents64 resumed>0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5368] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5368] close(26 [pid 5070] close(4 [pid 5368] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5368] close(27 [pid 5070] <... close resumed>) = 0 [pid 5368] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5368] close(28 [pid 5070] rmdir("./11/file0" [pid 5368] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5368] close(29) = -1 EBADF (Bad file descriptor) [pid 5368] exit_group(0 [pid 5070] <... rmdir resumed>) = 0 [pid 5368] <... exit_group resumed>) = ? [pid 5070] umount2("./11/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5368] +++ exited with 0 +++ [pid 5070] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./11/cgroup.cpu", [pid 5072] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=14, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- [pid 5070] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5072] umount2("./12", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5070] unlink("./11/cgroup.cpu" [pid 5072] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5072] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5070] <... unlink resumed>) = 0 [pid 5072] <... openat resumed>) = 3 [pid 5070] getdents64(3, [pid 5072] fstat(3, [pid 5070] <... getdents64 resumed>0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5072] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5070] close(3 [pid 5072] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5070] <... close resumed>) = 0 [pid 5072] umount2("./12/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [ 119.888381][ T5373] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 119.896360][ T5373] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 119.904355][ T5373] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 119.912351][ T5373] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000012 [ 119.920528][ T5373] [pid 5070] rmdir("./11" [pid 5072] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5070] <... rmdir resumed>) = 0 [pid 5072] lstat("./12/binderfs", [pid 5070] mkdir("./12", 0777 [pid 5072] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5072] unlink("./12/binderfs" [pid 5070] <... mkdir resumed>) = 0 [pid 5072] <... unlink resumed>) = 0 [pid 5070] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5072] umount2("./12/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5390 attached ) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./12/cgroup", [pid 5070] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 14 [pid 5390] chdir("./12" [pid 5072] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5390] <... chdir resumed>) = 0 [pid 5072] unlink("./12/cgroup" [pid 5390] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5072] <... unlink resumed>) = 0 [pid 5072] umount2("./12/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5390] setpgid(0, 0 [pid 5072] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5390] <... setpgid resumed>) = 0 [pid 5072] lstat("./12/cgroup.net", [pid 5390] symlink("/syzcgroup/unified/syz0", "./cgroup" [pid 5072] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5390] <... symlink resumed>) = 0 [pid 5072] unlink("./12/cgroup.net" [pid 5390] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu" [pid 5072] <... unlink resumed>) = 0 [pid 5072] umount2("./12/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5390] <... symlink resumed>) = 0 [pid 5390] symlink("/syzcgroup/net/syz0", "./cgroup.net" [pid 5072] <... umount2 resumed>) = 0 [pid 5390] <... symlink resumed>) = 0 [pid 5072] umount2("./12/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5390] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5072] lstat("./12/file0", [pid 5390] <... openat resumed>) = 3 [pid 5072] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5072] umount2("./12/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5390] write(3, "1000", 4 [pid 5072] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5390] <... write resumed>) = 4 [pid 5072] openat(AT_FDCWD, "./12/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5390] close(3 [pid 5072] <... openat resumed>) = 4 [pid 5390] <... close resumed>) = 0 [pid 5072] fstat(4, [pid 5390] symlink("/dev/binderfs", "./binderfs" [pid 5072] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5390] <... symlink resumed>) = 0 [pid 5072] getdents64(4, [pid 5390] mkdir("./file0", 000 [pid 5072] <... getdents64 resumed>0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5072] getdents64(4, [pid 5390] <... mkdir resumed>) = 0 [pid 5072] <... getdents64 resumed>0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5072] close(4 [pid 5390] open("./file0", O_RDONLY [pid 5072] <... close resumed>) = 0 [pid 5072] rmdir("./12/file0" [pid 5390] <... open resumed>) = 3 [pid 5072] <... rmdir resumed>) = 0 [pid 5072] umount2("./12/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5390] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5072] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5390] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5072] lstat("./12/cgroup.cpu", [pid 5390] <... openat resumed>) = 4 [pid 5072] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5390] openat(4, "syz1", O_RDWR|O_PATH [pid 5072] unlink("./12/cgroup.cpu" [pid 5390] <... openat resumed>) = 5 [pid 5390] openat(5, "memory.max", O_RDWR [pid 5072] <... unlink resumed>) = 0 [pid 5390] <... openat resumed>) = 6 [pid 5072] getdents64(3, [pid 5390] write(6, "0x000000000000040e", 18 [pid 5072] <... getdents64 resumed>0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5072] close(3) = 0 [pid 5072] rmdir("./12") = 0 [pid 5072] mkdir("./13", 0777) = 0 [ 120.005058][ T5373] memory: usage 12kB, limit 0kB, failcnt 55 [ 120.016154][ T5373] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 120.043106][ T5373] Memory cgroup stats for /syz1: [ 120.043305][ T5373] anon 0 [ 120.043305][ T5373] file 0 [ 120.043305][ T5373] kernel 12288 [ 120.043305][ T5373] kernel_stack 0 [ 120.043305][ T5373] pagetables 0 [ 120.043305][ T5373] sec_pagetables 0 [ 120.043305][ T5373] percpu 0 [ 120.043305][ T5373] sock 0 [ 120.043305][ T5373] vmalloc 0 [ 120.043305][ T5373] shmem 0 [ 120.043305][ T5373] zswap 0 [ 120.043305][ T5373] zswapped 0 [ 120.043305][ T5373] file_mapped 0 [ 120.043305][ T5373] file_dirty 0 [ 120.043305][ T5373] file_writeback 0 [ 120.043305][ T5373] swapcached 0 [ 120.043305][ T5373] anon_thp 0 [ 120.043305][ T5373] file_thp 0 [pid 5072] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5391 attached [pid 5391] chdir("./13" [pid 5072] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 15 [pid 5391] <... chdir resumed>) = 0 [pid 5391] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5391] setpgid(0, 0) = 0 [pid 5391] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 5391] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [ 120.043305][ T5373] shmem_thp 0 [ 120.043305][ T5373] inactive_anon 0 [ 120.043305][ T5373] active_anon 0 [ 120.043305][ T5373] inactive_file 0 [ 120.043305][ T5373] active_file 0 [ 120.043305][ T5373] unevictable 0 [ 120.043305][ T5373] slab_reclaimable 9328 [ 120.043305][ T5373] slab_unreclaimable 0 [ 120.043305][ T5373] slab 9328 [ 120.043305][ T5373] workingset_refault_anon 0 [pid 5391] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 5391] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5391] write(3, "1000", 4) = 4 [pid 5391] close(3) = 0 [pid 5391] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5391] mkdir("./file0", 000) = 0 [pid 5391] open("./file0", O_RDONLY) = 3 [pid 5391] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [ 120.164536][ T5373] Tasks state (memory values in pages): [ 120.173000][ T5373] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 120.196326][ T5373] Out of memory and no killable processes... [pid 5373] <... write resumed>) = 18 [pid 5391] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5373] close(3) = 0 [pid 5373] close(4) = 0 [pid 5373] close(5) = 0 [pid 5373] close(6) = 0 [pid 5373] close(7) = -1 EBADF (Bad file descriptor) [pid 5373] close(8) = -1 EBADF (Bad file descriptor) [pid 5373] close(9) = -1 EBADF (Bad file descriptor) [pid 5373] close(10) = -1 EBADF (Bad file descriptor) [pid 5373] close(11) = -1 EBADF (Bad file descriptor) [pid 5373] close(12) = -1 EBADF (Bad file descriptor) [pid 5373] close(13) = -1 EBADF (Bad file descriptor) [pid 5373] close(14) = -1 EBADF (Bad file descriptor) [pid 5373] close(15) = -1 EBADF (Bad file descriptor) [pid 5373] close(16) = -1 EBADF (Bad file descriptor) [pid 5373] close(17) = -1 EBADF (Bad file descriptor) [pid 5373] close(18) = -1 EBADF (Bad file descriptor) [pid 5373] close(19) = -1 EBADF (Bad file descriptor) [pid 5373] close(20) = -1 EBADF (Bad file descriptor) [pid 5373] close(21) = -1 EBADF (Bad file descriptor) [pid 5373] close(22) = -1 EBADF (Bad file descriptor) [pid 5373] close(23) = -1 EBADF (Bad file descriptor) [pid 5373] close(24) = -1 EBADF (Bad file descriptor) [pid 5373] close(25) = -1 EBADF (Bad file descriptor) [pid 5373] close(26) = -1 EBADF (Bad file descriptor) [pid 5373] close(27) = -1 EBADF (Bad file descriptor) [pid 5391] <... openat resumed>) = 4 [pid 5373] close(28 [pid 5391] openat(4, "syz1", O_RDWR|O_PATH [pid 5373] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5373] close(29) = -1 EBADF (Bad file descriptor) [pid 5373] exit_group(0 [pid 5391] <... openat resumed>) = 5 [pid 5391] openat(5, "memory.max", O_RDWR [pid 5373] <... exit_group resumed>) = ? [pid 5391] <... openat resumed>) = 6 [pid 5373] +++ exited with 0 +++ [pid 5391] write(6, "0x000000000000040e", 18 [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=20, si_uid=0, si_status=0, si_utime=0, si_stime=9 /* 0.09 s */} --- [pid 5074] umount2("./18", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5074] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5074] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5074] umount2("./18/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./18/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5074] unlink("./18/binderfs") = 0 [pid 5074] umount2("./18/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./18/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5074] unlink("./18/cgroup") = 0 [pid 5074] umount2("./18/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./18/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5074] unlink("./18/cgroup.net") = 0 [pid 5074] umount2("./18/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5074] umount2("./18/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./18/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5074] umount2("./18/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] openat(AT_FDCWD, "./18/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5074] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5074] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5074] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5074] close(4) = 0 [pid 5074] rmdir("./18/file0") = 0 [pid 5074] umount2("./18/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 120.217283][ T5377] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 120.263317][ T5377] CPU: 1 PID: 5377 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 120.273812][ T5377] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 120.283911][ T5377] Call Trace: [ 120.287231][ T5377] [ 120.290203][ T5377] dump_stack_lvl+0x1e7/0x2d0 [ 120.294938][ T5377] ? nf_tcp_handle_invalid+0x640/0x640 [ 120.300452][ T5377] ? panic+0x770/0x770 [ 120.304587][ T5377] dump_header+0xdc/0x940 [ 120.308973][ T5377] out_of_memory+0xf21/0x12c0 [ 120.313718][ T5377] ? mutex_lock_io_nested+0x60/0x60 [ 120.318973][ T5377] ? mark_lock+0x9a/0x340 [ 120.323357][ T5377] ? unregister_oom_notifier+0x20/0x20 [ 120.328859][ T5377] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 120.334901][ T5377] mem_cgroup_out_of_memory+0x263/0x3b0 [ 120.340505][ T5377] ? mem_cgroup_oom_trylock+0x210/0x210 [ 120.346132][ T5377] ? cgroup_file_notify+0x127/0x190 [ 120.351387][ T5377] memory_max_write+0x355/0x470 [ 120.356324][ T5377] ? memory_max_show+0xa0/0xa0 [ 120.361138][ T5377] ? read_lock_is_recursive+0x20/0x20 [ 120.366565][ T5377] ? memory_max_show+0xa0/0xa0 [ 120.371386][ T5377] cgroup_file_write+0x2b1/0x780 [ 120.376375][ T5377] ? cgroup_seqfile_stop+0xd0/0xd0 [ 120.381529][ T5377] ? __virt_addr_valid+0x22f/0x2e0 [ 120.386705][ T5377] ? cgroup_seqfile_stop+0xd0/0xd0 [ 120.391857][ T5377] kernfs_fop_write_iter+0x3a6/0x4f0 [ 120.397196][ T5377] vfs_write+0x7b2/0xbb0 [ 120.401496][ T5377] ? file_end_write+0x240/0x240 [ 120.406396][ T5377] ? do_raw_spin_unlock+0x13b/0x8b0 [ 120.411646][ T5377] ? lockdep_hardirqs_on+0x98/0x140 [ 120.416900][ T5377] ? __fdget_pos+0x265/0x2f0 [ 120.421541][ T5377] ksys_write+0x1a0/0x2c0 [ 120.425935][ T5377] ? __ia32_sys_read+0x90/0x90 [ 120.430748][ T5377] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 120.436786][ T5377] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 120.442826][ T5377] do_syscall_64+0x41/0xc0 [ 120.447291][ T5377] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 120.453233][ T5377] RIP: 0033:0x7fd49ce20129 [pid 5074] lstat("./18/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5074] unlink("./18/cgroup.cpu") = 0 [pid 5074] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5074] close(3) = 0 [pid 5074] rmdir("./18") = 0 [pid 5074] mkdir("./19", 0777) = 0 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5394 attached [pid 5394] chdir("./19") = 0 [pid 5074] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 21 [pid 5394] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5394] setpgid(0, 0) = 0 [pid 5394] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [pid 5394] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 5394] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 5394] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5394] write(3, "1000", 4) = 4 [pid 5394] close(3) = 0 [pid 5394] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5394] mkdir("./file0", 000) = 0 [pid 5394] open("./file0", O_RDONLY) = 3 [pid 5394] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5394] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5394] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5394] openat(5, "memory.max", O_RDWR) = 6 [ 120.457690][ T5377] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 120.477340][ T5377] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 120.485800][ T5377] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 120.493811][ T5377] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 120.501823][ T5377] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 120.509836][ T5377] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 120.517843][ T5377] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000012 [ 120.525881][ T5377] [ 120.542852][ T5377] memory: usage 12kB, limit 0kB, failcnt 55 [ 120.556626][ T5377] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 120.563538][ T5377] Memory cgroup stats for /syz1: [ 120.563742][ T5377] anon 0 [ 120.563742][ T5377] file 0 [ 120.563742][ T5377] kernel 8192 [ 120.563742][ T5377] kernel_stack 0 [ 120.563742][ T5377] pagetables 0 [ 120.563742][ T5377] sec_pagetables 0 [ 120.563742][ T5377] percpu 0 [ 120.563742][ T5377] sock 0 [ 120.563742][ T5377] vmalloc 0 [ 120.563742][ T5377] shmem 0 [ 120.563742][ T5377] zswap 0 [ 120.563742][ T5377] zswapped 0 [ 120.563742][ T5377] file_mapped 0 [ 120.563742][ T5377] file_dirty 0 [ 120.563742][ T5377] file_writeback 0 [ 120.563742][ T5377] swapcached 0 [ 120.563742][ T5377] anon_thp 0 [ 120.563742][ T5377] file_thp 0 [ 120.563742][ T5377] shmem_thp 0 [ 120.563742][ T5377] inactive_anon 0 [ 120.563742][ T5377] active_anon 0 [ 120.563742][ T5377] inactive_file 0 [ 120.563742][ T5377] active_file 0 [ 120.563742][ T5377] unevictable 0 [ 120.563742][ T5377] slab_reclaimable 9328 [ 120.563742][ T5377] slab_unreclaimable 0 [ 120.563742][ T5377] slab 9328 [ 120.563742][ T5377] workingset_refault_anon 0 [pid 5394] write(6, "0x000000000000040e", 18 [pid 5377] <... write resumed>) = 18 [ 120.665359][ T5377] Tasks state (memory values in pages): [ 120.671319][ T5377] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 120.681099][ T5377] Out of memory and no killable processes... [ 120.687471][ T5384] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 120.698138][ T5384] CPU: 1 PID: 5384 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 120.708600][ T5384] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 120.718692][ T5384] Call Trace: [ 120.722003][ T5384] [ 120.724972][ T5384] dump_stack_lvl+0x1e7/0x2d0 [ 120.729709][ T5384] ? nf_tcp_handle_invalid+0x640/0x640 [ 120.735217][ T5384] ? panic+0x770/0x770 [ 120.739346][ T5384] dump_header+0xdc/0x940 [ 120.743721][ T5384] out_of_memory+0xf21/0x12c0 [ 120.748451][ T5384] ? mutex_lock_io_nested+0x60/0x60 [ 120.753713][ T5384] ? preempt_schedule+0xdd/0xf0 [ 120.758613][ T5384] ? unregister_oom_notifier+0x20/0x20 [pid 5377] close(3) = 0 [pid 5377] close(4) = 0 [pid 5377] close(5) = 0 [pid 5377] close(6) = 0 [ 120.764115][ T5384] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 120.770158][ T5384] mem_cgroup_out_of_memory+0x263/0x3b0 [ 120.775752][ T5384] ? preempt_schedule_thunk+0x1a/0x20 [ 120.781183][ T5384] ? mem_cgroup_oom_trylock+0x210/0x210 [ 120.786806][ T5384] ? cgroup_file_notify+0x127/0x190 [ 120.792058][ T5384] memory_max_write+0x355/0x470 [ 120.796965][ T5384] ? memory_max_show+0xa0/0xa0 [ 120.801786][ T5384] ? read_lock_is_recursive+0x20/0x20 [ 120.807215][ T5384] ? memory_max_show+0xa0/0xa0 [ 120.812036][ T5384] cgroup_file_write+0x2b1/0x780 [ 120.817029][ T5384] ? cgroup_seqfile_stop+0xd0/0xd0 [ 120.822196][ T5384] ? __virt_addr_valid+0x22f/0x2e0 [ 120.827387][ T5384] ? cgroup_seqfile_stop+0xd0/0xd0 [ 120.832550][ T5384] kernfs_fop_write_iter+0x3a6/0x4f0 [ 120.837886][ T5384] vfs_write+0x7b2/0xbb0 [ 120.842229][ T5384] ? file_end_write+0x240/0x240 [ 120.847142][ T5384] ? do_raw_spin_unlock+0x13b/0x8b0 [ 120.852397][ T5384] ? lockdep_hardirqs_on+0x98/0x140 [ 120.857648][ T5384] ? __fdget_pos+0x265/0x2f0 [ 120.862287][ T5384] ksys_write+0x1a0/0x2c0 [ 120.866665][ T5384] ? __ia32_sys_read+0x90/0x90 [ 120.871479][ T5384] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 120.877534][ T5384] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 120.883567][ T5384] do_syscall_64+0x41/0xc0 [ 120.888037][ T5384] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 120.893990][ T5384] RIP: 0033:0x7fd49ce20129 [ 120.898447][ T5384] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 120.918104][ T5384] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 120.926576][ T5384] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 120.934588][ T5384] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 120.942601][ T5384] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 120.950610][ T5384] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 120.958619][ T5384] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 000000000000000f [pid 5377] close(7) = -1 EBADF (Bad file descriptor) [pid 5377] close(8) = -1 EBADF (Bad file descriptor) [pid 5377] close(9) = -1 EBADF (Bad file descriptor) [pid 5377] close(10) = -1 EBADF (Bad file descriptor) [pid 5377] close(11) = -1 EBADF (Bad file descriptor) [pid 5377] close(12) = -1 EBADF (Bad file descriptor) [pid 5377] close(13) = -1 EBADF (Bad file descriptor) [pid 5377] close(14) = -1 EBADF (Bad file descriptor) [pid 5377] close(15) = -1 EBADF (Bad file descriptor) [pid 5377] close(16) = -1 EBADF (Bad file descriptor) [pid 5377] close(17) = -1 EBADF (Bad file descriptor) [pid 5377] close(18) = -1 EBADF (Bad file descriptor) [pid 5377] close(19) = -1 EBADF (Bad file descriptor) [pid 5377] close(20) = -1 EBADF (Bad file descriptor) [pid 5377] close(21) = -1 EBADF (Bad file descriptor) [pid 5377] close(22) = -1 EBADF (Bad file descriptor) [pid 5377] close(23) = -1 EBADF (Bad file descriptor) [pid 5377] close(24) = -1 EBADF (Bad file descriptor) [pid 5377] close(25) = -1 EBADF (Bad file descriptor) [pid 5377] close(26) = -1 EBADF (Bad file descriptor) [pid 5377] close(27) = -1 EBADF (Bad file descriptor) [pid 5377] close(28) = -1 EBADF (Bad file descriptor) [pid 5377] close(29) = -1 EBADF (Bad file descriptor) [pid 5377] exit_group(0) = ? [pid 5377] +++ exited with 0 +++ [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=20, si_uid=0, si_status=0, si_utime=0, si_stime=7 /* 0.07 s */} --- [pid 5075] umount2("./18", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5075] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5075] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5075] umount2("./18/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./18/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5075] unlink("./18/binderfs") = 0 [pid 5075] umount2("./18/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./18/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5075] unlink("./18/cgroup") = 0 [pid 5075] umount2("./18/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./18/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5075] unlink("./18/cgroup.net") = 0 [pid 5075] umount2("./18/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5075] umount2("./18/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./18/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5075] umount2("./18/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] openat(AT_FDCWD, "./18/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5075] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5075] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5075] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5075] close(4) = 0 [pid 5075] rmdir("./18/file0") = 0 [pid 5075] umount2("./18/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./18/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5075] unlink("./18/cgroup.cpu") = 0 [pid 5075] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5075] close(3) = 0 [pid 5075] rmdir("./18") = 0 [pid 5075] mkdir("./19", 0777) = 0 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5400 attached [pid 5400] chdir("./19" [pid 5075] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 21 [pid 5400] <... chdir resumed>) = 0 [pid 5400] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5400] setpgid(0, 0) = 0 [ 120.966794][ T5384] [ 120.980919][ T5384] memory: usage 12kB, limit 0kB, failcnt 55 [ 120.994842][ T5384] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 121.010925][ T5384] Memory cgroup stats for /syz1: [pid 5400] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 5400] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 5400] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 5400] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5400] write(3, "1000", 4) = 4 [pid 5400] close(3) = 0 [pid 5400] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5400] mkdir("./file0", 000) = 0 [pid 5400] open("./file0", O_RDONLY) = 3 [ 121.011142][ T5384] anon 0 [ 121.011142][ T5384] file 0 [ 121.011142][ T5384] kernel 8192 [ 121.011142][ T5384] kernel_stack 0 [ 121.011142][ T5384] pagetables 0 [ 121.011142][ T5384] sec_pagetables 0 [ 121.011142][ T5384] percpu 0 [ 121.011142][ T5384] sock 0 [ 121.011142][ T5384] vmalloc 0 [ 121.011142][ T5384] shmem 0 [ 121.011142][ T5384] zswap 0 [ 121.011142][ T5384] zswapped 0 [ 121.011142][ T5384] file_mapped 0 [ 121.011142][ T5384] file_dirty 0 [ 121.011142][ T5384] file_writeback 0 [ 121.011142][ T5384] swapcached 0 [pid 5400] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5400] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5400] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5400] openat(5, "memory.max", O_RDWR) = 6 [ 121.011142][ T5384] anon_thp 0 [ 121.011142][ T5384] file_thp 0 [ 121.011142][ T5384] shmem_thp 0 [ 121.011142][ T5384] inactive_anon 0 [ 121.011142][ T5384] active_anon 0 [ 121.011142][ T5384] inactive_file 0 [ 121.011142][ T5384] active_file 0 [ 121.011142][ T5384] unevictable 0 [ 121.011142][ T5384] slab_reclaimable 9328 [ 121.011142][ T5384] slab_unreclaimable 0 [ 121.011142][ T5384] slab 9328 [ 121.011142][ T5384] workingset_refault_anon 0 [pid 5400] write(6, "0x000000000000040e", 18 [pid 5384] <... write resumed>) = 18 [pid 5384] close(3) = 0 [pid 5384] close(4) = 0 [ 121.115991][ T5384] Tasks state (memory values in pages): [ 121.123579][ T5384] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 121.144281][ T5384] Out of memory and no killable processes... [ 121.153493][ T5390] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5384] close(5) = 0 [pid 5384] close(6) = 0 [pid 5384] close(7) = -1 EBADF (Bad file descriptor) [pid 5384] close(8) = -1 EBADF (Bad file descriptor) [pid 5384] close(9) = -1 EBADF (Bad file descriptor) [pid 5384] close(10) = -1 EBADF (Bad file descriptor) [pid 5384] close(11) = -1 EBADF (Bad file descriptor) [pid 5384] close(12) = -1 EBADF (Bad file descriptor) [pid 5384] close(13) = -1 EBADF (Bad file descriptor) [pid 5384] close(14) = -1 EBADF (Bad file descriptor) [pid 5384] close(15) = -1 EBADF (Bad file descriptor) [pid 5384] close(16) = -1 EBADF (Bad file descriptor) [pid 5384] close(17) = -1 EBADF (Bad file descriptor) [pid 5384] close(18) = -1 EBADF (Bad file descriptor) [pid 5384] close(19) = -1 EBADF (Bad file descriptor) [ 121.165095][ T5390] CPU: 1 PID: 5390 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 121.175566][ T5390] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 121.185669][ T5390] Call Trace: [ 121.188997][ T5390] [ 121.191974][ T5390] dump_stack_lvl+0x1e7/0x2d0 [ 121.196712][ T5390] ? nf_tcp_handle_invalid+0x640/0x640 [ 121.202225][ T5390] ? panic+0x770/0x770 [ 121.206366][ T5390] dump_header+0xdc/0x940 [ 121.210753][ T5390] out_of_memory+0xf21/0x12c0 [ 121.215489][ T5390] ? mutex_lock_io_nested+0x60/0x60 [ 121.220735][ T5390] ? preempt_schedule+0xdd/0xf0 [ 121.225609][ T5390] ? unregister_oom_notifier+0x20/0x20 [ 121.231087][ T5390] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 121.237096][ T5390] mem_cgroup_out_of_memory+0x263/0x3b0 [ 121.242661][ T5390] ? preempt_schedule_thunk+0x1a/0x20 [ 121.248055][ T5390] ? mem_cgroup_oom_trylock+0x210/0x210 [ 121.253629][ T5390] ? cgroup_file_notify+0x127/0x190 [ 121.258849][ T5390] memory_max_write+0x355/0x470 [ 121.263726][ T5390] ? memory_max_show+0xa0/0xa0 [pid 5384] close(20) = -1 EBADF (Bad file descriptor) [pid 5384] close(21) = -1 EBADF (Bad file descriptor) [pid 5384] close(22) = -1 EBADF (Bad file descriptor) [pid 5384] close(23) = -1 EBADF (Bad file descriptor) [pid 5384] close(24) = -1 EBADF (Bad file descriptor) [ 121.268509][ T5390] ? read_lock_is_recursive+0x20/0x20 [ 121.273905][ T5390] ? memory_max_show+0xa0/0xa0 [ 121.278697][ T5390] cgroup_file_write+0x2b1/0x780 [ 121.283654][ T5390] ? cgroup_seqfile_stop+0xd0/0xd0 [ 121.288780][ T5390] ? __virt_addr_valid+0x22f/0x2e0 [ 121.293919][ T5390] ? cgroup_seqfile_stop+0xd0/0xd0 [ 121.299041][ T5390] kernfs_fop_write_iter+0x3a6/0x4f0 [ 121.304355][ T5390] vfs_write+0x7b2/0xbb0 [ 121.308622][ T5390] ? file_end_write+0x240/0x240 [ 121.313493][ T5390] ? do_raw_spin_unlock+0x13b/0x8b0 [ 121.318711][ T5390] ? lockdep_hardirqs_on+0x98/0x140 [ 121.323936][ T5390] ? __fdget_pos+0x265/0x2f0 [ 121.328542][ T5390] ksys_write+0x1a0/0x2c0 [ 121.332890][ T5390] ? __ia32_sys_read+0x90/0x90 [ 121.337669][ T5390] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 121.343671][ T5390] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 121.349675][ T5390] do_syscall_64+0x41/0xc0 [ 121.354111][ T5390] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 121.360049][ T5390] RIP: 0033:0x7fd49ce20129 [ 121.364475][ T5390] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 121.384100][ T5390] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 121.392526][ T5390] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 121.400512][ T5390] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 121.408495][ T5390] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [pid 5384] close(25) = -1 EBADF (Bad file descriptor) [pid 5384] close(26) = -1 EBADF (Bad file descriptor) [pid 5384] close(27) = -1 EBADF (Bad file descriptor) [pid 5384] close(28) = -1 EBADF (Bad file descriptor) [pid 5384] close(29) = -1 EBADF (Bad file descriptor) [pid 5384] exit_group(0) = ? [pid 5384] +++ exited with 0 +++ [pid 5073] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=17, si_uid=0, si_status=0, si_utime=0, si_stime=11 /* 0.11 s */} --- [pid 5073] umount2("./15", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [ 121.416477][ T5390] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 121.424456][ T5390] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 000000000000000c [ 121.432454][ T5390] [ 121.446862][ T5390] memory: usage 8kB, limit 0kB, failcnt 55 [ 121.452735][ T5390] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 121.469041][ T5390] Memory cgroup stats for /syz1: [ 121.469335][ T5390] anon 0 [ 121.469335][ T5390] file 0 [ 121.469335][ T5390] kernel 8192 [ 121.469335][ T5390] kernel_stack 0 [ 121.469335][ T5390] pagetables 0 [ 121.469335][ T5390] sec_pagetables 0 [ 121.469335][ T5390] percpu 0 [ 121.469335][ T5390] sock 0 [ 121.469335][ T5390] vmalloc 0 [ 121.469335][ T5390] shmem 0 [ 121.469335][ T5390] zswap 0 [ 121.469335][ T5390] zswapped 0 [ 121.469335][ T5390] file_mapped 0 [ 121.469335][ T5390] file_dirty 0 [pid 5073] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5073] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5073] umount2("./15/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./15/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [ 121.469335][ T5390] file_writeback 0 [ 121.469335][ T5390] swapcached 0 [ 121.469335][ T5390] anon_thp 0 [ 121.469335][ T5390] file_thp 0 [ 121.469335][ T5390] shmem_thp 0 [ 121.469335][ T5390] inactive_anon 0 [ 121.469335][ T5390] active_anon 0 [ 121.469335][ T5390] inactive_file 0 [ 121.469335][ T5390] active_file 0 [ 121.469335][ T5390] unevictable 0 [ 121.469335][ T5390] slab_reclaimable 6752 [ 121.469335][ T5390] slab_unreclaimable 0 [ 121.469335][ T5390] slab 6752 [ 121.469335][ T5390] workingset_refault_anon 0 [pid 5073] unlink("./15/binderfs") = 0 [pid 5073] umount2("./15/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./15/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5073] unlink("./15/cgroup") = 0 [pid 5073] umount2("./15/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./15/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5073] unlink("./15/cgroup.net") = 0 [ 121.569967][ T5390] Tasks state (memory values in pages): [ 121.575564][ T5390] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 121.586213][ T5390] Out of memory and no killable processes... [ 121.593296][ T5394] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 121.604007][ T5394] CPU: 0 PID: 5394 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 121.614475][ T5394] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 121.624575][ T5394] Call Trace: [ 121.627893][ T5394] [ 121.630862][ T5394] dump_stack_lvl+0x1e7/0x2d0 [ 121.635596][ T5394] ? nf_tcp_handle_invalid+0x640/0x640 [ 121.641105][ T5394] ? panic+0x770/0x770 [ 121.645237][ T5394] dump_header+0xdc/0x940 [ 121.649623][ T5394] out_of_memory+0xf21/0x12c0 [ 121.654357][ T5394] ? mutex_lock_io_nested+0x60/0x60 [ 121.659616][ T5394] ? preempt_schedule+0xdd/0xf0 [ 121.664514][ T5394] ? unregister_oom_notifier+0x20/0x20 [ 121.670020][ T5394] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 121.676067][ T5394] mem_cgroup_out_of_memory+0x263/0x3b0 [ 121.681668][ T5394] ? preempt_schedule_thunk+0x1a/0x20 [ 121.687099][ T5394] ? mem_cgroup_oom_trylock+0x210/0x210 [ 121.692716][ T5394] ? cgroup_file_notify+0x127/0x190 [ 121.697988][ T5394] memory_max_write+0x355/0x470 [ 121.702910][ T5394] ? memory_max_show+0xa0/0xa0 [ 121.707734][ T5394] ? read_lock_is_recursive+0x20/0x20 [ 121.713164][ T5394] ? memory_max_show+0xa0/0xa0 [ 121.718032][ T5394] cgroup_file_write+0x2b1/0x780 [ 121.723042][ T5394] ? cgroup_seqfile_stop+0xd0/0xd0 [ 121.728208][ T5394] ? __virt_addr_valid+0x22f/0x2e0 [ 121.733389][ T5394] ? cgroup_seqfile_stop+0xd0/0xd0 [ 121.738548][ T5394] kernfs_fop_write_iter+0x3a6/0x4f0 [ 121.743897][ T5394] vfs_write+0x7b2/0xbb0 [ 121.748201][ T5394] ? file_end_write+0x240/0x240 [ 121.753109][ T5394] ? do_raw_spin_unlock+0x13b/0x8b0 [ 121.758364][ T5394] ? lockdep_hardirqs_on+0x98/0x140 [ 121.763622][ T5394] ? __fdget_pos+0x265/0x2f0 [ 121.768265][ T5394] ksys_write+0x1a0/0x2c0 [ 121.772656][ T5394] ? __ia32_sys_read+0x90/0x90 [ 121.777474][ T5394] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 121.783520][ T5394] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 121.789559][ T5394] do_syscall_64+0x41/0xc0 [ 121.794030][ T5394] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 121.799996][ T5394] RIP: 0033:0x7fd49ce20129 [ 121.804456][ T5394] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 121.824114][ T5394] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 121.832587][ T5394] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 121.840601][ T5394] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 121.848611][ T5394] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 121.856611][ T5394] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [pid 5073] umount2("./15/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5390] <... write resumed>) = 18 [pid 5073] <... umount2 resumed>) = 0 [pid 5073] umount2("./15/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./15/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5073] umount2("./15/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] openat(AT_FDCWD, "./15/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5073] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5073] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5073] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5073] close(4) = 0 [pid 5073] rmdir("./15/file0") = 0 [pid 5073] umount2("./15/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./15/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5073] unlink("./15/cgroup.cpu") = 0 [pid 5073] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5073] close(3) = 0 [pid 5073] rmdir("./15") = 0 [pid 5073] mkdir("./16", 0777) = 0 [pid 5073] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5403 attached [pid 5403] chdir("./16") = 0 [pid 5073] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 18 [pid 5403] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5403] setpgid(0, 0) = 0 [pid 5403] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 5403] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 5403] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [pid 5403] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5403] write(3, "1000", 4) = 4 [pid 5403] close(3) = 0 [pid 5403] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5403] mkdir("./file0", 000) = 0 [pid 5403] open("./file0", O_RDONLY) = 3 [pid 5403] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5403] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5403] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5403] openat(5, "memory.max", O_RDWR) = 6 [pid 5403] write(6, "0x000000000000040e", 18 [pid 5390] close(3) = 0 [pid 5390] close(4) = 0 [pid 5390] close(5) = 0 [pid 5390] close(6) = 0 [pid 5390] close(7) = -1 EBADF (Bad file descriptor) [pid 5390] close(8) = -1 EBADF (Bad file descriptor) [pid 5390] close(9) = -1 EBADF (Bad file descriptor) [pid 5390] close(10) = -1 EBADF (Bad file descriptor) [pid 5390] close(11) = -1 EBADF (Bad file descriptor) [pid 5390] close(12) = -1 EBADF (Bad file descriptor) [pid 5390] close(13) = -1 EBADF (Bad file descriptor) [pid 5390] close(14) = -1 EBADF (Bad file descriptor) [pid 5390] close(15) = -1 EBADF (Bad file descriptor) [pid 5390] close(16) = -1 EBADF (Bad file descriptor) [ 121.864611][ T5394] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000013 [ 121.872648][ T5394] [pid 5390] close(17) = -1 EBADF (Bad file descriptor) [pid 5390] close(18) = -1 EBADF (Bad file descriptor) [pid 5390] close(19) = -1 EBADF (Bad file descriptor) [pid 5390] close(20) = -1 EBADF (Bad file descriptor) [pid 5390] close(21) = -1 EBADF (Bad file descriptor) [pid 5390] close(22) = -1 EBADF (Bad file descriptor) [pid 5390] close(23) = -1 EBADF (Bad file descriptor) [ 121.924211][ T5394] memory: usage 8kB, limit 0kB, failcnt 55 [ 121.933674][ T5394] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 121.942781][ T5394] Memory cgroup stats for /syz1: [ 121.942990][ T5394] anon 0 [ 121.942990][ T5394] file 0 [ 121.942990][ T5394] kernel 8192 [ 121.942990][ T5394] kernel_stack 0 [ 121.942990][ T5394] pagetables 0 [ 121.942990][ T5394] sec_pagetables 0 [ 121.942990][ T5394] percpu 0 [ 121.942990][ T5394] sock 0 [ 121.942990][ T5394] vmalloc 0 [ 121.942990][ T5394] shmem 0 [ 121.942990][ T5394] zswap 0 [ 121.942990][ T5394] zswapped 0 [ 121.942990][ T5394] file_mapped 0 [ 121.942990][ T5394] file_dirty 0 [ 121.942990][ T5394] file_writeback 0 [ 121.942990][ T5394] swapcached 0 [ 121.942990][ T5394] anon_thp 0 [ 121.942990][ T5394] file_thp 0 [ 121.942990][ T5394] shmem_thp 0 [ 121.942990][ T5394] inactive_anon 0 [ 121.942990][ T5394] active_anon 0 [ 121.942990][ T5394] inactive_file 0 [ 121.942990][ T5394] active_file 0 [ 121.942990][ T5394] unevictable 0 [pid 5390] close(24) = -1 EBADF (Bad file descriptor) [pid 5390] close(25) = -1 EBADF (Bad file descriptor) [pid 5390] close(26) = -1 EBADF (Bad file descriptor) [pid 5390] close(27) = -1 EBADF (Bad file descriptor) [pid 5390] close(28) = -1 EBADF (Bad file descriptor) [pid 5390] close(29) = -1 EBADF (Bad file descriptor) [ 121.942990][ T5394] slab_reclaimable 6752 [ 121.942990][ T5394] slab_unreclaimable 0 [ 121.942990][ T5394] slab 6752 [ 121.942990][ T5394] workingset_refault_anon 0 [ 122.050660][ T5394] Tasks state (memory values in pages): [ 122.058910][ T5394] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5390] exit_group(0 [pid 5394] <... write resumed>) = 18 [pid 5394] close(3) = 0 [pid 5390] <... exit_group resumed>) = ? [pid 5394] close(4) = 0 [pid 5394] close(5) = 0 [pid 5394] close(6) = 0 [pid 5394] close(7) = -1 EBADF (Bad file descriptor) [pid 5394] close(8) = -1 EBADF (Bad file descriptor) [pid 5394] close(9) = -1 EBADF (Bad file descriptor) [pid 5394] close(10) = -1 EBADF (Bad file descriptor) [pid 5394] close(11) = -1 EBADF (Bad file descriptor) [pid 5394] close(12) = -1 EBADF (Bad file descriptor) [pid 5394] close(13) = -1 EBADF (Bad file descriptor) [pid 5394] close(14) = -1 EBADF (Bad file descriptor) [pid 5394] close(15) = -1 EBADF (Bad file descriptor) [pid 5394] close(16) = -1 EBADF (Bad file descriptor) [pid 5394] close(17) = -1 EBADF (Bad file descriptor) [pid 5394] close(18) = -1 EBADF (Bad file descriptor) [pid 5394] close(19) = -1 EBADF (Bad file descriptor) [pid 5394] close(20) = -1 EBADF (Bad file descriptor) [pid 5394] close(21) = -1 EBADF (Bad file descriptor) [pid 5394] close(22) = -1 EBADF (Bad file descriptor) [pid 5394] close(23) = -1 EBADF (Bad file descriptor) [pid 5394] close(24) = -1 EBADF (Bad file descriptor) [pid 5394] close(25) = -1 EBADF (Bad file descriptor) [pid 5394] close(26 [pid 5390] +++ exited with 0 +++ [pid 5394] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5394] close(27) = -1 EBADF (Bad file descriptor) [pid 5394] close(28 [pid 5070] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=14, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- [pid 5394] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5394] close(29) = -1 EBADF (Bad file descriptor) [pid 5394] exit_group(0) = ? [pid 5070] umount2("./12", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5394] +++ exited with 0 +++ [pid 5070] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5070] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=21, si_uid=0, si_status=0, si_utime=0, si_stime=12 /* 0.12 s */} --- [pid 5070] <... openat resumed>) = 3 [pid 5074] umount2("./19", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] fstat(3, [pid 5074] openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5070] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5074] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5070] getdents64(3, [pid 5074] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5070] <... getdents64 resumed>0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5074] umount2("./19/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5070] umount2("./12/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./19/binderfs", [pid 5070] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5070] lstat("./12/binderfs", [pid 5074] unlink("./19/binderfs" [pid 5070] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5074] <... unlink resumed>) = 0 [pid 5070] unlink("./12/binderfs" [pid 5074] umount2("./19/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] <... unlink resumed>) = 0 [pid 5074] lstat("./19/cgroup", [pid 5070] umount2("./12/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5074] unlink("./19/cgroup" [pid 5070] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [ 122.072148][ T5394] Out of memory and no killable processes... [ 122.080378][ T5391] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 122.122495][ T5391] CPU: 0 PID: 5391 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 122.132995][ T5391] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 122.143090][ T5391] Call Trace: [ 122.146409][ T5391] [ 122.149379][ T5391] dump_stack_lvl+0x1e7/0x2d0 [ 122.154119][ T5391] ? nf_tcp_handle_invalid+0x640/0x640 [ 122.159636][ T5391] ? panic+0x770/0x770 [ 122.163776][ T5391] dump_header+0xdc/0x940 [ 122.168163][ T5391] out_of_memory+0xf21/0x12c0 [ 122.172894][ T5391] ? mutex_lock_io_nested+0x60/0x60 [ 122.178150][ T5391] ? mark_lock+0x9a/0x340 [ 122.182533][ T5391] ? unregister_oom_notifier+0x20/0x20 [ 122.188042][ T5391] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 122.194087][ T5391] mem_cgroup_out_of_memory+0x263/0x3b0 [ 122.199693][ T5391] ? mem_cgroup_oom_trylock+0x210/0x210 [ 122.205317][ T5391] ? cgroup_file_notify+0x127/0x190 [ 122.210586][ T5391] memory_max_write+0x355/0x470 [ 122.215503][ T5391] ? memory_max_show+0xa0/0xa0 [ 122.220326][ T5391] ? read_lock_is_recursive+0x20/0x20 [ 122.225771][ T5391] ? memory_max_show+0xa0/0xa0 [ 122.230592][ T5391] cgroup_file_write+0x2b1/0x780 [ 122.235586][ T5391] ? cgroup_seqfile_stop+0xd0/0xd0 [ 122.240752][ T5391] ? __virt_addr_valid+0x22f/0x2e0 [ 122.245935][ T5391] ? cgroup_seqfile_stop+0xd0/0xd0 [ 122.251093][ T5391] kernfs_fop_write_iter+0x3a6/0x4f0 [ 122.256443][ T5391] vfs_write+0x7b2/0xbb0 [ 122.260752][ T5391] ? file_end_write+0x240/0x240 [ 122.265658][ T5391] ? do_raw_spin_unlock+0x13b/0x8b0 [pid 5074] <... unlink resumed>) = 0 [pid 5070] lstat("./12/cgroup", [pid 5074] umount2("./19/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5074] lstat("./19/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5074] unlink("./19/cgroup.net") = 0 [pid 5074] umount2("./19/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5070] unlink("./12/cgroup") = 0 [pid 5070] umount2("./12/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./12/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5070] unlink("./12/cgroup.net") = 0 [ 122.270910][ T5391] ? lockdep_hardirqs_on+0x98/0x140 [ 122.276161][ T5391] ? __fdget_pos+0x265/0x2f0 [ 122.280818][ T5391] ksys_write+0x1a0/0x2c0 [ 122.285203][ T5391] ? __ia32_sys_read+0x90/0x90 [ 122.290013][ T5391] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 122.296054][ T5391] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 122.302097][ T5391] do_syscall_64+0x41/0xc0 [ 122.306561][ T5391] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 122.312513][ T5391] RIP: 0033:0x7fd49ce20129 [ 122.316969][ T5391] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 122.336623][ T5391] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 122.345097][ T5391] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 122.353115][ T5391] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 122.361135][ T5391] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [pid 5070] umount2("./12/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... umount2 resumed>) = 0 [pid 5070] <... umount2 resumed>) = 0 [pid 5074] umount2("./19/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5070] umount2("./12/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5070] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./19/file0", [pid 5070] lstat("./12/file0", [pid 5074] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5070] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5074] umount2("./19/file0", MNT_DETACH|UMOUNT_NOFOLLOW [ 122.369162][ T5391] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 122.377174][ T5391] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 000000000000000d [ 122.385213][ T5391] [ 122.394406][ T5391] memory: usage 8kB, limit 0kB, failcnt 55 [ 122.400455][ T5391] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 122.407895][ T5391] Memory cgroup stats for /syz1: [ 122.408096][ T5391] anon 0 [ 122.408096][ T5391] file 0 [ 122.408096][ T5391] kernel 8192 [pid 5070] umount2("./12/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5070] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] openat(AT_FDCWD, "./19/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5070] openat(AT_FDCWD, "./12/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5074] <... openat resumed>) = 4 [pid 5070] <... openat resumed>) = 4 [pid 5074] fstat(4, [pid 5070] fstat(4, [pid 5074] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5070] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5074] getdents64(4, [pid 5070] getdents64(4, [pid 5074] <... getdents64 resumed>0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5070] <... getdents64 resumed>0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5074] getdents64(4, [pid 5070] getdents64(4, [pid 5074] <... getdents64 resumed>0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5070] <... getdents64 resumed>0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5074] close(4 [pid 5070] close(4 [pid 5074] <... close resumed>) = 0 [pid 5070] <... close resumed>) = 0 [pid 5074] rmdir("./19/file0" [pid 5070] rmdir("./12/file0" [pid 5074] <... rmdir resumed>) = 0 [pid 5070] <... rmdir resumed>) = 0 [pid 5074] umount2("./19/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5070] umount2("./12/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5070] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./19/cgroup.cpu", [pid 5070] lstat("./12/cgroup.cpu", [pid 5074] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5070] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5074] unlink("./19/cgroup.cpu" [pid 5070] unlink("./12/cgroup.cpu" [pid 5074] <... unlink resumed>) = 0 [pid 5070] <... unlink resumed>) = 0 [pid 5074] getdents64(3, [pid 5070] getdents64(3, [pid 5074] <... getdents64 resumed>0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5070] <... getdents64 resumed>0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5074] close(3 [ 122.408096][ T5391] kernel_stack 0 [ 122.408096][ T5391] pagetables 0 [ 122.408096][ T5391] sec_pagetables 0 [ 122.408096][ T5391] percpu 0 [ 122.408096][ T5391] sock 0 [ 122.408096][ T5391] vmalloc 0 [ 122.408096][ T5391] shmem 0 [ 122.408096][ T5391] zswap 0 [ 122.408096][ T5391] zswapped 0 [ 122.408096][ T5391] file_mapped 0 [ 122.408096][ T5391] file_dirty 0 [ 122.408096][ T5391] file_writeback 0 [ 122.408096][ T5391] swapcached 0 [ 122.408096][ T5391] anon_thp 0 [ 122.408096][ T5391] file_thp 0 [ 122.408096][ T5391] shmem_thp 0 [pid 5070] close(3 [pid 5074] <... close resumed>) = 0 [pid 5070] <... close resumed>) = 0 [pid 5074] rmdir("./19" [pid 5070] rmdir("./12" [pid 5074] <... rmdir resumed>) = 0 [pid 5070] <... rmdir resumed>) = 0 [pid 5074] mkdir("./20", 0777 [pid 5070] mkdir("./13", 0777 [pid 5074] <... mkdir resumed>) = 0 [pid 5070] <... mkdir resumed>) = 0 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5070] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5411 attached [pid 5411] chdir("./13" [pid 5074] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 22 [pid 5070] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 15 [pid 5411] <... chdir resumed>) = 0 [pid 5411] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5411] setpgid(0, 0) = 0 [pid 5411] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 5411] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 5411] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 5411] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC./strace-static-x86_64: Process 5410 attached ) = 3 [pid 5411] write(3, "1000", 4) = 4 [pid 5411] close(3) = 0 [pid 5410] chdir("./20" [pid 5411] symlink("/dev/binderfs", "./binderfs") = 0 [ 122.408096][ T5391] inactive_anon 0 [ 122.408096][ T5391] active_anon 0 [ 122.408096][ T5391] inactive_file 0 [ 122.408096][ T5391] active_file 0 [ 122.408096][ T5391] unevictable 0 [ 122.408096][ T5391] slab_reclaimable 6752 [ 122.408096][ T5391] slab_unreclaimable 0 [ 122.408096][ T5391] slab 6752 [ 122.408096][ T5391] workingset_refault_anon 0 [ 122.508033][ T5391] Tasks state (memory values in pages): [ 122.514217][ T5391] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5411] mkdir("./file0", 000) = 0 [pid 5410] <... chdir resumed>) = 0 [pid 5411] open("./file0", O_RDONLY) = 3 [pid 5410] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5411] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5410] <... prctl resumed>) = 0 [pid 5410] setpgid(0, 0) = 0 [pid 5410] symlink("/syzcgroup/unified/syz3", "./cgroup" [pid 5411] <... mount resumed>) = 0 [pid 5410] <... symlink resumed>) = 0 [pid 5410] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu" [pid 5411] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5410] <... symlink resumed>) = 0 [pid 5410] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 5410] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5410] write(3, "1000", 4) = 4 [pid 5410] close(3) = 0 [pid 5410] symlink("/dev/binderfs", "./binderfs" [pid 5411] <... openat resumed>) = 4 [pid 5410] <... symlink resumed>) = 0 [pid 5410] mkdir("./file0", 000 [pid 5411] openat(4, "syz1", O_RDWR|O_PATH [pid 5410] <... mkdir resumed>) = 0 [pid 5411] <... openat resumed>) = 5 [pid 5410] open("./file0", O_RDONLY [pid 5411] openat(5, "memory.max", O_RDWR [pid 5410] <... open resumed>) = 3 [pid 5410] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5411] <... openat resumed>) = 6 [pid 5410] <... mount resumed>) = 0 [pid 5391] <... write resumed>) = 18 [pid 5410] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5391] close(3 [pid 5410] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5391] <... close resumed>) = 0 [pid 5410] openat(5, "memory.max", O_RDWR) = 6 [pid 5391] close(4 [pid 5410] write(6, "0x000000000000040e", 18 [pid 5391] <... close resumed>) = 0 [pid 5391] close(5) = 0 [pid 5391] close(6 [pid 5411] write(6, "0x000000000000040e", 18 [pid 5391] <... close resumed>) = 0 [pid 5391] close(7) = -1 EBADF (Bad file descriptor) [pid 5391] close(8) = -1 EBADF (Bad file descriptor) [pid 5391] close(9) = -1 EBADF (Bad file descriptor) [pid 5391] close(10) = -1 EBADF (Bad file descriptor) [pid 5391] close(11) = -1 EBADF (Bad file descriptor) [pid 5391] close(12) = -1 EBADF (Bad file descriptor) [pid 5391] close(13) = -1 EBADF (Bad file descriptor) [pid 5391] close(14) = -1 EBADF (Bad file descriptor) [pid 5391] close(15) = -1 EBADF (Bad file descriptor) [pid 5391] close(16) = -1 EBADF (Bad file descriptor) [pid 5391] close(17) = -1 EBADF (Bad file descriptor) [pid 5391] close(18) = -1 EBADF (Bad file descriptor) [pid 5391] close(19) = -1 EBADF (Bad file descriptor) [pid 5391] close(20) = -1 EBADF (Bad file descriptor) [pid 5391] close(21) = -1 EBADF (Bad file descriptor) [pid 5391] close(22) = -1 EBADF (Bad file descriptor) [pid 5391] close(23) = -1 EBADF (Bad file descriptor) [pid 5391] close(24) = -1 EBADF (Bad file descriptor) [pid 5391] close(25) = -1 EBADF (Bad file descriptor) [pid 5391] close(26) = -1 EBADF (Bad file descriptor) [pid 5391] close(27) = -1 EBADF (Bad file descriptor) [pid 5391] close(28) = -1 EBADF (Bad file descriptor) [pid 5391] close(29) = -1 EBADF (Bad file descriptor) [pid 5391] exit_group(0) = ? [pid 5391] +++ exited with 0 +++ [pid 5072] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=15, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- [ 122.524173][ T5391] Out of memory and no killable processes... [ 122.552007][ T5400] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5072] umount2("./13", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5072] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5072] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5072] umount2("./13/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./13/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5072] unlink("./13/binderfs") = 0 [pid 5072] umount2("./13/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./13/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5072] unlink("./13/cgroup") = 0 [pid 5072] umount2("./13/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./13/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [ 122.580351][ T5400] CPU: 0 PID: 5400 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 122.590842][ T5400] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 122.600938][ T5400] Call Trace: [ 122.604245][ T5400] [ 122.607211][ T5400] dump_stack_lvl+0x1e7/0x2d0 [ 122.611944][ T5400] ? nf_tcp_handle_invalid+0x640/0x640 [ 122.617456][ T5400] ? panic+0x770/0x770 [ 122.621594][ T5400] dump_header+0xdc/0x940 [ 122.625984][ T5400] out_of_memory+0xf21/0x12c0 [pid 5072] unlink("./13/cgroup.net") = 0 [ 122.630732][ T5400] ? mutex_lock_io_nested+0x60/0x60 [ 122.635996][ T5400] ? mark_lock+0x9a/0x340 [ 122.640360][ T5400] ? unregister_oom_notifier+0x20/0x20 [ 122.645858][ T5400] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 122.651901][ T5400] mem_cgroup_out_of_memory+0x263/0x3b0 [ 122.657510][ T5400] ? mem_cgroup_oom_trylock+0x210/0x210 [ 122.663122][ T5400] ? cgroup_file_notify+0x127/0x190 [ 122.668372][ T5400] memory_max_write+0x355/0x470 [ 122.673272][ T5400] ? memory_max_show+0xa0/0xa0 [ 122.678094][ T5400] ? read_lock_is_recursive+0x20/0x20 [ 122.683518][ T5400] ? memory_max_show+0xa0/0xa0 [ 122.688325][ T5400] cgroup_file_write+0x2b1/0x780 [ 122.693303][ T5400] ? cgroup_seqfile_stop+0xd0/0xd0 [ 122.698465][ T5400] ? __virt_addr_valid+0x22f/0x2e0 [ 122.703641][ T5400] ? cgroup_seqfile_stop+0xd0/0xd0 [ 122.708802][ T5400] kernfs_fop_write_iter+0x3a6/0x4f0 [ 122.714148][ T5400] vfs_write+0x7b2/0xbb0 [ 122.718453][ T5400] ? file_end_write+0x240/0x240 [ 122.723362][ T5400] ? do_raw_spin_unlock+0x13b/0x8b0 [ 122.728611][ T5400] ? lockdep_hardirqs_on+0x98/0x140 [ 122.733873][ T5400] ? __fdget_pos+0x265/0x2f0 [ 122.738523][ T5400] ksys_write+0x1a0/0x2c0 [ 122.742907][ T5400] ? __ia32_sys_read+0x90/0x90 [ 122.747722][ T5400] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 122.753769][ T5400] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 122.759811][ T5400] do_syscall_64+0x41/0xc0 [ 122.764286][ T5400] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 122.770249][ T5400] RIP: 0033:0x7fd49ce20129 [ 122.774706][ T5400] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 122.794378][ T5400] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 122.802849][ T5400] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 122.810861][ T5400] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 122.818870][ T5400] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [pid 5072] umount2("./13/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5072] umount2("./13/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./13/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5072] umount2("./13/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] openat(AT_FDCWD, "./13/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5072] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5072] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5072] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5072] close(4) = 0 [pid 5072] rmdir("./13/file0") = 0 [pid 5072] umount2("./13/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./13/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5072] unlink("./13/cgroup.cpu") = 0 [pid 5072] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5072] close(3) = 0 [pid 5072] rmdir("./13") = 0 [pid 5072] mkdir("./14", 0777) = 0 [ 122.826882][ T5400] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 122.834903][ T5400] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000013 [ 122.842947][ T5400] [ 122.853484][ T5400] memory: usage 8kB, limit 0kB, failcnt 55 [ 122.859885][ T5400] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 122.874728][ T5400] Memory cgroup stats for /syz1: [pid 5072] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555574ac5d0) = 16 [ 122.874990][ T5400] anon 0 [ 122.874990][ T5400] file 0 [ 122.874990][ T5400] kernel 8192 [ 122.874990][ T5400] kernel_stack 0 [ 122.874990][ T5400] pagetables 0 [ 122.874990][ T5400] sec_pagetables 0 [ 122.874990][ T5400] percpu 0 [ 122.874990][ T5400] sock 0 [ 122.874990][ T5400] vmalloc 0 [ 122.874990][ T5400] shmem 0 [ 122.874990][ T5400] zswap 0 [ 122.874990][ T5400] zswapped 0 [ 122.874990][ T5400] file_mapped 0 [ 122.874990][ T5400] file_dirty 0 [ 122.874990][ T5400] file_writeback 0 [ 122.874990][ T5400] swapcached 0 ./strace-static-x86_64: Process 5417 attached [pid 5417] chdir("./14") = 0 [pid 5417] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5417] setpgid(0, 0) = 0 [pid 5417] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 5417] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [pid 5417] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 5417] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5417] write(3, "1000", 4) = 4 [pid 5417] close(3) = 0 [pid 5417] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5417] mkdir("./file0", 000) = 0 [pid 5417] open("./file0", O_RDONLY) = 3 [pid 5417] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5417] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5417] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5417] openat(5, "memory.max", O_RDWR) = 6 [ 122.874990][ T5400] anon_thp 0 [ 122.874990][ T5400] file_thp 0 [ 122.874990][ T5400] shmem_thp 0 [ 122.874990][ T5400] inactive_anon 0 [ 122.874990][ T5400] active_anon 0 [ 122.874990][ T5400] inactive_file 0 [ 122.874990][ T5400] active_file 0 [ 122.874990][ T5400] unevictable 0 [ 122.874990][ T5400] slab_reclaimable 6752 [ 122.874990][ T5400] slab_unreclaimable 0 [ 122.874990][ T5400] slab 6752 [ 122.874990][ T5400] workingset_refault_anon 0 [ 123.058499][ T5400] Tasks state (memory values in pages): [ 123.064335][ T5400] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 123.082007][ T5400] Out of memory and no killable processes... [ 123.092131][ T5403] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 123.103214][ T5403] CPU: 1 PID: 5403 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 123.113681][ T5403] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 123.123783][ T5403] Call Trace: [ 123.127106][ T5403] [ 123.130072][ T5403] dump_stack_lvl+0x1e7/0x2d0 [ 123.134813][ T5403] ? nf_tcp_handle_invalid+0x640/0x640 [ 123.140325][ T5403] ? panic+0x770/0x770 [ 123.144457][ T5403] dump_header+0xdc/0x940 [ 123.148844][ T5403] out_of_memory+0xf21/0x12c0 [ 123.153582][ T5403] ? mutex_lock_io_nested+0x60/0x60 [pid 5417] write(6, "0x000000000000040e", 18 [pid 5400] <... write resumed>) = 18 [pid 5400] close(3) = 0 [pid 5400] close(4) = 0 [pid 5400] close(5) = 0 [pid 5400] close(6) = 0 [pid 5400] close(7) = -1 EBADF (Bad file descriptor) [pid 5400] close(8) = -1 EBADF (Bad file descriptor) [pid 5400] close(9) = -1 EBADF (Bad file descriptor) [pid 5400] close(10) = -1 EBADF (Bad file descriptor) [pid 5400] close(11) = -1 EBADF (Bad file descriptor) [ 123.158842][ T5403] ? preempt_schedule+0xdd/0xf0 [ 123.163749][ T5403] ? unregister_oom_notifier+0x20/0x20 [ 123.169264][ T5403] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 123.175301][ T5403] mem_cgroup_out_of_memory+0x263/0x3b0 [ 123.180899][ T5403] ? preempt_schedule_thunk+0x1a/0x20 [ 123.186333][ T5403] ? mem_cgroup_oom_trylock+0x210/0x210 [ 123.191954][ T5403] ? cgroup_file_notify+0x127/0x190 [ 123.197211][ T5403] memory_max_write+0x355/0x470 [ 123.202130][ T5403] ? memory_max_show+0xa0/0xa0 [pid 5400] close(12) = -1 EBADF (Bad file descriptor) [pid 5400] close(13) = -1 EBADF (Bad file descriptor) [pid 5400] close(14) = -1 EBADF (Bad file descriptor) [pid 5400] close(15) = -1 EBADF (Bad file descriptor) [pid 5400] close(16) = -1 EBADF (Bad file descriptor) [pid 5400] close(17) = -1 EBADF (Bad file descriptor) [pid 5400] close(18) = -1 EBADF (Bad file descriptor) [pid 5400] close(19) = -1 EBADF (Bad file descriptor) [ 123.206936][ T5403] ? read_lock_is_recursive+0x20/0x20 [ 123.212336][ T5403] ? memory_max_show+0xa0/0xa0 [ 123.217117][ T5403] cgroup_file_write+0x2b1/0x780 [ 123.222073][ T5403] ? cgroup_seqfile_stop+0xd0/0xd0 [ 123.227197][ T5403] ? __virt_addr_valid+0x22f/0x2e0 [ 123.232340][ T5403] ? cgroup_seqfile_stop+0xd0/0xd0 [ 123.237466][ T5403] kernfs_fop_write_iter+0x3a6/0x4f0 [ 123.242777][ T5403] vfs_write+0x7b2/0xbb0 [ 123.247050][ T5403] ? file_end_write+0x240/0x240 [ 123.251918][ T5403] ? do_raw_spin_unlock+0x13b/0x8b0 [ 123.257243][ T5403] ? lockdep_hardirqs_on+0x98/0x140 [ 123.262464][ T5403] ? __fdget_pos+0x265/0x2f0 [ 123.267073][ T5403] ksys_write+0x1a0/0x2c0 [ 123.271450][ T5403] ? __ia32_sys_read+0x90/0x90 [ 123.276270][ T5403] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 123.282317][ T5403] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 123.288356][ T5403] do_syscall_64+0x41/0xc0 [ 123.292802][ T5403] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 123.298735][ T5403] RIP: 0033:0x7fd49ce20129 [ 123.303176][ T5403] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 123.322982][ T5403] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 123.331496][ T5403] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 123.339480][ T5403] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 123.347467][ T5403] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [pid 5400] close(20) = -1 EBADF (Bad file descriptor) [ 123.355445][ T5403] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 123.363430][ T5403] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000010 [ 123.371432][ T5403] [ 123.384927][ T5403] memory: usage 8kB, limit 0kB, failcnt 55 [ 123.391914][ T5403] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 123.399672][ T5403] Memory cgroup stats for /syz1: [ 123.399872][ T5403] anon 0 [ 123.399872][ T5403] file 0 [ 123.399872][ T5403] kernel 8192 [ 123.399872][ T5403] kernel_stack 0 [ 123.399872][ T5403] pagetables 0 [ 123.399872][ T5403] sec_pagetables 0 [ 123.399872][ T5403] percpu 0 [ 123.399872][ T5403] sock 0 [ 123.399872][ T5403] vmalloc 0 [ 123.399872][ T5403] shmem 0 [ 123.399872][ T5403] zswap 0 [ 123.399872][ T5403] zswapped 0 [ 123.399872][ T5403] file_mapped 0 [ 123.399872][ T5403] file_dirty 0 [ 123.399872][ T5403] file_writeback 0 [ 123.399872][ T5403] swapcached 0 [ 123.399872][ T5403] anon_thp 0 [ 123.399872][ T5403] file_thp 0 [pid 5400] close(21) = -1 EBADF (Bad file descriptor) [ 123.399872][ T5403] shmem_thp 0 [ 123.399872][ T5403] inactive_anon 0 [ 123.399872][ T5403] active_anon 0 [ 123.399872][ T5403] inactive_file 0 [ 123.399872][ T5403] active_file 0 [ 123.399872][ T5403] unevictable 0 [ 123.399872][ T5403] slab_reclaimable 6752 [ 123.399872][ T5403] slab_unreclaimable 0 [ 123.399872][ T5403] slab 6752 [ 123.399872][ T5403] workingset_refault_anon 0 [ 123.498888][ T5403] Tasks state (memory values in pages): [pid 5400] close(22) = -1 EBADF (Bad file descriptor) [pid 5400] close(23) = -1 EBADF (Bad file descriptor) [pid 5400] close(24) = -1 EBADF (Bad file descriptor) [pid 5400] close(25) = -1 EBADF (Bad file descriptor) [pid 5400] close(26) = -1 EBADF (Bad file descriptor) [pid 5400] close(27) = -1 EBADF (Bad file descriptor) [pid 5400] close(28) = -1 EBADF (Bad file descriptor) [pid 5400] close(29) = -1 EBADF (Bad file descriptor) [pid 5400] exit_group(0) = ? [pid 5400] +++ exited with 0 +++ [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=21, si_uid=0, si_status=0, si_utime=0, si_stime=12 /* 0.12 s */} --- [ 123.504481][ T5403] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 123.514796][ T5403] Out of memory and no killable processes... [ 123.522458][ T5410] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 123.534648][ T5410] CPU: 0 PID: 5410 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 123.545117][ T5410] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 123.555211][ T5410] Call Trace: [ 123.558526][ T5410] [ 123.561500][ T5410] dump_stack_lvl+0x1e7/0x2d0 [ 123.566236][ T5410] ? nf_tcp_handle_invalid+0x640/0x640 [ 123.571762][ T5410] ? panic+0x770/0x770 [ 123.575889][ T5410] dump_header+0xdc/0x940 [ 123.580275][ T5410] out_of_memory+0xf21/0x12c0 [ 123.585007][ T5410] ? mutex_lock_io_nested+0x60/0x60 [ 123.590281][ T5410] ? mark_lock+0x9a/0x340 [ 123.594643][ T5410] ? unregister_oom_notifier+0x20/0x20 [ 123.600149][ T5410] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [pid 5403] <... write resumed>) = 18 [pid 5075] umount2("./19", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5075] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5075] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5075] umount2("./19/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./19/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5075] unlink("./19/binderfs") = 0 [pid 5075] umount2("./19/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./19/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5075] unlink("./19/cgroup") = 0 [pid 5075] umount2("./19/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./19/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5075] unlink("./19/cgroup.net") = 0 [pid 5075] umount2("./19/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5403] close(3) = 0 [ 123.606197][ T5410] mem_cgroup_out_of_memory+0x263/0x3b0 [ 123.611802][ T5410] ? mem_cgroup_oom_trylock+0x210/0x210 [ 123.617435][ T5410] ? cgroup_file_notify+0x127/0x190 [ 123.622697][ T5410] memory_max_write+0x355/0x470 [ 123.627607][ T5410] ? memory_max_show+0xa0/0xa0 [ 123.632437][ T5410] ? read_lock_is_recursive+0x20/0x20 [ 123.637864][ T5410] ? memory_max_show+0xa0/0xa0 [ 123.642657][ T5410] cgroup_file_write+0x2b1/0x780 [ 123.647615][ T5410] ? cgroup_seqfile_stop+0xd0/0xd0 [ 123.652734][ T5410] ? __virt_addr_valid+0x22f/0x2e0 [ 123.657876][ T5410] ? cgroup_seqfile_stop+0xd0/0xd0 [ 123.662996][ T5410] kernfs_fop_write_iter+0x3a6/0x4f0 [ 123.668304][ T5410] vfs_write+0x7b2/0xbb0 [ 123.672565][ T5410] ? file_end_write+0x240/0x240 [ 123.677435][ T5410] ? do_raw_spin_unlock+0x13b/0x8b0 [ 123.682650][ T5410] ? lockdep_hardirqs_on+0x98/0x140 [ 123.687869][ T5410] ? __fdget_pos+0x265/0x2f0 [ 123.692475][ T5410] ksys_write+0x1a0/0x2c0 [ 123.696824][ T5410] ? __ia32_sys_read+0x90/0x90 [ 123.701622][ T5410] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 123.707639][ T5410] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 123.713647][ T5410] do_syscall_64+0x41/0xc0 [ 123.718090][ T5410] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 123.724018][ T5410] RIP: 0033:0x7fd49ce20129 [ 123.728454][ T5410] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 123.748078][ T5410] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 123.756533][ T5410] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 123.764525][ T5410] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 123.772511][ T5410] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 123.780504][ T5410] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 123.788482][ T5410] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000014 [ 123.796479][ T5410] [pid 5403] close(4) = 0 [pid 5075] <... umount2 resumed>) = 0 [pid 5403] close(5 [pid 5075] umount2("./19/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5403] <... close resumed>) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5403] close(6 [pid 5075] lstat("./19/file0", [pid 5403] <... close resumed>) = 0 [pid 5075] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5403] close(7 [pid 5075] umount2("./19/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5403] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5403] close(8 [pid 5075] openat(AT_FDCWD, "./19/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5403] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... openat resumed>) = 4 [pid 5403] close(9 [pid 5075] fstat(4, [pid 5403] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5403] close(10 [pid 5075] getdents64(4, [pid 5403] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... getdents64 resumed>0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5403] close(11 [pid 5075] getdents64(4, [pid 5403] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... getdents64 resumed>0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5403] close(12 [pid 5075] close(4 [pid 5403] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... close resumed>) = 0 [pid 5403] close(13 [pid 5075] rmdir("./19/file0" [pid 5403] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... rmdir resumed>) = 0 [pid 5403] close(14 [pid 5075] umount2("./19/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5403] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5403] close(15 [pid 5075] lstat("./19/cgroup.cpu", [pid 5403] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5403] close(16 [pid 5075] unlink("./19/cgroup.cpu" [pid 5403] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... unlink resumed>) = 0 [pid 5403] close(17 [pid 5075] getdents64(3, [pid 5403] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... getdents64 resumed>0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5403] close(18 [pid 5075] close(3 [pid 5403] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... close resumed>) = 0 [pid 5403] close(19 [pid 5075] rmdir("./19" [pid 5403] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... rmdir resumed>) = 0 [pid 5403] close(20 [pid 5075] mkdir("./20", 0777 [ 123.806679][ T5410] memory: usage 8kB, limit 0kB, failcnt 55 [ 123.812549][ T5410] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 123.868239][ T5410] Memory cgroup stats for /syz1: [ 123.868598][ T5410] anon 0 [ 123.868598][ T5410] file 0 [ 123.868598][ T5410] kernel 8192 [ 123.868598][ T5410] kernel_stack 0 [ 123.868598][ T5410] pagetables 0 [ 123.868598][ T5410] sec_pagetables 0 [ 123.868598][ T5410] percpu 0 [ 123.868598][ T5410] sock 0 [ 123.868598][ T5410] vmalloc 0 [ 123.868598][ T5410] shmem 0 [ 123.868598][ T5410] zswap 0 [ 123.868598][ T5410] zswapped 0 [ 123.868598][ T5410] file_mapped 0 [ 123.868598][ T5410] file_dirty 0 [pid 5403] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... mkdir resumed>) = 0 [pid 5403] close(21) = -1 EBADF (Bad file descriptor) [pid 5403] close(22) = -1 EBADF (Bad file descriptor) [pid 5403] close(23) = -1 EBADF (Bad file descriptor) [pid 5403] close(24) = -1 EBADF (Bad file descriptor) [pid 5403] close(25) = -1 EBADF (Bad file descriptor) [pid 5403] close(26) = -1 EBADF (Bad file descriptor) [pid 5403] close(27) = -1 EBADF (Bad file descriptor) [pid 5403] close(28) = -1 EBADF (Bad file descriptor) [pid 5403] close(29) = -1 EBADF (Bad file descriptor) [pid 5403] exit_group(0) = ? [pid 5403] +++ exited with 0 +++ [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5073] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=18, si_uid=0, si_status=0, si_utime=0, si_stime=11 /* 0.11 s */} --- [pid 5073] umount2("./16", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5073] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5073] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5073] umount2("./16/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5428 attached [pid 5073] lstat("./16/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5073] unlink("./16/binderfs") = 0 [pid 5073] umount2("./16/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 22 [pid 5073] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./16/cgroup", [pid 5428] chdir("./20" [pid 5073] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5073] unlink("./16/cgroup") = 0 [pid 5073] umount2("./16/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./16/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5073] unlink("./16/cgroup.net") = 0 [pid 5073] umount2("./16/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5428] <... chdir resumed>) = 0 [pid 5073] <... umount2 resumed>) = 0 [pid 5428] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5073] umount2("./16/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5428] <... prctl resumed>) = 0 [pid 5073] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5428] setpgid(0, 0 [pid 5073] lstat("./16/file0", [pid 5428] <... setpgid resumed>) = 0 [pid 5073] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5073] umount2("./16/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] openat(AT_FDCWD, "./16/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5428] symlink("/syzcgroup/unified/syz2", "./cgroup" [pid 5073] <... openat resumed>) = 4 [ 123.868598][ T5410] file_writeback 0 [ 123.868598][ T5410] swapcached 0 [ 123.868598][ T5410] anon_thp 0 [ 123.868598][ T5410] file_thp 0 [ 123.868598][ T5410] shmem_thp 0 [ 123.868598][ T5410] inactive_anon 0 [ 123.868598][ T5410] active_anon 0 [ 123.868598][ T5410] inactive_file 0 [ 123.868598][ T5410] active_file 0 [ 123.868598][ T5410] unevictable 0 [ 123.868598][ T5410] slab_reclaimable 6752 [ 123.868598][ T5410] slab_unreclaimable 0 [ 123.868598][ T5410] slab 6752 [ 123.868598][ T5410] workingset_refault_anon 0 [pid 5428] <... symlink resumed>) = 0 [pid 5073] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5073] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5073] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5073] close(4) = 0 [pid 5073] rmdir("./16/file0") = 0 [pid 5073] umount2("./16/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./16/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5073] unlink("./16/cgroup.cpu") = 0 [pid 5073] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5073] close(3) = 0 [pid 5073] rmdir("./16") = 0 [pid 5073] mkdir("./17", 0777) = 0 [pid 5073] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5429 attached [pid 5428] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu" [pid 5429] chdir("./17" [pid 5073] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 19 [pid 5429] <... chdir resumed>) = 0 [pid 5429] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5428] <... symlink resumed>) = 0 [pid 5429] <... prctl resumed>) = 0 [pid 5429] setpgid(0, 0) = 0 [pid 5429] symlink("/syzcgroup/unified/syz4", "./cgroup" [pid 5428] symlink("/syzcgroup/net/syz2", "./cgroup.net" [pid 5429] <... symlink resumed>) = 0 [pid 5429] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 5428] <... symlink resumed>) = 0 [pid 5429] symlink("/syzcgroup/net/syz4", "./cgroup.net" [pid 5428] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5429] <... symlink resumed>) = 0 [pid 5429] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5428] <... openat resumed>) = 3 [pid 5429] write(3, "1000", 4 [pid 5428] write(3, "1000", 4 [pid 5429] <... write resumed>) = 4 [pid 5429] close(3 [pid 5428] <... write resumed>) = 4 [pid 5429] <... close resumed>) = 0 [pid 5428] close(3 [pid 5429] symlink("/dev/binderfs", "./binderfs" [pid 5428] <... close resumed>) = 0 [pid 5429] <... symlink resumed>) = 0 [pid 5428] symlink("/dev/binderfs", "./binderfs" [pid 5429] mkdir("./file0", 000) = 0 [pid 5428] <... symlink resumed>) = 0 [pid 5429] open("./file0", O_RDONLY) = 3 [pid 5428] mkdir("./file0", 000 [pid 5429] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5429] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5428] <... mkdir resumed>) = 0 [pid 5429] openat(4, "syz1", O_RDWR|O_PATH [pid 5428] open("./file0", O_RDONLY [pid 5429] <... openat resumed>) = 5 [pid 5428] <... open resumed>) = 3 [pid 5429] openat(5, "memory.max", O_RDWR) = 6 [pid 5428] mount(NULL, "./file0", "cgroup2", 0, NULL [ 123.989844][ T5410] Tasks state (memory values in pages): [ 123.995459][ T5410] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5429] write(6, "0x000000000000040e", 18 [pid 5428] <... mount resumed>) = 0 [pid 5428] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5428] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5428] openat(5, "memory.max", O_RDWR) = 6 [pid 5428] write(6, "0x000000000000040e", 18 [pid 5410] <... write resumed>) = 18 [pid 5410] close(3) = 0 [pid 5410] close(4) = 0 [pid 5410] close(5) = 0 [pid 5410] close(6) = 0 [pid 5410] close(7) = -1 EBADF (Bad file descriptor) [pid 5410] close(8) = -1 EBADF (Bad file descriptor) [pid 5410] close(9) = -1 EBADF (Bad file descriptor) [pid 5410] close(10) = -1 EBADF (Bad file descriptor) [pid 5410] close(11) = -1 EBADF (Bad file descriptor) [pid 5410] close(12) = -1 EBADF (Bad file descriptor) [pid 5410] close(13) = -1 EBADF (Bad file descriptor) [pid 5410] close(14) = -1 EBADF (Bad file descriptor) [ 124.032437][ T5410] Out of memory and no killable processes... [ 124.042108][ T5411] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5410] close(15) = -1 EBADF (Bad file descriptor) [pid 5410] close(16) = -1 EBADF (Bad file descriptor) [pid 5410] close(17) = -1 EBADF (Bad file descriptor) [pid 5410] close(18) = -1 EBADF (Bad file descriptor) [pid 5410] close(19) = -1 EBADF (Bad file descriptor) [pid 5410] close(20) = -1 EBADF (Bad file descriptor) [pid 5410] close(21) = -1 EBADF (Bad file descriptor) [pid 5410] close(22) = -1 EBADF (Bad file descriptor) [pid 5410] close(23) = -1 EBADF (Bad file descriptor) [pid 5410] close(24) = -1 EBADF (Bad file descriptor) [pid 5410] close(25) = -1 EBADF (Bad file descriptor) [pid 5410] close(26) = -1 EBADF (Bad file descriptor) [pid 5410] close(27) = -1 EBADF (Bad file descriptor) [pid 5410] close(28) = -1 EBADF (Bad file descriptor) [pid 5410] close(29) = -1 EBADF (Bad file descriptor) [pid 5410] exit_group(0) = ? [pid 5410] +++ exited with 0 +++ [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=22, si_uid=0, si_status=0, si_utime=0, si_stime=9 /* 0.09 s */} --- [pid 5074] umount2("./20", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] openat(AT_FDCWD, "./20", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5074] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [ 124.096753][ T5411] CPU: 0 PID: 5411 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 124.107248][ T5411] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 124.117341][ T5411] Call Trace: [ 124.120654][ T5411] [ 124.123622][ T5411] dump_stack_lvl+0x1e7/0x2d0 [ 124.131835][ T5411] ? nf_tcp_handle_invalid+0x640/0x640 [ 124.137360][ T5411] ? panic+0x770/0x770 [ 124.141502][ T5411] dump_header+0xdc/0x940 [pid 5074] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5074] umount2("./20/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./20/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5074] unlink("./20/binderfs") = 0 [pid 5074] umount2("./20/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./20/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5074] unlink("./20/cgroup") = 0 [pid 5074] umount2("./20/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./20/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5074] unlink("./20/cgroup.net") = 0 [ 124.145897][ T5411] out_of_memory+0xf21/0x12c0 [ 124.150639][ T5411] ? mutex_lock_io_nested+0x60/0x60 [ 124.155906][ T5411] ? preempt_schedule+0xdd/0xf0 [ 124.160814][ T5411] ? unregister_oom_notifier+0x20/0x20 [ 124.166326][ T5411] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 124.172386][ T5411] mem_cgroup_out_of_memory+0x263/0x3b0 [ 124.177992][ T5411] ? preempt_schedule_thunk+0x1a/0x20 [ 124.183427][ T5411] ? mem_cgroup_oom_trylock+0x210/0x210 [ 124.189048][ T5411] ? cgroup_file_notify+0x127/0x190 [ 124.194309][ T5411] memory_max_write+0x355/0x470 [ 124.199237][ T5411] ? memory_max_show+0xa0/0xa0 [ 124.204055][ T5411] ? read_lock_is_recursive+0x20/0x20 [ 124.209484][ T5411] ? memory_max_show+0xa0/0xa0 [ 124.214295][ T5411] cgroup_file_write+0x2b1/0x780 [ 124.219284][ T5411] ? cgroup_seqfile_stop+0xd0/0xd0 [ 124.224439][ T5411] ? __virt_addr_valid+0x22f/0x2e0 [ 124.229612][ T5411] ? cgroup_seqfile_stop+0xd0/0xd0 [ 124.234777][ T5411] kernfs_fop_write_iter+0x3a6/0x4f0 [ 124.240215][ T5411] vfs_write+0x7b2/0xbb0 [ 124.244521][ T5411] ? file_end_write+0x240/0x240 [ 124.249436][ T5411] ? do_raw_spin_unlock+0x13b/0x8b0 [ 124.254694][ T5411] ? lockdep_hardirqs_on+0x98/0x140 [ 124.259960][ T5411] ? __fdget_pos+0x265/0x2f0 [ 124.264599][ T5411] ksys_write+0x1a0/0x2c0 [ 124.268984][ T5411] ? __ia32_sys_read+0x90/0x90 [ 124.273794][ T5411] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 124.279838][ T5411] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 124.285881][ T5411] do_syscall_64+0x41/0xc0 [ 124.290347][ T5411] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 124.296315][ T5411] RIP: 0033:0x7fd49ce20129 [ 124.300772][ T5411] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 124.320427][ T5411] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 124.328899][ T5411] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 124.336914][ T5411] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [pid 5074] umount2("./20/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5074] umount2("./20/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./20/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [ 124.344925][ T5411] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 124.352937][ T5411] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 124.360949][ T5411] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 000000000000000d [ 124.369000][ T5411] [ 124.387625][ T5411] memory: usage 8kB, limit 0kB, failcnt 55 [pid 5074] umount2("./20/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] openat(AT_FDCWD, "./20/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5074] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [ 124.393682][ T5411] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 124.404083][ T5411] Memory cgroup stats for /syz1: [ 124.404291][ T5411] anon 0 [ 124.404291][ T5411] file 0 [ 124.404291][ T5411] kernel 8192 [ 124.404291][ T5411] kernel_stack 0 [ 124.404291][ T5411] pagetables 0 [ 124.404291][ T5411] sec_pagetables 0 [ 124.404291][ T5411] percpu 0 [ 124.404291][ T5411] sock 0 [ 124.404291][ T5411] vmalloc 0 [ 124.404291][ T5411] shmem 0 [ 124.404291][ T5411] zswap 0 [ 124.404291][ T5411] zswapped 0 [ 124.404291][ T5411] file_mapped 0 [ 124.404291][ T5411] file_dirty 0 [ 124.404291][ T5411] file_writeback 0 [ 124.404291][ T5411] swapcached 0 [ 124.404291][ T5411] anon_thp 0 [ 124.404291][ T5411] file_thp 0 [ 124.404291][ T5411] shmem_thp 0 [ 124.404291][ T5411] inactive_anon 0 [ 124.404291][ T5411] active_anon 0 [ 124.404291][ T5411] inactive_file 0 [ 124.404291][ T5411] active_file 0 [ 124.404291][ T5411] unevictable 0 [ 124.404291][ T5411] slab_reclaimable 6752 [ 124.404291][ T5411] slab_unreclaimable 0 [ 124.404291][ T5411] slab 6752 [pid 5074] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5074] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5074] close(4) = 0 [pid 5074] rmdir("./20/file0") = 0 [pid 5074] umount2("./20/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./20/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5074] unlink("./20/cgroup.cpu") = 0 [pid 5074] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5074] close(3) = 0 [pid 5074] rmdir("./20") = 0 [pid 5074] mkdir("./21", 0777) = 0 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5435 attached [ 124.404291][ T5411] workingset_refault_anon 0 [pid 5435] chdir("./21" [pid 5074] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 23 [pid 5435] <... chdir resumed>) = 0 [pid 5435] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5435] setpgid(0, 0) = 0 [pid 5435] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [pid 5435] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 5435] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 5435] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5435] write(3, "1000", 4) = 4 [pid 5435] close(3) = 0 [pid 5435] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5435] mkdir("./file0", 000) = 0 [pid 5435] open("./file0", O_RDONLY) = 3 [pid 5435] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5435] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5435] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5435] openat(5, "memory.max", O_RDWR) = 6 [ 124.523596][ T5411] Tasks state (memory values in pages): [ 124.534277][ T5411] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 124.563078][ T5411] Out of memory and no killable processes... [pid 5435] write(6, "0x000000000000040e", 18 [pid 5411] <... write resumed>) = 18 [ 124.569653][ T5417] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 124.587845][ T5417] CPU: 0 PID: 5417 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 124.598325][ T5417] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 124.608425][ T5417] Call Trace: [ 124.611738][ T5417] [ 124.614701][ T5417] dump_stack_lvl+0x1e7/0x2d0 [ 124.619453][ T5417] ? nf_tcp_handle_invalid+0x640/0x640 [ 124.624958][ T5417] ? panic+0x770/0x770 [ 124.629085][ T5417] dump_header+0xdc/0x940 [ 124.633470][ T5417] out_of_memory+0xf21/0x12c0 [ 124.638203][ T5417] ? mutex_lock_io_nested+0x60/0x60 [ 124.643461][ T5417] ? preempt_schedule+0xdd/0xf0 [ 124.648359][ T5417] ? unregister_oom_notifier+0x20/0x20 [ 124.653861][ T5417] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 124.659898][ T5417] mem_cgroup_out_of_memory+0x263/0x3b0 [ 124.665488][ T5417] ? preempt_schedule_thunk+0x1a/0x20 [ 124.670917][ T5417] ? mem_cgroup_oom_trylock+0x210/0x210 [ 124.676535][ T5417] ? cgroup_file_notify+0x127/0x190 [ 124.681795][ T5417] memory_max_write+0x355/0x470 [ 124.686704][ T5417] ? memory_max_show+0xa0/0xa0 [ 124.691527][ T5417] ? read_lock_is_recursive+0x20/0x20 [ 124.696960][ T5417] ? memory_max_show+0xa0/0xa0 [ 124.701772][ T5417] cgroup_file_write+0x2b1/0x780 [ 124.706761][ T5417] ? cgroup_seqfile_stop+0xd0/0xd0 [ 124.711916][ T5417] ? __virt_addr_valid+0x22f/0x2e0 [ 124.717090][ T5417] ? cgroup_seqfile_stop+0xd0/0xd0 [ 124.722219][ T5417] kernfs_fop_write_iter+0x3a6/0x4f0 [ 124.727535][ T5417] vfs_write+0x7b2/0xbb0 [ 124.731805][ T5417] ? file_end_write+0x240/0x240 [ 124.736677][ T5417] ? do_raw_spin_unlock+0x13b/0x8b0 [ 124.741901][ T5417] ? lockdep_hardirqs_on+0x98/0x140 [ 124.747126][ T5417] ? __fdget_pos+0x265/0x2f0 [ 124.751738][ T5417] ksys_write+0x1a0/0x2c0 [ 124.756088][ T5417] ? __ia32_sys_read+0x90/0x90 [ 124.760866][ T5417] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 124.766872][ T5417] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 124.772873][ T5417] do_syscall_64+0x41/0xc0 [ 124.777308][ T5417] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 124.783222][ T5417] RIP: 0033:0x7fd49ce20129 [ 124.787681][ T5417] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 124.807299][ T5417] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 124.815730][ T5417] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 124.823709][ T5417] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 124.831690][ T5417] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 124.839674][ T5417] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 124.847660][ T5417] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 000000000000000e [ 124.855682][ T5417] [ 124.864012][ T5417] memory: usage 8kB, limit 0kB, failcnt 55 [pid 5411] close(3) = 0 [pid 5411] close(4) = 0 [pid 5411] close(5) = 0 [pid 5411] close(6) = 0 [pid 5411] close(7) = -1 EBADF (Bad file descriptor) [pid 5411] close(8) = -1 EBADF (Bad file descriptor) [pid 5411] close(9) = -1 EBADF (Bad file descriptor) [pid 5411] close(10) = -1 EBADF (Bad file descriptor) [pid 5411] close(11) = -1 EBADF (Bad file descriptor) [pid 5411] close(12) = -1 EBADF (Bad file descriptor) [pid 5411] close(13) = -1 EBADF (Bad file descriptor) [pid 5411] close(14) = -1 EBADF (Bad file descriptor) [pid 5411] close(15) = -1 EBADF (Bad file descriptor) [pid 5411] close(16) = -1 EBADF (Bad file descriptor) [pid 5411] close(17) = -1 EBADF (Bad file descriptor) [pid 5411] close(18) = -1 EBADF (Bad file descriptor) [pid 5411] close(19) = -1 EBADF (Bad file descriptor) [pid 5411] close(20) = -1 EBADF (Bad file descriptor) [pid 5411] close(21) = -1 EBADF (Bad file descriptor) [pid 5411] close(22) = -1 EBADF (Bad file descriptor) [ 124.875262][ T5417] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 124.898759][ T5417] Memory cgroup stats for /syz1: [ 124.898970][ T5417] anon 0 [ 124.898970][ T5417] file 0 [ 124.898970][ T5417] kernel 8192 [ 124.898970][ T5417] kernel_stack 0 [ 124.898970][ T5417] pagetables 0 [ 124.898970][ T5417] sec_pagetables 0 [ 124.898970][ T5417] percpu 0 [ 124.898970][ T5417] sock 0 [ 124.898970][ T5417] vmalloc 0 [ 124.898970][ T5417] shmem 0 [ 124.898970][ T5417] zswap 0 [ 124.898970][ T5417] zswapped 0 [ 124.898970][ T5417] file_mapped 0 [ 124.898970][ T5417] file_dirty 0 [ 124.898970][ T5417] file_writeback 0 [ 124.898970][ T5417] swapcached 0 [ 124.898970][ T5417] anon_thp 0 [ 124.898970][ T5417] file_thp 0 [ 124.898970][ T5417] shmem_thp 0 [pid 5411] close(23) = -1 EBADF (Bad file descriptor) [pid 5411] close(24) = -1 EBADF (Bad file descriptor) [pid 5411] close(25) = -1 EBADF (Bad file descriptor) [pid 5411] close(26) = -1 EBADF (Bad file descriptor) [pid 5411] close(27) = -1 EBADF (Bad file descriptor) [pid 5411] close(28) = -1 EBADF (Bad file descriptor) [pid 5411] close(29) = -1 EBADF (Bad file descriptor) [pid 5411] exit_group(0) = ? [pid 5411] +++ exited with 0 +++ [ 124.898970][ T5417] inactive_anon 0 [ 124.898970][ T5417] active_anon 0 [ 124.898970][ T5417] inactive_file 0 [ 124.898970][ T5417] active_file 0 [ 124.898970][ T5417] unevictable 0 [ 124.898970][ T5417] slab_reclaimable 6752 [ 124.898970][ T5417] slab_unreclaimable 0 [ 124.898970][ T5417] slab 6752 [ 124.898970][ T5417] workingset_refault_anon 0 [ 125.016717][ T5417] Tasks state (memory values in pages): [pid 5070] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=15, si_uid=0, si_status=0, si_utime=0, si_stime=10 /* 0.10 s */} --- [pid 5070] umount2("./13", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5070] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5070] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5070] umount2("./13/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./13/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5070] unlink("./13/binderfs") = 0 [pid 5070] umount2("./13/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./13/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5070] unlink("./13/cgroup") = 0 [pid 5070] umount2("./13/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./13/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5070] unlink("./13/cgroup.net") = 0 [pid 5070] umount2("./13/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5070] umount2("./13/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./13/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5070] umount2("./13/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] openat(AT_FDCWD, "./13/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5070] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [ 125.022337][ T5417] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 125.060171][ T5417] Out of memory and no killable processes... [pid 5070] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5070] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5070] close(4) = 0 [pid 5070] rmdir("./13/file0") = 0 [pid 5070] umount2("./13/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./13/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5070] unlink("./13/cgroup.cpu") = 0 [pid 5417] <... write resumed>) = 18 [pid 5417] close(3 [pid 5070] getdents64(3, [pid 5417] <... close resumed>) = 0 [pid 5070] <... getdents64 resumed>0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5417] close(4 [pid 5070] close(3 [pid 5417] <... close resumed>) = 0 [pid 5070] <... close resumed>) = 0 [pid 5070] rmdir("./13") = 0 [pid 5070] mkdir("./14", 0777) = 0 [pid 5070] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5442 attached [pid 5442] chdir("./14" [pid 5070] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 16 [pid 5442] <... chdir resumed>) = 0 [pid 5442] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5442] setpgid(0, 0) = 0 [pid 5442] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 5442] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 5442] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 5442] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5442] write(3, "1000", 4) = 4 [pid 5442] close(3) = 0 [pid 5442] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5442] mkdir("./file0", 000) = 0 [pid 5442] open("./file0", O_RDONLY) = 3 [ 125.066332][ T5429] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 125.090206][ T5429] CPU: 0 PID: 5429 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 125.100702][ T5429] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 125.110816][ T5429] Call Trace: [ 125.114146][ T5429] [ 125.117114][ T5429] dump_stack_lvl+0x1e7/0x2d0 [pid 5442] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5442] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5442] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5442] openat(5, "memory.max", O_RDWR) = 6 [ 125.121853][ T5429] ? nf_tcp_handle_invalid+0x640/0x640 [ 125.127366][ T5429] ? panic+0x770/0x770 [ 125.131511][ T5429] dump_header+0xdc/0x940 [ 125.135909][ T5429] out_of_memory+0xf21/0x12c0 [ 125.140646][ T5429] ? mutex_lock_io_nested+0x60/0x60 [ 125.145910][ T5429] ? preempt_schedule+0xdd/0xf0 [ 125.150828][ T5429] ? unregister_oom_notifier+0x20/0x20 [ 125.156351][ T5429] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 125.162420][ T5429] mem_cgroup_out_of_memory+0x263/0x3b0 [ 125.168042][ T5429] ? preempt_schedule_thunk+0x1a/0x20 [ 125.173477][ T5429] ? mem_cgroup_oom_trylock+0x210/0x210 [ 125.179103][ T5429] ? cgroup_file_notify+0x127/0x190 [ 125.184365][ T5429] memory_max_write+0x355/0x470 [ 125.189280][ T5429] ? memory_max_show+0xa0/0xa0 [ 125.194099][ T5429] ? read_lock_is_recursive+0x20/0x20 [ 125.199537][ T5429] ? memory_max_show+0xa0/0xa0 [ 125.204361][ T5429] cgroup_file_write+0x2b1/0x780 [ 125.209355][ T5429] ? cgroup_seqfile_stop+0xd0/0xd0 [ 125.214523][ T5429] ? __virt_addr_valid+0x22f/0x2e0 [ 125.219713][ T5429] ? cgroup_seqfile_stop+0xd0/0xd0 [ 125.224884][ T5429] kernfs_fop_write_iter+0x3a6/0x4f0 [ 125.230332][ T5429] vfs_write+0x7b2/0xbb0 [ 125.234650][ T5429] ? file_end_write+0x240/0x240 [ 125.239569][ T5429] ? do_raw_spin_unlock+0x13b/0x8b0 [ 125.244832][ T5429] ? lockdep_hardirqs_on+0x98/0x140 [ 125.250106][ T5429] ? __fdget_pos+0x265/0x2f0 [ 125.254757][ T5429] ksys_write+0x1a0/0x2c0 [ 125.259148][ T5429] ? __ia32_sys_read+0x90/0x90 [ 125.263964][ T5429] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 125.270013][ T5429] ? syscall_enter_from_user_mode+0x8c/0x2c0 [pid 5442] write(6, "0x000000000000040e", 18 [pid 5417] close(5) = 0 [pid 5417] close(6) = 0 [ 125.276073][ T5429] do_syscall_64+0x41/0xc0 [ 125.280548][ T5429] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 125.286512][ T5429] RIP: 0033:0x7fd49ce20129 [ 125.290974][ T5429] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 125.310639][ T5429] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 125.319117][ T5429] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [pid 5417] close(7) = -1 EBADF (Bad file descriptor) [pid 5417] close(8) = -1 EBADF (Bad file descriptor) [pid 5417] close(9) = -1 EBADF (Bad file descriptor) [pid 5417] close(10) = -1 EBADF (Bad file descriptor) [pid 5417] close(11) = -1 EBADF (Bad file descriptor) [pid 5417] close(12) = -1 EBADF (Bad file descriptor) [pid 5417] close(13) = -1 EBADF (Bad file descriptor) [pid 5417] close(14) = -1 EBADF (Bad file descriptor) [pid 5417] close(15) = -1 EBADF (Bad file descriptor) [pid 5417] close(16) = -1 EBADF (Bad file descriptor) [pid 5417] close(17) = -1 EBADF (Bad file descriptor) [pid 5417] close(18) = -1 EBADF (Bad file descriptor) [pid 5417] close(19) = -1 EBADF (Bad file descriptor) [pid 5417] close(20) = -1 EBADF (Bad file descriptor) [pid 5417] close(21) = -1 EBADF (Bad file descriptor) [pid 5417] close(22) = -1 EBADF (Bad file descriptor) [pid 5417] close(23) = -1 EBADF (Bad file descriptor) [pid 5417] close(24) = -1 EBADF (Bad file descriptor) [pid 5417] close(25) = -1 EBADF (Bad file descriptor) [pid 5417] close(26) = -1 EBADF (Bad file descriptor) [pid 5417] close(27) = -1 EBADF (Bad file descriptor) [pid 5417] close(28) = -1 EBADF (Bad file descriptor) [pid 5417] close(29) = -1 EBADF (Bad file descriptor) [pid 5417] exit_group(0) = ? [pid 5417] +++ exited with 0 +++ [pid 5072] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=16, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- [pid 5072] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5072] umount2("./14", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5072] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5072] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5072] umount2("./14/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./14/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5072] unlink("./14/binderfs") = 0 [pid 5072] umount2("./14/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./14/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5072] unlink("./14/cgroup") = 0 [pid 5072] umount2("./14/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./14/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [ 125.327142][ T5429] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 125.335168][ T5429] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 125.343192][ T5429] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 125.351213][ T5429] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000011 [ 125.359268][ T5429] [pid 5072] unlink("./14/cgroup.net") = 0 [pid 5072] umount2("./14/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5072] umount2("./14/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./14/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5072] umount2("./14/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] openat(AT_FDCWD, "./14/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5072] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5072] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5072] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5072] close(4) = 0 [pid 5072] rmdir("./14/file0") = 0 [pid 5072] umount2("./14/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./14/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5072] unlink("./14/cgroup.cpu") = 0 [pid 5072] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5072] close(3) = 0 [pid 5072] rmdir("./14") = 0 [ 125.401723][ T5429] memory: usage 8kB, limit 0kB, failcnt 55 [ 125.413845][ T5429] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 125.423848][ T5429] Memory cgroup stats for /syz1: [ 125.424051][ T5429] anon 0 [ 125.424051][ T5429] file 0 [ 125.424051][ T5429] kernel 8192 [ 125.424051][ T5429] kernel_stack 0 [ 125.424051][ T5429] pagetables 0 [ 125.424051][ T5429] sec_pagetables 0 [ 125.424051][ T5429] percpu 0 [pid 5072] mkdir("./15", 0777) = 0 [pid 5072] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555574ac5d0) = 17 [ 125.424051][ T5429] sock 0 [ 125.424051][ T5429] vmalloc 0 [ 125.424051][ T5429] shmem 0 [ 125.424051][ T5429] zswap 0 [ 125.424051][ T5429] zswapped 0 [ 125.424051][ T5429] file_mapped 0 [ 125.424051][ T5429] file_dirty 0 [ 125.424051][ T5429] file_writeback 0 [ 125.424051][ T5429] swapcached 0 [ 125.424051][ T5429] anon_thp 0 [ 125.424051][ T5429] file_thp 0 [ 125.424051][ T5429] shmem_thp 0 [ 125.424051][ T5429] inactive_anon 0 [ 125.424051][ T5429] active_anon 0 [ 125.424051][ T5429] inactive_file 0 [ 125.424051][ T5429] active_file 0 ./strace-static-x86_64: Process 5445 attached [pid 5445] chdir("./15") = 0 [pid 5445] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5445] setpgid(0, 0) = 0 [pid 5445] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 5445] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [pid 5445] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [ 125.424051][ T5429] unevictable 0 [ 125.424051][ T5429] slab_reclaimable 6752 [ 125.424051][ T5429] slab_unreclaimable 0 [ 125.424051][ T5429] slab 6752 [ 125.424051][ T5429] workingset_refault_anon 0 [pid 5445] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5445] write(3, "1000", 4) = 4 [pid 5445] close(3) = 0 [pid 5445] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5445] mkdir("./file0", 000) = 0 [pid 5445] open("./file0", O_RDONLY) = 3 [pid 5445] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5445] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5445] openat(4, "syz1", O_RDWR|O_PATH) = 5 [ 125.546186][ T5429] Tasks state (memory values in pages): [ 125.560041][ T5429] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 125.581431][ T5429] Out of memory and no killable processes... [pid 5445] openat(5, "memory.max", O_RDWR [pid 5429] <... write resumed>) = 18 [pid 5445] <... openat resumed>) = 6 [pid 5445] write(6, "0x000000000000040e", 18 [pid 5429] close(3) = 0 [pid 5429] close(4) = 0 [ 125.593157][ T5428] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 125.614201][ T5428] CPU: 1 PID: 5428 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 125.624706][ T5428] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 125.634816][ T5428] Call Trace: [ 125.638137][ T5428] [ 125.641105][ T5428] dump_stack_lvl+0x1e7/0x2d0 [ 125.645837][ T5428] ? nf_tcp_handle_invalid+0x640/0x640 [ 125.651349][ T5428] ? panic+0x770/0x770 [ 125.655453][ T5428] dump_header+0xdc/0x940 [ 125.659814][ T5428] out_of_memory+0xf21/0x12c0 [ 125.664515][ T5428] ? mutex_lock_io_nested+0x60/0x60 [ 125.669740][ T5428] ? preempt_schedule+0xdd/0xf0 [ 125.674615][ T5428] ? unregister_oom_notifier+0x20/0x20 [ 125.680089][ T5428] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 125.686123][ T5428] mem_cgroup_out_of_memory+0x263/0x3b0 [ 125.691705][ T5428] ? preempt_schedule_thunk+0x1a/0x20 [ 125.697101][ T5428] ? mem_cgroup_oom_trylock+0x210/0x210 [ 125.702687][ T5428] ? cgroup_file_notify+0x127/0x190 [ 125.707914][ T5428] memory_max_write+0x355/0x470 [ 125.712788][ T5428] ? memory_max_show+0xa0/0xa0 [ 125.717590][ T5428] ? read_lock_is_recursive+0x20/0x20 [ 125.722984][ T5428] ? memory_max_show+0xa0/0xa0 [ 125.727769][ T5428] cgroup_file_write+0x2b1/0x780 [ 125.732731][ T5428] ? cgroup_seqfile_stop+0xd0/0xd0 [ 125.737859][ T5428] ? __virt_addr_valid+0x22f/0x2e0 [ 125.743005][ T5428] ? cgroup_seqfile_stop+0xd0/0xd0 [ 125.748140][ T5428] kernfs_fop_write_iter+0x3a6/0x4f0 [ 125.753471][ T5428] vfs_write+0x7b2/0xbb0 [ 125.757753][ T5428] ? file_end_write+0x240/0x240 [ 125.763073][ T5428] ? do_raw_spin_unlock+0x13b/0x8b0 [ 125.768327][ T5428] ? lockdep_hardirqs_on+0x98/0x140 [ 125.773553][ T5428] ? __fdget_pos+0x265/0x2f0 [ 125.778162][ T5428] ksys_write+0x1a0/0x2c0 [ 125.782515][ T5428] ? __ia32_sys_read+0x90/0x90 [ 125.787302][ T5428] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 125.793338][ T5428] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 125.799373][ T5428] do_syscall_64+0x41/0xc0 [ 125.803840][ T5428] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 125.809769][ T5428] RIP: 0033:0x7fd49ce20129 [ 125.814222][ T5428] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 125.833880][ T5428] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 5429] close(5) = 0 [pid 5429] close(6) = 0 [pid 5429] close(7) = -1 EBADF (Bad file descriptor) [pid 5429] close(8) = -1 EBADF (Bad file descriptor) [pid 5429] close(9) = -1 EBADF (Bad file descriptor) [pid 5429] close(10) = -1 EBADF (Bad file descriptor) [pid 5429] close(11) = -1 EBADF (Bad file descriptor) [pid 5429] close(12) = -1 EBADF (Bad file descriptor) [pid 5429] close(13) = -1 EBADF (Bad file descriptor) [pid 5429] close(14) = -1 EBADF (Bad file descriptor) [pid 5429] close(15) = -1 EBADF (Bad file descriptor) [pid 5429] close(16) = -1 EBADF (Bad file descriptor) [pid 5429] close(17) = -1 EBADF (Bad file descriptor) [pid 5429] close(18) = -1 EBADF (Bad file descriptor) [pid 5429] close(19) = -1 EBADF (Bad file descriptor) [pid 5429] close(20) = -1 EBADF (Bad file descriptor) [pid 5429] close(21) = -1 EBADF (Bad file descriptor) [pid 5429] close(22) = -1 EBADF (Bad file descriptor) [pid 5429] close(23) = -1 EBADF (Bad file descriptor) [pid 5429] close(24) = -1 EBADF (Bad file descriptor) [pid 5429] close(25) = -1 EBADF (Bad file descriptor) [pid 5429] close(26) = -1 EBADF (Bad file descriptor) [pid 5429] close(27) = -1 EBADF (Bad file descriptor) [pid 5429] close(28) = -1 EBADF (Bad file descriptor) [pid 5429] close(29) = -1 EBADF (Bad file descriptor) [pid 5429] exit_group(0) = ? [pid 5429] +++ exited with 0 +++ [pid 5073] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=19, si_uid=0, si_status=0, si_utime=0, si_stime=10 /* 0.10 s */} --- [pid 5073] umount2("./17", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5073] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5073] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5073] umount2("./17/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./17/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5073] unlink("./17/binderfs") = 0 [pid 5073] umount2("./17/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./17/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5073] unlink("./17/cgroup") = 0 [pid 5073] umount2("./17/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./17/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5073] unlink("./17/cgroup.net") = 0 [pid 5073] umount2("./17/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5073] umount2("./17/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./17/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5073] umount2("./17/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] openat(AT_FDCWD, "./17/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5073] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5073] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5073] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5073] close(4) = 0 [pid 5073] rmdir("./17/file0") = 0 [pid 5073] umount2("./17/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./17/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5073] unlink("./17/cgroup.cpu") = 0 [pid 5073] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5073] close(3) = 0 [pid 5073] rmdir("./17") = 0 [pid 5073] mkdir("./18", 0777) = 0 [ 125.842317][ T5428] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 125.850304][ T5428] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 125.858287][ T5428] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 125.866274][ T5428] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 125.874423][ T5428] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000014 [ 125.882446][ T5428] [pid 5073] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5447 attached , child_tidptr=0x5555574ac5d0) = 20 [pid 5447] chdir("./18") = 0 [pid 5447] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5447] setpgid(0, 0) = 0 [pid 5447] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 5447] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 5447] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [pid 5447] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5447] write(3, "1000", 4) = 4 [pid 5447] close(3) = 0 [pid 5447] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5447] mkdir("./file0", 000) = 0 [pid 5447] open("./file0", O_RDONLY) = 3 [pid 5447] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5447] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5447] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5447] openat(5, "memory.max", O_RDWR) = 6 [ 125.949391][ T5428] memory: usage 8kB, limit 0kB, failcnt 55 [ 125.955563][ T5428] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 125.986898][ T5428] Memory cgroup stats for /syz1: [ 125.987466][ T5428] anon 0 [ 125.987466][ T5428] file 0 [ 125.987466][ T5428] kernel 8192 [ 125.987466][ T5428] kernel_stack 0 [ 125.987466][ T5428] pagetables 0 [ 125.987466][ T5428] sec_pagetables 0 [ 125.987466][ T5428] percpu 0 [ 125.987466][ T5428] sock 0 [ 125.987466][ T5428] vmalloc 0 [ 125.987466][ T5428] shmem 0 [ 125.987466][ T5428] zswap 0 [ 125.987466][ T5428] zswapped 0 [ 125.987466][ T5428] file_mapped 0 [ 125.987466][ T5428] file_dirty 0 [ 125.987466][ T5428] file_writeback 0 [ 125.987466][ T5428] swapcached 0 [ 125.987466][ T5428] anon_thp 0 [ 125.987466][ T5428] file_thp 0 [ 125.987466][ T5428] shmem_thp 0 [ 125.987466][ T5428] inactive_anon 0 [ 125.987466][ T5428] active_anon 0 [ 125.987466][ T5428] inactive_file 0 [ 125.987466][ T5428] active_file 0 [ 125.987466][ T5428] unevictable 0 [ 125.987466][ T5428] slab_reclaimable 6752 [ 125.987466][ T5428] slab_unreclaimable 0 [ 125.987466][ T5428] slab 6752 [ 125.987466][ T5428] workingset_refault_anon 0 [ 126.086197][ T5428] Tasks state (memory values in pages): [pid 5447] write(6, "0x000000000000040e", 18 [pid 5428] <... write resumed>) = 18 [ 126.092197][ T5428] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 126.102075][ T5428] Out of memory and no killable processes... [ 126.108559][ T5435] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 126.121610][ T5435] CPU: 1 PID: 5435 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 126.132085][ T5435] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 126.142184][ T5435] Call Trace: [ 126.145496][ T5435] [ 126.148464][ T5435] dump_stack_lvl+0x1e7/0x2d0 [ 126.153205][ T5435] ? nf_tcp_handle_invalid+0x640/0x640 [ 126.158720][ T5435] ? panic+0x770/0x770 [ 126.162853][ T5435] dump_header+0xdc/0x940 [ 126.167242][ T5435] out_of_memory+0xf21/0x12c0 [ 126.171969][ T5435] ? mutex_lock_io_nested+0x60/0x60 [ 126.177226][ T5435] ? preempt_schedule+0xdd/0xf0 [ 126.182136][ T5435] ? unregister_oom_notifier+0x20/0x20 [ 126.187653][ T5435] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 126.193713][ T5435] mem_cgroup_out_of_memory+0x263/0x3b0 [ 126.199313][ T5435] ? preempt_schedule_thunk+0x1a/0x20 [ 126.204746][ T5435] ? mem_cgroup_oom_trylock+0x210/0x210 [ 126.210367][ T5435] ? cgroup_file_notify+0x127/0x190 [ 126.215641][ T5435] memory_max_write+0x355/0x470 [ 126.220557][ T5435] ? memory_max_show+0xa0/0xa0 [ 126.225376][ T5435] ? read_lock_is_recursive+0x20/0x20 [ 126.230808][ T5435] ? memory_max_show+0xa0/0xa0 [ 126.235623][ T5435] cgroup_file_write+0x2b1/0x780 [ 126.240612][ T5435] ? cgroup_seqfile_stop+0xd0/0xd0 [ 126.245767][ T5435] ? __virt_addr_valid+0x22f/0x2e0 [ 126.250942][ T5435] ? cgroup_seqfile_stop+0xd0/0xd0 [ 126.256098][ T5435] kernfs_fop_write_iter+0x3a6/0x4f0 [ 126.261445][ T5435] vfs_write+0x7b2/0xbb0 [ 126.265751][ T5435] ? file_end_write+0x240/0x240 [ 126.270653][ T5435] ? do_raw_spin_unlock+0x13b/0x8b0 [ 126.275904][ T5435] ? lockdep_hardirqs_on+0x98/0x140 [ 126.281159][ T5435] ? __fdget_pos+0x265/0x2f0 [ 126.285799][ T5435] ksys_write+0x1a0/0x2c0 [ 126.290187][ T5435] ? __ia32_sys_read+0x90/0x90 [ 126.294995][ T5435] ? syscall_enter_from_user_mode+0x32/0x2c0 [pid 5428] close(3) = 0 [pid 5428] close(4) = 0 [pid 5428] close(5) = 0 [pid 5428] close(6) = 0 [pid 5428] close(7) = -1 EBADF (Bad file descriptor) [pid 5428] close(8) = -1 EBADF (Bad file descriptor) [pid 5428] close(9) = -1 EBADF (Bad file descriptor) [pid 5428] close(10) = -1 EBADF (Bad file descriptor) [pid 5428] close(11) = -1 EBADF (Bad file descriptor) [pid 5428] close(12) = -1 EBADF (Bad file descriptor) [pid 5428] close(13) = -1 EBADF (Bad file descriptor) [pid 5428] close(14) = -1 EBADF (Bad file descriptor) [pid 5428] close(15) = -1 EBADF (Bad file descriptor) [pid 5428] close(16) = -1 EBADF (Bad file descriptor) [pid 5428] close(17) = -1 EBADF (Bad file descriptor) [pid 5428] close(18) = -1 EBADF (Bad file descriptor) [pid 5428] close(19) = -1 EBADF (Bad file descriptor) [pid 5428] close(20) = -1 EBADF (Bad file descriptor) [pid 5428] close(21) = -1 EBADF (Bad file descriptor) [pid 5428] close(22) = -1 EBADF (Bad file descriptor) [pid 5428] close(23) = -1 EBADF (Bad file descriptor) [pid 5428] close(24) = -1 EBADF (Bad file descriptor) [pid 5428] close(25) = -1 EBADF (Bad file descriptor) [pid 5428] close(26) = -1 EBADF (Bad file descriptor) [pid 5428] close(27) = -1 EBADF (Bad file descriptor) [pid 5428] close(28) = -1 EBADF (Bad file descriptor) [pid 5428] close(29) = -1 EBADF (Bad file descriptor) [pid 5428] exit_group(0) = ? [pid 5428] +++ exited with 0 +++ [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=22, si_uid=0, si_status=0, si_utime=0, si_stime=10 /* 0.10 s */} --- [pid 5075] umount2("./20", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] openat(AT_FDCWD, "./20", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5075] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5075] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5075] umount2("./20/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./20/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5075] unlink("./20/binderfs") = 0 [pid 5075] umount2("./20/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./20/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5075] unlink("./20/cgroup") = 0 [pid 5075] umount2("./20/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./20/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5075] unlink("./20/cgroup.net") = 0 [ 126.301040][ T5435] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 126.307079][ T5435] do_syscall_64+0x41/0xc0 [ 126.311549][ T5435] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 126.317488][ T5435] RIP: 0033:0x7fd49ce20129 [ 126.321937][ T5435] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 126.341582][ T5435] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 126.350053][ T5435] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 126.358068][ T5435] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 126.366431][ T5435] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 126.374702][ T5435] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 126.382712][ T5435] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000015 [ 126.390752][ T5435] [pid 5075] umount2("./20/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5075] umount2("./20/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 126.397752][ T5435] memory: usage 8kB, limit 0kB, failcnt 55 [ 126.403616][ T5435] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 126.416634][ T5435] Memory cgroup stats for /syz1: [ 126.416847][ T5435] anon 0 [ 126.416847][ T5435] file 0 [ 126.416847][ T5435] kernel 8192 [ 126.416847][ T5435] kernel_stack 0 [ 126.416847][ T5435] pagetables 0 [ 126.416847][ T5435] sec_pagetables 0 [ 126.416847][ T5435] percpu 0 [ 126.416847][ T5435] sock 0 [ 126.416847][ T5435] vmalloc 0 [ 126.416847][ T5435] shmem 0 [ 126.416847][ T5435] zswap 0 [ 126.416847][ T5435] zswapped 0 [ 126.416847][ T5435] file_mapped 0 [ 126.416847][ T5435] file_dirty 0 [ 126.416847][ T5435] file_writeback 0 [ 126.416847][ T5435] swapcached 0 [ 126.416847][ T5435] anon_thp 0 [ 126.416847][ T5435] file_thp 0 [ 126.416847][ T5435] shmem_thp 0 [ 126.416847][ T5435] inactive_anon 0 [ 126.416847][ T5435] active_anon 0 [ 126.416847][ T5435] inactive_file 0 [ 126.416847][ T5435] active_file 0 [ 126.416847][ T5435] unevictable 0 [ 126.416847][ T5435] slab_reclaimable 6752 [pid 5075] lstat("./20/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5075] umount2("./20/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] openat(AT_FDCWD, "./20/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [ 126.416847][ T5435] slab_unreclaimable 0 [ 126.416847][ T5435] slab 6752 [ 126.416847][ T5435] workingset_refault_anon 0 [ 126.516707][ T5435] Tasks state (memory values in pages): [ 126.522545][ T5435] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 126.533664][ T5435] Out of memory and no killable processes... [ 126.542246][ T5442] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5075] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5075] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5435] <... write resumed>) = 18 [pid 5075] getdents64(4, [pid 5435] close(3) = 0 [pid 5075] <... getdents64 resumed>0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5075] close(4 [pid 5435] close(4) = 0 [pid 5435] close(5) = 0 [pid 5075] <... close resumed>) = 0 [pid 5075] rmdir("./20/file0") = 0 [pid 5435] close(6 [pid 5075] umount2("./20/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5435] <... close resumed>) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5435] close(7 [pid 5075] lstat("./20/cgroup.cpu", [pid 5435] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5075] unlink("./20/cgroup.cpu" [pid 5435] close(8) = -1 EBADF (Bad file descriptor) [pid 5075] <... unlink resumed>) = 0 [pid 5075] getdents64(3, [pid 5435] close(9 [pid 5075] <... getdents64 resumed>0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5075] close(3) = 0 [pid 5435] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] rmdir("./20" [pid 5435] close(10) = -1 EBADF (Bad file descriptor) [pid 5435] close(11) = -1 EBADF (Bad file descriptor) [pid 5435] close(12) = -1 EBADF (Bad file descriptor) [pid 5435] close(13) = -1 EBADF (Bad file descriptor) [pid 5075] <... rmdir resumed>) = 0 [pid 5075] mkdir("./21", 0777 [pid 5435] close(14) = -1 EBADF (Bad file descriptor) [pid 5435] close(15) = -1 EBADF (Bad file descriptor) [pid 5435] close(16) = -1 EBADF (Bad file descriptor) [pid 5435] close(17 [pid 5075] <... mkdir resumed>) = 0 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5435] <... close resumed>) = -1 EBADF (Bad file descriptor) [ 126.568280][ T5442] CPU: 1 PID: 5442 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 126.578765][ T5442] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 126.588873][ T5442] Call Trace: [ 126.592179][ T5442] [ 126.595146][ T5442] dump_stack_lvl+0x1e7/0x2d0 [ 126.599879][ T5442] ? nf_tcp_handle_invalid+0x640/0x640 [ 126.605389][ T5442] ? panic+0x770/0x770 [ 126.609527][ T5442] dump_header+0xdc/0x940 [ 126.613908][ T5442] out_of_memory+0xf21/0x12c0 [ 126.618639][ T5442] ? mutex_lock_io_nested+0x60/0x60 [ 126.623898][ T5442] ? preempt_schedule+0xdd/0xf0 [ 126.628802][ T5442] ? unregister_oom_notifier+0x20/0x20 [ 126.634314][ T5442] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 126.640359][ T5442] mem_cgroup_out_of_memory+0x263/0x3b0 [ 126.645954][ T5442] ? preempt_schedule_thunk+0x1a/0x20 [ 126.651379][ T5442] ? mem_cgroup_oom_trylock+0x210/0x210 [ 126.657001][ T5442] ? cgroup_file_notify+0x127/0x190 [ 126.662259][ T5442] memory_max_write+0x355/0x470 [ 126.667174][ T5442] ? memory_max_show+0xa0/0xa0 [ 126.671981][ T5442] ? read_lock_is_recursive+0x20/0x20 [ 126.677401][ T5442] ? memory_max_show+0xa0/0xa0 [ 126.682209][ T5442] cgroup_file_write+0x2b1/0x780 [ 126.687198][ T5442] ? cgroup_seqfile_stop+0xd0/0xd0 [ 126.692345][ T5442] ? __virt_addr_valid+0x22f/0x2e0 [ 126.697517][ T5442] ? cgroup_seqfile_stop+0xd0/0xd0 [ 126.702664][ T5442] kernfs_fop_write_iter+0x3a6/0x4f0 [ 126.708008][ T5442] vfs_write+0x7b2/0xbb0 [ 126.712304][ T5442] ? file_end_write+0x240/0x240 [ 126.717215][ T5442] ? do_raw_spin_unlock+0x13b/0x8b0 [ 126.722476][ T5442] ? lockdep_hardirqs_on+0x98/0x140 [ 126.727746][ T5442] ? __fdget_pos+0x265/0x2f0 [ 126.732391][ T5442] ksys_write+0x1a0/0x2c0 [ 126.736771][ T5442] ? __ia32_sys_read+0x90/0x90 [ 126.741577][ T5442] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 126.747615][ T5442] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 126.753645][ T5442] do_syscall_64+0x41/0xc0 [ 126.758099][ T5442] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 126.764016][ T5442] RIP: 0033:0x7fd49ce20129 [ 126.768483][ T5442] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 126.788126][ T5442] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 126.796564][ T5442] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 126.804555][ T5442] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [pid 5435] close(18./strace-static-x86_64: Process 5453 attached ) = -1 EBADF (Bad file descriptor) [pid 5435] close(19) = -1 EBADF (Bad file descriptor) [pid 5435] close(20) = -1 EBADF (Bad file descriptor) [pid 5435] close(21) = -1 EBADF (Bad file descriptor) [pid 5075] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 23 [pid 5453] chdir("./21" [pid 5435] close(22) = -1 EBADF (Bad file descriptor) [pid 5435] close(23) = -1 EBADF (Bad file descriptor) [pid 5435] close(24) = -1 EBADF (Bad file descriptor) [pid 5435] close(25) = -1 EBADF (Bad file descriptor) [pid 5435] close(26) = -1 EBADF (Bad file descriptor) [pid 5435] close(27) = -1 EBADF (Bad file descriptor) [pid 5435] close(28) = -1 EBADF (Bad file descriptor) [pid 5435] close(29 [pid 5453] <... chdir resumed>) = 0 [pid 5435] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5435] exit_group(0) = ? [pid 5453] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5435] +++ exited with 0 +++ [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=23, si_uid=0, si_status=0, si_utime=0, si_stime=10 /* 0.10 s */} --- [pid 5453] <... prctl resumed>) = 0 [pid 5074] umount2("./21", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] openat(AT_FDCWD, "./21", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5453] setpgid(0, 0 [pid 5074] <... openat resumed>) = 3 [pid 5074] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5453] <... setpgid resumed>) = 0 [pid 5074] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5074] umount2("./21/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5453] symlink("/syzcgroup/unified/syz2", "./cgroup" [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./21/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5074] unlink("./21/binderfs" [pid 5453] <... symlink resumed>) = 0 [pid 5074] <... unlink resumed>) = 0 [pid 5074] umount2("./21/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./21/cgroup", [pid 5453] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu" [pid 5074] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5074] unlink("./21/cgroup" [pid 5453] <... symlink resumed>) = 0 [pid 5074] <... unlink resumed>) = 0 [pid 5453] symlink("/syzcgroup/net/syz2", "./cgroup.net" [pid 5074] umount2("./21/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./21/cgroup.net", [pid 5453] <... symlink resumed>) = 0 [pid 5074] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5453] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5074] unlink("./21/cgroup.net" [pid 5453] <... openat resumed>) = 3 [pid 5074] <... unlink resumed>) = 0 [pid 5453] write(3, "1000", 4 [pid 5074] umount2("./21/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5453] <... write resumed>) = 4 [pid 5074] <... umount2 resumed>) = 0 [pid 5453] close(3 [pid 5074] umount2("./21/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5453] <... close resumed>) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5453] symlink("/dev/binderfs", "./binderfs" [pid 5074] lstat("./21/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5074] umount2("./21/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5453] <... symlink resumed>) = 0 [pid 5074] openat(AT_FDCWD, "./21/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5453] mkdir("./file0", 000 [pid 5074] <... openat resumed>) = 4 [pid 5074] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5074] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5074] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5074] close(4) = 0 [pid 5074] rmdir("./21/file0" [pid 5453] <... mkdir resumed>) = 0 [pid 5074] <... rmdir resumed>) = 0 [pid 5074] umount2("./21/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5453] open("./file0", O_RDONLY [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./21/cgroup.cpu", [pid 5453] <... open resumed>) = 3 [pid 5074] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5074] unlink("./21/cgroup.cpu" [pid 5453] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5074] <... unlink resumed>) = 0 [pid 5074] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5074] close(3 [pid 5453] <... mount resumed>) = 0 [pid 5074] <... close resumed>) = 0 [pid 5074] rmdir("./21" [pid 5453] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5074] <... rmdir resumed>) = 0 [pid 5074] mkdir("./22", 0777 [pid 5453] <... openat resumed>) = 4 [pid 5074] <... mkdir resumed>) = 0 [pid 5453] openat(4, "syz1", O_RDWR|O_PATH [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5457 attached [ 126.812542][ T5442] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 126.820532][ T5442] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 126.828542][ T5442] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 000000000000000e [ 126.836662][ T5442] [ 126.855360][ T5442] memory: usage 8kB, limit 0kB, failcnt 55 [ 126.861713][ T5442] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [pid 5453] <... openat resumed>) = 5 [pid 5457] chdir("./22" [pid 5453] openat(5, "memory.max", O_RDWR [pid 5074] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 24 [pid 5457] <... chdir resumed>) = 0 [pid 5457] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5453] <... openat resumed>) = 6 [pid 5457] <... prctl resumed>) = 0 [ 126.903109][ T5442] Memory cgroup stats for /syz1: [ 126.903329][ T5442] anon 0 [ 126.903329][ T5442] file 0 [ 126.903329][ T5442] kernel 8192 [ 126.903329][ T5442] kernel_stack 0 [ 126.903329][ T5442] pagetables 0 [ 126.903329][ T5442] sec_pagetables 0 [ 126.903329][ T5442] percpu 0 [ 126.903329][ T5442] sock 0 [ 126.903329][ T5442] vmalloc 0 [ 126.903329][ T5442] shmem 0 [ 126.903329][ T5442] zswap 0 [ 126.903329][ T5442] zswapped 0 [ 126.903329][ T5442] file_mapped 0 [ 126.903329][ T5442] file_dirty 0 [pid 5453] write(6, "0x000000000000040e", 18 [pid 5457] setpgid(0, 0) = 0 [pid 5457] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [pid 5457] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 5457] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 5457] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5457] write(3, "1000", 4) = 4 [pid 5457] close(3) = 0 [pid 5457] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5457] mkdir("./file0", 000) = 0 [pid 5457] open("./file0", O_RDONLY) = 3 [pid 5457] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5457] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5457] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5457] openat(5, "memory.max", O_RDWR) = 6 [ 126.903329][ T5442] file_writeback 0 [ 126.903329][ T5442] swapcached 0 [ 126.903329][ T5442] anon_thp 0 [ 126.903329][ T5442] file_thp 0 [ 126.903329][ T5442] shmem_thp 0 [ 126.903329][ T5442] inactive_anon 0 [ 126.903329][ T5442] active_anon 0 [ 126.903329][ T5442] inactive_file 0 [ 126.903329][ T5442] active_file 0 [ 126.903329][ T5442] unevictable 0 [ 126.903329][ T5442] slab_reclaimable 6752 [ 126.903329][ T5442] slab_unreclaimable 0 [ 126.903329][ T5442] slab 6752 [ 126.903329][ T5442] workingset_refault_anon 0 [ 127.003946][ T5442] Tasks state (memory values in pages): [ 127.028268][ T5442] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5457] write(6, "0x000000000000040e", 18 [pid 5442] <... write resumed>) = 18 [pid 5442] close(3) = 0 [pid 5442] close(4) = 0 [pid 5442] close(5) = 0 [pid 5442] close(6) = 0 [pid 5442] close(7) = -1 EBADF (Bad file descriptor) [pid 5442] close(8) = -1 EBADF (Bad file descriptor) [pid 5442] close(9) = -1 EBADF (Bad file descriptor) [ 127.055396][ T5442] Out of memory and no killable processes... [ 127.071428][ T5445] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5442] close(10) = -1 EBADF (Bad file descriptor) [pid 5442] close(11) = -1 EBADF (Bad file descriptor) [pid 5442] close(12) = -1 EBADF (Bad file descriptor) [pid 5442] close(13) = -1 EBADF (Bad file descriptor) [pid 5442] close(14) = -1 EBADF (Bad file descriptor) [pid 5442] close(15) = -1 EBADF (Bad file descriptor) [pid 5442] close(16) = -1 EBADF (Bad file descriptor) [pid 5442] close(17) = -1 EBADF (Bad file descriptor) [pid 5442] close(18) = -1 EBADF (Bad file descriptor) [pid 5442] close(19) = -1 EBADF (Bad file descriptor) [pid 5442] close(20) = -1 EBADF (Bad file descriptor) [pid 5442] close(21) = -1 EBADF (Bad file descriptor) [pid 5442] close(22) = -1 EBADF (Bad file descriptor) [pid 5442] close(23) = -1 EBADF (Bad file descriptor) [pid 5442] close(24) = -1 EBADF (Bad file descriptor) [pid 5442] close(25) = -1 EBADF (Bad file descriptor) [pid 5442] close(26) = -1 EBADF (Bad file descriptor) [pid 5442] close(27) = -1 EBADF (Bad file descriptor) [pid 5442] close(28) = -1 EBADF (Bad file descriptor) [pid 5442] close(29) = -1 EBADF (Bad file descriptor) [pid 5442] exit_group(0) = ? [pid 5442] +++ exited with 0 +++ [pid 5070] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=16, si_uid=0, si_status=0, si_utime=0, si_stime=10 /* 0.10 s */} --- [pid 5070] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5070] umount2("./14", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5070] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5070] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5070] umount2("./14/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./14/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5070] unlink("./14/binderfs") = 0 [pid 5070] umount2("./14/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./14/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5070] unlink("./14/cgroup") = 0 [pid 5070] umount2("./14/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 127.096125][ T5445] CPU: 0 PID: 5445 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 127.106628][ T5445] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 127.116733][ T5445] Call Trace: [ 127.120059][ T5445] [ 127.123035][ T5445] dump_stack_lvl+0x1e7/0x2d0 [ 127.127778][ T5445] ? nf_tcp_handle_invalid+0x640/0x640 [ 127.133316][ T5445] ? panic+0x770/0x770 [ 127.137455][ T5445] dump_header+0xdc/0x940 [ 127.141851][ T5445] out_of_memory+0xf21/0x12c0 [ 127.146591][ T5445] ? mutex_lock_io_nested+0x60/0x60 [ 127.151841][ T5445] ? preempt_schedule+0xdd/0xf0 [ 127.156717][ T5445] ? unregister_oom_notifier+0x20/0x20 [ 127.162212][ T5445] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 127.168225][ T5445] mem_cgroup_out_of_memory+0x263/0x3b0 [ 127.173796][ T5445] ? preempt_schedule_thunk+0x1a/0x20 [ 127.179189][ T5445] ? mem_cgroup_oom_trylock+0x210/0x210 [ 127.184763][ T5445] ? cgroup_file_notify+0x127/0x190 [ 127.189987][ T5445] memory_max_write+0x355/0x470 [ 127.194865][ T5445] ? memory_max_show+0xa0/0xa0 [ 127.199646][ T5445] ? read_lock_is_recursive+0x20/0x20 [ 127.205039][ T5445] ? memory_max_show+0xa0/0xa0 [ 127.209817][ T5445] cgroup_file_write+0x2b1/0x780 [ 127.214773][ T5445] ? cgroup_seqfile_stop+0xd0/0xd0 [ 127.219895][ T5445] ? __virt_addr_valid+0x22f/0x2e0 [ 127.225033][ T5445] ? cgroup_seqfile_stop+0xd0/0xd0 [ 127.230152][ T5445] kernfs_fop_write_iter+0x3a6/0x4f0 [ 127.235459][ T5445] vfs_write+0x7b2/0xbb0 [ 127.239738][ T5445] ? file_end_write+0x240/0x240 [ 127.244611][ T5445] ? do_raw_spin_unlock+0x13b/0x8b0 [ 127.249826][ T5445] ? lockdep_hardirqs_on+0x98/0x140 [ 127.255050][ T5445] ? __fdget_pos+0x265/0x2f0 [ 127.259659][ T5445] ksys_write+0x1a0/0x2c0 [ 127.264007][ T5445] ? __ia32_sys_read+0x90/0x90 [ 127.268785][ T5445] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 127.274819][ T5445] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 127.280830][ T5445] do_syscall_64+0x41/0xc0 [ 127.285270][ T5445] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 127.291182][ T5445] RIP: 0033:0x7fd49ce20129 [ 127.295613][ T5445] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 127.315228][ T5445] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 127.323664][ T5445] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 127.331643][ T5445] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 127.339633][ T5445] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 127.347629][ T5445] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [pid 5070] lstat("./14/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5070] unlink("./14/cgroup.net") = 0 [pid 5070] umount2("./14/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5070] umount2("./14/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./14/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5070] umount2("./14/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] openat(AT_FDCWD, "./14/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5070] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5070] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5070] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5070] close(4) = 0 [pid 5070] rmdir("./14/file0") = 0 [pid 5070] umount2("./14/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./14/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5070] unlink("./14/cgroup.cpu") = 0 [pid 5070] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5070] close(3) = 0 [pid 5070] rmdir("./14") = 0 [pid 5070] mkdir("./15", 0777) = 0 [pid 5070] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5459 attached , child_tidptr=0x5555574ac5d0) = 17 [pid 5459] chdir("./15") = 0 [ 127.355611][ T5445] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 000000000000000f [ 127.363971][ T5445] [pid 5459] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5459] setpgid(0, 0) = 0 [pid 5459] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 5459] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [ 127.412712][ T5445] memory: usage 8kB, limit 0kB, failcnt 55 [ 127.421314][ T5445] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 127.432532][ T5445] Memory cgroup stats for /syz1: [ 127.434609][ T5445] anon 0 [ 127.434609][ T5445] file 0 [ 127.434609][ T5445] kernel 8192 [ 127.434609][ T5445] kernel_stack 0 [ 127.434609][ T5445] pagetables 0 [ 127.434609][ T5445] sec_pagetables 0 [ 127.434609][ T5445] percpu 0 [ 127.434609][ T5445] sock 0 [ 127.434609][ T5445] vmalloc 0 [ 127.434609][ T5445] shmem 0 [ 127.434609][ T5445] zswap 0 [ 127.434609][ T5445] zswapped 0 [ 127.434609][ T5445] file_mapped 0 [ 127.434609][ T5445] file_dirty 0 [ 127.434609][ T5445] file_writeback 0 [ 127.434609][ T5445] swapcached 0 [ 127.434609][ T5445] anon_thp 0 [ 127.434609][ T5445] file_thp 0 [ 127.434609][ T5445] shmem_thp 0 [ 127.434609][ T5445] inactive_anon 0 [ 127.434609][ T5445] active_anon 0 [ 127.434609][ T5445] inactive_file 0 [ 127.434609][ T5445] active_file 0 [pid 5459] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 5459] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5459] write(3, "1000", 4) = 4 [ 127.434609][ T5445] unevictable 0 [ 127.434609][ T5445] slab_reclaimable 6752 [ 127.434609][ T5445] slab_unreclaimable 0 [ 127.434609][ T5445] slab 6752 [ 127.434609][ T5445] workingset_refault_anon 0 [ 127.536977][ T5445] Tasks state (memory values in pages): [ 127.543086][ T5445] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 127.554603][ T5445] Out of memory and no killable processes... [ 127.562443][ T5447] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 127.573877][ T5447] CPU: 1 PID: 5447 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 127.584358][ T5447] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 127.594468][ T5447] Call Trace: [ 127.597796][ T5447] [ 127.600768][ T5447] dump_stack_lvl+0x1e7/0x2d0 [ 127.605545][ T5447] ? nf_tcp_handle_invalid+0x640/0x640 [ 127.611074][ T5447] ? panic+0x770/0x770 [ 127.615210][ T5447] dump_header+0xdc/0x940 [ 127.619613][ T5447] out_of_memory+0xf21/0x12c0 [ 127.624350][ T5447] ? mutex_lock_io_nested+0x60/0x60 [ 127.629620][ T5447] ? preempt_schedule+0xdd/0xf0 [ 127.634534][ T5447] ? unregister_oom_notifier+0x20/0x20 [ 127.640045][ T5447] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 127.646073][ T5447] mem_cgroup_out_of_memory+0x263/0x3b0 [ 127.651858][ T5447] ? preempt_schedule_thunk+0x1a/0x20 [ 127.657296][ T5447] ? mem_cgroup_oom_trylock+0x210/0x210 [ 127.662944][ T5447] ? cgroup_file_notify+0x127/0x190 [ 127.668169][ T5447] memory_max_write+0x355/0x470 [ 127.673050][ T5447] ? memory_max_show+0xa0/0xa0 [ 127.677856][ T5447] ? read_lock_is_recursive+0x20/0x20 [ 127.683353][ T5447] ? memory_max_show+0xa0/0xa0 [ 127.688137][ T5447] cgroup_file_write+0x2b1/0x780 [ 127.693094][ T5447] ? cgroup_seqfile_stop+0xd0/0xd0 [ 127.698217][ T5447] ? __virt_addr_valid+0x22f/0x2e0 [ 127.703376][ T5447] ? cgroup_seqfile_stop+0xd0/0xd0 [ 127.708499][ T5447] kernfs_fop_write_iter+0x3a6/0x4f0 [ 127.713829][ T5447] vfs_write+0x7b2/0xbb0 [ 127.718097][ T5447] ? file_end_write+0x240/0x240 [ 127.722967][ T5447] ? do_raw_spin_unlock+0x13b/0x8b0 [ 127.728203][ T5447] ? lockdep_hardirqs_on+0x98/0x140 [ 127.733425][ T5447] ? __fdget_pos+0x265/0x2f0 [ 127.738037][ T5447] ksys_write+0x1a0/0x2c0 [ 127.742400][ T5447] ? __ia32_sys_read+0x90/0x90 [ 127.747195][ T5447] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 127.753198][ T5447] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 127.759201][ T5447] do_syscall_64+0x41/0xc0 [ 127.763637][ T5447] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 127.769559][ T5447] RIP: 0033:0x7fd49ce20129 [ 127.773987][ T5447] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 127.793622][ T5447] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 127.802054][ T5447] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [pid 5459] close(3) = 0 [pid 5445] <... write resumed>) = 18 [pid 5459] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5459] mkdir("./file0", 000) = 0 [pid 5459] open("./file0", O_RDONLY) = 3 [pid 5459] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5459] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5459] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5459] openat(5, "memory.max", O_RDWR) = 6 [pid 5459] write(6, "0x000000000000040e", 18 [pid 5445] close(3) = 0 [pid 5445] close(4) = 0 [pid 5445] close(5) = 0 [pid 5445] close(6) = 0 [pid 5445] close(7) = -1 EBADF (Bad file descriptor) [pid 5445] close(8) = -1 EBADF (Bad file descriptor) [pid 5445] close(9) = -1 EBADF (Bad file descriptor) [pid 5445] close(10) = -1 EBADF (Bad file descriptor) [pid 5445] close(11) = -1 EBADF (Bad file descriptor) [pid 5445] close(12) = -1 EBADF (Bad file descriptor) [pid 5445] close(13) = -1 EBADF (Bad file descriptor) [pid 5445] close(14) = -1 EBADF (Bad file descriptor) [pid 5445] close(15) = -1 EBADF (Bad file descriptor) [pid 5445] close(16) = -1 EBADF (Bad file descriptor) [pid 5445] close(17) = -1 EBADF (Bad file descriptor) [pid 5445] close(18) = -1 EBADF (Bad file descriptor) [pid 5445] close(19) = -1 EBADF (Bad file descriptor) [pid 5445] close(20) = -1 EBADF (Bad file descriptor) [pid 5445] close(21) = -1 EBADF (Bad file descriptor) [pid 5445] close(22) = -1 EBADF (Bad file descriptor) [pid 5445] close(23) = -1 EBADF (Bad file descriptor) [pid 5445] close(24) = -1 EBADF (Bad file descriptor) [pid 5445] close(25) = -1 EBADF (Bad file descriptor) [pid 5445] close(26) = -1 EBADF (Bad file descriptor) [pid 5445] close(27) = -1 EBADF (Bad file descriptor) [pid 5445] close(28) = -1 EBADF (Bad file descriptor) [pid 5445] close(29) = -1 EBADF (Bad file descriptor) [pid 5445] exit_group(0) = ? [pid 5445] +++ exited with 0 +++ [pid 5072] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=17, si_uid=0, si_status=0, si_utime=0, si_stime=9 /* 0.09 s */} --- [pid 5072] restart_syscall(<... resuming interrupted clone ...>) = 0 [ 127.810037][ T5447] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 127.818018][ T5447] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 127.825998][ T5447] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 127.833978][ T5447] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000012 [ 127.841979][ T5447] [ 127.848851][ T5447] memory: usage 8kB, limit 0kB, failcnt 55 [ 127.854725][ T5447] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [pid 5072] umount2("./15", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5072] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5072] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5072] umount2("./15/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./15/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5072] unlink("./15/binderfs") = 0 [pid 5072] umount2("./15/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 127.899117][ T5447] Memory cgroup stats for /syz1: [ 127.899591][ T5447] anon 0 [ 127.899591][ T5447] file 0 [ 127.899591][ T5447] kernel 8192 [ 127.899591][ T5447] kernel_stack 0 [ 127.899591][ T5447] pagetables 0 [ 127.899591][ T5447] sec_pagetables 0 [ 127.899591][ T5447] percpu 0 [ 127.899591][ T5447] sock 0 [ 127.899591][ T5447] vmalloc 0 [ 127.899591][ T5447] shmem 0 [ 127.899591][ T5447] zswap 0 [ 127.899591][ T5447] zswapped 0 [ 127.899591][ T5447] file_mapped 0 [ 127.899591][ T5447] file_dirty 0 [pid 5072] lstat("./15/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [ 127.899591][ T5447] file_writeback 0 [ 127.899591][ T5447] swapcached 0 [ 127.899591][ T5447] anon_thp 0 [ 127.899591][ T5447] file_thp 0 [ 127.899591][ T5447] shmem_thp 0 [ 127.899591][ T5447] inactive_anon 0 [ 127.899591][ T5447] active_anon 0 [ 127.899591][ T5447] inactive_file 0 [ 127.899591][ T5447] active_file 0 [ 127.899591][ T5447] unevictable 0 [ 127.899591][ T5447] slab_reclaimable 6752 [ 127.899591][ T5447] slab_unreclaimable 0 [ 127.899591][ T5447] slab 6752 [ 127.899591][ T5447] workingset_refault_anon 0 [pid 5072] unlink("./15/cgroup") = 0 [pid 5072] umount2("./15/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./15/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5072] unlink("./15/cgroup.net") = 0 [pid 5447] <... write resumed>) = 18 [pid 5447] close(3) = 0 [pid 5447] close(4) = 0 [pid 5447] close(5) = 0 [pid 5447] close(6) = 0 [pid 5447] close(7) = -1 EBADF (Bad file descriptor) [pid 5447] close(8) = -1 EBADF (Bad file descriptor) [pid 5447] close(9) = -1 EBADF (Bad file descriptor) [pid 5447] close(10 [pid 5072] umount2("./15/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5447] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5447] close(11) = -1 EBADF (Bad file descriptor) [pid 5447] close(12) = -1 EBADF (Bad file descriptor) [pid 5447] close(13) = -1 EBADF (Bad file descriptor) [pid 5447] close(14) = -1 EBADF (Bad file descriptor) [pid 5447] close(15) = -1 EBADF (Bad file descriptor) [pid 5447] close(16) = -1 EBADF (Bad file descriptor) [pid 5447] close(17) = -1 EBADF (Bad file descriptor) [pid 5447] close(18) = -1 EBADF (Bad file descriptor) [pid 5447] close(19) = -1 EBADF (Bad file descriptor) [pid 5447] close(20) = -1 EBADF (Bad file descriptor) [pid 5447] close(21) = -1 EBADF (Bad file descriptor) [pid 5447] close(22) = -1 EBADF (Bad file descriptor) [pid 5447] close(23) = -1 EBADF (Bad file descriptor) [pid 5447] close(24) = -1 EBADF (Bad file descriptor) [pid 5447] close(25) = -1 EBADF (Bad file descriptor) [pid 5447] close(26) = -1 EBADF (Bad file descriptor) [pid 5447] close(27) = -1 EBADF (Bad file descriptor) [pid 5447] close(28) = -1 EBADF (Bad file descriptor) [pid 5447] close(29) = -1 EBADF (Bad file descriptor) [pid 5447] exit_group(0) = ? [pid 5072] <... umount2 resumed>) = 0 [ 128.002963][ T5447] Tasks state (memory values in pages): [ 128.010453][ T5447] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 128.021780][ T5447] Out of memory and no killable processes... [ 128.033410][ T5457] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 128.056771][ T5457] CPU: 0 PID: 5457 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 128.067263][ T5457] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 128.077432][ T5457] Call Trace: [ 128.080759][ T5457] [ 128.083728][ T5457] dump_stack_lvl+0x1e7/0x2d0 [ 128.088446][ T5457] ? nf_tcp_handle_invalid+0x640/0x640 [ 128.093938][ T5457] ? panic+0x770/0x770 [ 128.098041][ T5457] dump_header+0xdc/0x940 [ 128.102397][ T5457] out_of_memory+0xf21/0x12c0 [ 128.107096][ T5457] ? mutex_lock_io_nested+0x60/0x60 [ 128.112321][ T5457] ? preempt_schedule+0xdd/0xf0 [ 128.117200][ T5457] ? unregister_oom_notifier+0x20/0x20 [ 128.122682][ T5457] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 128.128691][ T5457] mem_cgroup_out_of_memory+0x263/0x3b0 [ 128.134256][ T5457] ? preempt_schedule_thunk+0x1a/0x20 [ 128.139652][ T5457] ? mem_cgroup_oom_trylock+0x210/0x210 [ 128.145234][ T5457] ? cgroup_file_notify+0x127/0x190 [ 128.150460][ T5457] memory_max_write+0x355/0x470 [ 128.155336][ T5457] ? memory_max_show+0xa0/0xa0 [ 128.160119][ T5457] ? read_lock_is_recursive+0x20/0x20 [ 128.165512][ T5457] ? memory_max_show+0xa0/0xa0 [ 128.170291][ T5457] cgroup_file_write+0x2b1/0x780 [ 128.175251][ T5457] ? cgroup_seqfile_stop+0xd0/0xd0 [ 128.180375][ T5457] ? __virt_addr_valid+0x22f/0x2e0 [ 128.185518][ T5457] ? cgroup_seqfile_stop+0xd0/0xd0 [ 128.190639][ T5457] kernfs_fop_write_iter+0x3a6/0x4f0 [ 128.195967][ T5457] vfs_write+0x7b2/0xbb0 [ 128.200238][ T5457] ? file_end_write+0x240/0x240 [ 128.205108][ T5457] ? do_raw_spin_unlock+0x13b/0x8b0 [ 128.210327][ T5457] ? lockdep_hardirqs_on+0x98/0x140 [ 128.215547][ T5457] ? __fdget_pos+0x265/0x2f0 [ 128.220158][ T5457] ksys_write+0x1a0/0x2c0 [ 128.224510][ T5457] ? __ia32_sys_read+0x90/0x90 [ 128.229288][ T5457] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 128.235295][ T5457] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 128.241304][ T5457] do_syscall_64+0x41/0xc0 [ 128.245742][ T5457] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 128.251661][ T5457] RIP: 0033:0x7fd49ce20129 [ 128.256087][ T5457] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 128.275723][ T5457] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 128.284162][ T5457] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 128.292153][ T5457] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 128.300136][ T5457] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [pid 5072] umount2("./15/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./15/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5447] +++ exited with 0 +++ [pid 5072] umount2("./15/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] openat(AT_FDCWD, "./15/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5072] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5072] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5072] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5072] close(4) = 0 [pid 5072] rmdir("./15/file0" [pid 5073] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=20, si_uid=0, si_status=0, si_utime=0, si_stime=7 /* 0.07 s */} --- [pid 5073] umount2("./18", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5072] <... rmdir resumed>) = 0 [pid 5073] <... openat resumed>) = 3 [pid 5073] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5073] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5073] umount2("./18/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./18/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5073] unlink("./18/binderfs") = 0 [pid 5073] umount2("./18/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./18/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [ 128.308115][ T5457] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 128.316097][ T5457] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000016 [ 128.324104][ T5457] [ 128.340282][ T5457] memory: usage 8kB, limit 0kB, failcnt 55 [ 128.348055][ T5457] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [pid 5073] unlink("./18/cgroup") = 0 [pid 5072] umount2("./15/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5073] umount2("./18/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5072] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5073] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./18/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5073] unlink("./18/cgroup.net") = 0 [ 128.356367][ T5457] Memory cgroup stats for /syz1: [ 128.368964][ T5457] anon 0 [ 128.368964][ T5457] file 0 [ 128.368964][ T5457] kernel 8192 [ 128.368964][ T5457] kernel_stack 0 [ 128.368964][ T5457] pagetables 0 [ 128.368964][ T5457] sec_pagetables 0 [ 128.368964][ T5457] percpu 0 [ 128.368964][ T5457] sock 0 [ 128.368964][ T5457] vmalloc 0 [ 128.368964][ T5457] shmem 0 [ 128.368964][ T5457] zswap 0 [ 128.368964][ T5457] zswapped 0 [ 128.368964][ T5457] file_mapped 0 [ 128.368964][ T5457] file_dirty 0 [pid 5073] umount2("./18/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5072] lstat("./15/cgroup.cpu", [pid 5073] <... umount2 resumed>) = 0 [pid 5072] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5073] umount2("./18/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5072] unlink("./15/cgroup.cpu" [pid 5073] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5072] <... unlink resumed>) = 0 [pid 5073] lstat("./18/file0", [pid 5072] getdents64(3, [pid 5073] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5072] <... getdents64 resumed>0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5073] umount2("./18/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5072] close(3 [pid 5073] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5072] <... close resumed>) = 0 [pid 5073] openat(AT_FDCWD, "./18/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5072] rmdir("./15" [pid 5073] <... openat resumed>) = 4 [pid 5072] <... rmdir resumed>) = 0 [pid 5073] fstat(4, [pid 5072] mkdir("./16", 0777 [pid 5073] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5072] <... mkdir resumed>) = 0 [pid 5073] getdents64(4, [ 128.368964][ T5457] file_writeback 0 [ 128.368964][ T5457] swapcached 0 [ 128.368964][ T5457] anon_thp 0 [ 128.368964][ T5457] file_thp 0 [ 128.368964][ T5457] shmem_thp 0 [ 128.368964][ T5457] inactive_anon 0 [ 128.368964][ T5457] active_anon 0 [ 128.368964][ T5457] inactive_file 0 [ 128.368964][ T5457] active_file 0 [ 128.368964][ T5457] unevictable 0 [ 128.368964][ T5457] slab_reclaimable 6752 [ 128.368964][ T5457] slab_unreclaimable 0 [ 128.368964][ T5457] slab 6752 [ 128.368964][ T5457] workingset_refault_anon 0 [pid 5072] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5466 attached [pid 5073] <... getdents64 resumed>0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5466] chdir("./16" [pid 5073] getdents64(4, [pid 5072] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 18 [pid 5466] <... chdir resumed>) = 0 [pid 5073] <... getdents64 resumed>0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5466] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5073] close(4 [pid 5466] <... prctl resumed>) = 0 [pid 5073] <... close resumed>) = 0 [pid 5466] setpgid(0, 0 [pid 5073] rmdir("./18/file0" [pid 5466] <... setpgid resumed>) = 0 [pid 5466] symlink("/syzcgroup/unified/syz5", "./cgroup" [pid 5073] <... rmdir resumed>) = 0 [pid 5466] <... symlink resumed>) = 0 [pid 5073] umount2("./18/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5466] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu" [pid 5073] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5466] <... symlink resumed>) = 0 [pid 5073] lstat("./18/cgroup.cpu", [pid 5466] symlink("/syzcgroup/net/syz5", "./cgroup.net" [pid 5073] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5466] <... symlink resumed>) = 0 [pid 5073] unlink("./18/cgroup.cpu" [pid 5466] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5073] <... unlink resumed>) = 0 [pid 5466] write(3, "1000", 4 [pid 5073] getdents64(3, [pid 5466] <... write resumed>) = 4 [pid 5073] <... getdents64 resumed>0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5466] close(3 [pid 5073] close(3 [pid 5466] <... close resumed>) = 0 [pid 5073] <... close resumed>) = 0 [pid 5466] symlink("/dev/binderfs", "./binderfs" [pid 5073] rmdir("./18" [pid 5466] <... symlink resumed>) = 0 [pid 5466] mkdir("./file0", 000) = 0 [pid 5073] <... rmdir resumed>) = 0 [pid 5466] open("./file0", O_RDONLY) = 3 [pid 5466] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5466] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5466] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5073] mkdir("./19", 0777 [pid 5466] openat(5, "memory.max", O_RDWR) = 6 [pid 5073] <... mkdir resumed>) = 0 [pid 5466] write(6, "0x000000000000040e", 18 [pid 5073] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5469 attached [pid 5469] chdir("./19" [pid 5073] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 21 [pid 5469] <... chdir resumed>) = 0 [pid 5469] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5469] setpgid(0, 0) = 0 [ 128.530025][ T5457] Tasks state (memory values in pages): [ 128.542765][ T5457] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 128.563483][ T5457] Out of memory and no killable processes... [pid 5469] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 5469] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 5457] <... write resumed>) = 18 [pid 5469] symlink("/syzcgroup/net/syz4", "./cgroup.net" [pid 5457] close(3 [pid 5469] <... symlink resumed>) = 0 [pid 5469] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5469] write(3, "1000", 4) = 4 [pid 5469] close(3) = 0 [pid 5469] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5469] mkdir("./file0", 000) = 0 [pid 5469] open("./file0", O_RDONLY) = 3 [pid 5469] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5469] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5469] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5469] openat(5, "memory.max", O_RDWR) = 6 [ 128.581122][ T5453] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 128.593974][ T5453] CPU: 0 PID: 5453 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 128.604454][ T5453] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 128.614559][ T5453] Call Trace: [ 128.617884][ T5453] [ 128.620846][ T5453] dump_stack_lvl+0x1e7/0x2d0 [ 128.625579][ T5453] ? nf_tcp_handle_invalid+0x640/0x640 [ 128.631089][ T5453] ? panic+0x770/0x770 [ 128.635220][ T5453] dump_header+0xdc/0x940 [ 128.639607][ T5453] out_of_memory+0xf21/0x12c0 [ 128.644340][ T5453] ? mutex_lock_io_nested+0x60/0x60 [ 128.649616][ T5453] ? mark_lock+0x9a/0x340 [ 128.653986][ T5453] ? unregister_oom_notifier+0x20/0x20 [ 128.659496][ T5453] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 128.665546][ T5453] mem_cgroup_out_of_memory+0x263/0x3b0 [ 128.671159][ T5453] ? mem_cgroup_oom_trylock+0x210/0x210 [ 128.676785][ T5453] ? cgroup_file_notify+0x127/0x190 [ 128.682046][ T5453] memory_max_write+0x355/0x470 [ 128.686962][ T5453] ? memory_max_show+0xa0/0xa0 [ 128.691782][ T5453] ? read_lock_is_recursive+0x20/0x20 [ 128.697219][ T5453] ? memory_max_show+0xa0/0xa0 [ 128.702030][ T5453] cgroup_file_write+0x2b1/0x780 [ 128.707022][ T5453] ? cgroup_seqfile_stop+0xd0/0xd0 [ 128.712181][ T5453] ? __virt_addr_valid+0x22f/0x2e0 [ 128.717365][ T5453] ? cgroup_seqfile_stop+0xd0/0xd0 [ 128.722522][ T5453] kernfs_fop_write_iter+0x3a6/0x4f0 [ 128.727873][ T5453] vfs_write+0x7b2/0xbb0 [ 128.732180][ T5453] ? file_end_write+0x240/0x240 [ 128.737094][ T5453] ? do_raw_spin_unlock+0x13b/0x8b0 [ 128.742349][ T5453] ? lockdep_hardirqs_on+0x98/0x140 [ 128.747609][ T5453] ? __fdget_pos+0x265/0x2f0 [ 128.752249][ T5453] ksys_write+0x1a0/0x2c0 [ 128.756631][ T5453] ? __ia32_sys_read+0x90/0x90 [ 128.761445][ T5453] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 128.767494][ T5453] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 128.773533][ T5453] do_syscall_64+0x41/0xc0 [ 128.778001][ T5453] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 128.783947][ T5453] RIP: 0033:0x7fd49ce20129 [ 128.788402][ T5453] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 128.808054][ T5453] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 128.816529][ T5453] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 128.824552][ T5453] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [pid 5469] write(6, "0x000000000000040e", 18 [pid 5457] <... close resumed>) = 0 [pid 5457] close(4) = 0 [pid 5457] close(5) = 0 [pid 5457] close(6) = 0 [pid 5457] close(7) = -1 EBADF (Bad file descriptor) [pid 5457] close(8) = -1 EBADF (Bad file descriptor) [pid 5457] close(9) = -1 EBADF (Bad file descriptor) [pid 5457] close(10) = -1 EBADF (Bad file descriptor) [pid 5457] close(11) = -1 EBADF (Bad file descriptor) [pid 5457] close(12) = -1 EBADF (Bad file descriptor) [pid 5457] close(13) = -1 EBADF (Bad file descriptor) [pid 5457] close(14) = -1 EBADF (Bad file descriptor) [pid 5457] close(15) = -1 EBADF (Bad file descriptor) [pid 5457] close(16) = -1 EBADF (Bad file descriptor) [pid 5457] close(17) = -1 EBADF (Bad file descriptor) [pid 5457] close(18) = -1 EBADF (Bad file descriptor) [pid 5457] close(19) = -1 EBADF (Bad file descriptor) [pid 5457] close(20) = -1 EBADF (Bad file descriptor) [ 128.832571][ T5453] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 128.840608][ T5453] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 128.848622][ T5453] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000015 [ 128.856664][ T5453] [pid 5457] close(21) = -1 EBADF (Bad file descriptor) [pid 5457] close(22) = -1 EBADF (Bad file descriptor) [pid 5457] close(23) = -1 EBADF (Bad file descriptor) [pid 5457] close(24) = -1 EBADF (Bad file descriptor) [pid 5457] close(25) = -1 EBADF (Bad file descriptor) [pid 5457] close(26) = -1 EBADF (Bad file descriptor) [pid 5457] close(27) = -1 EBADF (Bad file descriptor) [pid 5457] close(28) = -1 EBADF (Bad file descriptor) [pid 5457] close(29) = -1 EBADF (Bad file descriptor) [pid 5457] exit_group(0) = ? [pid 5457] +++ exited with 0 +++ [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=24, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- [pid 5074] umount2("./22", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] openat(AT_FDCWD, "./22", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5074] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5074] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5074] umount2("./22/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./22/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [ 128.884975][ T5453] memory: usage 8kB, limit 0kB, failcnt 55 [ 128.891010][ T5453] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 128.912473][ T5453] Memory cgroup stats for /syz1: [ 128.912682][ T5453] anon 0 [ 128.912682][ T5453] file 0 [ 128.912682][ T5453] kernel 8192 [ 128.912682][ T5453] kernel_stack 0 [ 128.912682][ T5453] pagetables 0 [pid 5074] unlink("./22/binderfs") = 0 [pid 5074] umount2("./22/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./22/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5074] unlink("./22/cgroup") = 0 [pid 5074] umount2("./22/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./22/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5074] unlink("./22/cgroup.net") = 0 [ 128.912682][ T5453] sec_pagetables 0 [ 128.912682][ T5453] percpu 0 [ 128.912682][ T5453] sock 0 [ 128.912682][ T5453] vmalloc 0 [ 128.912682][ T5453] shmem 0 [ 128.912682][ T5453] zswap 0 [ 128.912682][ T5453] zswapped 0 [ 128.912682][ T5453] file_mapped 0 [ 128.912682][ T5453] file_dirty 0 [ 128.912682][ T5453] file_writeback 0 [ 128.912682][ T5453] swapcached 0 [ 128.912682][ T5453] anon_thp 0 [ 128.912682][ T5453] file_thp 0 [ 128.912682][ T5453] shmem_thp 0 [ 128.912682][ T5453] inactive_anon 0 [ 128.912682][ T5453] active_anon 0 [pid 5074] umount2("./22/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5074] umount2("./22/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./22/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5074] umount2("./22/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] openat(AT_FDCWD, "./22/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5074] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5074] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5074] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5074] close(4) = 0 [pid 5074] rmdir("./22/file0") = 0 [pid 5074] umount2("./22/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./22/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [ 128.912682][ T5453] inactive_file 0 [ 128.912682][ T5453] active_file 0 [ 128.912682][ T5453] unevictable 0 [ 128.912682][ T5453] slab_reclaimable 6752 [ 128.912682][ T5453] slab_unreclaimable 0 [ 128.912682][ T5453] slab 6752 [ 128.912682][ T5453] workingset_refault_anon 0 [pid 5074] unlink("./22/cgroup.cpu") = 0 [pid 5074] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5074] close(3) = 0 [pid 5074] rmdir("./22") = 0 [pid 5074] mkdir("./23", 0777) = 0 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5473 attached [pid 5473] chdir("./23" [pid 5074] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 25 [pid 5473] <... chdir resumed>) = 0 [pid 5473] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5473] setpgid(0, 0) = 0 [pid 5473] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [pid 5473] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 5473] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 5473] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5473] write(3, "1000", 4) = 4 [pid 5473] close(3 [pid 5453] <... write resumed>) = 18 [pid 5473] <... close resumed>) = 0 [ 129.030733][ T5453] Tasks state (memory values in pages): [ 129.036423][ T5453] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 129.054041][ T5453] Out of memory and no killable processes... [ 129.060534][ T5459] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5473] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5473] mkdir("./file0", 000) = 0 [pid 5473] open("./file0", O_RDONLY) = 3 [pid 5473] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5473] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5473] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5473] openat(5, "memory.max", O_RDWR) = 6 [ 129.078674][ T5459] CPU: 0 PID: 5459 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 129.089147][ T5459] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 129.099251][ T5459] Call Trace: [ 129.102565][ T5459] [ 129.105542][ T5459] dump_stack_lvl+0x1e7/0x2d0 [ 129.110276][ T5459] ? nf_tcp_handle_invalid+0x640/0x640 [ 129.115791][ T5459] ? panic+0x770/0x770 [ 129.119932][ T5459] dump_header+0xdc/0x940 [ 129.124334][ T5459] out_of_memory+0xf21/0x12c0 [pid 5473] write(6, "0x000000000000040e", 18 [pid 5453] close(3) = 0 [pid 5453] close(4) = 0 [pid 5453] close(5) = 0 [pid 5453] close(6) = 0 [pid 5453] close(7) = -1 EBADF (Bad file descriptor) [pid 5453] close(8) = -1 EBADF (Bad file descriptor) [pid 5453] close(9) = -1 EBADF (Bad file descriptor) [pid 5453] close(10) = -1 EBADF (Bad file descriptor) [pid 5453] close(11) = -1 EBADF (Bad file descriptor) [pid 5453] close(12) = -1 EBADF (Bad file descriptor) [pid 5453] close(13) = -1 EBADF (Bad file descriptor) [pid 5453] close(14) = -1 EBADF (Bad file descriptor) [pid 5453] close(15) = -1 EBADF (Bad file descriptor) [pid 5453] close(16) = -1 EBADF (Bad file descriptor) [pid 5453] close(17) = -1 EBADF (Bad file descriptor) [pid 5453] close(18) = -1 EBADF (Bad file descriptor) [pid 5453] close(19) = -1 EBADF (Bad file descriptor) [ 129.129066][ T5459] ? mutex_lock_io_nested+0x60/0x60 [ 129.134333][ T5459] ? preempt_schedule+0xdd/0xf0 [ 129.139235][ T5459] ? unregister_oom_notifier+0x20/0x20 [ 129.144744][ T5459] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 129.150792][ T5459] mem_cgroup_out_of_memory+0x263/0x3b0 [ 129.156390][ T5459] ? preempt_schedule_thunk+0x1a/0x20 [ 129.161822][ T5459] ? mem_cgroup_oom_trylock+0x210/0x210 [ 129.167490][ T5459] ? cgroup_file_notify+0x127/0x190 [ 129.172748][ T5459] memory_max_write+0x355/0x470 [pid 5453] close(20) = -1 EBADF (Bad file descriptor) [pid 5453] close(21) = -1 EBADF (Bad file descriptor) [pid 5453] close(22) = -1 EBADF (Bad file descriptor) [pid 5453] close(23) = -1 EBADF (Bad file descriptor) [pid 5453] close(24) = -1 EBADF (Bad file descriptor) [pid 5453] close(25) = -1 EBADF (Bad file descriptor) [pid 5453] close(26) = -1 EBADF (Bad file descriptor) [pid 5453] close(27) = -1 EBADF (Bad file descriptor) [pid 5453] close(28) = -1 EBADF (Bad file descriptor) [pid 5453] close(29) = -1 EBADF (Bad file descriptor) [pid 5453] exit_group(0) = ? [pid 5453] +++ exited with 0 +++ [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=23, si_uid=0, si_status=0, si_utime=0, si_stime=9 /* 0.09 s */} --- [pid 5075] umount2("./21", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] openat(AT_FDCWD, "./21", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5075] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5075] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5075] umount2("./21/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./21/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5075] unlink("./21/binderfs") = 0 [ 129.177660][ T5459] ? memory_max_show+0xa0/0xa0 [ 129.182478][ T5459] ? read_lock_is_recursive+0x20/0x20 [ 129.187919][ T5459] ? memory_max_show+0xa0/0xa0 [ 129.192730][ T5459] cgroup_file_write+0x2b1/0x780 [ 129.197725][ T5459] ? cgroup_seqfile_stop+0xd0/0xd0 [ 129.202884][ T5459] ? __virt_addr_valid+0x22f/0x2e0 [ 129.208067][ T5459] ? cgroup_seqfile_stop+0xd0/0xd0 [ 129.213220][ T5459] kernfs_fop_write_iter+0x3a6/0x4f0 [ 129.218554][ T5459] vfs_write+0x7b2/0xbb0 [ 129.222858][ T5459] ? file_end_write+0x240/0x240 [pid 5075] umount2("./21/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./21/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5075] unlink("./21/cgroup") = 0 [pid 5075] umount2("./21/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./21/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5075] unlink("./21/cgroup.net") = 0 [ 129.227775][ T5459] ? do_raw_spin_unlock+0x13b/0x8b0 [ 129.233035][ T5459] ? lockdep_hardirqs_on+0x98/0x140 [ 129.238314][ T5459] ? __fdget_pos+0x265/0x2f0 [ 129.242973][ T5459] ksys_write+0x1a0/0x2c0 [ 129.247379][ T5459] ? __ia32_sys_read+0x90/0x90 [ 129.252200][ T5459] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 129.258245][ T5459] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 129.264288][ T5459] do_syscall_64+0x41/0xc0 [ 129.268753][ T5459] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 129.274696][ T5459] RIP: 0033:0x7fd49ce20129 [ 129.279150][ T5459] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 129.298806][ T5459] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 129.307279][ T5459] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 129.315298][ T5459] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 129.323321][ T5459] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [pid 5075] umount2("./21/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5075] umount2("./21/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 129.331341][ T5459] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 129.339367][ T5459] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 000000000000000f [ 129.347417][ T5459] [ 129.359627][ T5459] memory: usage 8kB, limit 0kB, failcnt 55 [ 129.365889][ T5459] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 129.373654][ T5459] Memory cgroup stats for /syz1: [ 129.374121][ T5459] anon 0 [ 129.374121][ T5459] file 0 [ 129.374121][ T5459] kernel 8192 [ 129.374121][ T5459] kernel_stack 0 [ 129.374121][ T5459] pagetables 0 [ 129.374121][ T5459] sec_pagetables 0 [ 129.374121][ T5459] percpu 0 [ 129.374121][ T5459] sock 0 [ 129.374121][ T5459] vmalloc 0 [ 129.374121][ T5459] shmem 0 [ 129.374121][ T5459] zswap 0 [ 129.374121][ T5459] zswapped 0 [ 129.374121][ T5459] file_mapped 0 [ 129.374121][ T5459] file_dirty 0 [ 129.374121][ T5459] file_writeback 0 [ 129.374121][ T5459] swapcached 0 [ 129.374121][ T5459] anon_thp 0 [pid 5075] lstat("./21/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5075] umount2("./21/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] openat(AT_FDCWD, "./21/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5075] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5075] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5075] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5075] close(4) = 0 [pid 5075] rmdir("./21/file0") = 0 [pid 5075] umount2("./21/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./21/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5075] unlink("./21/cgroup.cpu") = 0 [pid 5075] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5075] close(3) = 0 [ 129.374121][ T5459] file_thp 0 [ 129.374121][ T5459] shmem_thp 0 [ 129.374121][ T5459] inactive_anon 0 [ 129.374121][ T5459] active_anon 0 [ 129.374121][ T5459] inactive_file 0 [ 129.374121][ T5459] active_file 0 [ 129.374121][ T5459] unevictable 0 [ 129.374121][ T5459] slab_reclaimable 6752 [ 129.374121][ T5459] slab_unreclaimable 0 [ 129.374121][ T5459] slab 6752 [ 129.374121][ T5459] workingset_refault_anon 0 [pid 5075] rmdir("./21") = 0 [pid 5075] mkdir("./22", 0777) = 0 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5459] <... write resumed>) = 18 [pid 5459] close(3) = 0 [pid 5459] close(4) = 0 [pid 5459] close(5) = 0 [pid 5459] close(6) = 0 [pid 5459] close(7) = -1 EBADF (Bad file descriptor) [pid 5459] close(8) = -1 EBADF (Bad file descriptor) [pid 5459] close(9) = -1 EBADF (Bad file descriptor) [pid 5459] close(10) = -1 EBADF (Bad file descriptor) [pid 5459] close(11) = -1 EBADF (Bad file descriptor) [pid 5459] close(12) = -1 EBADF (Bad file descriptor) [pid 5459] close(13) = -1 EBADF (Bad file descriptor) [pid 5459] close(14) = -1 EBADF (Bad file descriptor) [pid 5459] close(15) = -1 EBADF (Bad file descriptor) [pid 5459] close(16) = -1 EBADF (Bad file descriptor) [pid 5459] close(17) = -1 EBADF (Bad file descriptor) [pid 5459] close(18) = -1 EBADF (Bad file descriptor) [pid 5459] close(19) = -1 EBADF (Bad file descriptor) [pid 5459] close(20) = -1 EBADF (Bad file descriptor) [pid 5459] close(21) = -1 EBADF (Bad file descriptor) [pid 5459] close(22) = -1 EBADF (Bad file descriptor) [pid 5459] close(23) = -1 EBADF (Bad file descriptor) [pid 5459] close(24) = -1 EBADF (Bad file descriptor) [pid 5459] close(25) = -1 EBADF (Bad file descriptor) [pid 5459] close(26) = -1 EBADF (Bad file descriptor) [pid 5459] close(27) = -1 EBADF (Bad file descriptor) [pid 5459] close(28) = -1 EBADF (Bad file descriptor) [pid 5459] close(29) = -1 EBADF (Bad file descriptor) [pid 5459] exit_group(0) = ? [pid 5459] +++ exited with 0 +++ [pid 5070] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=17, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- ./strace-static-x86_64: Process 5478 attached [pid 5075] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 24 [pid 5478] chdir("./22" [pid 5070] umount2("./15", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5478] <... chdir resumed>) = 0 [pid 5070] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5070] openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5478] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5070] <... openat resumed>) = 3 [pid 5070] fstat(3, [pid 5478] <... prctl resumed>) = 0 [ 129.508516][ T5459] Tasks state (memory values in pages): [ 129.514454][ T5459] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 129.524950][ T5459] Out of memory and no killable processes... [ 129.531908][ T5466] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 129.556790][ T5466] CPU: 0 PID: 5466 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 129.567279][ T5466] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 129.577380][ T5466] Call Trace: [ 129.580695][ T5466] [ 129.583664][ T5466] dump_stack_lvl+0x1e7/0x2d0 [ 129.588409][ T5466] ? nf_tcp_handle_invalid+0x640/0x640 [ 129.593923][ T5466] ? panic+0x770/0x770 [ 129.598057][ T5466] dump_header+0xdc/0x940 [ 129.602450][ T5466] out_of_memory+0xf21/0x12c0 [ 129.607196][ T5466] ? mutex_lock_io_nested+0x60/0x60 [ 129.612457][ T5466] ? mark_lock+0x9a/0x340 [ 129.616839][ T5466] ? unregister_oom_notifier+0x20/0x20 [ 129.622345][ T5466] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 129.628366][ T5466] mem_cgroup_out_of_memory+0x263/0x3b0 [ 129.633944][ T5466] ? mem_cgroup_oom_trylock+0x210/0x210 [ 129.639526][ T5466] ? cgroup_file_notify+0x127/0x190 [ 129.644767][ T5466] memory_max_write+0x355/0x470 [ 129.649648][ T5466] ? memory_max_show+0xa0/0xa0 [ 129.654432][ T5466] ? read_lock_is_recursive+0x20/0x20 [ 129.659829][ T5466] ? memory_max_show+0xa0/0xa0 [ 129.664661][ T5466] cgroup_file_write+0x2b1/0x780 [ 129.669668][ T5466] ? cgroup_seqfile_stop+0xd0/0xd0 [ 129.674802][ T5466] ? __virt_addr_valid+0x22f/0x2e0 [ 129.679965][ T5466] ? cgroup_seqfile_stop+0xd0/0xd0 [ 129.685091][ T5466] kernfs_fop_write_iter+0x3a6/0x4f0 [ 129.690399][ T5466] vfs_write+0x7b2/0xbb0 [ 129.694666][ T5466] ? file_end_write+0x240/0x240 [ 129.699625][ T5466] ? do_raw_spin_unlock+0x13b/0x8b0 [ 129.704840][ T5466] ? lockdep_hardirqs_on+0x98/0x140 [ 129.710062][ T5466] ? __fdget_pos+0x265/0x2f0 [ 129.714700][ T5466] ksys_write+0x1a0/0x2c0 [ 129.719070][ T5466] ? __ia32_sys_read+0x90/0x90 [ 129.723866][ T5466] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 129.729886][ T5466] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 129.735899][ T5466] do_syscall_64+0x41/0xc0 [ 129.740335][ T5466] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 129.746256][ T5466] RIP: 0033:0x7fd49ce20129 [ 129.750687][ T5466] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 129.770656][ T5466] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 129.779085][ T5466] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 129.787082][ T5466] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 129.795060][ T5466] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [pid 5478] setpgid(0, 0 [pid 5070] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5478] <... setpgid resumed>) = 0 [pid 5070] getdents64(3, [pid 5478] symlink("/syzcgroup/unified/syz2", "./cgroup" [pid 5070] <... getdents64 resumed>0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5478] <... symlink resumed>) = 0 [pid 5070] umount2("./15/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5478] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu" [pid 5070] lstat("./15/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5070] unlink("./15/binderfs" [pid 5478] <... symlink resumed>) = 0 [pid 5070] <... unlink resumed>) = 0 [pid 5070] umount2("./15/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5478] symlink("/syzcgroup/net/syz2", "./cgroup.net" [pid 5070] lstat("./15/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5070] unlink("./15/cgroup") = 0 [pid 5070] umount2("./15/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./15/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5070] unlink("./15/cgroup.net" [pid 5478] <... symlink resumed>) = 0 [pid 5070] <... unlink resumed>) = 0 [pid 5070] umount2("./15/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5478] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5070] umount2("./15/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5478] <... openat resumed>) = 3 [pid 5070] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./15/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5478] write(3, "1000", 4 [ 129.803041][ T5466] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 129.811025][ T5466] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000010 [ 129.819033][ T5466] [ 129.847340][ T5466] memory: usage 8kB, limit 0kB, failcnt 55 [pid 5070] umount2("./15/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5478] <... write resumed>) = 4 [pid 5070] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5478] close(3 [pid 5070] openat(AT_FDCWD, "./15/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5478] <... close resumed>) = 0 [pid 5070] <... openat resumed>) = 4 [pid 5478] symlink("/dev/binderfs", "./binderfs" [pid 5070] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5478] <... symlink resumed>) = 0 [pid 5070] getdents64(4, [pid 5478] mkdir("./file0", 000 [pid 5070] <... getdents64 resumed>0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5070] getdents64(4, [pid 5478] <... mkdir resumed>) = 0 [pid 5070] <... getdents64 resumed>0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5478] open("./file0", O_RDONLY [pid 5070] close(4 [pid 5478] <... open resumed>) = 3 [pid 5070] <... close resumed>) = 0 [pid 5478] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5070] rmdir("./15/file0" [pid 5478] <... mount resumed>) = 0 [pid 5070] <... rmdir resumed>) = 0 [pid 5478] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5070] umount2("./15/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5478] openat(4, "syz1", O_RDWR|O_PATH [pid 5070] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5478] <... openat resumed>) = 5 [pid 5070] lstat("./15/cgroup.cpu", [pid 5478] openat(5, "memory.max", O_RDWR [pid 5070] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5478] <... openat resumed>) = 6 [pid 5070] unlink("./15/cgroup.cpu" [pid 5478] write(6, "0x000000000000040e", 18 [pid 5070] <... unlink resumed>) = 0 [pid 5070] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5070] close(3) = 0 [pid 5070] rmdir("./15") = 0 [ 129.858173][ T5466] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 129.872634][ T5466] Memory cgroup stats for /syz1: [ 129.872846][ T5466] anon 0 [ 129.872846][ T5466] file 0 [ 129.872846][ T5466] kernel 8192 [ 129.872846][ T5466] kernel_stack 0 [ 129.872846][ T5466] pagetables 0 [ 129.872846][ T5466] sec_pagetables 0 [ 129.872846][ T5466] percpu 0 [ 129.872846][ T5466] sock 0 [ 129.872846][ T5466] vmalloc 0 [ 129.872846][ T5466] shmem 0 [pid 5070] mkdir("./16", 0777) = 0 [pid 5070] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555574ac5d0) = 18 [ 129.872846][ T5466] zswap 0 [ 129.872846][ T5466] zswapped 0 [ 129.872846][ T5466] file_mapped 0 [ 129.872846][ T5466] file_dirty 0 [ 129.872846][ T5466] file_writeback 0 [ 129.872846][ T5466] swapcached 0 [ 129.872846][ T5466] anon_thp 0 [ 129.872846][ T5466] file_thp 0 [ 129.872846][ T5466] shmem_thp 0 [ 129.872846][ T5466] inactive_anon 0 [ 129.872846][ T5466] active_anon 0 [ 129.872846][ T5466] inactive_file 0 [ 129.872846][ T5466] active_file 0 [ 129.872846][ T5466] unevictable 0 [ 129.872846][ T5466] slab_reclaimable 6752 ./strace-static-x86_64: Process 5482 attached [pid 5482] chdir("./16") = 0 [pid 5482] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5482] setpgid(0, 0) = 0 [pid 5482] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 5482] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 5482] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 5482] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5482] write(3, "1000", 4) = 4 [pid 5482] close(3) = 0 [pid 5482] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5482] mkdir("./file0", 000) = 0 [pid 5482] open("./file0", O_RDONLY) = 3 [pid 5482] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5482] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5482] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5482] openat(5, "memory.max", O_RDWR) = 6 [ 129.872846][ T5466] slab_unreclaimable 0 [ 129.872846][ T5466] slab 6752 [ 129.872846][ T5466] workingset_refault_anon 0 [ 129.972901][ T5466] Tasks state (memory values in pages): [ 129.980892][ T5466] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5482] write(6, "0x000000000000040e", 18 [pid 5466] <... write resumed>) = 18 [pid 5466] close(3) = 0 [pid 5466] close(4) = 0 [pid 5466] close(5) = 0 [pid 5466] close(6) = 0 [pid 5466] close(7) = -1 EBADF (Bad file descriptor) [pid 5466] close(8) = -1 EBADF (Bad file descriptor) [ 130.012958][ T5466] Out of memory and no killable processes... [ 130.021433][ T5469] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5466] close(9) = -1 EBADF (Bad file descriptor) [pid 5466] close(10) = -1 EBADF (Bad file descriptor) [pid 5466] close(11) = -1 EBADF (Bad file descriptor) [pid 5466] close(12) = -1 EBADF (Bad file descriptor) [ 130.058728][ T5469] CPU: 1 PID: 5469 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 130.069230][ T5469] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 130.079329][ T5469] Call Trace: [ 130.082641][ T5469] [ 130.085621][ T5469] dump_stack_lvl+0x1e7/0x2d0 [ 130.090372][ T5469] ? nf_tcp_handle_invalid+0x640/0x640 [ 130.095885][ T5469] ? panic+0x770/0x770 [ 130.100021][ T5469] dump_header+0xdc/0x940 [ 130.104420][ T5469] out_of_memory+0xf21/0x12c0 [ 130.109158][ T5469] ? mutex_lock_io_nested+0x60/0x60 [ 130.114417][ T5469] ? preempt_schedule+0xdd/0xf0 [ 130.119331][ T5469] ? unregister_oom_notifier+0x20/0x20 [ 130.124850][ T5469] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 130.130909][ T5469] mem_cgroup_out_of_memory+0x263/0x3b0 [ 130.136515][ T5469] ? preempt_schedule_thunk+0x1a/0x20 [ 130.141943][ T5469] ? mem_cgroup_oom_trylock+0x210/0x210 [ 130.147570][ T5469] ? cgroup_file_notify+0x127/0x190 [ 130.152825][ T5469] memory_max_write+0x355/0x470 [ 130.157732][ T5469] ? memory_max_show+0xa0/0xa0 [ 130.162567][ T5469] ? read_lock_is_recursive+0x20/0x20 [ 130.168021][ T5469] ? memory_max_show+0xa0/0xa0 [ 130.172830][ T5469] cgroup_file_write+0x2b1/0x780 [ 130.177826][ T5469] ? cgroup_seqfile_stop+0xd0/0xd0 [ 130.182987][ T5469] ? __virt_addr_valid+0x22f/0x2e0 [ 130.188169][ T5469] ? cgroup_seqfile_stop+0xd0/0xd0 [ 130.193326][ T5469] kernfs_fop_write_iter+0x3a6/0x4f0 [ 130.198676][ T5469] vfs_write+0x7b2/0xbb0 [ 130.202986][ T5469] ? file_end_write+0x240/0x240 [ 130.207898][ T5469] ? do_raw_spin_unlock+0x13b/0x8b0 [ 130.213143][ T5469] ? lockdep_hardirqs_on+0x98/0x140 [ 130.218404][ T5469] ? __fdget_pos+0x265/0x2f0 [ 130.223052][ T5469] ksys_write+0x1a0/0x2c0 [ 130.227442][ T5469] ? __ia32_sys_read+0x90/0x90 [ 130.232253][ T5469] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 130.238300][ T5469] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 130.244353][ T5469] do_syscall_64+0x41/0xc0 [ 130.248826][ T5469] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 130.254781][ T5469] RIP: 0033:0x7fd49ce20129 [ 130.259237][ T5469] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 130.278894][ T5469] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 130.287372][ T5469] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 130.295394][ T5469] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [pid 5466] close(13) = -1 EBADF (Bad file descriptor) [pid 5466] close(14) = -1 EBADF (Bad file descriptor) [pid 5466] close(15) = -1 EBADF (Bad file descriptor) [pid 5466] close(16) = -1 EBADF (Bad file descriptor) [pid 5466] close(17) = -1 EBADF (Bad file descriptor) [pid 5466] close(18) = -1 EBADF (Bad file descriptor) [pid 5466] close(19) = -1 EBADF (Bad file descriptor) [pid 5466] close(20) = -1 EBADF (Bad file descriptor) [pid 5466] close(21) = -1 EBADF (Bad file descriptor) [pid 5466] close(22) = -1 EBADF (Bad file descriptor) [pid 5466] close(23) = -1 EBADF (Bad file descriptor) [pid 5466] close(24) = -1 EBADF (Bad file descriptor) [pid 5466] close(25) = -1 EBADF (Bad file descriptor) [pid 5466] close(26) = -1 EBADF (Bad file descriptor) [pid 5466] close(27) = -1 EBADF (Bad file descriptor) [pid 5466] close(28) = -1 EBADF (Bad file descriptor) [pid 5466] close(29) = -1 EBADF (Bad file descriptor) [pid 5466] exit_group(0) = ? [pid 5466] +++ exited with 0 +++ [pid 5072] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=18, si_uid=0, si_status=0, si_utime=0, si_stime=7 /* 0.07 s */} --- [pid 5072] umount2("./16", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5072] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5072] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5072] umount2("./16/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./16/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [ 130.303421][ T5469] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 130.311447][ T5469] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 130.319470][ T5469] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000013 [ 130.327519][ T5469] [pid 5072] unlink("./16/binderfs") = 0 [pid 5072] umount2("./16/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./16/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5072] unlink("./16/cgroup") = 0 [pid 5072] umount2("./16/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./16/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5072] unlink("./16/cgroup.net") = 0 [pid 5072] umount2("./16/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [ 130.376278][ T5469] memory: usage 8kB, limit 0kB, failcnt 55 [ 130.388088][ T5469] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 130.396347][ T5469] Memory cgroup stats for /syz1: [ 130.403208][ T5469] anon 0 [ 130.403208][ T5469] file 0 [ 130.403208][ T5469] kernel 8192 [ 130.403208][ T5469] kernel_stack 0 [ 130.403208][ T5469] pagetables 0 [ 130.403208][ T5469] sec_pagetables 0 [ 130.403208][ T5469] percpu 0 [ 130.403208][ T5469] sock 0 [ 130.403208][ T5469] vmalloc 0 [ 130.403208][ T5469] shmem 0 [ 130.403208][ T5469] zswap 0 [ 130.403208][ T5469] zswapped 0 [ 130.403208][ T5469] file_mapped 0 [ 130.403208][ T5469] file_dirty 0 [ 130.403208][ T5469] file_writeback 0 [ 130.403208][ T5469] swapcached 0 [ 130.403208][ T5469] anon_thp 0 [ 130.403208][ T5469] file_thp 0 [ 130.403208][ T5469] shmem_thp 0 [ 130.403208][ T5469] inactive_anon 0 [ 130.403208][ T5469] active_anon 0 [pid 5072] umount2("./16/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./16/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5072] umount2("./16/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] openat(AT_FDCWD, "./16/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5072] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5072] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5072] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5072] close(4) = 0 [pid 5072] rmdir("./16/file0") = 0 [pid 5072] umount2("./16/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./16/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5072] unlink("./16/cgroup.cpu") = 0 [pid 5072] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5072] close(3) = 0 [pid 5072] rmdir("./16") = 0 [pid 5072] mkdir("./17", 0777) = 0 [pid 5072] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5488 attached [pid 5488] chdir("./17") = 0 [pid 5072] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 19 [pid 5488] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5488] setpgid(0, 0) = 0 [ 130.403208][ T5469] inactive_file 0 [ 130.403208][ T5469] active_file 0 [ 130.403208][ T5469] unevictable 0 [ 130.403208][ T5469] slab_reclaimable 6752 [ 130.403208][ T5469] slab_unreclaimable 0 [ 130.403208][ T5469] slab 6752 [ 130.403208][ T5469] workingset_refault_anon 0 [ 130.513345][ T5469] Tasks state (memory values in pages): [pid 5488] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 5488] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [pid 5488] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 5488] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5488] write(3, "1000", 4) = 4 [pid 5488] close(3) = 0 [pid 5488] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5488] mkdir("./file0", 000) = 0 [pid 5488] open("./file0", O_RDONLY) = 3 [pid 5488] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5488] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5488] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5488] openat(5, "memory.max", O_RDWR) = 6 [ 130.522961][ T5469] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 130.543226][ T5469] Out of memory and no killable processes... [ 130.553665][ T5473] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 130.566693][ T5473] CPU: 0 PID: 5473 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [pid 5488] write(6, "0x000000000000040e", 18 [pid 5469] <... write resumed>) = 18 [pid 5469] close(3) = 0 [pid 5469] close(4) = 0 [pid 5469] close(5) = 0 [pid 5469] close(6) = 0 [pid 5469] close(7) = -1 EBADF (Bad file descriptor) [pid 5469] close(8) = -1 EBADF (Bad file descriptor) [pid 5469] close(9) = -1 EBADF (Bad file descriptor) [pid 5469] close(10) = -1 EBADF (Bad file descriptor) [pid 5469] close(11) = -1 EBADF (Bad file descriptor) [pid 5469] close(12) = -1 EBADF (Bad file descriptor) [pid 5469] close(13) = -1 EBADF (Bad file descriptor) [pid 5469] close(14) = -1 EBADF (Bad file descriptor) [pid 5469] close(15) = -1 EBADF (Bad file descriptor) [pid 5469] close(16) = -1 EBADF (Bad file descriptor) [pid 5469] close(17) = -1 EBADF (Bad file descriptor) [pid 5469] close(18) = -1 EBADF (Bad file descriptor) [pid 5469] close(19) = -1 EBADF (Bad file descriptor) [pid 5469] close(20) = -1 EBADF (Bad file descriptor) [pid 5469] close(21) = -1 EBADF (Bad file descriptor) [pid 5469] close(22) = -1 EBADF (Bad file descriptor) [pid 5469] close(23) = -1 EBADF (Bad file descriptor) [pid 5469] close(24) = -1 EBADF (Bad file descriptor) [pid 5469] close(25) = -1 EBADF (Bad file descriptor) [pid 5469] close(26) = -1 EBADF (Bad file descriptor) [pid 5469] close(27) = -1 EBADF (Bad file descriptor) [pid 5469] close(28) = -1 EBADF (Bad file descriptor) [pid 5469] close(29) = -1 EBADF (Bad file descriptor) [pid 5469] exit_group(0) = ? [pid 5469] +++ exited with 0 +++ [pid 5073] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=21, si_uid=0, si_status=0, si_utime=0, si_stime=10 /* 0.10 s */} --- [pid 5073] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5073] umount2("./19", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5073] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5073] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [ 130.577172][ T5473] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 130.587271][ T5473] Call Trace: [ 130.590589][ T5473] [ 130.593563][ T5473] dump_stack_lvl+0x1e7/0x2d0 [ 130.598303][ T5473] ? nf_tcp_handle_invalid+0x640/0x640 [ 130.603825][ T5473] ? panic+0x770/0x770 [ 130.607967][ T5473] dump_header+0xdc/0x940 [ 130.612358][ T5473] out_of_memory+0xf21/0x12c0 [ 130.617106][ T5473] ? mutex_lock_io_nested+0x60/0x60 [ 130.622384][ T5473] ? preempt_schedule+0xdd/0xf0 [ 130.627299][ T5473] ? unregister_oom_notifier+0x20/0x20 [ 130.632797][ T5473] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 130.638811][ T5473] mem_cgroup_out_of_memory+0x263/0x3b0 [ 130.644379][ T5473] ? preempt_schedule_thunk+0x1a/0x20 [ 130.649776][ T5473] ? mem_cgroup_oom_trylock+0x210/0x210 [ 130.655360][ T5473] ? cgroup_file_notify+0x127/0x190 [ 130.660592][ T5473] memory_max_write+0x355/0x470 [ 130.665469][ T5473] ? memory_max_show+0xa0/0xa0 [ 130.670250][ T5473] ? read_lock_is_recursive+0x20/0x20 [ 130.675668][ T5473] ? memory_max_show+0xa0/0xa0 [ 130.680470][ T5473] cgroup_file_write+0x2b1/0x780 [ 130.685444][ T5473] ? cgroup_seqfile_stop+0xd0/0xd0 [ 130.690583][ T5473] ? __virt_addr_valid+0x22f/0x2e0 [ 130.695745][ T5473] ? cgroup_seqfile_stop+0xd0/0xd0 [ 130.700873][ T5473] kernfs_fop_write_iter+0x3a6/0x4f0 [ 130.706183][ T5473] vfs_write+0x7b2/0xbb0 [ 130.710448][ T5473] ? file_end_write+0x240/0x240 [ 130.715321][ T5473] ? do_raw_spin_unlock+0x13b/0x8b0 [ 130.720541][ T5473] ? lockdep_hardirqs_on+0x98/0x140 [ 130.725762][ T5473] ? __fdget_pos+0x265/0x2f0 [ 130.730371][ T5473] ksys_write+0x1a0/0x2c0 [ 130.734720][ T5473] ? __ia32_sys_read+0x90/0x90 [ 130.739515][ T5473] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 130.745544][ T5473] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 130.751562][ T5473] do_syscall_64+0x41/0xc0 [ 130.756010][ T5473] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 130.761934][ T5473] RIP: 0033:0x7fd49ce20129 [ 130.766383][ T5473] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 130.786002][ T5473] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 130.794456][ T5473] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 130.802444][ T5473] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 130.810445][ T5473] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 130.818426][ T5473] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [pid 5073] umount2("./19/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./19/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5073] unlink("./19/binderfs") = 0 [pid 5073] umount2("./19/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./19/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5073] unlink("./19/cgroup") = 0 [pid 5073] umount2("./19/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 130.826409][ T5473] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000017 [ 130.834412][ T5473] [ 130.840371][ T5473] memory: usage 8kB, limit 0kB, failcnt 55 [ 130.846261][ T5473] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 130.855319][ T5473] Memory cgroup stats for /syz1: [ 130.855541][ T5473] anon 0 [ 130.855541][ T5473] file 0 [ 130.855541][ T5473] kernel 8192 [ 130.855541][ T5473] kernel_stack 0 [ 130.855541][ T5473] pagetables 0 [pid 5073] lstat("./19/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5073] unlink("./19/cgroup.net") = 0 [ 130.855541][ T5473] sec_pagetables 0 [ 130.855541][ T5473] percpu 0 [ 130.855541][ T5473] sock 0 [ 130.855541][ T5473] vmalloc 0 [ 130.855541][ T5473] shmem 0 [ 130.855541][ T5473] zswap 0 [ 130.855541][ T5473] zswapped 0 [ 130.855541][ T5473] file_mapped 0 [ 130.855541][ T5473] file_dirty 0 [ 130.855541][ T5473] file_writeback 0 [ 130.855541][ T5473] swapcached 0 [ 130.855541][ T5473] anon_thp 0 [ 130.855541][ T5473] file_thp 0 [ 130.855541][ T5473] shmem_thp 0 [ 130.855541][ T5473] inactive_anon 0 [ 130.855541][ T5473] active_anon 0 [pid 5073] umount2("./19/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5073] umount2("./19/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./19/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5073] umount2("./19/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] openat(AT_FDCWD, "./19/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5073] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5073] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5073] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5073] close(4) = 0 [pid 5073] rmdir("./19/file0") = 0 [ 130.855541][ T5473] inactive_file 0 [ 130.855541][ T5473] active_file 0 [ 130.855541][ T5473] unevictable 0 [ 130.855541][ T5473] slab_reclaimable 6752 [ 130.855541][ T5473] slab_unreclaimable 0 [ 130.855541][ T5473] slab 6752 [ 130.855541][ T5473] workingset_refault_anon 0 [ 130.955270][ T5473] Tasks state (memory values in pages): [ 130.961857][ T5473] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5073] umount2("./19/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./19/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5073] unlink("./19/cgroup.cpu") = 0 [pid 5073] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5073] close(3) = 0 [pid 5073] rmdir("./19") = 0 [pid 5073] mkdir("./20", 0777 [pid 5473] <... write resumed>) = 18 [pid 5073] <... mkdir resumed>) = 0 [pid 5073] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555574ac5d0) = 22 [ 130.978924][ T5473] Out of memory and no killable processes... [ 130.985318][ T5478] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 130.996716][ T5478] CPU: 1 PID: 5478 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 131.007194][ T5478] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 131.017294][ T5478] Call Trace: [ 131.020610][ T5478] [ 131.023577][ T5478] dump_stack_lvl+0x1e7/0x2d0 [ 131.028329][ T5478] ? nf_tcp_handle_invalid+0x640/0x640 [ 131.033853][ T5478] ? panic+0x770/0x770 [ 131.037996][ T5478] dump_header+0xdc/0x940 [ 131.042383][ T5478] out_of_memory+0xf21/0x12c0 [ 131.047118][ T5478] ? mutex_lock_io_nested+0x60/0x60 [ 131.052378][ T5478] ? preempt_schedule+0xdd/0xf0 [ 131.057284][ T5478] ? unregister_oom_notifier+0x20/0x20 [ 131.062788][ T5478] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 131.068840][ T5478] mem_cgroup_out_of_memory+0x263/0x3b0 [ 131.074448][ T5478] ? preempt_schedule_thunk+0x1a/0x20 [ 131.079882][ T5478] ? mem_cgroup_oom_trylock+0x210/0x210 [ 131.085497][ T5478] ? cgroup_file_notify+0x127/0x190 [ 131.090757][ T5478] memory_max_write+0x355/0x470 [ 131.095666][ T5478] ? memory_max_show+0xa0/0xa0 [ 131.100479][ T5478] ? read_lock_is_recursive+0x20/0x20 [ 131.105908][ T5478] ? memory_max_show+0xa0/0xa0 [ 131.110720][ T5478] cgroup_file_write+0x2b1/0x780 [ 131.115711][ T5478] ? cgroup_seqfile_stop+0xd0/0xd0 [ 131.120864][ T5478] ? __virt_addr_valid+0x22f/0x2e0 [ 131.126043][ T5478] ? cgroup_seqfile_stop+0xd0/0xd0 [ 131.131200][ T5478] kernfs_fop_write_iter+0x3a6/0x4f0 [ 131.136538][ T5478] vfs_write+0x7b2/0xbb0 [ 131.140841][ T5478] ? file_end_write+0x240/0x240 [ 131.145764][ T5478] ? do_raw_spin_unlock+0x13b/0x8b0 [ 131.151013][ T5478] ? lockdep_hardirqs_on+0x98/0x140 [ 131.156288][ T5478] ? __fdget_pos+0x265/0x2f0 [ 131.160937][ T5478] ksys_write+0x1a0/0x2c0 [ 131.165323][ T5478] ? __ia32_sys_read+0x90/0x90 [ 131.170144][ T5478] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 131.176192][ T5478] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 131.182240][ T5478] do_syscall_64+0x41/0xc0 [ 131.186715][ T5478] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 131.192670][ T5478] RIP: 0033:0x7fd49ce20129 [ 131.197128][ T5478] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 131.216781][ T5478] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 ./strace-static-x86_64: Process 5492 attached [pid 5473] close(3 [pid 5492] chdir("./20" [pid 5473] <... close resumed>) = 0 [ 131.225250][ T5478] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 131.233270][ T5478] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 131.241286][ T5478] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 131.249296][ T5478] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 131.257309][ T5478] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000016 [ 131.265352][ T5478] [pid 5492] <... chdir resumed>) = 0 [pid 5473] close(4 [pid 5492] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5473] <... close resumed>) = 0 [pid 5492] <... prctl resumed>) = 0 [pid 5492] setpgid(0, 0 [pid 5473] close(5 [pid 5492] <... setpgid resumed>) = 0 [pid 5492] symlink("/syzcgroup/unified/syz4", "./cgroup" [pid 5473] <... close resumed>) = 0 [pid 5492] <... symlink resumed>) = 0 [pid 5473] close(6 [pid 5492] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 5473] <... close resumed>) = 0 [pid 5492] symlink("/syzcgroup/net/syz4", "./cgroup.net" [pid 5473] close(7 [pid 5492] <... symlink resumed>) = 0 [pid 5473] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5492] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5492] write(3, "1000", 4) = 4 [pid 5492] close(3) = 0 [pid 5492] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5492] mkdir("./file0", 000) = 0 [ 131.278766][ T5478] memory: usage 8kB, limit 0kB, failcnt 55 [ 131.291415][ T5478] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 131.304814][ T5478] Memory cgroup stats for /syz1: [ 131.305863][ T5478] anon 0 [ 131.305863][ T5478] file 0 [ 131.305863][ T5478] kernel 8192 [ 131.305863][ T5478] kernel_stack 0 [ 131.305863][ T5478] pagetables 0 [ 131.305863][ T5478] sec_pagetables 0 [pid 5492] open("./file0", O_RDONLY) = 3 [pid 5492] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5492] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5492] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5492] openat(5, "memory.max", O_RDWR) = 6 [ 131.305863][ T5478] percpu 0 [ 131.305863][ T5478] sock 0 [ 131.305863][ T5478] vmalloc 0 [ 131.305863][ T5478] shmem 0 [ 131.305863][ T5478] zswap 0 [ 131.305863][ T5478] zswapped 0 [ 131.305863][ T5478] file_mapped 0 [ 131.305863][ T5478] file_dirty 0 [ 131.305863][ T5478] file_writeback 0 [ 131.305863][ T5478] swapcached 0 [ 131.305863][ T5478] anon_thp 0 [ 131.305863][ T5478] file_thp 0 [ 131.305863][ T5478] shmem_thp 0 [ 131.305863][ T5478] inactive_anon 0 [ 131.305863][ T5478] active_anon 0 [ 131.305863][ T5478] inactive_file 0 [pid 5492] write(6, "0x000000000000040e", 18 [pid 5473] close(8) = -1 EBADF (Bad file descriptor) [pid 5473] close(9) = -1 EBADF (Bad file descriptor) [pid 5473] close(10) = -1 EBADF (Bad file descriptor) [pid 5473] close(11) = -1 EBADF (Bad file descriptor) [pid 5473] close(12) = -1 EBADF (Bad file descriptor) [pid 5473] close(13) = -1 EBADF (Bad file descriptor) [pid 5473] close(14) = -1 EBADF (Bad file descriptor) [pid 5473] close(15) = -1 EBADF (Bad file descriptor) [pid 5473] close(16) = -1 EBADF (Bad file descriptor) [pid 5473] close(17) = -1 EBADF (Bad file descriptor) [pid 5473] close(18) = -1 EBADF (Bad file descriptor) [pid 5473] close(19) = -1 EBADF (Bad file descriptor) [pid 5473] close(20) = -1 EBADF (Bad file descriptor) [pid 5473] close(21) = -1 EBADF (Bad file descriptor) [pid 5473] close(22) = -1 EBADF (Bad file descriptor) [pid 5473] close(23) = -1 EBADF (Bad file descriptor) [pid 5473] close(24) = -1 EBADF (Bad file descriptor) [pid 5473] close(25) = -1 EBADF (Bad file descriptor) [pid 5473] close(26) = -1 EBADF (Bad file descriptor) [pid 5473] close(27) = -1 EBADF (Bad file descriptor) [pid 5473] close(28) = -1 EBADF (Bad file descriptor) [ 131.305863][ T5478] active_file 0 [ 131.305863][ T5478] unevictable 0 [ 131.305863][ T5478] slab_reclaimable 6752 [ 131.305863][ T5478] slab_unreclaimable 0 [ 131.305863][ T5478] slab 6752 [ 131.305863][ T5478] workingset_refault_anon 0 [ 131.406492][ T5478] Tasks state (memory values in pages): [ 131.412362][ T5478] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5473] close(29 [pid 5478] <... write resumed>) = 18 [pid 5478] close(3) = 0 [pid 5478] close(4) = 0 [pid 5478] close(5) = 0 [pid 5478] close(6 [pid 5473] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5473] exit_group(0) = ? [pid 5473] +++ exited with 0 +++ [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=25, si_uid=0, si_status=0, si_utime=0, si_stime=7 /* 0.07 s */} --- [pid 5074] umount2("./23", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] openat(AT_FDCWD, "./23", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [ 131.447456][ T5478] Out of memory and no killable processes... [ 131.454045][ T5482] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 131.468121][ T5482] CPU: 1 PID: 5482 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 131.478604][ T5482] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 131.488701][ T5482] Call Trace: [ 131.492026][ T5482] [pid 5074] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5074] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5074] umount2("./23/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./23/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5074] unlink("./23/binderfs") = 0 [pid 5074] umount2("./23/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./23/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5074] unlink("./23/cgroup") = 0 [pid 5074] umount2("./23/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./23/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5074] unlink("./23/cgroup.net") = 0 [ 131.494994][ T5482] dump_stack_lvl+0x1e7/0x2d0 [ 131.499744][ T5482] ? nf_tcp_handle_invalid+0x640/0x640 [ 131.505351][ T5482] ? panic+0x770/0x770 [ 131.509482][ T5482] dump_header+0xdc/0x940 [ 131.513866][ T5482] out_of_memory+0xf21/0x12c0 [ 131.518604][ T5482] ? mutex_lock_io_nested+0x60/0x60 [ 131.523872][ T5482] ? mark_lock+0x9a/0x340 [ 131.528256][ T5482] ? unregister_oom_notifier+0x20/0x20 [ 131.533761][ T5482] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 131.539811][ T5482] mem_cgroup_out_of_memory+0x263/0x3b0 [ 131.545432][ T5482] ? mem_cgroup_oom_trylock+0x210/0x210 [ 131.551054][ T5482] ? cgroup_file_notify+0x127/0x190 [ 131.556319][ T5482] memory_max_write+0x355/0x470 [ 131.561229][ T5482] ? memory_max_show+0xa0/0xa0 [ 131.566055][ T5482] ? read_lock_is_recursive+0x20/0x20 [ 131.571484][ T5482] ? memory_max_show+0xa0/0xa0 [ 131.576293][ T5482] cgroup_file_write+0x2b1/0x780 [ 131.581277][ T5482] ? cgroup_seqfile_stop+0xd0/0xd0 [ 131.586514][ T5482] ? __virt_addr_valid+0x22f/0x2e0 [ 131.591696][ T5482] ? cgroup_seqfile_stop+0xd0/0xd0 [ 131.596849][ T5482] kernfs_fop_write_iter+0x3a6/0x4f0 [ 131.602195][ T5482] vfs_write+0x7b2/0xbb0 [ 131.606500][ T5482] ? file_end_write+0x240/0x240 [ 131.611400][ T5482] ? do_raw_spin_unlock+0x13b/0x8b0 [ 131.616644][ T5482] ? lockdep_hardirqs_on+0x98/0x140 [ 131.621905][ T5482] ? __fdget_pos+0x265/0x2f0 [ 131.626546][ T5482] ksys_write+0x1a0/0x2c0 [ 131.630928][ T5482] ? __ia32_sys_read+0x90/0x90 [ 131.635736][ T5482] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 131.641782][ T5482] ? syscall_enter_from_user_mode+0x8c/0x2c0 [pid 5074] umount2("./23/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5478] <... close resumed>) = 0 [pid 5478] close(7) = -1 EBADF (Bad file descriptor) [ 131.647831][ T5482] do_syscall_64+0x41/0xc0 [ 131.652292][ T5482] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 131.658244][ T5482] RIP: 0033:0x7fd49ce20129 [ 131.662699][ T5482] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 131.682445][ T5482] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 5478] close(8) = -1 EBADF (Bad file descriptor) [pid 5478] close(9) = -1 EBADF (Bad file descriptor) [pid 5478] close(10) = -1 EBADF (Bad file descriptor) [pid 5478] close(11) = -1 EBADF (Bad file descriptor) [pid 5478] close(12) = -1 EBADF (Bad file descriptor) [pid 5478] close(13) = -1 EBADF (Bad file descriptor) [pid 5478] close(14) = -1 EBADF (Bad file descriptor) [pid 5478] close(15) = -1 EBADF (Bad file descriptor) [pid 5478] close(16) = -1 EBADF (Bad file descriptor) [pid 5478] close(17) = -1 EBADF (Bad file descriptor) [pid 5478] close(18) = -1 EBADF (Bad file descriptor) [pid 5478] close(19) = -1 EBADF (Bad file descriptor) [pid 5478] close(20) = -1 EBADF (Bad file descriptor) [pid 5478] close(21) = -1 EBADF (Bad file descriptor) [pid 5478] close(22) = -1 EBADF (Bad file descriptor) [pid 5478] close(23) = -1 EBADF (Bad file descriptor) [pid 5478] close(24) = -1 EBADF (Bad file descriptor) [pid 5478] close(25) = -1 EBADF (Bad file descriptor) [pid 5478] close(26) = -1 EBADF (Bad file descriptor) [pid 5478] close(27) = -1 EBADF (Bad file descriptor) [pid 5478] close(28) = -1 EBADF (Bad file descriptor) [pid 5478] close(29) = -1 EBADF (Bad file descriptor) [pid 5478] exit_group(0) = ? [pid 5478] +++ exited with 0 +++ [pid 5074] <... umount2 resumed>) = 0 [pid 5074] umount2("./23/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./23/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5074] umount2("./23/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] openat(AT_FDCWD, "./23/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5074] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5074] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5074] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5074] close(4) = 0 [ 131.690917][ T5482] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 131.698936][ T5482] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 131.706957][ T5482] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 131.714982][ T5482] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 131.723014][ T5482] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000010 [ 131.731048][ T5482] [pid 5074] rmdir("./23/file0") = 0 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=24, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- [pid 5074] umount2("./23/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./23/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5074] unlink("./23/cgroup.cpu") = 0 [pid 5074] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5074] close(3) = 0 [pid 5074] rmdir("./23") = 0 [pid 5074] mkdir("./24", 0777) = 0 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555574ac5d0) = 26 [ 131.743752][ T5482] memory: usage 8kB, limit 0kB, failcnt 55 [ 131.750317][ T5482] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 131.758163][ T5482] Memory cgroup stats for /syz1: [ 131.758363][ T5482] anon 0 [ 131.758363][ T5482] file 0 [ 131.758363][ T5482] kernel 8192 [ 131.758363][ T5482] kernel_stack 0 [ 131.758363][ T5482] pagetables 0 [ 131.758363][ T5482] sec_pagetables 0 [ 131.758363][ T5482] percpu 0 [ 131.758363][ T5482] sock 0 [ 131.758363][ T5482] vmalloc 0 [ 131.758363][ T5482] shmem 0 [ 131.758363][ T5482] zswap 0 [ 131.758363][ T5482] zswapped 0 [ 131.758363][ T5482] file_mapped 0 [ 131.758363][ T5482] file_dirty 0 [ 131.758363][ T5482] file_writeback 0 [ 131.758363][ T5482] swapcached 0 [ 131.758363][ T5482] anon_thp 0 [ 131.758363][ T5482] file_thp 0 [ 131.758363][ T5482] shmem_thp 0 [ 131.758363][ T5482] inactive_anon 0 [ 131.758363][ T5482] active_anon 0 [ 131.758363][ T5482] inactive_file 0 [ 131.758363][ T5482] active_file 0 [ 131.758363][ T5482] unevictable 0 [ 131.758363][ T5482] slab_reclaimable 6752 [ 131.758363][ T5482] slab_unreclaimable 0 ./strace-static-x86_64: Process 5500 attached [pid 5075] umount2("./22", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5500] chdir("./24" [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5500] <... chdir resumed>) = 0 [pid 5075] openat(AT_FDCWD, "./22", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5500] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5075] <... openat resumed>) = 3 [pid 5500] <... prctl resumed>) = 0 [pid 5075] fstat(3, [pid 5500] setpgid(0, 0 [pid 5075] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5482] <... write resumed>) = 18 [ 131.758363][ T5482] slab 6752 [ 131.758363][ T5482] workingset_refault_anon 0 [ 131.861194][ T5482] Tasks state (memory values in pages): [ 131.867172][ T5482] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 131.878002][ T5482] Out of memory and no killable processes... [ 131.884483][ T5488] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 131.895905][ T5488] CPU: 1 PID: 5488 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 131.906382][ T5488] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 131.916482][ T5488] Call Trace: [ 131.919806][ T5488] [ 131.922774][ T5488] dump_stack_lvl+0x1e7/0x2d0 [ 131.927509][ T5488] ? nf_tcp_handle_invalid+0x640/0x640 [ 131.933023][ T5488] ? panic+0x770/0x770 [ 131.937162][ T5488] dump_header+0xdc/0x940 [ 131.941552][ T5488] out_of_memory+0xf21/0x12c0 [ 131.946287][ T5488] ? mutex_lock_io_nested+0x60/0x60 [ 131.951558][ T5488] ? mark_lock+0x9a/0x340 [ 131.955946][ T5488] ? unregister_oom_notifier+0x20/0x20 [ 131.961459][ T5488] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 131.967552][ T5488] mem_cgroup_out_of_memory+0x263/0x3b0 [ 131.973182][ T5488] ? mem_cgroup_oom_trylock+0x210/0x210 [ 131.978812][ T5488] ? cgroup_file_notify+0x127/0x190 [ 131.984078][ T5488] memory_max_write+0x355/0x470 [ 131.988996][ T5488] ? memory_max_show+0xa0/0xa0 [ 131.993816][ T5488] ? read_lock_is_recursive+0x20/0x20 [ 131.999251][ T5488] ? memory_max_show+0xa0/0xa0 [ 132.004074][ T5488] cgroup_file_write+0x2b1/0x780 [ 132.009074][ T5488] ? cgroup_seqfile_stop+0xd0/0xd0 [ 132.014239][ T5488] ? __virt_addr_valid+0x22f/0x2e0 [ 132.019445][ T5488] ? cgroup_seqfile_stop+0xd0/0xd0 [ 132.024601][ T5488] kernfs_fop_write_iter+0x3a6/0x4f0 [ 132.029939][ T5488] vfs_write+0x7b2/0xbb0 [ 132.034214][ T5488] ? file_end_write+0x240/0x240 [ 132.039089][ T5488] ? do_raw_spin_unlock+0x13b/0x8b0 [ 132.044311][ T5488] ? lockdep_hardirqs_on+0x98/0x140 [ 132.049536][ T5488] ? __fdget_pos+0x265/0x2f0 [ 132.054667][ T5488] ksys_write+0x1a0/0x2c0 [ 132.059021][ T5488] ? __ia32_sys_read+0x90/0x90 [ 132.063801][ T5488] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 132.069818][ T5488] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 132.075851][ T5488] do_syscall_64+0x41/0xc0 [ 132.080328][ T5488] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 132.086265][ T5488] RIP: 0033:0x7fd49ce20129 [ 132.090707][ T5488] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 132.110337][ T5488] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 132.118932][ T5488] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 132.126931][ T5488] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 132.134929][ T5488] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [pid 5500] <... setpgid resumed>) = 0 [pid 5482] close(3 [pid 5075] getdents64(3, [pid 5500] symlink("/syzcgroup/unified/syz3", "./cgroup" [pid 5482] <... close resumed>) = 0 [pid 5075] <... getdents64 resumed>0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5500] <... symlink resumed>) = 0 [pid 5482] close(4 [pid 5075] umount2("./22/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5500] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu" [pid 5482] <... close resumed>) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5500] <... symlink resumed>) = 0 [pid 5482] close(5 [pid 5075] lstat("./22/binderfs", [pid 5500] symlink("/syzcgroup/net/syz3", "./cgroup.net" [pid 5482] <... close resumed>) = 0 [pid 5075] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5500] <... symlink resumed>) = 0 [pid 5482] close(6 [pid 5075] unlink("./22/binderfs" [pid 5500] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5482] <... close resumed>) = 0 [pid 5075] <... unlink resumed>) = 0 [pid 5500] <... openat resumed>) = 3 [pid 5482] close(7 [pid 5075] umount2("./22/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5500] write(3, "1000", 4 [pid 5482] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5500] <... write resumed>) = 4 [pid 5482] close(8 [pid 5075] lstat("./22/cgroup", [pid 5500] close(3 [pid 5482] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5500] <... close resumed>) = 0 [pid 5482] close(9 [pid 5075] unlink("./22/cgroup" [pid 5500] symlink("/dev/binderfs", "./binderfs" [pid 5482] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... unlink resumed>) = 0 [pid 5500] <... symlink resumed>) = 0 [pid 5482] close(10 [pid 5075] umount2("./22/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5500] mkdir("./file0", 000 [pid 5482] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5500] <... mkdir resumed>) = 0 [pid 5482] close(11 [pid 5075] lstat("./22/cgroup.net", [pid 5500] open("./file0", O_RDONLY [pid 5482] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5500] <... open resumed>) = 3 [pid 5482] close(12 [pid 5075] unlink("./22/cgroup.net" [pid 5500] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5482] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... unlink resumed>) = 0 [pid 5500] <... mount resumed>) = 0 [pid 5482] close(13 [pid 5075] umount2("./22/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5500] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5482] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... umount2 resumed>) = 0 [pid 5500] <... openat resumed>) = 4 [pid 5482] close(14 [pid 5075] umount2("./22/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5500] openat(4, "syz1", O_RDWR|O_PATH [pid 5482] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5500] <... openat resumed>) = 5 [pid 5482] close(15 [pid 5075] lstat("./22/file0", [pid 5500] openat(5, "memory.max", O_RDWR [pid 5482] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5500] <... openat resumed>) = 6 [pid 5482] close(16 [pid 5075] umount2("./22/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5500] write(6, "0x000000000000040e", 18 [pid 5482] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5482] close(17 [pid 5075] openat(AT_FDCWD, "./22/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5482] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... openat resumed>) = 4 [pid 5482] close(18 [pid 5075] fstat(4, [pid 5482] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5482] close(19 [pid 5075] getdents64(4, [pid 5482] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... getdents64 resumed>0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5482] close(20 [pid 5075] getdents64(4, [pid 5482] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... getdents64 resumed>0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5482] close(21 [pid 5075] close(4 [pid 5482] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... close resumed>) = 0 [pid 5482] close(22 [pid 5075] rmdir("./22/file0" [pid 5482] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... rmdir resumed>) = 0 [pid 5482] close(23 [pid 5075] umount2("./22/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5482] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5482] close(24 [ 132.142916][ T5488] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 132.150903][ T5488] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000011 [ 132.158923][ T5488] [pid 5075] lstat("./22/cgroup.cpu", [pid 5482] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5482] close(25 [pid 5075] unlink("./22/cgroup.cpu" [pid 5482] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... unlink resumed>) = 0 [pid 5482] close(26 [pid 5075] getdents64(3, [pid 5482] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... getdents64 resumed>0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5482] close(27 [pid 5075] close(3 [pid 5482] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... close resumed>) = 0 [pid 5482] close(28 [pid 5075] rmdir("./22" [pid 5482] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... rmdir resumed>) = 0 [pid 5482] close(29 [pid 5075] mkdir("./23", 0777 [pid 5482] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... mkdir resumed>) = 0 [pid 5482] exit_group(0 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5502 attached [pid 5482] <... exit_group resumed>) = ? [pid 5502] chdir("./23" [pid 5482] +++ exited with 0 +++ [pid 5075] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 25 [pid 5502] <... chdir resumed>) = 0 [pid 5502] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5070] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=18, si_uid=0, si_status=0, si_utime=0, si_stime=7 /* 0.07 s */} --- [pid 5502] setpgid(0, 0) = 0 [pid 5070] umount2("./16", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5502] symlink("/syzcgroup/unified/syz2", "./cgroup" [pid 5070] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5502] <... symlink resumed>) = 0 [pid 5070] openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5502] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 5070] <... openat resumed>) = 3 [pid 5502] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 5070] fstat(3, [pid 5502] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5070] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5502] write(3, "1000", 4 [pid 5070] getdents64(3, [pid 5502] <... write resumed>) = 4 [pid 5502] close(3) = 0 [pid 5070] <... getdents64 resumed>0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5502] symlink("/dev/binderfs", "./binderfs" [pid 5070] umount2("./16/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5502] <... symlink resumed>) = 0 [pid 5502] mkdir("./file0", 000 [pid 5070] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5502] <... mkdir resumed>) = 0 [pid 5070] lstat("./16/binderfs", [pid 5502] open("./file0", O_RDONLY) = 3 [pid 5070] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5502] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5070] unlink("./16/binderfs" [pid 5502] <... mount resumed>) = 0 [pid 5502] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5070] <... unlink resumed>) = 0 [pid 5502] <... openat resumed>) = 4 [pid 5070] umount2("./16/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5502] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5070] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5502] openat(5, "memory.max", O_RDWR [pid 5070] lstat("./16/cgroup", [pid 5502] <... openat resumed>) = 6 [pid 5502] write(6, "0x000000000000040e", 18 [pid 5070] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5070] unlink("./16/cgroup") = 0 [pid 5070] umount2("./16/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./16/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5070] unlink("./16/cgroup.net") = 0 [pid 5070] umount2("./16/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5070] umount2("./16/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./16/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5070] umount2("./16/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] openat(AT_FDCWD, "./16/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5070] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5070] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5070] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5070] close(4) = 0 [ 132.258569][ T5488] memory: usage 8kB, limit 0kB, failcnt 55 [ 132.270833][ T5488] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 132.280717][ T5488] Memory cgroup stats for /syz1: [ 132.286139][ T5488] anon 0 [ 132.286139][ T5488] file 0 [ 132.286139][ T5488] kernel 8192 [ 132.286139][ T5488] kernel_stack 0 [ 132.286139][ T5488] pagetables 0 [ 132.286139][ T5488] sec_pagetables 0 [ 132.286139][ T5488] percpu 0 [ 132.286139][ T5488] sock 0 [ 132.286139][ T5488] vmalloc 0 [ 132.286139][ T5488] shmem 0 [ 132.286139][ T5488] zswap 0 [ 132.286139][ T5488] zswapped 0 [ 132.286139][ T5488] file_mapped 0 [ 132.286139][ T5488] file_dirty 0 [ 132.286139][ T5488] file_writeback 0 [ 132.286139][ T5488] swapcached 0 [ 132.286139][ T5488] anon_thp 0 [ 132.286139][ T5488] file_thp 0 [ 132.286139][ T5488] shmem_thp 0 [ 132.286139][ T5488] inactive_anon 0 [ 132.286139][ T5488] active_anon 0 [pid 5070] rmdir("./16/file0") = 0 [pid 5070] umount2("./16/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./16/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5070] unlink("./16/cgroup.cpu") = 0 [pid 5070] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5070] close(3) = 0 [pid 5070] rmdir("./16") = 0 [pid 5070] mkdir("./17", 0777) = 0 [ 132.286139][ T5488] inactive_file 0 [ 132.286139][ T5488] active_file 0 [ 132.286139][ T5488] unevictable 0 [ 132.286139][ T5488] slab_reclaimable 6752 [ 132.286139][ T5488] slab_unreclaimable 0 [ 132.286139][ T5488] slab 6752 [ 132.286139][ T5488] workingset_refault_anon 0 [ 132.389146][ T5488] Tasks state (memory values in pages): [ 132.397018][ T5488] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5070] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5503 attached [pid 5503] chdir("./17" [pid 5070] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 19 [pid 5503] <... chdir resumed>) = 0 [pid 5503] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5503] setpgid(0, 0) = 0 [pid 5503] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 5503] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 5503] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 5503] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5503] write(3, "1000", 4) = 4 [pid 5503] close(3) = 0 [pid 5503] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5503] mkdir("./file0", 000) = 0 [pid 5503] open("./file0", O_RDONLY) = 3 [pid 5503] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5503] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5503] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5503] openat(5, "memory.max", O_RDWR) = 6 [pid 5503] write(6, "0x000000000000040e", 18 [pid 5488] <... write resumed>) = 18 [pid 5488] close(3) = 0 [pid 5488] close(4) = 0 [pid 5488] close(5) = 0 [pid 5488] close(6) = 0 [pid 5488] close(7) = -1 EBADF (Bad file descriptor) [pid 5488] close(8) = -1 EBADF (Bad file descriptor) [pid 5488] close(9) = -1 EBADF (Bad file descriptor) [pid 5488] close(10) = -1 EBADF (Bad file descriptor) [pid 5488] close(11) = -1 EBADF (Bad file descriptor) [pid 5488] close(12) = -1 EBADF (Bad file descriptor) [pid 5488] close(13) = -1 EBADF (Bad file descriptor) [ 132.408763][ T5488] Out of memory and no killable processes... [ 132.444813][ T5492] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 132.469916][ T5492] CPU: 1 PID: 5492 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 132.480423][ T5492] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 132.490520][ T5492] Call Trace: [ 132.493830][ T5492] [ 132.496790][ T5492] dump_stack_lvl+0x1e7/0x2d0 [ 132.501531][ T5492] ? nf_tcp_handle_invalid+0x640/0x640 [ 132.507041][ T5492] ? panic+0x770/0x770 [ 132.511169][ T5492] dump_header+0xdc/0x940 [ 132.515548][ T5492] out_of_memory+0xf21/0x12c0 [ 132.520296][ T5492] ? mutex_lock_io_nested+0x60/0x60 [ 132.525560][ T5492] ? preempt_schedule+0xdd/0xf0 [ 132.530456][ T5492] ? unregister_oom_notifier+0x20/0x20 [ 132.535959][ T5492] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 132.542002][ T5492] mem_cgroup_out_of_memory+0x263/0x3b0 [ 132.547598][ T5492] ? preempt_schedule_thunk+0x1a/0x20 [ 132.553016][ T5492] ? mem_cgroup_oom_trylock+0x210/0x210 [ 132.558628][ T5492] ? cgroup_file_notify+0x127/0x190 [ 132.563879][ T5492] memory_max_write+0x355/0x470 [ 132.568790][ T5492] ? memory_max_show+0xa0/0xa0 [ 132.573608][ T5492] ? read_lock_is_recursive+0x20/0x20 [ 132.579017][ T5492] ? memory_max_show+0xa0/0xa0 [ 132.583799][ T5492] cgroup_file_write+0x2b1/0x780 [ 132.588760][ T5492] ? cgroup_seqfile_stop+0xd0/0xd0 [ 132.593886][ T5492] ? __virt_addr_valid+0x22f/0x2e0 [ 132.599030][ T5492] ? cgroup_seqfile_stop+0xd0/0xd0 [ 132.604152][ T5492] kernfs_fop_write_iter+0x3a6/0x4f0 [ 132.609461][ T5492] vfs_write+0x7b2/0xbb0 [ 132.613731][ T5492] ? file_end_write+0x240/0x240 [ 132.618600][ T5492] ? do_raw_spin_unlock+0x13b/0x8b0 [ 132.623815][ T5492] ? lockdep_hardirqs_on+0x98/0x140 [ 132.629038][ T5492] ? __fdget_pos+0x265/0x2f0 [ 132.633646][ T5492] ksys_write+0x1a0/0x2c0 [ 132.637996][ T5492] ? __ia32_sys_read+0x90/0x90 [ 132.642774][ T5492] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 132.648778][ T5492] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 132.654783][ T5492] do_syscall_64+0x41/0xc0 [ 132.659220][ T5492] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 132.665135][ T5492] RIP: 0033:0x7fd49ce20129 [ 132.669566][ T5492] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 132.689182][ T5492] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 132.697613][ T5492] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 132.705596][ T5492] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [pid 5488] close(14) = -1 EBADF (Bad file descriptor) [pid 5488] close(15) = -1 EBADF (Bad file descriptor) [pid 5488] close(16) = -1 EBADF (Bad file descriptor) [pid 5488] close(17) = -1 EBADF (Bad file descriptor) [pid 5488] close(18) = -1 EBADF (Bad file descriptor) [pid 5488] close(19) = -1 EBADF (Bad file descriptor) [pid 5488] close(20) = -1 EBADF (Bad file descriptor) [pid 5488] close(21) = -1 EBADF (Bad file descriptor) [pid 5488] close(22) = -1 EBADF (Bad file descriptor) [pid 5488] close(23) = -1 EBADF (Bad file descriptor) [pid 5488] close(24) = -1 EBADF (Bad file descriptor) [pid 5488] close(25) = -1 EBADF (Bad file descriptor) [pid 5488] close(26) = -1 EBADF (Bad file descriptor) [pid 5488] close(27) = -1 EBADF (Bad file descriptor) [pid 5488] close(28) = -1 EBADF (Bad file descriptor) [pid 5488] close(29) = -1 EBADF (Bad file descriptor) [pid 5488] exit_group(0) = ? [pid 5488] +++ exited with 0 +++ [pid 5072] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=19, si_uid=0, si_status=0, si_utime=0, si_stime=6 /* 0.06 s */} --- [ 132.713578][ T5492] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 132.721575][ T5492] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 132.729570][ T5492] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000014 [ 132.737592][ T5492] [pid 5072] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5072] umount2("./17", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5072] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5072] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5072] umount2("./17/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./17/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5072] unlink("./17/binderfs") = 0 [pid 5072] umount2("./17/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./17/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5072] unlink("./17/cgroup") = 0 [pid 5072] umount2("./17/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./17/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5072] unlink("./17/cgroup.net") = 0 [pid 5072] umount2("./17/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5072] umount2("./17/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./17/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5072] umount2("./17/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] openat(AT_FDCWD, "./17/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5072] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5072] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5072] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5072] close(4) = 0 [pid 5072] rmdir("./17/file0") = 0 [pid 5072] umount2("./17/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./17/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5072] unlink("./17/cgroup.cpu") = 0 [pid 5072] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5072] close(3) = 0 [ 132.774011][ T5492] memory: usage 8kB, limit 0kB, failcnt 55 [ 132.780757][ T5492] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 132.812524][ T5492] Memory cgroup stats for /syz1: [ 132.812734][ T5492] anon 0 [ 132.812734][ T5492] file 0 [ 132.812734][ T5492] kernel 8192 [ 132.812734][ T5492] kernel_stack 0 [ 132.812734][ T5492] pagetables 0 [ 132.812734][ T5492] sec_pagetables 0 [ 132.812734][ T5492] percpu 0 [ 132.812734][ T5492] sock 0 [ 132.812734][ T5492] vmalloc 0 [ 132.812734][ T5492] shmem 0 [ 132.812734][ T5492] zswap 0 [ 132.812734][ T5492] zswapped 0 [ 132.812734][ T5492] file_mapped 0 [ 132.812734][ T5492] file_dirty 0 [ 132.812734][ T5492] file_writeback 0 [ 132.812734][ T5492] swapcached 0 [ 132.812734][ T5492] anon_thp 0 [ 132.812734][ T5492] file_thp 0 [pid 5072] rmdir("./17") = 0 [pid 5072] mkdir("./18", 0777) = 0 [pid 5072] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5509 attached , child_tidptr=0x5555574ac5d0) = 20 [pid 5509] chdir("./18") = 0 [ 132.812734][ T5492] shmem_thp 0 [ 132.812734][ T5492] inactive_anon 0 [ 132.812734][ T5492] active_anon 0 [ 132.812734][ T5492] inactive_file 0 [ 132.812734][ T5492] active_file 0 [ 132.812734][ T5492] unevictable 0 [ 132.812734][ T5492] slab_reclaimable 6752 [ 132.812734][ T5492] slab_unreclaimable 0 [ 132.812734][ T5492] slab 6752 [ 132.812734][ T5492] workingset_refault_anon 0 [pid 5509] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5509] setpgid(0, 0) = 0 [pid 5509] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 5509] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [pid 5509] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 5492] <... write resumed>) = 18 [pid 5509] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5492] close(3 [pid 5509] write(3, "1000", 4) = 4 [pid 5509] close(3) = 0 [pid 5509] symlink("/dev/binderfs", "./binderfs" [pid 5492] <... close resumed>) = 0 [pid 5509] <... symlink resumed>) = 0 [pid 5492] close(4 [pid 5509] mkdir("./file0", 000 [pid 5492] <... close resumed>) = 0 [pid 5492] close(5) = 0 [pid 5492] close(6) = 0 [pid 5509] <... mkdir resumed>) = 0 [pid 5492] close(7 [pid 5509] open("./file0", O_RDONLY [pid 5492] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5509] <... open resumed>) = 3 [pid 5492] close(8 [pid 5509] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5492] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5492] close(9) = -1 EBADF (Bad file descriptor) [pid 5509] <... mount resumed>) = 0 [pid 5492] close(10 [pid 5509] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5492] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5509] <... openat resumed>) = 4 [pid 5492] close(11) = -1 EBADF (Bad file descriptor) [pid 5509] openat(4, "syz1", O_RDWR|O_PATH [pid 5492] close(12) = -1 EBADF (Bad file descriptor) [pid 5492] close(13) = -1 EBADF (Bad file descriptor) [pid 5509] <... openat resumed>) = 5 [pid 5492] close(14 [pid 5509] openat(5, "memory.max", O_RDWR [pid 5492] <... close resumed>) = -1 EBADF (Bad file descriptor) [ 132.922317][ T5492] Tasks state (memory values in pages): [ 132.929722][ T5492] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 132.942493][ T5492] Out of memory and no killable processes... [ 132.951313][ T5500] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5509] <... openat resumed>) = 6 [pid 5492] close(15 [ 132.981796][ T5500] CPU: 1 PID: 5500 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 132.992290][ T5500] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 133.002388][ T5500] Call Trace: [ 133.005699][ T5500] [ 133.008665][ T5500] dump_stack_lvl+0x1e7/0x2d0 [ 133.013400][ T5500] ? nf_tcp_handle_invalid+0x640/0x640 [ 133.018907][ T5500] ? panic+0x770/0x770 [ 133.023041][ T5500] dump_header+0xdc/0x940 [ 133.027421][ T5500] out_of_memory+0xf21/0x12c0 [pid 5509] write(6, "0x000000000000040e", 18 [pid 5492] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5492] close(16) = -1 EBADF (Bad file descriptor) [pid 5492] close(17) = -1 EBADF (Bad file descriptor) [pid 5492] close(18) = -1 EBADF (Bad file descriptor) [pid 5492] close(19) = -1 EBADF (Bad file descriptor) [pid 5492] close(20) = -1 EBADF (Bad file descriptor) [pid 5492] close(21) = -1 EBADF (Bad file descriptor) [pid 5492] close(22) = -1 EBADF (Bad file descriptor) [pid 5492] close(23) = -1 EBADF (Bad file descriptor) [pid 5492] close(24) = -1 EBADF (Bad file descriptor) [pid 5492] close(25) = -1 EBADF (Bad file descriptor) [pid 5492] close(26) = -1 EBADF (Bad file descriptor) [pid 5492] close(27) = -1 EBADF (Bad file descriptor) [ 133.032151][ T5500] ? mutex_lock_io_nested+0x60/0x60 [ 133.037407][ T5500] ? mark_lock+0x9a/0x340 [ 133.041787][ T5500] ? unregister_oom_notifier+0x20/0x20 [ 133.047294][ T5500] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 133.053341][ T5500] mem_cgroup_out_of_memory+0x263/0x3b0 [ 133.058951][ T5500] ? mem_cgroup_oom_trylock+0x210/0x210 [ 133.064575][ T5500] ? cgroup_file_notify+0x127/0x190 [ 133.069837][ T5500] memory_max_write+0x355/0x470 [ 133.074773][ T5500] ? memory_max_show+0xa0/0xa0 [pid 5492] close(28) = -1 EBADF (Bad file descriptor) [pid 5492] close(29) = -1 EBADF (Bad file descriptor) [pid 5492] exit_group(0) = ? [pid 5492] +++ exited with 0 +++ [pid 5073] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=22, si_uid=0, si_status=0, si_utime=0, si_stime=10 /* 0.10 s */} --- [pid 5073] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5073] umount2("./20", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] openat(AT_FDCWD, "./20", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5073] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [ 133.079588][ T5500] ? read_lock_is_recursive+0x20/0x20 [ 133.085018][ T5500] ? memory_max_show+0xa0/0xa0 [ 133.089821][ T5500] cgroup_file_write+0x2b1/0x780 [ 133.094806][ T5500] ? cgroup_seqfile_stop+0xd0/0xd0 [ 133.099966][ T5500] ? __virt_addr_valid+0x22f/0x2e0 [ 133.105149][ T5500] ? cgroup_seqfile_stop+0xd0/0xd0 [ 133.110313][ T5500] kernfs_fop_write_iter+0x3a6/0x4f0 [ 133.115660][ T5500] vfs_write+0x7b2/0xbb0 [ 133.119969][ T5500] ? file_end_write+0x240/0x240 [ 133.124873][ T5500] ? do_raw_spin_unlock+0x13b/0x8b0 [ 133.130103][ T5500] ? lockdep_hardirqs_on+0x98/0x140 [ 133.135328][ T5500] ? __fdget_pos+0x265/0x2f0 [ 133.139940][ T5500] ksys_write+0x1a0/0x2c0 [ 133.144296][ T5500] ? __ia32_sys_read+0x90/0x90 [ 133.149075][ T5500] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 133.155079][ T5500] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 133.161087][ T5500] do_syscall_64+0x41/0xc0 [ 133.165523][ T5500] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 133.171459][ T5500] RIP: 0033:0x7fd49ce20129 [ 133.175893][ T5500] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 133.195531][ T5500] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 133.203970][ T5500] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 133.211953][ T5500] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 133.219936][ T5500] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [pid 5073] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5073] umount2("./20/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./20/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5073] unlink("./20/binderfs") = 0 [pid 5073] umount2("./20/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./20/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5073] unlink("./20/cgroup") = 0 [pid 5073] umount2("./20/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./20/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5073] unlink("./20/cgroup.net") = 0 [pid 5073] umount2("./20/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5073] umount2("./20/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./20/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5073] umount2("./20/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] openat(AT_FDCWD, "./20/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5073] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5073] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5073] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5073] close(4) = 0 [pid 5073] rmdir("./20/file0") = 0 [pid 5073] umount2("./20/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./20/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5073] unlink("./20/cgroup.cpu") = 0 [pid 5073] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5073] close(3) = 0 [pid 5073] rmdir("./20") = 0 [pid 5073] mkdir("./21", 0777) = 0 [pid 5073] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5512 attached , child_tidptr=0x5555574ac5d0) = 23 [pid 5512] chdir("./21") = 0 [pid 5512] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5512] setpgid(0, 0) = 0 [ 133.227943][ T5500] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 133.235955][ T5500] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000018 [ 133.243967][ T5500] [pid 5512] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 5512] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 5512] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [pid 5512] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5512] write(3, "1000", 4) = 4 [pid 5512] close(3) = 0 [pid 5512] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5512] mkdir("./file0", 000) = 0 [pid 5512] open("./file0", O_RDONLY) = 3 [pid 5512] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5512] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5512] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5512] openat(5, "memory.max", O_RDWR) = 6 [ 133.346636][ T5500] memory: usage 8kB, limit 0kB, failcnt 55 [ 133.352543][ T5500] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 133.372043][ T5500] Memory cgroup stats for /syz1: [ 133.372222][ T5500] anon 0 [ 133.372222][ T5500] file 0 [ 133.372222][ T5500] kernel 8192 [ 133.372222][ T5500] kernel_stack 0 [ 133.372222][ T5500] pagetables 0 [ 133.372222][ T5500] sec_pagetables 0 [ 133.372222][ T5500] percpu 0 [ 133.372222][ T5500] sock 0 [ 133.372222][ T5500] vmalloc 0 [ 133.372222][ T5500] shmem 0 [ 133.372222][ T5500] zswap 0 [ 133.372222][ T5500] zswapped 0 [ 133.372222][ T5500] file_mapped 0 [ 133.372222][ T5500] file_dirty 0 [ 133.372222][ T5500] file_writeback 0 [ 133.372222][ T5500] swapcached 0 [ 133.372222][ T5500] anon_thp 0 [ 133.372222][ T5500] file_thp 0 [ 133.372222][ T5500] shmem_thp 0 [ 133.372222][ T5500] inactive_anon 0 [ 133.372222][ T5500] active_anon 0 [ 133.372222][ T5500] inactive_file 0 [ 133.372222][ T5500] active_file 0 [ 133.372222][ T5500] unevictable 0 [ 133.372222][ T5500] slab_reclaimable 6752 [ 133.372222][ T5500] slab_unreclaimable 0 [ 133.372222][ T5500] slab 6752 [ 133.372222][ T5500] workingset_refault_anon 0 [ 133.481779][ T5500] Tasks state (memory values in pages): [pid 5512] write(6, "0x000000000000040e", 18 [pid 5500] <... write resumed>) = 18 [pid 5500] close(3) = 0 [ 133.497110][ T5500] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 133.516439][ T5500] Out of memory and no killable processes... [ 133.522885][ T5502] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 133.537221][ T5502] CPU: 0 PID: 5502 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 133.547714][ T5502] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 133.557810][ T5502] Call Trace: [ 133.561123][ T5502] [ 133.564087][ T5502] dump_stack_lvl+0x1e7/0x2d0 [ 133.568817][ T5502] ? nf_tcp_handle_invalid+0x640/0x640 [ 133.574326][ T5502] ? panic+0x770/0x770 [ 133.578467][ T5502] dump_header+0xdc/0x940 [ 133.582851][ T5502] out_of_memory+0xf21/0x12c0 [ 133.587586][ T5502] ? mutex_lock_io_nested+0x60/0x60 [ 133.592942][ T5502] ? mark_lock+0x9a/0x340 [pid 5500] close(4) = 0 [pid 5500] close(5) = 0 [pid 5500] close(6) = 0 [pid 5500] close(7) = -1 EBADF (Bad file descriptor) [pid 5500] close(8) = -1 EBADF (Bad file descriptor) [pid 5500] close(9) = -1 EBADF (Bad file descriptor) [pid 5500] close(10) = -1 EBADF (Bad file descriptor) [pid 5500] close(11) = -1 EBADF (Bad file descriptor) [pid 5500] close(12) = -1 EBADF (Bad file descriptor) [pid 5500] close(13) = -1 EBADF (Bad file descriptor) [pid 5500] close(14) = -1 EBADF (Bad file descriptor) [pid 5500] close(15) = -1 EBADF (Bad file descriptor) [pid 5500] close(16) = -1 EBADF (Bad file descriptor) [pid 5500] close(17) = -1 EBADF (Bad file descriptor) [pid 5500] close(18) = -1 EBADF (Bad file descriptor) [pid 5500] close(19) = -1 EBADF (Bad file descriptor) [pid 5500] close(20) = -1 EBADF (Bad file descriptor) [pid 5500] close(21) = -1 EBADF (Bad file descriptor) [pid 5500] close(22) = -1 EBADF (Bad file descriptor) [pid 5500] close(23) = -1 EBADF (Bad file descriptor) [pid 5500] close(24) = -1 EBADF (Bad file descriptor) [pid 5500] close(25) = -1 EBADF (Bad file descriptor) [pid 5500] close(26) = -1 EBADF (Bad file descriptor) [pid 5500] close(27) = -1 EBADF (Bad file descriptor) [pid 5500] close(28) = -1 EBADF (Bad file descriptor) [pid 5500] close(29) = -1 EBADF (Bad file descriptor) [pid 5500] exit_group(0) = ? [pid 5500] +++ exited with 0 +++ [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=26, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- [pid 5074] umount2("./24", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] openat(AT_FDCWD, "./24", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5074] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5074] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5074] umount2("./24/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./24/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5074] unlink("./24/binderfs") = 0 [pid 5074] umount2("./24/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./24/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5074] unlink("./24/cgroup") = 0 [pid 5074] umount2("./24/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./24/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5074] unlink("./24/cgroup.net") = 0 [ 133.597320][ T5502] ? unregister_oom_notifier+0x20/0x20 [ 133.602835][ T5502] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 133.608895][ T5502] mem_cgroup_out_of_memory+0x263/0x3b0 [ 133.614516][ T5502] ? mem_cgroup_oom_trylock+0x210/0x210 [ 133.620133][ T5502] ? cgroup_file_notify+0x127/0x190 [ 133.625406][ T5502] memory_max_write+0x355/0x470 [ 133.630331][ T5502] ? memory_max_show+0xa0/0xa0 [ 133.635152][ T5502] ? read_lock_is_recursive+0x20/0x20 [ 133.640579][ T5502] ? memory_max_show+0xa0/0xa0 [ 133.645398][ T5502] cgroup_file_write+0x2b1/0x780 [ 133.650398][ T5502] ? cgroup_seqfile_stop+0xd0/0xd0 [ 133.655557][ T5502] ? __virt_addr_valid+0x22f/0x2e0 [ 133.660739][ T5502] ? cgroup_seqfile_stop+0xd0/0xd0 [ 133.665897][ T5502] kernfs_fop_write_iter+0x3a6/0x4f0 [ 133.671270][ T5502] vfs_write+0x7b2/0xbb0 [ 133.675573][ T5502] ? file_end_write+0x240/0x240 [ 133.680693][ T5502] ? do_raw_spin_unlock+0x13b/0x8b0 [ 133.685965][ T5502] ? lockdep_hardirqs_on+0x98/0x140 [ 133.691236][ T5502] ? __fdget_pos+0x265/0x2f0 [ 133.695891][ T5502] ksys_write+0x1a0/0x2c0 [ 133.700289][ T5502] ? __ia32_sys_read+0x90/0x90 [ 133.705104][ T5502] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 133.711145][ T5502] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 133.717186][ T5502] do_syscall_64+0x41/0xc0 [ 133.721662][ T5502] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 133.727616][ T5502] RIP: 0033:0x7fd49ce20129 [ 133.732173][ T5502] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 133.751831][ T5502] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 133.760307][ T5502] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 133.768330][ T5502] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 133.776339][ T5502] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 133.784334][ T5502] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [pid 5074] umount2("./24/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5074] umount2("./24/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./24/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5074] umount2("./24/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] openat(AT_FDCWD, "./24/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5074] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5074] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5074] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5074] close(4) = 0 [pid 5074] rmdir("./24/file0") = 0 [pid 5074] umount2("./24/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./24/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5074] unlink("./24/cgroup.cpu") = 0 [pid 5074] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5074] close(3) = 0 [pid 5074] rmdir("./24") = 0 [pid 5074] mkdir("./25", 0777) = 0 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5518 attached [pid 5518] chdir("./25" [pid 5074] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 27 [pid 5518] <... chdir resumed>) = 0 [pid 5518] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [ 133.792321][ T5502] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000017 [ 133.800331][ T5502] [pid 5518] setpgid(0, 0) = 0 [pid 5518] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [pid 5518] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 5518] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 5518] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5518] write(3, "1000", 4) = 4 [pid 5518] close(3) = 0 [pid 5518] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5518] mkdir("./file0", 000) = 0 [pid 5518] open("./file0", O_RDONLY) = 3 [pid 5518] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5518] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5518] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5518] openat(5, "memory.max", O_RDWR) = 6 [ 133.899684][ T5502] memory: usage 8kB, limit 0kB, failcnt 55 [ 133.906843][ T5502] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 133.915363][ T5502] Memory cgroup stats for /syz1: [ 133.915527][ T5502] anon 0 [ 133.915527][ T5502] file 0 [ 133.915527][ T5502] kernel 8192 [ 133.915527][ T5502] kernel_stack 0 [ 133.915527][ T5502] pagetables 0 [ 133.915527][ T5502] sec_pagetables 0 [ 133.915527][ T5502] percpu 0 [ 133.915527][ T5502] sock 0 [ 133.915527][ T5502] vmalloc 0 [ 133.915527][ T5502] shmem 0 [ 133.915527][ T5502] zswap 0 [ 133.915527][ T5502] zswapped 0 [ 133.915527][ T5502] file_mapped 0 [ 133.915527][ T5502] file_dirty 0 [ 133.915527][ T5502] file_writeback 0 [ 133.915527][ T5502] swapcached 0 [ 133.915527][ T5502] anon_thp 0 [ 133.915527][ T5502] file_thp 0 [ 133.915527][ T5502] shmem_thp 0 [ 133.915527][ T5502] inactive_anon 0 [ 133.915527][ T5502] active_anon 0 [ 133.915527][ T5502] inactive_file 0 [ 133.915527][ T5502] active_file 0 [ 133.915527][ T5502] unevictable 0 [ 133.915527][ T5502] slab_reclaimable 6752 [ 133.915527][ T5502] slab_unreclaimable 0 [ 133.915527][ T5502] slab 6752 [ 133.915527][ T5502] workingset_refault_anon 0 [ 134.021766][ T5502] Tasks state (memory values in pages): [ 134.030565][ T5502] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5518] write(6, "0x000000000000040e", 18 [pid 5502] <... write resumed>) = 18 [pid 5502] close(3) = 0 [pid 5502] close(4) = 0 [pid 5502] close(5) = 0 [pid 5502] close(6) = 0 [pid 5502] close(7) = -1 EBADF (Bad file descriptor) [pid 5502] close(8) = -1 EBADF (Bad file descriptor) [pid 5502] close(9) = -1 EBADF (Bad file descriptor) [pid 5502] close(10) = -1 EBADF (Bad file descriptor) [pid 5502] close(11) = -1 EBADF (Bad file descriptor) [pid 5502] close(12) = -1 EBADF (Bad file descriptor) [pid 5502] close(13) = -1 EBADF (Bad file descriptor) [pid 5502] close(14) = -1 EBADF (Bad file descriptor) [pid 5502] close(15) = -1 EBADF (Bad file descriptor) [pid 5502] close(16) = -1 EBADF (Bad file descriptor) [pid 5502] close(17) = -1 EBADF (Bad file descriptor) [pid 5502] close(18) = -1 EBADF (Bad file descriptor) [pid 5502] close(19) = -1 EBADF (Bad file descriptor) [pid 5502] close(20) = -1 EBADF (Bad file descriptor) [pid 5502] close(21) = -1 EBADF (Bad file descriptor) [pid 5502] close(22) = -1 EBADF (Bad file descriptor) [pid 5502] close(23) = -1 EBADF (Bad file descriptor) [pid 5502] close(24) = -1 EBADF (Bad file descriptor) [pid 5502] close(25) = -1 EBADF (Bad file descriptor) [pid 5502] close(26) = -1 EBADF (Bad file descriptor) [pid 5502] close(27) = -1 EBADF (Bad file descriptor) [pid 5502] close(28) = -1 EBADF (Bad file descriptor) [pid 5502] close(29) = -1 EBADF (Bad file descriptor) [ 134.044795][ T5502] Out of memory and no killable processes... [ 134.054162][ T5503] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5502] exit_group(0) = ? [pid 5502] +++ exited with 0 +++ [ 134.090989][ T5503] CPU: 0 PID: 5503 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 134.101490][ T5503] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 134.111592][ T5503] Call Trace: [ 134.114911][ T5503] [ 134.117882][ T5503] dump_stack_lvl+0x1e7/0x2d0 [ 134.122613][ T5503] ? nf_tcp_handle_invalid+0x640/0x640 [ 134.128120][ T5503] ? panic+0x770/0x770 [ 134.132258][ T5503] dump_header+0xdc/0x940 [ 134.136648][ T5503] out_of_memory+0xf21/0x12c0 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=25, si_uid=0, si_status=0, si_utime=0, si_stime=6 /* 0.06 s */} --- [ 134.141388][ T5503] ? mutex_lock_io_nested+0x60/0x60 [ 134.146643][ T5503] ? preempt_schedule+0xdd/0xf0 [ 134.151543][ T5503] ? unregister_oom_notifier+0x20/0x20 [ 134.157022][ T5503] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 134.163034][ T5503] mem_cgroup_out_of_memory+0x263/0x3b0 [ 134.168600][ T5503] ? preempt_schedule_thunk+0x1a/0x20 [ 134.173994][ T5503] ? mem_cgroup_oom_trylock+0x210/0x210 [ 134.179571][ T5503] ? cgroup_file_notify+0x127/0x190 [ 134.184797][ T5503] memory_max_write+0x355/0x470 [ 134.189671][ T5503] ? memory_max_show+0xa0/0xa0 [ 134.194455][ T5503] ? read_lock_is_recursive+0x20/0x20 [ 134.199849][ T5503] ? memory_max_show+0xa0/0xa0 [ 134.204629][ T5503] cgroup_file_write+0x2b1/0x780 [ 134.209584][ T5503] ? cgroup_seqfile_stop+0xd0/0xd0 [ 134.214709][ T5503] ? __virt_addr_valid+0x22f/0x2e0 [ 134.219850][ T5503] ? cgroup_seqfile_stop+0xd0/0xd0 [ 134.224973][ T5503] kernfs_fop_write_iter+0x3a6/0x4f0 [ 134.230279][ T5503] vfs_write+0x7b2/0xbb0 [ 134.234546][ T5503] ? file_end_write+0x240/0x240 [ 134.239438][ T5503] ? do_raw_spin_unlock+0x13b/0x8b0 [ 134.244768][ T5503] ? lockdep_hardirqs_on+0x98/0x140 [ 134.250157][ T5503] ? __fdget_pos+0x265/0x2f0 [ 134.254808][ T5503] ksys_write+0x1a0/0x2c0 [ 134.259173][ T5503] ? __ia32_sys_read+0x90/0x90 [ 134.264151][ T5503] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 134.270181][ T5503] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 134.276195][ T5503] do_syscall_64+0x41/0xc0 [ 134.280640][ T5503] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 134.286563][ T5503] RIP: 0033:0x7fd49ce20129 [ 134.290997][ T5503] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 134.310619][ T5503] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 134.319057][ T5503] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 134.327040][ T5503] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [pid 5075] umount2("./23", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] openat(AT_FDCWD, "./23", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5075] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5075] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5075] umount2("./23/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./23/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5075] unlink("./23/binderfs") = 0 [pid 5075] umount2("./23/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./23/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5075] unlink("./23/cgroup") = 0 [pid 5075] umount2("./23/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 134.335018][ T5503] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 134.342996][ T5503] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 134.350976][ T5503] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000011 [ 134.358985][ T5503] [ 134.366170][ T5503] memory: usage 8kB, limit 0kB, failcnt 55 [ 134.373074][ T5503] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 134.397272][ T5503] Memory cgroup stats for /syz1: [ 134.397487][ T5503] anon 0 [ 134.397487][ T5503] file 0 [ 134.397487][ T5503] kernel 8192 [ 134.397487][ T5503] kernel_stack 0 [ 134.397487][ T5503] pagetables 0 [ 134.397487][ T5503] sec_pagetables 0 [ 134.397487][ T5503] percpu 0 [ 134.397487][ T5503] sock 0 [ 134.397487][ T5503] vmalloc 0 [ 134.397487][ T5503] shmem 0 [ 134.397487][ T5503] zswap 0 [ 134.397487][ T5503] zswapped 0 [ 134.397487][ T5503] file_mapped 0 [ 134.397487][ T5503] file_dirty 0 [pid 5075] lstat("./23/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5075] unlink("./23/cgroup.net") = 0 [pid 5075] umount2("./23/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5075] umount2("./23/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 134.397487][ T5503] file_writeback 0 [ 134.397487][ T5503] swapcached 0 [ 134.397487][ T5503] anon_thp 0 [ 134.397487][ T5503] file_thp 0 [ 134.397487][ T5503] shmem_thp 0 [ 134.397487][ T5503] inactive_anon 0 [ 134.397487][ T5503] active_anon 0 [ 134.397487][ T5503] inactive_file 0 [ 134.397487][ T5503] active_file 0 [ 134.397487][ T5503] unevictable 0 [ 134.397487][ T5503] slab_reclaimable 6752 [ 134.397487][ T5503] slab_unreclaimable 0 [ 134.397487][ T5503] slab 6752 [ 134.397487][ T5503] workingset_refault_anon 0 [pid 5075] lstat("./23/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5075] umount2("./23/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] openat(AT_FDCWD, "./23/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5075] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5075] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5075] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5075] close(4) = 0 [pid 5075] rmdir("./23/file0") = 0 [pid 5075] umount2("./23/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./23/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5075] unlink("./23/cgroup.cpu") = 0 [pid 5075] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5075] close(3) = 0 [pid 5075] rmdir("./23") = 0 [pid 5075] mkdir("./24", 0777) = 0 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555574ac5d0) = 26 ./strace-static-x86_64: Process 5525 attached [pid 5503] <... write resumed>) = 18 [ 134.498455][ T5503] Tasks state (memory values in pages): [ 134.504377][ T5503] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 134.515120][ T5503] Out of memory and no killable processes... [ 134.522068][ T5509] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 134.533874][ T5509] CPU: 1 PID: 5509 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 134.544337][ T5509] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 134.554428][ T5509] Call Trace: [ 134.557742][ T5509] [ 134.560708][ T5509] dump_stack_lvl+0x1e7/0x2d0 [ 134.565438][ T5509] ? nf_tcp_handle_invalid+0x640/0x640 [ 134.570946][ T5509] ? panic+0x770/0x770 [ 134.575075][ T5509] dump_header+0xdc/0x940 [ 134.579544][ T5509] out_of_memory+0xf21/0x12c0 [ 134.584274][ T5509] ? mutex_lock_io_nested+0x60/0x60 [ 134.589523][ T5509] ? mark_lock+0x9a/0x340 [pid 5525] chdir("./24") = 0 [pid 5525] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5525] setpgid(0, 0) = 0 [pid 5525] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 5525] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 5525] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 5525] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [ 134.593887][ T5509] ? unregister_oom_notifier+0x20/0x20 [ 134.599388][ T5509] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 134.605428][ T5509] mem_cgroup_out_of_memory+0x263/0x3b0 [ 134.611031][ T5509] ? mem_cgroup_oom_trylock+0x210/0x210 [ 134.616646][ T5509] ? cgroup_file_notify+0x127/0x190 [ 134.621901][ T5509] memory_max_write+0x355/0x470 [ 134.626811][ T5509] ? memory_max_show+0xa0/0xa0 [ 134.631626][ T5509] ? read_lock_is_recursive+0x20/0x20 [ 134.637050][ T5509] ? memory_max_show+0xa0/0xa0 [ 134.641863][ T5509] cgroup_file_write+0x2b1/0x780 [pid 5525] write(3, "1000", 4) = 4 [pid 5525] close(3) = 0 [pid 5525] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5525] mkdir("./file0", 000) = 0 [pid 5525] open("./file0", O_RDONLY) = 3 [ 134.646847][ T5509] ? cgroup_seqfile_stop+0xd0/0xd0 [ 134.652008][ T5509] ? __virt_addr_valid+0x22f/0x2e0 [ 134.657188][ T5509] ? cgroup_seqfile_stop+0xd0/0xd0 [ 134.662344][ T5509] kernfs_fop_write_iter+0x3a6/0x4f0 [ 134.667698][ T5509] vfs_write+0x7b2/0xbb0 [ 134.672005][ T5509] ? file_end_write+0x240/0x240 [ 134.676906][ T5509] ? do_raw_spin_unlock+0x13b/0x8b0 [ 134.682158][ T5509] ? lockdep_hardirqs_on+0x98/0x140 [ 134.687409][ T5509] ? __fdget_pos+0x265/0x2f0 [ 134.692048][ T5509] ksys_write+0x1a0/0x2c0 [pid 5525] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5525] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5525] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5525] openat(5, "memory.max", O_RDWR) = 6 [ 134.696434][ T5509] ? __ia32_sys_read+0x90/0x90 [ 134.701250][ T5509] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 134.707389][ T5509] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 134.713431][ T5509] do_syscall_64+0x41/0xc0 [ 134.717912][ T5509] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 134.723857][ T5509] RIP: 0033:0x7fd49ce20129 [ 134.728308][ T5509] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 134.747957][ T5509] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 134.756419][ T5509] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 134.764431][ T5509] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 134.772444][ T5509] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 134.780457][ T5509] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 134.788472][ T5509] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000012 [ 134.796512][ T5509] [ 134.807292][ T5509] memory: usage 8kB, limit 0kB, failcnt 55 [ 134.813296][ T5509] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 134.820667][ T5509] Memory cgroup stats for /syz1: [ 134.820867][ T5509] anon 0 [ 134.820867][ T5509] file 0 [ 134.820867][ T5509] kernel 8192 [ 134.820867][ T5509] kernel_stack 0 [ 134.820867][ T5509] pagetables 0 [ 134.820867][ T5509] sec_pagetables 0 [ 134.820867][ T5509] percpu 0 [ 134.820867][ T5509] sock 0 [ 134.820867][ T5509] vmalloc 0 [ 134.820867][ T5509] shmem 0 [ 134.820867][ T5509] zswap 0 [ 134.820867][ T5509] zswapped 0 [ 134.820867][ T5509] file_mapped 0 [ 134.820867][ T5509] file_dirty 0 [ 134.820867][ T5509] file_writeback 0 [ 134.820867][ T5509] swapcached 0 [ 134.820867][ T5509] anon_thp 0 [ 134.820867][ T5509] file_thp 0 [ 134.820867][ T5509] shmem_thp 0 [ 134.820867][ T5509] inactive_anon 0 [ 134.820867][ T5509] active_anon 0 [ 134.820867][ T5509] inactive_file 0 [ 134.820867][ T5509] active_file 0 [ 134.820867][ T5509] unevictable 0 [ 134.820867][ T5509] slab_reclaimable 6752 [pid 5525] write(6, "0x000000000000040e", 18 [pid 5509] <... write resumed>) = 18 [pid 5503] close(3 [pid 5509] close(3 [pid 5503] <... close resumed>) = 0 [pid 5509] <... close resumed>) = 0 [pid 5503] close(4 [pid 5509] close(4) = 0 [pid 5503] <... close resumed>) = 0 [pid 5509] close(5 [pid 5503] close(5 [pid 5509] <... close resumed>) = 0 [pid 5503] <... close resumed>) = 0 [pid 5509] close(6 [pid 5503] close(6 [pid 5509] <... close resumed>) = 0 [pid 5503] <... close resumed>) = 0 [pid 5509] close(7 [pid 5503] close(7 [pid 5509] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5503] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5509] close(8 [pid 5503] close(8 [pid 5509] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5509] close(9 [pid 5503] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5509] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5503] close(9 [pid 5509] close(10 [pid 5503] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5509] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5503] close(10 [pid 5509] close(11 [pid 5503] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5509] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5503] close(11 [pid 5509] close(12 [pid 5503] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5509] <... close resumed>) = -1 EBADF (Bad file descriptor) [ 134.820867][ T5509] slab_unreclaimable 0 [ 134.820867][ T5509] slab 6752 [ 134.820867][ T5509] workingset_refault_anon 0 [ 134.921971][ T5509] Tasks state (memory values in pages): [ 134.928149][ T5509] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 134.938109][ T5509] Out of memory and no killable processes... [ 134.944665][ T5512] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 134.977853][ T5512] CPU: 0 PID: 5512 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 134.988343][ T5512] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 134.998528][ T5512] Call Trace: [ 135.001850][ T5512] [ 135.004819][ T5512] dump_stack_lvl+0x1e7/0x2d0 [ 135.009550][ T5512] ? nf_tcp_handle_invalid+0x640/0x640 [ 135.015068][ T5512] ? panic+0x770/0x770 [ 135.019205][ T5512] dump_header+0xdc/0x940 [ 135.023599][ T5512] out_of_memory+0xf21/0x12c0 [ 135.028342][ T5512] ? mutex_lock_io_nested+0x60/0x60 [ 135.033604][ T5512] ? preempt_schedule+0xdd/0xf0 [ 135.038517][ T5512] ? unregister_oom_notifier+0x20/0x20 [ 135.044013][ T5512] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 135.050379][ T5512] mem_cgroup_out_of_memory+0x263/0x3b0 [ 135.055953][ T5512] ? preempt_schedule_thunk+0x1a/0x20 [ 135.061366][ T5512] ? mem_cgroup_oom_trylock+0x210/0x210 [ 135.066947][ T5512] ? cgroup_file_notify+0x127/0x190 [ 135.072168][ T5512] memory_max_write+0x355/0x470 [ 135.077052][ T5512] ? memory_max_show+0xa0/0xa0 [ 135.081831][ T5512] ? read_lock_is_recursive+0x20/0x20 [ 135.087228][ T5512] ? memory_max_show+0xa0/0xa0 [ 135.092013][ T5512] cgroup_file_write+0x2b1/0x780 [ 135.096982][ T5512] ? cgroup_seqfile_stop+0xd0/0xd0 [ 135.102105][ T5512] ? __virt_addr_valid+0x22f/0x2e0 [ 135.107244][ T5512] ? cgroup_seqfile_stop+0xd0/0xd0 [ 135.112378][ T5512] kernfs_fop_write_iter+0x3a6/0x4f0 [ 135.117686][ T5512] vfs_write+0x7b2/0xbb0 [ 135.122036][ T5512] ? file_end_write+0x240/0x240 [ 135.126920][ T5512] ? do_raw_spin_unlock+0x13b/0x8b0 [ 135.132136][ T5512] ? lockdep_hardirqs_on+0x98/0x140 [ 135.137532][ T5512] ? __fdget_pos+0x265/0x2f0 [ 135.142147][ T5512] ksys_write+0x1a0/0x2c0 [ 135.146499][ T5512] ? __ia32_sys_read+0x90/0x90 [ 135.151285][ T5512] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 135.157292][ T5512] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 135.163313][ T5512] do_syscall_64+0x41/0xc0 [ 135.167747][ T5512] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 135.173752][ T5512] RIP: 0033:0x7fd49ce20129 [ 135.178183][ T5512] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 135.197804][ T5512] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 135.206235][ T5512] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 135.214217][ T5512] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [pid 5503] close(12 [pid 5509] close(13 [pid 5503] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5509] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5503] close(13 [pid 5509] close(14 [pid 5503] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5509] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5503] close(14 [pid 5509] close(15 [pid 5503] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5509] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5503] close(15 [pid 5509] close(16 [pid 5503] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5503] close(16 [pid 5509] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5503] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5503] close(17 [pid 5509] close(17) = -1 EBADF (Bad file descriptor) [pid 5503] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5509] close(18 [pid 5503] close(18) = -1 EBADF (Bad file descriptor) [pid 5509] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5503] close(19 [pid 5509] close(19 [pid 5503] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5503] close(20) = -1 EBADF (Bad file descriptor) [pid 5509] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5503] close(21) = -1 EBADF (Bad file descriptor) [pid 5509] close(20) = -1 EBADF (Bad file descriptor) [pid 5503] close(22 [pid 5509] close(21 [pid 5503] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5509] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5503] close(23 [pid 5509] close(22 [pid 5503] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5509] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5503] close(24 [pid 5509] close(23 [pid 5503] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5509] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5503] close(25 [pid 5509] close(24 [pid 5503] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5509] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5503] close(26 [pid 5509] close(25 [pid 5503] <... close resumed>) = -1 EBADF (Bad file descriptor) [ 135.222199][ T5512] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 135.230177][ T5512] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 135.238156][ T5512] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000015 [ 135.246168][ T5512] [ 135.252234][ T5512] memory: usage 8kB, limit 0kB, failcnt 55 [pid 5509] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5503] close(27 [pid 5509] close(26 [pid 5503] <... close resumed>) = -1 EBADF (Bad file descriptor) [ 135.286159][ T5512] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 135.297480][ T5512] Memory cgroup stats for /syz1: [ 135.298288][ T5512] anon 0 [ 135.298288][ T5512] file 0 [ 135.298288][ T5512] kernel 8192 [ 135.298288][ T5512] kernel_stack 0 [ 135.298288][ T5512] pagetables 0 [ 135.298288][ T5512] sec_pagetables 0 [ 135.298288][ T5512] percpu 0 [ 135.298288][ T5512] sock 0 [ 135.298288][ T5512] vmalloc 0 [ 135.298288][ T5512] shmem 0 [ 135.298288][ T5512] zswap 0 [ 135.298288][ T5512] zswapped 0 [ 135.298288][ T5512] file_mapped 0 [ 135.298288][ T5512] file_dirty 0 [ 135.298288][ T5512] file_writeback 0 [ 135.298288][ T5512] swapcached 0 [ 135.298288][ T5512] anon_thp 0 [ 135.298288][ T5512] file_thp 0 [ 135.298288][ T5512] shmem_thp 0 [ 135.298288][ T5512] inactive_anon 0 [ 135.298288][ T5512] active_anon 0 [ 135.298288][ T5512] inactive_file 0 [ 135.298288][ T5512] active_file 0 [ 135.298288][ T5512] unevictable 0 [ 135.298288][ T5512] slab_reclaimable 6752 [ 135.298288][ T5512] slab_unreclaimable 0 [pid 5509] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5503] close(28) = -1 EBADF (Bad file descriptor) [pid 5503] close(29) = -1 EBADF (Bad file descriptor) [pid 5503] exit_group(0) = ? [pid 5503] +++ exited with 0 +++ [pid 5070] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=19, si_uid=0, si_status=0, si_utime=0, si_stime=7 /* 0.07 s */} --- [pid 5070] umount2("./17", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5070] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5070] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5070] umount2("./17/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./17/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5070] unlink("./17/binderfs") = 0 [pid 5070] umount2("./17/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./17/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5070] unlink("./17/cgroup") = 0 [pid 5070] umount2("./17/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./17/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5070] unlink("./17/cgroup.net") = 0 [pid 5070] umount2("./17/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5509] close(27 [pid 5070] umount2("./17/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./17/file0", [pid 5509] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5070] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5070] umount2("./17/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] openat(AT_FDCWD, "./17/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5070] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5070] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5070] getdents64(4, [pid 5509] close(28 [pid 5070] <... getdents64 resumed>0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5509] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5070] close(4 [pid 5509] close(29 [pid 5070] <... close resumed>) = 0 [pid 5070] rmdir("./17/file0" [pid 5509] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5070] <... rmdir resumed>) = 0 [pid 5070] umount2("./17/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./17/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5070] unlink("./17/cgroup.cpu") = 0 [pid 5070] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5070] close(3) = 0 [pid 5070] rmdir("./17") = 0 [pid 5509] exit_group(0 [pid 5070] mkdir("./18", 0777 [pid 5509] <... exit_group resumed>) = ? [pid 5070] <... mkdir resumed>) = 0 [pid 5070] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5530 attached [pid 5509] +++ exited with 0 +++ [pid 5530] chdir("./18" [pid 5072] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=20, si_uid=0, si_status=0, si_utime=0, si_stime=9 /* 0.09 s */} --- [pid 5530] <... chdir resumed>) = 0 [pid 5070] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 20 [pid 5530] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5072] umount2("./18", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5530] setpgid(0, 0 [pid 5072] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5530] <... setpgid resumed>) = 0 [pid 5072] openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [ 135.298288][ T5512] slab 6752 [ 135.298288][ T5512] workingset_refault_anon 0 [ 135.397627][ T5512] Tasks state (memory values in pages): [pid 5530] symlink("/syzcgroup/unified/syz0", "./cgroup" [pid 5072] <... openat resumed>) = 3 [pid 5530] <... symlink resumed>) = 0 [pid 5072] fstat(3, [pid 5530] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu" [pid 5072] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5530] <... symlink resumed>) = 0 [pid 5072] getdents64(3, [pid 5530] symlink("/syzcgroup/net/syz0", "./cgroup.net" [pid 5072] <... getdents64 resumed>0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5530] <... symlink resumed>) = 0 [pid 5072] umount2("./18/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5530] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5072] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5530] <... openat resumed>) = 3 [pid 5072] lstat("./18/binderfs", [pid 5530] write(3, "1000", 4 [pid 5072] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5530] <... write resumed>) = 4 [pid 5072] unlink("./18/binderfs" [pid 5530] close(3 [pid 5072] <... unlink resumed>) = 0 [pid 5530] <... close resumed>) = 0 [pid 5072] umount2("./18/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5530] symlink("/dev/binderfs", "./binderfs" [pid 5072] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5530] <... symlink resumed>) = 0 [pid 5072] lstat("./18/cgroup", [pid 5530] mkdir("./file0", 000 [pid 5072] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5530] <... mkdir resumed>) = 0 [pid 5072] unlink("./18/cgroup" [pid 5530] open("./file0", O_RDONLY [pid 5072] <... unlink resumed>) = 0 [pid 5530] <... open resumed>) = 3 [pid 5072] umount2("./18/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5530] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5072] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5530] <... mount resumed>) = 0 [pid 5072] lstat("./18/cgroup.net", [pid 5530] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5072] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5530] <... openat resumed>) = 4 [pid 5072] unlink("./18/cgroup.net" [pid 5530] openat(4, "syz1", O_RDWR|O_PATH [pid 5072] <... unlink resumed>) = 0 [pid 5530] <... openat resumed>) = 5 [pid 5072] umount2("./18/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5530] openat(5, "memory.max", O_RDWR [pid 5072] <... umount2 resumed>) = 0 [pid 5530] <... openat resumed>) = 6 [pid 5072] umount2("./18/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5530] write(6, "0x000000000000040e", 18 [pid 5072] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./18/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [ 135.438872][ T5512] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5072] umount2("./18/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] openat(AT_FDCWD, "./18/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5072] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5072] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5072] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5072] close(4) = 0 [pid 5072] rmdir("./18/file0") = 0 [pid 5072] umount2("./18/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./18/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5072] unlink("./18/cgroup.cpu") = 0 [pid 5072] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5072] close(3) = 0 [pid 5072] rmdir("./18") = 0 [pid 5072] mkdir("./19", 0777) = 0 [pid 5072] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5533 attached [pid 5533] chdir("./19" [pid 5072] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 21 [pid 5533] <... chdir resumed>) = 0 [pid 5533] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5512] <... write resumed>) = 18 [pid 5533] <... prctl resumed>) = 0 [pid 5512] close(3 [pid 5533] setpgid(0, 0 [pid 5512] <... close resumed>) = 0 [pid 5512] close(4 [pid 5533] <... setpgid resumed>) = 0 [pid 5512] <... close resumed>) = 0 [pid 5512] close(5) = 0 [pid 5533] symlink("/syzcgroup/unified/syz5", "./cgroup" [pid 5512] close(6) = 0 [pid 5533] <... symlink resumed>) = 0 [pid 5512] close(7) = -1 EBADF (Bad file descriptor) [pid 5533] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu" [ 135.481123][ T5512] Out of memory and no killable processes... [ 135.510074][ T5518] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5512] close(8) = -1 EBADF (Bad file descriptor) [pid 5533] <... symlink resumed>) = 0 [pid 5512] close(9) = -1 EBADF (Bad file descriptor) [ 135.533143][ T5518] CPU: 1 PID: 5518 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 135.543636][ T5518] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 135.553730][ T5518] Call Trace: [ 135.557070][ T5518] [ 135.560049][ T5518] dump_stack_lvl+0x1e7/0x2d0 [ 135.564778][ T5518] ? nf_tcp_handle_invalid+0x640/0x640 [ 135.570279][ T5518] ? panic+0x770/0x770 [ 135.574402][ T5518] dump_header+0xdc/0x940 [ 135.578778][ T5518] out_of_memory+0xf21/0x12c0 [ 135.583518][ T5518] ? mutex_lock_io_nested+0x60/0x60 [ 135.588775][ T5518] ? preempt_schedule+0xdd/0xf0 [ 135.593669][ T5518] ? unregister_oom_notifier+0x20/0x20 [ 135.599198][ T5518] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 135.605242][ T5518] mem_cgroup_out_of_memory+0x263/0x3b0 [ 135.610836][ T5518] ? preempt_schedule_thunk+0x1a/0x20 [ 135.616263][ T5518] ? mem_cgroup_oom_trylock+0x210/0x210 [ 135.621872][ T5518] ? cgroup_file_notify+0x127/0x190 [ 135.627126][ T5518] memory_max_write+0x355/0x470 [ 135.632019][ T5518] ? memory_max_show+0xa0/0xa0 [ 135.636799][ T5518] ? read_lock_is_recursive+0x20/0x20 [ 135.642191][ T5518] ? memory_max_show+0xa0/0xa0 [ 135.646972][ T5518] cgroup_file_write+0x2b1/0x780 [ 135.651931][ T5518] ? cgroup_seqfile_stop+0xd0/0xd0 [ 135.657055][ T5518] ? __virt_addr_valid+0x22f/0x2e0 [ 135.662195][ T5518] ? cgroup_seqfile_stop+0xd0/0xd0 [ 135.667317][ T5518] kernfs_fop_write_iter+0x3a6/0x4f0 [ 135.672622][ T5518] vfs_write+0x7b2/0xbb0 [ 135.676889][ T5518] ? file_end_write+0x240/0x240 [ 135.681758][ T5518] ? do_raw_spin_unlock+0x13b/0x8b0 [ 135.686977][ T5518] ? lockdep_hardirqs_on+0x98/0x140 [ 135.692201][ T5518] ? __fdget_pos+0x265/0x2f0 [ 135.696809][ T5518] ksys_write+0x1a0/0x2c0 [ 135.701161][ T5518] ? __ia32_sys_read+0x90/0x90 [ 135.705937][ T5518] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 135.711941][ T5518] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 135.717961][ T5518] do_syscall_64+0x41/0xc0 [ 135.722406][ T5518] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 135.728344][ T5518] RIP: 0033:0x7fd49ce20129 [ 135.732780][ T5518] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 135.752413][ T5518] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 135.760849][ T5518] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 135.768844][ T5518] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [pid 5533] symlink("/syzcgroup/net/syz5", "./cgroup.net" [pid 5512] close(10) = -1 EBADF (Bad file descriptor) [pid 5512] close(11 [pid 5533] <... symlink resumed>) = 0 [pid 5512] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5533] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5512] close(12) = -1 EBADF (Bad file descriptor) [pid 5533] <... openat resumed>) = 3 [pid 5533] write(3, "1000", 4 [pid 5512] close(13) = -1 EBADF (Bad file descriptor) [pid 5533] <... write resumed>) = 4 [pid 5512] close(14 [pid 5533] close(3 [pid 5512] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5512] close(15 [pid 5533] <... close resumed>) = 0 [pid 5512] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5533] symlink("/dev/binderfs", "./binderfs" [pid 5512] close(16) = -1 EBADF (Bad file descriptor) [pid 5512] close(17 [pid 5533] <... symlink resumed>) = 0 [pid 5533] mkdir("./file0", 000 [pid 5512] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5512] close(18) = -1 EBADF (Bad file descriptor) [pid 5533] <... mkdir resumed>) = 0 [pid 5512] close(19 [pid 5533] open("./file0", O_RDONLY [pid 5512] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5512] close(20) = -1 EBADF (Bad file descriptor) [ 135.776824][ T5518] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 135.784815][ T5518] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 135.792878][ T5518] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000019 [ 135.800985][ T5518] [pid 5533] <... open resumed>) = 3 [pid 5512] close(21 [pid 5533] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5512] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5512] close(22 [pid 5533] <... mount resumed>) = 0 [pid 5512] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5512] close(23) = -1 EBADF (Bad file descriptor) [pid 5512] close(24 [pid 5533] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5512] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5533] <... openat resumed>) = 4 [pid 5512] close(25) = -1 EBADF (Bad file descriptor) [pid 5512] close(26) = -1 EBADF (Bad file descriptor) [pid 5512] close(27) = -1 EBADF (Bad file descriptor) [pid 5512] close(28) = -1 EBADF (Bad file descriptor) [pid 5512] close(29) = -1 EBADF (Bad file descriptor) [pid 5512] exit_group(0) = ? [pid 5512] +++ exited with 0 +++ [pid 5073] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=23, si_uid=0, si_status=0, si_utime=0, si_stime=10 /* 0.10 s */} --- [pid 5533] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5533] openat(5, "memory.max", O_RDWR) = 6 [pid 5073] umount2("./21", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5533] write(6, "0x000000000000040e", 18 [pid 5073] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5073] openat(AT_FDCWD, "./21", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5073] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5073] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5073] umount2("./21/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./21/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5073] unlink("./21/binderfs") = 0 [pid 5073] umount2("./21/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./21/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5073] unlink("./21/cgroup") = 0 [pid 5073] umount2("./21/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./21/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5073] unlink("./21/cgroup.net") = 0 [pid 5073] umount2("./21/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5073] umount2("./21/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./21/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5073] umount2("./21/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] openat(AT_FDCWD, "./21/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5073] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5073] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5073] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5073] close(4) = 0 [pid 5073] rmdir("./21/file0") = 0 [pid 5073] umount2("./21/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./21/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5073] unlink("./21/cgroup.cpu") = 0 [pid 5073] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5073] close(3) = 0 [pid 5073] rmdir("./21") = 0 [pid 5073] mkdir("./22", 0777) = 0 [pid 5073] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5537 attached , child_tidptr=0x5555574ac5d0) = 24 [pid 5537] chdir("./22") = 0 [pid 5537] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5537] setpgid(0, 0) = 0 [ 135.851269][ T5518] memory: usage 8kB, limit 0kB, failcnt 55 [ 135.886493][ T5518] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [pid 5537] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [ 135.921624][ T5518] Memory cgroup stats for /syz1: [ 135.921840][ T5518] anon 0 [ 135.921840][ T5518] file 0 [ 135.921840][ T5518] kernel 8192 [ 135.921840][ T5518] kernel_stack 0 [ 135.921840][ T5518] pagetables 0 [ 135.921840][ T5518] sec_pagetables 0 [ 135.921840][ T5518] percpu 0 [ 135.921840][ T5518] sock 0 [ 135.921840][ T5518] vmalloc 0 [ 135.921840][ T5518] shmem 0 [ 135.921840][ T5518] zswap 0 [ 135.921840][ T5518] zswapped 0 [ 135.921840][ T5518] file_mapped 0 [ 135.921840][ T5518] file_dirty 0 [pid 5537] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 5537] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [pid 5537] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5537] write(3, "1000", 4) = 4 [pid 5537] close(3) = 0 [pid 5537] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5537] mkdir("./file0", 000) = 0 [pid 5537] open("./file0", O_RDONLY) = 3 [ 135.921840][ T5518] file_writeback 0 [ 135.921840][ T5518] swapcached 0 [ 135.921840][ T5518] anon_thp 0 [ 135.921840][ T5518] file_thp 0 [ 135.921840][ T5518] shmem_thp 0 [ 135.921840][ T5518] inactive_anon 0 [ 135.921840][ T5518] active_anon 0 [ 135.921840][ T5518] inactive_file 0 [ 135.921840][ T5518] active_file 0 [ 135.921840][ T5518] unevictable 0 [ 135.921840][ T5518] slab_reclaimable 6752 [ 135.921840][ T5518] slab_unreclaimable 0 [ 135.921840][ T5518] slab 6752 [ 135.921840][ T5518] workingset_refault_anon 0 [pid 5537] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5537] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5537] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5537] openat(5, "memory.max", O_RDWR) = 6 [ 136.034422][ T5518] Tasks state (memory values in pages): [ 136.043194][ T5518] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 136.060523][ T5518] Out of memory and no killable processes... [pid 5537] write(6, "0x000000000000040e", 18 [pid 5518] <... write resumed>) = 18 [ 136.081699][ T5525] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 136.093769][ T5525] CPU: 0 PID: 5525 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 136.104339][ T5525] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 136.114443][ T5525] Call Trace: [ 136.117759][ T5525] [ 136.120737][ T5525] dump_stack_lvl+0x1e7/0x2d0 [ 136.125471][ T5525] ? nf_tcp_handle_invalid+0x640/0x640 [ 136.130990][ T5525] ? panic+0x770/0x770 [ 136.135130][ T5525] dump_header+0xdc/0x940 [ 136.139537][ T5525] out_of_memory+0xf21/0x12c0 [ 136.144278][ T5525] ? mutex_lock_io_nested+0x60/0x60 [ 136.149713][ T5525] ? preempt_schedule+0xdd/0xf0 [ 136.154621][ T5525] ? unregister_oom_notifier+0x20/0x20 [ 136.160134][ T5525] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 136.166189][ T5525] mem_cgroup_out_of_memory+0x263/0x3b0 [ 136.171796][ T5525] ? preempt_schedule_thunk+0x1a/0x20 [ 136.177227][ T5525] ? mem_cgroup_oom_trylock+0x210/0x210 [ 136.182844][ T5525] ? cgroup_file_notify+0x127/0x190 [ 136.188110][ T5525] memory_max_write+0x355/0x470 [ 136.195024][ T5525] ? memory_max_show+0xa0/0xa0 [ 136.199853][ T5525] ? read_lock_is_recursive+0x20/0x20 [ 136.205314][ T5525] ? memory_max_show+0xa0/0xa0 [ 136.210130][ T5525] cgroup_file_write+0x2b1/0x780 [ 136.215124][ T5525] ? cgroup_seqfile_stop+0xd0/0xd0 [ 136.220281][ T5525] ? __virt_addr_valid+0x22f/0x2e0 [ 136.225460][ T5525] ? cgroup_seqfile_stop+0xd0/0xd0 [pid 5518] close(3) = 0 [pid 5518] close(4) = 0 [pid 5518] close(5) = 0 [pid 5518] close(6) = 0 [pid 5518] close(7) = -1 EBADF (Bad file descriptor) [ 136.230614][ T5525] kernfs_fop_write_iter+0x3a6/0x4f0 [ 136.235960][ T5525] vfs_write+0x7b2/0xbb0 [ 136.240267][ T5525] ? file_end_write+0x240/0x240 [ 136.245176][ T5525] ? do_raw_spin_unlock+0x13b/0x8b0 [ 136.250428][ T5525] ? lockdep_hardirqs_on+0x98/0x140 [ 136.255686][ T5525] ? __fdget_pos+0x265/0x2f0 [ 136.260330][ T5525] ksys_write+0x1a0/0x2c0 [ 136.264711][ T5525] ? __ia32_sys_read+0x90/0x90 [ 136.269521][ T5525] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 136.275564][ T5525] ? syscall_enter_from_user_mode+0x8c/0x2c0 [pid 5518] close(8) = -1 EBADF (Bad file descriptor) [pid 5518] close(9) = -1 EBADF (Bad file descriptor) [pid 5518] close(10) = -1 EBADF (Bad file descriptor) [pid 5518] close(11) = -1 EBADF (Bad file descriptor) [pid 5518] close(12) = -1 EBADF (Bad file descriptor) [pid 5518] close(13) = -1 EBADF (Bad file descriptor) [pid 5518] close(14) = -1 EBADF (Bad file descriptor) [pid 5518] close(15) = -1 EBADF (Bad file descriptor) [pid 5518] close(16) = -1 EBADF (Bad file descriptor) [pid 5518] close(17) = -1 EBADF (Bad file descriptor) [pid 5518] close(18) = -1 EBADF (Bad file descriptor) [pid 5518] close(19) = -1 EBADF (Bad file descriptor) [pid 5518] close(20) = -1 EBADF (Bad file descriptor) [pid 5518] close(21) = -1 EBADF (Bad file descriptor) [pid 5518] close(22) = -1 EBADF (Bad file descriptor) [pid 5518] close(23) = -1 EBADF (Bad file descriptor) [pid 5518] close(24) = -1 EBADF (Bad file descriptor) [pid 5518] close(25) = -1 EBADF (Bad file descriptor) [pid 5518] close(26) = -1 EBADF (Bad file descriptor) [pid 5518] close(27) = -1 EBADF (Bad file descriptor) [pid 5518] close(28) = -1 EBADF (Bad file descriptor) [pid 5518] close(29) = -1 EBADF (Bad file descriptor) [pid 5518] exit_group(0) = ? [pid 5518] +++ exited with 0 +++ [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=27, si_uid=0, si_status=0, si_utime=0, si_stime=11 /* 0.11 s */} --- [ 136.281608][ T5525] do_syscall_64+0x41/0xc0 [ 136.286083][ T5525] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 136.292045][ T5525] RIP: 0033:0x7fd49ce20129 [ 136.296514][ T5525] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 136.316181][ T5525] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 136.324672][ T5525] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [pid 5074] umount2("./25", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] openat(AT_FDCWD, "./25", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5074] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5074] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5074] umount2("./25/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./25/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5074] unlink("./25/binderfs") = 0 [pid 5074] umount2("./25/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./25/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5074] unlink("./25/cgroup") = 0 [pid 5074] umount2("./25/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./25/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5074] unlink("./25/cgroup.net") = 0 [pid 5074] umount2("./25/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5074] umount2("./25/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./25/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5074] umount2("./25/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] openat(AT_FDCWD, "./25/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5074] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5074] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5074] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5074] close(4) = 0 [pid 5074] rmdir("./25/file0") = 0 [pid 5074] umount2("./25/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./25/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5074] unlink("./25/cgroup.cpu") = 0 [pid 5074] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5074] close(3) = 0 [pid 5074] rmdir("./25") = 0 [pid 5074] mkdir("./26", 0777) = 0 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5541 attached [pid 5541] chdir("./26" [ 136.332694][ T5525] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 136.340711][ T5525] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 136.348726][ T5525] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 136.356742][ T5525] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000018 [ 136.364793][ T5525] [pid 5074] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 28 [pid 5541] <... chdir resumed>) = 0 [pid 5541] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5541] setpgid(0, 0) = 0 [pid 5541] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [pid 5541] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 5541] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 5541] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5541] write(3, "1000", 4) = 4 [pid 5541] close(3) = 0 [pid 5541] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5541] mkdir("./file0", 000) = 0 [pid 5541] open("./file0", O_RDONLY) = 3 [pid 5541] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5541] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5541] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5541] openat(5, "memory.max", O_RDWR) = 6 [ 136.433832][ T5525] memory: usage 8kB, limit 0kB, failcnt 55 [ 136.456656][ T5525] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 136.463574][ T5525] Memory cgroup stats for /syz1: [ 136.463737][ T5525] anon 0 [ 136.463737][ T5525] file 0 [ 136.463737][ T5525] kernel 8192 [ 136.463737][ T5525] kernel_stack 0 [ 136.463737][ T5525] pagetables 0 [ 136.463737][ T5525] sec_pagetables 0 [ 136.463737][ T5525] percpu 0 [ 136.463737][ T5525] sock 0 [ 136.463737][ T5525] vmalloc 0 [ 136.463737][ T5525] shmem 0 [ 136.463737][ T5525] zswap 0 [ 136.463737][ T5525] zswapped 0 [ 136.463737][ T5525] file_mapped 0 [ 136.463737][ T5525] file_dirty 0 [ 136.463737][ T5525] file_writeback 0 [ 136.463737][ T5525] swapcached 0 [ 136.463737][ T5525] anon_thp 0 [ 136.463737][ T5525] file_thp 0 [ 136.463737][ T5525] shmem_thp 0 [ 136.463737][ T5525] inactive_anon 0 [ 136.463737][ T5525] active_anon 0 [ 136.463737][ T5525] inactive_file 0 [ 136.463737][ T5525] active_file 0 [ 136.463737][ T5525] unevictable 0 [ 136.463737][ T5525] slab_reclaimable 6752 [ 136.463737][ T5525] slab_unreclaimable 0 [ 136.463737][ T5525] slab 6752 [ 136.463737][ T5525] workingset_refault_anon 0 [ 136.573019][ T5525] Tasks state (memory values in pages): [pid 5541] write(6, "0x000000000000040e", 18 [pid 5525] <... write resumed>) = 18 [pid 5525] close(3) = 0 [pid 5525] close(4) = 0 [pid 5525] close(5) = 0 [pid 5525] close(6) = 0 [pid 5525] close(7) = -1 EBADF (Bad file descriptor) [pid 5525] close(8) = -1 EBADF (Bad file descriptor) [pid 5525] close(9) = -1 EBADF (Bad file descriptor) [pid 5525] close(10) = -1 EBADF (Bad file descriptor) [pid 5525] close(11) = -1 EBADF (Bad file descriptor) [pid 5525] close(12) = -1 EBADF (Bad file descriptor) [pid 5525] close(13) = -1 EBADF (Bad file descriptor) [pid 5525] close(14) = -1 EBADF (Bad file descriptor) [pid 5525] close(15) = -1 EBADF (Bad file descriptor) [pid 5525] close(16) = -1 EBADF (Bad file descriptor) [pid 5525] close(17) = -1 EBADF (Bad file descriptor) [pid 5525] close(18) = -1 EBADF (Bad file descriptor) [pid 5525] close(19) = -1 EBADF (Bad file descriptor) [pid 5525] close(20) = -1 EBADF (Bad file descriptor) [pid 5525] close(21) = -1 EBADF (Bad file descriptor) [pid 5525] close(22) = -1 EBADF (Bad file descriptor) [pid 5525] close(23) = -1 EBADF (Bad file descriptor) [pid 5525] close(24) = -1 EBADF (Bad file descriptor) [pid 5525] close(25) = -1 EBADF (Bad file descriptor) [pid 5525] close(26) = -1 EBADF (Bad file descriptor) [pid 5525] close(27) = -1 EBADF (Bad file descriptor) [pid 5525] close(28) = -1 EBADF (Bad file descriptor) [pid 5525] close(29) = -1 EBADF (Bad file descriptor) [pid 5525] exit_group(0) = ? [ 136.595836][ T5525] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 136.616794][ T5525] Out of memory and no killable processes... [ 136.622912][ T5530] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 136.641465][ T5530] CPU: 1 PID: 5530 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 136.651946][ T5530] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 136.662040][ T5530] Call Trace: [ 136.665351][ T5530] [ 136.668313][ T5530] dump_stack_lvl+0x1e7/0x2d0 [ 136.673021][ T5530] ? nf_tcp_handle_invalid+0x640/0x640 [ 136.678586][ T5530] ? panic+0x770/0x770 [ 136.682683][ T5530] dump_header+0xdc/0x940 [ 136.687033][ T5530] out_of_memory+0xf21/0x12c0 [ 136.691751][ T5530] ? mutex_lock_io_nested+0x60/0x60 [ 136.696996][ T5530] ? preempt_schedule+0xdd/0xf0 [ 136.701873][ T5530] ? unregister_oom_notifier+0x20/0x20 [ 136.707386][ T5530] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 136.713403][ T5530] mem_cgroup_out_of_memory+0x263/0x3b0 [ 136.718983][ T5530] ? preempt_schedule_thunk+0x1a/0x20 [ 136.724381][ T5530] ? mem_cgroup_oom_trylock+0x210/0x210 [ 136.729978][ T5530] ? cgroup_file_notify+0x127/0x190 [ 136.735226][ T5530] memory_max_write+0x355/0x470 [ 136.740100][ T5530] ? memory_max_show+0xa0/0xa0 [ 136.744893][ T5530] ? read_lock_is_recursive+0x20/0x20 [ 136.750290][ T5530] ? memory_max_show+0xa0/0xa0 [ 136.755069][ T5530] cgroup_file_write+0x2b1/0x780 [ 136.760025][ T5530] ? cgroup_seqfile_stop+0xd0/0xd0 [ 136.765147][ T5530] ? __virt_addr_valid+0x22f/0x2e0 [ 136.770287][ T5530] ? cgroup_seqfile_stop+0xd0/0xd0 [ 136.775413][ T5530] kernfs_fop_write_iter+0x3a6/0x4f0 [ 136.780725][ T5530] vfs_write+0x7b2/0xbb0 [ 136.784996][ T5530] ? file_end_write+0x240/0x240 [ 136.789868][ T5530] ? do_raw_spin_unlock+0x13b/0x8b0 [ 136.795086][ T5530] ? lockdep_hardirqs_on+0x98/0x140 [ 136.800308][ T5530] ? __fdget_pos+0x265/0x2f0 [ 136.804916][ T5530] ksys_write+0x1a0/0x2c0 [ 136.809270][ T5530] ? __ia32_sys_read+0x90/0x90 [ 136.814069][ T5530] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 136.820078][ T5530] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 136.826140][ T5530] do_syscall_64+0x41/0xc0 [ 136.830591][ T5530] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 136.836514][ T5530] RIP: 0033:0x7fd49ce20129 [ 136.840956][ T5530] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 136.860586][ T5530] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 136.869020][ T5530] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 136.877011][ T5530] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 136.885026][ T5530] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [pid 5525] +++ exited with 0 +++ [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=26, si_uid=0, si_status=0, si_utime=0, si_stime=7 /* 0.07 s */} --- [pid 5075] umount2("./24", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] openat(AT_FDCWD, "./24", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5075] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5075] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5075] umount2("./24/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./24/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5075] unlink("./24/binderfs") = 0 [pid 5075] umount2("./24/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./24/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5075] unlink("./24/cgroup") = 0 [pid 5075] umount2("./24/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 136.893016][ T5530] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 136.901038][ T5530] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000012 [ 136.909052][ T5530] [ 136.929109][ T5530] memory: usage 8kB, limit 0kB, failcnt 55 [ 136.935214][ T5530] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 136.944959][ T5530] Memory cgroup stats for /syz1: [ 136.952367][ T5530] anon 0 [ 136.952367][ T5530] file 0 [ 136.952367][ T5530] kernel 8192 [ 136.952367][ T5530] kernel_stack 0 [ 136.952367][ T5530] pagetables 0 [ 136.952367][ T5530] sec_pagetables 0 [ 136.952367][ T5530] percpu 0 [ 136.952367][ T5530] sock 0 [ 136.952367][ T5530] vmalloc 0 [ 136.952367][ T5530] shmem 0 [ 136.952367][ T5530] zswap 0 [ 136.952367][ T5530] zswapped 0 [ 136.952367][ T5530] file_mapped 0 [ 136.952367][ T5530] file_dirty 0 [pid 5075] lstat("./24/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5075] unlink("./24/cgroup.net") = 0 [pid 5075] umount2("./24/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5075] umount2("./24/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./24/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5075] umount2("./24/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] openat(AT_FDCWD, "./24/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5075] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5075] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5075] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [ 136.952367][ T5530] file_writeback 0 [ 136.952367][ T5530] swapcached 0 [ 136.952367][ T5530] anon_thp 0 [ 136.952367][ T5530] file_thp 0 [ 136.952367][ T5530] shmem_thp 0 [ 136.952367][ T5530] inactive_anon 0 [ 136.952367][ T5530] active_anon 0 [ 136.952367][ T5530] inactive_file 0 [ 136.952367][ T5530] active_file 0 [ 136.952367][ T5530] unevictable 0 [ 136.952367][ T5530] slab_reclaimable 6752 [ 136.952367][ T5530] slab_unreclaimable 0 [ 136.952367][ T5530] slab 6752 [ 136.952367][ T5530] workingset_refault_anon 0 [pid 5075] close(4) = 0 [pid 5075] rmdir("./24/file0") = 0 [pid 5075] umount2("./24/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./24/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5075] unlink("./24/cgroup.cpu") = 0 [pid 5075] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5075] close(3) = 0 [pid 5075] rmdir("./24") = 0 [pid 5075] mkdir("./25", 0777) = 0 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5545 attached [pid 5545] chdir("./25" [pid 5075] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 27 [pid 5545] <... chdir resumed>) = 0 [pid 5545] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5545] setpgid(0, 0) = 0 [pid 5530] <... write resumed>) = 18 [pid 5545] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 5545] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 5545] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 5545] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5545] write(3, "1000", 4) = 4 [pid 5545] close(3) = 0 [pid 5545] symlink("/dev/binderfs", "./binderfs") = 0 [ 137.077252][ T5530] Tasks state (memory values in pages): [ 137.083059][ T5530] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 137.104671][ T5530] Out of memory and no killable processes... [ 137.114309][ T5533] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5530] close(3 [pid 5545] mkdir("./file0", 000 [pid 5530] <... close resumed>) = 0 [pid 5545] <... mkdir resumed>) = 0 [pid 5530] close(4 [pid 5545] open("./file0", O_RDONLY [pid 5530] <... close resumed>) = 0 [pid 5545] <... open resumed>) = 3 [pid 5530] close(5 [pid 5545] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5530] <... close resumed>) = 0 [ 137.142119][ T5533] CPU: 0 PID: 5533 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 137.152611][ T5533] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 137.162704][ T5533] Call Trace: [ 137.166022][ T5533] [ 137.168992][ T5533] dump_stack_lvl+0x1e7/0x2d0 [ 137.173732][ T5533] ? nf_tcp_handle_invalid+0x640/0x640 [ 137.179249][ T5533] ? panic+0x770/0x770 [ 137.183392][ T5533] dump_header+0xdc/0x940 [ 137.187776][ T5533] out_of_memory+0xf21/0x12c0 [ 137.192509][ T5533] ? mutex_lock_io_nested+0x60/0x60 [ 137.197767][ T5533] ? preempt_schedule+0xdd/0xf0 [ 137.202653][ T5533] ? unregister_oom_notifier+0x20/0x20 [ 137.208133][ T5533] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 137.214145][ T5533] mem_cgroup_out_of_memory+0x263/0x3b0 [ 137.219726][ T5533] ? preempt_schedule_thunk+0x1a/0x20 [ 137.225118][ T5533] ? mem_cgroup_oom_trylock+0x210/0x210 [ 137.230692][ T5533] ? cgroup_file_notify+0x127/0x190 [ 137.235914][ T5533] memory_max_write+0x355/0x470 [ 137.240790][ T5533] ? memory_max_show+0xa0/0xa0 [ 137.245568][ T5533] ? read_lock_is_recursive+0x20/0x20 [ 137.250965][ T5533] ? memory_max_show+0xa0/0xa0 [ 137.255742][ T5533] cgroup_file_write+0x2b1/0x780 [ 137.260698][ T5533] ? cgroup_seqfile_stop+0xd0/0xd0 [ 137.265835][ T5533] ? __virt_addr_valid+0x22f/0x2e0 [ 137.270976][ T5533] ? cgroup_seqfile_stop+0xd0/0xd0 [ 137.276094][ T5533] kernfs_fop_write_iter+0x3a6/0x4f0 [ 137.281403][ T5533] vfs_write+0x7b2/0xbb0 [ 137.285673][ T5533] ? file_end_write+0x240/0x240 [ 137.290560][ T5533] ? do_raw_spin_unlock+0x13b/0x8b0 [ 137.295771][ T5533] ? lockdep_hardirqs_on+0x98/0x140 [ 137.300994][ T5533] ? __fdget_pos+0x265/0x2f0 [ 137.305621][ T5533] ksys_write+0x1a0/0x2c0 [ 137.309988][ T5533] ? __ia32_sys_read+0x90/0x90 [ 137.314960][ T5533] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 137.321089][ T5533] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 137.327117][ T5533] do_syscall_64+0x41/0xc0 [ 137.331569][ T5533] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 137.337492][ T5533] RIP: 0033:0x7fd49ce20129 [ 137.341928][ T5533] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 137.361551][ T5533] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 137.369983][ T5533] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 137.377964][ T5533] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [pid 5545] <... mount resumed>) = 0 [pid 5530] close(6) = 0 [pid 5530] close(7) = -1 EBADF (Bad file descriptor) [pid 5530] close(8) = -1 EBADF (Bad file descriptor) [pid 5545] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5530] close(9 [pid 5545] <... openat resumed>) = 4 [pid 5530] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5545] openat(4, "syz1", O_RDWR|O_PATH [pid 5530] close(10 [pid 5545] <... openat resumed>) = 5 [pid 5530] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5545] openat(5, "memory.max", O_RDWR [pid 5530] close(11 [pid 5545] <... openat resumed>) = 6 [pid 5530] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5545] write(6, "0x000000000000040e", 18 [pid 5530] close(12) = -1 EBADF (Bad file descriptor) [pid 5530] close(13) = -1 EBADF (Bad file descriptor) [pid 5530] close(14) = -1 EBADF (Bad file descriptor) [pid 5530] close(15) = -1 EBADF (Bad file descriptor) [pid 5530] close(16) = -1 EBADF (Bad file descriptor) [pid 5530] close(17) = -1 EBADF (Bad file descriptor) [pid 5530] close(18) = -1 EBADF (Bad file descriptor) [pid 5530] close(19) = -1 EBADF (Bad file descriptor) [pid 5530] close(20) = -1 EBADF (Bad file descriptor) [ 137.385944][ T5533] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 137.393924][ T5533] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 137.401904][ T5533] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000013 [ 137.409919][ T5533] [pid 5530] close(21) = -1 EBADF (Bad file descriptor) [pid 5530] close(22) = -1 EBADF (Bad file descriptor) [pid 5530] close(23) = -1 EBADF (Bad file descriptor) [pid 5530] close(24) = -1 EBADF (Bad file descriptor) [pid 5530] close(25) = -1 EBADF (Bad file descriptor) [pid 5530] close(26) = -1 EBADF (Bad file descriptor) [pid 5530] close(27) = -1 EBADF (Bad file descriptor) [pid 5530] close(28) = -1 EBADF (Bad file descriptor) [pid 5530] close(29) = -1 EBADF (Bad file descriptor) [pid 5530] exit_group(0) = ? [pid 5530] +++ exited with 0 +++ [pid 5070] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=20, si_uid=0, si_status=0, si_utime=0, si_stime=12 /* 0.12 s */} --- [pid 5070] umount2("./18", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5070] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5070] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5070] umount2("./18/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./18/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5070] unlink("./18/binderfs") = 0 [pid 5070] umount2("./18/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./18/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5070] unlink("./18/cgroup") = 0 [pid 5070] umount2("./18/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./18/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5070] unlink("./18/cgroup.net") = 0 [pid 5070] umount2("./18/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5070] umount2("./18/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./18/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5070] umount2("./18/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] openat(AT_FDCWD, "./18/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5070] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5070] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5070] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5070] close(4) = 0 [pid 5070] rmdir("./18/file0") = 0 [pid 5070] umount2("./18/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./18/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5070] unlink("./18/cgroup.cpu") = 0 [pid 5070] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5070] close(3) = 0 [pid 5070] rmdir("./18") = 0 [pid 5070] mkdir("./19", 0777) = 0 [pid 5070] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5549 attached [pid 5549] chdir("./19" [pid 5070] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 21 [pid 5549] <... chdir resumed>) = 0 [pid 5549] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5549] setpgid(0, 0) = 0 [pid 5549] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 5549] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 5549] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 5549] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5549] write(3, "1000", 4) = 4 [pid 5549] close(3) = 0 [pid 5549] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5549] mkdir("./file0", 000) = 0 [pid 5549] open("./file0", O_RDONLY) = 3 [pid 5549] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5549] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5549] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5549] openat(5, "memory.max", O_RDWR) = 6 [ 137.592254][ T5533] memory: usage 8kB, limit 0kB, failcnt 55 [ 137.600292][ T5533] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 137.609328][ T5533] Memory cgroup stats for /syz1: [ 137.609480][ T5533] anon 0 [ 137.609480][ T5533] file 0 [ 137.609480][ T5533] kernel 8192 [ 137.609480][ T5533] kernel_stack 0 [ 137.609480][ T5533] pagetables 0 [ 137.609480][ T5533] sec_pagetables 0 [ 137.609480][ T5533] percpu 0 [ 137.609480][ T5533] sock 0 [ 137.609480][ T5533] vmalloc 0 [ 137.609480][ T5533] shmem 0 [ 137.609480][ T5533] zswap 0 [ 137.609480][ T5533] zswapped 0 [ 137.609480][ T5533] file_mapped 0 [ 137.609480][ T5533] file_dirty 0 [ 137.609480][ T5533] file_writeback 0 [ 137.609480][ T5533] swapcached 0 [ 137.609480][ T5533] anon_thp 0 [ 137.609480][ T5533] file_thp 0 [ 137.609480][ T5533] shmem_thp 0 [ 137.609480][ T5533] inactive_anon 0 [ 137.609480][ T5533] active_anon 0 [ 137.609480][ T5533] inactive_file 0 [ 137.609480][ T5533] active_file 0 [ 137.609480][ T5533] unevictable 0 [ 137.609480][ T5533] slab_reclaimable 6752 [ 137.609480][ T5533] slab_unreclaimable 0 [ 137.609480][ T5533] slab 6752 [ 137.609480][ T5533] workingset_refault_anon 0 [pid 5549] write(6, "0x000000000000040e", 18 [pid 5533] <... write resumed>) = 18 [ 137.823116][ T5533] Tasks state (memory values in pages): [ 137.832846][ T5533] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 137.856643][ T5533] Out of memory and no killable processes... [pid 5533] close(3) = 0 [ 137.874424][ T5537] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 137.887018][ T5537] CPU: 1 PID: 5537 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 137.897502][ T5537] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 137.907603][ T5537] Call Trace: [ 137.910922][ T5537] [ 137.913901][ T5537] dump_stack_lvl+0x1e7/0x2d0 [ 137.918644][ T5537] ? nf_tcp_handle_invalid+0x640/0x640 [ 137.924164][ T5537] ? panic+0x770/0x770 [ 137.928306][ T5537] dump_header+0xdc/0x940 [ 137.932706][ T5537] out_of_memory+0xf21/0x12c0 [ 137.937450][ T5537] ? mutex_lock_io_nested+0x60/0x60 [ 137.942712][ T5537] ? mark_lock+0x9a/0x340 [ 137.947092][ T5537] ? unregister_oom_notifier+0x20/0x20 [ 137.952606][ T5537] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 137.958658][ T5537] mem_cgroup_out_of_memory+0x263/0x3b0 [ 137.964270][ T5537] ? mem_cgroup_oom_trylock+0x210/0x210 [ 137.969897][ T5537] ? cgroup_file_notify+0x127/0x190 [ 137.975147][ T5537] memory_max_write+0x355/0x470 [ 137.980054][ T5537] ? memory_max_show+0xa0/0xa0 [ 137.984869][ T5537] ? read_lock_is_recursive+0x20/0x20 [ 137.990297][ T5537] ? memory_max_show+0xa0/0xa0 [ 137.995121][ T5537] cgroup_file_write+0x2b1/0x780 [ 138.000120][ T5537] ? cgroup_seqfile_stop+0xd0/0xd0 [ 138.005274][ T5537] ? __virt_addr_valid+0x22f/0x2e0 [ 138.010455][ T5537] ? cgroup_seqfile_stop+0xd0/0xd0 [ 138.015611][ T5537] kernfs_fop_write_iter+0x3a6/0x4f0 [ 138.020957][ T5537] vfs_write+0x7b2/0xbb0 [ 138.025260][ T5537] ? file_end_write+0x240/0x240 [ 138.030171][ T5537] ? do_raw_spin_unlock+0x13b/0x8b0 [ 138.035426][ T5537] ? lockdep_hardirqs_on+0x98/0x140 [ 138.040682][ T5537] ? __fdget_pos+0x265/0x2f0 [ 138.045332][ T5537] ksys_write+0x1a0/0x2c0 [ 138.049724][ T5537] ? __ia32_sys_read+0x90/0x90 [ 138.054537][ T5537] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 138.060583][ T5537] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 138.066629][ T5537] do_syscall_64+0x41/0xc0 [ 138.071097][ T5537] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 138.077046][ T5537] RIP: 0033:0x7fd49ce20129 [ 138.081511][ T5537] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 138.101165][ T5537] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 138.109640][ T5537] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 138.117660][ T5537] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [pid 5533] close(4) = 0 [pid 5533] close(5) = 0 [pid 5533] close(6) = 0 [pid 5533] close(7) = -1 EBADF (Bad file descriptor) [pid 5533] close(8) = -1 EBADF (Bad file descriptor) [pid 5533] close(9) = -1 EBADF (Bad file descriptor) [pid 5533] close(10) = -1 EBADF (Bad file descriptor) [pid 5533] close(11) = -1 EBADF (Bad file descriptor) [pid 5533] close(12) = -1 EBADF (Bad file descriptor) [pid 5533] close(13) = -1 EBADF (Bad file descriptor) [pid 5533] close(14) = -1 EBADF (Bad file descriptor) [pid 5533] close(15) = -1 EBADF (Bad file descriptor) [pid 5533] close(16) = -1 EBADF (Bad file descriptor) [pid 5533] close(17) = -1 EBADF (Bad file descriptor) [pid 5533] close(18) = -1 EBADF (Bad file descriptor) [pid 5533] close(19) = -1 EBADF (Bad file descriptor) [pid 5533] close(20) = -1 EBADF (Bad file descriptor) [pid 5533] close(21) = -1 EBADF (Bad file descriptor) [pid 5533] close(22) = -1 EBADF (Bad file descriptor) [pid 5533] close(23) = -1 EBADF (Bad file descriptor) [pid 5533] close(24) = -1 EBADF (Bad file descriptor) [pid 5533] close(25) = -1 EBADF (Bad file descriptor) [pid 5533] close(26) = -1 EBADF (Bad file descriptor) [pid 5533] close(27) = -1 EBADF (Bad file descriptor) [pid 5533] close(28) = -1 EBADF (Bad file descriptor) [pid 5533] close(29) = -1 EBADF (Bad file descriptor) [pid 5533] exit_group(0) = ? [pid 5533] +++ exited with 0 +++ [pid 5072] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=21, si_uid=0, si_status=0, si_utime=0, si_stime=7 /* 0.07 s */} --- [pid 5072] umount2("./19", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5072] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5072] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5072] umount2("./19/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./19/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5072] unlink("./19/binderfs") = 0 [pid 5072] umount2("./19/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./19/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5072] unlink("./19/cgroup") = 0 [pid 5072] umount2("./19/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./19/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5072] unlink("./19/cgroup.net") = 0 [pid 5072] umount2("./19/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5072] umount2("./19/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./19/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5072] umount2("./19/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 138.125687][ T5537] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 138.133712][ T5537] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 138.141732][ T5537] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000016 [ 138.149776][ T5537] [pid 5072] openat(AT_FDCWD, "./19/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5072] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5072] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5072] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5072] close(4) = 0 [pid 5072] rmdir("./19/file0") = 0 [pid 5072] umount2("./19/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./19/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5072] unlink("./19/cgroup.cpu") = 0 [pid 5072] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5072] close(3) = 0 [pid 5072] rmdir("./19") = 0 [pid 5072] mkdir("./20", 0777) = 0 [pid 5072] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5559 attached [pid 5559] chdir("./20" [pid 5072] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 22 [pid 5559] <... chdir resumed>) = 0 [pid 5559] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5559] setpgid(0, 0) = 0 [pid 5559] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 5559] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [ 138.216729][ T5537] memory: usage 8kB, limit 0kB, failcnt 55 [ 138.222928][ T5537] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [pid 5559] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 5559] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5559] write(3, "1000", 4) = 4 [ 138.260153][ T5537] Memory cgroup stats for /syz1: [ 138.260367][ T5537] anon 0 [ 138.260367][ T5537] file 0 [ 138.260367][ T5537] kernel 8192 [ 138.260367][ T5537] kernel_stack 0 [ 138.260367][ T5537] pagetables 0 [ 138.260367][ T5537] sec_pagetables 0 [ 138.260367][ T5537] percpu 0 [ 138.260367][ T5537] sock 0 [ 138.260367][ T5537] vmalloc 0 [ 138.260367][ T5537] shmem 0 [ 138.260367][ T5537] zswap 0 [ 138.260367][ T5537] zswapped 0 [ 138.260367][ T5537] file_mapped 0 [ 138.260367][ T5537] file_dirty 0 [ 138.260367][ T5537] file_writeback 0 [ 138.260367][ T5537] swapcached 0 [ 138.260367][ T5537] anon_thp 0 [ 138.260367][ T5537] file_thp 0 [ 138.260367][ T5537] shmem_thp 0 [ 138.260367][ T5537] inactive_anon 0 [ 138.260367][ T5537] active_anon 0 [ 138.260367][ T5537] inactive_file 0 [ 138.260367][ T5537] active_file 0 [ 138.260367][ T5537] unevictable 0 [ 138.260367][ T5537] slab_reclaimable 6752 [ 138.260367][ T5537] slab_unreclaimable 0 [ 138.260367][ T5537] slab 6752 [ 138.260367][ T5537] workingset_refault_anon 0 [pid 5559] close(3) = 0 [pid 5559] symlink("/dev/binderfs", "./binderfs" [pid 5537] <... write resumed>) = 18 [pid 5559] <... symlink resumed>) = 0 [pid 5537] close(3 [pid 5559] mkdir("./file0", 000 [pid 5537] <... close resumed>) = 0 [pid 5559] <... mkdir resumed>) = 0 [ 138.363477][ T5537] Tasks state (memory values in pages): [ 138.376634][ T5537] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 138.386359][ T5537] Out of memory and no killable processes... [ 138.400357][ T5541] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 138.416686][ T5541] CPU: 0 PID: 5541 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 138.427176][ T5541] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 138.437316][ T5541] Call Trace: [ 138.440631][ T5541] [ 138.443595][ T5541] dump_stack_lvl+0x1e7/0x2d0 [ 138.448330][ T5541] ? nf_tcp_handle_invalid+0x640/0x640 [ 138.453839][ T5541] ? panic+0x770/0x770 [ 138.457970][ T5541] dump_header+0xdc/0x940 [ 138.462364][ T5541] out_of_memory+0xf21/0x12c0 [ 138.467097][ T5541] ? mutex_lock_io_nested+0x60/0x60 [ 138.472358][ T5541] ? preempt_schedule+0xdd/0xf0 [ 138.477251][ T5541] ? unregister_oom_notifier+0x20/0x20 [ 138.482739][ T5541] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 138.488762][ T5541] mem_cgroup_out_of_memory+0x263/0x3b0 [ 138.494327][ T5541] ? preempt_schedule_thunk+0x1a/0x20 [ 138.499738][ T5541] ? mem_cgroup_oom_trylock+0x210/0x210 [ 138.505314][ T5541] ? cgroup_file_notify+0x127/0x190 [ 138.510534][ T5541] memory_max_write+0x355/0x470 [ 138.515407][ T5541] ? memory_max_show+0xa0/0xa0 [ 138.520190][ T5541] ? read_lock_is_recursive+0x20/0x20 [ 138.525582][ T5541] ? memory_max_show+0xa0/0xa0 [ 138.530368][ T5541] cgroup_file_write+0x2b1/0x780 [ 138.535323][ T5541] ? cgroup_seqfile_stop+0xd0/0xd0 [ 138.540445][ T5541] ? __virt_addr_valid+0x22f/0x2e0 [ 138.545582][ T5541] ? cgroup_seqfile_stop+0xd0/0xd0 [ 138.550711][ T5541] kernfs_fop_write_iter+0x3a6/0x4f0 [ 138.556031][ T5541] vfs_write+0x7b2/0xbb0 [ 138.560303][ T5541] ? file_end_write+0x240/0x240 [ 138.565174][ T5541] ? do_raw_spin_unlock+0x13b/0x8b0 [ 138.570389][ T5541] ? lockdep_hardirqs_on+0x98/0x140 [ 138.575615][ T5541] ? __fdget_pos+0x265/0x2f0 [ 138.580223][ T5541] ksys_write+0x1a0/0x2c0 [ 138.584579][ T5541] ? __ia32_sys_read+0x90/0x90 [ 138.589359][ T5541] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 138.595363][ T5541] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 138.601369][ T5541] do_syscall_64+0x41/0xc0 [ 138.605804][ T5541] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 138.611721][ T5541] RIP: 0033:0x7fd49ce20129 [ 138.616157][ T5541] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 138.635779][ T5541] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 138.644214][ T5541] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 138.652221][ T5541] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 138.660218][ T5541] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [pid 5537] close(4 [pid 5559] open("./file0", O_RDONLY) = 3 [pid 5537] <... close resumed>) = 0 [pid 5559] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5537] close(5 [pid 5559] <... mount resumed>) = 0 [pid 5537] <... close resumed>) = 0 [pid 5559] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5537] close(6 [pid 5559] <... openat resumed>) = 4 [pid 5537] <... close resumed>) = 0 [pid 5559] openat(4, "syz1", O_RDWR|O_PATH [pid 5537] close(7 [pid 5559] <... openat resumed>) = 5 [pid 5537] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5559] openat(5, "memory.max", O_RDWR [pid 5537] close(8 [pid 5559] <... openat resumed>) = 6 [pid 5537] <... close resumed>) = -1 EBADF (Bad file descriptor) [ 138.668204][ T5541] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 138.676202][ T5541] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 000000000000001a [ 138.684217][ T5541] [pid 5559] write(6, "0x000000000000040e", 18 [pid 5537] close(9) = -1 EBADF (Bad file descriptor) [pid 5537] close(10) = -1 EBADF (Bad file descriptor) [ 138.726693][ T5541] memory: usage 8kB, limit 0kB, failcnt 55 [ 138.732736][ T5541] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 138.746225][ T5541] Memory cgroup stats for /syz1: [ 138.746398][ T5541] anon 0 [ 138.746398][ T5541] file 0 [ 138.746398][ T5541] kernel 8192 [ 138.746398][ T5541] kernel_stack 0 [ 138.746398][ T5541] pagetables 0 [ 138.746398][ T5541] sec_pagetables 0 [ 138.746398][ T5541] percpu 0 [ 138.746398][ T5541] sock 0 [ 138.746398][ T5541] vmalloc 0 [ 138.746398][ T5541] shmem 0 [ 138.746398][ T5541] zswap 0 [ 138.746398][ T5541] zswapped 0 [ 138.746398][ T5541] file_mapped 0 [ 138.746398][ T5541] file_dirty 0 [ 138.746398][ T5541] file_writeback 0 [ 138.746398][ T5541] swapcached 0 [ 138.746398][ T5541] anon_thp 0 [ 138.746398][ T5541] file_thp 0 [ 138.746398][ T5541] shmem_thp 0 [ 138.746398][ T5541] inactive_anon 0 [ 138.746398][ T5541] active_anon 0 [ 138.746398][ T5541] inactive_file 0 [ 138.746398][ T5541] active_file 0 [ 138.746398][ T5541] unevictable 0 [ 138.746398][ T5541] slab_reclaimable 6752 [ 138.746398][ T5541] slab_unreclaimable 0 [ 138.746398][ T5541] slab 6752 [ 138.746398][ T5541] workingset_refault_anon 0 [ 138.853543][ T5541] Tasks state (memory values in pages): [ 138.859324][ T5541] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5541] <... write resumed>) = 18 [pid 5537] close(11 [pid 5541] close(3 [pid 5537] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5541] <... close resumed>) = 0 [ 138.876503][ T5541] Out of memory and no killable processes... [ 138.886966][ T5545] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 138.901397][ T5545] CPU: 0 PID: 5545 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 138.911893][ T5545] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 138.921993][ T5545] Call Trace: [ 138.925307][ T5545] [ 138.928285][ T5545] dump_stack_lvl+0x1e7/0x2d0 [ 138.933029][ T5545] ? nf_tcp_handle_invalid+0x640/0x640 [ 138.938546][ T5545] ? panic+0x770/0x770 [ 138.942688][ T5545] dump_header+0xdc/0x940 [ 138.947073][ T5545] out_of_memory+0xf21/0x12c0 [ 138.951813][ T5545] ? mutex_lock_io_nested+0x60/0x60 [ 138.957073][ T5545] ? mark_lock+0x9a/0x340 [ 138.961448][ T5545] ? unregister_oom_notifier+0x20/0x20 [ 138.966961][ T5545] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 138.973015][ T5545] mem_cgroup_out_of_memory+0x263/0x3b0 [ 138.978625][ T5545] ? mem_cgroup_oom_trylock+0x210/0x210 [ 138.984251][ T5545] ? cgroup_file_notify+0x127/0x190 [ 138.989515][ T5545] memory_max_write+0x355/0x470 [ 138.994431][ T5545] ? memory_max_show+0xa0/0xa0 [ 138.999337][ T5545] ? read_lock_is_recursive+0x20/0x20 [ 139.004769][ T5545] ? memory_max_show+0xa0/0xa0 [ 139.009587][ T5545] cgroup_file_write+0x2b1/0x780 [ 139.014673][ T5545] ? cgroup_seqfile_stop+0xd0/0xd0 [ 139.019837][ T5545] ? __virt_addr_valid+0x22f/0x2e0 [ 139.025014][ T5545] ? cgroup_seqfile_stop+0xd0/0xd0 [ 139.030165][ T5545] kernfs_fop_write_iter+0x3a6/0x4f0 [ 139.035511][ T5545] vfs_write+0x7b2/0xbb0 [ 139.039817][ T5545] ? file_end_write+0x240/0x240 [ 139.044734][ T5545] ? do_raw_spin_unlock+0x13b/0x8b0 [ 139.049982][ T5545] ? lockdep_hardirqs_on+0x98/0x140 [ 139.055238][ T5545] ? __fdget_pos+0x265/0x2f0 [ 139.059878][ T5545] ksys_write+0x1a0/0x2c0 [ 139.064261][ T5545] ? __ia32_sys_read+0x90/0x90 [ 139.069073][ T5545] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 139.075106][ T5545] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 139.081140][ T5545] do_syscall_64+0x41/0xc0 [ 139.085609][ T5545] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 139.091554][ T5545] RIP: 0033:0x7fd49ce20129 [ 139.096006][ T5545] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 139.115660][ T5545] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 5541] close(4) = 0 [pid 5541] close(5) = 0 [pid 5541] close(6) = 0 [pid 5541] close(7) = -1 EBADF (Bad file descriptor) [pid 5541] close(8) = -1 EBADF (Bad file descriptor) [pid 5541] close(9) = -1 EBADF (Bad file descriptor) [pid 5541] close(10) = -1 EBADF (Bad file descriptor) [pid 5541] close(11) = -1 EBADF (Bad file descriptor) [pid 5541] close(12) = -1 EBADF (Bad file descriptor) [pid 5541] close(13) = -1 EBADF (Bad file descriptor) [pid 5541] close(14) = -1 EBADF (Bad file descriptor) [pid 5541] close(15) = -1 EBADF (Bad file descriptor) [pid 5541] close(16) = -1 EBADF (Bad file descriptor) [pid 5541] close(17) = -1 EBADF (Bad file descriptor) [pid 5541] close(18) = -1 EBADF (Bad file descriptor) [pid 5541] close(19) = -1 EBADF (Bad file descriptor) [ 139.124140][ T5545] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 139.132266][ T5545] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 139.140272][ T5545] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 139.148276][ T5545] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 139.156300][ T5545] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000019 [ 139.164344][ T5545] [pid 5541] close(20) = -1 EBADF (Bad file descriptor) [pid 5541] close(21) = -1 EBADF (Bad file descriptor) [pid 5541] close(22) = -1 EBADF (Bad file descriptor) [pid 5541] close(23) = -1 EBADF (Bad file descriptor) [pid 5541] close(24) = -1 EBADF (Bad file descriptor) [pid 5541] close(25) = -1 EBADF (Bad file descriptor) [pid 5541] close(26) = -1 EBADF (Bad file descriptor) [pid 5541] close(27) = -1 EBADF (Bad file descriptor) [pid 5541] close(28) = -1 EBADF (Bad file descriptor) [pid 5541] close(29) = -1 EBADF (Bad file descriptor) [pid 5541] exit_group(0) = ? [pid 5541] +++ exited with 0 +++ [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=28, si_uid=0, si_status=0, si_utime=0, si_stime=10 /* 0.10 s */} --- [pid 5074] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5074] umount2("./26", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] openat(AT_FDCWD, "./26", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5074] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5537] close(12 [pid 5074] getdents64(3, [pid 5537] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5074] <... getdents64 resumed>0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5537] close(13 [pid 5074] umount2("./26/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5537] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5537] close(14 [pid 5074] lstat("./26/binderfs", [pid 5537] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5074] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5537] close(15 [pid 5074] unlink("./26/binderfs" [pid 5537] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5074] <... unlink resumed>) = 0 [pid 5537] close(16 [pid 5074] umount2("./26/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5537] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5537] close(17 [pid 5074] lstat("./26/cgroup", [pid 5537] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5074] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5537] close(18 [pid 5074] unlink("./26/cgroup" [pid 5537] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5074] <... unlink resumed>) = 0 [pid 5537] close(19 [pid 5074] umount2("./26/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5537] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./26/cgroup.net", [pid 5537] close(20 [pid 5074] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5537] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5074] unlink("./26/cgroup.net" [pid 5537] close(21 [pid 5074] <... unlink resumed>) = 0 [pid 5537] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5074] umount2("./26/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5537] close(22 [pid 5074] <... umount2 resumed>) = 0 [pid 5537] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5074] umount2("./26/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5537] close(23 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5537] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5074] lstat("./26/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5074] umount2("./26/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] openat(AT_FDCWD, "./26/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5537] close(24 [pid 5074] fstat(4, [pid 5537] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5074] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5537] close(25 [pid 5074] getdents64(4, [pid 5537] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5074] <... getdents64 resumed>0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5537] close(26 [pid 5074] getdents64(4, [pid 5537] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5074] <... getdents64 resumed>0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5537] close(27 [pid 5074] close(4 [pid 5537] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5074] <... close resumed>) = 0 [pid 5537] close(28 [pid 5074] rmdir("./26/file0" [pid 5537] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5074] <... rmdir resumed>) = 0 [ 139.300819][ T5545] memory: usage 8kB, limit 0kB, failcnt 55 [ 139.320213][ T5545] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 139.344458][ T5545] Memory cgroup stats for /syz1: [pid 5074] umount2("./26/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./26/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5074] unlink("./26/cgroup.cpu") = 0 [pid 5074] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5074] close(3) = 0 [pid 5074] rmdir("./26") = 0 [pid 5074] mkdir("./27", 0777) = 0 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555574ac5d0) = 29 [ 139.344735][ T5545] anon 0 [ 139.344735][ T5545] file 0 [ 139.344735][ T5545] kernel 8192 [ 139.344735][ T5545] kernel_stack 0 [ 139.344735][ T5545] pagetables 0 [ 139.344735][ T5545] sec_pagetables 0 [ 139.344735][ T5545] percpu 0 [ 139.344735][ T5545] sock 0 [ 139.344735][ T5545] vmalloc 0 [ 139.344735][ T5545] shmem 0 [ 139.344735][ T5545] zswap 0 [ 139.344735][ T5545] zswapped 0 [ 139.344735][ T5545] file_mapped 0 [ 139.344735][ T5545] file_dirty 0 [ 139.344735][ T5545] file_writeback 0 [ 139.344735][ T5545] swapcached 0 [pid 5537] close(29) = -1 EBADF (Bad file descriptor) [pid 5537] exit_group(0) = ? [pid 5537] +++ exited with 0 +++ [pid 5073] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=24, si_uid=0, si_status=0, si_utime=0, si_stime=6 /* 0.06 s */} --- [pid 5073] umount2("./22", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] openat(AT_FDCWD, "./22", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5073] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5073] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5073] umount2("./22/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./22/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5073] unlink("./22/binderfs") = 0 [pid 5073] umount2("./22/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5566 attached ) = -1 EINVAL (Invalid argument) [pid 5566] chdir("./27" [pid 5073] lstat("./22/cgroup", [pid 5566] <... chdir resumed>) = 0 [pid 5073] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5566] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5073] unlink("./22/cgroup" [pid 5566] <... prctl resumed>) = 0 [pid 5073] <... unlink resumed>) = 0 [pid 5566] setpgid(0, 0 [pid 5073] umount2("./22/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5566] <... setpgid resumed>) = 0 [pid 5073] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5566] symlink("/syzcgroup/unified/syz3", "./cgroup" [pid 5073] lstat("./22/cgroup.net", [pid 5566] <... symlink resumed>) = 0 [pid 5073] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5566] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu" [pid 5073] unlink("./22/cgroup.net" [pid 5566] <... symlink resumed>) = 0 [pid 5073] <... unlink resumed>) = 0 [pid 5566] symlink("/syzcgroup/net/syz3", "./cgroup.net" [pid 5073] umount2("./22/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5566] <... symlink resumed>) = 0 [pid 5566] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [ 139.344735][ T5545] anon_thp 0 [ 139.344735][ T5545] file_thp 0 [ 139.344735][ T5545] shmem_thp 0 [ 139.344735][ T5545] inactive_anon 0 [ 139.344735][ T5545] active_anon 0 [ 139.344735][ T5545] inactive_file 0 [ 139.344735][ T5545] active_file 0 [ 139.344735][ T5545] unevictable 0 [ 139.344735][ T5545] slab_reclaimable 6752 [ 139.344735][ T5545] slab_unreclaimable 0 [ 139.344735][ T5545] slab 6752 [ 139.344735][ T5545] workingset_refault_anon 0 [pid 5566] write(3, "1000", 4) = 4 [pid 5566] close(3) = 0 [pid 5566] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5566] mkdir("./file0", 000) = 0 [pid 5566] open("./file0", O_RDONLY) = 3 [pid 5566] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5566] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5566] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5073] <... umount2 resumed>) = 0 [pid 5073] umount2("./22/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./22/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5073] umount2("./22/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5566] openat(5, "memory.max", O_RDWR [pid 5073] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5566] <... openat resumed>) = 6 [pid 5073] openat(AT_FDCWD, "./22/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5566] write(6, "0x000000000000040e", 18 [pid 5073] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5073] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5073] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5073] close(4) = 0 [pid 5073] rmdir("./22/file0") = 0 [pid 5073] umount2("./22/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./22/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5073] unlink("./22/cgroup.cpu") = 0 [pid 5073] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5073] close(3) = 0 [pid 5073] rmdir("./22") = 0 [pid 5073] mkdir("./23", 0777) = 0 [pid 5073] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5567 attached [pid 5567] chdir("./23" [pid 5073] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 25 [pid 5567] <... chdir resumed>) = 0 [pid 5567] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5567] setpgid(0, 0) = 0 [pid 5567] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 5567] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 5567] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [pid 5567] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5567] write(3, "1000", 4) = 4 [pid 5567] close(3) = 0 [pid 5567] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5567] mkdir("./file0", 000) = 0 [pid 5567] open("./file0", O_RDONLY) = 3 [pid 5567] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5567] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5567] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5567] openat(5, "memory.max", O_RDWR) = 6 [ 139.649546][ T5545] Tasks state (memory values in pages): [ 139.655168][ T5545] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5567] write(6, "0x000000000000040e", 18 [pid 5545] <... write resumed>) = 18 [ 139.701105][ T5545] Out of memory and no killable processes... [ 139.715341][ T5549] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 139.725860][ T5549] CPU: 0 PID: 5549 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 139.736328][ T5549] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 139.746415][ T5549] Call Trace: [ 139.749735][ T5549] [ 139.752703][ T5549] dump_stack_lvl+0x1e7/0x2d0 [ 139.757435][ T5549] ? nf_tcp_handle_invalid+0x640/0x640 [ 139.762958][ T5549] ? panic+0x770/0x770 [ 139.767096][ T5549] dump_header+0xdc/0x940 [ 139.771488][ T5549] out_of_memory+0xf21/0x12c0 [ 139.776223][ T5549] ? mutex_lock_io_nested+0x60/0x60 [ 139.781480][ T5549] ? mark_lock+0x9a/0x340 [ 139.785860][ T5549] ? unregister_oom_notifier+0x20/0x20 [ 139.791364][ T5549] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 139.797413][ T5549] mem_cgroup_out_of_memory+0x263/0x3b0 [ 139.803027][ T5549] ? mem_cgroup_oom_trylock+0x210/0x210 [ 139.808649][ T5549] ? cgroup_file_notify+0x127/0x190 [ 139.813916][ T5549] memory_max_write+0x355/0x470 [ 139.818824][ T5549] ? memory_max_show+0xa0/0xa0 [ 139.823641][ T5549] ? read_lock_is_recursive+0x20/0x20 [ 139.829082][ T5549] ? memory_max_show+0xa0/0xa0 [ 139.833904][ T5549] cgroup_file_write+0x2b1/0x780 [ 139.838897][ T5549] ? cgroup_seqfile_stop+0xd0/0xd0 [ 139.844056][ T5549] ? __virt_addr_valid+0x22f/0x2e0 [ 139.849235][ T5549] ? cgroup_seqfile_stop+0xd0/0xd0 [ 139.854386][ T5549] kernfs_fop_write_iter+0x3a6/0x4f0 [ 139.859728][ T5549] vfs_write+0x7b2/0xbb0 [ 139.864032][ T5549] ? file_end_write+0x240/0x240 [ 139.868936][ T5549] ? do_raw_spin_unlock+0x13b/0x8b0 [ 139.874187][ T5549] ? lockdep_hardirqs_on+0x98/0x140 [ 139.879440][ T5549] ? __fdget_pos+0x265/0x2f0 [ 139.884082][ T5549] ksys_write+0x1a0/0x2c0 [ 139.888473][ T5549] ? __ia32_sys_read+0x90/0x90 [ 139.893282][ T5549] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 139.899325][ T5549] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 139.905374][ T5549] do_syscall_64+0x41/0xc0 [ 139.909865][ T5549] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 139.915811][ T5549] RIP: 0033:0x7fd49ce20129 [ 139.920283][ T5549] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 139.939941][ T5549] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 5545] close(3) = 0 [pid 5545] close(4) = 0 [pid 5545] close(5) = 0 [pid 5545] close(6) = 0 [pid 5545] close(7) = -1 EBADF (Bad file descriptor) [pid 5545] close(8) = -1 EBADF (Bad file descriptor) [pid 5545] close(9) = -1 EBADF (Bad file descriptor) [ 139.948414][ T5549] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 139.956460][ T5549] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 139.964470][ T5549] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 139.972482][ T5549] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 139.980505][ T5549] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000013 [ 139.988507][ T5549] [pid 5545] close(10) = -1 EBADF (Bad file descriptor) [pid 5545] close(11) = -1 EBADF (Bad file descriptor) [pid 5545] close(12) = -1 EBADF (Bad file descriptor) [pid 5545] close(13) = -1 EBADF (Bad file descriptor) [pid 5545] close(14) = -1 EBADF (Bad file descriptor) [ 140.030683][ T5549] memory: usage 8kB, limit 0kB, failcnt 55 [ 140.039628][ T5549] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 140.055079][ T5549] Memory cgroup stats for /syz1: [ 140.055294][ T5549] anon 0 [ 140.055294][ T5549] file 0 [ 140.055294][ T5549] kernel 8192 [ 140.055294][ T5549] kernel_stack 0 [ 140.055294][ T5549] pagetables 0 [ 140.055294][ T5549] sec_pagetables 0 [ 140.055294][ T5549] percpu 0 [ 140.055294][ T5549] sock 0 [ 140.055294][ T5549] vmalloc 0 [ 140.055294][ T5549] shmem 0 [ 140.055294][ T5549] zswap 0 [ 140.055294][ T5549] zswapped 0 [ 140.055294][ T5549] file_mapped 0 [ 140.055294][ T5549] file_dirty 0 [ 140.055294][ T5549] file_writeback 0 [ 140.055294][ T5549] swapcached 0 [ 140.055294][ T5549] anon_thp 0 [ 140.055294][ T5549] file_thp 0 [ 140.055294][ T5549] shmem_thp 0 [ 140.055294][ T5549] inactive_anon 0 [ 140.055294][ T5549] active_anon 0 [ 140.055294][ T5549] inactive_file 0 [pid 5545] close(15) = -1 EBADF (Bad file descriptor) [ 140.055294][ T5549] active_file 0 [ 140.055294][ T5549] unevictable 0 [ 140.055294][ T5549] slab_reclaimable 6752 [ 140.055294][ T5549] slab_unreclaimable 0 [ 140.055294][ T5549] slab 6752 [ 140.055294][ T5549] workingset_refault_anon 0 [ 140.161666][ T5549] Tasks state (memory values in pages): [ 140.168886][ T5549] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5545] close(16) = -1 EBADF (Bad file descriptor) [pid 5549] <... write resumed>) = 18 [pid 5545] close(17 [pid 5549] close(3 [pid 5545] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5549] <... close resumed>) = 0 [ 140.184367][ T5549] Out of memory and no killable processes... [ 140.192576][ T5559] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 140.208854][ T5559] CPU: 1 PID: 5559 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 140.219351][ T5559] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 140.229453][ T5559] Call Trace: [ 140.232767][ T5559] [ 140.235739][ T5559] dump_stack_lvl+0x1e7/0x2d0 [ 140.240473][ T5559] ? nf_tcp_handle_invalid+0x640/0x640 [ 140.245993][ T5559] ? panic+0x770/0x770 [ 140.250127][ T5559] dump_header+0xdc/0x940 [ 140.254511][ T5559] out_of_memory+0xf21/0x12c0 [ 140.259243][ T5559] ? mutex_lock_io_nested+0x60/0x60 [ 140.264494][ T5559] ? mark_lock+0x9a/0x340 [ 140.268866][ T5559] ? unregister_oom_notifier+0x20/0x20 [ 140.274363][ T5559] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 140.280378][ T5559] mem_cgroup_out_of_memory+0x263/0x3b0 [ 140.285952][ T5559] ? mem_cgroup_oom_trylock+0x210/0x210 [ 140.291531][ T5559] ? cgroup_file_notify+0x127/0x190 [ 140.296752][ T5559] memory_max_write+0x355/0x470 [ 140.301635][ T5559] ? memory_max_show+0xa0/0xa0 [ 140.306516][ T5559] ? read_lock_is_recursive+0x20/0x20 [ 140.311944][ T5559] ? memory_max_show+0xa0/0xa0 [ 140.316726][ T5559] cgroup_file_write+0x2b1/0x780 [ 140.321686][ T5559] ? cgroup_seqfile_stop+0xd0/0xd0 [ 140.326811][ T5559] ? __virt_addr_valid+0x22f/0x2e0 [ 140.331959][ T5559] ? cgroup_seqfile_stop+0xd0/0xd0 [ 140.337084][ T5559] kernfs_fop_write_iter+0x3a6/0x4f0 [ 140.342391][ T5559] vfs_write+0x7b2/0xbb0 [ 140.346661][ T5559] ? file_end_write+0x240/0x240 [ 140.351534][ T5559] ? do_raw_spin_unlock+0x13b/0x8b0 [ 140.356752][ T5559] ? lockdep_hardirqs_on+0x98/0x140 [ 140.361979][ T5559] ? __fdget_pos+0x265/0x2f0 [ 140.366615][ T5559] ksys_write+0x1a0/0x2c0 [ 140.370996][ T5559] ? __ia32_sys_read+0x90/0x90 [ 140.375787][ T5559] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 140.381805][ T5559] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 140.387818][ T5559] do_syscall_64+0x41/0xc0 [ 140.392291][ T5559] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 140.398209][ T5559] RIP: 0033:0x7fd49ce20129 [ 140.402638][ T5559] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 140.422258][ T5559] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 5549] close(4 [pid 5545] close(18 [pid 5549] <... close resumed>) = 0 [pid 5545] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5549] close(5 [pid 5545] close(19 [pid 5549] <... close resumed>) = 0 [pid 5545] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5549] close(6 [pid 5545] close(20 [pid 5549] <... close resumed>) = 0 [pid 5545] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5549] close(7 [pid 5545] close(21 [pid 5549] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5545] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5549] close(8 [pid 5545] close(22 [pid 5549] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5545] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5549] close(9 [pid 5545] close(23 [pid 5549] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5545] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5549] close(10 [pid 5545] close(24 [pid 5549] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5545] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5549] close(11 [pid 5545] close(25 [pid 5549] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5545] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5549] close(12 [pid 5545] close(26 [pid 5549] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5545] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5549] close(13 [pid 5545] close(27 [pid 5549] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5545] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5549] close(14 [pid 5545] close(28 [pid 5549] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5545] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5549] close(15 [pid 5545] close(29 [pid 5549] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5545] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5549] close(16 [pid 5545] exit_group(0 [pid 5549] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5545] <... exit_group resumed>) = ? [pid 5549] close(17 [pid 5545] +++ exited with 0 +++ [pid 5549] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5549] close(18) = -1 EBADF (Bad file descriptor) [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=27, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- [pid 5549] close(19) = -1 EBADF (Bad file descriptor) [pid 5549] close(20) = -1 EBADF (Bad file descriptor) [pid 5075] umount2("./25", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5549] close(21) = -1 EBADF (Bad file descriptor) [pid 5549] close(22) = -1 EBADF (Bad file descriptor) [pid 5549] close(23 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5549] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5549] close(24) = -1 EBADF (Bad file descriptor) [pid 5549] close(25) = -1 EBADF (Bad file descriptor) [pid 5075] openat(AT_FDCWD, "./25", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5549] close(26) = -1 EBADF (Bad file descriptor) [pid 5549] close(27 [pid 5075] <... openat resumed>) = 3 [pid 5549] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5549] close(28 [pid 5075] fstat(3, [pid 5549] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5075] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5549] close(29) = -1 EBADF (Bad file descriptor) [pid 5075] getdents64(3, [pid 5549] exit_group(0) = ? [pid 5549] +++ exited with 0 +++ [pid 5075] <... getdents64 resumed>0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5075] umount2("./25/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5070] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=21, si_uid=0, si_status=0, si_utime=0, si_stime=10 /* 0.10 s */} --- [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [ 140.430700][ T5559] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 140.438687][ T5559] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 140.446672][ T5559] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 140.454655][ T5559] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 140.462637][ T5559] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000014 [ 140.470640][ T5559] [pid 5075] lstat("./25/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5070] umount2("./19", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] unlink("./25/binderfs" [pid 5070] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] <... unlink resumed>) = 0 [pid 5075] umount2("./25/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5070] openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5070] fstat(3, [pid 5075] lstat("./25/cgroup", [pid 5070] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5075] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5070] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5075] unlink("./25/cgroup" [pid 5070] umount2("./19/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] <... unlink resumed>) = 0 [pid 5070] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] umount2("./25/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5070] lstat("./19/binderfs", [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5070] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5075] lstat("./25/cgroup.net", [pid 5070] unlink("./19/binderfs" [pid 5075] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5070] <... unlink resumed>) = 0 [pid 5075] unlink("./25/cgroup.net" [pid 5070] umount2("./19/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] <... unlink resumed>) = 0 [pid 5070] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] umount2("./25/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5070] lstat("./19/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5070] unlink("./19/cgroup" [pid 5075] <... umount2 resumed>) = 0 [pid 5070] <... unlink resumed>) = 0 [pid 5075] umount2("./25/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5070] umount2("./19/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./25/file0", [pid 5070] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./19/cgroup.net", [pid 5075] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5075] umount2("./25/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5070] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5070] unlink("./19/cgroup.net" [pid 5075] openat(AT_FDCWD, "./25/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5070] <... unlink resumed>) = 0 [pid 5075] <... openat resumed>) = 4 [pid 5075] fstat(4, [pid 5070] umount2("./19/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [ 140.504288][ T5559] memory: usage 8kB, limit 0kB, failcnt 55 [ 140.527717][ T5559] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 140.540670][ T5559] Memory cgroup stats for /syz1: [ 140.540889][ T5559] anon 0 [ 140.540889][ T5559] file 0 [ 140.540889][ T5559] kernel 8192 [ 140.540889][ T5559] kernel_stack 0 [ 140.540889][ T5559] pagetables 0 [ 140.540889][ T5559] sec_pagetables 0 [ 140.540889][ T5559] percpu 0 [ 140.540889][ T5559] sock 0 [ 140.540889][ T5559] vmalloc 0 [ 140.540889][ T5559] shmem 0 [ 140.540889][ T5559] zswap 0 [ 140.540889][ T5559] zswapped 0 [ 140.540889][ T5559] file_mapped 0 [ 140.540889][ T5559] file_dirty 0 [ 140.540889][ T5559] file_writeback 0 [ 140.540889][ T5559] swapcached 0 [ 140.540889][ T5559] anon_thp 0 [ 140.540889][ T5559] file_thp 0 [ 140.540889][ T5559] shmem_thp 0 [ 140.540889][ T5559] inactive_anon 0 [pid 5075] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5070] <... umount2 resumed>) = 0 [pid 5075] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5075] close(4) = 0 [pid 5075] rmdir("./25/file0") = 0 [pid 5075] umount2("./25/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./25/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5075] unlink("./25/cgroup.cpu") = 0 [pid 5075] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5075] close(3) = 0 [pid 5075] rmdir("./25") = 0 [pid 5075] mkdir("./26", 0777) = 0 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5575 attached , child_tidptr=0x5555574ac5d0) = 28 [pid 5575] chdir("./26") = 0 [pid 5575] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5575] setpgid(0, 0) = 0 [pid 5575] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 5575] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 5575] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 5575] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5575] write(3, "1000", 4) = 4 [pid 5575] close(3) = 0 [pid 5575] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5575] mkdir("./file0", 000) = 0 [pid 5575] open("./file0", O_RDONLY) = 3 [pid 5575] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5575] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5575] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5575] openat(5, "memory.max", O_RDWR) = 6 [pid 5575] write(6, "0x000000000000040e", 18 [pid 5070] umount2("./19/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./19/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [ 140.540889][ T5559] active_anon 0 [ 140.540889][ T5559] inactive_file 0 [ 140.540889][ T5559] active_file 0 [ 140.540889][ T5559] unevictable 0 [ 140.540889][ T5559] slab_reclaimable 6752 [ 140.540889][ T5559] slab_unreclaimable 0 [ 140.540889][ T5559] slab 6752 [ 140.540889][ T5559] workingset_refault_anon 0 [ 140.644605][ T5559] Tasks state (memory values in pages): [pid 5070] umount2("./19/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] openat(AT_FDCWD, "./19/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5070] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5559] <... write resumed>) = 18 [pid 5070] getdents64(4, [ 140.651593][ T5559] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 140.663549][ T5559] Out of memory and no killable processes... [ 140.671071][ T5566] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 140.688872][ T5566] CPU: 1 PID: 5566 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [pid 5559] close(3) = 0 [pid 5070] <... getdents64 resumed>0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5559] close(4) = 0 [pid 5559] close(5) = 0 [pid 5559] close(6) = 0 [pid 5559] close(7) = -1 EBADF (Bad file descriptor) [pid 5559] close(8) = -1 EBADF (Bad file descriptor) [pid 5559] close(9) = -1 EBADF (Bad file descriptor) [pid 5559] close(10) = -1 EBADF (Bad file descriptor) [pid 5559] close(11) = -1 EBADF (Bad file descriptor) [pid 5559] close(12) = -1 EBADF (Bad file descriptor) [pid 5559] close(13) = -1 EBADF (Bad file descriptor) [pid 5559] close(14) = -1 EBADF (Bad file descriptor) [pid 5559] close(15) = -1 EBADF (Bad file descriptor) [pid 5559] close(16) = -1 EBADF (Bad file descriptor) [pid 5559] close(17) = -1 EBADF (Bad file descriptor) [ 140.699345][ T5566] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 140.709439][ T5566] Call Trace: [ 140.712755][ T5566] [ 140.715727][ T5566] dump_stack_lvl+0x1e7/0x2d0 [ 140.720467][ T5566] ? nf_tcp_handle_invalid+0x640/0x640 [ 140.725994][ T5566] ? panic+0x770/0x770 [ 140.730127][ T5566] dump_header+0xdc/0x940 [ 140.734530][ T5566] out_of_memory+0xf21/0x12c0 [ 140.739265][ T5566] ? mutex_lock_io_nested+0x60/0x60 [ 140.744530][ T5566] ? mark_lock+0x9a/0x340 [ 140.748912][ T5566] ? unregister_oom_notifier+0x20/0x20 [ 140.754427][ T5566] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 140.760485][ T5566] mem_cgroup_out_of_memory+0x263/0x3b0 [ 140.766105][ T5566] ? mem_cgroup_oom_trylock+0x210/0x210 [ 140.771739][ T5566] ? cgroup_file_notify+0x127/0x190 [ 140.776999][ T5566] memory_max_write+0x355/0x470 [ 140.781923][ T5566] ? memory_max_show+0xa0/0xa0 [ 140.786742][ T5566] ? read_lock_is_recursive+0x20/0x20 [ 140.792185][ T5566] ? memory_max_show+0xa0/0xa0 [ 140.796998][ T5566] cgroup_file_write+0x2b1/0x780 [ 140.801977][ T5566] ? cgroup_seqfile_stop+0xd0/0xd0 [ 140.807108][ T5566] ? __virt_addr_valid+0x22f/0x2e0 [ 140.812251][ T5566] ? cgroup_seqfile_stop+0xd0/0xd0 [ 140.817407][ T5566] kernfs_fop_write_iter+0x3a6/0x4f0 [ 140.822708][ T5566] vfs_write+0x7b2/0xbb0 [ 140.826970][ T5566] ? file_end_write+0x240/0x240 [ 140.831848][ T5566] ? do_raw_spin_unlock+0x13b/0x8b0 [ 140.837069][ T5566] ? lockdep_hardirqs_on+0x98/0x140 [ 140.842292][ T5566] ? __fdget_pos+0x265/0x2f0 [ 140.846921][ T5566] ksys_write+0x1a0/0x2c0 [ 140.851302][ T5566] ? __ia32_sys_read+0x90/0x90 [ 140.856080][ T5566] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 140.862079][ T5566] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 140.868083][ T5566] do_syscall_64+0x41/0xc0 [ 140.872516][ T5566] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 140.878429][ T5566] RIP: 0033:0x7fd49ce20129 [ 140.882856][ T5566] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 5559] close(18) = -1 EBADF (Bad file descriptor) [pid 5559] close(19) = -1 EBADF (Bad file descriptor) [pid 5559] close(20) = -1 EBADF (Bad file descriptor) [pid 5559] close(21) = -1 EBADF (Bad file descriptor) [pid 5559] close(22) = -1 EBADF (Bad file descriptor) [pid 5559] close(23) = -1 EBADF (Bad file descriptor) [pid 5559] close(24) = -1 EBADF (Bad file descriptor) [pid 5559] close(25) = -1 EBADF (Bad file descriptor) [pid 5559] close(26) = -1 EBADF (Bad file descriptor) [pid 5559] close(27) = -1 EBADF (Bad file descriptor) [pid 5559] close(28) = -1 EBADF (Bad file descriptor) [pid 5559] close(29) = -1 EBADF (Bad file descriptor) [pid 5559] exit_group(0) = ? [pid 5559] +++ exited with 0 +++ [pid 5072] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=22, si_uid=0, si_status=0, si_utime=0, si_stime=7 /* 0.07 s */} --- [pid 5072] umount2("./20", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] openat(AT_FDCWD, "./20", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5072] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5072] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5072] umount2("./20/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./20/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5072] unlink("./20/binderfs") = 0 [pid 5072] umount2("./20/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./20/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5072] unlink("./20/cgroup") = 0 [pid 5072] umount2("./20/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./20/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5072] unlink("./20/cgroup.net") = 0 [pid 5072] umount2("./20/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5070] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5070] close(4) = 0 [pid 5070] rmdir("./19/file0") = 0 [pid 5070] umount2("./19/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./19/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5070] unlink("./19/cgroup.cpu") = 0 [pid 5070] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5070] close(3) = 0 [pid 5070] rmdir("./19") = 0 [pid 5070] mkdir("./20", 0777) = 0 [pid 5070] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555574ac5d0) = 22 ./strace-static-x86_64: Process 5576 attached [pid 5072] <... umount2 resumed>) = 0 [pid 5576] chdir("./20") = 0 [pid 5072] umount2("./20/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5576] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5072] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5576] <... prctl resumed>) = 0 [pid 5072] lstat("./20/file0", [pid 5576] setpgid(0, 0) = 0 [pid 5072] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5576] symlink("/syzcgroup/unified/syz0", "./cgroup" [pid 5072] umount2("./20/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5576] <... symlink resumed>) = 0 [pid 5576] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu" [pid 5072] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5576] <... symlink resumed>) = 0 [ 140.902498][ T5566] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 140.910922][ T5566] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 140.918915][ T5566] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 140.926921][ T5566] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 140.934907][ T5566] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 140.942901][ T5566] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 000000000000001b [ 140.951002][ T5566] [pid 5576] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 5072] openat(AT_FDCWD, "./20/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5576] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5072] <... openat resumed>) = 4 [pid 5576] write(3, "1000", 4) = 4 [pid 5576] close(3) = 0 [pid 5576] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5072] fstat(4, [pid 5576] mkdir("./file0", 000) = 0 [pid 5072] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5576] open("./file0", O_RDONLY) = 3 [pid 5576] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5072] getdents64(4, [pid 5576] <... mount resumed>) = 0 [pid 5576] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5576] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5576] openat(5, "memory.max", O_RDWR) = 6 [pid 5072] <... getdents64 resumed>0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5576] write(6, "0x000000000000040e", 18 [pid 5072] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5072] close(4) = 0 [pid 5072] rmdir("./20/file0") = 0 [pid 5072] umount2("./20/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./20/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5072] unlink("./20/cgroup.cpu") = 0 [pid 5072] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5072] close(3) = 0 [pid 5072] rmdir("./20") = 0 [pid 5072] mkdir("./21", 0777) = 0 [pid 5072] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5579 attached , child_tidptr=0x5555574ac5d0) = 23 [pid 5579] chdir("./21") = 0 [pid 5579] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5579] setpgid(0, 0) = 0 [ 141.043413][ T5566] memory: usage 8kB, limit 0kB, failcnt 55 [ 141.055988][ T5566] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 141.067990][ T5566] Memory cgroup stats for /syz1: [ 141.068199][ T5566] anon 0 [ 141.068199][ T5566] file 0 [ 141.068199][ T5566] kernel 8192 [ 141.068199][ T5566] kernel_stack 0 [ 141.068199][ T5566] pagetables 0 [ 141.068199][ T5566] sec_pagetables 0 [ 141.068199][ T5566] percpu 0 [ 141.068199][ T5566] sock 0 [ 141.068199][ T5566] vmalloc 0 [ 141.068199][ T5566] shmem 0 [ 141.068199][ T5566] zswap 0 [ 141.068199][ T5566] zswapped 0 [ 141.068199][ T5566] file_mapped 0 [ 141.068199][ T5566] file_dirty 0 [ 141.068199][ T5566] file_writeback 0 [ 141.068199][ T5566] swapcached 0 [ 141.068199][ T5566] anon_thp 0 [ 141.068199][ T5566] file_thp 0 [ 141.068199][ T5566] shmem_thp 0 [ 141.068199][ T5566] inactive_anon 0 [ 141.068199][ T5566] active_anon 0 [ 141.068199][ T5566] inactive_file 0 [pid 5579] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 5579] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [pid 5579] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 5579] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [ 141.068199][ T5566] active_file 0 [ 141.068199][ T5566] unevictable 0 [ 141.068199][ T5566] slab_reclaimable 6752 [ 141.068199][ T5566] slab_unreclaimable 0 [ 141.068199][ T5566] slab 6752 [ 141.068199][ T5566] workingset_refault_anon 0 [ 141.168917][ T5566] Tasks state (memory values in pages): [ 141.174534][ T5566] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5579] write(3, "1000", 4) = 4 [pid 5579] close(3) = 0 [pid 5579] symlink("/dev/binderfs", "./binderfs" [pid 5566] <... write resumed>) = 18 [ 141.198625][ T5566] Out of memory and no killable processes... [ 141.205404][ T5567] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 141.224518][ T5567] CPU: 1 PID: 5567 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 141.235006][ T5567] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 141.245116][ T5567] Call Trace: [pid 5579] <... symlink resumed>) = 0 [pid 5566] close(3 [pid 5579] mkdir("./file0", 000 [pid 5566] <... close resumed>) = 0 [pid 5579] <... mkdir resumed>) = 0 [pid 5566] close(4 [pid 5579] open("./file0", O_RDONLY [pid 5566] <... close resumed>) = 0 [pid 5579] <... open resumed>) = 3 [pid 5566] close(5 [pid 5579] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5566] <... close resumed>) = 0 [pid 5579] <... mount resumed>) = 0 [pid 5566] close(6 [pid 5579] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5566] <... close resumed>) = 0 [pid 5579] <... openat resumed>) = 4 [pid 5566] close(7 [pid 5579] openat(4, "syz1", O_RDWR|O_PATH [pid 5566] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5579] <... openat resumed>) = 5 [pid 5566] close(8 [pid 5579] openat(5, "memory.max", O_RDWR [pid 5566] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5579] <... openat resumed>) = 6 [pid 5566] close(9 [pid 5579] write(6, "0x000000000000040e", 18 [pid 5566] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5566] close(10) = -1 EBADF (Bad file descriptor) [ 141.248430][ T5567] [ 141.251388][ T5567] dump_stack_lvl+0x1e7/0x2d0 [ 141.256109][ T5567] ? nf_tcp_handle_invalid+0x640/0x640 [ 141.261619][ T5567] ? panic+0x770/0x770 [ 141.265769][ T5567] dump_header+0xdc/0x940 [ 141.270149][ T5567] out_of_memory+0xf21/0x12c0 [ 141.274891][ T5567] ? mutex_lock_io_nested+0x60/0x60 [ 141.280144][ T5567] ? mark_lock+0x9a/0x340 [ 141.284521][ T5567] ? unregister_oom_notifier+0x20/0x20 [ 141.290029][ T5567] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [pid 5566] close(11) = -1 EBADF (Bad file descriptor) [pid 5566] close(12) = -1 EBADF (Bad file descriptor) [pid 5566] close(13) = -1 EBADF (Bad file descriptor) [pid 5566] close(14) = -1 EBADF (Bad file descriptor) [pid 5566] close(15) = -1 EBADF (Bad file descriptor) [pid 5566] close(16) = -1 EBADF (Bad file descriptor) [pid 5566] close(17) = -1 EBADF (Bad file descriptor) [pid 5566] close(18) = -1 EBADF (Bad file descriptor) [pid 5566] close(19) = -1 EBADF (Bad file descriptor) [pid 5566] close(20) = -1 EBADF (Bad file descriptor) [pid 5566] close(21) = -1 EBADF (Bad file descriptor) [pid 5566] close(22) = -1 EBADF (Bad file descriptor) [pid 5566] close(23) = -1 EBADF (Bad file descriptor) [ 141.296073][ T5567] mem_cgroup_out_of_memory+0x263/0x3b0 [ 141.301674][ T5567] ? mem_cgroup_oom_trylock+0x210/0x210 [ 141.307293][ T5567] ? cgroup_file_notify+0x127/0x190 [ 141.312568][ T5567] memory_max_write+0x355/0x470 [ 141.317487][ T5567] ? memory_max_show+0xa0/0xa0 [ 141.322317][ T5567] ? read_lock_is_recursive+0x20/0x20 [ 141.327747][ T5567] ? memory_max_show+0xa0/0xa0 [ 141.332571][ T5567] cgroup_file_write+0x2b1/0x780 [ 141.337573][ T5567] ? cgroup_seqfile_stop+0xd0/0xd0 [ 141.342733][ T5567] ? __virt_addr_valid+0x22f/0x2e0 [ 141.347916][ T5567] ? cgroup_seqfile_stop+0xd0/0xd0 [ 141.353073][ T5567] kernfs_fop_write_iter+0x3a6/0x4f0 [ 141.358421][ T5567] vfs_write+0x7b2/0xbb0 [ 141.362729][ T5567] ? file_end_write+0x240/0x240 [ 141.367649][ T5567] ? do_raw_spin_unlock+0x13b/0x8b0 [ 141.372905][ T5567] ? lockdep_hardirqs_on+0x98/0x140 [ 141.378169][ T5567] ? __fdget_pos+0x265/0x2f0 [ 141.382824][ T5567] ksys_write+0x1a0/0x2c0 [ 141.387217][ T5567] ? __ia32_sys_read+0x90/0x90 [ 141.392033][ T5567] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 141.398078][ T5567] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 141.404124][ T5567] do_syscall_64+0x41/0xc0 [ 141.408619][ T5567] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 141.414571][ T5567] RIP: 0033:0x7fd49ce20129 [ 141.419028][ T5567] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 141.438678][ T5567] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 5566] close(24) = -1 EBADF (Bad file descriptor) [pid 5566] close(25) = -1 EBADF (Bad file descriptor) [pid 5566] close(26) = -1 EBADF (Bad file descriptor) [pid 5566] close(27) = -1 EBADF (Bad file descriptor) [pid 5566] close(28) = -1 EBADF (Bad file descriptor) [pid 5566] close(29) = -1 EBADF (Bad file descriptor) [pid 5566] exit_group(0) = ? [pid 5566] +++ exited with 0 +++ [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=29, si_uid=0, si_status=0, si_utime=0, si_stime=6 /* 0.06 s */} --- [pid 5074] umount2("./27", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] openat(AT_FDCWD, "./27", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5074] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5074] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5074] umount2("./27/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./27/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5074] unlink("./27/binderfs") = 0 [pid 5074] umount2("./27/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./27/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5074] unlink("./27/cgroup") = 0 [pid 5074] umount2("./27/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./27/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5074] unlink("./27/cgroup.net") = 0 [pid 5074] umount2("./27/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5074] umount2("./27/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./27/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5074] umount2("./27/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] openat(AT_FDCWD, "./27/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5074] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5074] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5074] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5074] close(4) = 0 [pid 5074] rmdir("./27/file0") = 0 [pid 5074] umount2("./27/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./27/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5074] unlink("./27/cgroup.cpu") = 0 [pid 5074] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5074] close(3) = 0 [pid 5074] rmdir("./27") = 0 [pid 5074] mkdir("./28", 0777) = 0 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5586 attached [pid 5586] chdir("./28" [pid 5074] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 30 [ 141.447144][ T5567] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 141.455160][ T5567] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 141.463175][ T5567] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 141.471191][ T5567] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 141.479214][ T5567] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000017 [ 141.487255][ T5567] [pid 5586] <... chdir resumed>) = 0 [pid 5586] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5586] setpgid(0, 0) = 0 [pid 5586] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [pid 5586] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 5586] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 5586] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5586] write(3, "1000", 4) = 4 [pid 5586] close(3) = 0 [pid 5586] symlink("/dev/binderfs", "./binderfs") = 0 [ 141.523273][ T5567] memory: usage 8kB, limit 0kB, failcnt 55 [ 141.530881][ T5567] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 141.546747][ T5567] Memory cgroup stats for /syz1: [ 141.546965][ T5567] anon 0 [ 141.546965][ T5567] file 0 [ 141.546965][ T5567] kernel 8192 [ 141.546965][ T5567] kernel_stack 0 [ 141.546965][ T5567] pagetables 0 [ 141.546965][ T5567] sec_pagetables 0 [ 141.546965][ T5567] percpu 0 [ 141.546965][ T5567] sock 0 [ 141.546965][ T5567] vmalloc 0 [ 141.546965][ T5567] shmem 0 [ 141.546965][ T5567] zswap 0 [ 141.546965][ T5567] zswapped 0 [ 141.546965][ T5567] file_mapped 0 [ 141.546965][ T5567] file_dirty 0 [ 141.546965][ T5567] file_writeback 0 [ 141.546965][ T5567] swapcached 0 [ 141.546965][ T5567] anon_thp 0 [ 141.546965][ T5567] file_thp 0 [ 141.546965][ T5567] shmem_thp 0 [ 141.546965][ T5567] inactive_anon 0 [ 141.546965][ T5567] active_anon 0 [ 141.546965][ T5567] inactive_file 0 [ 141.546965][ T5567] active_file 0 [pid 5586] mkdir("./file0", 000) = 0 [pid 5586] open("./file0", O_RDONLY) = 3 [pid 5586] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5586] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5586] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5586] openat(5, "memory.max", O_RDWR) = 6 [ 141.546965][ T5567] unevictable 0 [ 141.546965][ T5567] slab_reclaimable 6752 [ 141.546965][ T5567] slab_unreclaimable 0 [ 141.546965][ T5567] slab 6752 [ 141.546965][ T5567] workingset_refault_anon 0 [ 141.660967][ T5567] Tasks state (memory values in pages): [pid 5586] write(6, "0x000000000000040e", 18 [pid 5567] <... write resumed>) = 18 [ 141.670088][ T5567] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 141.684474][ T5567] Out of memory and no killable processes... [ 141.694088][ T5575] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 141.713161][ T5575] CPU: 0 PID: 5575 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 141.723638][ T5575] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 141.733734][ T5575] Call Trace: [ 141.737049][ T5575] [ 141.740017][ T5575] dump_stack_lvl+0x1e7/0x2d0 [ 141.744754][ T5575] ? nf_tcp_handle_invalid+0x640/0x640 [ 141.750282][ T5575] ? panic+0x770/0x770 [ 141.754426][ T5575] dump_header+0xdc/0x940 [ 141.758813][ T5575] out_of_memory+0xf21/0x12c0 [ 141.763545][ T5575] ? mutex_lock_io_nested+0x60/0x60 [ 141.768814][ T5575] ? preempt_schedule+0xdd/0xf0 [ 141.773717][ T5575] ? unregister_oom_notifier+0x20/0x20 [ 141.779222][ T5575] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 141.785264][ T5575] mem_cgroup_out_of_memory+0x263/0x3b0 [ 141.790861][ T5575] ? preempt_schedule_thunk+0x1a/0x20 [ 141.796288][ T5575] ? mem_cgroup_oom_trylock+0x210/0x210 [ 141.801904][ T5575] ? cgroup_file_notify+0x127/0x190 [ 141.807160][ T5575] memory_max_write+0x355/0x470 [ 141.812072][ T5575] ? memory_max_show+0xa0/0xa0 [ 141.816885][ T5575] ? read_lock_is_recursive+0x20/0x20 [ 141.822312][ T5575] ? memory_max_show+0xa0/0xa0 [ 141.827130][ T5575] cgroup_file_write+0x2b1/0x780 [ 141.832126][ T5575] ? cgroup_seqfile_stop+0xd0/0xd0 [ 141.837281][ T5575] ? __virt_addr_valid+0x22f/0x2e0 [ 141.842470][ T5575] ? cgroup_seqfile_stop+0xd0/0xd0 [ 141.847616][ T5575] kernfs_fop_write_iter+0x3a6/0x4f0 [ 141.852958][ T5575] vfs_write+0x7b2/0xbb0 [ 141.857262][ T5575] ? file_end_write+0x240/0x240 [ 141.862169][ T5575] ? do_raw_spin_unlock+0x13b/0x8b0 [ 141.867428][ T5575] ? lockdep_hardirqs_on+0x98/0x140 [ 141.872731][ T5575] ? __fdget_pos+0x265/0x2f0 [ 141.877382][ T5575] ksys_write+0x1a0/0x2c0 [ 141.881771][ T5575] ? __ia32_sys_read+0x90/0x90 [ 141.886584][ T5575] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 141.892643][ T5575] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 141.898679][ T5575] do_syscall_64+0x41/0xc0 [ 141.903146][ T5575] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 141.909096][ T5575] RIP: 0033:0x7fd49ce20129 [ 141.913554][ T5575] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 141.933205][ T5575] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 141.941677][ T5575] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 141.949696][ T5575] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 141.957727][ T5575] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 141.965747][ T5575] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [pid 5567] close(3) = 0 [pid 5567] close(4) = 0 [ 141.973761][ T5575] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 000000000000001a [ 141.981805][ T5575] [ 141.988046][ T5575] memory: usage 8kB, limit 0kB, failcnt 55 [ 141.994010][ T5575] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 142.001161][ T5575] Memory cgroup stats for /syz1: [ 142.001368][ T5575] anon 0 [ 142.001368][ T5575] file 0 [ 142.001368][ T5575] kernel 8192 [ 142.001368][ T5575] kernel_stack 0 [ 142.001368][ T5575] pagetables 0 [ 142.001368][ T5575] sec_pagetables 0 [ 142.001368][ T5575] percpu 0 [ 142.001368][ T5575] sock 0 [ 142.001368][ T5575] vmalloc 0 [ 142.001368][ T5575] shmem 0 [ 142.001368][ T5575] zswap 0 [ 142.001368][ T5575] zswapped 0 [ 142.001368][ T5575] file_mapped 0 [ 142.001368][ T5575] file_dirty 0 [ 142.001368][ T5575] file_writeback 0 [ 142.001368][ T5575] swapcached 0 [ 142.001368][ T5575] anon_thp 0 [ 142.001368][ T5575] file_thp 0 [ 142.001368][ T5575] shmem_thp 0 [ 142.001368][ T5575] inactive_anon 0 [ 142.001368][ T5575] active_anon 0 [ 142.001368][ T5575] inactive_file 0 [pid 5567] close(5) = 0 [pid 5567] close(6) = 0 [pid 5567] close(7) = -1 EBADF (Bad file descriptor) [pid 5567] close(8) = -1 EBADF (Bad file descriptor) [pid 5567] close(9) = -1 EBADF (Bad file descriptor) [pid 5567] close(10) = -1 EBADF (Bad file descriptor) [pid 5567] close(11) = -1 EBADF (Bad file descriptor) [pid 5567] close(12) = -1 EBADF (Bad file descriptor) [pid 5567] close(13) = -1 EBADF (Bad file descriptor) [pid 5567] close(14) = -1 EBADF (Bad file descriptor) [pid 5567] close(15) = -1 EBADF (Bad file descriptor) [pid 5567] close(16) = -1 EBADF (Bad file descriptor) [pid 5567] close(17) = -1 EBADF (Bad file descriptor) [pid 5567] close(18) = -1 EBADF (Bad file descriptor) [pid 5567] close(19) = -1 EBADF (Bad file descriptor) [pid 5567] close(20) = -1 EBADF (Bad file descriptor) [pid 5567] close(21) = -1 EBADF (Bad file descriptor) [ 142.001368][ T5575] active_file 0 [ 142.001368][ T5575] unevictable 0 [ 142.001368][ T5575] slab_reclaimable 6752 [ 142.001368][ T5575] slab_unreclaimable 0 [ 142.001368][ T5575] slab 6752 [ 142.001368][ T5575] workingset_refault_anon 0 [pid 5567] close(22) = -1 EBADF (Bad file descriptor) [pid 5567] close(23) = -1 EBADF (Bad file descriptor) [pid 5567] close(24) = -1 EBADF (Bad file descriptor) [pid 5567] close(25) = -1 EBADF (Bad file descriptor) [pid 5567] close(26) = -1 EBADF (Bad file descriptor) [pid 5567] close(27) = -1 EBADF (Bad file descriptor) [pid 5567] close(28) = -1 EBADF (Bad file descriptor) [pid 5567] close(29) = -1 EBADF (Bad file descriptor) [pid 5567] exit_group(0) = ? [pid 5567] +++ exited with 0 +++ [pid 5073] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=25, si_uid=0, si_status=0, si_utime=0, si_stime=9 /* 0.09 s */} --- [pid 5073] umount2("./23", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] openat(AT_FDCWD, "./23", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [ 142.116688][ T5575] Tasks state (memory values in pages): [ 142.122305][ T5575] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 142.140791][ T5575] Out of memory and no killable processes... [ 142.148099][ T5576] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5073] fstat(3, [pid 5575] <... write resumed>) = 18 [pid 5073] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [ 142.160906][ T5576] CPU: 1 PID: 5576 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 142.171377][ T5576] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 142.181476][ T5576] Call Trace: [ 142.184787][ T5576] [ 142.187755][ T5576] dump_stack_lvl+0x1e7/0x2d0 [ 142.192492][ T5576] ? nf_tcp_handle_invalid+0x640/0x640 [ 142.198005][ T5576] ? panic+0x770/0x770 [ 142.202142][ T5576] dump_header+0xdc/0x940 [ 142.206525][ T5576] out_of_memory+0xf21/0x12c0 [ 142.211259][ T5576] ? mutex_lock_io_nested+0x60/0x60 [pid 5575] close(3) = 0 [pid 5575] close(4) = 0 [pid 5575] close(5) = 0 [pid 5575] close(6) = 0 [pid 5575] close(7) = -1 EBADF (Bad file descriptor) [pid 5575] close(8) = -1 EBADF (Bad file descriptor) [pid 5575] close(9) = -1 EBADF (Bad file descriptor) [pid 5575] close(10) = -1 EBADF (Bad file descriptor) [pid 5575] close(11) = -1 EBADF (Bad file descriptor) [pid 5575] close(12) = -1 EBADF (Bad file descriptor) [pid 5575] close(13) = -1 EBADF (Bad file descriptor) [pid 5575] close(14) = -1 EBADF (Bad file descriptor) [pid 5575] close(15) = -1 EBADF (Bad file descriptor) [pid 5575] close(16) = -1 EBADF (Bad file descriptor) [pid 5575] close(17) = -1 EBADF (Bad file descriptor) [pid 5575] close(18) = -1 EBADF (Bad file descriptor) [pid 5575] close(19) = -1 EBADF (Bad file descriptor) [pid 5575] close(20) = -1 EBADF (Bad file descriptor) [pid 5575] close(21) = -1 EBADF (Bad file descriptor) [pid 5575] close(22) = -1 EBADF (Bad file descriptor) [pid 5575] close(23) = -1 EBADF (Bad file descriptor) [pid 5575] close(24) = -1 EBADF (Bad file descriptor) [pid 5575] close(25) = -1 EBADF (Bad file descriptor) [pid 5575] close(26) = -1 EBADF (Bad file descriptor) [pid 5575] close(27) = -1 EBADF (Bad file descriptor) [pid 5575] close(28) = -1 EBADF (Bad file descriptor) [pid 5575] close(29) = -1 EBADF (Bad file descriptor) [pid 5575] exit_group(0) = ? [pid 5575] +++ exited with 0 +++ [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=28, si_uid=0, si_status=0, si_utime=0, si_stime=10 /* 0.10 s */} --- [pid 5075] umount2("./26", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] openat(AT_FDCWD, "./26", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5075] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5075] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5075] umount2("./26/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 142.216519][ T5576] ? preempt_schedule+0xdd/0xf0 [ 142.221422][ T5576] ? unregister_oom_notifier+0x20/0x20 [ 142.226933][ T5576] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 142.232985][ T5576] mem_cgroup_out_of_memory+0x263/0x3b0 [ 142.238590][ T5576] ? preempt_schedule_thunk+0x1a/0x20 [ 142.244024][ T5576] ? mem_cgroup_oom_trylock+0x210/0x210 [ 142.249645][ T5576] ? cgroup_file_notify+0x127/0x190 [ 142.254903][ T5576] memory_max_write+0x355/0x470 [ 142.259821][ T5576] ? memory_max_show+0xa0/0xa0 [pid 5075] lstat("./26/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5075] unlink("./26/binderfs") = 0 [pid 5075] umount2("./26/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./26/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5075] unlink("./26/cgroup") = 0 [pid 5075] umount2("./26/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./26/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5075] unlink("./26/cgroup.net") = 0 [ 142.264641][ T5576] ? read_lock_is_recursive+0x20/0x20 [ 142.270067][ T5576] ? memory_max_show+0xa0/0xa0 [ 142.274884][ T5576] cgroup_file_write+0x2b1/0x780 [ 142.279874][ T5576] ? cgroup_seqfile_stop+0xd0/0xd0 [ 142.285029][ T5576] ? __virt_addr_valid+0x22f/0x2e0 [ 142.290207][ T5576] ? cgroup_seqfile_stop+0xd0/0xd0 [ 142.295361][ T5576] kernfs_fop_write_iter+0x3a6/0x4f0 [ 142.300752][ T5576] vfs_write+0x7b2/0xbb0 [ 142.305062][ T5576] ? file_end_write+0x240/0x240 [ 142.309970][ T5576] ? do_raw_spin_unlock+0x13b/0x8b0 [ 142.315250][ T5576] ? lockdep_hardirqs_on+0x98/0x140 [ 142.320584][ T5576] ? __fdget_pos+0x265/0x2f0 [ 142.325235][ T5576] ksys_write+0x1a0/0x2c0 [ 142.329622][ T5576] ? __ia32_sys_read+0x90/0x90 [ 142.334433][ T5576] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 142.340479][ T5576] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 142.346711][ T5576] do_syscall_64+0x41/0xc0 [ 142.351186][ T5576] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 142.357135][ T5576] RIP: 0033:0x7fd49ce20129 [ 142.361595][ T5576] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 142.381349][ T5576] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 142.389833][ T5576] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 142.397855][ T5576] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 142.405876][ T5576] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [pid 5075] umount2("./26/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5073] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5073] umount2("./23/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./23/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5073] unlink("./23/binderfs") = 0 [pid 5073] umount2("./23/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./23/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5073] unlink("./23/cgroup") = 0 [pid 5073] umount2("./23/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./23/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5073] unlink("./23/cgroup.net") = 0 [pid 5073] umount2("./23/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] <... umount2 resumed>) = 0 [pid 5075] umount2("./26/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./26/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5073] <... umount2 resumed>) = 0 [pid 5075] umount2("./26/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5073] umount2("./23/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5073] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] openat(AT_FDCWD, "./26/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5073] lstat("./23/file0", [pid 5075] <... openat resumed>) = 4 [pid 5073] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5075] fstat(4, [pid 5073] umount2("./23/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5073] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] getdents64(4, [pid 5073] openat(AT_FDCWD, "./23/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5075] <... getdents64 resumed>0x5555574b5660 /* 2 entries */, 32768) = 48 [ 142.413892][ T5576] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 142.421911][ T5576] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000014 [ 142.429988][ T5576] [ 142.444018][ T5576] memory: usage 8kB, limit 0kB, failcnt 55 [ 142.450154][ T5576] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 142.457637][ T5576] Memory cgroup stats for /syz1: [ 142.458051][ T5576] anon 0 [pid 5073] <... openat resumed>) = 4 [pid 5075] getdents64(4, [pid 5073] fstat(4, [pid 5075] <... getdents64 resumed>0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5073] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5075] close(4 [pid 5073] getdents64(4, [pid 5075] <... close resumed>) = 0 [pid 5073] <... getdents64 resumed>0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5075] rmdir("./26/file0" [pid 5073] getdents64(4, [pid 5075] <... rmdir resumed>) = 0 [pid 5073] <... getdents64 resumed>0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5075] umount2("./26/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5073] close(4 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5073] <... close resumed>) = 0 [pid 5075] lstat("./26/cgroup.cpu", [pid 5073] rmdir("./23/file0" [pid 5075] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5073] <... rmdir resumed>) = 0 [pid 5075] unlink("./26/cgroup.cpu" [pid 5073] umount2("./23/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] <... unlink resumed>) = 0 [pid 5073] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] getdents64(3, [pid 5073] lstat("./23/cgroup.cpu", [pid 5075] <... getdents64 resumed>0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5073] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5075] close(3 [pid 5073] unlink("./23/cgroup.cpu" [pid 5075] <... close resumed>) = 0 [pid 5073] <... unlink resumed>) = 0 [pid 5075] rmdir("./26" [pid 5073] getdents64(3, [pid 5075] <... rmdir resumed>) = 0 [pid 5073] <... getdents64 resumed>0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5075] mkdir("./27", 0777 [pid 5073] close(3 [pid 5075] <... mkdir resumed>) = 0 [pid 5073] <... close resumed>) = 0 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5073] rmdir("./23"./strace-static-x86_64: Process 5596 attached ) = 0 [pid 5596] chdir("./27" [pid 5075] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 29 [pid 5073] mkdir("./24", 0777 [pid 5596] <... chdir resumed>) = 0 [pid 5073] <... mkdir resumed>) = 0 [ 142.458051][ T5576] file 0 [ 142.458051][ T5576] kernel 8192 [ 142.458051][ T5576] kernel_stack 0 [ 142.458051][ T5576] pagetables 0 [ 142.458051][ T5576] sec_pagetables 0 [ 142.458051][ T5576] percpu 0 [ 142.458051][ T5576] sock 0 [ 142.458051][ T5576] vmalloc 0 [ 142.458051][ T5576] shmem 0 [ 142.458051][ T5576] zswap 0 [ 142.458051][ T5576] zswapped 0 [ 142.458051][ T5576] file_mapped 0 [ 142.458051][ T5576] file_dirty 0 [ 142.458051][ T5576] file_writeback 0 [ 142.458051][ T5576] swapcached 0 [ 142.458051][ T5576] anon_thp 0 [pid 5596] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5073] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5596] <... prctl resumed>) = 0 [pid 5596] setpgid(0, 0 [pid 5073] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 26 [pid 5596] <... setpgid resumed>) = 0 [pid 5596] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 5596] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 5596] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 5596] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5596] write(3, "1000", 4) = 4 [pid 5596] close(3) = 0 [pid 5596] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5596] mkdir("./file0", 000) = 0 [pid 5596] open("./file0", O_RDONLY./strace-static-x86_64: Process 5597 attached ) = 3 [pid 5596] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5597] chdir("./24" [pid 5596] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5597] <... chdir resumed>) = 0 [pid 5596] <... openat resumed>) = 4 [pid 5597] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5596] openat(4, "syz1", O_RDWR|O_PATH [pid 5597] <... prctl resumed>) = 0 [pid 5596] <... openat resumed>) = 5 [pid 5597] setpgid(0, 0 [pid 5596] openat(5, "memory.max", O_RDWR [pid 5597] <... setpgid resumed>) = 0 [pid 5596] <... openat resumed>) = 6 [pid 5596] write(6, "0x000000000000040e", 18 [pid 5597] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 5597] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 5597] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [pid 5597] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5597] write(3, "1000", 4) = 4 [ 142.458051][ T5576] file_thp 0 [ 142.458051][ T5576] shmem_thp 0 [ 142.458051][ T5576] inactive_anon 0 [ 142.458051][ T5576] active_anon 0 [ 142.458051][ T5576] inactive_file 0 [ 142.458051][ T5576] active_file 0 [ 142.458051][ T5576] unevictable 0 [ 142.458051][ T5576] slab_reclaimable 6752 [ 142.458051][ T5576] slab_unreclaimable 0 [ 142.458051][ T5576] slab 6752 [ 142.458051][ T5576] workingset_refault_anon 0 [pid 5597] close(3) = 0 [pid 5597] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5597] mkdir("./file0", 000) = 0 [pid 5597] open("./file0", O_RDONLY) = 3 [pid 5597] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5597] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5597] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5597] openat(5, "memory.max", O_RDWR) = 6 [pid 5597] write(6, "0x000000000000040e", 18 [pid 5576] <... write resumed>) = 18 [ 142.601073][ T5576] Tasks state (memory values in pages): [ 142.607390][ T5576] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 142.619644][ T5576] Out of memory and no killable processes... [ 142.632693][ T5579] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5576] close(3) = 0 [pid 5576] close(4) = 0 [pid 5576] close(5) = 0 [pid 5576] close(6) = 0 [pid 5576] close(7) = -1 EBADF (Bad file descriptor) [pid 5576] close(8) = -1 EBADF (Bad file descriptor) [pid 5576] close(9) = -1 EBADF (Bad file descriptor) [pid 5576] close(10) = -1 EBADF (Bad file descriptor) [pid 5576] close(11) = -1 EBADF (Bad file descriptor) [pid 5576] close(12) = -1 EBADF (Bad file descriptor) [pid 5576] close(13) = -1 EBADF (Bad file descriptor) [pid 5576] close(14) = -1 EBADF (Bad file descriptor) [pid 5576] close(15) = -1 EBADF (Bad file descriptor) [pid 5576] close(16) = -1 EBADF (Bad file descriptor) [pid 5576] close(17) = -1 EBADF (Bad file descriptor) [pid 5576] close(18) = -1 EBADF (Bad file descriptor) [pid 5576] close(19) = -1 EBADF (Bad file descriptor) [pid 5576] close(20) = -1 EBADF (Bad file descriptor) [pid 5576] close(21) = -1 EBADF (Bad file descriptor) [pid 5576] close(22) = -1 EBADF (Bad file descriptor) [pid 5576] close(23) = -1 EBADF (Bad file descriptor) [pid 5576] close(24) = -1 EBADF (Bad file descriptor) [pid 5576] close(25) = -1 EBADF (Bad file descriptor) [pid 5576] close(26) = -1 EBADF (Bad file descriptor) [pid 5576] close(27) = -1 EBADF (Bad file descriptor) [pid 5576] close(28) = -1 EBADF (Bad file descriptor) [pid 5576] close(29) = -1 EBADF (Bad file descriptor) [pid 5576] exit_group(0) = ? [pid 5576] +++ exited with 0 +++ [ 142.643568][ T5579] CPU: 1 PID: 5579 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 142.654042][ T5579] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 142.664145][ T5579] Call Trace: [ 142.667466][ T5579] [ 142.670435][ T5579] dump_stack_lvl+0x1e7/0x2d0 [ 142.675172][ T5579] ? nf_tcp_handle_invalid+0x640/0x640 [ 142.680686][ T5579] ? panic+0x770/0x770 [ 142.684813][ T5579] dump_header+0xdc/0x940 [ 142.689201][ T5579] out_of_memory+0xf21/0x12c0 [ 142.693938][ T5579] ? mutex_lock_io_nested+0x60/0x60 [pid 5070] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=22, si_uid=0, si_status=0, si_utime=0, si_stime=11 /* 0.11 s */} --- [pid 5070] umount2("./20", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 142.699309][ T5579] ? preempt_schedule+0xdd/0xf0 [ 142.704227][ T5579] ? unregister_oom_notifier+0x20/0x20 [ 142.709737][ T5579] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 142.715779][ T5579] mem_cgroup_out_of_memory+0x263/0x3b0 [ 142.721380][ T5579] ? preempt_schedule_thunk+0x1a/0x20 [ 142.726837][ T5579] ? mem_cgroup_oom_trylock+0x210/0x210 [ 142.732465][ T5579] ? cgroup_file_notify+0x127/0x190 [ 142.737731][ T5579] memory_max_write+0x355/0x470 [ 142.742649][ T5579] ? memory_max_show+0xa0/0xa0 [ 142.747468][ T5579] ? read_lock_is_recursive+0x20/0x20 [ 142.752913][ T5579] ? memory_max_show+0xa0/0xa0 [ 142.757747][ T5579] cgroup_file_write+0x2b1/0x780 [ 142.762751][ T5579] ? cgroup_seqfile_stop+0xd0/0xd0 [ 142.767914][ T5579] ? __virt_addr_valid+0x22f/0x2e0 [ 142.773096][ T5579] ? cgroup_seqfile_stop+0xd0/0xd0 [ 142.778261][ T5579] kernfs_fop_write_iter+0x3a6/0x4f0 [ 142.783632][ T5579] vfs_write+0x7b2/0xbb0 [ 142.787937][ T5579] ? file_end_write+0x240/0x240 [ 142.792845][ T5579] ? do_raw_spin_unlock+0x13b/0x8b0 [ 142.798107][ T5579] ? lockdep_hardirqs_on+0x98/0x140 [ 142.803376][ T5579] ? __fdget_pos+0x265/0x2f0 [ 142.808031][ T5579] ksys_write+0x1a0/0x2c0 [ 142.812431][ T5579] ? __ia32_sys_read+0x90/0x90 [ 142.817247][ T5579] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 142.823288][ T5579] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 142.829326][ T5579] do_syscall_64+0x41/0xc0 [ 142.833810][ T5579] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 142.839768][ T5579] RIP: 0033:0x7fd49ce20129 [ 142.844236][ T5579] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 142.863891][ T5579] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 142.872532][ T5579] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 142.880630][ T5579] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 142.888638][ T5579] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [pid 5070] openat(AT_FDCWD, "./20", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5070] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5070] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5070] umount2("./20/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./20/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5070] unlink("./20/binderfs") = 0 [pid 5070] umount2("./20/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./20/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5070] unlink("./20/cgroup") = 0 [pid 5070] umount2("./20/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./20/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5070] unlink("./20/cgroup.net") = 0 [pid 5070] umount2("./20/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5070] umount2("./20/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./20/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5070] umount2("./20/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] openat(AT_FDCWD, "./20/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5070] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5070] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5070] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5070] close(4) = 0 [pid 5070] rmdir("./20/file0") = 0 [pid 5070] umount2("./20/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./20/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5070] unlink("./20/cgroup.cpu") = 0 [ 142.896653][ T5579] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 142.904669][ T5579] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000015 [ 142.912727][ T5579] [ 142.929038][ T5579] memory: usage 8kB, limit 0kB, failcnt 55 [ 142.935571][ T5579] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [pid 5070] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5070] close(3) = 0 [pid 5070] rmdir("./20") = 0 [pid 5070] mkdir("./21", 0777) = 0 [pid 5070] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5600 attached [pid 5600] chdir("./21" [pid 5070] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 23 [pid 5600] <... chdir resumed>) = 0 [pid 5600] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5600] setpgid(0, 0) = 0 [pid 5600] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 5600] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 5600] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 5600] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5600] write(3, "1000", 4) = 4 [pid 5600] close(3) = 0 [pid 5600] symlink("/dev/binderfs", "./binderfs") = 0 [ 142.963343][ T5579] Memory cgroup stats for /syz1: [ 142.963555][ T5579] anon 0 [ 142.963555][ T5579] file 0 [ 142.963555][ T5579] kernel 8192 [ 142.963555][ T5579] kernel_stack 0 [ 142.963555][ T5579] pagetables 0 [ 142.963555][ T5579] sec_pagetables 0 [ 142.963555][ T5579] percpu 0 [ 142.963555][ T5579] sock 0 [ 142.963555][ T5579] vmalloc 0 [ 142.963555][ T5579] shmem 0 [ 142.963555][ T5579] zswap 0 [ 142.963555][ T5579] zswapped 0 [ 142.963555][ T5579] file_mapped 0 [ 142.963555][ T5579] file_dirty 0 [pid 5600] mkdir("./file0", 000) = 0 [pid 5600] open("./file0", O_RDONLY) = 3 [pid 5600] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5600] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5600] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5600] openat(5, "memory.max", O_RDWR) = 6 [ 142.963555][ T5579] file_writeback 0 [ 142.963555][ T5579] swapcached 0 [ 142.963555][ T5579] anon_thp 0 [ 142.963555][ T5579] file_thp 0 [ 142.963555][ T5579] shmem_thp 0 [ 142.963555][ T5579] inactive_anon 0 [ 142.963555][ T5579] active_anon 0 [ 142.963555][ T5579] inactive_file 0 [ 142.963555][ T5579] active_file 0 [ 142.963555][ T5579] unevictable 0 [ 142.963555][ T5579] slab_reclaimable 6752 [ 142.963555][ T5579] slab_unreclaimable 0 [ 142.963555][ T5579] slab 6752 [ 142.963555][ T5579] workingset_refault_anon 0 [pid 5600] write(6, "0x000000000000040e", 18 [pid 5579] <... write resumed>) = 18 [ 143.070091][ T5579] Tasks state (memory values in pages): [ 143.078254][ T5579] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 143.095823][ T5579] Out of memory and no killable processes... [ 143.102792][ T5586] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5579] close(3) = 0 [pid 5579] close(4) = 0 [pid 5579] close(5) = 0 [pid 5579] close(6) = 0 [pid 5579] close(7) = -1 EBADF (Bad file descriptor) [pid 5579] close(8) = -1 EBADF (Bad file descriptor) [pid 5579] close(9) = -1 EBADF (Bad file descriptor) [pid 5579] close(10) = -1 EBADF (Bad file descriptor) [pid 5579] close(11) = -1 EBADF (Bad file descriptor) [pid 5579] close(12) = -1 EBADF (Bad file descriptor) [pid 5579] close(13) = -1 EBADF (Bad file descriptor) [pid 5579] close(14) = -1 EBADF (Bad file descriptor) [pid 5579] close(15) = -1 EBADF (Bad file descriptor) [pid 5579] close(16) = -1 EBADF (Bad file descriptor) [pid 5579] close(17) = -1 EBADF (Bad file descriptor) [pid 5579] close(18) = -1 EBADF (Bad file descriptor) [pid 5579] close(19) = -1 EBADF (Bad file descriptor) [pid 5579] close(20) = -1 EBADF (Bad file descriptor) [ 143.113416][ T5586] CPU: 1 PID: 5586 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 143.123879][ T5586] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 143.133972][ T5586] Call Trace: [ 143.137297][ T5586] [ 143.140267][ T5586] dump_stack_lvl+0x1e7/0x2d0 [ 143.144993][ T5586] ? nf_tcp_handle_invalid+0x640/0x640 [ 143.150496][ T5586] ? panic+0x770/0x770 [ 143.154630][ T5586] dump_header+0xdc/0x940 [ 143.159026][ T5586] out_of_memory+0xf21/0x12c0 [ 143.163756][ T5586] ? mutex_lock_io_nested+0x60/0x60 [ 143.169008][ T5586] ? mark_lock+0x9a/0x340 [ 143.173369][ T5586] ? unregister_oom_notifier+0x20/0x20 [ 143.178893][ T5586] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 143.184934][ T5586] mem_cgroup_out_of_memory+0x263/0x3b0 [ 143.190532][ T5586] ? mem_cgroup_oom_trylock+0x210/0x210 [ 143.196144][ T5586] ? cgroup_file_notify+0x127/0x190 [ 143.201383][ T5586] memory_max_write+0x355/0x470 [ 143.206266][ T5586] ? memory_max_show+0xa0/0xa0 [ 143.211060][ T5586] ? read_lock_is_recursive+0x20/0x20 [ 143.216460][ T5586] ? memory_max_show+0xa0/0xa0 [ 143.221252][ T5586] cgroup_file_write+0x2b1/0x780 [ 143.226217][ T5586] ? cgroup_seqfile_stop+0xd0/0xd0 [ 143.231352][ T5586] ? __virt_addr_valid+0x22f/0x2e0 [ 143.236506][ T5586] ? cgroup_seqfile_stop+0xd0/0xd0 [ 143.241639][ T5586] kernfs_fop_write_iter+0x3a6/0x4f0 [ 143.246953][ T5586] vfs_write+0x7b2/0xbb0 [ 143.251240][ T5586] ? file_end_write+0x240/0x240 [ 143.256139][ T5586] ? do_raw_spin_unlock+0x13b/0x8b0 [ 143.261377][ T5586] ? lockdep_hardirqs_on+0x98/0x140 [ 143.266637][ T5586] ? __fdget_pos+0x265/0x2f0 [pid 5579] close(21) = -1 EBADF (Bad file descriptor) [pid 5579] close(22) = -1 EBADF (Bad file descriptor) [pid 5579] close(23) = -1 EBADF (Bad file descriptor) [pid 5579] close(24) = -1 EBADF (Bad file descriptor) [pid 5579] close(25) = -1 EBADF (Bad file descriptor) [pid 5579] close(26) = -1 EBADF (Bad file descriptor) [pid 5579] close(27) = -1 EBADF (Bad file descriptor) [pid 5579] close(28) = -1 EBADF (Bad file descriptor) [pid 5579] close(29) = -1 EBADF (Bad file descriptor) [ 143.271289][ T5586] ksys_write+0x1a0/0x2c0 [ 143.275741][ T5586] ? __ia32_sys_read+0x90/0x90 [ 143.280539][ T5586] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 143.286552][ T5586] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 143.292567][ T5586] do_syscall_64+0x41/0xc0 [ 143.297009][ T5586] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 143.302924][ T5586] RIP: 0033:0x7fd49ce20129 [ 143.307358][ T5586] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 143.326976][ T5586] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 143.335406][ T5586] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 143.343390][ T5586] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 143.351400][ T5586] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 143.359396][ T5586] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [pid 5579] exit_group(0) = ? [pid 5579] +++ exited with 0 +++ [pid 5072] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=23, si_uid=0, si_status=0, si_utime=0, si_stime=12 /* 0.12 s */} --- [pid 5072] umount2("./21", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] openat(AT_FDCWD, "./21", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5072] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5072] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5072] umount2("./21/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./21/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [ 143.367393][ T5586] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 000000000000001c [ 143.375403][ T5586] [ 143.390945][ T5586] memory: usage 8kB, limit 0kB, failcnt 55 [ 143.397901][ T5586] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 143.405734][ T5586] Memory cgroup stats for /syz1: [ 143.405934][ T5586] anon 0 [ 143.405934][ T5586] file 0 [ 143.405934][ T5586] kernel 8192 [pid 5072] unlink("./21/binderfs") = 0 [pid 5072] umount2("./21/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./21/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5072] unlink("./21/cgroup") = 0 [pid 5072] umount2("./21/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./21/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5072] unlink("./21/cgroup.net") = 0 [ 143.405934][ T5586] kernel_stack 0 [ 143.405934][ T5586] pagetables 0 [ 143.405934][ T5586] sec_pagetables 0 [ 143.405934][ T5586] percpu 0 [ 143.405934][ T5586] sock 0 [ 143.405934][ T5586] vmalloc 0 [ 143.405934][ T5586] shmem 0 [ 143.405934][ T5586] zswap 0 [ 143.405934][ T5586] zswapped 0 [ 143.405934][ T5586] file_mapped 0 [ 143.405934][ T5586] file_dirty 0 [ 143.405934][ T5586] file_writeback 0 [ 143.405934][ T5586] swapcached 0 [ 143.405934][ T5586] anon_thp 0 [ 143.405934][ T5586] file_thp 0 [ 143.405934][ T5586] shmem_thp 0 [pid 5072] umount2("./21/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5072] umount2("./21/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./21/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5072] umount2("./21/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] openat(AT_FDCWD, "./21/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5072] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5072] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5072] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5072] close(4) = 0 [pid 5072] rmdir("./21/file0") = 0 [ 143.405934][ T5586] inactive_anon 0 [ 143.405934][ T5586] active_anon 0 [ 143.405934][ T5586] inactive_file 0 [ 143.405934][ T5586] active_file 0 [ 143.405934][ T5586] unevictable 0 [ 143.405934][ T5586] slab_reclaimable 6752 [ 143.405934][ T5586] slab_unreclaimable 0 [ 143.405934][ T5586] slab 6752 [ 143.405934][ T5586] workingset_refault_anon 0 [ 143.514532][ T5586] Tasks state (memory values in pages): [pid 5072] umount2("./21/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./21/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5072] unlink("./21/cgroup.cpu") = 0 [pid 5072] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5072] close(3) = 0 [pid 5072] rmdir("./21") = 0 [pid 5072] mkdir("./22", 0777) = 0 [pid 5072] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555574ac5d0) = 24 ./strace-static-x86_64: Process 5601 attached [pid 5601] chdir("./22") = 0 [pid 5586] <... write resumed>) = 18 [pid 5586] close(3) = 0 [pid 5586] close(4) = 0 [pid 5586] close(5) = 0 [pid 5586] close(6) = 0 [pid 5586] close(7) = -1 EBADF (Bad file descriptor) [pid 5586] close(8) = -1 EBADF (Bad file descriptor) [pid 5586] close(9) = -1 EBADF (Bad file descriptor) [pid 5586] close(10) = -1 EBADF (Bad file descriptor) [pid 5586] close(11) = -1 EBADF (Bad file descriptor) [pid 5586] close(12) = -1 EBADF (Bad file descriptor) [pid 5586] close(13) = -1 EBADF (Bad file descriptor) [pid 5586] close(14) = -1 EBADF (Bad file descriptor) [pid 5586] close(15) = -1 EBADF (Bad file descriptor) [pid 5586] close(16) = -1 EBADF (Bad file descriptor) [pid 5586] close(17) = -1 EBADF (Bad file descriptor) [pid 5586] close(18) = -1 EBADF (Bad file descriptor) [pid 5586] close(19) = -1 EBADF (Bad file descriptor) [pid 5586] close(20) = -1 EBADF (Bad file descriptor) [pid 5586] close(21) = -1 EBADF (Bad file descriptor) [pid 5586] close(22) = -1 EBADF (Bad file descriptor) [pid 5586] close(23) = -1 EBADF (Bad file descriptor) [pid 5586] close(24) = -1 EBADF (Bad file descriptor) [pid 5586] close(25) = -1 EBADF (Bad file descriptor) [pid 5586] close(26) = -1 EBADF (Bad file descriptor) [pid 5586] close(27) = -1 EBADF (Bad file descriptor) [pid 5586] close(28) = -1 EBADF (Bad file descriptor) [pid 5586] close(29) = -1 EBADF (Bad file descriptor) [pid 5586] exit_group(0) = ? [pid 5586] +++ exited with 0 +++ [pid 5601] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [ 143.521293][ T5586] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 143.539589][ T5586] Out of memory and no killable processes... [ 143.545994][ T5596] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 143.557923][ T5596] CPU: 0 PID: 5596 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [pid 5601] setpgid(0, 0) = 0 [pid 5601] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 5601] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [pid 5601] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 5601] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5601] write(3, "1000", 4) = 4 [pid 5601] close(3) = 0 [pid 5601] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5601] mkdir("./file0", 000) = 0 [pid 5601] open("./file0", O_RDONLY) = 3 [pid 5601] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5601] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5601] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5601] openat(5, "memory.max", O_RDWR) = 6 [pid 5601] write(6, "0x000000000000040e", 18 [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=30, si_uid=0, si_status=0, si_utime=0, si_stime=9 /* 0.09 s */} --- [pid 5074] umount2("./28", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] openat(AT_FDCWD, "./28", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5074] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5074] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5074] umount2("./28/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./28/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5074] unlink("./28/binderfs") = 0 [pid 5074] umount2("./28/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./28/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5074] unlink("./28/cgroup") = 0 [pid 5074] umount2("./28/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./28/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5074] unlink("./28/cgroup.net") = 0 [ 143.568390][ T5596] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 143.578493][ T5596] Call Trace: [ 143.581800][ T5596] [ 143.584765][ T5596] dump_stack_lvl+0x1e7/0x2d0 [ 143.589503][ T5596] ? nf_tcp_handle_invalid+0x640/0x640 [ 143.595016][ T5596] ? panic+0x770/0x770 [ 143.599151][ T5596] dump_header+0xdc/0x940 [ 143.603557][ T5596] out_of_memory+0xf21/0x12c0 [ 143.608293][ T5596] ? mutex_lock_io_nested+0x60/0x60 [ 143.613547][ T5596] ? preempt_schedule+0xdd/0xf0 [ 143.618445][ T5596] ? unregister_oom_notifier+0x20/0x20 [ 143.623948][ T5596] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 143.629999][ T5596] mem_cgroup_out_of_memory+0x263/0x3b0 [ 143.635598][ T5596] ? preempt_schedule_thunk+0x1a/0x20 [ 143.641022][ T5596] ? mem_cgroup_oom_trylock+0x210/0x210 [ 143.646637][ T5596] ? cgroup_file_notify+0x127/0x190 [ 143.651895][ T5596] memory_max_write+0x355/0x470 [ 143.656800][ T5596] ? memory_max_show+0xa0/0xa0 [ 143.661606][ T5596] ? read_lock_is_recursive+0x20/0x20 [ 143.667022][ T5596] ? memory_max_show+0xa0/0xa0 [ 143.671830][ T5596] cgroup_file_write+0x2b1/0x780 [ 143.676806][ T5596] ? cgroup_seqfile_stop+0xd0/0xd0 [ 143.681943][ T5596] ? __virt_addr_valid+0x22f/0x2e0 [ 143.687122][ T5596] ? cgroup_seqfile_stop+0xd0/0xd0 [ 143.692275][ T5596] kernfs_fop_write_iter+0x3a6/0x4f0 [ 143.697621][ T5596] vfs_write+0x7b2/0xbb0 [ 143.701922][ T5596] ? file_end_write+0x240/0x240 [ 143.706825][ T5596] ? do_raw_spin_unlock+0x13b/0x8b0 [ 143.712065][ T5596] ? lockdep_hardirqs_on+0x98/0x140 [ 143.717320][ T5596] ? __fdget_pos+0x265/0x2f0 [ 143.721960][ T5596] ksys_write+0x1a0/0x2c0 [ 143.726348][ T5596] ? __ia32_sys_read+0x90/0x90 [ 143.731166][ T5596] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 143.737216][ T5596] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 143.743261][ T5596] do_syscall_64+0x41/0xc0 [ 143.747716][ T5596] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 143.753660][ T5596] RIP: 0033:0x7fd49ce20129 [ 143.758111][ T5596] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 143.777747][ T5596] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 143.786188][ T5596] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 143.794197][ T5596] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 143.802180][ T5596] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 143.810191][ T5596] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [pid 5074] umount2("./28/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5074] umount2("./28/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./28/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5074] umount2("./28/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] openat(AT_FDCWD, "./28/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5074] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5074] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5074] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5074] close(4) = 0 [pid 5074] rmdir("./28/file0") = 0 [pid 5074] umount2("./28/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./28/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5074] unlink("./28/cgroup.cpu") = 0 [pid 5074] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [ 143.818184][ T5596] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 000000000000001b [ 143.826192][ T5596] [ 143.841538][ T5596] memory: usage 8kB, limit 0kB, failcnt 55 [ 143.847581][ T5596] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 143.854462][ T5596] Memory cgroup stats for /syz1: [ 143.854662][ T5596] anon 0 [ 143.854662][ T5596] file 0 [ 143.854662][ T5596] kernel 8192 [ 143.854662][ T5596] kernel_stack 0 [pid 5074] close(3) = 0 [pid 5074] rmdir("./28") = 0 [pid 5074] mkdir("./29", 0777) = 0 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555574ac5d0) = 31 [ 143.854662][ T5596] pagetables 0 [ 143.854662][ T5596] sec_pagetables 0 [ 143.854662][ T5596] percpu 0 [ 143.854662][ T5596] sock 0 [ 143.854662][ T5596] vmalloc 0 [ 143.854662][ T5596] shmem 0 [ 143.854662][ T5596] zswap 0 [ 143.854662][ T5596] zswapped 0 [ 143.854662][ T5596] file_mapped 0 [ 143.854662][ T5596] file_dirty 0 [ 143.854662][ T5596] file_writeback 0 [ 143.854662][ T5596] swapcached 0 [ 143.854662][ T5596] anon_thp 0 [ 143.854662][ T5596] file_thp 0 [ 143.854662][ T5596] shmem_thp 0 [ 143.854662][ T5596] inactive_anon 0 ./strace-static-x86_64: Process 5602 attached [pid 5602] chdir("./29") = 0 [ 143.854662][ T5596] active_anon 0 [ 143.854662][ T5596] inactive_file 0 [ 143.854662][ T5596] active_file 0 [ 143.854662][ T5596] unevictable 0 [ 143.854662][ T5596] slab_reclaimable 6752 [ 143.854662][ T5596] slab_unreclaimable 0 [ 143.854662][ T5596] slab 6752 [ 143.854662][ T5596] workingset_refault_anon 0 [ 143.954276][ T5596] Tasks state (memory values in pages): [pid 5602] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5602] setpgid(0, 0) = 0 [pid 5602] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [pid 5602] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu" [pid 5596] <... write resumed>) = 18 [pid 5602] <... symlink resumed>) = 0 [pid 5602] symlink("/syzcgroup/net/syz3", "./cgroup.net" [pid 5596] close(3 [pid 5602] <... symlink resumed>) = 0 [pid 5602] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5596] <... close resumed>) = 0 [pid 5602] <... openat resumed>) = 3 [pid 5602] write(3, "1000", 4 [pid 5596] close(4 [pid 5602] <... write resumed>) = 4 [pid 5602] close(3 [pid 5596] <... close resumed>) = 0 [pid 5602] <... close resumed>) = 0 [pid 5602] symlink("/dev/binderfs", "./binderfs" [pid 5596] close(5 [pid 5602] <... symlink resumed>) = 0 [pid 5602] mkdir("./file0", 000 [pid 5596] <... close resumed>) = 0 [pid 5602] <... mkdir resumed>) = 0 [pid 5602] open("./file0", O_RDONLY [pid 5596] close(6 [pid 5602] <... open resumed>) = 3 [pid 5602] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5596] <... close resumed>) = 0 [pid 5602] <... mount resumed>) = 0 [pid 5602] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5596] close(7 [pid 5602] <... openat resumed>) = 4 [pid 5596] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5602] openat(4, "syz1", O_RDWR|O_PATH [pid 5596] close(8 [pid 5602] <... openat resumed>) = 5 [pid 5596] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5602] openat(5, "memory.max", O_RDWR [pid 5596] close(9 [pid 5602] <... openat resumed>) = 6 [pid 5596] <... close resumed>) = -1 EBADF (Bad file descriptor) [ 143.965584][ T5596] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 143.975262][ T5596] Out of memory and no killable processes... [ 143.989922][ T5597] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 144.005234][ T5597] CPU: 1 PID: 5597 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [pid 5602] write(6, "0x000000000000040e", 18 [pid 5596] close(10) = -1 EBADF (Bad file descriptor) [pid 5596] close(11) = -1 EBADF (Bad file descriptor) [pid 5596] close(12) = -1 EBADF (Bad file descriptor) [pid 5596] close(13) = -1 EBADF (Bad file descriptor) [pid 5596] close(14) = -1 EBADF (Bad file descriptor) [pid 5596] close(15) = -1 EBADF (Bad file descriptor) [pid 5596] close(16) = -1 EBADF (Bad file descriptor) [pid 5596] close(17) = -1 EBADF (Bad file descriptor) [pid 5596] close(18) = -1 EBADF (Bad file descriptor) [pid 5596] close(19) = -1 EBADF (Bad file descriptor) [pid 5596] close(20) = -1 EBADF (Bad file descriptor) [pid 5596] close(21) = -1 EBADF (Bad file descriptor) [pid 5596] close(22) = -1 EBADF (Bad file descriptor) [pid 5596] close(23) = -1 EBADF (Bad file descriptor) [pid 5596] close(24) = -1 EBADF (Bad file descriptor) [pid 5596] close(25) = -1 EBADF (Bad file descriptor) [pid 5596] close(26) = -1 EBADF (Bad file descriptor) [pid 5596] close(27) = -1 EBADF (Bad file descriptor) [pid 5596] close(28) = -1 EBADF (Bad file descriptor) [pid 5596] close(29) = -1 EBADF (Bad file descriptor) [pid 5596] exit_group(0) = ? [pid 5596] +++ exited with 0 +++ [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=29, si_uid=0, si_status=0, si_utime=0, si_stime=11 /* 0.11 s */} --- [pid 5075] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5075] umount2("./27", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] openat(AT_FDCWD, "./27", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5075] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5075] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5075] umount2("./27/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./27/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5075] unlink("./27/binderfs") = 0 [pid 5075] umount2("./27/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 144.015705][ T5597] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 144.025797][ T5597] Call Trace: [ 144.029109][ T5597] [ 144.032070][ T5597] dump_stack_lvl+0x1e7/0x2d0 [ 144.036802][ T5597] ? nf_tcp_handle_invalid+0x640/0x640 [ 144.042320][ T5597] ? panic+0x770/0x770 [ 144.046461][ T5597] dump_header+0xdc/0x940 [ 144.050849][ T5597] out_of_memory+0xf21/0x12c0 [ 144.055583][ T5597] ? mutex_lock_io_nested+0x60/0x60 [ 144.060846][ T5597] ? preempt_schedule+0xdd/0xf0 [ 144.065744][ T5597] ? unregister_oom_notifier+0x20/0x20 [pid 5075] lstat("./27/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5075] unlink("./27/cgroup") = 0 [pid 5075] umount2("./27/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./27/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5075] unlink("./27/cgroup.net") = 0 [ 144.071244][ T5597] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 144.077278][ T5597] mem_cgroup_out_of_memory+0x263/0x3b0 [ 144.082869][ T5597] ? preempt_schedule_thunk+0x1a/0x20 [ 144.088288][ T5597] ? mem_cgroup_oom_trylock+0x210/0x210 [ 144.093889][ T5597] ? cgroup_file_notify+0x127/0x190 [ 144.099128][ T5597] memory_max_write+0x355/0x470 [ 144.104060][ T5597] ? memory_max_show+0xa0/0xa0 [ 144.108861][ T5597] ? read_lock_is_recursive+0x20/0x20 [ 144.114257][ T5597] ? memory_max_show+0xa0/0xa0 [ 144.119051][ T5597] cgroup_file_write+0x2b1/0x780 [ 144.124038][ T5597] ? cgroup_seqfile_stop+0xd0/0xd0 [ 144.129178][ T5597] ? __virt_addr_valid+0x22f/0x2e0 [ 144.134323][ T5597] ? cgroup_seqfile_stop+0xd0/0xd0 [ 144.139480][ T5597] kernfs_fop_write_iter+0x3a6/0x4f0 [ 144.144819][ T5597] vfs_write+0x7b2/0xbb0 [ 144.149117][ T5597] ? file_end_write+0x240/0x240 [ 144.153991][ T5597] ? do_raw_spin_unlock+0x13b/0x8b0 [ 144.159234][ T5597] ? lockdep_hardirqs_on+0x98/0x140 [ 144.164492][ T5597] ? __fdget_pos+0x265/0x2f0 [ 144.169135][ T5597] ksys_write+0x1a0/0x2c0 [ 144.173506][ T5597] ? __ia32_sys_read+0x90/0x90 [ 144.178301][ T5597] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 144.184341][ T5597] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 144.190365][ T5597] do_syscall_64+0x41/0xc0 [ 144.194800][ T5597] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 144.200721][ T5597] RIP: 0033:0x7fd49ce20129 [ 144.205170][ T5597] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 144.224827][ T5597] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 144.233281][ T5597] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 144.241280][ T5597] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 144.249279][ T5597] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 144.257277][ T5597] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 144.265299][ T5597] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000018 [pid 5075] umount2("./27/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5075] umount2("./27/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./27/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5075] umount2("./27/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] openat(AT_FDCWD, "./27/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5075] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5075] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5075] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5075] close(4) = 0 [pid 5075] rmdir("./27/file0") = 0 [pid 5075] umount2("./27/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./27/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5075] unlink("./27/cgroup.cpu") = 0 [pid 5075] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5075] close(3) = 0 [pid 5075] rmdir("./27") = 0 [pid 5075] mkdir("./28", 0777) = 0 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5603 attached [pid 5603] chdir("./28" [pid 5075] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 30 [pid 5603] <... chdir resumed>) = 0 [pid 5603] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5603] setpgid(0, 0) = 0 [pid 5603] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 5603] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 5603] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 5603] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [ 144.273354][ T5597] [ 144.285558][ T5597] memory: usage 8kB, limit 0kB, failcnt 55 [ 144.292120][ T5597] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 144.300518][ T5597] Memory cgroup stats for /syz1: [ 144.300724][ T5597] anon 0 [ 144.300724][ T5597] file 0 [ 144.300724][ T5597] kernel 8192 [ 144.300724][ T5597] kernel_stack 0 [ 144.300724][ T5597] pagetables 0 [ 144.300724][ T5597] sec_pagetables 0 [pid 5603] write(3, "1000", 4) = 4 [pid 5603] close(3) = 0 [pid 5603] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5603] mkdir("./file0", 000) = 0 [pid 5603] open("./file0", O_RDONLY) = 3 [pid 5603] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [ 144.300724][ T5597] percpu 0 [ 144.300724][ T5597] sock 0 [ 144.300724][ T5597] vmalloc 0 [ 144.300724][ T5597] shmem 0 [ 144.300724][ T5597] zswap 0 [ 144.300724][ T5597] zswapped 0 [ 144.300724][ T5597] file_mapped 0 [ 144.300724][ T5597] file_dirty 0 [ 144.300724][ T5597] file_writeback 0 [ 144.300724][ T5597] swapcached 0 [ 144.300724][ T5597] anon_thp 0 [ 144.300724][ T5597] file_thp 0 [ 144.300724][ T5597] shmem_thp 0 [ 144.300724][ T5597] inactive_anon 0 [ 144.300724][ T5597] active_anon 0 [ 144.300724][ T5597] inactive_file 0 [pid 5603] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5603] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5603] openat(5, "memory.max", O_RDWR) = 6 [ 144.300724][ T5597] active_file 0 [ 144.300724][ T5597] unevictable 0 [ 144.300724][ T5597] slab_reclaimable 6752 [ 144.300724][ T5597] slab_unreclaimable 0 [ 144.300724][ T5597] slab 6752 [ 144.300724][ T5597] workingset_refault_anon 0 [ 144.403956][ T5597] Tasks state (memory values in pages): [ 144.409841][ T5597] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 144.419459][ T5597] Out of memory and no killable processes... [pid 5603] write(6, "0x000000000000040e", 18 [pid 5597] <... write resumed>) = 18 [ 144.425815][ T5600] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 144.436514][ T5600] CPU: 1 PID: 5600 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 144.446973][ T5600] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 144.457062][ T5600] Call Trace: [ 144.460348][ T5600] [ 144.463287][ T5600] dump_stack_lvl+0x1e7/0x2d0 [ 144.467991][ T5600] ? nf_tcp_handle_invalid+0x640/0x640 [ 144.473467][ T5600] ? panic+0x770/0x770 [ 144.477562][ T5600] dump_header+0xdc/0x940 [ 144.481912][ T5600] out_of_memory+0xf21/0x12c0 [ 144.486620][ T5600] ? mutex_lock_io_nested+0x60/0x60 [ 144.491847][ T5600] ? mark_lock+0x9a/0x340 [ 144.496186][ T5600] ? unregister_oom_notifier+0x20/0x20 [ 144.501663][ T5600] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 144.507693][ T5600] mem_cgroup_out_of_memory+0x263/0x3b0 [ 144.513274][ T5600] ? mem_cgroup_oom_trylock+0x210/0x210 [ 144.518851][ T5600] ? cgroup_file_notify+0x127/0x190 [ 144.524071][ T5600] memory_max_write+0x355/0x470 [ 144.528947][ T5600] ? memory_max_show+0xa0/0xa0 [ 144.533748][ T5600] ? read_lock_is_recursive+0x20/0x20 [ 144.539170][ T5600] ? memory_max_show+0xa0/0xa0 [ 144.543972][ T5600] cgroup_file_write+0x2b1/0x780 [ 144.548945][ T5600] ? cgroup_seqfile_stop+0xd0/0xd0 [ 144.554078][ T5600] ? __virt_addr_valid+0x22f/0x2e0 [ 144.559229][ T5600] ? cgroup_seqfile_stop+0xd0/0xd0 [ 144.564354][ T5600] kernfs_fop_write_iter+0x3a6/0x4f0 [ 144.569669][ T5600] vfs_write+0x7b2/0xbb0 [ 144.573942][ T5600] ? file_end_write+0x240/0x240 [ 144.578827][ T5600] ? do_raw_spin_unlock+0x13b/0x8b0 [ 144.584047][ T5600] ? lockdep_hardirqs_on+0x98/0x140 [ 144.589282][ T5600] ? __fdget_pos+0x265/0x2f0 [ 144.593895][ T5600] ksys_write+0x1a0/0x2c0 [ 144.598255][ T5600] ? __ia32_sys_read+0x90/0x90 [ 144.603043][ T5600] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 144.609049][ T5600] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 144.615053][ T5600] do_syscall_64+0x41/0xc0 [ 144.619487][ T5600] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 144.625402][ T5600] RIP: 0033:0x7fd49ce20129 [ 144.629834][ T5600] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 144.649483][ T5600] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 144.657917][ T5600] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 144.665900][ T5600] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [pid 5597] close(3) = 0 [pid 5597] close(4) = 0 [pid 5597] close(5) = 0 [pid 5597] close(6) = 0 [pid 5597] close(7) = -1 EBADF (Bad file descriptor) [pid 5597] close(8) = -1 EBADF (Bad file descriptor) [pid 5597] close(9) = -1 EBADF (Bad file descriptor) [pid 5597] close(10) = -1 EBADF (Bad file descriptor) [pid 5597] close(11) = -1 EBADF (Bad file descriptor) [pid 5597] close(12) = -1 EBADF (Bad file descriptor) [pid 5597] close(13) = -1 EBADF (Bad file descriptor) [pid 5597] close(14) = -1 EBADF (Bad file descriptor) [pid 5597] close(15) = -1 EBADF (Bad file descriptor) [pid 5597] close(16) = -1 EBADF (Bad file descriptor) [pid 5597] close(17) = -1 EBADF (Bad file descriptor) [pid 5597] close(18) = -1 EBADF (Bad file descriptor) [pid 5597] close(19) = -1 EBADF (Bad file descriptor) [pid 5597] close(20) = -1 EBADF (Bad file descriptor) [pid 5597] close(21) = -1 EBADF (Bad file descriptor) [pid 5597] close(22) = -1 EBADF (Bad file descriptor) [pid 5597] close(23) = -1 EBADF (Bad file descriptor) [pid 5597] close(24) = -1 EBADF (Bad file descriptor) [pid 5597] close(25) = -1 EBADF (Bad file descriptor) [pid 5597] close(26) = -1 EBADF (Bad file descriptor) [pid 5597] close(27) = -1 EBADF (Bad file descriptor) [pid 5597] close(28) = -1 EBADF (Bad file descriptor) [pid 5597] close(29) = -1 EBADF (Bad file descriptor) [pid 5597] exit_group(0) = ? [pid 5597] +++ exited with 0 +++ [pid 5073] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=26, si_uid=0, si_status=0, si_utime=0, si_stime=9 /* 0.09 s */} --- [pid 5073] umount2("./24", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] openat(AT_FDCWD, "./24", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5073] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5073] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5073] umount2("./24/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./24/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [ 144.673883][ T5600] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 144.681865][ T5600] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 144.689866][ T5600] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000015 [ 144.697887][ T5600] [pid 5073] unlink("./24/binderfs") = 0 [pid 5073] umount2("./24/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./24/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5073] unlink("./24/cgroup") = 0 [pid 5073] umount2("./24/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./24/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5073] unlink("./24/cgroup.net") = 0 [pid 5073] umount2("./24/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5073] umount2("./24/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./24/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5073] umount2("./24/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] openat(AT_FDCWD, "./24/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5073] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5073] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5073] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5073] close(4) = 0 [pid 5073] rmdir("./24/file0") = 0 [pid 5073] umount2("./24/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./24/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5073] unlink("./24/cgroup.cpu") = 0 [pid 5073] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5073] close(3) = 0 [pid 5073] rmdir("./24") = 0 [pid 5073] mkdir("./25", 0777) = 0 [pid 5073] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555574ac5d0) = 27 [ 144.745759][ T5600] memory: usage 8kB, limit 0kB, failcnt 55 [ 144.759769][ T5600] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 144.769983][ T5600] Memory cgroup stats for /syz1: [ 144.770187][ T5600] anon 0 [ 144.770187][ T5600] file 0 [ 144.770187][ T5600] kernel 8192 [ 144.770187][ T5600] kernel_stack 0 [ 144.770187][ T5600] pagetables 0 [ 144.770187][ T5600] sec_pagetables 0 [ 144.770187][ T5600] percpu 0 [ 144.770187][ T5600] sock 0 [ 144.770187][ T5600] vmalloc 0 [ 144.770187][ T5600] shmem 0 [ 144.770187][ T5600] zswap 0 [ 144.770187][ T5600] zswapped 0 [ 144.770187][ T5600] file_mapped 0 [ 144.770187][ T5600] file_dirty 0 [ 144.770187][ T5600] file_writeback 0 [ 144.770187][ T5600] swapcached 0 [ 144.770187][ T5600] anon_thp 0 [ 144.770187][ T5600] file_thp 0 [ 144.770187][ T5600] shmem_thp 0 [ 144.770187][ T5600] inactive_anon 0 [ 144.770187][ T5600] active_anon 0 [ 144.770187][ T5600] inactive_file 0 ./strace-static-x86_64: Process 5605 attached [pid 5605] chdir("./25") = 0 [ 144.770187][ T5600] active_file 0 [ 144.770187][ T5600] unevictable 0 [ 144.770187][ T5600] slab_reclaimable 6752 [ 144.770187][ T5600] slab_unreclaimable 0 [ 144.770187][ T5600] slab 6752 [ 144.770187][ T5600] workingset_refault_anon 0 [ 144.867030][ T5600] Tasks state (memory values in pages): [ 144.872897][ T5600] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 144.887807][ T5600] Out of memory and no killable processes... [pid 5605] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5600] <... write resumed>) = 18 [ 144.893860][ T5601] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 144.904535][ T5601] CPU: 0 PID: 5601 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 144.915019][ T5601] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 144.925108][ T5601] Call Trace: [ 144.928423][ T5601] [ 144.931386][ T5601] dump_stack_lvl+0x1e7/0x2d0 [ 144.936117][ T5601] ? nf_tcp_handle_invalid+0x640/0x640 [ 144.941620][ T5601] ? panic+0x770/0x770 [ 144.945736][ T5601] dump_header+0xdc/0x940 [ 144.950094][ T5601] out_of_memory+0xf21/0x12c0 [ 144.954824][ T5601] ? mutex_lock_io_nested+0x60/0x60 [ 144.960083][ T5601] ? preempt_schedule+0xdd/0xf0 [ 144.964985][ T5601] ? unregister_oom_notifier+0x20/0x20 [ 144.970493][ T5601] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 144.976540][ T5601] mem_cgroup_out_of_memory+0x263/0x3b0 [ 144.982138][ T5601] ? preempt_schedule_thunk+0x1a/0x20 [ 144.987570][ T5601] ? mem_cgroup_oom_trylock+0x210/0x210 [pid 5605] setpgid(0, 0) = 0 [pid 5605] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 5605] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 5605] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [pid 5605] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5605] write(3, "1000", 4) = 4 [pid 5605] close(3) = 0 [pid 5605] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5605] mkdir("./file0", 000) = 0 [pid 5605] open("./file0", O_RDONLY) = 3 [pid 5605] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5605] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5605] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5605] openat(5, "memory.max", O_RDWR) = 6 [ 144.993174][ T5601] ? cgroup_file_notify+0x127/0x190 [ 144.998419][ T5601] memory_max_write+0x355/0x470 [ 145.003354][ T5601] ? memory_max_show+0xa0/0xa0 [ 145.008182][ T5601] ? read_lock_is_recursive+0x20/0x20 [ 145.013613][ T5601] ? memory_max_show+0xa0/0xa0 [ 145.018436][ T5601] cgroup_file_write+0x2b1/0x780 [ 145.023435][ T5601] ? cgroup_seqfile_stop+0xd0/0xd0 [ 145.028598][ T5601] ? __virt_addr_valid+0x22f/0x2e0 [ 145.033779][ T5601] ? cgroup_seqfile_stop+0xd0/0xd0 [ 145.038917][ T5601] kernfs_fop_write_iter+0x3a6/0x4f0 [ 145.044243][ T5601] vfs_write+0x7b2/0xbb0 [ 145.048534][ T5601] ? file_end_write+0x240/0x240 [ 145.053414][ T5601] ? do_raw_spin_unlock+0x13b/0x8b0 [ 145.058662][ T5601] ? lockdep_hardirqs_on+0x98/0x140 [ 145.063922][ T5601] ? __fdget_pos+0x265/0x2f0 [ 145.068570][ T5601] ksys_write+0x1a0/0x2c0 [ 145.072938][ T5601] ? __ia32_sys_read+0x90/0x90 [ 145.077733][ T5601] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 145.083758][ T5601] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 145.089788][ T5601] do_syscall_64+0x41/0xc0 [pid 5605] write(6, "0x000000000000040e", 18 [pid 5600] close(3) = 0 [pid 5600] close(4) = 0 [pid 5600] close(5) = 0 [pid 5600] close(6) = 0 [pid 5600] close(7) = -1 EBADF (Bad file descriptor) [pid 5600] close(8) = -1 EBADF (Bad file descriptor) [pid 5600] close(9) = -1 EBADF (Bad file descriptor) [pid 5600] close(10) = -1 EBADF (Bad file descriptor) [pid 5600] close(11) = -1 EBADF (Bad file descriptor) [pid 5600] close(12) = -1 EBADF (Bad file descriptor) [pid 5600] close(13) = -1 EBADF (Bad file descriptor) [pid 5600] close(14) = -1 EBADF (Bad file descriptor) [pid 5600] close(15) = -1 EBADF (Bad file descriptor) [pid 5600] close(16) = -1 EBADF (Bad file descriptor) [pid 5600] close(17) = -1 EBADF (Bad file descriptor) [pid 5600] close(18) = -1 EBADF (Bad file descriptor) [pid 5600] close(19) = -1 EBADF (Bad file descriptor) [pid 5600] close(20) = -1 EBADF (Bad file descriptor) [pid 5600] close(21) = -1 EBADF (Bad file descriptor) [pid 5600] close(22) = -1 EBADF (Bad file descriptor) [pid 5600] close(23) = -1 EBADF (Bad file descriptor) [pid 5600] close(24) = -1 EBADF (Bad file descriptor) [pid 5600] close(25) = -1 EBADF (Bad file descriptor) [pid 5600] close(26) = -1 EBADF (Bad file descriptor) [pid 5600] close(27) = -1 EBADF (Bad file descriptor) [pid 5600] close(28) = -1 EBADF (Bad file descriptor) [pid 5600] close(29) = -1 EBADF (Bad file descriptor) [pid 5600] exit_group(0) = ? [ 145.094236][ T5601] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 145.100189][ T5601] RIP: 0033:0x7fd49ce20129 [ 145.104651][ T5601] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 145.124321][ T5601] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 145.132803][ T5601] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [pid 5600] +++ exited with 0 +++ [pid 5070] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=23, si_uid=0, si_status=0, si_utime=0, si_stime=7 /* 0.07 s */} --- [pid 5070] umount2("./21", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] openat(AT_FDCWD, "./21", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5070] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5070] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5070] umount2("./21/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./21/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5070] unlink("./21/binderfs") = 0 [pid 5070] umount2("./21/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./21/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5070] unlink("./21/cgroup") = 0 [pid 5070] umount2("./21/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./21/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5070] unlink("./21/cgroup.net") = 0 [pid 5070] umount2("./21/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5070] umount2("./21/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./21/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5070] umount2("./21/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 145.140833][ T5601] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 145.148857][ T5601] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 145.156891][ T5601] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 145.164919][ T5601] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000016 [ 145.172973][ T5601] [ 145.184400][ T5601] memory: usage 8kB, limit 0kB, failcnt 55 [ 145.190694][ T5601] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [pid 5070] openat(AT_FDCWD, "./21/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5070] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5070] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5070] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5070] close(4) = 0 [pid 5070] rmdir("./21/file0") = 0 [pid 5070] umount2("./21/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./21/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5070] unlink("./21/cgroup.cpu") = 0 [pid 5070] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5070] close(3) = 0 [pid 5070] rmdir("./21") = 0 [pid 5070] mkdir("./22", 0777) = 0 [pid 5070] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555574ac5d0) = 24 [ 145.201394][ T5601] Memory cgroup stats for /syz1: [ 145.203823][ T5601] anon 0 [ 145.203823][ T5601] file 0 [ 145.203823][ T5601] kernel 8192 [ 145.203823][ T5601] kernel_stack 0 [ 145.203823][ T5601] pagetables 0 [ 145.203823][ T5601] sec_pagetables 0 [ 145.203823][ T5601] percpu 0 [ 145.203823][ T5601] sock 0 [ 145.203823][ T5601] vmalloc 0 [ 145.203823][ T5601] shmem 0 [ 145.203823][ T5601] zswap 0 [ 145.203823][ T5601] zswapped 0 [ 145.203823][ T5601] file_mapped 0 [ 145.203823][ T5601] file_dirty 0 ./strace-static-x86_64: Process 5607 attached [ 145.203823][ T5601] file_writeback 0 [ 145.203823][ T5601] swapcached 0 [ 145.203823][ T5601] anon_thp 0 [ 145.203823][ T5601] file_thp 0 [ 145.203823][ T5601] shmem_thp 0 [ 145.203823][ T5601] inactive_anon 0 [ 145.203823][ T5601] active_anon 0 [ 145.203823][ T5601] inactive_file 0 [ 145.203823][ T5601] active_file 0 [ 145.203823][ T5601] unevictable 0 [ 145.203823][ T5601] slab_reclaimable 6752 [ 145.203823][ T5601] slab_unreclaimable 0 [ 145.203823][ T5601] slab 6752 [ 145.203823][ T5601] workingset_refault_anon 0 [pid 5607] chdir("./22") = 0 [pid 5607] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5607] setpgid(0, 0 [pid 5601] <... write resumed>) = 18 [pid 5607] <... setpgid resumed>) = 0 [pid 5607] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 5607] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 5607] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [ 145.306642][ T5601] Tasks state (memory values in pages): [ 145.312331][ T5601] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 145.322460][ T5601] Out of memory and no killable processes... [ 145.330033][ T5602] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 145.340850][ T5602] CPU: 0 PID: 5602 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [pid 5607] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5607] write(3, "1000", 4) = 4 [pid 5607] close(3) = 0 [pid 5607] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5607] mkdir("./file0", 000) = 0 [pid 5607] open("./file0", O_RDONLY) = 3 [pid 5607] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5607] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5607] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5607] openat(5, "memory.max", O_RDWR) = 6 [ 145.351320][ T5602] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 145.361415][ T5602] Call Trace: [ 145.364745][ T5602] [ 145.367717][ T5602] dump_stack_lvl+0x1e7/0x2d0 [ 145.372456][ T5602] ? nf_tcp_handle_invalid+0x640/0x640 [ 145.377967][ T5602] ? panic+0x770/0x770 [ 145.382103][ T5602] dump_header+0xdc/0x940 [ 145.386490][ T5602] out_of_memory+0xf21/0x12c0 [ 145.391226][ T5602] ? mutex_lock_io_nested+0x60/0x60 [ 145.396476][ T5602] ? preempt_schedule+0xdd/0xf0 [ 145.401358][ T5602] ? unregister_oom_notifier+0x20/0x20 [ 145.406860][ T5602] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 145.412900][ T5602] mem_cgroup_out_of_memory+0x263/0x3b0 [ 145.418498][ T5602] ? preempt_schedule_thunk+0x1a/0x20 [ 145.423887][ T5602] ? mem_cgroup_oom_trylock+0x210/0x210 [ 145.429477][ T5602] ? cgroup_file_notify+0x127/0x190 [ 145.434725][ T5602] memory_max_write+0x355/0x470 [ 145.439637][ T5602] ? memory_max_show+0xa0/0xa0 [ 145.444443][ T5602] ? read_lock_is_recursive+0x20/0x20 [ 145.449848][ T5602] ? memory_max_show+0xa0/0xa0 [ 145.454632][ T5602] cgroup_file_write+0x2b1/0x780 [ 145.459588][ T5602] ? cgroup_seqfile_stop+0xd0/0xd0 [ 145.464713][ T5602] ? __virt_addr_valid+0x22f/0x2e0 [ 145.469849][ T5602] ? cgroup_seqfile_stop+0xd0/0xd0 [ 145.474968][ T5602] kernfs_fop_write_iter+0x3a6/0x4f0 [ 145.480280][ T5602] vfs_write+0x7b2/0xbb0 [ 145.484542][ T5602] ? file_end_write+0x240/0x240 [ 145.489409][ T5602] ? do_raw_spin_unlock+0x13b/0x8b0 [ 145.494625][ T5602] ? lockdep_hardirqs_on+0x98/0x140 [ 145.499850][ T5602] ? __fdget_pos+0x265/0x2f0 [ 145.504459][ T5602] ksys_write+0x1a0/0x2c0 [ 145.508805][ T5602] ? __ia32_sys_read+0x90/0x90 [ 145.513581][ T5602] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 145.519601][ T5602] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 145.525628][ T5602] do_syscall_64+0x41/0xc0 [ 145.530064][ T5602] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 145.535976][ T5602] RIP: 0033:0x7fd49ce20129 [ 145.540406][ T5602] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 145.560020][ T5602] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 145.568453][ T5602] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 145.576438][ T5602] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 145.584420][ T5602] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 145.592413][ T5602] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [pid 5607] write(6, "0x000000000000040e", 18 [pid 5601] close(3) = 0 [pid 5601] close(4) = 0 [pid 5601] close(5) = 0 [pid 5601] close(6) = 0 [pid 5601] close(7) = -1 EBADF (Bad file descriptor) [pid 5601] close(8) = -1 EBADF (Bad file descriptor) [pid 5601] close(9) = -1 EBADF (Bad file descriptor) [pid 5601] close(10) = -1 EBADF (Bad file descriptor) [pid 5601] close(11) = -1 EBADF (Bad file descriptor) [pid 5601] close(12) = -1 EBADF (Bad file descriptor) [pid 5601] close(13) = -1 EBADF (Bad file descriptor) [pid 5601] close(14) = -1 EBADF (Bad file descriptor) [pid 5601] close(15) = -1 EBADF (Bad file descriptor) [pid 5601] close(16) = -1 EBADF (Bad file descriptor) [pid 5601] close(17) = -1 EBADF (Bad file descriptor) [pid 5601] close(18) = -1 EBADF (Bad file descriptor) [pid 5601] close(19) = -1 EBADF (Bad file descriptor) [pid 5601] close(20) = -1 EBADF (Bad file descriptor) [pid 5601] close(21) = -1 EBADF (Bad file descriptor) [pid 5601] close(22) = -1 EBADF (Bad file descriptor) [pid 5601] close(23) = -1 EBADF (Bad file descriptor) [pid 5601] close(24) = -1 EBADF (Bad file descriptor) [pid 5601] close(25) = -1 EBADF (Bad file descriptor) [pid 5601] close(26) = -1 EBADF (Bad file descriptor) [pid 5601] close(27) = -1 EBADF (Bad file descriptor) [pid 5601] close(28) = -1 EBADF (Bad file descriptor) [pid 5601] close(29) = -1 EBADF (Bad file descriptor) [pid 5601] exit_group(0) = ? [pid 5601] +++ exited with 0 +++ [pid 5072] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=24, si_uid=0, si_status=0, si_utime=0, si_stime=10 /* 0.10 s */} --- [ 145.600409][ T5602] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 000000000000001d [ 145.608419][ T5602] [pid 5072] umount2("./22", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] openat(AT_FDCWD, "./22", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5072] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5072] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [ 145.634382][ T5602] memory: usage 8kB, limit 0kB, failcnt 55 [ 145.641977][ T5602] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 145.650515][ T5602] Memory cgroup stats for /syz1: [ 145.650940][ T5602] anon 0 [ 145.650940][ T5602] file 0 [ 145.650940][ T5602] kernel 8192 [ 145.650940][ T5602] kernel_stack 0 [ 145.650940][ T5602] pagetables 0 [ 145.650940][ T5602] sec_pagetables 0 [ 145.650940][ T5602] percpu 0 [ 145.650940][ T5602] sock 0 [ 145.650940][ T5602] vmalloc 0 [pid 5072] umount2("./22/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./22/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5072] unlink("./22/binderfs") = 0 [pid 5072] umount2("./22/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./22/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5072] unlink("./22/cgroup") = 0 [pid 5072] umount2("./22/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./22/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5072] unlink("./22/cgroup.net") = 0 [ 145.650940][ T5602] shmem 0 [ 145.650940][ T5602] zswap 0 [ 145.650940][ T5602] zswapped 0 [ 145.650940][ T5602] file_mapped 0 [ 145.650940][ T5602] file_dirty 0 [ 145.650940][ T5602] file_writeback 0 [ 145.650940][ T5602] swapcached 0 [ 145.650940][ T5602] anon_thp 0 [ 145.650940][ T5602] file_thp 0 [ 145.650940][ T5602] shmem_thp 0 [ 145.650940][ T5602] inactive_anon 0 [ 145.650940][ T5602] active_anon 0 [ 145.650940][ T5602] inactive_file 0 [ 145.650940][ T5602] active_file 0 [ 145.650940][ T5602] unevictable 0 [ 145.650940][ T5602] slab_reclaimable 6752 [pid 5072] umount2("./22/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5072] umount2("./22/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./22/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5072] umount2("./22/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] openat(AT_FDCWD, "./22/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5072] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5072] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5072] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5072] close(4) = 0 [pid 5072] rmdir("./22/file0") = 0 [pid 5072] umount2("./22/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./22/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5072] unlink("./22/cgroup.cpu") = 0 [pid 5072] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5072] close(3) = 0 [pid 5072] rmdir("./22") = 0 [pid 5072] mkdir("./23", 0777) = 0 [pid 5072] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5608 attached [pid 5608] chdir("./23" [pid 5072] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 25 [pid 5608] <... chdir resumed>) = 0 [pid 5608] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5608] setpgid(0, 0) = 0 [ 145.650940][ T5602] slab_unreclaimable 0 [ 145.650940][ T5602] slab 6752 [ 145.650940][ T5602] workingset_refault_anon 0 [ 145.766111][ T5602] Tasks state (memory values in pages): [ 145.774949][ T5602] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5608] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 5608] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [pid 5608] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 5608] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5608] write(3, "1000", 4) = 4 [pid 5608] close(3) = 0 [pid 5608] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5608] mkdir("./file0", 000) = 0 [pid 5608] open("./file0", O_RDONLY) = 3 [pid 5608] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5608] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5608] openat(4, "syz1", O_RDWR|O_PATH [pid 5602] <... write resumed>) = 18 [pid 5608] <... openat resumed>) = 5 [pid 5602] close(3 [pid 5608] openat(5, "memory.max", O_RDWR [pid 5602] <... close resumed>) = 0 [pid 5608] <... openat resumed>) = 6 [pid 5602] close(4 [ 145.792538][ T5602] Out of memory and no killable processes... [ 145.800615][ T5603] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 145.826343][ T5603] CPU: 0 PID: 5603 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 145.836915][ T5603] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 145.847024][ T5603] Call Trace: [ 145.850341][ T5603] [ 145.853295][ T5603] dump_stack_lvl+0x1e7/0x2d0 [ 145.858001][ T5603] ? nf_tcp_handle_invalid+0x640/0x640 [ 145.863480][ T5603] ? panic+0x770/0x770 [ 145.867595][ T5603] dump_header+0xdc/0x940 [ 145.871980][ T5603] out_of_memory+0xf21/0x12c0 [ 145.876715][ T5603] ? mutex_lock_io_nested+0x60/0x60 [ 145.881976][ T5603] ? preempt_schedule+0xdd/0xf0 [ 145.886878][ T5603] ? unregister_oom_notifier+0x20/0x20 [pid 5608] write(6, "0x000000000000040e", 18 [pid 5602] <... close resumed>) = 0 [pid 5602] close(5) = 0 [pid 5602] close(6) = 0 [pid 5602] close(7) = -1 EBADF (Bad file descriptor) [pid 5602] close(8) = -1 EBADF (Bad file descriptor) [pid 5602] close(9) = -1 EBADF (Bad file descriptor) [pid 5602] close(10) = -1 EBADF (Bad file descriptor) [pid 5602] close(11) = -1 EBADF (Bad file descriptor) [pid 5602] close(12) = -1 EBADF (Bad file descriptor) [pid 5602] close(13) = -1 EBADF (Bad file descriptor) [ 145.892387][ T5603] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 145.898443][ T5603] mem_cgroup_out_of_memory+0x263/0x3b0 [ 145.904055][ T5603] ? preempt_schedule_thunk+0x1a/0x20 [ 145.909482][ T5603] ? mem_cgroup_oom_trylock+0x210/0x210 [ 145.915087][ T5603] ? cgroup_file_notify+0x127/0x190 [ 145.920338][ T5603] memory_max_write+0x355/0x470 [ 145.925246][ T5603] ? memory_max_show+0xa0/0xa0 [ 145.930064][ T5603] ? read_lock_is_recursive+0x20/0x20 [ 145.935493][ T5603] ? memory_max_show+0xa0/0xa0 [pid 5602] close(14) = -1 EBADF (Bad file descriptor) [pid 5602] close(15) = -1 EBADF (Bad file descriptor) [pid 5602] close(16) = -1 EBADF (Bad file descriptor) [pid 5602] close(17) = -1 EBADF (Bad file descriptor) [pid 5602] close(18) = -1 EBADF (Bad file descriptor) [pid 5602] close(19) = -1 EBADF (Bad file descriptor) [pid 5602] close(20) = -1 EBADF (Bad file descriptor) [pid 5602] close(21) = -1 EBADF (Bad file descriptor) [pid 5602] close(22) = -1 EBADF (Bad file descriptor) [pid 5602] close(23) = -1 EBADF (Bad file descriptor) [pid 5602] close(24) = -1 EBADF (Bad file descriptor) [pid 5602] close(25) = -1 EBADF (Bad file descriptor) [pid 5602] close(26) = -1 EBADF (Bad file descriptor) [pid 5602] close(27) = -1 EBADF (Bad file descriptor) [pid 5602] close(28) = -1 EBADF (Bad file descriptor) [pid 5602] close(29) = -1 EBADF (Bad file descriptor) [pid 5602] exit_group(0) = ? [pid 5602] +++ exited with 0 +++ [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=31, si_uid=0, si_status=0, si_utime=0, si_stime=10 /* 0.10 s */} --- [pid 5074] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5074] umount2("./29", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] openat(AT_FDCWD, "./29", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5074] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5074] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5074] umount2("./29/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./29/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [ 145.940312][ T5603] cgroup_file_write+0x2b1/0x780 [ 145.945300][ T5603] ? cgroup_seqfile_stop+0xd0/0xd0 [ 145.950463][ T5603] ? __virt_addr_valid+0x22f/0x2e0 [ 145.955639][ T5603] ? cgroup_seqfile_stop+0xd0/0xd0 [ 145.960796][ T5603] kernfs_fop_write_iter+0x3a6/0x4f0 [ 145.966153][ T5603] vfs_write+0x7b2/0xbb0 [ 145.970455][ T5603] ? file_end_write+0x240/0x240 [ 145.975361][ T5603] ? do_raw_spin_unlock+0x13b/0x8b0 [ 145.980607][ T5603] ? lockdep_hardirqs_on+0x98/0x140 [ 145.985862][ T5603] ? __fdget_pos+0x265/0x2f0 [pid 5074] unlink("./29/binderfs") = 0 [pid 5074] umount2("./29/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./29/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5074] unlink("./29/cgroup") = 0 [pid 5074] umount2("./29/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./29/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5074] unlink("./29/cgroup.net") = 0 [ 145.990503][ T5603] ksys_write+0x1a0/0x2c0 [ 145.994890][ T5603] ? __ia32_sys_read+0x90/0x90 [ 145.999712][ T5603] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 146.005749][ T5603] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 146.011778][ T5603] do_syscall_64+0x41/0xc0 [ 146.016224][ T5603] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 146.022208][ T5603] RIP: 0033:0x7fd49ce20129 [ 146.026660][ T5603] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 146.046314][ T5603] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 146.054760][ T5603] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 146.062764][ T5603] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 146.070764][ T5603] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 146.078781][ T5603] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [pid 5074] umount2("./29/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5074] umount2("./29/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./29/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5074] umount2("./29/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] openat(AT_FDCWD, "./29/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5074] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5074] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5074] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5074] close(4) = 0 [ 146.086786][ T5603] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 000000000000001c [ 146.094811][ T5603] [ 146.108257][ T5603] memory: usage 8kB, limit 0kB, failcnt 55 [ 146.114147][ T5603] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 146.121552][ T5603] Memory cgroup stats for /syz1: [ 146.121754][ T5603] anon 0 [ 146.121754][ T5603] file 0 [ 146.121754][ T5603] kernel 8192 [ 146.121754][ T5603] kernel_stack 0 [ 146.121754][ T5603] pagetables 0 [pid 5074] rmdir("./29/file0") = 0 [pid 5074] umount2("./29/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./29/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5074] unlink("./29/cgroup.cpu") = 0 [pid 5074] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5074] close(3) = 0 [pid 5074] rmdir("./29") = 0 [pid 5074] mkdir("./30", 0777) = 0 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555574ac5d0) = 32 ./strace-static-x86_64: Process 5609 attached [pid 5609] chdir("./30") = 0 [pid 5609] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5609] setpgid(0, 0) = 0 [pid 5609] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [pid 5609] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 5609] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [ 146.121754][ T5603] sec_pagetables 0 [ 146.121754][ T5603] percpu 0 [ 146.121754][ T5603] sock 0 [ 146.121754][ T5603] vmalloc 0 [ 146.121754][ T5603] shmem 0 [ 146.121754][ T5603] zswap 0 [ 146.121754][ T5603] zswapped 0 [ 146.121754][ T5603] file_mapped 0 [ 146.121754][ T5603] file_dirty 0 [ 146.121754][ T5603] file_writeback 0 [ 146.121754][ T5603] swapcached 0 [ 146.121754][ T5603] anon_thp 0 [ 146.121754][ T5603] file_thp 0 [ 146.121754][ T5603] shmem_thp 0 [ 146.121754][ T5603] inactive_anon 0 [ 146.121754][ T5603] active_anon 0 [pid 5609] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5609] write(3, "1000", 4) = 4 [pid 5609] close(3) = 0 [pid 5609] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5609] mkdir("./file0", 000) = 0 [pid 5609] open("./file0", O_RDONLY) = 3 [pid 5609] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5609] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5609] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5609] openat(5, "memory.max", O_RDWR) = 6 [ 146.121754][ T5603] inactive_file 0 [ 146.121754][ T5603] active_file 0 [ 146.121754][ T5603] unevictable 0 [ 146.121754][ T5603] slab_reclaimable 6752 [ 146.121754][ T5603] slab_unreclaimable 0 [ 146.121754][ T5603] slab 6752 [ 146.121754][ T5603] workingset_refault_anon 0 [ 146.221139][ T5603] Tasks state (memory values in pages): [ 146.227759][ T5603] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 146.237381][ T5603] Out of memory and no killable processes... [pid 5609] write(6, "0x000000000000040e", 18 [pid 5603] <... write resumed>) = 18 [pid 5603] close(3) = 0 [pid 5603] close(4) = 0 [pid 5603] close(5) = 0 [pid 5603] close(6) = 0 [pid 5603] close(7) = -1 EBADF (Bad file descriptor) [pid 5603] close(8) = -1 EBADF (Bad file descriptor) [pid 5603] close(9) = -1 EBADF (Bad file descriptor) [pid 5603] close(10) = -1 EBADF (Bad file descriptor) [pid 5603] close(11) = -1 EBADF (Bad file descriptor) [pid 5603] close(12) = -1 EBADF (Bad file descriptor) [pid 5603] close(13) = -1 EBADF (Bad file descriptor) [pid 5603] close(14) = -1 EBADF (Bad file descriptor) [pid 5603] close(15) = -1 EBADF (Bad file descriptor) [pid 5603] close(16) = -1 EBADF (Bad file descriptor) [pid 5603] close(17) = -1 EBADF (Bad file descriptor) [pid 5603] close(18) = -1 EBADF (Bad file descriptor) [pid 5603] close(19) = -1 EBADF (Bad file descriptor) [pid 5603] close(20) = -1 EBADF (Bad file descriptor) [pid 5603] close(21) = -1 EBADF (Bad file descriptor) [pid 5603] close(22) = -1 EBADF (Bad file descriptor) [pid 5603] close(23) = -1 EBADF (Bad file descriptor) [pid 5603] close(24) = -1 EBADF (Bad file descriptor) [pid 5603] close(25) = -1 EBADF (Bad file descriptor) [pid 5603] close(26) = -1 EBADF (Bad file descriptor) [pid 5603] close(27) = -1 EBADF (Bad file descriptor) [pid 5603] close(28) = -1 EBADF (Bad file descriptor) [pid 5603] close(29) = -1 EBADF (Bad file descriptor) [pid 5603] exit_group(0) = ? [pid 5603] +++ exited with 0 +++ [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=30, si_uid=0, si_status=0, si_utime=0, si_stime=9 /* 0.09 s */} --- [pid 5075] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5075] umount2("./28", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] openat(AT_FDCWD, "./28", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5075] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5075] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5075] umount2("./28/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./28/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5075] unlink("./28/binderfs") = 0 [pid 5075] umount2("./28/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./28/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5075] unlink("./28/cgroup") = 0 [pid 5075] umount2("./28/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./28/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [ 146.243600][ T5605] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 146.255270][ T5605] CPU: 1 PID: 5605 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 146.265729][ T5605] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 146.275807][ T5605] Call Trace: [ 146.279094][ T5605] [ 146.282057][ T5605] dump_stack_lvl+0x1e7/0x2d0 [ 146.286775][ T5605] ? nf_tcp_handle_invalid+0x640/0x640 [pid 5075] unlink("./28/cgroup.net") = 0 [ 146.292278][ T5605] ? panic+0x770/0x770 [ 146.296386][ T5605] dump_header+0xdc/0x940 [ 146.300759][ T5605] out_of_memory+0xf21/0x12c0 [ 146.305497][ T5605] ? mutex_lock_io_nested+0x60/0x60 [ 146.310758][ T5605] ? mark_lock+0x9a/0x340 [ 146.315128][ T5605] ? unregister_oom_notifier+0x20/0x20 [ 146.320636][ T5605] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 146.326661][ T5605] mem_cgroup_out_of_memory+0x263/0x3b0 [ 146.332267][ T5605] ? mem_cgroup_oom_trylock+0x210/0x210 [ 146.337880][ T5605] ? cgroup_file_notify+0x127/0x190 [ 146.343129][ T5605] memory_max_write+0x355/0x470 [ 146.348040][ T5605] ? memory_max_show+0xa0/0xa0 [ 146.352847][ T5605] ? read_lock_is_recursive+0x20/0x20 [ 146.358273][ T5605] ? memory_max_show+0xa0/0xa0 [ 146.363075][ T5605] cgroup_file_write+0x2b1/0x780 [ 146.368058][ T5605] ? cgroup_seqfile_stop+0xd0/0xd0 [ 146.373222][ T5605] ? __virt_addr_valid+0x22f/0x2e0 [ 146.378434][ T5605] ? cgroup_seqfile_stop+0xd0/0xd0 [ 146.383593][ T5605] kernfs_fop_write_iter+0x3a6/0x4f0 [ 146.388930][ T5605] vfs_write+0x7b2/0xbb0 [ 146.393223][ T5605] ? file_end_write+0x240/0x240 [ 146.398117][ T5605] ? do_raw_spin_unlock+0x13b/0x8b0 [ 146.403392][ T5605] ? lockdep_hardirqs_on+0x98/0x140 [ 146.408656][ T5605] ? __fdget_pos+0x265/0x2f0 [ 146.413300][ T5605] ksys_write+0x1a0/0x2c0 [ 146.417684][ T5605] ? __ia32_sys_read+0x90/0x90 [ 146.422500][ T5605] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 146.428544][ T5605] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 146.434582][ T5605] do_syscall_64+0x41/0xc0 [ 146.439040][ T5605] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 146.444992][ T5605] RIP: 0033:0x7fd49ce20129 [ 146.449434][ T5605] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 146.469090][ T5605] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 146.477559][ T5605] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 146.485563][ T5605] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [pid 5075] umount2("./28/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5075] umount2("./28/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./28/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5075] umount2("./28/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] openat(AT_FDCWD, "./28/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5075] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5075] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5075] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5075] close(4) = 0 [pid 5075] rmdir("./28/file0") = 0 [pid 5075] umount2("./28/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./28/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5075] unlink("./28/cgroup.cpu") = 0 [ 146.493583][ T5605] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 146.501571][ T5605] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 146.509574][ T5605] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000019 [ 146.517620][ T5605] [ 146.530082][ T5605] memory: usage 8kB, limit 0kB, failcnt 55 [ 146.537113][ T5605] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [pid 5075] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5075] close(3) = 0 [pid 5075] rmdir("./28") = 0 [pid 5075] mkdir("./29", 0777) = 0 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555574ac5d0) = 31 ./strace-static-x86_64: Process 5610 attached [ 146.545134][ T5605] Memory cgroup stats for /syz1: [ 146.545367][ T5605] anon 0 [ 146.545367][ T5605] file 0 [ 146.545367][ T5605] kernel 8192 [ 146.545367][ T5605] kernel_stack 0 [ 146.545367][ T5605] pagetables 0 [ 146.545367][ T5605] sec_pagetables 0 [ 146.545367][ T5605] percpu 0 [ 146.545367][ T5605] sock 0 [ 146.545367][ T5605] vmalloc 0 [ 146.545367][ T5605] shmem 0 [ 146.545367][ T5605] zswap 0 [ 146.545367][ T5605] zswapped 0 [ 146.545367][ T5605] file_mapped 0 [ 146.545367][ T5605] file_dirty 0 [pid 5610] chdir("./29") = 0 [pid 5610] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5610] setpgid(0, 0) = 0 [pid 5610] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 5610] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 5610] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 5610] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5610] write(3, "1000", 4) = 4 [pid 5610] close(3) = 0 [pid 5610] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5610] mkdir("./file0", 000) = 0 [pid 5610] open("./file0", O_RDONLY) = 3 [pid 5610] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5610] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5610] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5610] openat(5, "memory.max", O_RDWR) = 6 [ 146.545367][ T5605] file_writeback 0 [ 146.545367][ T5605] swapcached 0 [ 146.545367][ T5605] anon_thp 0 [ 146.545367][ T5605] file_thp 0 [ 146.545367][ T5605] shmem_thp 0 [ 146.545367][ T5605] inactive_anon 0 [ 146.545367][ T5605] active_anon 0 [ 146.545367][ T5605] inactive_file 0 [ 146.545367][ T5605] active_file 0 [ 146.545367][ T5605] unevictable 0 [ 146.545367][ T5605] slab_reclaimable 6752 [ 146.545367][ T5605] slab_unreclaimable 0 [ 146.545367][ T5605] slab 6752 [ 146.545367][ T5605] workingset_refault_anon 0 [pid 5610] write(6, "0x000000000000040e", 18 [pid 5605] <... write resumed>) = 18 [pid 5605] close(3) = 0 [pid 5605] close(4) = 0 [pid 5605] close(5) = 0 [pid 5605] close(6) = 0 [ 146.648510][ T5605] Tasks state (memory values in pages): [ 146.654178][ T5605] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 146.663807][ T5605] Out of memory and no killable processes... [ 146.670077][ T5607] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 146.681087][ T5607] CPU: 1 PID: 5607 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [pid 5605] close(7) = -1 EBADF (Bad file descriptor) [pid 5605] close(8) = -1 EBADF (Bad file descriptor) [pid 5605] close(9) = -1 EBADF (Bad file descriptor) [pid 5605] close(10) = -1 EBADF (Bad file descriptor) [pid 5605] close(11) = -1 EBADF (Bad file descriptor) [pid 5605] close(12) = -1 EBADF (Bad file descriptor) [pid 5605] close(13) = -1 EBADF (Bad file descriptor) [pid 5605] close(14) = -1 EBADF (Bad file descriptor) [ 146.691563][ T5607] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 146.701675][ T5607] Call Trace: [ 146.705001][ T5607] [ 146.707989][ T5607] dump_stack_lvl+0x1e7/0x2d0 [ 146.712725][ T5607] ? nf_tcp_handle_invalid+0x640/0x640 [ 146.718244][ T5607] ? panic+0x770/0x770 [ 146.722381][ T5607] dump_header+0xdc/0x940 [ 146.726775][ T5607] out_of_memory+0xf21/0x12c0 [ 146.731511][ T5607] ? mutex_lock_io_nested+0x60/0x60 [ 146.736774][ T5607] ? mark_lock+0x9a/0x340 [ 146.741161][ T5607] ? unregister_oom_notifier+0x20/0x20 [ 146.746674][ T5607] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 146.752709][ T5607] mem_cgroup_out_of_memory+0x263/0x3b0 [ 146.758288][ T5607] ? mem_cgroup_oom_trylock+0x210/0x210 [ 146.763869][ T5607] ? cgroup_file_notify+0x127/0x190 [ 146.769099][ T5607] memory_max_write+0x355/0x470 [ 146.773984][ T5607] ? memory_max_show+0xa0/0xa0 [ 146.778793][ T5607] ? read_lock_is_recursive+0x20/0x20 [ 146.784196][ T5607] ? memory_max_show+0xa0/0xa0 [ 146.788981][ T5607] cgroup_file_write+0x2b1/0x780 [ 146.793941][ T5607] ? cgroup_seqfile_stop+0xd0/0xd0 [pid 5605] close(15) = -1 EBADF (Bad file descriptor) [pid 5605] close(16) = -1 EBADF (Bad file descriptor) [pid 5605] close(17) = -1 EBADF (Bad file descriptor) [pid 5605] close(18) = -1 EBADF (Bad file descriptor) [pid 5605] close(19) = -1 EBADF (Bad file descriptor) [pid 5605] close(20) = -1 EBADF (Bad file descriptor) [pid 5605] close(21) = -1 EBADF (Bad file descriptor) [pid 5605] close(22) = -1 EBADF (Bad file descriptor) [pid 5605] close(23) = -1 EBADF (Bad file descriptor) [ 146.799067][ T5607] ? __virt_addr_valid+0x22f/0x2e0 [ 146.804224][ T5607] ? cgroup_seqfile_stop+0xd0/0xd0 [ 146.809351][ T5607] kernfs_fop_write_iter+0x3a6/0x4f0 [ 146.814662][ T5607] vfs_write+0x7b2/0xbb0 [ 146.819021][ T5607] ? file_end_write+0x240/0x240 [ 146.823897][ T5607] ? do_raw_spin_unlock+0x13b/0x8b0 [ 146.829130][ T5607] ? lockdep_hardirqs_on+0x98/0x140 [ 146.834353][ T5607] ? __fdget_pos+0x265/0x2f0 [ 146.838964][ T5607] ksys_write+0x1a0/0x2c0 [ 146.843315][ T5607] ? __ia32_sys_read+0x90/0x90 [ 146.848096][ T5607] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 146.854105][ T5607] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 146.860111][ T5607] do_syscall_64+0x41/0xc0 [ 146.864560][ T5607] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 146.870506][ T5607] RIP: 0033:0x7fd49ce20129 [ 146.874957][ T5607] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 5605] close(24) = -1 EBADF (Bad file descriptor) [pid 5605] close(25) = -1 EBADF (Bad file descriptor) [pid 5605] close(26) = -1 EBADF (Bad file descriptor) [pid 5605] close(27) = -1 EBADF (Bad file descriptor) [pid 5605] close(28) = -1 EBADF (Bad file descriptor) [pid 5605] close(29) = -1 EBADF (Bad file descriptor) [pid 5605] exit_group(0) = ? [pid 5605] +++ exited with 0 +++ [pid 5073] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=27, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- [pid 5073] umount2("./25", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 146.894585][ T5607] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 146.903036][ T5607] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 146.911044][ T5607] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 146.919039][ T5607] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 146.927041][ T5607] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 146.935034][ T5607] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000016 [ 146.943066][ T5607] [pid 5073] openat(AT_FDCWD, "./25", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [ 146.959986][ T5607] memory: usage 8kB, limit 0kB, failcnt 55 [ 146.965859][ T5607] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 146.974197][ T5607] Memory cgroup stats for /syz1: [ 146.974990][ T5607] anon 0 [ 146.974990][ T5607] file 0 [ 146.974990][ T5607] kernel 8192 [ 146.974990][ T5607] kernel_stack 0 [ 146.974990][ T5607] pagetables 0 [ 146.974990][ T5607] sec_pagetables 0 [ 146.974990][ T5607] percpu 0 [ 146.974990][ T5607] sock 0 [ 146.974990][ T5607] vmalloc 0 [ 146.974990][ T5607] shmem 0 [ 146.974990][ T5607] zswap 0 [ 146.974990][ T5607] zswapped 0 [ 146.974990][ T5607] file_mapped 0 [ 146.974990][ T5607] file_dirty 0 [ 146.974990][ T5607] file_writeback 0 [ 146.974990][ T5607] swapcached 0 [ 146.974990][ T5607] anon_thp 0 [ 146.974990][ T5607] file_thp 0 [ 146.974990][ T5607] shmem_thp 0 [ 146.974990][ T5607] inactive_anon 0 [ 146.974990][ T5607] active_anon 0 [ 146.974990][ T5607] inactive_file 0 [ 146.974990][ T5607] active_file 0 [ 146.974990][ T5607] unevictable 0 [ 146.974990][ T5607] slab_reclaimable 6752 [pid 5073] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5073] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5073] umount2("./25/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./25/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5073] unlink("./25/binderfs") = 0 [pid 5073] umount2("./25/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./25/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5073] unlink("./25/cgroup") = 0 [pid 5073] umount2("./25/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./25/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5073] unlink("./25/cgroup.net") = 0 [pid 5073] umount2("./25/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5073] umount2("./25/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./25/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5073] umount2("./25/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] openat(AT_FDCWD, "./25/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5073] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [ 146.974990][ T5607] slab_unreclaimable 0 [ 146.974990][ T5607] slab 6752 [ 146.974990][ T5607] workingset_refault_anon 0 [ 147.077062][ T5607] Tasks state (memory values in pages): [ 147.085742][ T5607] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 147.095635][ T5607] Out of memory and no killable processes... [pid 5073] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5073] getdents64(4, [pid 5607] <... write resumed>) = 18 [pid 5607] close(3) = 0 [pid 5607] close(4) = 0 [pid 5073] <... getdents64 resumed>0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5073] close(4 [pid 5607] close(5) = 0 [pid 5607] close(6 [pid 5073] <... close resumed>) = 0 [pid 5073] rmdir("./25/file0") = 0 [pid 5073] umount2("./25/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5607] <... close resumed>) = 0 [pid 5607] close(7) = -1 EBADF (Bad file descriptor) [pid 5073] lstat("./25/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5073] unlink("./25/cgroup.cpu" [pid 5607] close(8 [pid 5073] <... unlink resumed>) = 0 [pid 5607] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5073] getdents64(3, [pid 5607] close(9 [pid 5073] <... getdents64 resumed>0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5073] close(3) = 0 [pid 5073] rmdir("./25" [pid 5607] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5607] close(10) = -1 EBADF (Bad file descriptor) [pid 5607] close(11) = -1 EBADF (Bad file descriptor) [pid 5607] close(12) = -1 EBADF (Bad file descriptor) [pid 5073] <... rmdir resumed>) = 0 [pid 5607] close(13 [pid 5073] mkdir("./26", 0777 [pid 5607] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5607] close(14) = -1 EBADF (Bad file descriptor) [pid 5607] close(15) = -1 EBADF (Bad file descriptor) [pid 5607] close(16) = -1 EBADF (Bad file descriptor) [pid 5607] close(17) = -1 EBADF (Bad file descriptor) [pid 5073] <... mkdir resumed>) = 0 [pid 5607] close(18 [pid 5073] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5607] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5607] close(19) = -1 EBADF (Bad file descriptor) ./strace-static-x86_64: Process 5611 attached [pid 5607] close(20 [pid 5611] chdir("./26") = 0 [pid 5073] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 28 [pid 5611] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5611] setpgid(0, 0) = 0 [pid 5611] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 5611] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 5611] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [pid 5611] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5611] write(3, "1000", 4) = 4 [pid 5611] close(3) = 0 [ 147.103456][ T5608] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 147.128678][ T5608] CPU: 0 PID: 5608 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 147.139238][ T5608] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 147.149318][ T5608] Call Trace: [ 147.152626][ T5608] [ 147.155591][ T5608] dump_stack_lvl+0x1e7/0x2d0 [pid 5611] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5611] mkdir("./file0", 000) = 0 [pid 5611] open("./file0", O_RDONLY) = 3 [pid 5611] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5611] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5611] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5611] openat(5, "memory.max", O_RDWR) = 6 [ 147.160322][ T5608] ? nf_tcp_handle_invalid+0x640/0x640 [ 147.165817][ T5608] ? panic+0x770/0x770 [ 147.169949][ T5608] dump_header+0xdc/0x940 [ 147.174343][ T5608] out_of_memory+0xf21/0x12c0 [ 147.179092][ T5608] ? mutex_lock_io_nested+0x60/0x60 [ 147.184345][ T5608] ? mark_lock+0x9a/0x340 [ 147.188714][ T5608] ? unregister_oom_notifier+0x20/0x20 [ 147.194223][ T5608] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 147.200262][ T5608] mem_cgroup_out_of_memory+0x263/0x3b0 [ 147.205865][ T5608] ? mem_cgroup_oom_trylock+0x210/0x210 [pid 5611] write(6, "0x000000000000040e", 18 [pid 5607] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5607] close(21) = -1 EBADF (Bad file descriptor) [pid 5607] close(22) = -1 EBADF (Bad file descriptor) [pid 5607] close(23) = -1 EBADF (Bad file descriptor) [pid 5607] close(24) = -1 EBADF (Bad file descriptor) [pid 5607] close(25) = -1 EBADF (Bad file descriptor) [pid 5607] close(26) = -1 EBADF (Bad file descriptor) [pid 5607] close(27) = -1 EBADF (Bad file descriptor) [pid 5607] close(28) = -1 EBADF (Bad file descriptor) [pid 5607] close(29) = -1 EBADF (Bad file descriptor) [ 147.211479][ T5608] ? cgroup_file_notify+0x127/0x190 [ 147.216745][ T5608] memory_max_write+0x355/0x470 [ 147.221660][ T5608] ? memory_max_show+0xa0/0xa0 [ 147.226491][ T5608] ? read_lock_is_recursive+0x20/0x20 [ 147.231931][ T5608] ? memory_max_show+0xa0/0xa0 [ 147.236744][ T5608] cgroup_file_write+0x2b1/0x780 [ 147.241737][ T5608] ? cgroup_seqfile_stop+0xd0/0xd0 [ 147.246879][ T5608] ? __virt_addr_valid+0x22f/0x2e0 [ 147.252025][ T5608] ? cgroup_seqfile_stop+0xd0/0xd0 [ 147.257151][ T5608] kernfs_fop_write_iter+0x3a6/0x4f0 [ 147.262460][ T5608] vfs_write+0x7b2/0xbb0 [ 147.266731][ T5608] ? file_end_write+0x240/0x240 [ 147.271601][ T5608] ? do_raw_spin_unlock+0x13b/0x8b0 [ 147.276828][ T5608] ? lockdep_hardirqs_on+0x98/0x140 [ 147.282065][ T5608] ? __fdget_pos+0x265/0x2f0 [ 147.286680][ T5608] ksys_write+0x1a0/0x2c0 [ 147.291037][ T5608] ? __ia32_sys_read+0x90/0x90 [ 147.295820][ T5608] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 147.301825][ T5608] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 147.307831][ T5608] do_syscall_64+0x41/0xc0 [ 147.312317][ T5608] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 147.318421][ T5608] RIP: 0033:0x7fd49ce20129 [ 147.322845][ T5608] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 147.342463][ T5608] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 147.350898][ T5608] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 147.358898][ T5608] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 147.367067][ T5608] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 147.375150][ T5608] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 147.383138][ T5608] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000017 [ 147.391144][ T5608] [ 147.398993][ T5608] memory: usage 8kB, limit 0kB, failcnt 55 [pid 5607] exit_group(0) = ? [pid 5607] +++ exited with 0 +++ [pid 5070] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=24, si_uid=0, si_status=0, si_utime=0, si_stime=10 /* 0.10 s */} --- [pid 5070] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5070] umount2("./22", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] openat(AT_FDCWD, "./22", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5070] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5070] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5070] umount2("./22/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./22/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5070] unlink("./22/binderfs") = 0 [pid 5070] umount2("./22/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./22/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5070] unlink("./22/cgroup") = 0 [pid 5070] umount2("./22/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./22/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5070] unlink("./22/cgroup.net") = 0 [ 147.409373][ T5608] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 147.424781][ T5608] Memory cgroup stats for /syz1: [ 147.425001][ T5608] anon 0 [ 147.425001][ T5608] file 0 [ 147.425001][ T5608] kernel 8192 [ 147.425001][ T5608] kernel_stack 0 [ 147.425001][ T5608] pagetables 0 [ 147.425001][ T5608] sec_pagetables 0 [ 147.425001][ T5608] percpu 0 [ 147.425001][ T5608] sock 0 [ 147.425001][ T5608] vmalloc 0 [ 147.425001][ T5608] shmem 0 [ 147.425001][ T5608] zswap 0 [ 147.425001][ T5608] zswapped 0 [ 147.425001][ T5608] file_mapped 0 [ 147.425001][ T5608] file_dirty 0 [ 147.425001][ T5608] file_writeback 0 [ 147.425001][ T5608] swapcached 0 [ 147.425001][ T5608] anon_thp 0 [ 147.425001][ T5608] file_thp 0 [ 147.425001][ T5608] shmem_thp 0 [ 147.425001][ T5608] inactive_anon 0 [ 147.425001][ T5608] active_anon 0 [ 147.425001][ T5608] inactive_file 0 [ 147.425001][ T5608] active_file 0 [ 147.425001][ T5608] unevictable 0 [ 147.425001][ T5608] slab_reclaimable 6752 [pid 5070] umount2("./22/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5070] umount2("./22/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./22/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5070] umount2("./22/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] openat(AT_FDCWD, "./22/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5070] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5070] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5070] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5070] close(4) = 0 [pid 5070] rmdir("./22/file0") = 0 [pid 5070] umount2("./22/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./22/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5070] unlink("./22/cgroup.cpu") = 0 [pid 5070] getdents64(3, [pid 5608] <... write resumed>) = 18 [pid 5070] <... getdents64 resumed>0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5070] close(3) = 0 [ 147.425001][ T5608] slab_unreclaimable 0 [ 147.425001][ T5608] slab 6752 [ 147.425001][ T5608] workingset_refault_anon 0 [ 147.523551][ T5608] Tasks state (memory values in pages): [ 147.530055][ T5608] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 147.540630][ T5608] Out of memory and no killable processes... [ 147.547626][ T5609] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5070] rmdir("./22") = 0 [pid 5070] mkdir("./23", 0777) = 0 [pid 5070] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5612 attached [pid 5612] chdir("./23" [pid 5070] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 25 [pid 5612] <... chdir resumed>) = 0 [pid 5612] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5612] setpgid(0, 0) = 0 [pid 5612] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 5612] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 5612] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [ 147.558688][ T5609] CPU: 1 PID: 5609 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 147.569160][ T5609] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 147.579274][ T5609] Call Trace: [ 147.582587][ T5609] [ 147.585548][ T5609] dump_stack_lvl+0x1e7/0x2d0 [ 147.590284][ T5609] ? nf_tcp_handle_invalid+0x640/0x640 [ 147.595797][ T5609] ? panic+0x770/0x770 [ 147.599936][ T5609] dump_header+0xdc/0x940 [ 147.604320][ T5609] out_of_memory+0xf21/0x12c0 [pid 5612] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5612] write(3, "1000", 4) = 4 [pid 5612] close(3 [pid 5608] close(3 [pid 5612] <... close resumed>) = 0 [pid 5608] <... close resumed>) = 0 [pid 5612] symlink("/dev/binderfs", "./binderfs" [pid 5608] close(4 [pid 5612] <... symlink resumed>) = 0 [pid 5608] <... close resumed>) = 0 [pid 5612] mkdir("./file0", 000 [pid 5608] close(5 [pid 5612] <... mkdir resumed>) = 0 [ 147.609051][ T5609] ? mutex_lock_io_nested+0x60/0x60 [ 147.614307][ T5609] ? preempt_schedule+0xdd/0xf0 [ 147.619209][ T5609] ? unregister_oom_notifier+0x20/0x20 [ 147.624719][ T5609] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 147.630872][ T5609] mem_cgroup_out_of_memory+0x263/0x3b0 [ 147.636473][ T5609] ? preempt_schedule_thunk+0x1a/0x20 [ 147.641895][ T5609] ? mem_cgroup_oom_trylock+0x210/0x210 [ 147.647488][ T5609] ? cgroup_file_notify+0x127/0x190 [ 147.652727][ T5609] memory_max_write+0x355/0x470 [ 147.657699][ T5609] ? memory_max_show+0xa0/0xa0 [ 147.662487][ T5609] ? read_lock_is_recursive+0x20/0x20 [ 147.667895][ T5609] ? memory_max_show+0xa0/0xa0 [ 147.672683][ T5609] cgroup_file_write+0x2b1/0x780 [ 147.677642][ T5609] ? cgroup_seqfile_stop+0xd0/0xd0 [ 147.682855][ T5609] ? __virt_addr_valid+0x22f/0x2e0 [ 147.688084][ T5609] ? cgroup_seqfile_stop+0xd0/0xd0 [ 147.693215][ T5609] kernfs_fop_write_iter+0x3a6/0x4f0 [ 147.698523][ T5609] vfs_write+0x7b2/0xbb0 [ 147.702788][ T5609] ? file_end_write+0x240/0x240 [ 147.707660][ T5609] ? do_raw_spin_unlock+0x13b/0x8b0 [ 147.712872][ T5609] ? lockdep_hardirqs_on+0x98/0x140 [ 147.718095][ T5609] ? __fdget_pos+0x265/0x2f0 [ 147.722705][ T5609] ksys_write+0x1a0/0x2c0 [ 147.727076][ T5609] ? __ia32_sys_read+0x90/0x90 [ 147.731897][ T5609] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 147.738279][ T5609] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 147.744294][ T5609] do_syscall_64+0x41/0xc0 [ 147.748820][ T5609] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 147.754743][ T5609] RIP: 0033:0x7fd49ce20129 [ 147.759173][ T5609] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 147.778828][ T5609] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 147.787291][ T5609] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 147.795278][ T5609] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 147.803259][ T5609] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [pid 5608] <... close resumed>) = 0 [pid 5612] open("./file0", O_RDONLY [pid 5608] close(6 [pid 5612] <... open resumed>) = 3 [pid 5608] <... close resumed>) = 0 [pid 5612] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5608] close(7 [pid 5612] <... mount resumed>) = 0 [pid 5608] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5612] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5608] close(8 [pid 5612] <... openat resumed>) = 4 [pid 5608] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5612] openat(4, "syz1", O_RDWR|O_PATH [pid 5608] close(9 [pid 5612] <... openat resumed>) = 5 [pid 5608] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5612] openat(5, "memory.max", O_RDWR [pid 5608] close(10 [pid 5612] <... openat resumed>) = 6 [pid 5608] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5612] write(6, "0x000000000000040e", 18 [pid 5608] close(11) = -1 EBADF (Bad file descriptor) [pid 5608] close(12) = -1 EBADF (Bad file descriptor) [pid 5608] close(13) = -1 EBADF (Bad file descriptor) [pid 5608] close(14) = -1 EBADF (Bad file descriptor) [pid 5608] close(15) = -1 EBADF (Bad file descriptor) [pid 5608] close(16) = -1 EBADF (Bad file descriptor) [pid 5608] close(17) = -1 EBADF (Bad file descriptor) [pid 5608] close(18) = -1 EBADF (Bad file descriptor) [pid 5608] close(19) = -1 EBADF (Bad file descriptor) [pid 5608] close(20) = -1 EBADF (Bad file descriptor) [pid 5608] close(21) = -1 EBADF (Bad file descriptor) [ 147.811239][ T5609] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 147.819221][ T5609] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 000000000000001e [ 147.827234][ T5609] [ 147.835744][ T5609] memory: usage 8kB, limit 0kB, failcnt 55 [ 147.842413][ T5609] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 147.851290][ T5609] Memory cgroup stats for /syz1: [ 147.851780][ T5609] anon 0 [ 147.851780][ T5609] file 0 [pid 5608] close(22) = -1 EBADF (Bad file descriptor) [pid 5608] close(23) = -1 EBADF (Bad file descriptor) [pid 5608] close(24) = -1 EBADF (Bad file descriptor) [pid 5608] close(25) = -1 EBADF (Bad file descriptor) [pid 5608] close(26) = -1 EBADF (Bad file descriptor) [pid 5608] close(27) = -1 EBADF (Bad file descriptor) [pid 5608] close(28) = -1 EBADF (Bad file descriptor) [pid 5608] close(29) = -1 EBADF (Bad file descriptor) [pid 5608] exit_group(0) = ? [pid 5608] +++ exited with 0 +++ [pid 5072] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=25, si_uid=0, si_status=0, si_utime=0, si_stime=6 /* 0.06 s */} --- [pid 5072] restart_syscall(<... resuming interrupted clone ...>) = 0 [ 147.851780][ T5609] kernel 8192 [ 147.851780][ T5609] kernel_stack 0 [ 147.851780][ T5609] pagetables 0 [ 147.851780][ T5609] sec_pagetables 0 [ 147.851780][ T5609] percpu 0 [ 147.851780][ T5609] sock 0 [ 147.851780][ T5609] vmalloc 0 [ 147.851780][ T5609] shmem 0 [ 147.851780][ T5609] zswap 0 [ 147.851780][ T5609] zswapped 0 [ 147.851780][ T5609] file_mapped 0 [ 147.851780][ T5609] file_dirty 0 [ 147.851780][ T5609] file_writeback 0 [ 147.851780][ T5609] swapcached 0 [ 147.851780][ T5609] anon_thp 0 [ 147.851780][ T5609] file_thp 0 [pid 5072] umount2("./23", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] openat(AT_FDCWD, "./23", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5072] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5072] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5072] umount2("./23/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./23/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5072] unlink("./23/binderfs") = 0 [pid 5072] umount2("./23/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./23/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5072] unlink("./23/cgroup") = 0 [pid 5072] umount2("./23/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./23/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5072] unlink("./23/cgroup.net") = 0 [pid 5072] umount2("./23/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5072] umount2("./23/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./23/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5072] umount2("./23/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] openat(AT_FDCWD, "./23/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5072] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [ 147.851780][ T5609] shmem_thp 0 [ 147.851780][ T5609] inactive_anon 0 [ 147.851780][ T5609] active_anon 0 [ 147.851780][ T5609] inactive_file 0 [ 147.851780][ T5609] active_file 0 [ 147.851780][ T5609] unevictable 0 [ 147.851780][ T5609] slab_reclaimable 6752 [ 147.851780][ T5609] slab_unreclaimable 0 [ 147.851780][ T5609] slab 6752 [ 147.851780][ T5609] workingset_refault_anon 0 [ 147.953887][ T5609] Tasks state (memory values in pages): [pid 5072] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5609] <... write resumed>) = 18 [pid 5609] close(3) = 0 [pid 5609] close(4) = 0 [pid 5609] close(5) = 0 [pid 5609] close(6) = 0 [pid 5072] getdents64(4, [pid 5609] close(7) = -1 EBADF (Bad file descriptor) [pid 5609] close(8) = -1 EBADF (Bad file descriptor) [pid 5609] close(9) = -1 EBADF (Bad file descriptor) [pid 5072] <... getdents64 resumed>0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5609] close(10) = -1 EBADF (Bad file descriptor) [pid 5072] close(4 [pid 5609] close(11 [pid 5072] <... close resumed>) = 0 [pid 5609] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5072] rmdir("./23/file0" [pid 5609] close(12) = -1 EBADF (Bad file descriptor) [pid 5609] close(13) = -1 EBADF (Bad file descriptor) [pid 5609] close(14) = -1 EBADF (Bad file descriptor) [pid 5609] close(15) = -1 EBADF (Bad file descriptor) [pid 5072] <... rmdir resumed>) = 0 [pid 5609] close(16) = -1 EBADF (Bad file descriptor) [pid 5072] umount2("./23/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5609] close(17) = -1 EBADF (Bad file descriptor) [pid 5072] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5609] close(18 [pid 5072] lstat("./23/cgroup.cpu", [pid 5609] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5072] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5609] close(19) = -1 EBADF (Bad file descriptor) [pid 5072] unlink("./23/cgroup.cpu" [pid 5609] close(20) = -1 EBADF (Bad file descriptor) [pid 5609] close(21) = -1 EBADF (Bad file descriptor) [pid 5609] close(22) = -1 EBADF (Bad file descriptor) [pid 5609] close(23) = -1 EBADF (Bad file descriptor) [pid 5609] close(24) = -1 EBADF (Bad file descriptor) [pid 5609] close(25) = -1 EBADF (Bad file descriptor) [pid 5609] close(26) = -1 EBADF (Bad file descriptor) [pid 5609] close(27) = -1 EBADF (Bad file descriptor) [pid 5609] close(28) = -1 EBADF (Bad file descriptor) [pid 5609] close(29) = -1 EBADF (Bad file descriptor) [pid 5609] exit_group(0) = ? [pid 5609] +++ exited with 0 +++ [pid 5072] <... unlink resumed>) = 0 [pid 5072] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5072] close(3) = 0 [ 147.960249][ T5609] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 147.970791][ T5609] Out of memory and no killable processes... [ 147.976983][ T5610] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 147.997873][ T5610] CPU: 0 PID: 5610 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [pid 5072] rmdir("./23") = 0 [pid 5072] mkdir("./24", 0777) = 0 [pid 5072] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555574ac5d0) = 26 [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=32, si_uid=0, si_status=0, si_utime=0, si_stime=10 /* 0.10 s */} --- [pid 5074] umount2("./30", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] openat(AT_FDCWD, "./30", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5074] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5074] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5074] umount2("./30/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./30/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5074] unlink("./30/binderfs") = 0 [pid 5074] umount2("./30/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./30/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5074] unlink("./30/cgroup") = 0 [pid 5074] umount2("./30/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./30/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5074] unlink("./30/cgroup.net") = 0 [pid 5074] umount2("./30/file0", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5613 attached [pid 5613] chdir("./24") = 0 [pid 5613] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5613] setpgid(0, 0) = 0 [pid 5613] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 5613] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [ 148.008437][ T5610] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 148.018533][ T5610] Call Trace: [ 148.021856][ T5610] [ 148.024820][ T5610] dump_stack_lvl+0x1e7/0x2d0 [ 148.029553][ T5610] ? nf_tcp_handle_invalid+0x640/0x640 [ 148.035062][ T5610] ? panic+0x770/0x770 [ 148.039196][ T5610] dump_header+0xdc/0x940 [ 148.043593][ T5610] out_of_memory+0xf21/0x12c0 [ 148.048317][ T5610] ? mutex_lock_io_nested+0x60/0x60 [ 148.053559][ T5610] ? mark_lock+0x9a/0x340 [ 148.057959][ T5610] ? unregister_oom_notifier+0x20/0x20 [pid 5613] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 5613] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5613] write(3, "1000", 4) = 4 [pid 5613] close(3) = 0 [pid 5613] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5613] mkdir("./file0", 000) = 0 [pid 5613] open("./file0", O_RDONLY) = 3 [pid 5613] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5613] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5613] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5613] openat(5, "memory.max", O_RDWR) = 6 [ 148.063463][ T5610] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 148.069510][ T5610] mem_cgroup_out_of_memory+0x263/0x3b0 [ 148.075112][ T5610] ? mem_cgroup_oom_trylock+0x210/0x210 [ 148.080745][ T5610] ? cgroup_file_notify+0x127/0x190 [ 148.086002][ T5610] memory_max_write+0x355/0x470 [ 148.090925][ T5610] ? memory_max_show+0xa0/0xa0 [ 148.095735][ T5610] ? read_lock_is_recursive+0x20/0x20 [ 148.101150][ T5610] ? memory_max_show+0xa0/0xa0 [ 148.105928][ T5610] cgroup_file_write+0x2b1/0x780 [ 148.110883][ T5610] ? cgroup_seqfile_stop+0xd0/0xd0 [ 148.116003][ T5610] ? __virt_addr_valid+0x22f/0x2e0 [ 148.121148][ T5610] ? cgroup_seqfile_stop+0xd0/0xd0 [ 148.126282][ T5610] kernfs_fop_write_iter+0x3a6/0x4f0 [ 148.131591][ T5610] vfs_write+0x7b2/0xbb0 [ 148.135854][ T5610] ? file_end_write+0x240/0x240 [ 148.140720][ T5610] ? do_raw_spin_unlock+0x13b/0x8b0 [ 148.145928][ T5610] ? lockdep_hardirqs_on+0x98/0x140 [ 148.151146][ T5610] ? __fdget_pos+0x265/0x2f0 [ 148.155748][ T5610] ksys_write+0x1a0/0x2c0 [ 148.160092][ T5610] ? __ia32_sys_read+0x90/0x90 [ 148.164861][ T5610] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 148.170857][ T5610] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 148.176858][ T5610] do_syscall_64+0x41/0xc0 [ 148.181307][ T5610] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 148.187226][ T5610] RIP: 0033:0x7fd49ce20129 [ 148.191651][ T5610] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 148.211267][ T5610] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 148.219697][ T5610] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 148.227678][ T5610] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 148.235659][ T5610] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 148.243668][ T5610] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 148.251738][ T5610] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 000000000000001d [ 148.259750][ T5610] [pid 5613] write(6, "0x000000000000040e", 18 [pid 5074] <... umount2 resumed>) = 0 [pid 5074] umount2("./30/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./30/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5074] umount2("./30/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] openat(AT_FDCWD, "./30/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5074] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5074] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5074] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5074] close(4) = 0 [pid 5074] rmdir("./30/file0") = 0 [pid 5074] umount2("./30/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./30/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5074] unlink("./30/cgroup.cpu") = 0 [pid 5074] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5074] close(3) = 0 [pid 5074] rmdir("./30") = 0 [pid 5074] mkdir("./31", 0777) = 0 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555574ac5d0) = 33 [ 148.271661][ T5610] memory: usage 8kB, limit 0kB, failcnt 55 [ 148.277944][ T5610] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 148.285100][ T5610] Memory cgroup stats for /syz1: [ 148.285305][ T5610] anon 0 [ 148.285305][ T5610] file 0 [ 148.285305][ T5610] kernel 8192 [ 148.285305][ T5610] kernel_stack 0 [ 148.285305][ T5610] pagetables 0 [ 148.285305][ T5610] sec_pagetables 0 [ 148.285305][ T5610] percpu 0 [ 148.285305][ T5610] sock 0 [ 148.285305][ T5610] vmalloc 0 [ 148.285305][ T5610] shmem 0 ./strace-static-x86_64: Process 5614 attached [ 148.285305][ T5610] zswap 0 [ 148.285305][ T5610] zswapped 0 [ 148.285305][ T5610] file_mapped 0 [ 148.285305][ T5610] file_dirty 0 [ 148.285305][ T5610] file_writeback 0 [ 148.285305][ T5610] swapcached 0 [ 148.285305][ T5610] anon_thp 0 [ 148.285305][ T5610] file_thp 0 [ 148.285305][ T5610] shmem_thp 0 [ 148.285305][ T5610] inactive_anon 0 [ 148.285305][ T5610] active_anon 0 [ 148.285305][ T5610] inactive_file 0 [ 148.285305][ T5610] active_file 0 [ 148.285305][ T5610] unevictable 0 [ 148.285305][ T5610] slab_reclaimable 6752 [pid 5614] chdir("./31") = 0 [pid 5614] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5614] setpgid(0, 0) = 0 [pid 5614] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [pid 5614] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 5614] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 5614] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5614] write(3, "1000", 4) = 4 [pid 5614] close(3) = 0 [pid 5614] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5614] mkdir("./file0", 000) = 0 [pid 5614] open("./file0", O_RDONLY) = 3 [pid 5614] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5614] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5614] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5614] openat(5, "memory.max", O_RDWR) = 6 [pid 5614] write(6, "0x000000000000040e", 18 [pid 5610] <... write resumed>) = 18 [ 148.285305][ T5610] slab_unreclaimable 0 [ 148.285305][ T5610] slab 6752 [ 148.285305][ T5610] workingset_refault_anon 0 [ 148.385679][ T5610] Tasks state (memory values in pages): [ 148.403799][ T5610] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 148.413849][ T5610] Out of memory and no killable processes... [pid 5610] close(3) = 0 [pid 5610] close(4) = 0 [pid 5610] close(5) = 0 [pid 5610] close(6) = 0 [pid 5610] close(7) = -1 EBADF (Bad file descriptor) [pid 5610] close(8) = -1 EBADF (Bad file descriptor) [pid 5610] close(9) = -1 EBADF (Bad file descriptor) [pid 5610] close(10) = -1 EBADF (Bad file descriptor) [pid 5610] close(11) = -1 EBADF (Bad file descriptor) [pid 5610] close(12) = -1 EBADF (Bad file descriptor) [pid 5610] close(13) = -1 EBADF (Bad file descriptor) [pid 5610] close(14) = -1 EBADF (Bad file descriptor) [pid 5610] close(15) = -1 EBADF (Bad file descriptor) [pid 5610] close(16) = -1 EBADF (Bad file descriptor) [pid 5610] close(17) = -1 EBADF (Bad file descriptor) [pid 5610] close(18) = -1 EBADF (Bad file descriptor) [pid 5610] close(19) = -1 EBADF (Bad file descriptor) [pid 5610] close(20) = -1 EBADF (Bad file descriptor) [pid 5610] close(21) = -1 EBADF (Bad file descriptor) [pid 5610] close(22) = -1 EBADF (Bad file descriptor) [ 148.420146][ T5611] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 148.430543][ T5611] CPU: 0 PID: 5611 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 148.440998][ T5611] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 148.451091][ T5611] Call Trace: [ 148.454405][ T5611] [ 148.457378][ T5611] dump_stack_lvl+0x1e7/0x2d0 [ 148.462124][ T5611] ? nf_tcp_handle_invalid+0x640/0x640 [ 148.467633][ T5611] ? panic+0x770/0x770 [pid 5610] close(23) = -1 EBADF (Bad file descriptor) [pid 5610] close(24) = -1 EBADF (Bad file descriptor) [pid 5610] close(25) = -1 EBADF (Bad file descriptor) [pid 5610] close(26) = -1 EBADF (Bad file descriptor) [pid 5610] close(27) = -1 EBADF (Bad file descriptor) [pid 5610] close(28) = -1 EBADF (Bad file descriptor) [pid 5610] close(29) = -1 EBADF (Bad file descriptor) [pid 5610] exit_group(0) = ? [pid 5610] +++ exited with 0 +++ [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=31, si_uid=0, si_status=0, si_utime=0, si_stime=9 /* 0.09 s */} --- [pid 5075] umount2("./29", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] openat(AT_FDCWD, "./29", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5075] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5075] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5075] umount2("./29/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./29/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5075] unlink("./29/binderfs") = 0 [pid 5075] umount2("./29/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./29/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5075] unlink("./29/cgroup") = 0 [pid 5075] umount2("./29/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 148.471776][ T5611] dump_header+0xdc/0x940 [ 148.476170][ T5611] out_of_memory+0xf21/0x12c0 [ 148.480904][ T5611] ? mutex_lock_io_nested+0x60/0x60 [ 148.486161][ T5611] ? preempt_schedule+0xdd/0xf0 [ 148.491060][ T5611] ? unregister_oom_notifier+0x20/0x20 [ 148.496570][ T5611] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 148.502616][ T5611] mem_cgroup_out_of_memory+0x263/0x3b0 [ 148.508212][ T5611] ? preempt_schedule_thunk+0x1a/0x20 [ 148.513644][ T5611] ? mem_cgroup_oom_trylock+0x210/0x210 [pid 5075] lstat("./29/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5075] unlink("./29/cgroup.net") = 0 [ 148.519265][ T5611] ? cgroup_file_notify+0x127/0x190 [ 148.524525][ T5611] memory_max_write+0x355/0x470 [ 148.529438][ T5611] ? memory_max_show+0xa0/0xa0 [ 148.534252][ T5611] ? read_lock_is_recursive+0x20/0x20 [ 148.539694][ T5611] ? memory_max_show+0xa0/0xa0 [ 148.544494][ T5611] cgroup_file_write+0x2b1/0x780 [ 148.549442][ T5611] ? cgroup_seqfile_stop+0xd0/0xd0 [ 148.554559][ T5611] ? __virt_addr_valid+0x22f/0x2e0 [ 148.559699][ T5611] ? cgroup_seqfile_stop+0xd0/0xd0 [ 148.564817][ T5611] kernfs_fop_write_iter+0x3a6/0x4f0 [ 148.570116][ T5611] vfs_write+0x7b2/0xbb0 [ 148.574403][ T5611] ? file_end_write+0x240/0x240 [ 148.579275][ T5611] ? do_raw_spin_unlock+0x13b/0x8b0 [ 148.584501][ T5611] ? lockdep_hardirqs_on+0x98/0x140 [ 148.589733][ T5611] ? __fdget_pos+0x265/0x2f0 [ 148.594348][ T5611] ksys_write+0x1a0/0x2c0 [ 148.598698][ T5611] ? __ia32_sys_read+0x90/0x90 [ 148.603492][ T5611] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 148.609494][ T5611] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 148.615495][ T5611] do_syscall_64+0x41/0xc0 [ 148.619932][ T5611] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 148.625842][ T5611] RIP: 0033:0x7fd49ce20129 [ 148.630266][ T5611] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 148.649895][ T5611] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 148.658322][ T5611] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [pid 5075] umount2("./29/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [ 148.666305][ T5611] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 148.674300][ T5611] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 148.682323][ T5611] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 148.690348][ T5611] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 000000000000001a [ 148.698366][ T5611] [ 148.708254][ T5611] memory: usage 8kB, limit 0kB, failcnt 55 [ 148.715342][ T5611] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [pid 5075] umount2("./29/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./29/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5075] umount2("./29/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] openat(AT_FDCWD, "./29/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5075] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5075] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5075] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5075] close(4) = 0 [pid 5075] rmdir("./29/file0") = 0 [pid 5075] umount2("./29/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./29/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [ 148.722490][ T5611] Memory cgroup stats for /syz1: [ 148.722700][ T5611] anon 0 [ 148.722700][ T5611] file 0 [ 148.722700][ T5611] kernel 8192 [ 148.722700][ T5611] kernel_stack 0 [ 148.722700][ T5611] pagetables 0 [ 148.722700][ T5611] sec_pagetables 0 [ 148.722700][ T5611] percpu 0 [ 148.722700][ T5611] sock 0 [ 148.722700][ T5611] vmalloc 0 [ 148.722700][ T5611] shmem 0 [ 148.722700][ T5611] zswap 0 [ 148.722700][ T5611] zswapped 0 [ 148.722700][ T5611] file_mapped 0 [ 148.722700][ T5611] file_dirty 0 [pid 5075] unlink("./29/cgroup.cpu") = 0 [pid 5075] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5075] close(3) = 0 [pid 5075] rmdir("./29") = 0 [pid 5075] mkdir("./30", 0777) = 0 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5615 attached [pid 5615] chdir("./30" [pid 5075] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 32 [pid 5615] <... chdir resumed>) = 0 [pid 5615] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5615] setpgid(0, 0) = 0 [pid 5615] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 5615] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 5615] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 5615] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5615] write(3, "1000", 4) = 4 [pid 5615] close(3) = 0 [pid 5615] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5615] mkdir("./file0", 000) = 0 [pid 5615] open("./file0", O_RDONLY) = 3 [pid 5615] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5615] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5615] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5615] openat(5, "memory.max", O_RDWR) = 6 [ 148.722700][ T5611] file_writeback 0 [ 148.722700][ T5611] swapcached 0 [ 148.722700][ T5611] anon_thp 0 [ 148.722700][ T5611] file_thp 0 [ 148.722700][ T5611] shmem_thp 0 [ 148.722700][ T5611] inactive_anon 0 [ 148.722700][ T5611] active_anon 0 [ 148.722700][ T5611] inactive_file 0 [ 148.722700][ T5611] active_file 0 [ 148.722700][ T5611] unevictable 0 [ 148.722700][ T5611] slab_reclaimable 6752 [ 148.722700][ T5611] slab_unreclaimable 0 [ 148.722700][ T5611] slab 6752 [ 148.722700][ T5611] workingset_refault_anon 0 [pid 5615] write(6, "0x000000000000040e", 18 [pid 5611] <... write resumed>) = 18 [pid 5611] close(3) = 0 [pid 5611] close(4) = 0 [pid 5611] close(5) = 0 [pid 5611] close(6) = 0 [pid 5611] close(7) = -1 EBADF (Bad file descriptor) [pid 5611] close(8) = -1 EBADF (Bad file descriptor) [pid 5611] close(9) = -1 EBADF (Bad file descriptor) [pid 5611] close(10) = -1 EBADF (Bad file descriptor) [pid 5611] close(11) = -1 EBADF (Bad file descriptor) [pid 5611] close(12) = -1 EBADF (Bad file descriptor) [pid 5611] close(13) = -1 EBADF (Bad file descriptor) [pid 5611] close(14) = -1 EBADF (Bad file descriptor) [pid 5611] close(15) = -1 EBADF (Bad file descriptor) [pid 5611] close(16) = -1 EBADF (Bad file descriptor) [pid 5611] close(17) = -1 EBADF (Bad file descriptor) [pid 5611] close(18) = -1 EBADF (Bad file descriptor) [pid 5611] close(19) = -1 EBADF (Bad file descriptor) [pid 5611] close(20) = -1 EBADF (Bad file descriptor) [pid 5611] close(21) = -1 EBADF (Bad file descriptor) [pid 5611] close(22) = -1 EBADF (Bad file descriptor) [pid 5611] close(23) = -1 EBADF (Bad file descriptor) [pid 5611] close(24) = -1 EBADF (Bad file descriptor) [pid 5611] close(25) = -1 EBADF (Bad file descriptor) [pid 5611] close(26) = -1 EBADF (Bad file descriptor) [pid 5611] close(27) = -1 EBADF (Bad file descriptor) [pid 5611] close(28) = -1 EBADF (Bad file descriptor) [pid 5611] close(29) = -1 EBADF (Bad file descriptor) [pid 5611] exit_group(0) = ? [pid 5611] +++ exited with 0 +++ [pid 5073] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=28, si_uid=0, si_status=0, si_utime=0, si_stime=9 /* 0.09 s */} --- [pid 5073] restart_syscall(<... resuming interrupted clone ...>) = 0 [ 148.821935][ T5611] Tasks state (memory values in pages): [ 148.832279][ T5611] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 148.843690][ T5611] Out of memory and no killable processes... [ 148.852174][ T5612] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5073] umount2("./26", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] openat(AT_FDCWD, "./26", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5073] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5073] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5073] umount2("./26/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./26/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5073] unlink("./26/binderfs") = 0 [pid 5073] umount2("./26/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./26/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5073] unlink("./26/cgroup") = 0 [pid 5073] umount2("./26/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./26/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5073] unlink("./26/cgroup.net") = 0 [ 148.865019][ T5612] CPU: 0 PID: 5612 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 148.875482][ T5612] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 148.885576][ T5612] Call Trace: [ 148.888891][ T5612] [ 148.891856][ T5612] dump_stack_lvl+0x1e7/0x2d0 [ 148.896592][ T5612] ? nf_tcp_handle_invalid+0x640/0x640 [ 148.902105][ T5612] ? panic+0x770/0x770 [ 148.906281][ T5612] dump_header+0xdc/0x940 [ 148.910678][ T5612] out_of_memory+0xf21/0x12c0 [ 148.915401][ T5612] ? mutex_lock_io_nested+0x60/0x60 [ 148.920636][ T5612] ? mark_lock+0x9a/0x340 [ 148.924992][ T5612] ? unregister_oom_notifier+0x20/0x20 [ 148.930480][ T5612] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 148.936528][ T5612] mem_cgroup_out_of_memory+0x263/0x3b0 [ 148.942118][ T5612] ? mem_cgroup_oom_trylock+0x210/0x210 [ 148.947708][ T5612] ? cgroup_file_notify+0x127/0x190 [ 148.952984][ T5612] memory_max_write+0x355/0x470 [ 148.957890][ T5612] ? memory_max_show+0xa0/0xa0 [ 148.962698][ T5612] ? read_lock_is_recursive+0x20/0x20 [ 148.968136][ T5612] ? memory_max_show+0xa0/0xa0 [ 148.972950][ T5612] cgroup_file_write+0x2b1/0x780 [ 148.977908][ T5612] ? cgroup_seqfile_stop+0xd0/0xd0 [ 148.983029][ T5612] ? __virt_addr_valid+0x22f/0x2e0 [ 148.988186][ T5612] ? cgroup_seqfile_stop+0xd0/0xd0 [ 148.993323][ T5612] kernfs_fop_write_iter+0x3a6/0x4f0 [ 148.998647][ T5612] vfs_write+0x7b2/0xbb0 [ 149.002928][ T5612] ? file_end_write+0x240/0x240 [ 149.007797][ T5612] ? do_raw_spin_unlock+0x13b/0x8b0 [ 149.013017][ T5612] ? lockdep_hardirqs_on+0x98/0x140 [ 149.018236][ T5612] ? __fdget_pos+0x265/0x2f0 [ 149.022871][ T5612] ksys_write+0x1a0/0x2c0 [ 149.027221][ T5612] ? __ia32_sys_read+0x90/0x90 [ 149.031997][ T5612] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 149.038011][ T5612] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 149.044014][ T5612] do_syscall_64+0x41/0xc0 [ 149.048451][ T5612] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 149.054452][ T5612] RIP: 0033:0x7fd49ce20129 [ 149.058883][ T5612] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 149.078498][ T5612] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 149.086941][ T5612] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 149.094933][ T5612] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 149.102913][ T5612] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 149.110891][ T5612] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [pid 5073] umount2("./26/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5073] umount2("./26/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 149.118878][ T5612] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000017 [ 149.126877][ T5612] [pid 5073] lstat("./26/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [ 149.148968][ T5612] memory: usage 8kB, limit 0kB, failcnt 55 [ 149.155235][ T5612] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 149.163073][ T5612] Memory cgroup stats for /syz1: [ 149.163285][ T5612] anon 0 [ 149.163285][ T5612] file 0 [ 149.163285][ T5612] kernel 8192 [ 149.163285][ T5612] kernel_stack 0 [ 149.163285][ T5612] pagetables 0 [ 149.163285][ T5612] sec_pagetables 0 [ 149.163285][ T5612] percpu 0 [ 149.163285][ T5612] sock 0 [ 149.163285][ T5612] vmalloc 0 [ 149.163285][ T5612] shmem 0 [ 149.163285][ T5612] zswap 0 [ 149.163285][ T5612] zswapped 0 [ 149.163285][ T5612] file_mapped 0 [ 149.163285][ T5612] file_dirty 0 [ 149.163285][ T5612] file_writeback 0 [ 149.163285][ T5612] swapcached 0 [ 149.163285][ T5612] anon_thp 0 [ 149.163285][ T5612] file_thp 0 [ 149.163285][ T5612] shmem_thp 0 [ 149.163285][ T5612] inactive_anon 0 [ 149.163285][ T5612] active_anon 0 [ 149.163285][ T5612] inactive_file 0 [ 149.163285][ T5612] active_file 0 [ 149.163285][ T5612] unevictable 0 [ 149.163285][ T5612] slab_reclaimable 6752 [pid 5073] umount2("./26/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] openat(AT_FDCWD, "./26/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5073] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5073] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5073] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5073] close(4) = 0 [pid 5073] rmdir("./26/file0") = 0 [pid 5073] umount2("./26/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./26/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5073] unlink("./26/cgroup.cpu") = 0 [pid 5073] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5073] close(3) = 0 [pid 5073] rmdir("./26") = 0 [pid 5073] mkdir("./27", 0777) = 0 [pid 5073] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5616 attached [pid 5616] chdir("./27" [pid 5073] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 29 [pid 5616] <... chdir resumed>) = 0 [pid 5616] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5616] setpgid(0, 0) = 0 [pid 5616] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 5616] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 5616] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [pid 5616] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5616] write(3, "1000", 4) = 4 [pid 5616] close(3) = 0 [pid 5616] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5616] mkdir("./file0", 000) = 0 [ 149.163285][ T5612] slab_unreclaimable 0 [ 149.163285][ T5612] slab 6752 [ 149.163285][ T5612] workingset_refault_anon 0 [ 149.279155][ T5612] Tasks state (memory values in pages): [ 149.284971][ T5612] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5616] open("./file0", O_RDONLY) = 3 [pid 5616] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5616] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5616] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5616] openat(5, "memory.max", O_RDWR) = 6 [pid 5616] write(6, "0x000000000000040e", 18 [pid 5612] <... write resumed>) = 18 [ 149.309632][ T5612] Out of memory and no killable processes... [ 149.315910][ T5613] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 149.327107][ T5613] CPU: 0 PID: 5613 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 149.337569][ T5613] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 149.347661][ T5613] Call Trace: [ 149.350976][ T5613] [ 149.353937][ T5613] dump_stack_lvl+0x1e7/0x2d0 [pid 5612] close(3) = 0 [pid 5612] close(4) = 0 [pid 5612] close(5) = 0 [pid 5612] close(6) = 0 [pid 5612] close(7) = -1 EBADF (Bad file descriptor) [pid 5612] close(8) = -1 EBADF (Bad file descriptor) [pid 5612] close(9) = -1 EBADF (Bad file descriptor) [pid 5612] close(10) = -1 EBADF (Bad file descriptor) [pid 5612] close(11) = -1 EBADF (Bad file descriptor) [pid 5612] close(12) = -1 EBADF (Bad file descriptor) [pid 5612] close(13) = -1 EBADF (Bad file descriptor) [pid 5612] close(14) = -1 EBADF (Bad file descriptor) [pid 5612] close(15) = -1 EBADF (Bad file descriptor) [pid 5612] close(16) = -1 EBADF (Bad file descriptor) [pid 5612] close(17) = -1 EBADF (Bad file descriptor) [pid 5612] close(18) = -1 EBADF (Bad file descriptor) [pid 5612] close(19) = -1 EBADF (Bad file descriptor) [pid 5612] close(20) = -1 EBADF (Bad file descriptor) [pid 5612] close(21) = -1 EBADF (Bad file descriptor) [pid 5612] close(22) = -1 EBADF (Bad file descriptor) [pid 5612] close(23) = -1 EBADF (Bad file descriptor) [pid 5612] close(24) = -1 EBADF (Bad file descriptor) [pid 5612] close(25) = -1 EBADF (Bad file descriptor) [pid 5612] close(26) = -1 EBADF (Bad file descriptor) [pid 5612] close(27) = -1 EBADF (Bad file descriptor) [pid 5612] close(28) = -1 EBADF (Bad file descriptor) [pid 5612] close(29) = -1 EBADF (Bad file descriptor) [ 149.358730][ T5613] ? nf_tcp_handle_invalid+0x640/0x640 [ 149.364244][ T5613] ? panic+0x770/0x770 [ 149.368386][ T5613] dump_header+0xdc/0x940 [ 149.372768][ T5613] out_of_memory+0xf21/0x12c0 [ 149.377515][ T5613] ? mutex_lock_io_nested+0x60/0x60 [ 149.382776][ T5613] ? mark_lock+0x9a/0x340 [ 149.387148][ T5613] ? unregister_oom_notifier+0x20/0x20 [ 149.392662][ T5613] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 149.398741][ T5613] mem_cgroup_out_of_memory+0x263/0x3b0 [ 149.404346][ T5613] ? mem_cgroup_oom_trylock+0x210/0x210 [pid 5612] exit_group(0) = ? [pid 5612] +++ exited with 0 +++ [pid 5070] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=25, si_uid=0, si_status=0, si_utime=0, si_stime=6 /* 0.06 s */} --- [pid 5070] umount2("./23", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] openat(AT_FDCWD, "./23", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5070] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5070] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5070] umount2("./23/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./23/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [ 149.409967][ T5613] ? cgroup_file_notify+0x127/0x190 [ 149.415222][ T5613] memory_max_write+0x355/0x470 [ 149.420136][ T5613] ? memory_max_show+0xa0/0xa0 [ 149.424952][ T5613] ? read_lock_is_recursive+0x20/0x20 [ 149.430387][ T5613] ? memory_max_show+0xa0/0xa0 [ 149.435187][ T5613] cgroup_file_write+0x2b1/0x780 [ 149.440156][ T5613] ? cgroup_seqfile_stop+0xd0/0xd0 [ 149.445291][ T5613] ? __virt_addr_valid+0x22f/0x2e0 [ 149.450442][ T5613] ? cgroup_seqfile_stop+0xd0/0xd0 [ 149.455568][ T5613] kernfs_fop_write_iter+0x3a6/0x4f0 [ 149.460880][ T5613] vfs_write+0x7b2/0xbb0 [ 149.465144][ T5613] ? file_end_write+0x240/0x240 [ 149.470014][ T5613] ? do_raw_spin_unlock+0x13b/0x8b0 [ 149.475232][ T5613] ? lockdep_hardirqs_on+0x98/0x140 [ 149.480460][ T5613] ? __fdget_pos+0x265/0x2f0 [ 149.485071][ T5613] ksys_write+0x1a0/0x2c0 [ 149.489423][ T5613] ? __ia32_sys_read+0x90/0x90 [ 149.494204][ T5613] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 149.500210][ T5613] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 149.506218][ T5613] do_syscall_64+0x41/0xc0 [ 149.510651][ T5613] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 149.516659][ T5613] RIP: 0033:0x7fd49ce20129 [ 149.521095][ T5613] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 149.540717][ T5613] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 149.549164][ T5613] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [pid 5070] unlink("./23/binderfs") = 0 [ 149.557176][ T5613] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 149.565156][ T5613] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 149.573155][ T5613] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 149.581226][ T5613] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000018 [ 149.589232][ T5613] [ 149.596105][ T5613] memory: usage 8kB, limit 0kB, failcnt 55 [pid 5070] umount2("./23/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./23/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5070] unlink("./23/cgroup") = 0 [pid 5070] umount2("./23/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./23/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5070] unlink("./23/cgroup.net") = 0 [ 149.602362][ T5613] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 149.612597][ T5613] Memory cgroup stats for /syz1: [ 149.612972][ T5613] anon 0 [ 149.612972][ T5613] file 0 [ 149.612972][ T5613] kernel 8192 [ 149.612972][ T5613] kernel_stack 0 [ 149.612972][ T5613] pagetables 0 [ 149.612972][ T5613] sec_pagetables 0 [ 149.612972][ T5613] percpu 0 [ 149.612972][ T5613] sock 0 [ 149.612972][ T5613] vmalloc 0 [ 149.612972][ T5613] shmem 0 [ 149.612972][ T5613] zswap 0 [ 149.612972][ T5613] zswapped 0 [ 149.612972][ T5613] file_mapped 0 [ 149.612972][ T5613] file_dirty 0 [pid 5070] umount2("./23/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5070] umount2("./23/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 149.612972][ T5613] file_writeback 0 [ 149.612972][ T5613] swapcached 0 [ 149.612972][ T5613] anon_thp 0 [ 149.612972][ T5613] file_thp 0 [ 149.612972][ T5613] shmem_thp 0 [ 149.612972][ T5613] inactive_anon 0 [ 149.612972][ T5613] active_anon 0 [ 149.612972][ T5613] inactive_file 0 [ 149.612972][ T5613] active_file 0 [ 149.612972][ T5613] unevictable 0 [ 149.612972][ T5613] slab_reclaimable 6752 [ 149.612972][ T5613] slab_unreclaimable 0 [ 149.612972][ T5613] slab 6752 [ 149.612972][ T5613] workingset_refault_anon 0 [pid 5070] lstat("./23/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5070] umount2("./23/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] openat(AT_FDCWD, "./23/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5070] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5070] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5070] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5070] close(4) = 0 [pid 5070] rmdir("./23/file0") = 0 [pid 5070] umount2("./23/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./23/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5070] unlink("./23/cgroup.cpu") = 0 [pid 5070] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5070] close(3) = 0 [pid 5070] rmdir("./23") = 0 [pid 5070] mkdir("./24", 0777) = 0 [pid 5070] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5618 attached [ 149.712753][ T5613] Tasks state (memory values in pages): [ 149.723671][ T5613] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 149.737720][ T5613] Out of memory and no killable processes... [pid 5618] chdir("./24" [pid 5070] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 26 [pid 5618] <... chdir resumed>) = 0 [pid 5613] <... write resumed>) = 18 [pid 5613] close(3) = 0 [pid 5613] close(4) = 0 [pid 5613] close(5) = 0 [pid 5613] close(6) = 0 [pid 5613] close(7) = -1 EBADF (Bad file descriptor) [pid 5613] close(8) = -1 EBADF (Bad file descriptor) [pid 5613] close(9) = -1 EBADF (Bad file descriptor) [pid 5613] close(10) = -1 EBADF (Bad file descriptor) [pid 5613] close(11) = -1 EBADF (Bad file descriptor) [pid 5613] close(12) = -1 EBADF (Bad file descriptor) [pid 5613] close(13) = -1 EBADF (Bad file descriptor) [pid 5613] close(14) = -1 EBADF (Bad file descriptor) [pid 5613] close(15) = -1 EBADF (Bad file descriptor) [pid 5613] close(16) = -1 EBADF (Bad file descriptor) [pid 5613] close(17) = -1 EBADF (Bad file descriptor) [pid 5613] close(18) = -1 EBADF (Bad file descriptor) [pid 5613] close(19) = -1 EBADF (Bad file descriptor) [pid 5613] close(20) = -1 EBADF (Bad file descriptor) [pid 5613] close(21) = -1 EBADF (Bad file descriptor) [pid 5613] close(22) = -1 EBADF (Bad file descriptor) [pid 5613] close(23) = -1 EBADF (Bad file descriptor) [pid 5613] close(24) = -1 EBADF (Bad file descriptor) [pid 5613] close(25) = -1 EBADF (Bad file descriptor) [pid 5613] close(26) = -1 EBADF (Bad file descriptor) [pid 5613] close(27) = -1 EBADF (Bad file descriptor) [pid 5613] close(28) = -1 EBADF (Bad file descriptor) [pid 5613] close(29) = -1 EBADF (Bad file descriptor) [pid 5613] exit_group(0) = ? [pid 5613] +++ exited with 0 +++ [pid 5618] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5618] setpgid(0, 0 [pid 5072] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=26, si_uid=0, si_status=0, si_utime=0, si_stime=9 /* 0.09 s */} --- [pid 5618] <... setpgid resumed>) = 0 [pid 5072] umount2("./24", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] openat(AT_FDCWD, "./24", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5618] symlink("/syzcgroup/unified/syz0", "./cgroup" [pid 5072] <... openat resumed>) = 3 [pid 5072] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5072] getdents64(3, [pid 5618] <... symlink resumed>) = 0 [pid 5072] <... getdents64 resumed>0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5072] umount2("./24/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5618] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu" [pid 5072] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./24/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5072] unlink("./24/binderfs" [pid 5618] <... symlink resumed>) = 0 [pid 5072] <... unlink resumed>) = 0 [pid 5618] symlink("/syzcgroup/net/syz0", "./cgroup.net" [pid 5072] umount2("./24/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./24/cgroup", [pid 5618] <... symlink resumed>) = 0 [pid 5072] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5618] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5072] unlink("./24/cgroup" [pid 5618] <... openat resumed>) = 3 [pid 5072] <... unlink resumed>) = 0 [pid 5618] write(3, "1000", 4 [pid 5072] umount2("./24/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5618] <... write resumed>) = 4 [pid 5072] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./24/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5072] unlink("./24/cgroup.net" [pid 5618] close(3 [pid 5072] <... unlink resumed>) = 0 [pid 5618] <... close resumed>) = 0 [pid 5618] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5618] mkdir("./file0", 000) = 0 [pid 5618] open("./file0", O_RDONLY) = 3 [pid 5618] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5618] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5618] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5618] openat(5, "memory.max", O_RDWR) = 6 [ 149.755003][ T5614] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 149.777138][ T5614] CPU: 1 PID: 5614 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 149.787652][ T5614] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 149.797757][ T5614] Call Trace: [ 149.801076][ T5614] [ 149.804044][ T5614] dump_stack_lvl+0x1e7/0x2d0 [ 149.808814][ T5614] ? nf_tcp_handle_invalid+0x640/0x640 [ 149.814327][ T5614] ? panic+0x770/0x770 [ 149.818460][ T5614] dump_header+0xdc/0x940 [ 149.822847][ T5614] out_of_memory+0xf21/0x12c0 [ 149.827697][ T5614] ? mutex_lock_io_nested+0x60/0x60 [ 149.832958][ T5614] ? preempt_schedule+0xdd/0xf0 [ 149.837863][ T5614] ? unregister_oom_notifier+0x20/0x20 [ 149.843373][ T5614] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 149.849422][ T5614] mem_cgroup_out_of_memory+0x263/0x3b0 [ 149.855021][ T5614] ? preempt_schedule_thunk+0x1a/0x20 [pid 5618] write(6, "0x000000000000040e", 18 [ 149.860450][ T5614] ? mem_cgroup_oom_trylock+0x210/0x210 [ 149.866068][ T5614] ? cgroup_file_notify+0x127/0x190 [ 149.871415][ T5614] memory_max_write+0x355/0x470 [ 149.876347][ T5614] ? memory_max_show+0xa0/0xa0 [ 149.881166][ T5614] ? read_lock_is_recursive+0x20/0x20 [ 149.886595][ T5614] ? memory_max_show+0xa0/0xa0 [ 149.891408][ T5614] cgroup_file_write+0x2b1/0x780 [ 149.896401][ T5614] ? cgroup_seqfile_stop+0xd0/0xd0 [ 149.901556][ T5614] ? __virt_addr_valid+0x22f/0x2e0 [ 149.906736][ T5614] ? cgroup_seqfile_stop+0xd0/0xd0 [ 149.911889][ T5614] kernfs_fop_write_iter+0x3a6/0x4f0 [ 149.917235][ T5614] vfs_write+0x7b2/0xbb0 [ 149.921538][ T5614] ? file_end_write+0x240/0x240 [ 149.926444][ T5614] ? do_raw_spin_unlock+0x13b/0x8b0 [ 149.931696][ T5614] ? lockdep_hardirqs_on+0x98/0x140 [ 149.936951][ T5614] ? __fdget_pos+0x265/0x2f0 [ 149.941588][ T5614] ksys_write+0x1a0/0x2c0 [ 149.945971][ T5614] ? __ia32_sys_read+0x90/0x90 [ 149.950782][ T5614] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 149.956819][ T5614] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 149.962860][ T5614] do_syscall_64+0x41/0xc0 [ 149.967347][ T5614] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 149.973291][ T5614] RIP: 0033:0x7fd49ce20129 [ 149.977726][ T5614] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 149.997465][ T5614] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 150.005927][ T5614] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [pid 5072] umount2("./24/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5072] umount2("./24/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./24/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5072] umount2("./24/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] openat(AT_FDCWD, "./24/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5072] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [ 150.013939][ T5614] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 150.021948][ T5614] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 150.029958][ T5614] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 150.038055][ T5614] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 000000000000001f [ 150.046094][ T5614] [pid 5072] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5072] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5072] close(4) = 0 [pid 5072] rmdir("./24/file0") = 0 [pid 5072] umount2("./24/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./24/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5072] unlink("./24/cgroup.cpu") = 0 [pid 5072] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5072] close(3) = 0 [pid 5072] rmdir("./24") = 0 [pid 5072] mkdir("./25", 0777) = 0 [pid 5072] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5619 attached [pid 5619] chdir("./25" [pid 5072] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 27 [pid 5619] <... chdir resumed>) = 0 [pid 5619] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5619] setpgid(0, 0) = 0 [pid 5619] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 5619] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [pid 5619] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 5619] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5619] write(3, "1000", 4) = 4 [pid 5619] close(3) = 0 [pid 5619] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5619] mkdir("./file0", 000) = 0 [ 150.063118][ T5614] memory: usage 8kB, limit 0kB, failcnt 55 [ 150.073096][ T5614] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 150.090004][ T5614] Memory cgroup stats for /syz1: [ 150.090213][ T5614] anon 0 [ 150.090213][ T5614] file 0 [ 150.090213][ T5614] kernel 8192 [ 150.090213][ T5614] kernel_stack 0 [ 150.090213][ T5614] pagetables 0 [pid 5619] open("./file0", O_RDONLY) = 3 [pid 5619] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5619] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5619] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5619] openat(5, "memory.max", O_RDWR) = 6 [ 150.090213][ T5614] sec_pagetables 0 [ 150.090213][ T5614] percpu 0 [ 150.090213][ T5614] sock 0 [ 150.090213][ T5614] vmalloc 0 [ 150.090213][ T5614] shmem 0 [ 150.090213][ T5614] zswap 0 [ 150.090213][ T5614] zswapped 0 [ 150.090213][ T5614] file_mapped 0 [ 150.090213][ T5614] file_dirty 0 [ 150.090213][ T5614] file_writeback 0 [ 150.090213][ T5614] swapcached 0 [ 150.090213][ T5614] anon_thp 0 [ 150.090213][ T5614] file_thp 0 [ 150.090213][ T5614] shmem_thp 0 [ 150.090213][ T5614] inactive_anon 0 [ 150.090213][ T5614] active_anon 0 [ 150.090213][ T5614] inactive_file 0 [ 150.090213][ T5614] active_file 0 [ 150.090213][ T5614] unevictable 0 [ 150.090213][ T5614] slab_reclaimable 6752 [ 150.090213][ T5614] slab_unreclaimable 0 [ 150.090213][ T5614] slab 6752 [ 150.090213][ T5614] workingset_refault_anon 0 [ 150.201998][ T5614] Tasks state (memory values in pages): [pid 5619] write(6, "0x000000000000040e", 18 [pid 5614] <... write resumed>) = 18 [pid 5614] close(3) = 0 [pid 5614] close(4) = 0 [pid 5614] close(5) = 0 [pid 5614] close(6) = 0 [pid 5614] close(7) = -1 EBADF (Bad file descriptor) [pid 5614] close(8) = -1 EBADF (Bad file descriptor) [pid 5614] close(9) = -1 EBADF (Bad file descriptor) [pid 5614] close(10) = -1 EBADF (Bad file descriptor) [pid 5614] close(11) = -1 EBADF (Bad file descriptor) [pid 5614] close(12) = -1 EBADF (Bad file descriptor) [pid 5614] close(13) = -1 EBADF (Bad file descriptor) [pid 5614] close(14) = -1 EBADF (Bad file descriptor) [pid 5614] close(15) = -1 EBADF (Bad file descriptor) [pid 5614] close(16) = -1 EBADF (Bad file descriptor) [pid 5614] close(17) = -1 EBADF (Bad file descriptor) [pid 5614] close(18) = -1 EBADF (Bad file descriptor) [pid 5614] close(19) = -1 EBADF (Bad file descriptor) [ 150.224267][ T5614] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 150.243759][ T5614] Out of memory and no killable processes... [ 150.254304][ T5615] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 150.297353][ T5615] CPU: 0 PID: 5615 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 150.307851][ T5615] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 150.317950][ T5615] Call Trace: [ 150.321268][ T5615] [ 150.324235][ T5615] dump_stack_lvl+0x1e7/0x2d0 [ 150.328971][ T5615] ? nf_tcp_handle_invalid+0x640/0x640 [ 150.334570][ T5615] ? panic+0x770/0x770 [ 150.338714][ T5615] dump_header+0xdc/0x940 [ 150.343097][ T5615] out_of_memory+0xf21/0x12c0 [ 150.347841][ T5615] ? mutex_lock_io_nested+0x60/0x60 [ 150.353102][ T5615] ? preempt_schedule+0xdd/0xf0 [ 150.358001][ T5615] ? unregister_oom_notifier+0x20/0x20 [ 150.363508][ T5615] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 150.369553][ T5615] mem_cgroup_out_of_memory+0x263/0x3b0 [ 150.375153][ T5615] ? preempt_schedule_thunk+0x1a/0x20 [ 150.380581][ T5615] ? mem_cgroup_oom_trylock+0x210/0x210 [ 150.386196][ T5615] ? cgroup_file_notify+0x127/0x190 [ 150.391462][ T5615] memory_max_write+0x355/0x470 [ 150.396378][ T5615] ? memory_max_show+0xa0/0xa0 [ 150.401197][ T5615] ? read_lock_is_recursive+0x20/0x20 [ 150.406629][ T5615] ? memory_max_show+0xa0/0xa0 [ 150.411442][ T5615] cgroup_file_write+0x2b1/0x780 [ 150.416431][ T5615] ? cgroup_seqfile_stop+0xd0/0xd0 [ 150.421587][ T5615] ? __virt_addr_valid+0x22f/0x2e0 [ 150.426760][ T5615] ? cgroup_seqfile_stop+0xd0/0xd0 [ 150.431921][ T5615] kernfs_fop_write_iter+0x3a6/0x4f0 [ 150.437267][ T5615] vfs_write+0x7b2/0xbb0 [ 150.441573][ T5615] ? file_end_write+0x240/0x240 [ 150.446476][ T5615] ? do_raw_spin_unlock+0x13b/0x8b0 [ 150.451724][ T5615] ? lockdep_hardirqs_on+0x98/0x140 [ 150.456980][ T5615] ? __fdget_pos+0x265/0x2f0 [ 150.461625][ T5615] ksys_write+0x1a0/0x2c0 [ 150.466008][ T5615] ? __ia32_sys_read+0x90/0x90 [ 150.470820][ T5615] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 150.476858][ T5615] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 150.482896][ T5615] do_syscall_64+0x41/0xc0 [ 150.487362][ T5615] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 150.493310][ T5615] RIP: 0033:0x7fd49ce20129 [ 150.497764][ T5615] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 150.517435][ T5615] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 150.525904][ T5615] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 150.533923][ T5615] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [pid 5614] close(20) = -1 EBADF (Bad file descriptor) [pid 5614] close(21) = -1 EBADF (Bad file descriptor) [pid 5614] close(22) = -1 EBADF (Bad file descriptor) [pid 5614] close(23) = -1 EBADF (Bad file descriptor) [pid 5614] close(24) = -1 EBADF (Bad file descriptor) [pid 5614] close(25) = -1 EBADF (Bad file descriptor) [pid 5614] close(26) = -1 EBADF (Bad file descriptor) [pid 5614] close(27) = -1 EBADF (Bad file descriptor) [pid 5614] close(28) = -1 EBADF (Bad file descriptor) [pid 5614] close(29) = -1 EBADF (Bad file descriptor) [pid 5614] exit_group(0) = ? [pid 5614] +++ exited with 0 +++ [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=33, si_uid=0, si_status=0, si_utime=0, si_stime=10 /* 0.10 s */} --- [pid 5074] umount2("./31", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] openat(AT_FDCWD, "./31", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5074] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5074] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5074] umount2("./31/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./31/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5074] unlink("./31/binderfs") = 0 [pid 5074] umount2("./31/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./31/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5074] unlink("./31/cgroup") = 0 [pid 5074] umount2("./31/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./31/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5074] unlink("./31/cgroup.net") = 0 [pid 5074] umount2("./31/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5074] umount2("./31/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./31/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5074] umount2("./31/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 150.541940][ T5615] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 150.549955][ T5615] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 150.557969][ T5615] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 000000000000001e [ 150.566007][ T5615] [pid 5074] openat(AT_FDCWD, "./31/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5074] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5074] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5074] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5074] close(4) = 0 [pid 5074] rmdir("./31/file0") = 0 [pid 5074] umount2("./31/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./31/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5074] unlink("./31/cgroup.cpu") = 0 [pid 5074] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5074] close(3) = 0 [pid 5074] rmdir("./31") = 0 [pid 5074] mkdir("./32", 0777) = 0 [ 150.598252][ T5615] memory: usage 8kB, limit 0kB, failcnt 55 [ 150.604851][ T5615] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 150.620285][ T5615] Memory cgroup stats for /syz1: [ 150.620502][ T5615] anon 0 [ 150.620502][ T5615] file 0 [ 150.620502][ T5615] kernel 8192 [ 150.620502][ T5615] kernel_stack 0 [ 150.620502][ T5615] pagetables 0 [ 150.620502][ T5615] sec_pagetables 0 [ 150.620502][ T5615] percpu 0 [ 150.620502][ T5615] sock 0 [ 150.620502][ T5615] vmalloc 0 [ 150.620502][ T5615] shmem 0 [ 150.620502][ T5615] zswap 0 [ 150.620502][ T5615] zswapped 0 [ 150.620502][ T5615] file_mapped 0 [ 150.620502][ T5615] file_dirty 0 [ 150.620502][ T5615] file_writeback 0 [ 150.620502][ T5615] swapcached 0 [ 150.620502][ T5615] anon_thp 0 [ 150.620502][ T5615] file_thp 0 [ 150.620502][ T5615] shmem_thp 0 [ 150.620502][ T5615] inactive_anon 0 [ 150.620502][ T5615] active_anon 0 [ 150.620502][ T5615] inactive_file 0 [ 150.620502][ T5615] active_file 0 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555574ac5d0) = 34 ./strace-static-x86_64: Process 5630 attached [pid 5630] chdir("./32") = 0 [pid 5630] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [ 150.620502][ T5615] unevictable 0 [ 150.620502][ T5615] slab_reclaimable 6752 [ 150.620502][ T5615] slab_unreclaimable 0 [ 150.620502][ T5615] slab 6752 [ 150.620502][ T5615] workingset_refault_anon 0 [ 150.721171][ T5615] Tasks state (memory values in pages): [ 150.728919][ T5615] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 150.739285][ T5615] Out of memory and no killable processes... [pid 5630] setpgid(0, 0) = 0 [pid 5615] <... write resumed>) = 18 [pid 5630] symlink("/syzcgroup/unified/syz3", "./cgroup" [pid 5615] close(3) = 0 [pid 5630] <... symlink resumed>) = 0 [pid 5630] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu" [ 150.745750][ T5616] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 150.773339][ T5616] CPU: 0 PID: 5616 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 150.783859][ T5616] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 150.794054][ T5616] Call Trace: [ 150.797363][ T5616] [ 150.800323][ T5616] dump_stack_lvl+0x1e7/0x2d0 [ 150.805062][ T5616] ? nf_tcp_handle_invalid+0x640/0x640 [ 150.810563][ T5616] ? panic+0x770/0x770 [ 150.814695][ T5616] dump_header+0xdc/0x940 [ 150.819074][ T5616] out_of_memory+0xf21/0x12c0 [ 150.823805][ T5616] ? mutex_lock_io_nested+0x60/0x60 [ 150.829064][ T5616] ? preempt_schedule+0xdd/0xf0 [ 150.833966][ T5616] ? unregister_oom_notifier+0x20/0x20 [ 150.839481][ T5616] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 150.845531][ T5616] mem_cgroup_out_of_memory+0x263/0x3b0 [ 150.851127][ T5616] ? preempt_schedule_thunk+0x1a/0x20 [ 150.856553][ T5616] ? mem_cgroup_oom_trylock+0x210/0x210 [ 150.862175][ T5616] ? cgroup_file_notify+0x127/0x190 [ 150.867443][ T5616] memory_max_write+0x355/0x470 [ 150.872368][ T5616] ? memory_max_show+0xa0/0xa0 [ 150.877215][ T5616] ? read_lock_is_recursive+0x20/0x20 [ 150.882637][ T5616] ? memory_max_show+0xa0/0xa0 [ 150.887450][ T5616] cgroup_file_write+0x2b1/0x780 [ 150.892457][ T5616] ? cgroup_seqfile_stop+0xd0/0xd0 [ 150.897651][ T5616] ? __virt_addr_valid+0x22f/0x2e0 [ 150.902826][ T5616] ? cgroup_seqfile_stop+0xd0/0xd0 [ 150.907987][ T5616] kernfs_fop_write_iter+0x3a6/0x4f0 [ 150.913343][ T5616] vfs_write+0x7b2/0xbb0 [ 150.917651][ T5616] ? file_end_write+0x240/0x240 [ 150.922561][ T5616] ? do_raw_spin_unlock+0x13b/0x8b0 [ 150.927813][ T5616] ? lockdep_hardirqs_on+0x98/0x140 [ 150.933067][ T5616] ? __fdget_pos+0x265/0x2f0 [ 150.937713][ T5616] ksys_write+0x1a0/0x2c0 [ 150.942110][ T5616] ? __ia32_sys_read+0x90/0x90 [ 150.946923][ T5616] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 150.952965][ T5616] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 150.959005][ T5616] do_syscall_64+0x41/0xc0 [ 150.963472][ T5616] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 150.969418][ T5616] RIP: 0033:0x7fd49ce20129 [ 150.973891][ T5616] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 5615] close(4 [pid 5630] <... symlink resumed>) = 0 [pid 5615] <... close resumed>) = 0 [pid 5630] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 5630] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5630] write(3, "1000", 4) = 4 [pid 5630] close(3) = 0 [pid 5630] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5630] mkdir("./file0", 000) = 0 [pid 5630] open("./file0", O_RDONLY) = 3 [pid 5630] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5630] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5630] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5630] openat(5, "memory.max", O_RDWR [pid 5615] close(5 [pid 5630] <... openat resumed>) = 6 [pid 5615] <... close resumed>) = 0 [pid 5630] write(6, "0x000000000000040e", 18 [pid 5615] close(6) = 0 [pid 5615] close(7) = -1 EBADF (Bad file descriptor) [pid 5615] close(8) = -1 EBADF (Bad file descriptor) [pid 5615] close(9) = -1 EBADF (Bad file descriptor) [ 150.993551][ T5616] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 151.002419][ T5616] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 151.010450][ T5616] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 151.019160][ T5616] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 151.027187][ T5616] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 151.035234][ T5616] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 000000000000001b [ 151.043281][ T5616] [pid 5615] close(10) = -1 EBADF (Bad file descriptor) [pid 5615] close(11) = -1 EBADF (Bad file descriptor) [pid 5615] close(12) = -1 EBADF (Bad file descriptor) [pid 5615] close(13) = -1 EBADF (Bad file descriptor) [pid 5615] close(14) = -1 EBADF (Bad file descriptor) [pid 5615] close(15) = -1 EBADF (Bad file descriptor) [pid 5615] close(16) = -1 EBADF (Bad file descriptor) [pid 5615] close(17) = -1 EBADF (Bad file descriptor) [pid 5615] close(18) = -1 EBADF (Bad file descriptor) [pid 5615] close(19) = -1 EBADF (Bad file descriptor) [pid 5615] close(20) = -1 EBADF (Bad file descriptor) [pid 5615] close(21) = -1 EBADF (Bad file descriptor) [pid 5615] close(22) = -1 EBADF (Bad file descriptor) [pid 5615] close(23) = -1 EBADF (Bad file descriptor) [pid 5615] close(24) = -1 EBADF (Bad file descriptor) [pid 5615] close(25) = -1 EBADF (Bad file descriptor) [pid 5615] close(26) = -1 EBADF (Bad file descriptor) [pid 5615] close(27) = -1 EBADF (Bad file descriptor) [pid 5615] close(28) = -1 EBADF (Bad file descriptor) [ 151.118447][ T5616] memory: usage 8kB, limit 0kB, failcnt 55 [ 151.125256][ T5616] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 151.136142][ T5616] Memory cgroup stats for /syz1: [ 151.136364][ T5616] anon 0 [ 151.136364][ T5616] file 0 [ 151.136364][ T5616] kernel 8192 [ 151.136364][ T5616] kernel_stack 0 [ 151.136364][ T5616] pagetables 0 [ 151.136364][ T5616] sec_pagetables 0 [ 151.136364][ T5616] percpu 0 [ 151.136364][ T5616] sock 0 [ 151.136364][ T5616] vmalloc 0 [ 151.136364][ T5616] shmem 0 [ 151.136364][ T5616] zswap 0 [ 151.136364][ T5616] zswapped 0 [ 151.136364][ T5616] file_mapped 0 [ 151.136364][ T5616] file_dirty 0 [ 151.136364][ T5616] file_writeback 0 [ 151.136364][ T5616] swapcached 0 [ 151.136364][ T5616] anon_thp 0 [ 151.136364][ T5616] file_thp 0 [ 151.136364][ T5616] shmem_thp 0 [ 151.136364][ T5616] inactive_anon 0 [ 151.136364][ T5616] active_anon 0 [ 151.136364][ T5616] inactive_file 0 [ 151.136364][ T5616] active_file 0 [ 151.136364][ T5616] unevictable 0 [pid 5615] close(29) = -1 EBADF (Bad file descriptor) [pid 5615] exit_group(0) = ? [pid 5615] +++ exited with 0 +++ [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=32, si_uid=0, si_status=0, si_utime=0, si_stime=9 /* 0.09 s */} --- [pid 5075] umount2("./30", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] openat(AT_FDCWD, "./30", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5075] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5075] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5075] umount2("./30/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./30/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5075] unlink("./30/binderfs") = 0 [pid 5075] umount2("./30/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./30/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5075] unlink("./30/cgroup") = 0 [pid 5075] umount2("./30/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./30/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5075] unlink("./30/cgroup.net") = 0 [pid 5075] umount2("./30/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5075] umount2("./30/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./30/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5075] umount2("./30/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] openat(AT_FDCWD, "./30/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5075] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5075] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5075] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5075] close(4) = 0 [pid 5075] rmdir("./30/file0") = 0 [pid 5075] umount2("./30/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./30/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5075] unlink("./30/cgroup.cpu") = 0 [pid 5075] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5075] close(3) = 0 [pid 5075] rmdir("./30") = 0 [pid 5075] mkdir("./31", 0777) = 0 [ 151.136364][ T5616] slab_reclaimable 6752 [ 151.136364][ T5616] slab_unreclaimable 0 [ 151.136364][ T5616] slab 6752 [ 151.136364][ T5616] workingset_refault_anon 0 [ 151.243517][ T5616] Tasks state (memory values in pages): [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555574ac5d0) = 33 ./strace-static-x86_64: Process 5636 attached [pid 5636] chdir("./31") = 0 [pid 5636] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5636] setpgid(0, 0) = 0 [pid 5616] <... write resumed>) = 18 [pid 5636] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 5616] close(3 [pid 5636] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 5616] <... close resumed>) = 0 [pid 5636] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 5616] close(4 [pid 5636] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5616] <... close resumed>) = 0 [pid 5636] write(3, "1000", 4) = 4 [pid 5616] close(5 [pid 5636] close(3) = 0 [pid 5616] <... close resumed>) = 0 [pid 5636] symlink("/dev/binderfs", "./binderfs" [pid 5616] close(6 [pid 5636] <... symlink resumed>) = 0 [pid 5616] <... close resumed>) = 0 [ 151.261853][ T5616] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 151.281396][ T5616] Out of memory and no killable processes... [ 151.293450][ T5618] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5636] mkdir("./file0", 000 [pid 5616] close(7 [pid 5636] <... mkdir resumed>) = 0 [pid 5616] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5636] open("./file0", O_RDONLY [pid 5616] close(8 [pid 5636] <... open resumed>) = 3 [pid 5616] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5636] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5616] close(9 [pid 5636] <... mount resumed>) = 0 [pid 5616] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5636] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5616] close(10 [pid 5636] <... openat resumed>) = 4 [pid 5616] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5636] openat(4, "syz1", O_RDWR|O_PATH [pid 5616] close(11 [pid 5636] <... openat resumed>) = 5 [pid 5616] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5636] openat(5, "memory.max", O_RDWR [pid 5616] close(12 [pid 5636] <... openat resumed>) = 6 [pid 5616] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5636] write(6, "0x000000000000040e", 18 [pid 5616] close(13) = -1 EBADF (Bad file descriptor) [pid 5616] close(14) = -1 EBADF (Bad file descriptor) [pid 5616] close(15) = -1 EBADF (Bad file descriptor) [pid 5616] close(16) = -1 EBADF (Bad file descriptor) [pid 5616] close(17) = -1 EBADF (Bad file descriptor) [pid 5616] close(18) = -1 EBADF (Bad file descriptor) [pid 5616] close(19) = -1 EBADF (Bad file descriptor) [pid 5616] close(20) = -1 EBADF (Bad file descriptor) [pid 5616] close(21) = -1 EBADF (Bad file descriptor) [pid 5616] close(22) = -1 EBADF (Bad file descriptor) [pid 5616] close(23) = -1 EBADF (Bad file descriptor) [pid 5616] close(24) = -1 EBADF (Bad file descriptor) [pid 5616] close(25) = -1 EBADF (Bad file descriptor) [pid 5616] close(26) = -1 EBADF (Bad file descriptor) [pid 5616] close(27) = -1 EBADF (Bad file descriptor) [pid 5616] close(28) = -1 EBADF (Bad file descriptor) [pid 5616] close(29) = -1 EBADF (Bad file descriptor) [pid 5616] exit_group(0) = ? [pid 5616] +++ exited with 0 +++ [ 151.311690][ T5618] CPU: 0 PID: 5618 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 151.322176][ T5618] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 151.332274][ T5618] Call Trace: [ 151.335586][ T5618] [ 151.338581][ T5618] dump_stack_lvl+0x1e7/0x2d0 [ 151.343505][ T5618] ? nf_tcp_handle_invalid+0x640/0x640 [ 151.349027][ T5618] ? panic+0x770/0x770 [ 151.353163][ T5618] dump_header+0xdc/0x940 [ 151.357555][ T5618] out_of_memory+0xf21/0x12c0 [ 151.365520][ T5618] ? mutex_lock_io_nested+0x60/0x60 [ 151.370785][ T5618] ? preempt_schedule+0xdd/0xf0 [ 151.375674][ T5618] ? unregister_oom_notifier+0x20/0x20 [ 151.381161][ T5618] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 151.387182][ T5618] mem_cgroup_out_of_memory+0x263/0x3b0 [ 151.392751][ T5618] ? preempt_schedule_thunk+0x1a/0x20 [ 151.398149][ T5618] ? mem_cgroup_oom_trylock+0x210/0x210 [ 151.403730][ T5618] ? cgroup_file_notify+0x127/0x190 [ 151.408958][ T5618] memory_max_write+0x355/0x470 [ 151.413853][ T5618] ? memory_max_show+0xa0/0xa0 [ 151.418662][ T5618] ? read_lock_is_recursive+0x20/0x20 [ 151.424074][ T5618] ? memory_max_show+0xa0/0xa0 [ 151.428860][ T5618] cgroup_file_write+0x2b1/0x780 [ 151.433818][ T5618] ? cgroup_seqfile_stop+0xd0/0xd0 [ 151.438946][ T5618] ? __virt_addr_valid+0x22f/0x2e0 [ 151.444084][ T5618] ? cgroup_seqfile_stop+0xd0/0xd0 [ 151.449207][ T5618] kernfs_fop_write_iter+0x3a6/0x4f0 [ 151.454538][ T5618] vfs_write+0x7b2/0xbb0 [ 151.458905][ T5618] ? file_end_write+0x240/0x240 [ 151.463777][ T5618] ? do_raw_spin_unlock+0x13b/0x8b0 [ 151.468992][ T5618] ? lockdep_hardirqs_on+0x98/0x140 [ 151.474217][ T5618] ? __fdget_pos+0x265/0x2f0 [ 151.478914][ T5618] ksys_write+0x1a0/0x2c0 [ 151.483266][ T5618] ? __ia32_sys_read+0x90/0x90 [ 151.488045][ T5618] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 151.494045][ T5618] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 151.500045][ T5618] do_syscall_64+0x41/0xc0 [ 151.504477][ T5618] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 151.510390][ T5618] RIP: 0033:0x7fd49ce20129 [ 151.514818][ T5618] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 151.534434][ T5618] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 151.542872][ T5618] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 151.550857][ T5618] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 151.558840][ T5618] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [pid 5073] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=29, si_uid=0, si_status=0, si_utime=0, si_stime=9 /* 0.09 s */} --- [pid 5073] umount2("./27", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] openat(AT_FDCWD, "./27", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5073] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5073] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5073] umount2("./27/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./27/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5073] unlink("./27/binderfs") = 0 [pid 5073] umount2("./27/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./27/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5073] unlink("./27/cgroup") = 0 [pid 5073] umount2("./27/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 151.566822][ T5618] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 151.574799][ T5618] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000018 [ 151.582799][ T5618] [ 151.592920][ T5618] memory: usage 8kB, limit 0kB, failcnt 55 [pid 5073] lstat("./27/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5073] unlink("./27/cgroup.net") = 0 [pid 5073] umount2("./27/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5073] umount2("./27/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./27/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5073] umount2("./27/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] openat(AT_FDCWD, "./27/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5073] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5073] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5073] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [ 151.615856][ T5618] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [pid 5073] close(4) = 0 [pid 5073] rmdir("./27/file0") = 0 [pid 5073] umount2("./27/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./27/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [ 151.641861][ T5618] Memory cgroup stats for /syz1: [ 151.642082][ T5618] anon 0 [ 151.642082][ T5618] file 0 [ 151.642082][ T5618] kernel 8192 [ 151.642082][ T5618] kernel_stack 0 [ 151.642082][ T5618] pagetables 0 [ 151.642082][ T5618] sec_pagetables 0 [ 151.642082][ T5618] percpu 0 [ 151.642082][ T5618] sock 0 [ 151.642082][ T5618] vmalloc 0 [ 151.642082][ T5618] shmem 0 [ 151.642082][ T5618] zswap 0 [ 151.642082][ T5618] zswapped 0 [ 151.642082][ T5618] file_mapped 0 [ 151.642082][ T5618] file_dirty 0 [pid 5073] unlink("./27/cgroup.cpu") = 0 [pid 5073] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5073] close(3) = 0 [pid 5073] rmdir("./27") = 0 [pid 5073] mkdir("./28", 0777) = 0 [pid 5073] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5639 attached [pid 5639] chdir("./28" [pid 5073] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 30 [pid 5639] <... chdir resumed>) = 0 [pid 5639] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5639] setpgid(0, 0) = 0 [pid 5639] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 5639] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 5639] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [pid 5639] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5639] write(3, "1000", 4) = 4 [pid 5639] close(3) = 0 [pid 5639] symlink("/dev/binderfs", "./binderfs") = 0 [ 151.642082][ T5618] file_writeback 0 [ 151.642082][ T5618] swapcached 0 [ 151.642082][ T5618] anon_thp 0 [ 151.642082][ T5618] file_thp 0 [ 151.642082][ T5618] shmem_thp 0 [ 151.642082][ T5618] inactive_anon 0 [ 151.642082][ T5618] active_anon 0 [ 151.642082][ T5618] inactive_file 0 [ 151.642082][ T5618] active_file 0 [ 151.642082][ T5618] unevictable 0 [ 151.642082][ T5618] slab_reclaimable 6752 [ 151.642082][ T5618] slab_unreclaimable 0 [ 151.642082][ T5618] slab 6752 [ 151.642082][ T5618] workingset_refault_anon 0 [pid 5639] mkdir("./file0", 000) = 0 [pid 5639] open("./file0", O_RDONLY) = 3 [pid 5639] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5639] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5639] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5639] openat(5, "memory.max", O_RDWR) = 6 [pid 5639] write(6, "0x000000000000040e", 18 [pid 5618] <... write resumed>) = 18 [pid 5618] close(3) = 0 [pid 5618] close(4) = 0 [ 151.744019][ T5618] Tasks state (memory values in pages): [ 151.750270][ T5618] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 151.760691][ T5618] Out of memory and no killable processes... [ 151.771932][ T5619] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 151.794164][ T5619] CPU: 0 PID: 5619 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 151.804740][ T5619] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 151.814839][ T5619] Call Trace: [ 151.818152][ T5619] [ 151.821120][ T5619] dump_stack_lvl+0x1e7/0x2d0 [ 151.825857][ T5619] ? nf_tcp_handle_invalid+0x640/0x640 [ 151.831365][ T5619] ? panic+0x770/0x770 [ 151.835499][ T5619] dump_header+0xdc/0x940 [ 151.839880][ T5619] out_of_memory+0xf21/0x12c0 [ 151.844623][ T5619] ? mutex_lock_io_nested+0x60/0x60 [ 151.849865][ T5619] ? preempt_schedule+0xdd/0xf0 [ 151.854731][ T5619] ? unregister_oom_notifier+0x20/0x20 [ 151.860207][ T5619] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 151.866230][ T5619] mem_cgroup_out_of_memory+0x263/0x3b0 [ 151.871808][ T5619] ? preempt_schedule_thunk+0x1a/0x20 [ 151.877202][ T5619] ? mem_cgroup_oom_trylock+0x210/0x210 [ 151.882777][ T5619] ? cgroup_file_notify+0x127/0x190 [ 151.887996][ T5619] memory_max_write+0x355/0x470 [ 151.892868][ T5619] ? memory_max_show+0xa0/0xa0 [ 151.897648][ T5619] ? read_lock_is_recursive+0x20/0x20 [ 151.903042][ T5619] ? memory_max_show+0xa0/0xa0 [ 151.907818][ T5619] cgroup_file_write+0x2b1/0x780 [ 151.912776][ T5619] ? cgroup_seqfile_stop+0xd0/0xd0 [ 151.917900][ T5619] ? __virt_addr_valid+0x22f/0x2e0 [ 151.923130][ T5619] ? cgroup_seqfile_stop+0xd0/0xd0 [ 151.928263][ T5619] kernfs_fop_write_iter+0x3a6/0x4f0 [ 151.933590][ T5619] vfs_write+0x7b2/0xbb0 [ 151.937862][ T5619] ? file_end_write+0x240/0x240 [ 151.942749][ T5619] ? do_raw_spin_unlock+0x13b/0x8b0 [ 151.947972][ T5619] ? lockdep_hardirqs_on+0x98/0x140 [ 151.953196][ T5619] ? __fdget_pos+0x265/0x2f0 [ 151.957823][ T5619] ksys_write+0x1a0/0x2c0 [ 151.962345][ T5619] ? __ia32_sys_read+0x90/0x90 [ 151.967126][ T5619] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 151.973129][ T5619] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 151.979131][ T5619] do_syscall_64+0x41/0xc0 [ 151.983562][ T5619] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 151.989470][ T5619] RIP: 0033:0x7fd49ce20129 [ 151.993901][ T5619] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 152.013535][ T5619] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 152.021975][ T5619] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 152.029975][ T5619] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [pid 5618] close(5) = 0 [pid 5618] close(6) = 0 [pid 5618] close(7) = -1 EBADF (Bad file descriptor) [pid 5618] close(8) = -1 EBADF (Bad file descriptor) [pid 5618] close(9) = -1 EBADF (Bad file descriptor) [pid 5618] close(10) = -1 EBADF (Bad file descriptor) [pid 5618] close(11) = -1 EBADF (Bad file descriptor) [pid 5618] close(12) = -1 EBADF (Bad file descriptor) [pid 5618] close(13) = -1 EBADF (Bad file descriptor) [pid 5618] close(14) = -1 EBADF (Bad file descriptor) [pid 5618] close(15) = -1 EBADF (Bad file descriptor) [pid 5618] close(16) = -1 EBADF (Bad file descriptor) [pid 5618] close(17) = -1 EBADF (Bad file descriptor) [pid 5618] close(18) = -1 EBADF (Bad file descriptor) [pid 5618] close(19) = -1 EBADF (Bad file descriptor) [pid 5618] close(20) = -1 EBADF (Bad file descriptor) [pid 5618] close(21) = -1 EBADF (Bad file descriptor) [pid 5618] close(22) = -1 EBADF (Bad file descriptor) [pid 5618] close(23) = -1 EBADF (Bad file descriptor) [pid 5618] close(24) = -1 EBADF (Bad file descriptor) [pid 5618] close(25) = -1 EBADF (Bad file descriptor) [pid 5618] close(26) = -1 EBADF (Bad file descriptor) [pid 5618] close(27) = -1 EBADF (Bad file descriptor) [pid 5618] close(28) = -1 EBADF (Bad file descriptor) [pid 5618] close(29) = -1 EBADF (Bad file descriptor) [pid 5618] exit_group(0) = ? [ 152.037967][ T5619] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 152.045948][ T5619] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 152.053947][ T5619] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000019 [ 152.062055][ T5619] [ 152.083085][ T5619] memory: usage 8kB, limit 0kB, failcnt 55 [pid 5618] +++ exited with 0 +++ [pid 5070] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=26, si_uid=0, si_status=0, si_utime=0, si_stime=12 /* 0.12 s */} --- [pid 5070] umount2("./24", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] openat(AT_FDCWD, "./24", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5070] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5070] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5070] umount2("./24/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 152.095625][ T5619] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 152.105233][ T5619] Memory cgroup stats for /syz1: [ 152.105426][ T5619] anon 0 [ 152.105426][ T5619] file 0 [ 152.105426][ T5619] kernel 8192 [ 152.105426][ T5619] kernel_stack 0 [ 152.105426][ T5619] pagetables 0 [ 152.105426][ T5619] sec_pagetables 0 [ 152.105426][ T5619] percpu 0 [ 152.105426][ T5619] sock 0 [ 152.105426][ T5619] vmalloc 0 [ 152.105426][ T5619] shmem 0 [ 152.105426][ T5619] zswap 0 [ 152.105426][ T5619] zswapped 0 [ 152.105426][ T5619] file_mapped 0 [ 152.105426][ T5619] file_dirty 0 [ 152.105426][ T5619] file_writeback 0 [ 152.105426][ T5619] swapcached 0 [ 152.105426][ T5619] anon_thp 0 [ 152.105426][ T5619] file_thp 0 [ 152.105426][ T5619] shmem_thp 0 [ 152.105426][ T5619] inactive_anon 0 [ 152.105426][ T5619] active_anon 0 [ 152.105426][ T5619] inactive_file 0 [ 152.105426][ T5619] active_file 0 [ 152.105426][ T5619] unevictable 0 [ 152.105426][ T5619] slab_reclaimable 6752 [ 152.105426][ T5619] slab_unreclaimable 0 [pid 5070] lstat("./24/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5070] unlink("./24/binderfs") = 0 [pid 5070] umount2("./24/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./24/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5070] unlink("./24/cgroup") = 0 [pid 5070] umount2("./24/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./24/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5070] unlink("./24/cgroup.net") = 0 [pid 5070] umount2("./24/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5070] umount2("./24/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./24/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5070] umount2("./24/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] openat(AT_FDCWD, "./24/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5070] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5070] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5070] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5070] close(4) = 0 [pid 5070] rmdir("./24/file0") = 0 [pid 5070] umount2("./24/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./24/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5070] unlink("./24/cgroup.cpu") = 0 [pid 5070] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5070] close(3) = 0 [pid 5070] rmdir("./24") = 0 [pid 5070] mkdir("./25", 0777) = 0 [pid 5070] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5644 attached [pid 5644] chdir("./25" [pid 5070] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 27 [pid 5644] <... chdir resumed>) = 0 [pid 5644] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5644] setpgid(0, 0) = 0 [pid 5644] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 5644] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 5644] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [ 152.105426][ T5619] slab 6752 [ 152.105426][ T5619] workingset_refault_anon 0 [ 152.206929][ T5619] Tasks state (memory values in pages): [ 152.212730][ T5619] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5644] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5644] write(3, "1000", 4) = 4 [pid 5644] close(3) = 0 [ 152.263239][ T5619] Out of memory and no killable processes... [ 152.276044][ T5630] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 152.297256][ T5630] CPU: 0 PID: 5630 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 152.307744][ T5630] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 152.317837][ T5630] Call Trace: [ 152.321152][ T5630] [ 152.324119][ T5630] dump_stack_lvl+0x1e7/0x2d0 [ 152.328852][ T5630] ? nf_tcp_handle_invalid+0x640/0x640 [ 152.334640][ T5630] ? panic+0x770/0x770 [ 152.339395][ T5630] dump_header+0xdc/0x940 [ 152.344311][ T5630] out_of_memory+0xf21/0x12c0 [ 152.349051][ T5630] ? mutex_lock_io_nested+0x60/0x60 [ 152.354325][ T5630] ? preempt_schedule+0xdd/0xf0 [ 152.359226][ T5630] ? unregister_oom_notifier+0x20/0x20 [ 152.364796][ T5630] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 152.370827][ T5630] mem_cgroup_out_of_memory+0x263/0x3b0 [ 152.376411][ T5630] ? preempt_schedule_thunk+0x1a/0x20 [ 152.381811][ T5630] ? mem_cgroup_oom_trylock+0x210/0x210 [ 152.387399][ T5630] ? cgroup_file_notify+0x127/0x190 [ 152.392620][ T5630] memory_max_write+0x355/0x470 [ 152.397505][ T5630] ? memory_max_show+0xa0/0xa0 [ 152.402287][ T5630] ? read_lock_is_recursive+0x20/0x20 [ 152.407682][ T5630] ? memory_max_show+0xa0/0xa0 [ 152.412462][ T5630] cgroup_file_write+0x2b1/0x780 [ 152.417423][ T5630] ? cgroup_seqfile_stop+0xd0/0xd0 [ 152.422543][ T5630] ? __virt_addr_valid+0x22f/0x2e0 [ 152.427679][ T5630] ? cgroup_seqfile_stop+0xd0/0xd0 [ 152.432815][ T5630] kernfs_fop_write_iter+0x3a6/0x4f0 [ 152.438293][ T5630] vfs_write+0x7b2/0xbb0 [ 152.442558][ T5630] ? file_end_write+0x240/0x240 [ 152.447432][ T5630] ? do_raw_spin_unlock+0x13b/0x8b0 [ 152.452647][ T5630] ? lockdep_hardirqs_on+0x98/0x140 [ 152.457867][ T5630] ? __fdget_pos+0x265/0x2f0 [ 152.462500][ T5630] ksys_write+0x1a0/0x2c0 [ 152.466850][ T5630] ? __ia32_sys_read+0x90/0x90 [ 152.471626][ T5630] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 152.477631][ T5630] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 152.483719][ T5630] do_syscall_64+0x41/0xc0 [ 152.488151][ T5630] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 152.494059][ T5630] RIP: 0033:0x7fd49ce20129 [ 152.498511][ T5630] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 152.518125][ T5630] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 152.526570][ T5630] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 152.534560][ T5630] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 152.542535][ T5630] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 152.550511][ T5630] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [pid 5644] symlink("/dev/binderfs", "./binderfs" [pid 5619] <... write resumed>) = 18 [pid 5619] close(3) = 0 [pid 5619] close(4) = 0 [pid 5619] close(5) = 0 [pid 5619] close(6) = 0 [pid 5619] close(7) = -1 EBADF (Bad file descriptor) [pid 5619] close(8) = -1 EBADF (Bad file descriptor) [pid 5619] close(9) = -1 EBADF (Bad file descriptor) [pid 5619] close(10) = -1 EBADF (Bad file descriptor) [pid 5619] close(11) = -1 EBADF (Bad file descriptor) [pid 5619] close(12) = -1 EBADF (Bad file descriptor) [pid 5619] close(13) = -1 EBADF (Bad file descriptor) [pid 5619] close(14) = -1 EBADF (Bad file descriptor) [pid 5619] close(15) = -1 EBADF (Bad file descriptor) [pid 5619] close(16) = -1 EBADF (Bad file descriptor) [pid 5619] close(17) = -1 EBADF (Bad file descriptor) [pid 5619] close(18) = -1 EBADF (Bad file descriptor) [pid 5619] close(19) = -1 EBADF (Bad file descriptor) [pid 5619] close(20) = -1 EBADF (Bad file descriptor) [pid 5619] close(21) = -1 EBADF (Bad file descriptor) [pid 5619] close(22) = -1 EBADF (Bad file descriptor) [pid 5619] close(23) = -1 EBADF (Bad file descriptor) [pid 5619] close(24) = -1 EBADF (Bad file descriptor) [pid 5619] close(25) = -1 EBADF (Bad file descriptor) [pid 5619] close(26) = -1 EBADF (Bad file descriptor) [pid 5619] close(27) = -1 EBADF (Bad file descriptor) [pid 5619] close(28) = -1 EBADF (Bad file descriptor) [pid 5619] close(29) = -1 EBADF (Bad file descriptor) [pid 5619] exit_group(0) = ? [pid 5619] +++ exited with 0 +++ [pid 5644] <... symlink resumed>) = 0 [pid 5644] mkdir("./file0", 000) = 0 [pid 5072] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=27, si_uid=0, si_status=0, si_utime=0, si_stime=11 /* 0.11 s */} --- [pid 5644] open("./file0", O_RDONLY) = 3 [pid 5072] umount2("./25", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5644] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5072] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5644] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5072] openat(AT_FDCWD, "./25", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5644] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5644] openat(5, "memory.max", O_RDWR [pid 5072] <... openat resumed>) = 3 [pid 5644] <... openat resumed>) = 6 [pid 5072] fstat(3, [pid 5644] write(6, "0x000000000000040e", 18 [pid 5072] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5072] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [ 152.558494][ T5630] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000020 [ 152.566530][ T5630] [ 152.575820][ T5630] memory: usage 8kB, limit 0kB, failcnt 55 [ 152.585621][ T5630] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 152.609567][ T5630] Memory cgroup stats for /syz1: [ 152.609729][ T5630] anon 0 [ 152.609729][ T5630] file 0 [ 152.609729][ T5630] kernel 8192 [ 152.609729][ T5630] kernel_stack 0 [ 152.609729][ T5630] pagetables 0 [ 152.609729][ T5630] sec_pagetables 0 [ 152.609729][ T5630] percpu 0 [ 152.609729][ T5630] sock 0 [ 152.609729][ T5630] vmalloc 0 [ 152.609729][ T5630] shmem 0 [ 152.609729][ T5630] zswap 0 [ 152.609729][ T5630] zswapped 0 [ 152.609729][ T5630] file_mapped 0 [ 152.609729][ T5630] file_dirty 0 [ 152.609729][ T5630] file_writeback 0 [ 152.609729][ T5630] swapcached 0 [ 152.609729][ T5630] anon_thp 0 [ 152.609729][ T5630] file_thp 0 [ 152.609729][ T5630] shmem_thp 0 [ 152.609729][ T5630] inactive_anon 0 [ 152.609729][ T5630] active_anon 0 [ 152.609729][ T5630] inactive_file 0 [ 152.609729][ T5630] active_file 0 [ 152.609729][ T5630] unevictable 0 [ 152.609729][ T5630] slab_reclaimable 6752 [ 152.609729][ T5630] slab_unreclaimable 0 [ 152.609729][ T5630] slab 6752 [ 152.609729][ T5630] workingset_refault_anon 0 [pid 5072] umount2("./25/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./25/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5072] unlink("./25/binderfs") = 0 [pid 5630] <... write resumed>) = 18 [pid 5072] umount2("./25/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5630] close(3 [pid 5072] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5630] <... close resumed>) = 0 [pid 5072] lstat("./25/cgroup", [pid 5630] close(4 [pid 5072] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5630] <... close resumed>) = 0 [pid 5072] unlink("./25/cgroup" [pid 5630] close(5 [pid 5072] <... unlink resumed>) = 0 [pid 5630] <... close resumed>) = 0 [pid 5072] umount2("./25/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5630] close(6 [pid 5072] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5630] <... close resumed>) = 0 [pid 5072] lstat("./25/cgroup.net", [pid 5630] close(7 [pid 5072] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [ 152.711220][ T5630] Tasks state (memory values in pages): [ 152.718167][ T5630] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 152.729227][ T5630] Out of memory and no killable processes... [ 152.735836][ T5636] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 152.749114][ T5636] CPU: 1 PID: 5636 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [pid 5630] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5072] unlink("./25/cgroup.net" [pid 5630] close(8 [pid 5072] <... unlink resumed>) = 0 [pid 5630] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5072] umount2("./25/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5630] close(9) = -1 EBADF (Bad file descriptor) [pid 5630] close(10) = -1 EBADF (Bad file descriptor) [pid 5630] close(11) = -1 EBADF (Bad file descriptor) [pid 5630] close(12) = -1 EBADF (Bad file descriptor) [ 152.759586][ T5636] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 152.769684][ T5636] Call Trace: [ 152.773007][ T5636] [ 152.775981][ T5636] dump_stack_lvl+0x1e7/0x2d0 [ 152.780714][ T5636] ? nf_tcp_handle_invalid+0x640/0x640 [ 152.786225][ T5636] ? panic+0x770/0x770 [ 152.790386][ T5636] dump_header+0xdc/0x940 [ 152.794774][ T5636] out_of_memory+0xf21/0x12c0 [ 152.799512][ T5636] ? mutex_lock_io_nested+0x60/0x60 [ 152.804774][ T5636] ? preempt_schedule+0xdd/0xf0 [ 152.809678][ T5636] ? unregister_oom_notifier+0x20/0x20 [ 152.815186][ T5636] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 152.821254][ T5636] mem_cgroup_out_of_memory+0x263/0x3b0 [ 152.826856][ T5636] ? preempt_schedule_thunk+0x1a/0x20 [ 152.832284][ T5636] ? mem_cgroup_oom_trylock+0x210/0x210 [ 152.837899][ T5636] ? cgroup_file_notify+0x127/0x190 [ 152.843138][ T5636] memory_max_write+0x355/0x470 [ 152.848046][ T5636] ? memory_max_show+0xa0/0xa0 [ 152.852852][ T5636] ? read_lock_is_recursive+0x20/0x20 [ 152.858288][ T5636] ? memory_max_show+0xa0/0xa0 [ 152.863088][ T5636] cgroup_file_write+0x2b1/0x780 [ 152.868070][ T5636] ? cgroup_seqfile_stop+0xd0/0xd0 [ 152.873220][ T5636] ? __virt_addr_valid+0x22f/0x2e0 [ 152.878401][ T5636] ? cgroup_seqfile_stop+0xd0/0xd0 [ 152.883543][ T5636] kernfs_fop_write_iter+0x3a6/0x4f0 [ 152.888890][ T5636] vfs_write+0x7b2/0xbb0 [ 152.893188][ T5636] ? file_end_write+0x240/0x240 [ 152.898086][ T5636] ? do_raw_spin_unlock+0x13b/0x8b0 [ 152.903334][ T5636] ? lockdep_hardirqs_on+0x98/0x140 [ 152.908592][ T5636] ? __fdget_pos+0x265/0x2f0 [ 152.913227][ T5636] ksys_write+0x1a0/0x2c0 [ 152.917619][ T5636] ? __ia32_sys_read+0x90/0x90 [ 152.922427][ T5636] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 152.928487][ T5636] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 152.934520][ T5636] do_syscall_64+0x41/0xc0 [ 152.938991][ T5636] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 152.944924][ T5636] RIP: 0033:0x7fd49ce20129 [ 152.949362][ T5636] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 152.969015][ T5636] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 152.977494][ T5636] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 152.985505][ T5636] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 152.993501][ T5636] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 153.001514][ T5636] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [pid 5630] close(13) = -1 EBADF (Bad file descriptor) [pid 5630] close(14) = -1 EBADF (Bad file descriptor) [pid 5630] close(15) = -1 EBADF (Bad file descriptor) [pid 5630] close(16) = -1 EBADF (Bad file descriptor) [pid 5630] close(17) = -1 EBADF (Bad file descriptor) [pid 5630] close(18) = -1 EBADF (Bad file descriptor) [pid 5630] close(19) = -1 EBADF (Bad file descriptor) [pid 5630] close(20) = -1 EBADF (Bad file descriptor) [pid 5630] close(21) = -1 EBADF (Bad file descriptor) [pid 5630] close(22) = -1 EBADF (Bad file descriptor) [pid 5630] close(23) = -1 EBADF (Bad file descriptor) [pid 5630] close(24) = -1 EBADF (Bad file descriptor) [pid 5630] close(25) = -1 EBADF (Bad file descriptor) [pid 5630] close(26) = -1 EBADF (Bad file descriptor) [pid 5630] close(27) = -1 EBADF (Bad file descriptor) [pid 5630] close(28) = -1 EBADF (Bad file descriptor) [pid 5630] close(29) = -1 EBADF (Bad file descriptor) [pid 5630] exit_group(0) = ? [pid 5630] +++ exited with 0 +++ [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=34, si_uid=0, si_status=0, si_utime=0, si_stime=10 /* 0.10 s */} --- [pid 5074] umount2("./32", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] openat(AT_FDCWD, "./32", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5074] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5074] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5074] umount2("./32/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./32/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5074] unlink("./32/binderfs") = 0 [pid 5074] umount2("./32/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./32/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5074] unlink("./32/cgroup") = 0 [pid 5074] umount2("./32/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./32/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5074] unlink("./32/cgroup.net") = 0 [pid 5074] umount2("./32/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5072] <... umount2 resumed>) = 0 [pid 5074] <... umount2 resumed>) = 0 [pid 5072] umount2("./25/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] umount2("./32/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5072] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./25/file0", [pid 5074] lstat("./32/file0", [pid 5072] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5074] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5072] umount2("./25/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] umount2("./32/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5072] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5072] openat(AT_FDCWD, "./25/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5074] openat(AT_FDCWD, "./32/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5072] <... openat resumed>) = 4 [pid 5074] <... openat resumed>) = 4 [pid 5072] fstat(4, [pid 5074] fstat(4, [pid 5072] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5074] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5072] getdents64(4, [pid 5074] getdents64(4, [pid 5072] <... getdents64 resumed>0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5074] <... getdents64 resumed>0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5072] getdents64(4, [pid 5074] getdents64(4, [pid 5072] <... getdents64 resumed>0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5074] <... getdents64 resumed>0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5072] close(4 [pid 5074] close(4 [pid 5072] <... close resumed>) = 0 [pid 5074] <... close resumed>) = 0 [pid 5072] rmdir("./25/file0" [pid 5074] rmdir("./32/file0" [pid 5072] <... rmdir resumed>) = 0 [pid 5074] <... rmdir resumed>) = 0 [pid 5072] umount2("./25/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] umount2("./32/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5072] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./25/cgroup.cpu", [pid 5074] lstat("./32/cgroup.cpu", [pid 5072] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5074] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [ 153.009538][ T5636] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 000000000000001f [ 153.017597][ T5636] [ 153.031217][ T5636] memory: usage 8kB, limit 0kB, failcnt 55 [ 153.037555][ T5636] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 153.045064][ T5636] Memory cgroup stats for /syz1: [ 153.045350][ T5636] anon 0 [ 153.045350][ T5636] file 0 [ 153.045350][ T5636] kernel 8192 [ 153.045350][ T5636] kernel_stack 0 [ 153.045350][ T5636] pagetables 0 [pid 5072] unlink("./25/cgroup.cpu" [pid 5074] unlink("./32/cgroup.cpu" [pid 5072] <... unlink resumed>) = 0 [pid 5074] <... unlink resumed>) = 0 [pid 5072] getdents64(3, [pid 5074] getdents64(3, [pid 5072] <... getdents64 resumed>0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5074] <... getdents64 resumed>0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5072] close(3 [pid 5074] close(3 [pid 5072] <... close resumed>) = 0 [pid 5074] <... close resumed>) = 0 [pid 5072] rmdir("./25" [pid 5074] rmdir("./32" [pid 5072] <... rmdir resumed>) = 0 [pid 5074] <... rmdir resumed>) = 0 [pid 5072] mkdir("./26", 0777 [pid 5074] mkdir("./33", 0777 [pid 5072] <... mkdir resumed>) = 0 [ 153.045350][ T5636] sec_pagetables 0 [ 153.045350][ T5636] percpu 0 [ 153.045350][ T5636] sock 0 [ 153.045350][ T5636] vmalloc 0 [ 153.045350][ T5636] shmem 0 [ 153.045350][ T5636] zswap 0 [ 153.045350][ T5636] zswapped 0 [ 153.045350][ T5636] file_mapped 0 [ 153.045350][ T5636] file_dirty 0 [ 153.045350][ T5636] file_writeback 0 [ 153.045350][ T5636] swapcached 0 [ 153.045350][ T5636] anon_thp 0 [ 153.045350][ T5636] file_thp 0 [ 153.045350][ T5636] shmem_thp 0 [ 153.045350][ T5636] inactive_anon 0 [ 153.045350][ T5636] active_anon 0 [pid 5074] <... mkdir resumed>) = 0 [pid 5072] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5646 attached [pid 5072] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 28 [pid 5646] chdir("./33" [pid 5074] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 35 [pid 5646] <... chdir resumed>) = 0 [pid 5646] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5646] setpgid(0, 0) = 0 [pid 5646] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [pid 5646] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 5646] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 5646] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5646] write(3, "1000", 4) = 4 [pid 5646] close(3) = 0 [pid 5646] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5646] mkdir("./file0", 000) = 0 [pid 5646] open("./file0", O_RDONLY) = 3 [pid 5646] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5646] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5646] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5646] openat(5, "memory.max", O_RDWR) = 6 [pid 5646] write(6, "0x000000000000040e", 18./strace-static-x86_64: Process 5645 attached [pid 5645] chdir("./26") = 0 [pid 5645] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5645] setpgid(0, 0) = 0 [ 153.045350][ T5636] inactive_file 0 [ 153.045350][ T5636] active_file 0 [ 153.045350][ T5636] unevictable 0 [ 153.045350][ T5636] slab_reclaimable 6752 [ 153.045350][ T5636] slab_unreclaimable 0 [ 153.045350][ T5636] slab 6752 [ 153.045350][ T5636] workingset_refault_anon 0 [ 153.151749][ T5636] Tasks state (memory values in pages): [ 153.157971][ T5636] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5645] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 5645] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [pid 5645] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 5645] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5645] write(3, "1000", 4) = 4 [pid 5645] close(3) = 0 [pid 5645] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5645] mkdir("./file0", 000 [pid 5636] <... write resumed>) = 18 [pid 5645] <... mkdir resumed>) = 0 [pid 5645] open("./file0", O_RDONLY) = 3 [pid 5645] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5645] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5645] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5645] openat(5, "memory.max", O_RDWR) = 6 [pid 5645] write(6, "0x000000000000040e", 18 [pid 5636] close(3) = 0 [pid 5636] close(4) = 0 [pid 5636] close(5) = 0 [pid 5636] close(6) = 0 [ 153.168564][ T5636] Out of memory and no killable processes... [ 153.175359][ T5639] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 153.186766][ T5639] CPU: 1 PID: 5639 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 153.197240][ T5639] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 153.207338][ T5639] Call Trace: [ 153.210646][ T5639] [ 153.213605][ T5639] dump_stack_lvl+0x1e7/0x2d0 [pid 5636] close(7) = -1 EBADF (Bad file descriptor) [pid 5636] close(8) = -1 EBADF (Bad file descriptor) [pid 5636] close(9) = -1 EBADF (Bad file descriptor) [pid 5636] close(10) = -1 EBADF (Bad file descriptor) [pid 5636] close(11) = -1 EBADF (Bad file descriptor) [pid 5636] close(12) = -1 EBADF (Bad file descriptor) [pid 5636] close(13) = -1 EBADF (Bad file descriptor) [pid 5636] close(14) = -1 EBADF (Bad file descriptor) [pid 5636] close(15) = -1 EBADF (Bad file descriptor) [ 153.218358][ T5639] ? nf_tcp_handle_invalid+0x640/0x640 [ 153.223874][ T5639] ? panic+0x770/0x770 [ 153.228015][ T5639] dump_header+0xdc/0x940 [ 153.232387][ T5639] out_of_memory+0xf21/0x12c0 [ 153.237125][ T5639] ? mutex_lock_io_nested+0x60/0x60 [ 153.242387][ T5639] ? mark_lock+0x9a/0x340 [ 153.246783][ T5639] ? unregister_oom_notifier+0x20/0x20 [ 153.252282][ T5639] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 153.258298][ T5639] mem_cgroup_out_of_memory+0x263/0x3b0 [ 153.263888][ T5639] ? mem_cgroup_oom_trylock+0x210/0x210 [ 153.269482][ T5639] ? cgroup_file_notify+0x127/0x190 [ 153.274732][ T5639] memory_max_write+0x355/0x470 [ 153.279610][ T5639] ? memory_max_show+0xa0/0xa0 [ 153.284390][ T5639] ? read_lock_is_recursive+0x20/0x20 [ 153.289784][ T5639] ? memory_max_show+0xa0/0xa0 [ 153.294564][ T5639] cgroup_file_write+0x2b1/0x780 [ 153.299525][ T5639] ? cgroup_seqfile_stop+0xd0/0xd0 [ 153.304651][ T5639] ? __virt_addr_valid+0x22f/0x2e0 [ 153.309789][ T5639] ? cgroup_seqfile_stop+0xd0/0xd0 [ 153.314910][ T5639] kernfs_fop_write_iter+0x3a6/0x4f0 [ 153.320218][ T5639] vfs_write+0x7b2/0xbb0 [ 153.324506][ T5639] ? file_end_write+0x240/0x240 [ 153.329383][ T5639] ? do_raw_spin_unlock+0x13b/0x8b0 [ 153.334620][ T5639] ? lockdep_hardirqs_on+0x98/0x140 [ 153.339847][ T5639] ? __fdget_pos+0x265/0x2f0 [ 153.344476][ T5639] ksys_write+0x1a0/0x2c0 [ 153.348829][ T5639] ? __ia32_sys_read+0x90/0x90 [ 153.353611][ T5639] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 153.359625][ T5639] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 153.365631][ T5639] do_syscall_64+0x41/0xc0 [ 153.370067][ T5639] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 153.375983][ T5639] RIP: 0033:0x7fd49ce20129 [ 153.380412][ T5639] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 153.400027][ T5639] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 153.408456][ T5639] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [pid 5636] close(16) = -1 EBADF (Bad file descriptor) [pid 5636] close(17) = -1 EBADF (Bad file descriptor) [pid 5636] close(18) = -1 EBADF (Bad file descriptor) [pid 5636] close(19) = -1 EBADF (Bad file descriptor) [pid 5636] close(20) = -1 EBADF (Bad file descriptor) [pid 5636] close(21) = -1 EBADF (Bad file descriptor) [pid 5636] close(22) = -1 EBADF (Bad file descriptor) [pid 5636] close(23) = -1 EBADF (Bad file descriptor) [pid 5636] close(24) = -1 EBADF (Bad file descriptor) [pid 5636] close(25) = -1 EBADF (Bad file descriptor) [ 153.416441][ T5639] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 153.424420][ T5639] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 153.432399][ T5639] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 153.440383][ T5639] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 000000000000001c [ 153.448382][ T5639] [ 153.454675][ T5639] memory: usage 8kB, limit 0kB, failcnt 55 [pid 5636] close(26) = -1 EBADF (Bad file descriptor) [pid 5636] close(27) = -1 EBADF (Bad file descriptor) [pid 5636] close(28) = -1 EBADF (Bad file descriptor) [pid 5636] close(29) = -1 EBADF (Bad file descriptor) [pid 5636] exit_group(0) = ? [pid 5636] +++ exited with 0 +++ [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=33, si_uid=0, si_status=0, si_utime=0, si_stime=7 /* 0.07 s */} --- [pid 5075] umount2("./31", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] openat(AT_FDCWD, "./31", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5075] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5075] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5075] umount2("./31/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./31/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5075] unlink("./31/binderfs") = 0 [pid 5075] umount2("./31/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./31/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5075] unlink("./31/cgroup") = 0 [pid 5075] umount2("./31/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./31/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5075] unlink("./31/cgroup.net") = 0 [ 153.470144][ T5639] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 153.478687][ T5639] Memory cgroup stats for /syz1: [ 153.478883][ T5639] anon 0 [ 153.478883][ T5639] file 0 [ 153.478883][ T5639] kernel 8192 [ 153.478883][ T5639] kernel_stack 0 [ 153.478883][ T5639] pagetables 0 [ 153.478883][ T5639] sec_pagetables 0 [ 153.478883][ T5639] percpu 0 [ 153.478883][ T5639] sock 0 [ 153.478883][ T5639] vmalloc 0 [ 153.478883][ T5639] shmem 0 [ 153.478883][ T5639] zswap 0 [ 153.478883][ T5639] zswapped 0 [ 153.478883][ T5639] file_mapped 0 [ 153.478883][ T5639] file_dirty 0 [ 153.478883][ T5639] file_writeback 0 [ 153.478883][ T5639] swapcached 0 [ 153.478883][ T5639] anon_thp 0 [ 153.478883][ T5639] file_thp 0 [ 153.478883][ T5639] shmem_thp 0 [ 153.478883][ T5639] inactive_anon 0 [ 153.478883][ T5639] active_anon 0 [ 153.478883][ T5639] inactive_file 0 [ 153.478883][ T5639] active_file 0 [ 153.478883][ T5639] unevictable 0 [ 153.478883][ T5639] slab_reclaimable 6752 [ 153.478883][ T5639] slab_unreclaimable 0 [ 153.478883][ T5639] slab 6752 [pid 5075] umount2("./31/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5075] umount2("./31/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./31/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5075] umount2("./31/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] openat(AT_FDCWD, "./31/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5639] <... write resumed>) = 18 [pid 5075] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5075] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5075] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [ 153.478883][ T5639] workingset_refault_anon 0 [ 153.579769][ T5639] Tasks state (memory values in pages): [ 153.585368][ T5639] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 153.595430][ T5639] Out of memory and no killable processes... [ 153.601874][ T5644] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5075] close(4) = 0 [pid 5075] rmdir("./31/file0") = 0 [pid 5075] umount2("./31/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./31/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5075] unlink("./31/cgroup.cpu") = 0 [pid 5075] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5075] close(3) = 0 [pid 5075] rmdir("./31") = 0 [pid 5075] mkdir("./32", 0777) = 0 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555574ac5d0) = 34 [pid 5639] close(3) = 0 [pid 5639] close(4) = 0 [pid 5639] close(5) = 0 [pid 5639] close(6) = 0 [pid 5639] close(7) = -1 EBADF (Bad file descriptor) [pid 5639] close(8) = -1 EBADF (Bad file descriptor) [pid 5639] close(9) = -1 EBADF (Bad file descriptor) [pid 5639] close(10) = -1 EBADF (Bad file descriptor) [pid 5639] close(11) = -1 EBADF (Bad file descriptor) [pid 5639] close(12) = -1 EBADF (Bad file descriptor) [ 153.614172][ T5644] CPU: 0 PID: 5644 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 153.624646][ T5644] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 153.634754][ T5644] Call Trace: [ 153.638065][ T5644] [ 153.641045][ T5644] dump_stack_lvl+0x1e7/0x2d0 [ 153.645792][ T5644] ? nf_tcp_handle_invalid+0x640/0x640 [ 153.651312][ T5644] ? panic+0x770/0x770 [ 153.655465][ T5644] dump_header+0xdc/0x940 [ 153.659855][ T5644] out_of_memory+0xf21/0x12c0 [ 153.664592][ T5644] ? mutex_lock_io_nested+0x60/0x60 [pid 5639] close(13) = -1 EBADF (Bad file descriptor) [pid 5639] close(14) = -1 EBADF (Bad file descriptor) [pid 5639] close(15) = -1 EBADF (Bad file descriptor) [pid 5639] close(16) = -1 EBADF (Bad file descriptor) [pid 5639] close(17) = -1 EBADF (Bad file descriptor) [pid 5639] close(18) = -1 EBADF (Bad file descriptor) [pid 5639] close(19) = -1 EBADF (Bad file descriptor) [pid 5639] close(20) = -1 EBADF (Bad file descriptor) [pid 5639] close(21) = -1 EBADF (Bad file descriptor) [pid 5639] close(22) = -1 EBADF (Bad file descriptor) [pid 5639] close(23) = -1 EBADF (Bad file descriptor) [pid 5639] close(24) = -1 EBADF (Bad file descriptor) [pid 5639] close(25) = -1 EBADF (Bad file descriptor) [pid 5639] close(26) = -1 EBADF (Bad file descriptor) [pid 5639] close(27) = -1 EBADF (Bad file descriptor) [pid 5639] close(28) = -1 EBADF (Bad file descriptor) [pid 5639] close(29) = -1 EBADF (Bad file descriptor) [pid 5639] exit_group(0) = ? [pid 5639] +++ exited with 0 +++ [pid 5073] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=30, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- [pid 5073] umount2("./28", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 153.669855][ T5644] ? mark_lock+0x9a/0x340 [ 153.674225][ T5644] ? unregister_oom_notifier+0x20/0x20 [ 153.679734][ T5644] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 153.685785][ T5644] mem_cgroup_out_of_memory+0x263/0x3b0 [ 153.691405][ T5644] ? mem_cgroup_oom_trylock+0x210/0x210 [ 153.697031][ T5644] ? cgroup_file_notify+0x127/0x190 [ 153.702296][ T5644] memory_max_write+0x355/0x470 [ 153.707217][ T5644] ? memory_max_show+0xa0/0xa0 [ 153.712056][ T5644] ? read_lock_is_recursive+0x20/0x20 [pid 5073] openat(AT_FDCWD, "./28", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5073] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5073] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5073] umount2("./28/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./28/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5073] unlink("./28/binderfs") = 0 [pid 5073] umount2("./28/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./28/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5073] unlink("./28/cgroup") = 0 [pid 5073] umount2("./28/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./28/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5073] unlink("./28/cgroup.net") = 0 [pid 5073] umount2("./28/file0", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5648 attached [pid 5648] chdir("./32") = 0 [pid 5648] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5648] setpgid(0, 0) = 0 [pid 5648] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [ 153.717499][ T5644] ? memory_max_show+0xa0/0xa0 [ 153.722316][ T5644] cgroup_file_write+0x2b1/0x780 [ 153.727317][ T5644] ? cgroup_seqfile_stop+0xd0/0xd0 [ 153.732479][ T5644] ? __virt_addr_valid+0x22f/0x2e0 [ 153.737673][ T5644] ? cgroup_seqfile_stop+0xd0/0xd0 [ 153.742838][ T5644] kernfs_fop_write_iter+0x3a6/0x4f0 [ 153.748195][ T5644] vfs_write+0x7b2/0xbb0 [ 153.752509][ T5644] ? file_end_write+0x240/0x240 [ 153.757419][ T5644] ? do_raw_spin_unlock+0x13b/0x8b0 [ 153.762674][ T5644] ? lockdep_hardirqs_on+0x98/0x140 [pid 5648] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 5648] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 5648] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5648] write(3, "1000", 4) = 4 [pid 5648] close(3) = 0 [pid 5648] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5648] mkdir("./file0", 000) = 0 [pid 5648] open("./file0", O_RDONLY) = 3 [pid 5648] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5648] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5648] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5648] openat(5, "memory.max", O_RDWR) = 6 [ 153.767934][ T5644] ? __fdget_pos+0x265/0x2f0 [ 153.772575][ T5644] ksys_write+0x1a0/0x2c0 [ 153.776961][ T5644] ? __ia32_sys_read+0x90/0x90 [ 153.781778][ T5644] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 153.787840][ T5644] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 153.793884][ T5644] do_syscall_64+0x41/0xc0 [ 153.798366][ T5644] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 153.804318][ T5644] RIP: 0033:0x7fd49ce20129 [ 153.808771][ T5644] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 153.828423][ T5644] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 153.836866][ T5644] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 153.844881][ T5644] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 153.852874][ T5644] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 153.860877][ T5644] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [pid 5648] write(6, "0x000000000000040e", 18 [pid 5073] <... umount2 resumed>) = 0 [pid 5073] umount2("./28/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./28/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5073] umount2("./28/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] openat(AT_FDCWD, "./28/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5073] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5073] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5073] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5073] close(4) = 0 [pid 5073] rmdir("./28/file0") = 0 [pid 5073] umount2("./28/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./28/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5073] unlink("./28/cgroup.cpu") = 0 [pid 5073] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [ 153.868884][ T5644] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000019 [ 153.876896][ T5644] [ 153.899897][ T5644] memory: usage 8kB, limit 0kB, failcnt 55 [ 153.905795][ T5644] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 153.913182][ T5644] Memory cgroup stats for /syz1: [ 153.913398][ T5644] anon 0 [pid 5073] close(3) = 0 [pid 5073] rmdir("./28") = 0 [pid 5073] mkdir("./29", 0777) = 0 [pid 5073] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555574ac5d0) = 31 [ 153.913398][ T5644] file 0 [ 153.913398][ T5644] kernel 8192 [ 153.913398][ T5644] kernel_stack 0 [ 153.913398][ T5644] pagetables 0 [ 153.913398][ T5644] sec_pagetables 0 [ 153.913398][ T5644] percpu 0 [ 153.913398][ T5644] sock 0 [ 153.913398][ T5644] vmalloc 0 [ 153.913398][ T5644] shmem 0 [ 153.913398][ T5644] zswap 0 [ 153.913398][ T5644] zswapped 0 [ 153.913398][ T5644] file_mapped 0 [ 153.913398][ T5644] file_dirty 0 [ 153.913398][ T5644] file_writeback 0 [ 153.913398][ T5644] swapcached 0 [ 153.913398][ T5644] anon_thp 0 ./strace-static-x86_64: Process 5649 attached [pid 5649] chdir("./29") = 0 [ 153.913398][ T5644] file_thp 0 [ 153.913398][ T5644] shmem_thp 0 [ 153.913398][ T5644] inactive_anon 0 [ 153.913398][ T5644] active_anon 0 [ 153.913398][ T5644] inactive_file 0 [ 153.913398][ T5644] active_file 0 [ 153.913398][ T5644] unevictable 0 [ 153.913398][ T5644] slab_reclaimable 6752 [ 153.913398][ T5644] slab_unreclaimable 0 [ 153.913398][ T5644] slab 6752 [ 153.913398][ T5644] workingset_refault_anon 0 [ 154.013903][ T5644] Tasks state (memory values in pages): [pid 5649] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5649] setpgid(0, 0) = 0 [pid 5649] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [ 154.027021][ T5644] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 154.042439][ T5644] Out of memory and no killable processes... [ 154.050907][ T5646] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 154.066617][ T5646] CPU: 1 PID: 5646 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [pid 5649] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu" [pid 5644] <... write resumed>) = 18 [pid 5649] <... symlink resumed>) = 0 [pid 5649] symlink("/syzcgroup/net/syz4", "./cgroup.net" [pid 5644] close(3 [pid 5649] <... symlink resumed>) = 0 [pid 5649] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5644] <... close resumed>) = 0 [pid 5649] <... openat resumed>) = 3 [pid 5649] write(3, "1000", 4 [pid 5644] close(4 [pid 5649] <... write resumed>) = 4 [pid 5649] close(3 [pid 5644] <... close resumed>) = 0 [pid 5649] <... close resumed>) = 0 [pid 5649] symlink("/dev/binderfs", "./binderfs" [pid 5644] close(5 [pid 5649] <... symlink resumed>) = 0 [pid 5649] mkdir("./file0", 000 [pid 5644] <... close resumed>) = 0 [pid 5649] <... mkdir resumed>) = 0 [pid 5649] open("./file0", O_RDONLY [pid 5644] close(6 [pid 5649] <... open resumed>) = 3 [pid 5649] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5644] <... close resumed>) = 0 [pid 5649] <... mount resumed>) = 0 [pid 5649] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5644] close(7 [pid 5649] <... openat resumed>) = 4 [pid 5644] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5649] openat(4, "syz1", O_RDWR|O_PATH [pid 5644] close(8 [pid 5649] <... openat resumed>) = 5 [pid 5644] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5649] openat(5, "memory.max", O_RDWR [pid 5644] close(9 [pid 5649] <... openat resumed>) = 6 [pid 5644] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5649] write(6, "0x000000000000040e", 18 [pid 5644] close(10) = -1 EBADF (Bad file descriptor) [pid 5644] close(11) = -1 EBADF (Bad file descriptor) [pid 5644] close(12) = -1 EBADF (Bad file descriptor) [pid 5644] close(13) = -1 EBADF (Bad file descriptor) [pid 5644] close(14) = -1 EBADF (Bad file descriptor) [pid 5644] close(15) = -1 EBADF (Bad file descriptor) [pid 5644] close(16) = -1 EBADF (Bad file descriptor) [pid 5644] close(17) = -1 EBADF (Bad file descriptor) [pid 5644] close(18) = -1 EBADF (Bad file descriptor) [pid 5644] close(19) = -1 EBADF (Bad file descriptor) [pid 5644] close(20) = -1 EBADF (Bad file descriptor) [pid 5644] close(21) = -1 EBADF (Bad file descriptor) [pid 5644] close(22) = -1 EBADF (Bad file descriptor) [pid 5644] close(23) = -1 EBADF (Bad file descriptor) [pid 5644] close(24) = -1 EBADF (Bad file descriptor) [pid 5644] close(25) = -1 EBADF (Bad file descriptor) [pid 5644] close(26) = -1 EBADF (Bad file descriptor) [pid 5644] close(27) = -1 EBADF (Bad file descriptor) [pid 5644] close(28) = -1 EBADF (Bad file descriptor) [pid 5644] close(29) = -1 EBADF (Bad file descriptor) [pid 5644] exit_group(0) = ? [pid 5644] +++ exited with 0 +++ [pid 5070] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=27, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- [pid 5070] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5070] umount2("./25", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] openat(AT_FDCWD, "./25", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5070] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5070] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5070] umount2("./25/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./25/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5070] unlink("./25/binderfs") = 0 [pid 5070] umount2("./25/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./25/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5070] unlink("./25/cgroup") = 0 [ 154.077093][ T5646] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 154.087188][ T5646] Call Trace: [ 154.090505][ T5646] [ 154.093468][ T5646] dump_stack_lvl+0x1e7/0x2d0 [ 154.098200][ T5646] ? nf_tcp_handle_invalid+0x640/0x640 [ 154.103729][ T5646] ? panic+0x770/0x770 [ 154.107865][ T5646] dump_header+0xdc/0x940 [ 154.112250][ T5646] out_of_memory+0xf21/0x12c0 [ 154.116990][ T5646] ? mutex_lock_io_nested+0x60/0x60 [ 154.122248][ T5646] ? mark_lock+0x9a/0x340 [pid 5070] umount2("./25/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./25/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5070] unlink("./25/cgroup.net") = 0 [ 154.126623][ T5646] ? unregister_oom_notifier+0x20/0x20 [ 154.132135][ T5646] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 154.138181][ T5646] mem_cgroup_out_of_memory+0x263/0x3b0 [ 154.143799][ T5646] ? mem_cgroup_oom_trylock+0x210/0x210 [ 154.149392][ T5646] ? cgroup_file_notify+0x127/0x190 [ 154.154624][ T5646] memory_max_write+0x355/0x470 [ 154.159530][ T5646] ? memory_max_show+0xa0/0xa0 [ 154.164319][ T5646] ? read_lock_is_recursive+0x20/0x20 [ 154.169708][ T5646] ? memory_max_show+0xa0/0xa0 [ 154.174495][ T5646] cgroup_file_write+0x2b1/0x780 [ 154.179467][ T5646] ? cgroup_seqfile_stop+0xd0/0xd0 [ 154.184602][ T5646] ? __virt_addr_valid+0x22f/0x2e0 [ 154.189737][ T5646] ? cgroup_seqfile_stop+0xd0/0xd0 [ 154.194892][ T5646] kernfs_fop_write_iter+0x3a6/0x4f0 [ 154.200206][ T5646] vfs_write+0x7b2/0xbb0 [ 154.204488][ T5646] ? file_end_write+0x240/0x240 [ 154.209372][ T5646] ? do_raw_spin_unlock+0x13b/0x8b0 [ 154.214604][ T5646] ? lockdep_hardirqs_on+0x98/0x140 [ 154.219840][ T5646] ? __fdget_pos+0x265/0x2f0 [ 154.224462][ T5646] ksys_write+0x1a0/0x2c0 [ 154.228833][ T5646] ? __ia32_sys_read+0x90/0x90 [ 154.233659][ T5646] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 154.239678][ T5646] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 154.245699][ T5646] do_syscall_64+0x41/0xc0 [ 154.250130][ T5646] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 154.256038][ T5646] RIP: 0033:0x7fd49ce20129 [ 154.260471][ T5646] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 154.280116][ T5646] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 154.288583][ T5646] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 154.296591][ T5646] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 154.304585][ T5646] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 154.312561][ T5646] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 154.320545][ T5646] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000021 [pid 5070] umount2("./25/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5070] umount2("./25/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./25/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5070] umount2("./25/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] openat(AT_FDCWD, "./25/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5070] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5070] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5070] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5070] close(4) = 0 [pid 5070] rmdir("./25/file0") = 0 [pid 5070] umount2("./25/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5070] lstat("./25/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5070] unlink("./25/cgroup.cpu") = 0 [pid 5070] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5070] close(3) = 0 [pid 5070] rmdir("./25") = 0 [pid 5070] mkdir("./26", 0777) = 0 [pid 5070] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5650 attached [ 154.328570][ T5646] [ 154.338935][ T5646] memory: usage 8kB, limit 0kB, failcnt 55 [ 154.345355][ T5646] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 154.353353][ T5646] Memory cgroup stats for /syz1: [ 154.354370][ T5646] anon 0 [ 154.354370][ T5646] file 0 [ 154.354370][ T5646] kernel 8192 [ 154.354370][ T5646] kernel_stack 0 [ 154.354370][ T5646] pagetables 0 [ 154.354370][ T5646] sec_pagetables 0 [ 154.354370][ T5646] percpu 0 [ 154.354370][ T5646] sock 0 [ 154.354370][ T5646] vmalloc 0 [ 154.354370][ T5646] shmem 0 [ 154.354370][ T5646] zswap 0 [ 154.354370][ T5646] zswapped 0 [ 154.354370][ T5646] file_mapped 0 [ 154.354370][ T5646] file_dirty 0 [ 154.354370][ T5646] file_writeback 0 [ 154.354370][ T5646] swapcached 0 [ 154.354370][ T5646] anon_thp 0 [ 154.354370][ T5646] file_thp 0 [ 154.354370][ T5646] shmem_thp 0 [ 154.354370][ T5646] inactive_anon 0 [ 154.354370][ T5646] active_anon 0 [ 154.354370][ T5646] inactive_file 0 [pid 5650] chdir("./26" [pid 5070] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 28 [pid 5650] <... chdir resumed>) = 0 [pid 5650] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5650] setpgid(0, 0) = 0 [pid 5650] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 5650] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 5650] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 5650] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5650] write(3, "1000", 4) = 4 [pid 5650] close(3) = 0 [pid 5650] symlink("/dev/binderfs", "./binderfs") = 0 [ 154.354370][ T5646] active_file 0 [ 154.354370][ T5646] unevictable 0 [ 154.354370][ T5646] slab_reclaimable 6752 [ 154.354370][ T5646] slab_unreclaimable 0 [ 154.354370][ T5646] slab 6752 [ 154.354370][ T5646] workingset_refault_anon 0 [ 154.457298][ T5646] Tasks state (memory values in pages): [ 154.463898][ T5646] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 5650] mkdir("./file0", 000) = 0 [pid 5650] open("./file0", O_RDONLY) = 3 [pid 5650] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5650] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5650] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5650] openat(5, "memory.max", O_RDWR) = 6 [pid 5650] write(6, "0x000000000000040e", 18 [pid 5646] <... write resumed>) = 18 [ 154.474846][ T5646] Out of memory and no killable processes... [ 154.482139][ T5645] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 154.494662][ T5645] CPU: 1 PID: 5645 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 154.505134][ T5645] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 154.515226][ T5645] Call Trace: [ 154.518541][ T5645] [ 154.521502][ T5645] dump_stack_lvl+0x1e7/0x2d0 [ 154.526216][ T5645] ? nf_tcp_handle_invalid+0x640/0x640 [ 154.531705][ T5645] ? panic+0x770/0x770 [ 154.535808][ T5645] dump_header+0xdc/0x940 [ 154.540169][ T5645] out_of_memory+0xf21/0x12c0 [ 154.544875][ T5645] ? mutex_lock_io_nested+0x60/0x60 [ 154.550099][ T5645] ? mark_lock+0x9a/0x340 [ 154.554440][ T5645] ? unregister_oom_notifier+0x20/0x20 [ 154.559916][ T5645] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 154.565930][ T5645] mem_cgroup_out_of_memory+0x263/0x3b0 [ 154.571500][ T5645] ? mem_cgroup_oom_trylock+0x210/0x210 [ 154.577097][ T5645] ? cgroup_file_notify+0x127/0x190 [ 154.582322][ T5645] memory_max_write+0x355/0x470 [ 154.587198][ T5645] ? memory_max_show+0xa0/0xa0 [ 154.592015][ T5645] ? read_lock_is_recursive+0x20/0x20 [ 154.597426][ T5645] ? memory_max_show+0xa0/0xa0 [ 154.602225][ T5645] cgroup_file_write+0x2b1/0x780 [ 154.607211][ T5645] ? cgroup_seqfile_stop+0xd0/0xd0 [ 154.612365][ T5645] ? __virt_addr_valid+0x22f/0x2e0 [ 154.617518][ T5645] ? cgroup_seqfile_stop+0xd0/0xd0 [ 154.622653][ T5645] kernfs_fop_write_iter+0x3a6/0x4f0 [ 154.627969][ T5645] vfs_write+0x7b2/0xbb0 [ 154.632244][ T5645] ? file_end_write+0x240/0x240 [ 154.637123][ T5645] ? do_raw_spin_unlock+0x13b/0x8b0 [ 154.642345][ T5645] ? lockdep_hardirqs_on+0x98/0x140 [ 154.647571][ T5645] ? __fdget_pos+0x265/0x2f0 [ 154.652180][ T5645] ksys_write+0x1a0/0x2c0 [ 154.656543][ T5645] ? __ia32_sys_read+0x90/0x90 [ 154.661347][ T5645] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 154.667368][ T5645] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 154.673399][ T5645] do_syscall_64+0x41/0xc0 [ 154.677852][ T5645] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 154.683776][ T5645] RIP: 0033:0x7fd49ce20129 [ 154.688216][ T5645] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 154.707840][ T5645] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 154.716272][ T5645] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [pid 5646] close(3) = 0 [pid 5646] close(4) = 0 [pid 5646] close(5) = 0 [pid 5646] close(6) = 0 [pid 5646] close(7) = -1 EBADF (Bad file descriptor) [pid 5646] close(8) = -1 EBADF (Bad file descriptor) [pid 5646] close(9) = -1 EBADF (Bad file descriptor) [pid 5646] close(10) = -1 EBADF (Bad file descriptor) [pid 5646] close(11) = -1 EBADF (Bad file descriptor) [pid 5646] close(12) = -1 EBADF (Bad file descriptor) [pid 5646] close(13) = -1 EBADF (Bad file descriptor) [pid 5646] close(14) = -1 EBADF (Bad file descriptor) [pid 5646] close(15) = -1 EBADF (Bad file descriptor) [pid 5646] close(16) = -1 EBADF (Bad file descriptor) [pid 5646] close(17) = -1 EBADF (Bad file descriptor) [pid 5646] close(18) = -1 EBADF (Bad file descriptor) [pid 5646] close(19) = -1 EBADF (Bad file descriptor) [pid 5646] close(20) = -1 EBADF (Bad file descriptor) [ 154.724259][ T5645] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 154.732263][ T5645] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 154.740264][ T5645] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 154.748259][ T5645] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 000000000000001a [ 154.756272][ T5645] [ 154.768517][ T5645] memory: usage 8kB, limit 0kB, failcnt 55 [pid 5646] close(21) = -1 EBADF (Bad file descriptor) [pid 5646] close(22) = -1 EBADF (Bad file descriptor) [pid 5646] close(23) = -1 EBADF (Bad file descriptor) [pid 5646] close(24) = -1 EBADF (Bad file descriptor) [pid 5646] close(25) = -1 EBADF (Bad file descriptor) [pid 5646] close(26) = -1 EBADF (Bad file descriptor) [pid 5646] close(27) = -1 EBADF (Bad file descriptor) [pid 5646] close(28) = -1 EBADF (Bad file descriptor) [pid 5646] close(29) = -1 EBADF (Bad file descriptor) [pid 5646] exit_group(0) = ? [pid 5646] +++ exited with 0 +++ [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=35, si_uid=0, si_status=0, si_utime=0, si_stime=6 /* 0.06 s */} --- [pid 5074] umount2("./33", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] openat(AT_FDCWD, "./33", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5074] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5074] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5074] umount2("./33/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./33/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5074] unlink("./33/binderfs") = 0 [pid 5074] umount2("./33/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./33/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5074] unlink("./33/cgroup") = 0 [pid 5074] umount2("./33/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./33/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5074] unlink("./33/cgroup.net") = 0 [ 154.776662][ T5645] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 154.784652][ T5645] Memory cgroup stats for /syz1: [ 154.784861][ T5645] anon 0 [ 154.784861][ T5645] file 0 [ 154.784861][ T5645] kernel 8192 [ 154.784861][ T5645] kernel_stack 0 [ 154.784861][ T5645] pagetables 0 [ 154.784861][ T5645] sec_pagetables 0 [ 154.784861][ T5645] percpu 0 [ 154.784861][ T5645] sock 0 [ 154.784861][ T5645] vmalloc 0 [ 154.784861][ T5645] shmem 0 [ 154.784861][ T5645] zswap 0 [ 154.784861][ T5645] zswapped 0 [ 154.784861][ T5645] file_mapped 0 [ 154.784861][ T5645] file_dirty 0 [ 154.784861][ T5645] file_writeback 0 [ 154.784861][ T5645] swapcached 0 [ 154.784861][ T5645] anon_thp 0 [ 154.784861][ T5645] file_thp 0 [ 154.784861][ T5645] shmem_thp 0 [ 154.784861][ T5645] inactive_anon 0 [ 154.784861][ T5645] active_anon 0 [ 154.784861][ T5645] inactive_file 0 [ 154.784861][ T5645] active_file 0 [ 154.784861][ T5645] unevictable 0 [ 154.784861][ T5645] slab_reclaimable 6752 [ 154.784861][ T5645] slab_unreclaimable 0 [ 154.784861][ T5645] slab 6752 [ 154.784861][ T5645] workingset_refault_anon 0 [pid 5074] umount2("./33/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5074] umount2("./33/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./33/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5074] umount2("./33/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] openat(AT_FDCWD, "./33/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5645] <... write resumed>) = 18 [pid 5074] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5074] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5074] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5074] close(4) = 0 [pid 5074] rmdir("./33/file0") = 0 [pid 5074] umount2("./33/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] lstat("./33/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5074] unlink("./33/cgroup.cpu") = 0 [pid 5074] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5074] close(3) = 0 [pid 5074] rmdir("./33") = 0 [pid 5074] mkdir("./34", 0777) = 0 [ 154.883298][ T5645] Tasks state (memory values in pages): [ 154.892325][ T5645] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 154.902941][ T5645] Out of memory and no killable processes... [ 154.909964][ T5648] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 154.921041][ T5648] CPU: 1 PID: 5648 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 154.931513][ T5648] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 154.941623][ T5648] Call Trace: [ 154.944942][ T5648] [ 154.947911][ T5648] dump_stack_lvl+0x1e7/0x2d0 [ 154.952645][ T5648] ? nf_tcp_handle_invalid+0x640/0x640 [ 154.958180][ T5648] ? panic+0x770/0x770 [ 154.962313][ T5648] dump_header+0xdc/0x940 [ 154.966703][ T5648] out_of_memory+0xf21/0x12c0 [ 154.971435][ T5648] ? mutex_lock_io_nested+0x60/0x60 [ 154.976714][ T5648] ? preempt_schedule+0xdd/0xf0 [ 154.981615][ T5648] ? unregister_oom_notifier+0x20/0x20 [ 154.987131][ T5648] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 154.993164][ T5648] mem_cgroup_out_of_memory+0x263/0x3b0 [ 154.998733][ T5648] ? preempt_schedule_thunk+0x1a/0x20 [ 155.004132][ T5648] ? mem_cgroup_oom_trylock+0x210/0x210 [ 155.009722][ T5648] ? cgroup_file_notify+0x127/0x190 [ 155.014947][ T5648] memory_max_write+0x355/0x470 [ 155.019822][ T5648] ? memory_max_show+0xa0/0xa0 [ 155.024612][ T5648] ? read_lock_is_recursive+0x20/0x20 [ 155.030005][ T5648] ? memory_max_show+0xa0/0xa0 [ 155.034785][ T5648] cgroup_file_write+0x2b1/0x780 [ 155.039755][ T5648] ? cgroup_seqfile_stop+0xd0/0xd0 [ 155.044891][ T5648] ? __virt_addr_valid+0x22f/0x2e0 [ 155.050043][ T5648] ? cgroup_seqfile_stop+0xd0/0xd0 [ 155.055164][ T5648] kernfs_fop_write_iter+0x3a6/0x4f0 [ 155.060474][ T5648] vfs_write+0x7b2/0xbb0 [ 155.064740][ T5648] ? file_end_write+0x240/0x240 [ 155.069609][ T5648] ? do_raw_spin_unlock+0x13b/0x8b0 [ 155.074824][ T5648] ? lockdep_hardirqs_on+0x98/0x140 [ 155.080055][ T5648] ? __fdget_pos+0x265/0x2f0 [ 155.084664][ T5648] ksys_write+0x1a0/0x2c0 [ 155.089030][ T5648] ? __ia32_sys_read+0x90/0x90 [ 155.093807][ T5648] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 155.099810][ T5648] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 155.105817][ T5648] do_syscall_64+0x41/0xc0 [ 155.110264][ T5648] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 155.116198][ T5648] RIP: 0033:0x7fd49ce20129 [ 155.120641][ T5648] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 155.140260][ T5648] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 155.148691][ T5648] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 155.156674][ T5648] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 155.164659][ T5648] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 155.172730][ T5648] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555574ac5d0) = 36 [pid 5645] close(3) = 0 [pid 5645] close(4) = 0 [pid 5645] close(5) = 0 [pid 5645] close(6) = 0 [pid 5645] close(7) = -1 EBADF (Bad file descriptor) [pid 5645] close(8) = -1 EBADF (Bad file descriptor) [pid 5645] close(9) = -1 EBADF (Bad file descriptor) [pid 5645] close(10) = -1 EBADF (Bad file descriptor) [pid 5645] close(11) = -1 EBADF (Bad file descriptor) [pid 5645] close(12) = -1 EBADF (Bad file descriptor) [pid 5645] close(13) = -1 EBADF (Bad file descriptor) [pid 5645] close(14) = -1 EBADF (Bad file descriptor) [pid 5645] close(15) = -1 EBADF (Bad file descriptor) [pid 5645] close(16) = -1 EBADF (Bad file descriptor) [pid 5645] close(17) = -1 EBADF (Bad file descriptor) [pid 5645] close(18) = -1 EBADF (Bad file descriptor) [pid 5645] close(19) = -1 EBADF (Bad file descriptor) [pid 5645] close(20) = -1 EBADF (Bad file descriptor) [pid 5645] close(21) = -1 EBADF (Bad file descriptor) [pid 5645] close(22) = -1 EBADF (Bad file descriptor) [pid 5645] close(23) = -1 EBADF (Bad file descriptor) [pid 5645] close(24) = -1 EBADF (Bad file descriptor) [pid 5645] close(25) = -1 EBADF (Bad file descriptor) [pid 5645] close(26) = -1 EBADF (Bad file descriptor) [pid 5645] close(27) = -1 EBADF (Bad file descriptor) [pid 5645] close(28) = -1 EBADF (Bad file descriptor) [pid 5645] close(29) = -1 EBADF (Bad file descriptor) [pid 5645] exit_group(0) = ? [pid 5645] +++ exited with 0 +++ [pid 5072] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=28, si_uid=0, si_status=0, si_utime=0, si_stime=7 /* 0.07 s */} --- [pid 5072] restart_syscall(<... resuming interrupted clone ...>./strace-static-x86_64: Process 5651 attached ) = 0 [pid 5072] umount2("./26", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] openat(AT_FDCWD, "./26", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5072] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5072] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5651] chdir("./34" [pid 5072] umount2("./26/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5651] <... chdir resumed>) = 0 [pid 5072] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./26/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5072] unlink("./26/binderfs") = 0 [pid 5651] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5072] umount2("./26/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./26/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5651] <... prctl resumed>) = 0 [ 155.180715][ T5648] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 0000000000000020 [ 155.188721][ T5648] [ 155.197150][ T5648] memory: usage 8kB, limit 0kB, failcnt 55 [ 155.203423][ T5648] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 155.213952][ T5648] Memory cgroup stats for /syz1: [ 155.216818][ T5648] anon 0 [ 155.216818][ T5648] file 0 [ 155.216818][ T5648] kernel 8192 [ 155.216818][ T5648] kernel_stack 0 [ 155.216818][ T5648] pagetables 0 [ 155.216818][ T5648] sec_pagetables 0 [ 155.216818][ T5648] percpu 0 [ 155.216818][ T5648] sock 0 [ 155.216818][ T5648] vmalloc 0 [ 155.216818][ T5648] shmem 0 [ 155.216818][ T5648] zswap 0 [ 155.216818][ T5648] zswapped 0 [ 155.216818][ T5648] file_mapped 0 [ 155.216818][ T5648] file_dirty 0 [ 155.216818][ T5648] file_writeback 0 [ 155.216818][ T5648] swapcached 0 [ 155.216818][ T5648] anon_thp 0 [ 155.216818][ T5648] file_thp 0 [ 155.216818][ T5648] shmem_thp 0 [ 155.216818][ T5648] inactive_anon 0 [pid 5072] unlink("./26/cgroup" [pid 5651] setpgid(0, 0 [pid 5072] <... unlink resumed>) = 0 [pid 5072] umount2("./26/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./26/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5072] unlink("./26/cgroup.net") = 0 [pid 5072] umount2("./26/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5651] <... setpgid resumed>) = 0 [pid 5651] symlink("/syzcgroup/unified/syz3", "./cgroup" [pid 5072] <... umount2 resumed>) = 0 [pid 5072] umount2("./26/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5651] <... symlink resumed>) = 0 [pid 5072] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5651] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu" [pid 5072] lstat("./26/file0", [pid 5651] <... symlink resumed>) = 0 [pid 5072] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5072] umount2("./26/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] openat(AT_FDCWD, "./26/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5072] fstat(4, [pid 5651] symlink("/syzcgroup/net/syz3", "./cgroup.net" [pid 5072] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5072] getdents64(4, [pid 5651] <... symlink resumed>) = 0 [pid 5072] <... getdents64 resumed>0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5072] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5072] close(4 [pid 5651] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5072] <... close resumed>) = 0 [pid 5651] <... openat resumed>) = 3 [pid 5072] rmdir("./26/file0" [pid 5651] write(3, "1000", 4 [pid 5072] <... rmdir resumed>) = 0 [pid 5072] umount2("./26/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5072] lstat("./26/cgroup.cpu", [pid 5651] <... write resumed>) = 4 [pid 5072] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5651] close(3 [pid 5072] unlink("./26/cgroup.cpu" [pid 5651] <... close resumed>) = 0 [pid 5072] <... unlink resumed>) = 0 [pid 5072] getdents64(3, [pid 5651] symlink("/dev/binderfs", "./binderfs" [pid 5072] <... getdents64 resumed>0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5072] close(3 [pid 5651] <... symlink resumed>) = 0 [pid 5072] <... close resumed>) = 0 [pid 5072] rmdir("./26" [pid 5651] mkdir("./file0", 000 [pid 5072] <... rmdir resumed>) = 0 [pid 5072] mkdir("./27", 0777 [pid 5651] <... mkdir resumed>) = 0 [pid 5072] <... mkdir resumed>) = 0 [pid 5072] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5651] open("./file0", O_RDONLY) = 3 ./strace-static-x86_64: Process 5652 attached [pid 5072] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 29 [pid 5652] chdir("./27" [pid 5651] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 5652] <... chdir resumed>) = 0 [pid 5652] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5651] <... mount resumed>) = 0 [pid 5652] <... prctl resumed>) = 0 [pid 5652] setpgid(0, 0) = 0 [pid 5651] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 5652] symlink("/syzcgroup/unified/syz5", "./cgroup" [pid 5651] <... openat resumed>) = 4 [pid 5652] <... symlink resumed>) = 0 [pid 5652] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu" [pid 5651] openat(4, "syz1", O_RDWR|O_PATH [pid 5652] <... symlink resumed>) = 0 [pid 5651] <... openat resumed>) = 5 [pid 5652] symlink("/syzcgroup/net/syz5", "./cgroup.net" [ 155.216818][ T5648] active_anon 0 [ 155.216818][ T5648] inactive_file 0 [ 155.216818][ T5648] active_file 0 [ 155.216818][ T5648] unevictable 0 [ 155.216818][ T5648] slab_reclaimable 6752 [ 155.216818][ T5648] slab_unreclaimable 0 [ 155.216818][ T5648] slab 6752 [ 155.216818][ T5648] workingset_refault_anon 0 [pid 5651] openat(5, "memory.max", O_RDWR) = 6 [pid 5651] write(6, "0x000000000000040e", 18 [pid 5652] <... symlink resumed>) = 0 [pid 5652] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5652] write(3, "1000", 4) = 4 [pid 5652] close(3) = 0 [pid 5652] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5652] mkdir("./file0", 000) = 0 [pid 5652] open("./file0", O_RDONLY) = 3 [pid 5652] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5652] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5652] openat(4, "syz1", O_RDWR|O_PATH) = 5 [pid 5652] openat(5, "memory.max", O_RDWR) = 6 [pid 5652] write(6, "0x000000000000040e", 18 [pid 5648] <... write resumed>) = 18 [ 155.351401][ T5648] Tasks state (memory values in pages): [ 155.373743][ T5648] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 155.384218][ T5648] Out of memory and no killable processes... [ 155.391114][ T5649] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 5648] close(3) = 0 [pid 5648] close(4) = 0 [pid 5648] close(5) = 0 [pid 5648] close(6) = 0 [pid 5648] close(7) = -1 EBADF (Bad file descriptor) [pid 5648] close(8) = -1 EBADF (Bad file descriptor) [pid 5648] close(9) = -1 EBADF (Bad file descriptor) [pid 5648] close(10) = -1 EBADF (Bad file descriptor) [pid 5648] close(11) = -1 EBADF (Bad file descriptor) [pid 5648] close(12) = -1 EBADF (Bad file descriptor) [pid 5648] close(13) = -1 EBADF (Bad file descriptor) [pid 5648] close(14) = -1 EBADF (Bad file descriptor) [pid 5648] close(15) = -1 EBADF (Bad file descriptor) [pid 5648] close(16) = -1 EBADF (Bad file descriptor) [pid 5648] close(17) = -1 EBADF (Bad file descriptor) [pid 5648] close(18) = -1 EBADF (Bad file descriptor) [pid 5648] close(19) = -1 EBADF (Bad file descriptor) [pid 5648] close(20) = -1 EBADF (Bad file descriptor) [pid 5648] close(21) = -1 EBADF (Bad file descriptor) [pid 5648] close(22) = -1 EBADF (Bad file descriptor) [pid 5648] close(23) = -1 EBADF (Bad file descriptor) [pid 5648] close(24) = -1 EBADF (Bad file descriptor) [pid 5648] close(25) = -1 EBADF (Bad file descriptor) [pid 5648] close(26) = -1 EBADF (Bad file descriptor) [pid 5648] close(27) = -1 EBADF (Bad file descriptor) [pid 5648] close(28) = -1 EBADF (Bad file descriptor) [pid 5648] close(29) = -1 EBADF (Bad file descriptor) [pid 5648] exit_group(0) = ? [pid 5648] +++ exited with 0 +++ [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=34, si_uid=0, si_status=0, si_utime=0, si_stime=9 /* 0.09 s */} --- [pid 5075] umount2("./32", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] openat(AT_FDCWD, "./32", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5075] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5075] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [pid 5075] umount2("./32/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./32/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5075] unlink("./32/binderfs") = 0 [pid 5075] umount2("./32/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./32/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5075] unlink("./32/cgroup") = 0 [pid 5075] umount2("./32/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./32/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5075] unlink("./32/cgroup.net") = 0 [ 155.402138][ T5649] CPU: 0 PID: 5649 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [ 155.412607][ T5649] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 155.422711][ T5649] Call Trace: [ 155.426030][ T5649] [ 155.428998][ T5649] dump_stack_lvl+0x1e7/0x2d0 [ 155.433747][ T5649] ? nf_tcp_handle_invalid+0x640/0x640 [ 155.439269][ T5649] ? panic+0x770/0x770 [ 155.443417][ T5649] dump_header+0xdc/0x940 [ 155.447806][ T5649] out_of_memory+0xf21/0x12c0 [ 155.452543][ T5649] ? mutex_lock_io_nested+0x60/0x60 [ 155.457823][ T5649] ? preempt_schedule+0xdd/0xf0 [ 155.462719][ T5649] ? unregister_oom_notifier+0x20/0x20 [ 155.468212][ T5649] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 155.474253][ T5649] mem_cgroup_out_of_memory+0x263/0x3b0 [ 155.479852][ T5649] ? preempt_schedule_thunk+0x1a/0x20 [ 155.485286][ T5649] ? mem_cgroup_oom_trylock+0x210/0x210 [ 155.490901][ T5649] ? cgroup_file_notify+0x127/0x190 [ 155.496167][ T5649] memory_max_write+0x355/0x470 [ 155.501082][ T5649] ? memory_max_show+0xa0/0xa0 [ 155.505889][ T5649] ? read_lock_is_recursive+0x20/0x20 [ 155.511310][ T5649] ? memory_max_show+0xa0/0xa0 [ 155.516154][ T5649] cgroup_file_write+0x2b1/0x780 [ 155.521157][ T5649] ? cgroup_seqfile_stop+0xd0/0xd0 [ 155.526303][ T5649] ? __virt_addr_valid+0x22f/0x2e0 [ 155.531445][ T5649] ? cgroup_seqfile_stop+0xd0/0xd0 [ 155.536582][ T5649] kernfs_fop_write_iter+0x3a6/0x4f0 [ 155.541919][ T5649] vfs_write+0x7b2/0xbb0 [ 155.546213][ T5649] ? file_end_write+0x240/0x240 [ 155.551099][ T5649] ? do_raw_spin_unlock+0x13b/0x8b0 [ 155.556354][ T5649] ? lockdep_hardirqs_on+0x98/0x140 [ 155.561707][ T5649] ? __fdget_pos+0x265/0x2f0 [ 155.566341][ T5649] ksys_write+0x1a0/0x2c0 [ 155.570715][ T5649] ? __ia32_sys_read+0x90/0x90 [ 155.575522][ T5649] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 155.581545][ T5649] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 155.587579][ T5649] do_syscall_64+0x41/0xc0 [ 155.592033][ T5649] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 155.597982][ T5649] RIP: 0033:0x7fd49ce20129 [ 155.602428][ T5649] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 155.622064][ T5649] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 155.630521][ T5649] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 155.638518][ T5649] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [pid 5075] umount2("./32/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5075] umount2("./32/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./32/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5075] umount2("./32/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] openat(AT_FDCWD, "./32/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5075] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5075] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5075] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5075] close(4) = 0 [pid 5075] rmdir("./32/file0") = 0 [pid 5075] umount2("./32/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] lstat("./32/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5075] unlink("./32/cgroup.cpu") = 0 [ 155.646524][ T5649] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 155.654532][ T5649] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [ 155.662546][ T5649] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 000000000000001d [ 155.670574][ T5649] [ 155.682164][ T5649] memory: usage 8kB, limit 0kB, failcnt 55 [ 155.695891][ T5649] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [pid 5075] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5075] close(3) = 0 [pid 5075] rmdir("./32") = 0 [pid 5075] mkdir("./33", 0777) = 0 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5654 attached [pid 5654] chdir("./33" [pid 5075] <... clone resumed>, child_tidptr=0x5555574ac5d0) = 35 [pid 5654] <... chdir resumed>) = 0 [pid 5654] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5654] setpgid(0, 0) = 0 [pid 5654] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 5654] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 5654] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 5654] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5654] write(3, "1000", 4) = 4 [pid 5654] close(3) = 0 [pid 5654] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5654] mkdir("./file0", 000) = 0 [pid 5654] open("./file0", O_RDONLY) = 3 [pid 5654] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 5654] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 5654] openat(4, "syz1", O_RDWR|O_PATH) = 5 [ 155.703609][ T5649] Memory cgroup stats for /syz1: [ 155.703990][ T5649] anon 0 [ 155.703990][ T5649] file 0 [ 155.703990][ T5649] kernel 8192 [ 155.703990][ T5649] kernel_stack 0 [ 155.703990][ T5649] pagetables 0 [ 155.703990][ T5649] sec_pagetables 0 [ 155.703990][ T5649] percpu 0 [ 155.703990][ T5649] sock 0 [ 155.703990][ T5649] vmalloc 0 [ 155.703990][ T5649] shmem 0 [ 155.703990][ T5649] zswap 0 [ 155.703990][ T5649] zswapped 0 [ 155.703990][ T5649] file_mapped 0 [ 155.703990][ T5649] file_dirty 0 [pid 5654] openat(5, "memory.max", O_RDWR) = 6 [ 155.703990][ T5649] file_writeback 0 [ 155.703990][ T5649] swapcached 0 [ 155.703990][ T5649] anon_thp 0 [ 155.703990][ T5649] file_thp 0 [ 155.703990][ T5649] shmem_thp 0 [ 155.703990][ T5649] inactive_anon 0 [ 155.703990][ T5649] active_anon 0 [ 155.703990][ T5649] inactive_file 0 [ 155.703990][ T5649] active_file 0 [ 155.703990][ T5649] unevictable 0 [ 155.703990][ T5649] slab_reclaimable 6752 [ 155.703990][ T5649] slab_unreclaimable 0 [ 155.703990][ T5649] slab 6752 [ 155.703990][ T5649] workingset_refault_anon 0 [pid 5654] write(6, "0x000000000000040e", 18 [pid 5649] <... write resumed>) = 18 [pid 5649] close(3) = 0 [ 155.826678][ T5649] Tasks state (memory values in pages): [ 155.832446][ T5649] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 155.842451][ T5649] Out of memory and no killable processes... [ 155.848869][ T5650] syz-executor131 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 155.860157][ T5650] CPU: 1 PID: 5650 Comm: syz-executor131 Not tainted 6.2.0-rc8-syzkaller-00021-ge1c04510f521 #0 [pid 5649] close(4) = 0 [pid 5649] close(5) = 0 [pid 5649] close(6) = 0 [pid 5649] close(7) = -1 EBADF (Bad file descriptor) [pid 5649] close(8) = -1 EBADF (Bad file descriptor) [pid 5649] close(9) = -1 EBADF (Bad file descriptor) [pid 5649] close(10) = -1 EBADF (Bad file descriptor) [pid 5649] close(11) = -1 EBADF (Bad file descriptor) [pid 5649] close(12) = -1 EBADF (Bad file descriptor) [pid 5649] close(13) = -1 EBADF (Bad file descriptor) [pid 5649] close(14) = -1 EBADF (Bad file descriptor) [pid 5649] close(15) = -1 EBADF (Bad file descriptor) [pid 5649] close(16) = -1 EBADF (Bad file descriptor) [pid 5649] close(17) = -1 EBADF (Bad file descriptor) [pid 5649] close(18) = -1 EBADF (Bad file descriptor) [pid 5649] close(19) = -1 EBADF (Bad file descriptor) [pid 5649] close(20) = -1 EBADF (Bad file descriptor) [pid 5649] close(21) = -1 EBADF (Bad file descriptor) [pid 5649] close(22) = -1 EBADF (Bad file descriptor) [pid 5649] close(23) = -1 EBADF (Bad file descriptor) [pid 5649] close(24) = -1 EBADF (Bad file descriptor) [pid 5649] close(25) = -1 EBADF (Bad file descriptor) [pid 5649] close(26) = -1 EBADF (Bad file descriptor) [pid 5649] close(27) = -1 EBADF (Bad file descriptor) [pid 5649] close(28) = -1 EBADF (Bad file descriptor) [pid 5649] close(29) = -1 EBADF (Bad file descriptor) [pid 5649] exit_group(0) = ? [pid 5649] +++ exited with 0 +++ [pid 5073] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=31, si_uid=0, si_status=0, si_utime=0, si_stime=10 /* 0.10 s */} --- [pid 5073] umount2("./29", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] openat(AT_FDCWD, "./29", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5073] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5073] getdents64(3, 0x5555574ad620 /* 7 entries */, 32768) = 208 [ 155.870632][ T5650] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 155.880729][ T5650] Call Trace: [ 155.884047][ T5650] [ 155.887023][ T5650] dump_stack_lvl+0x1e7/0x2d0 [ 155.891871][ T5650] ? nf_tcp_handle_invalid+0x640/0x640 [ 155.897383][ T5650] ? panic+0x770/0x770 [ 155.901516][ T5650] dump_header+0xdc/0x940 [ 155.905900][ T5650] out_of_memory+0xf21/0x12c0 [ 155.910713][ T5650] ? mutex_lock_io_nested+0x60/0x60 [ 155.916008][ T5650] ? preempt_schedule+0xdd/0xf0 [ 155.920917][ T5650] ? unregister_oom_notifier+0x20/0x20 [pid 5073] umount2("./29/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./29/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5073] unlink("./29/binderfs") = 0 [pid 5073] umount2("./29/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./29/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5073] unlink("./29/cgroup") = 0 [pid 5073] umount2("./29/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./29/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5073] unlink("./29/cgroup.net") = 0 [ 155.926430][ T5650] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 155.932481][ T5650] mem_cgroup_out_of_memory+0x263/0x3b0 [ 155.938102][ T5650] ? preempt_schedule_thunk+0x1a/0x20 [ 155.943546][ T5650] ? mem_cgroup_oom_trylock+0x210/0x210 [ 155.949189][ T5650] ? cgroup_file_notify+0x127/0x190 [ 155.954443][ T5650] memory_max_write+0x355/0x470 [ 155.959342][ T5650] ? memory_max_show+0xa0/0xa0 [ 155.964160][ T5650] ? read_lock_is_recursive+0x20/0x20 [ 155.969589][ T5650] ? memory_max_show+0xa0/0xa0 [ 155.974404][ T5650] cgroup_file_write+0x2b1/0x780 [ 155.979394][ T5650] ? cgroup_seqfile_stop+0xd0/0xd0 [ 155.984555][ T5650] ? __virt_addr_valid+0x22f/0x2e0 [ 155.989750][ T5650] ? cgroup_seqfile_stop+0xd0/0xd0 [ 155.994899][ T5650] kernfs_fop_write_iter+0x3a6/0x4f0 [ 156.000230][ T5650] vfs_write+0x7b2/0xbb0 [ 156.004636][ T5650] ? file_end_write+0x240/0x240 [ 156.009511][ T5650] ? do_raw_spin_unlock+0x13b/0x8b0 [ 156.014730][ T5650] ? lockdep_hardirqs_on+0x98/0x140 [ 156.019965][ T5650] ? __fdget_pos+0x265/0x2f0 [ 156.024605][ T5650] ksys_write+0x1a0/0x2c0 [ 156.028989][ T5650] ? __ia32_sys_read+0x90/0x90 [ 156.033801][ T5650] ? syscall_enter_from_user_mode+0x32/0x2c0 [ 156.039839][ T5650] ? syscall_enter_from_user_mode+0x8c/0x2c0 [ 156.045876][ T5650] do_syscall_64+0x41/0xc0 [ 156.050333][ T5650] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 156.056267][ T5650] RIP: 0033:0x7fd49ce20129 [ 156.060722][ T5650] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 156.080372][ T5650] RSP: 002b:00007ffd221823f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 156.088837][ T5650] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd49ce20129 [ 156.096867][ T5650] RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000006 [ 156.104878][ T5650] RBP: 0000000000000000 R08: 0000000000000012 R09: 00007ffd22182420 [ 156.112897][ T5650] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd2218241c [pid 5073] umount2("./29/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 5073] umount2("./29/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./29/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5073] umount2("./29/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] openat(AT_FDCWD, "./29/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5073] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 5073] getdents64(4, 0x5555574b5660 /* 2 entries */, 32768) = 48 [pid 5073] getdents64(4, 0x5555574b5660 /* 0 entries */, 32768) = 0 [pid 5073] close(4) = 0 [pid 5073] rmdir("./29/file0") = 0 [pid 5073] umount2("./29/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5073] lstat("./29/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5073] unlink("./29/cgroup.cpu") = 0 [pid 5073] getdents64(3, 0x5555574ad620 /* 0 entries */, 32768) = 0 [pid 5073] close(3) = 0 [pid 5073] rmdir("./29") = 0 [pid 5073] mkdir("./30", 0777) = 0 [ 156.120921][ T5650] R13: 00007ffd22182430 R14: 00007ffd22182470 R15: 000000000000001a [ 156.128969][ T5650] [ 156.141829][ T5650] memory: usage 8kB, limit 0kB, failcnt 55 [ 156.148201][ T5650] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 156.155478][ T5650] Memory cgroup stats for /syz1: [ 156.155681][ T5650] anon 0 [ 156.155681][ T5650] file 0 [ 156.155681][ T5650] kernel 8192 [ 156.155681][ T5650] kernel_stack 0 [ 156.155681][ T5650] pagetables 0 [pid 5073] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555574ac5d0) = 32 [ 156.155681][ T5650] sec_pagetables 0 [ 156.155681][ T5650] percpu 0 [ 156.155681][ T5650] sock 0 [ 156.155681][ T5650] vmalloc 0 [ 156.155681][ T5650] shmem 0 [ 156.155681][ T5650] zswap 0 [ 156.155681][ T5650] zswapped 0 [ 156.155681][ T5650] file_mapped 0 [ 156.155681][ T5650] file_dirty 0 [ 156.155681][ T5650] file_writeback 0 [ 156.155681][ T5650] swapcached 0 [ 156.155681][ T5650] anon_thp 0 [ 156.155681][ T5650] file_thp 0 [ 156.155681][ T5650] shmem_thp 0 [ 156.155681][ T5650] inactive_anon 0 [ 156.155681][ T5650] active_anon 0 ./strace-static-x86_64: Process 5655 attached [pid 5655] chdir("./30") = 0 [pid 5655] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5655] setpgid(0, 0) = 0 [pid 5655] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 5655] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 5655] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [pid 5655] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5655] write(3, "1000", 4) = 4 [pid 5655] close(3) = 0 [pid 5655] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5655] mkdir("./file0", 000) = 0 [pid 5655] open("./file0", O_RDONLY) = 3 [pid 5655] mount(NULL, "./file0", "cgroup2", 0, NULL) =