./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3386864445

<...>
Warning: Permanently added '10.128.0.3' (ED25519) to the list of known hosts.
execve("./syz-executor3386864445", ["./syz-executor3386864445"], 0x7ffca73498b0 /* 10 vars */) = 0
brk(NULL)                               = 0x5555570c7000
brk(0x5555570c7d40)                     = 0x5555570c7d40
arch_prctl(ARCH_SET_FS, 0x5555570c73c0) = 0
set_tid_address(0x5555570c7690)         = 292
set_robust_list(0x5555570c76a0, 24)     = 0
rseq(0x5555570c7ce0, 0x20, 0, 0x53053053) = -1 ENOSYS (Function not implemented)
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor3386864445", 4096) = 28
getrandom("\xc8\x40\x21\x9f\x8f\xbb\xa2\x9b", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x5555570c7d40
brk(0x5555570e8d40)                     = 0x5555570e8d40
brk(0x5555570e9000)                     = 0x5555570e9000
mprotect(0x7ff6e0bc5000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
openat(AT_FDCWD, "/sys/kernel/debug/failslab/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_futex/ignore-private", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-highmem", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/min-order", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1)                        = 1
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555570c7690) = 293
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555570c7690) = 294
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555570c7690) = 295
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555570c7690) = 296
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555570c7690) = 297
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555570c7690) = 298
./strace-static-x86_64: Process 298 attached
./strace-static-x86_64: Process 293 attached
[pid   298] set_robust_list(0x5555570c76a0, 24 <unfinished ...>
[pid   293] set_robust_list(0x5555570c76a0, 24 <unfinished ...>
[pid   298] <... set_robust_list resumed>) = 0
[pid   293] <... set_robust_list resumed>) = 0
[pid   298] unshare(CLONE_NEWPID <unfinished ...>
[pid   293] unshare(CLONE_NEWPID <unfinished ...>
[pid   298] <... unshare resumed>)      = 0
[pid   293] <... unshare resumed>)      = 0
[pid   293] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid   298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid   293] <... clone resumed>, child_tidptr=0x5555570c7690) = 299
[pid   298] <... clone resumed>, child_tidptr=0x5555570c7690) = 300
./strace-static-x86_64: Process 299 attached
[pid   299] set_robust_list(0x5555570c76a0, 24) = 0
[pid   299] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy)
[pid   299] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   299] setsid()                    = 1
[pid   299] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0
[pid   299] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0
[pid   299] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0
[pid   299] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0
[pid   299] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0
[pid   299] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0
[pid   299] unshare(CLONE_NEWNS)        = 0
./strace-static-x86_64: Process 300 attached
[pid   300] set_robust_list(0x5555570c76a0, 24) = 0
[pid   300] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy)
[pid   300] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   300] setsid( <unfinished ...>
[pid   299] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0
[pid   300] <... setsid resumed>)       = 1
[pid   300] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0
[pid   300] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0
[pid   300] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0
[pid   300] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0
[pid   300] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0
[pid   299] unshare(CLONE_NEWIPC <unfinished ...>
[pid   300] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256},  <unfinished ...>
[pid   299] <... unshare resumed>)      = -1 EINVAL (Invalid argument)
[pid   300] <... prlimit64 resumed>NULL) = 0
[pid   300] unshare(CLONE_NEWNS)        = 0
[pid   299] unshare(CLONE_NEWCGROUP)    = 0
[pid   299] unshare(CLONE_NEWUTS)       = 0
[pid   299] unshare(CLONE_SYSVSEM)      = 0
[pid   299] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   299] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   299] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC./strace-static-x86_64: Process 297 attached
./strace-static-x86_64: Process 296 attached
./strace-static-x86_64: Process 295 attached
./strace-static-x86_64: Process 294 attached
) = -1 ENOENT (No such file or directory)
[pid   295] set_robust_list(0x5555570c76a0, 24 <unfinished ...>
[pid   294] set_robust_list(0x5555570c76a0, 24 <unfinished ...>
[pid   296] set_robust_list(0x5555570c76a0, 24 <unfinished ...>
[pid   297] set_robust_list(0x5555570c76a0, 24 <unfinished ...>
[pid   300] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0
[pid   294] <... set_robust_list resumed>) = 0
[pid   295] <... set_robust_list resumed>) = 0
[pid   297] <... set_robust_list resumed>) = 0
[pid   296] <... set_robust_list resumed>) = 0
[pid   299] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   294] unshare(CLONE_NEWPID <unfinished ...>
[pid   295] unshare(CLONE_NEWPID <unfinished ...>
[pid   297] unshare(CLONE_NEWPID <unfinished ...>
[pid   296] unshare(CLONE_NEWPID <unfinished ...>
[pid   300] unshare(CLONE_NEWIPC <unfinished ...>
[pid   299] <... openat resumed>)       = -1 ENOENT (No such file or directory)
[pid   300] <... unshare resumed>)      = -1 EINVAL (Invalid argument)
[pid   300] unshare(CLONE_NEWCGROUP)    = 0
[pid   300] unshare(CLONE_NEWUTS)       = 0
[pid   299] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   297] <... unshare resumed>)      = 0
[pid   295] <... unshare resumed>)      = 0
[pid   296] <... unshare resumed>)      = 0
[pid   299] <... openat resumed>)       = -1 ENOENT (No such file or directory)
[pid   300] unshare(CLONE_SYSVSEM <unfinished ...>
[pid   294] <... unshare resumed>)      = 0
[pid   295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid   297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid   296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid   300] <... unshare resumed>)      = 0
[pid   300] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid   300] <... openat resumed>)       = -1 ENOENT (No such file or directory)
[pid   299] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   300] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   299] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   300] <... openat resumed>)       = -1 ENOENT (No such file or directory)
[pid   299] <... openat resumed>)       = -1 ENOENT (No such file or directory)
[pid   300] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   299] getpid()                    = 1
[pid   299] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid   300] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   299] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0} <unfinished ...>
[pid   300] <... openat resumed>)       = -1 ENOENT (No such file or directory)
[pid   299] <... capset resumed>)       = 0
[pid   299] unshare(CLONE_NEWNET./strace-static-x86_64: Process 301 attached
./strace-static-x86_64: Process 302 attached
 <unfinished ...>
[pid   300] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC./strace-static-x86_64: Process 304 attached
./strace-static-x86_64: Process 303 attached
 <unfinished ...>
[pid   302] set_robust_list(0x5555570c76a0, 24 <unfinished ...>
[pid   301] set_robust_list(0x5555570c76a0, 24 <unfinished ...>
[pid   304] set_robust_list(0x5555570c76a0, 24 <unfinished ...>
[pid   295] <... clone resumed>, child_tidptr=0x5555570c7690) = 302
[pid   304] <... set_robust_list resumed>) = 0
[pid   303] set_robust_list(0x5555570c76a0, 24 <unfinished ...>
[pid   302] <... set_robust_list resumed>) = 0
[pid   301] <... set_robust_list resumed>) = 0
[pid   297] <... clone resumed>, child_tidptr=0x5555570c7690) = 303
[pid   300] <... openat resumed>)       = -1 ENOENT (No such file or directory)
[pid   294] <... clone resumed>, child_tidptr=0x5555570c7690) = 304
[pid   296] <... clone resumed>, child_tidptr=0x5555570c7690) = 301
[pid   300] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   300] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   300] getpid()                    = 1
[pid   300] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid   300] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[   21.742591][   T30] audit: type=1400 audit(1689338761.359:66): avc:  denied  { execmem } for  pid=292 comm="syz-executor338" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   21.750036][   T30] audit: type=1400 audit(1689338761.359:67): avc:  denied  { integrity } for  pid=292 comm="syz-executor338" lockdown_reason="debugfs access" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=lockdown permissive=1
[   21.759164][   T30] audit: type=1400 audit(1689338761.359:68): avc:  denied  { mounton } for  pid=299 comm="syz-executor338" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1
[pid   300] unshare(CLONE_NEWNET <unfinished ...>
[pid   304] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL <unfinished ...>
[pid   303] <... set_robust_list resumed>) = 0
[pid   302] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL <unfinished ...>
[pid   301] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL <unfinished ...>
[pid   303] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL <unfinished ...>
[pid   304] <... mount resumed>)        = -1 EBUSY (Device or resource busy)
[pid   301] <... mount resumed>)        = -1 EBUSY (Device or resource busy)
[pid   304] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid   303] <... mount resumed>)        = -1 EBUSY (Device or resource busy)
[pid   302] <... mount resumed>)        = -1 EBUSY (Device or resource busy)
[pid   301] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid   299] <... unshare resumed>)      = 0
[pid   299] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC) = 3
[pid   299] write(3, "0 65535", 7)      = 7
[pid   299] close(3)                    = 0
[pid   299] openat(AT_FDCWD, "/dev/net/tun", O_RDWR|O_NONBLOCK) = 3
[pid   299] dup2(3, 200)                = 200
[pid   299] close(3)                    = 0
[pid   299] ioctl(200, TUNSETIFF, 0x7ffd00327930) = 0
[pid   299] openat(AT_FDCWD, "/proc/sys/net/ipv6/conf/syz_tun/accept_dad", O_WRONLY|O_CLOEXEC) = 3
[pid   299] write(3, "0", 1)            = 1
[pid   299] close(3)                    = 0
[pid   299] openat(AT_FDCWD, "/proc/sys/net/ipv6/conf/syz_tun/router_solicitations", O_WRONLY|O_CLOEXEC) = 3
[pid   299] write(3, "0", 1)            = 1
[pid   299] close(3)                    = 0
[pid   299] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3
[pid   299] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid   299] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun", ifr_ifindex=11}) = 0
[pid   299] close(4)                    = 0
[pid   299] sendto(3, [{nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x18\x00\x00\x0b\x00\x00\x00\x08\x00\x02\x00\xac\x14\x14\xaa\x08\x00\x01\x00\xac\x14\x14\xaa"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 40
[pid   299] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   299] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid   299] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun", ifr_ifindex=11}) = 0
[pid   299] close(4)                    = 0
[pid   299] sendto(3, [{nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x78\x00\x00\x0b\x00\x00\x00\x14\x00\x02\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa"], 64, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 64
[pid   299] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   299] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid   299] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun", ifr_ifindex=11}) = 0
[pid   299] close(4)                    = 0
[pid   299] sendto(3, [{nlmsg_len=48, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x00\x00\x00\x0b\x00\x00\x00\x80\x00\x00\x00\x08\x00\x01\x00\xac\x14\x14\xbb\x0a\x00\x02\x00\xbb\xaa\xaa\xaa\xaa\xaa\x00\x00"], 48, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid   304] <... prctl resumed>)        = 0
[pid   303] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid   302] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid   301] <... prctl resumed>)        = 0
[pid   301] setsid( <unfinished ...>
[pid   304] setsid( <unfinished ...>
[pid   303] <... prctl resumed>)        = 0
[pid   302] <... prctl resumed>)        = 0
[pid   299] <... sendto resumed>)       = 48
[pid   299] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=48, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   299] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid   299] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun", ifr_ifindex=11}) = 0
[pid   299] close(4)                    = 0
[pid   299] sendto(3, [{nlmsg_len=60, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x00\x00\x00\x0b\x00\x00\x00\x80\x00\x00\x00\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbb\x0a\x00\x02\x00\xbb\xaa\xaa\xaa\xaa\xaa\x00\x00"], 60, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 60
[pid   299] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=60, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   299] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid   299] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun", ifr_ifindex=11}) = 0
[pid   299] close(4)                    = 0
[pid   299] sendto(3, [{nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0b\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x0a\x00\x01\x00\xaa\xaa\xaa\xaa\xaa\xaa\x00\x00"], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid   304] <... setsid resumed>)       = 1
[pid   303] setsid( <unfinished ...>
[pid   302] setsid( <unfinished ...>
[pid   301] <... setsid resumed>)       = 1
[pid   300] <... unshare resumed>)      = 0
[pid   299] <... sendto resumed>)       = 44
[pid   299] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   299] close(3)                    = 0
[pid   299] mkdir("/dev/binderfs", 0777) = 0
[pid   299] mount("binder", "/dev/binderfs", "binder", 0, NULL) = 0
[pid   299] symlink("/dev/binderfs", "./binderfs") = 0
[pid   299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555570c7690) = 2
./strace-static-x86_64: Process 306 attached
[pid   306] set_robust_list(0x5555570c76a0, 24) = 0
[pid   306] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   306] setpgid(0, 0)               = 0
[pid   306] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   306] write(3, "1000", 4)         = 4
[pid   306] close(3)                    = 0
[   21.777871][   T30] audit: type=1400 audit(1689338761.359:69): avc:  denied  { mount } for  pid=299 comm="syz-executor338" name="/" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1
[   21.801828][   T30] audit: type=1400 audit(1689338761.359:70): avc:  denied  { mounton } for  pid=299 comm="syz-executor338" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1
[pid   306] read(200, 0x7ffd00327490, 1000) = -1 EAGAIN (Resource temporarily unavailable)
[pid   306] futex(0x7ff6e0bcb3cc, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid   306] rt_sigaction(SIGRT_1, {sa_handler=0x7ff6e0b68fa0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7ff6e0b5a620}, NULL, 8) = 0
[pid   306] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
[pid   306] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7ff6e0ae1000
[pid   306] mprotect(0x7ff6e0ae2000, 131072, PROT_READ|PROT_WRITE) = 0
[pid   306] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid   306] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7ff6e0b01990, parent_tid=0x7ff6e0b01990, exit_signal=0, stack=0x7ff6e0ae1000, stack_size=0x20300, tls=0x7ff6e0b016c0} => {parent_tid=[3]}, 88) = 3
[pid   306] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid   306] futex(0x7ff6e0bcb3c8, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid   306] futex(0x7ff6e0bcb3cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 307 attached
 <unfinished ...>
[pid   307] set_robust_list(0x7ff6e0b019a0, 24) = 0
[pid   307] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid   307] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 3
[pid   307] write(3, "73", 2)           = 2
[pid   307] clone(child_stack=NULL, flags=CLONE_NEWUSER|CLONE_NEWPID <unfinished ...>
[pid   304] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024},  <unfinished ...>
[pid   303] <... setsid resumed>)       = 1
[pid   302] <... setsid resumed>)       = 1
[pid   301] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024},  <unfinished ...>
[pid   300] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   302] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024},  <unfinished ...>
[pid   301] <... prlimit64 resumed>NULL) = 0
[pid   304] <... prlimit64 resumed>NULL) = 0
[pid   303] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024},  <unfinished ...>
[pid   304] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024},  <unfinished ...>
[pid   303] <... prlimit64 resumed>NULL) = 0
[pid   302] <... prlimit64 resumed>NULL) = 0
[pid   301] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024},  <unfinished ...>
[pid   300] <... openat resumed>)       = 3
[   21.830750][   T30] audit: type=1400 audit(1689338761.419:71): avc:  denied  { create } for  pid=289 comm="strace-static-x" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_tcpdiag_socket permissive=1
[   21.851740][   T30] audit: type=1400 audit(1689338761.419:72): avc:  denied  { write } for  pid=289 comm="strace-static-x" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_tcpdiag_socket permissive=1
[   21.852247][  T307] FAULT_INJECTION: forcing a failure.
[   21.852247][  T307] name failslab, interval 1, probability 0, space 0, times 1
[pid   304] <... prlimit64 resumed>NULL) = 0
[pid   303] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024},  <unfinished ...>
[pid   302] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024},  <unfinished ...>
[pid   301] <... prlimit64 resumed>NULL) = 0
[pid   300] write(3, "0 65535", 7 <unfinished ...>
[pid   306] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid   304] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024},  <unfinished ...>
[pid   303] <... prlimit64 resumed>NULL) = 0
[pid   302] <... prlimit64 resumed>NULL) = 0
[pid   301] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024},  <unfinished ...>
[pid   300] <... write resumed>)        = 7
[pid   304] <... prlimit64 resumed>NULL) = 0
[pid   303] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024},  <unfinished ...>
[pid   302] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024},  <unfinished ...>
[pid   301] <... prlimit64 resumed>NULL) = 0
[   21.872359][   T30] audit: type=1400 audit(1689338761.419:73): avc:  denied  { nlmsg_read } for  pid=289 comm="strace-static-x" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_tcpdiag_socket permissive=1
[   21.905357][   T30] audit: type=1400 audit(1689338761.419:74): avc:  denied  { module_request } for  pid=289 comm="strace-static-x" kmod="net-pf-16-proto-4-type-16" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1
[   21.928594][   T30] audit: type=1400 audit(1689338761.419:75): avc:  denied  { read } for  pid=289 comm="strace-static-x" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_tcpdiag_socket permissive=1
[   21.929192][  T307] CPU: 0 PID: 307 Comm: syz-executor338 Not tainted 5.15.119-syzkaller-android13-5.15.119_r00 #0
[   21.959135][  T307] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023
[   21.969032][  T307] Call Trace:
[   21.972153][  T307]  <TASK>
[   21.974944][  T307]  dump_stack_lvl+0x151/0x1b7
[   21.979445][  T307]  ? io_uring_drop_tctx_refs+0x190/0x190
[   21.984915][  T307]  ? irqentry_exit_cond_resched+0x2a/0x30
[   21.990555][  T307]  dump_stack+0x15/0x17
[   21.994553][  T307]  should_fail+0x3c6/0x510
[   21.998803][  T307]  __should_failslab+0xa4/0xe0
[   22.003397][  T307]  ? anon_vma_fork+0xf7/0x4e0
[   22.007914][  T307]  should_failslab+0x9/0x20
[   22.012251][  T307]  slab_pre_alloc_hook+0x37/0xd0
[   22.017026][  T307]  ? anon_vma_fork+0xf7/0x4e0
[   22.021537][  T307]  kmem_cache_alloc+0x44/0x200
[   22.026141][  T307]  anon_vma_fork+0xf7/0x4e0
[   22.030475][  T307]  ? anon_vma_name+0x43/0x70
[   22.034905][  T307]  ? vm_area_dup+0x17a/0x230
[   22.039337][  T307]  dup_mm+0x8c5/0x12c0
[   22.043239][  T307]  ? copy_init_mm+0x20/0x20
[   22.047578][  T307]  copy_mm+0x107/0x1b0
[   22.051486][  T307]  copy_process+0x12bc/0x3260
[   22.056007][  T307]  ? pidfd_show_fdinfo+0x2b0/0x2b0
[   22.060946][  T307]  ? __kasan_check_write+0x14/0x20
[   22.065897][  T307]  kernel_clone+0x21e/0x9e0
[   22.070234][  T307]  ? _raw_spin_unlock_irq+0x4e/0x70
[   22.075269][  T307]  ? create_io_thread+0x1e0/0x1e0
[   22.080136][  T307]  __x64_sys_clone+0x23f/0x290
[   22.084723][  T307]  ? __do_sys_vfork+0x130/0x130
[   22.089411][  T307]  ? __kasan_check_read+0x11/0x20
[   22.094269][  T307]  ? syscall_enter_from_user_mode+0x70/0x1b0
[   22.100084][  T307]  do_syscall_64+0x3d/0xb0
[   22.104339][  T307]  entry_SYSCALL_64_after_hwframe+0x61/0xcb
[   22.110066][  T307] RIP: 0033:0x7ff6e0b41399
[   22.114319][  T307] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
[   22.133846][  T307] RSP: 002b:00007ff6e0b01208 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
[pid   300] close(3 <unfinished ...>
[pid   304] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024},  <unfinished ...>
[pid   303] <... prlimit64 resumed>NULL) = 0
[pid   302] <... prlimit64 resumed>NULL) = 0
[pid   301] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024},  <unfinished ...>
[pid   300] <... close resumed>)        = 0
[pid   304] <... prlimit64 resumed>NULL) = 0
[pid   303] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024},  <unfinished ...>
[pid   302] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024},  <unfinished ...>
[pid   301] <... prlimit64 resumed>NULL) = 0
[pid   300] openat(AT_FDCWD, "/dev/net/tun", O_RDWR|O_NONBLOCK <unfinished ...>
[pid   307] <... clone resumed>)        = -1 ENOMEM (Cannot allocate memory)
[pid   304] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024},  <unfinished ...>
[pid   303] <... prlimit64 resumed>NULL) = 0
[pid   307] futex(0x7ff6e0bcb3cc, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid   304] <... prlimit64 resumed>NULL) = 0
[pid   303] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024},  <unfinished ...>
[pid   302] <... prlimit64 resumed>NULL) = 0
[pid   301] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024},  <unfinished ...>
[pid   300] <... openat resumed>)       = 3
[pid   304] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256},  <unfinished ...>
[pid   303] <... prlimit64 resumed>NULL) = 0
[pid   302] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024},  <unfinished ...>
[pid   301] <... prlimit64 resumed>NULL) = 0
[pid   300] dup2(3, 200 <unfinished ...>
[pid   304] <... prlimit64 resumed>NULL) = 0
[pid   303] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256},  <unfinished ...>
[pid   302] <... prlimit64 resumed>NULL) = 0
[pid   301] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256},  <unfinished ...>
[pid   300] <... dup2 resumed>)         = 200
[pid   304] unshare(CLONE_NEWNS <unfinished ...>
[pid   303] <... prlimit64 resumed>NULL) = 0
[pid   302] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256},  <unfinished ...>
[pid   301] <... prlimit64 resumed>NULL) = 0
[pid   300] close(3 <unfinished ...>
[pid   307] <... futex resumed>)        = 0
[pid   303] unshare(CLONE_NEWNS <unfinished ...>
[pid   302] <... prlimit64 resumed>NULL) = 0
[pid   301] unshare(CLONE_NEWNS <unfinished ...>
[pid   300] <... close resumed>)        = 0
[pid   304] <... unshare resumed>)      = 0
[pid   307] futex(0x7ff6e0bcb3c8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid   306] close(3 <unfinished ...>
[pid   304] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid   302] unshare(CLONE_NEWNS <unfinished ...>
[pid   301] <... unshare resumed>)      = 0
[pid   300] ioctl(200, TUNSETIFF, 0x7ffd00327930 <unfinished ...>
[pid   306] <... close resumed>)        = 0
[pid   304] <... mount resumed>)        = 0
[pid   303] <... unshare resumed>)      = 0
[pid   302] <... unshare resumed>)      = 0
[pid   301] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid   306] close(4 <unfinished ...>
[pid   304] unshare(CLONE_NEWIPC <unfinished ...>
[pid   303] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid   302] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid   301] <... mount resumed>)        = 0
[pid   306] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   304] <... unshare resumed>)      = -1 EINVAL (Invalid argument)
[pid   303] <... mount resumed>)        = 0
[pid   302] <... mount resumed>)        = 0
[pid   301] unshare(CLONE_NEWIPC <unfinished ...>
[pid   306] close(5 <unfinished ...>
[pid   304] unshare(CLONE_NEWCGROUP <unfinished ...>
[pid   303] unshare(CLONE_NEWIPC <unfinished ...>
[pid   302] unshare(CLONE_NEWIPC <unfinished ...>
[pid   301] <... unshare resumed>)      = -1 EINVAL (Invalid argument)
[pid   300] <... ioctl resumed>)        = 0
[pid   300] openat(AT_FDCWD, "/proc/sys/net/ipv6/conf/syz_tun/accept_dad", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   306] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   306] close(6 <unfinished ...>
[pid   304] <... unshare resumed>)      = 0
[pid   303] <... unshare resumed>)      = -1 EINVAL (Invalid argument)
[pid   302] <... unshare resumed>)      = -1 EINVAL (Invalid argument)
[pid   301] unshare(CLONE_NEWCGROUP <unfinished ...>
[pid   306] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   304] unshare(CLONE_NEWUTS <unfinished ...>
[pid   300] <... openat resumed>)       = 3
[pid   306] close(7 <unfinished ...>
[pid   304] <... unshare resumed>)      = 0
[pid   303] unshare(CLONE_NEWCGROUP <unfinished ...>
[pid   302] unshare(CLONE_NEWCGROUP <unfinished ...>
[pid   301] <... unshare resumed>)      = 0
[pid   300] write(3, "0", 1 <unfinished ...>
[pid   306] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   304] unshare(CLONE_SYSVSEM <unfinished ...>
[pid   302] <... unshare resumed>)      = 0
[pid   303] <... unshare resumed>)      = 0
[pid   301] unshare(CLONE_NEWUTS <unfinished ...>
[pid   306] close(8 <unfinished ...>
[pid   304] <... unshare resumed>)      = 0
[pid   302] unshare(CLONE_NEWUTS <unfinished ...>
[pid   306] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   303] unshare(CLONE_NEWUTS <unfinished ...>
[pid   301] <... unshare resumed>)      = 0
[pid   304] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   306] close(9 <unfinished ...>
[pid   302] <... unshare resumed>)      = 0
[pid   301] unshare(CLONE_SYSVSEM <unfinished ...>
[pid   306] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   304] <... openat resumed>)       = -1 ENOENT (No such file or directory)
[pid   301] <... unshare resumed>)      = 0
[pid   300] <... write resumed>)        = 1
[pid   302] unshare(CLONE_SYSVSEM <unfinished ...>
[pid   306] close(10 <unfinished ...>
[pid   304] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   303] <... unshare resumed>)      = 0
[pid   306] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   302] <... unshare resumed>)      = 0
[pid   301] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   306] close(11 <unfinished ...>
[pid   304] <... openat resumed>)       = -1 ENOENT (No such file or directory)
[pid   302] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   300] close(3 <unfinished ...>
[pid   306] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   304] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   303] unshare(CLONE_SYSVSEM <unfinished ...>
[pid   302] <... openat resumed>)       = -1 ENOENT (No such file or directory)
[pid   301] <... openat resumed>)       = -1 ENOENT (No such file or directory)
[pid   300] <... close resumed>)        = 0
[pid   306] close(12 <unfinished ...>
[pid   304] <... openat resumed>)       = -1 ENOENT (No such file or directory)
[pid   303] <... unshare resumed>)      = 0
[pid   302] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   301] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   300] openat(AT_FDCWD, "/proc/sys/net/ipv6/conf/syz_tun/router_solicitations", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   306] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   304] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   303] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   302] <... openat resumed>)       = -1 ENOENT (No such file or directory)
[pid   301] <... openat resumed>)       = -1 ENOENT (No such file or directory)
[pid   300] <... openat resumed>)       = 3
[pid   306] close(13 <unfinished ...>
[pid   304] <... openat resumed>)       = -1 ENOENT (No such file or directory)
[pid   302] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   301] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   303] <... openat resumed>)       = -1 ENOENT (No such file or directory)
[pid   300] write(3, "0", 1 <unfinished ...>
[pid   306] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   304] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   303] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   302] <... openat resumed>)       = -1 ENOENT (No such file or directory)
[pid   301] <... openat resumed>)       = -1 ENOENT (No such file or directory)
[pid   300] <... write resumed>)        = 1
[pid   306] close(14 <unfinished ...>
[pid   304] <... openat resumed>)       = -1 ENOENT (No such file or directory)
[pid   302] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   301] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   300] close(3 <unfinished ...>
[pid   306] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   304] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   303] <... openat resumed>)       = -1 ENOENT (No such file or directory)
[pid   302] <... openat resumed>)       = -1 ENOENT (No such file or directory)
[pid   300] <... close resumed>)        = 0
[pid   306] close(15 <unfinished ...>
[pid   304] <... openat resumed>)       = -1 ENOENT (No such file or directory)
[pid   303] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   302] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   301] <... openat resumed>)       = -1 ENOENT (No such file or directory)
[pid   300] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE <unfinished ...>
[pid   306] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   304] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   303] <... openat resumed>)       = -1 ENOENT (No such file or directory)
[pid   302] <... openat resumed>)       = -1 ENOENT (No such file or directory)
[pid   301] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   300] <... socket resumed>)       = 3
[pid   306] close(16 <unfinished ...>
[pid   304] <... openat resumed>)       = -1 ENOENT (No such file or directory)
[pid   303] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   302] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   301] <... openat resumed>)       = -1 ENOENT (No such file or directory)
[pid   300] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid   306] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   304] getpid( <unfinished ...>
[pid   303] <... openat resumed>)       = -1 ENOENT (No such file or directory)
[pid   302] <... openat resumed>)       = -1 ENOENT (No such file or directory)
[pid   301] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   300] <... socket resumed>)       = 4
[pid   306] close(17 <unfinished ...>
[pid   304] <... getpid resumed>)       = 1
[pid   303] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   302] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   301] <... openat resumed>)       = -1 ENOENT (No such file or directory)
[pid   300] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" <unfinished ...>
[pid   306] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   304] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1},  <unfinished ...>
[pid   303] <... openat resumed>)       = -1 ENOENT (No such file or directory)
[pid   302] <... openat resumed>)       = -1 ENOENT (No such file or directory)
[pid   301] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   300] <... ioctl resumed>, ifr_ifindex=11}) = 0
[pid   306] close(18 <unfinished ...>
[pid   304] <... capget resumed>{effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid   303] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   302] getpid( <unfinished ...>
[pid   301] <... openat resumed>)       = -1 ENOENT (No such file or directory)
[pid   300] close(4 <unfinished ...>
[pid   306] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   304] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0} <unfinished ...>
[pid   303] <... openat resumed>)       = -1 ENOENT (No such file or directory)
[pid   302] <... getpid resumed>)       = 1
[pid   301] getpid( <unfinished ...>
[pid   300] <... close resumed>)        = 0
[pid   306] close(19 <unfinished ...>
[pid   304] <... capset resumed>)       = 0
[pid   303] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   302] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1},  <unfinished ...>
[pid   301] <... getpid resumed>)       = 1
[pid   300] sendto(3, [{nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x18\x00\x00\x0b\x00\x00\x00\x08\x00\x02\x00\xac\x14\x14\xaa\x08\x00\x01\x00\xac\x14\x14\xaa"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid   306] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   304] unshare(CLONE_NEWNET <unfinished ...>
[pid   303] <... openat resumed>)       = -1 ENOENT (No such file or directory)
[pid   302] <... capget resumed>{effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid   301] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1},  <unfinished ...>
[pid   300] <... sendto resumed>)       = 40
[pid   306] close(20 <unfinished ...>
[pid   300] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   300] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid   300] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun", ifr_ifindex=11}) = 0
[pid   300] close(4)                    = 0
[pid   300] sendto(3, [{nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x78\x00\x00\x0b\x00\x00\x00\x14\x00\x02\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa"], 64, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 64
[pid   300] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   300] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid   306] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   303] getpid( <unfinished ...>
[pid   302] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0} <unfinished ...>
[pid   306] close(21 <unfinished ...>
[pid   301] <... capget resumed>{effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid   300] <... socket resumed>)       = 4
[pid   306] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   303] <... getpid resumed>)       = 1
[pid   302] <... capset resumed>)       = 0
[pid   301] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0} <unfinished ...>
[pid   300] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" <unfinished ...>
[pid   306] close(22 <unfinished ...>
[pid   303] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1},  <unfinished ...>
[pid   302] unshare(CLONE_NEWNET <unfinished ...>
[pid   301] <... capset resumed>)       = 0
[pid   300] <... ioctl resumed>, ifr_ifindex=11}) = 0
[pid   306] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   303] <... capget resumed>{effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid   300] close(4)                    = 0
[pid   300] sendto(3, [{nlmsg_len=48, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x00\x00\x00\x0b\x00\x00\x00\x80\x00\x00\x00\x08\x00\x01\x00\xac\x14\x14\xbb\x0a\x00\x02\x00\xbb\xaa\xaa\xaa\xaa\xaa\x00\x00"], 48, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 48
[pid   300] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=48, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   300] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid   300] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun", ifr_ifindex=11}) = 0
[pid   300] close(4)                    = 0
[pid   300] sendto(3, [{nlmsg_len=60, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x00\x00\x00\x0b\x00\x00\x00\x80\x00\x00\x00\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbb\x0a\x00\x02\x00\xbb\xaa\xaa\xaa\xaa\xaa\x00\x00"], 60, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 60
[pid   300] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=60, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   300] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid   306] close(23 <unfinished ...>
[pid   303] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0} <unfinished ...>
[pid   301] unshare(CLONE_NEWNET <unfinished ...>
[pid   300] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" <unfinished ...>
[pid   306] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   303] <... capset resumed>)       = 0
[pid   300] <... ioctl resumed>, ifr_ifindex=11}) = 0
[pid   306] close(24 <unfinished ...>
[pid   303] unshare(CLONE_NEWNET <unfinished ...>
[pid   300] close(4 <unfinished ...>
[pid   306] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   300] <... close resumed>)        = 0
[pid   306] close(25 <unfinished ...>
[pid   300] sendto(3, [{nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0b\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x0a\x00\x01\x00\xaa\xaa\xaa\xaa\xaa\xaa\x00\x00"], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid   306] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   306] close(26)                   = -1 EBADF (Bad file descriptor)
[pid   306] close(27)                   = -1 EBADF (Bad file descriptor)
[pid   306] close(28)                   = -1 EBADF (Bad file descriptor)
[pid   306] close(29)                   = -1 EBADF (Bad file descriptor)
[pid   306] exit_group(0 <unfinished ...>
[pid   307] <... futex resumed>)        = ?
[pid   306] <... exit_group resumed>)   = ?
[pid   307] +++ exited with 0 +++
[pid   306] +++ exited with 0 +++
[pid   299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=3} ---
[pid   299] restart_syscall(<... resuming interrupted clone ...>) = 0
[pid   299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555570c7690) = 4
./strace-static-x86_64: Process 308 attached
[pid   308] set_robust_list(0x5555570c76a0, 24) = 0
[pid   308] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   308] setpgid(0, 0)               = 0
[pid   308] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   308] write(3, "1000", 4)         = 4
[pid   308] close(3)                    = 0
[pid   308] read(200, "\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x38\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\xc2\x46\x00\x00\x00\x02\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\xaa\xaa\xaa\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00"..., 1000) = 110
[   22.142094][  T307] RAX: ffffffffffffffda RBX: 00007ff6e0bcb3c8 RCX: 00007ff6e0b41399
[   22.149901][  T307] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000030000000
[   22.157714][  T307] RBP: 00007ff6e0bcb3c0 R08: 0000000000000000 R09: 0000000000003337
[   22.165528][  T307] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff6e0bcb3cc
[   22.173338][  T307] R13: 00007ff6e0b01210 R14: 0000000000000002 R15: 00007ff6e0b9801d
[   22.181152][  T307]  </TASK>
[pid   308] read(200, 0x7ffd00327490, 1000) = -1 EAGAIN (Resource temporarily unavailable)
[pid   308] futex(0x7ff6e0bcb3cc, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid   308] rt_sigaction(SIGRT_1, {sa_handler=0x7ff6e0b68fa0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7ff6e0b5a620}, NULL, 8) = 0
[pid   308] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
[pid   308] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7ff6e0ae1000
[pid   308] mprotect(0x7ff6e0ae2000, 131072, PROT_READ|PROT_WRITE) = 0
[pid   308] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid   308] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7ff6e0b01990, parent_tid=0x7ff6e0b01990, exit_signal=0, stack=0x7ff6e0ae1000, stack_size=0x20300, tls=0x7ff6e0b016c0} => {parent_tid=[5]}, 88) = 5
[pid   308] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid   308] futex(0x7ff6e0bcb3c8, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid   304] <... unshare resumed>)      = 0
[pid   308] futex(0x7ff6e0bcb3cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 309 attached
 <unfinished ...>
[pid   309] set_robust_list(0x7ff6e0b019a0, 24) = 0
[pid   309] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid   309] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 3
[pid   309] write(3, "73", 2)           = 2
[pid   309] clone(child_stack=NULL, flags=CLONE_NEWUSER|CLONE_NEWPID <unfinished ...>
[pid   300] <... sendto resumed>)       = 44
[pid   300] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   300] close(3)                    = 0
[pid   300] mkdir("/dev/binderfs", 0777) = -1 EEXIST (File exists)
[pid   300] mount("binder", "/dev/binderfs", "binder", 0, NULL) = 0
[pid   300] symlink("/dev/binderfs", "./binderfs") = -1 EEXIST (File exists)
[pid   300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555570c7690) = 2
[   22.232263][  T309] FAULT_INJECTION: forcing a failure.
[   22.232263][  T309] name failslab, interval 1, probability 0, space 0, times 0
[   22.253625][  T309] CPU: 0 PID: 309 Comm: syz-executor338 Not tainted 5.15.119-syzkaller-android13-5.15.119_r00 #0
[   22.263961][  T309] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023
[   22.273866][  T309] Call Trace:
[   22.276982][  T309]  <TASK>
[   22.279757][  T309]  dump_stack_lvl+0x151/0x1b7
[   22.284273][  T309]  ? io_uring_drop_tctx_refs+0x190/0x190
[   22.289740][  T309]  dump_stack+0x15/0x17
[   22.293735][  T309]  should_fail+0x3c6/0x510
[   22.297987][  T309]  __should_failslab+0xa4/0xe0
[   22.302583][  T309]  ? anon_vma_fork+0x1df/0x4e0
[   22.307182][  T309]  should_failslab+0x9/0x20
[   22.311522][  T309]  slab_pre_alloc_hook+0x37/0xd0
[   22.315864][  T315] FAULT_INJECTION: forcing a failure.
[   22.315864][  T315] name failslab, interval 1, probability 0, space 0, times 0
[   22.316293][  T309]  ? anon_vma_fork+0x1df/0x4e0
[   22.333309][  T309]  kmem_cache_alloc+0x44/0x200
[   22.337909][  T309]  anon_vma_fork+0x1df/0x4e0
[   22.342334][  T309]  dup_mm+0x8c5/0x12c0
[   22.346242][  T309]  ? copy_init_mm+0x20/0x20
[   22.350580][  T309]  copy_mm+0x107/0x1b0
[   22.354484][  T309]  copy_process+0x12bc/0x3260
[   22.359008][  T309]  ? pidfd_show_fdinfo+0x2b0/0x2b0
[   22.363942][  T309]  ? __kasan_check_write+0x14/0x20
[   22.368902][  T309]  kernel_clone+0x21e/0x9e0
[   22.373235][  T309]  ? _raw_spin_unlock_irq+0x4e/0x70
[   22.378266][  T309]  ? create_io_thread+0x1e0/0x1e0
[   22.383131][  T309]  __x64_sys_clone+0x23f/0x290
[   22.387727][  T309]  ? __do_sys_vfork+0x130/0x130
[   22.392413][  T309]  ? __kasan_check_read+0x11/0x20
[   22.397272][  T309]  ? syscall_enter_from_user_mode+0x70/0x1b0
[   22.403093][  T309]  do_syscall_64+0x3d/0xb0
[   22.403386][  T311] FAULT_INJECTION: forcing a failure.
[   22.403386][  T311] name failslab, interval 1, probability 0, space 0, times 0
[   22.407338][  T309]  entry_SYSCALL_64_after_hwframe+0x61/0xcb
[   22.407363][  T309] RIP: 0033:0x7ff6e0b41399
[   22.429735][  T309] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
[   22.449173][  T309] RSP: 002b:00007ff6e0b01208 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
[   22.457419][  T309] RAX: ffffffffffffffda RBX: 00007ff6e0bcb3c8 RCX: 00007ff6e0b41399
[   22.465232][  T309] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000030000000
[   22.473127][  T309] RBP: 00007ff6e0bcb3c0 R08: 0000000000000000 R09: 0000000000003337
./strace-static-x86_64: Process 310 attached
[pid   304] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   303] <... unshare resumed>)      = 0
[pid   302] <... unshare resumed>)      = 0
[pid   301] <... unshare resumed>)      = 0
[pid   304] <... openat resumed>)       = 3
[pid   302] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   301] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   304] write(3, "0 65535", 7 <unfinished ...>
[pid   302] <... openat resumed>)       = 3
[pid   301] <... openat resumed>)       = 3
[pid   304] <... write resumed>)        = 7
[pid   302] write(3, "0 65535", 7 <unfinished ...>
[pid   301] write(3, "0 65535", 7 <unfinished ...>
[pid   304] close(3 <unfinished ...>
[pid   302] <... write resumed>)        = 7
[pid   301] <... write resumed>)        = 7
[pid   304] <... close resumed>)        = 0
[pid   302] close(3 <unfinished ...>
[pid   301] close(3 <unfinished ...>
[pid   304] openat(AT_FDCWD, "/dev/net/tun", O_RDWR|O_NONBLOCK <unfinished ...>
[pid   302] <... close resumed>)        = 0
[pid   301] <... close resumed>)        = 0
[pid   304] <... openat resumed>)       = 3
[pid   302] openat(AT_FDCWD, "/dev/net/tun", O_RDWR|O_NONBLOCK <unfinished ...>
[pid   301] openat(AT_FDCWD, "/dev/net/tun", O_RDWR|O_NONBLOCK <unfinished ...>
[pid   304] dup2(3, 200 <unfinished ...>
[pid   302] <... openat resumed>)       = 3
[pid   301] <... openat resumed>)       = 3
[pid   304] <... dup2 resumed>)         = 200
[pid   302] dup2(3, 200 <unfinished ...>
[pid   301] dup2(3, 200 <unfinished ...>
[pid   304] close(3 <unfinished ...>
[pid   302] <... dup2 resumed>)         = 200
[pid   301] <... dup2 resumed>)         = 200
[pid   304] <... close resumed>)        = 0
[pid   302] close(3 <unfinished ...>
[pid   301] close(3 <unfinished ...>
[pid   304] ioctl(200, TUNSETIFF, 0x7ffd00327930 <unfinished ...>
[pid   302] <... close resumed>)        = 0
[pid   301] <... close resumed>)        = 0
[pid   304] <... ioctl resumed>)        = 0
[pid   302] ioctl(200, TUNSETIFF, 0x7ffd00327930 <unfinished ...>
[pid   301] ioctl(200, TUNSETIFF, 0x7ffd00327930 <unfinished ...>
[pid   304] openat(AT_FDCWD, "/proc/sys/net/ipv6/conf/syz_tun/accept_dad", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   302] <... ioctl resumed>)        = 0
[pid   304] <... openat resumed>)       = 3
[pid   302] openat(AT_FDCWD, "/proc/sys/net/ipv6/conf/syz_tun/accept_dad", O_WRONLY|O_CLOEXEC) = 3
[pid   302] write(3, "0", 1 <unfinished ...>
[pid   304] write(3, "0", 1 <unfinished ...>
[pid   302] <... write resumed>)        = 1
[pid   304] <... write resumed>)        = 1
[pid   302] close(3 <unfinished ...>
[pid   304] close(3 <unfinished ...>
[pid   302] <... close resumed>)        = 0
[pid   304] <... close resumed>)        = 0
[pid   302] openat(AT_FDCWD, "/proc/sys/net/ipv6/conf/syz_tun/router_solicitations", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   304] openat(AT_FDCWD, "/proc/sys/net/ipv6/conf/syz_tun/router_solicitations", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   302] <... openat resumed>)       = 3
[pid   304] <... openat resumed>)       = 3
[pid   302] write(3, "0", 1 <unfinished ...>
[pid   304] write(3, "0", 1 <unfinished ...>
[pid   302] <... write resumed>)        = 1
[pid   304] <... write resumed>)        = 1
[pid   302] close(3 <unfinished ...>
[pid   304] close(3 <unfinished ...>
[pid   302] <... close resumed>)        = 0
[pid   304] <... close resumed>)        = 0
[pid   302] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE <unfinished ...>
[pid   304] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE <unfinished ...>
[pid   302] <... socket resumed>)       = 3
[pid   304] <... socket resumed>)       = 3
[pid   302] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid   304] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid   302] <... socket resumed>)       = 4
[pid   304] <... socket resumed>)       = 4
[pid   302] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" <unfinished ...>
[pid   304] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" <unfinished ...>
[pid   303] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   302] <... ioctl resumed>, ifr_ifindex=11}) = 0
[pid   304] <... ioctl resumed>, ifr_ifindex=11}) = 0
[pid   303] <... openat resumed>)       = 3
[pid   302] close(4 <unfinished ...>
[pid   304] close(4 <unfinished ...>
[pid   303] write(3, "0 65535", 7 <unfinished ...>
[pid   302] <... close resumed>)        = 0
[pid   304] <... close resumed>)        = 0
[pid   303] <... write resumed>)        = 7
[pid   302] sendto(3, [{nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x18\x00\x00\x0b\x00\x00\x00\x08\x00\x02\x00\xac\x14\x14\xaa\x08\x00\x01\x00\xac\x14\x14\xaa"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid   304] sendto(3, [{nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x18\x00\x00\x0b\x00\x00\x00\x08\x00\x02\x00\xac\x14\x14\xaa\x08\x00\x01\x00\xac\x14\x14\xaa"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid   303] close(3 <unfinished ...>
[pid   302] <... sendto resumed>)       = 40
[pid   304] <... sendto resumed>)       = 40
[pid   303] <... close resumed>)        = 0
[pid   302] recvfrom(3,  <unfinished ...>
[pid   304] recvfrom(3,  <unfinished ...>
[pid   303] openat(AT_FDCWD, "/dev/net/tun", O_RDWR|O_NONBLOCK <unfinished ...>
[pid   302] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   304] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   303] <... openat resumed>)       = 3
[pid   302] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid   304] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid   303] dup2(3, 200 <unfinished ...>
[pid   302] <... socket resumed>)       = 4
[pid   304] <... socket resumed>)       = 4
[pid   303] <... dup2 resumed>)         = 200
[pid   302] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" <unfinished ...>
[pid   304] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" <unfinished ...>
[pid   303] close(3 <unfinished ...>
[pid   302] <... ioctl resumed>, ifr_ifindex=11}) = 0
[pid   304] <... ioctl resumed>, ifr_ifindex=11}) = 0
[pid   303] <... close resumed>)        = 0
[pid   302] close(4 <unfinished ...>
[pid   304] close(4 <unfinished ...>
[pid   303] ioctl(200, TUNSETIFF, 0x7ffd00327930 <unfinished ...>
[pid   302] <... close resumed>)        = 0
[pid   304] <... close resumed>)        = 0
[pid   303] <... ioctl resumed>)        = 0
[pid   302] sendto(3, [{nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x78\x00\x00\x0b\x00\x00\x00\x14\x00\x02\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa"], 64, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid   310] set_robust_list(0x5555570c76a0, 24 <unfinished ...>
[pid   304] sendto(3, [{nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x78\x00\x00\x0b\x00\x00\x00\x14\x00\x02\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa"], 64, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid   303] openat(AT_FDCWD, "/proc/sys/net/ipv6/conf/syz_tun/accept_dad", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   302] <... sendto resumed>)       = 64
[pid   310] <... set_robust_list resumed>) = 0
[pid   304] <... sendto resumed>)       = 64
[pid   303] <... openat resumed>)       = 3
[pid   302] recvfrom(3,  <unfinished ...>
[pid   310] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid   304] recvfrom(3,  <unfinished ...>
[pid   303] write(3, "0", 1 <unfinished ...>
[pid   302] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   310] <... prctl resumed>)        = 0
[pid   304] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   303] <... write resumed>)        = 1
[pid   302] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid   310] setpgid(0, 0 <unfinished ...>
[pid   304] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid   303] close(3 <unfinished ...>
[pid   302] <... socket resumed>)       = 4
[pid   310] <... setpgid resumed>)      = 0
[pid   304] <... socket resumed>)       = 4
[pid   303] <... close resumed>)        = 0
[pid   302] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" <unfinished ...>
[pid   310] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   304] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" <unfinished ...>
[pid   303] openat(AT_FDCWD, "/proc/sys/net/ipv6/conf/syz_tun/router_solicitations", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   302] <... ioctl resumed>, ifr_ifindex=11}) = 0
[pid   310] <... openat resumed>)       = 3
[pid   304] <... ioctl resumed>, ifr_ifindex=11}) = 0
[pid   303] <... openat resumed>)       = 3
[pid   302] close(4 <unfinished ...>
[pid   310] write(3, "1000", 4 <unfinished ...>
[pid   304] close(4 <unfinished ...>
[pid   303] write(3, "0", 1 <unfinished ...>
[pid   302] <... close resumed>)        = 0
[pid   310] <... write resumed>)        = 4
[pid   304] <... close resumed>)        = 0
[pid   303] <... write resumed>)        = 1
[pid   302] sendto(3, [{nlmsg_len=48, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x00\x00\x00\x0b\x00\x00\x00\x80\x00\x00\x00\x08\x00\x01\x00\xac\x14\x14\xbb\x0a\x00\x02\x00\xbb\xaa\xaa\xaa\xaa\xaa\x00\x00"], 48, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid   310] close(3 <unfinished ...>
[pid   304] sendto(3, [{nlmsg_len=48, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x00\x00\x00\x0b\x00\x00\x00\x80\x00\x00\x00\x08\x00\x01\x00\xac\x14\x14\xbb\x0a\x00\x02\x00\xbb\xaa\xaa\xaa\xaa\xaa\x00\x00"], 48, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid   303] close(3 <unfinished ...>
[pid   302] <... sendto resumed>)       = 48
[pid   310] <... close resumed>)        = 0
[pid   304] <... sendto resumed>)       = 48
[pid   303] <... close resumed>)        = 0
[pid   302] recvfrom(3,  <unfinished ...>
[pid   310] read(200,  <unfinished ...>
[pid   304] recvfrom(3,  <unfinished ...>
[pid   303] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE <unfinished ...>
[pid   302] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=48, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   310] <... read resumed>0x7ffd00327490, 1000) = -1 EAGAIN (Resource temporarily unavailable)
[pid   304] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=48, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   303] <... socket resumed>)       = 3
[pid   302] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid   310] futex(0x7ff6e0bcb3cc, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid   304] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid   303] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid   302] <... socket resumed>)       = 4
[pid   310] <... futex resumed>)        = 0
[pid   304] <... socket resumed>)       = 4
[pid   303] <... socket resumed>)       = 4
[pid   302] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" <unfinished ...>
[pid   310] rt_sigaction(SIGRT_1, {sa_handler=0x7ff6e0b68fa0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7ff6e0b5a620},  <unfinished ...>
[pid   304] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" <unfinished ...>
[pid   303] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" <unfinished ...>
[pid   302] <... ioctl resumed>, ifr_ifindex=11}) = 0
[pid   310] <... rt_sigaction resumed>NULL, 8) = 0
[pid   304] <... ioctl resumed>, ifr_ifindex=11}) = 0
[pid   303] <... ioctl resumed>, ifr_ifindex=11}) = 0
[pid   302] close(4 <unfinished ...>
[pid   310] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1],  <unfinished ...>
[pid   304] close(4 <unfinished ...>
[pid   303] close(4 <unfinished ...>
[pid   302] <... close resumed>)        = 0
[pid   310] <... rt_sigprocmask resumed>NULL, 8) = 0
[pid   304] <... close resumed>)        = 0
[pid   303] <... close resumed>)        = 0
[pid   302] sendto(3, [{nlmsg_len=60, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x00\x00\x00\x0b\x00\x00\x00\x80\x00\x00\x00\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbb\x0a\x00\x02\x00\xbb\xaa\xaa\xaa\xaa\xaa\x00\x00"], 60, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid   310] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid   304] sendto(3, [{nlmsg_len=60, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x00\x00\x00\x0b\x00\x00\x00\x80\x00\x00\x00\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbb\x0a\x00\x02\x00\xbb\xaa\xaa\xaa\xaa\xaa\x00\x00"], 60, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid   303] sendto(3, [{nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x18\x00\x00\x0b\x00\x00\x00\x08\x00\x02\x00\xac\x14\x14\xaa\x08\x00\x01\x00\xac\x14\x14\xaa"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid   302] <... sendto resumed>)       = 60
[pid   310] <... mmap resumed>)         = 0x7ff6e0ae1000
[pid   304] <... sendto resumed>)       = 60
[pid   303] <... sendto resumed>)       = 40
[pid   302] recvfrom(3,  <unfinished ...>
[pid   310] mprotect(0x7ff6e0ae2000, 131072, PROT_READ|PROT_WRITE <unfinished ...>
[pid   304] recvfrom(3,  <unfinished ...>
[pid   303] recvfrom(3,  <unfinished ...>
[pid   302] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=60, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   310] <... mprotect resumed>)     = 0
[pid   304] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=60, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   303] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   302] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid   310] rt_sigprocmask(SIG_BLOCK, ~[],  <unfinished ...>
[pid   304] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid   303] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid   302] <... socket resumed>)       = 4
[pid   310] <... rt_sigprocmask resumed>[], 8) = 0
[pid   304] <... socket resumed>)       = 4
[pid   303] <... socket resumed>)       = 4
[pid   302] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" <unfinished ...>
[pid   310] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7ff6e0b01990, parent_tid=0x7ff6e0b01990, exit_signal=0, stack=0x7ff6e0ae1000, stack_size=0x20300, tls=0x7ff6e0b016c0} <unfinished ...>
[pid   304] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" <unfinished ...>
[pid   303] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" <unfinished ...>
[pid   302] <... ioctl resumed>, ifr_ifindex=11}) = 0
[pid   304] <... ioctl resumed>, ifr_ifindex=11}) = 0
[pid   303] <... ioctl resumed>, ifr_ifindex=11}) = 0
[pid   302] close(4 <unfinished ...>
[pid   310] <... clone3 resumed> => {parent_tid=[3]}, 88) = 3
[pid   304] close(4 <unfinished ...>
[pid   303] close(4 <unfinished ...>
[pid   302] <... close resumed>)        = 0
[pid   310] rt_sigprocmask(SIG_SETMASK, [],  <unfinished ...>
[pid   304] <... close resumed>)        = 0
[pid   303] <... close resumed>)        = 0
[pid   302] sendto(3, [{nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0b\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x0a\x00\x01\x00\xaa\xaa\xaa\xaa\xaa\xaa\x00\x00"], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid   310] <... rt_sigprocmask resumed>NULL, 8) = 0
[pid   304] sendto(3, [{nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0b\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x0a\x00\x01\x00\xaa\xaa\xaa\xaa\xaa\xaa\x00\x00"], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid   303] sendto(3, [{nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x78\x00\x00\x0b\x00\x00\x00\x14\x00\x02\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa"], 64, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid   302] <... sendto resumed>)       = 44
[pid   310] futex(0x7ff6e0bcb3c8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid   304] <... sendto resumed>)       = 44
[pid   303] <... sendto resumed>)       = 64
[pid   302] recvfrom(3,  <unfinished ...>
[pid   310] <... futex resumed>)        = 0
[pid   304] recvfrom(3,  <unfinished ...>
[pid   303] recvfrom(3,  <unfinished ...>
[pid   302] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   310] futex(0x7ff6e0bcb3cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid   304] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   303] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   302] close(3 <unfinished ...>
[pid   304] close(3 <unfinished ...>
[pid   303] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid   302] <... close resumed>)        = 0
[pid   304] <... close resumed>)        = 0
[pid   303] <... socket resumed>)       = 4
[pid   302] mkdir("/dev/binderfs", 0777 <unfinished ...>
[pid   304] mkdir("/dev/binderfs", 0777 <unfinished ...>
[pid   303] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" <unfinished ...>
[pid   302] <... mkdir resumed>)        = -1 EEXIST (File exists)
[pid   304] <... mkdir resumed>)        = -1 EEXIST (File exists)
[pid   303] <... ioctl resumed>, ifr_ifindex=11}) = 0
[pid   302] mount("binder", "/dev/binderfs", "binder", 0, NULL <unfinished ...>
[pid   304] mount("binder", "/dev/binderfs", "binder", 0, NULL <unfinished ...>
[pid   303] close(4 <unfinished ...>
[pid   302] <... mount resumed>)        = 0
[pid   304] <... mount resumed>)        = 0
[pid   303] <... close resumed>)        = 0
[pid   302] symlink("/dev/binderfs", "./binderfs" <unfinished ...>
[pid   304] symlink("/dev/binderfs", "./binderfs" <unfinished ...>
[pid   303] sendto(3, [{nlmsg_len=48, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x00\x00\x00\x0b\x00\x00\x00\x80\x00\x00\x00\x08\x00\x01\x00\xac\x14\x14\xbb\x0a\x00\x02\x00\xbb\xaa\xaa\xaa\xaa\xaa\x00\x00"], 48, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid   302] <... symlink resumed>)      = -1 EEXIST (File exists)
[pid   304] <... symlink resumed>)      = -1 EEXIST (File exists)
[pid   303] <... sendto resumed>)       = 48
[pid   302] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid   304] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid   303] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=48, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   302] <... clone resumed>, child_tidptr=0x5555570c7690) = 2
[pid   304] <... clone resumed>, child_tidptr=0x5555570c7690) = 2
[pid   303] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid   303] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun", ifr_ifindex=11}) = 0
[pid   303] close(4)                    = 0
[pid   303] sendto(3, [{nlmsg_len=60, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x00\x00\x00\x0b\x00\x00\x00\x80\x00\x00\x00\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbb\x0a\x00\x02\x00\xbb\xaa\xaa\xaa\xaa\xaa\x00\x00"], 60, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 60
[pid   303] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=60, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   303] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid   303] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun", ifr_ifindex=11}) = 0
[pid   303] close(4)                    = 0
[pid   303] sendto(3, [{nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0b\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x0a\x00\x01\x00\xaa\xaa\xaa\xaa\xaa\xaa\x00\x00"], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 44
[pid   303] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   303] close(3)                    = 0
[pid   303] mkdir("/dev/binderfs", 0777) = -1 EEXIST (File exists)
[pid   303] mount("binder", "/dev/binderfs", "binder", 0, NULL) = 0
[pid   303] symlink("/dev/binderfs", "./binderfs") = -1 EEXIST (File exists)
[pid   303] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555570c7690) = 2
./strace-static-x86_64: Process 312 attached
[pid   312] set_robust_list(0x5555570c76a0, 24) = 0
[pid   312] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   312] setpgid(0, 0)               = 0
[pid   312] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   312] write(3, "1000", 4)         = 4
[pid   312] close(3)                    = 0
[pid   312] read(200, 0x7ffd00327490, 1000) = -1 EAGAIN (Resource temporarily unavailable)
[pid   312] futex(0x7ff6e0bcb3cc, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid   312] rt_sigaction(SIGRT_1, {sa_handler=0x7ff6e0b68fa0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7ff6e0b5a620}, NULL, 8) = 0
[pid   312] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
[pid   312] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7ff6e0ae1000
[pid   312] mprotect(0x7ff6e0ae2000, 131072, PROT_READ|PROT_WRITE) = 0
[pid   312] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid   312] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7ff6e0b01990, parent_tid=0x7ff6e0b01990, exit_signal=0, stack=0x7ff6e0ae1000, stack_size=0x20300, tls=0x7ff6e0b016c0} => {parent_tid=[3]}, 88) = 3
[pid   312] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid   312] futex(0x7ff6e0bcb3c8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 314 attached
) = 0
[pid   314] set_robust_list(0x5555570c76a0, 24 <unfinished ...>
[pid   312] futex(0x7ff6e0bcb3cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid   314] <... set_robust_list resumed>) = 0
[pid   314] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   314] setpgid(0, 0)               = 0
[pid   314] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   314] write(3, "1000", 4)         = 4
[pid   314] close(3)                    = 0
[pid   314] read(200, 0x7ffd00327490, 1000) = -1 EAGAIN (Resource temporarily unavailable)
[pid   314] futex(0x7ff6e0bcb3cc, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid   314] rt_sigaction(SIGRT_1, {sa_handler=0x7ff6e0b68fa0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7ff6e0b5a620}, NULL, 8) = 0
[pid   314] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
[pid   314] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7ff6e0ae1000
[pid   314] mprotect(0x7ff6e0ae2000, 131072, PROT_READ|PROT_WRITE) = 0
[pid   314] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid   314] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7ff6e0b01990, parent_tid=0x7ff6e0b01990, exit_signal=0, stack=0x7ff6e0ae1000, stack_size=0x20300, tls=0x7ff6e0b016c0} => {parent_tid=[3]}, 88) = 3
[pid   314] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid   314] futex(0x7ff6e0bcb3c8, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid   314] futex(0x7ff6e0bcb3cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 315 attached
 <unfinished ...>
[pid   315] set_robust_list(0x7ff6e0b019a0, 24) = 0
[pid   315] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid   315] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 3
[pid   315] write(3, "73", 2)           = 2
[pid   315] clone(child_stack=NULL, flags=CLONE_NEWUSER|CLONE_NEWPID <unfinished ...>
[pid   310] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid   312] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid   314] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
./strace-static-x86_64: Process 311 attached
[pid   311] set_robust_list(0x7ff6e0b019a0, 24) = 0
[pid   311] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid   311] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 3
[pid   311] write(3, "73", 2)           = 2
[   22.480938][  T309] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff6e0bcb3cc
[   22.488748][  T309] R13: 00007ff6e0b01210 R14: 0000000000000002 R15: 00007ff6e0b9801d
[   22.496564][  T309]  </TASK>
[   22.499427][  T315] CPU: 1 PID: 315 Comm: syz-executor338 Not tainted 5.15.119-syzkaller-android13-5.15.119_r00 #0
[   22.510010][  T315] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023
[   22.519898][  T315] Call Trace:
[   22.523024][  T315]  <TASK>
[   22.525800][  T315]  dump_stack_lvl+0x151/0x1b7
[   22.530322][  T315]  ? io_uring_drop_tctx_refs+0x190/0x190
[   22.535780][  T315]  ? avc_denied+0x1b0/0x1b0
[   22.540206][  T315]  dump_stack+0x15/0x17
[   22.544200][  T315]  should_fail+0x3c6/0x510
[   22.548454][  T315]  __should_failslab+0xa4/0xe0
[   22.553051][  T315]  ? vm_area_dup+0x26/0x230
[   22.557395][  T315]  should_failslab+0x9/0x20
[   22.561732][  T315]  slab_pre_alloc_hook+0x37/0xd0
[   22.566505][  T315]  ? vm_area_dup+0x26/0x230
[   22.570843][  T315]  kmem_cache_alloc+0x44/0x200
[   22.575534][  T315]  vm_area_dup+0x26/0x230
[   22.579698][  T315]  dup_mm+0x81b/0x12c0
[   22.583627][  T315]  ? copy_init_mm+0x20/0x20
[   22.587944][  T315]  copy_mm+0x107/0x1b0
[   22.591849][  T315]  copy_process+0x12bc/0x3260
[   22.596363][  T315]  ? pidfd_show_fdinfo+0x2b0/0x2b0
[   22.601315][  T315]  ? __kasan_check_write+0x14/0x20
[   22.606261][  T315]  kernel_clone+0x21e/0x9e0
[   22.610594][  T315]  ? _raw_spin_unlock_irq+0x4e/0x70
[   22.615628][  T315]  ? create_io_thread+0x1e0/0x1e0
[   22.620508][  T315]  __x64_sys_clone+0x23f/0x290
[   22.625089][  T315]  ? __do_sys_vfork+0x130/0x130
[   22.629780][  T315]  ? __kasan_check_read+0x11/0x20
[   22.634664][  T315]  ? syscall_enter_from_user_mode+0x70/0x1b0
[   22.640455][  T315]  do_syscall_64+0x3d/0xb0
[   22.644703][  T315]  entry_SYSCALL_64_after_hwframe+0x61/0xcb
[   22.650435][  T315] RIP: 0033:0x7ff6e0b41399
[   22.654687][  T315] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
[   22.674309][  T315] RSP: 002b:00007ff6e0b01208 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
[   22.682544][  T315] RAX: ffffffffffffffda RBX: 00007ff6e0bcb3c8 RCX: 00007ff6e0b41399
[   22.690362][  T315] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000030000000
[   22.698168][  T315] RBP: 00007ff6e0bcb3c0 R08: 0000000000000000 R09: 0000000000003337
[   22.705981][  T315] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff6e0bcb3cc
[   22.713793][  T315] R13: 00007ff6e0b01210 R14: 0000000000000002 R15: 00007ff6e0b9801d
[   22.721612][  T315]  </TASK>
[   22.724493][  T311] CPU: 0 PID: 311 Comm: syz-executor338 Not tainted 5.15.119-syzkaller-android13-5.15.119_r00 #0
[   22.734808][  T311] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023
[   22.744694][  T311] Call Trace:
[   22.747819][  T311]  <TASK>
[   22.750595][  T311]  dump_stack_lvl+0x151/0x1b7
[   22.755112][  T311]  ? io_uring_drop_tctx_refs+0x190/0x190
[   22.760580][  T311]  dump_stack+0x15/0x17
[   22.764572][  T311]  should_fail+0x3c6/0x510
[   22.768820][  T311]  __should_failslab+0xa4/0xe0
[   22.773438][  T311]  ? anon_vma_fork+0x1df/0x4e0
[   22.778017][  T311]  should_failslab+0x9/0x20
[   22.782357][  T311]  slab_pre_alloc_hook+0x37/0xd0
[   22.787130][  T311]  ? anon_vma_fork+0x1df/0x4e0
[   22.791732][  T311]  kmem_cache_alloc+0x44/0x200
[   22.796335][  T311]  anon_vma_fork+0x1df/0x4e0
[   22.800846][  T311]  dup_mm+0x8c5/0x12c0
[   22.804752][  T311]  ? copy_init_mm+0x20/0x20
[   22.809091][  T311]  copy_mm+0x107/0x1b0
[   22.812995][  T311]  copy_process+0x12bc/0x3260
[   22.817513][  T311]  ? pidfd_show_fdinfo+0x2b0/0x2b0
[   22.822481][  T311]  ? __kasan_check_write+0x14/0x20
[   22.827413][  T311]  kernel_clone+0x21e/0x9e0
[   22.831749][  T311]  ? _raw_spin_unlock_irq+0x4e/0x70
[   22.836774][  T311]  ? create_io_thread+0x1e0/0x1e0
[   22.841639][  T311]  __x64_sys_clone+0x23f/0x290
[   22.846248][  T311]  ? __do_sys_vfork+0x130/0x130
[   22.851447][  T311]  ? __kasan_check_read+0x11/0x20
[   22.856304][  T311]  ? syscall_enter_from_user_mode+0x70/0x1b0
[   22.862211][  T311]  do_syscall_64+0x3d/0xb0
[   22.866459][  T311]  entry_SYSCALL_64_after_hwframe+0x61/0xcb
[   22.872188][  T311] RIP: 0033:0x7ff6e0b41399
[   22.876440][  T311] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
[   22.895972][  T311] RSP: 002b:00007ff6e0b01208 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
[   22.904213][  T311] RAX: ffffffffffffffda RBX: 00007ff6e0bcb3c8 RCX: 00007ff6e0b41399
[   22.912023][  T311] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000030000000
[   22.919834][  T311] RBP: 00007ff6e0bcb3c0 R08: 0000000000000000 R09: 0000000000003337
[   22.927647][  T311] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff6e0bcb3cc
[pid   311] clone(child_stack=NULL, flags=CLONE_NEWUSER|CLONE_NEWPID./strace-static-x86_64: Process 316 attached
./strace-static-x86_64: Process 313 attached
 <unfinished ...>
[pid   309] <... clone resumed>)        = -1 ENOMEM (Cannot allocate memory)
[pid   308] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid   301] <... ioctl resumed>)        = 0
[pid   316] set_robust_list(0x7ff6e0b019a0, 24 <unfinished ...>
[pid   313] set_robust_list(0x5555570c76a0, 24 <unfinished ...>
[pid   309] futex(0x7ff6e0bcb3cc, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid   308] close(3 <unfinished ...>
[pid   316] <... set_robust_list resumed>) = 0
[pid   314] close(3 <unfinished ...>
[pid   313] <... set_robust_list resumed>) = 0
[pid   309] <... futex resumed>)        = 0
[pid   308] <... close resumed>)        = 0
[pid   314] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   314] close(4)                    = -1 EBADF (Bad file descriptor)
[pid   313] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid   309] futex(0x7ff6e0bcb3c8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid   316] rt_sigprocmask(SIG_SETMASK, [],  <unfinished ...>
[pid   308] close(4 <unfinished ...>
[pid   314] close(5)                    = -1 EBADF (Bad file descriptor)
[pid   314] close(6)                    = -1 EBADF (Bad file descriptor)
[pid   314] close(7)                    = -1 EBADF (Bad file descriptor)
[pid   314] close(8)                    = -1 EBADF (Bad file descriptor)
[pid   314] close(9)                    = -1 EBADF (Bad file descriptor)
[pid   301] openat(AT_FDCWD, "/proc/sys/net/ipv6/conf/syz_tun/accept_dad", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   316] <... rt_sigprocmask resumed>NULL, 8) = 0
[pid   316] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR <unfinished ...>
[pid   314] close(10 <unfinished ...>
[pid   313] <... prctl resumed>)        = 0
[pid   308] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   301] <... openat resumed>)       = 3
[pid   314] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   314] close(11 <unfinished ...>
[pid   301] write(3, "0", 1 <unfinished ...>
[pid   316] <... openat resumed>)       = 3
[pid   314] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   313] setpgid(0, 0 <unfinished ...>
[pid   308] close(5 <unfinished ...>
[pid   314] close(12 <unfinished ...>
[pid   313] <... setpgid resumed>)      = 0
[pid   308] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   301] <... write resumed>)        = 1
[pid   314] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   308] close(6 <unfinished ...>
[pid   314] close(13 <unfinished ...>
[pid   301] close(3 <unfinished ...>
[pid   313] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   316] write(3, "73", 2 <unfinished ...>
[pid   314] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   308] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   314] close(14 <unfinished ...>
[pid   301] <... close resumed>)        = 0
[pid   314] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   314] close(15 <unfinished ...>
[pid   301] openat(AT_FDCWD, "/proc/sys/net/ipv6/conf/syz_tun/router_solicitations", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   314] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   314] close(16 <unfinished ...>
[pid   301] <... openat resumed>)       = 3
[pid   314] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   314] close(17 <unfinished ...>
[pid   301] write(3, "0", 1 <unfinished ...>
[pid   314] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   314] close(18 <unfinished ...>
[pid   301] <... write resumed>)        = 1
[pid   314] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   314] close(19 <unfinished ...>
[pid   301] close(3 <unfinished ...>
[pid   314] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   314] close(20 <unfinished ...>
[pid   301] <... close resumed>)        = 0
[pid   314] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   314] close(21 <unfinished ...>
[pid   301] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE <unfinished ...>
[pid   314] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   314] close(22 <unfinished ...>
[pid   308] close(7 <unfinished ...>
[pid   316] <... write resumed>)        = 2
[pid   301] <... socket resumed>)       = 3
[pid   314] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   314] close(23 <unfinished ...>
[pid   301] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid   316] clone(child_stack=NULL, flags=CLONE_NEWUSER|CLONE_NEWPID <unfinished ...>
[pid   314] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   313] <... openat resumed>)       = 3
[pid   308] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   314] close(24 <unfinished ...>
[pid   301] <... socket resumed>)       = 4
[pid   314] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   314] close(25 <unfinished ...>
[pid   301] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" <unfinished ...>
[pid   314] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   314] close(26 <unfinished ...>
[pid   301] <... ioctl resumed>, ifr_ifindex=11}) = 0
[pid   314] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   314] close(27 <unfinished ...>
[pid   301] close(4 <unfinished ...>
[pid   314] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   308] close(8 <unfinished ...>
[pid   301] <... close resumed>)        = 0
[pid   314] close(28 <unfinished ...>
[pid   301] sendto(3, [{nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x18\x00\x00\x0b\x00\x00\x00\x08\x00\x02\x00\xac\x14\x14\xaa\x08\x00\x01\x00\xac\x14\x14\xaa"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid   314] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   301] <... sendto resumed>)       = 40
[pid   301] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   301] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid   301] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun", ifr_ifindex=11}) = 0
[pid   301] close(4)                    = 0
[pid   301] sendto(3, [{nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x78\x00\x00\x0b\x00\x00\x00\x14\x00\x02\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa"], 64, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 64
[pid   301] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   301] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid   301] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun", ifr_ifindex=11}) = 0
[pid   301] close(4)                    = 0
[pid   301] sendto(3, [{nlmsg_len=48, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x00\x00\x00\x0b\x00\x00\x00\x80\x00\x00\x00\x08\x00\x01\x00\xac\x14\x14\xbb\x0a\x00\x02\x00\xbb\xaa\xaa\xaa\xaa\xaa\x00\x00"], 48, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 48
[pid   301] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=48, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   301] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid   301] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun", ifr_ifindex=11}) = 0
[pid   301] close(4)                    = 0
[pid   301] sendto(3, [{nlmsg_len=60, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x00\x00\x00\x0b\x00\x00\x00\x80\x00\x00\x00\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbb\x0a\x00\x02\x00\xbb\xaa\xaa\xaa\xaa\xaa\x00\x00"], 60, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 60
[pid   301] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=60, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   301] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid   301] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun", ifr_ifindex=11}) = 0
[pid   301] close(4)                    = 0
[pid   301] sendto(3, [{nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0b\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x0a\x00\x01\x00\xaa\xaa\xaa\xaa\xaa\xaa\x00\x00"], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 44
[pid   301] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   301] close(3)                    = 0
[pid   301] mkdir("/dev/binderfs", 0777) = -1 EEXIST (File exists)
[pid   301] mount("binder", "/dev/binderfs", "binder", 0, NULL) = 0
[pid   301] symlink("/dev/binderfs", "./binderfs") = -1 EEXIST (File exists)
[pid   301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555570c7690) = 2
./strace-static-x86_64: Process 318 attached
[pid   318] set_robust_list(0x5555570c76a0, 24) = 0
[pid   318] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   318] setpgid(0, 0)               = 0
[pid   318] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   318] write(3, "1000", 4)         = 4
[pid   318] close(3)                    = 0
[pid   318] read(200, 0x7ffd00327490, 1000) = -1 EAGAIN (Resource temporarily unavailable)
[pid   313] write(3, "1000", 4 <unfinished ...>
[pid   308] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   313] <... write resumed>)        = 4
[pid   308] close(9 <unfinished ...>
[pid   313] close(3 <unfinished ...>
[pid   308] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   313] <... close resumed>)        = 0
[pid   308] close(10 <unfinished ...>
[pid   313] read(200,  <unfinished ...>
[pid   308] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   318] futex(0x7ff6e0bcb3cc, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid   313] <... read resumed>"\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x24\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\x6f\xb5\x00\x00\x00\x01\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\x00\x00\xaa", 1000) = 90
[pid   308] close(11 <unfinished ...>
[pid   313] read(200,  <unfinished ...>
[pid   308] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   313] <... read resumed>0x7ffd00327490, 1000) = -1 EAGAIN (Resource temporarily unavailable)
[pid   308] close(12 <unfinished ...>
[pid   318] <... futex resumed>)        = 0
[pid   313] futex(0x7ff6e0bcb3cc, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid   308] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   313] <... futex resumed>)        = 0
[pid   308] close(13 <unfinished ...>
[pid   318] rt_sigaction(SIGRT_1, {sa_handler=0x7ff6e0b68fa0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7ff6e0b5a620},  <unfinished ...>
[pid   313] rt_sigaction(SIGRT_1, {sa_handler=0x7ff6e0b68fa0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7ff6e0b5a620},  <unfinished ...>
[pid   308] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   318] <... rt_sigaction resumed>NULL, 8) = 0
[pid   313] <... rt_sigaction resumed>NULL, 8) = 0
[pid   308] close(14 <unfinished ...>
[pid   318] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1],  <unfinished ...>
[pid   313] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1],  <unfinished ...>
[pid   308] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   318] <... rt_sigprocmask resumed>NULL, 8) = 0
[pid   313] <... rt_sigprocmask resumed>NULL, 8) = 0
[pid   308] close(15 <unfinished ...>
[pid   313] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid   308] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   318] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid   313] <... mmap resumed>)         = 0x7ff6e0ae1000
[pid   308] close(16 <unfinished ...>
[pid   313] mprotect(0x7ff6e0ae2000, 131072, PROT_READ|PROT_WRITE <unfinished ...>
[pid   308] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   313] <... mprotect resumed>)     = 0
[pid   308] close(17 <unfinished ...>
[pid   318] <... mmap resumed>)         = 0x7ff6e0ae1000
[pid   318] mprotect(0x7ff6e0ae2000, 131072, PROT_READ|PROT_WRITE) = 0
[pid   318] rt_sigprocmask(SIG_BLOCK, ~[],  <unfinished ...>
[pid   313] rt_sigprocmask(SIG_BLOCK, ~[],  <unfinished ...>
[pid   308] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   313] <... rt_sigprocmask resumed>[], 8) = 0
[pid   308] close(18 <unfinished ...>
[pid   318] <... rt_sigprocmask resumed>[], 8) = 0
[pid   313] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7ff6e0b01990, parent_tid=0x7ff6e0b01990, exit_signal=0, stack=0x7ff6e0ae1000, stack_size=0x20300, tls=0x7ff6e0b016c0} <unfinished ...>
[pid   308] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   318] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7ff6e0b01990, parent_tid=0x7ff6e0b01990, exit_signal=0, stack=0x7ff6e0ae1000, stack_size=0x20300, tls=0x7ff6e0b016c0} <unfinished ...>
[pid   308] close(19 <unfinished ...>
[pid   313] <... clone3 resumed> => {parent_tid=[3]}, 88) = 3
[pid   308] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   318] <... clone3 resumed> => {parent_tid=[3]}, 88) = 3
[pid   313] rt_sigprocmask(SIG_SETMASK, [],  <unfinished ...>
[pid   308] close(20 <unfinished ...>
[pid   313] <... rt_sigprocmask resumed>NULL, 8) = 0
[pid   308] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   313] futex(0x7ff6e0bcb3c8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid   308] close(21 <unfinished ...>
[pid   318] rt_sigprocmask(SIG_SETMASK, [],  <unfinished ...>
[pid   313] <... futex resumed>)        = 0
[pid   308] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   318] <... rt_sigprocmask resumed>NULL, 8) = 0
[pid   313] futex(0x7ff6e0bcb3cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid   308] close(22 <unfinished ...>
[pid   318] futex(0x7ff6e0bcb3c8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid   308] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   318] <... futex resumed>)        = 0
[pid   308] close(23 <unfinished ...>
[pid   318] futex(0x7ff6e0bcb3cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid   308] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   308] close(24./strace-static-x86_64: Process 319 attached
)                   = -1 EBADF (Bad file descriptor)
[pid   308] close(25)                   = -1 EBADF (Bad file descriptor)
[pid   308] close(26)                   = -1 EBADF (Bad file descriptor)
[pid   308] close(27)                   = -1 EBADF (Bad file descriptor)
[pid   308] close(28)                   = -1 EBADF (Bad file descriptor)
[pid   308] close(29 <unfinished ...>
[pid   319] set_robust_list(0x7ff6e0b019a0, 24 <unfinished ...>
[pid   308] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   319] <... set_robust_list resumed>) = 0
[pid   319] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid   308] exit_group(0 <unfinished ...>
[pid   319] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR <unfinished ...>
[pid   308] <... exit_group resumed>)   = ?
[pid   309] <... futex resumed>)        = -1 (errno 18446744073709551359)
[pid   319] <... openat resumed>)       = 3
[pid   319] write(3, "73", 2)           = 2
[pid   319] clone(child_stack=NULL, flags=CLONE_NEWUSER|CLONE_NEWPID <unfinished ...>
[pid   309] +++ exited with 0 +++
[pid   308] +++ exited with 0 +++
[pid   299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4, si_uid=0, si_status=0, si_utime=0, si_stime=2} ---
./strace-static-x86_64: Process 320 attached
[pid   320] set_robust_list(0x7ff6e0b019a0, 24 <unfinished ...>
[pid   299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid   320] <... set_robust_list resumed>) = 0
[pid   320] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid   320] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 3
[pid   299] <... clone resumed>, child_tidptr=0x5555570c7690) = 6
[   22.935459][  T311] R13: 00007ff6e0b01210 R14: 0000000000000002 R15: 00007ff6e0b9801d
[   22.943276][  T311]  </TASK>
[   22.956511][  T316] FAULT_INJECTION: forcing a failure.
[   22.956511][  T316] name failslab, interval 1, probability 0, space 0, times 0
[   22.978245][  T319] FAULT_INJECTION: forcing a failure.
[   22.978245][  T319] name failslab, interval 1, probability 0, space 0, times 0
[   22.978900][  T316] CPU: 0 PID: 316 Comm: syz-executor338 Not tainted 5.15.119-syzkaller-android13-5.15.119_r00 #0
[   22.992135][  T320] FAULT_INJECTION: forcing a failure.
[   22.992135][  T320] name failslab, interval 1, probability 0, space 0, times 0
[   23.000987][  T316] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023
[   23.001001][  T316] Call Trace:
[   23.001008][  T316]  <TASK>
[   23.001015][  T316]  dump_stack_lvl+0x151/0x1b7
[   23.033820][  T316]  ? io_uring_drop_tctx_refs+0x190/0x190
[   23.039278][  T316]  ? avc_denied+0x1b0/0x1b0
[   23.043619][  T316]  dump_stack+0x15/0x17
[   23.047610][  T316]  should_fail+0x3c6/0x510
[   23.051877][  T316]  __should_failslab+0xa4/0xe0
[   23.056481][  T316]  ? vm_area_dup+0x26/0x230
[   23.061334][  T316]  should_failslab+0x9/0x20
[   23.065754][  T316]  slab_pre_alloc_hook+0x37/0xd0
[   23.070524][  T316]  ? vm_area_dup+0x26/0x230
[   23.074882][  T316]  kmem_cache_alloc+0x44/0x200
[   23.079465][  T316]  vm_area_dup+0x26/0x230
[   23.083629][  T316]  dup_mm+0x81b/0x12c0
[   23.087538][  T316]  ? copy_init_mm+0x20/0x20
[   23.091881][  T316]  copy_mm+0x107/0x1b0
[   23.095780][  T316]  copy_process+0x12bc/0x3260
[   23.100298][  T316]  ? pidfd_show_fdinfo+0x2b0/0x2b0
[   23.105239][  T316]  ? __kasan_check_write+0x14/0x20
[   23.110190][  T316]  kernel_clone+0x21e/0x9e0
[   23.114531][  T316]  ? _raw_spin_unlock_irq+0x4e/0x70
[   23.119563][  T316]  ? create_io_thread+0x1e0/0x1e0
[   23.124513][  T316]  __x64_sys_clone+0x23f/0x290
[   23.129110][  T316]  ? __do_sys_vfork+0x130/0x130
[   23.133800][  T316]  ? __kasan_check_read+0x11/0x20
[   23.138658][  T316]  ? syscall_enter_from_user_mode+0x70/0x1b0
[   23.144471][  T316]  do_syscall_64+0x3d/0xb0
[   23.148728][  T316]  entry_SYSCALL_64_after_hwframe+0x61/0xcb
[   23.154454][  T316] RIP: 0033:0x7ff6e0b41399
[   23.158712][  T316] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
[   23.178148][  T316] RSP: 002b:00007ff6e0b01208 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
./strace-static-x86_64: Process 321 attached
[pid   320] write(3, "73", 2)           = 2
[pid   320] clone(child_stack=NULL, flags=CLONE_NEWUSER|CLONE_NEWPID <unfinished ...>
[pid   315] <... clone resumed>)        = -1 ENOMEM (Cannot allocate memory)
[pid   315] futex(0x7ff6e0bcb3cc, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid   315] futex(0x7ff6e0bcb3c8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid   312] close(3)                    = 0
[pid   312] close(4)                    = -1 EBADF (Bad file descriptor)
[pid   312] close(5)                    = -1 EBADF (Bad file descriptor)
[pid   312] close(6)                    = -1 EBADF (Bad file descriptor)
[pid   312] close(7)                    = -1 EBADF (Bad file descriptor)
[pid   312] close(8)                    = -1 EBADF (Bad file descriptor)
[pid   312] close(9)                    = -1 EBADF (Bad file descriptor)
[pid   312] close(10)                   = -1 EBADF (Bad file descriptor)
[pid   312] close(11)                   = -1 EBADF (Bad file descriptor)
[pid   312] close(12)                   = -1 EBADF (Bad file descriptor)
[pid   312] close(13)                   = -1 EBADF (Bad file descriptor)
[pid   312] close(14)                   = -1 EBADF (Bad file descriptor)
[pid   312] close(15)                   = -1 EBADF (Bad file descriptor)
[pid   312] close(16)                   = -1 EBADF (Bad file descriptor)
[pid   312] close(17)                   = -1 EBADF (Bad file descriptor)
[pid   312] close(18)                   = -1 EBADF (Bad file descriptor)
[pid   312] close(19)                   = -1 EBADF (Bad file descriptor)
[pid   312] close(20)                   = -1 EBADF (Bad file descriptor)
[pid   312] close(21)                   = -1 EBADF (Bad file descriptor)
[pid   312] close(22)                   = -1 EBADF (Bad file descriptor)
[pid   312] close(23)                   = -1 EBADF (Bad file descriptor)
[pid   312] close(24)                   = -1 EBADF (Bad file descriptor)
[pid   312] close(25)                   = -1 EBADF (Bad file descriptor)
[pid   312] close(26)                   = -1 EBADF (Bad file descriptor)
[pid   312] close(27)                   = -1 EBADF (Bad file descriptor)
[pid   312] close(28)                   = -1 EBADF (Bad file descriptor)
[pid   312] close(29)                   = -1 EBADF (Bad file descriptor)
[pid   312] exit_group(0)               = ?
[pid   315] <... futex resumed>)        = ?
[pid   318] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid   315] +++ exited with 0 +++
[pid   312] +++ exited with 0 +++
[pid   302] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=9} ---
[pid   302] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555570c7690) = 4
[   23.186489][  T316] RAX: ffffffffffffffda RBX: 00007ff6e0bcb3c8 RCX: 00007ff6e0b41399
[   23.194287][  T316] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000030000000
[   23.202102][  T316] RBP: 00007ff6e0bcb3c0 R08: 0000000000000000 R09: 0000000000003337
[   23.210027][  T316] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff6e0bcb3cc
[   23.217849][  T316] R13: 00007ff6e0b01210 R14: 0000000000000002 R15: 00007ff6e0b9801d
[   23.225652][  T316]  </TASK>
[   23.228516][  T320] CPU: 1 PID: 320 Comm: syz-executor338 Not tainted 5.15.119-syzkaller-android13-5.15.119_r00 #0
[   23.229629][  T311] ------------[ cut here ]------------
[   23.238836][  T320] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023
[   23.238850][  T320] Call Trace:
[   23.238856][  T320]  <TASK>
[   23.238862][  T320]  dump_stack_lvl+0x151/0x1b7
[   23.244172][  T311] refcount_t: underflow; use-after-free.
[   23.254028][  T320]  ? io_uring_drop_tctx_refs+0x190/0x190
[   23.257297][  T311] WARNING: CPU: 0 PID: 311 at lib/refcount.c:28 refcount_warn_saturate+0x158/0x1a0
[   23.259928][  T320]  dump_stack+0x15/0x17
[   23.264457][  T311] Modules linked in:
[   23.269907][  T320]  should_fail+0x3c6/0x510
[   23.275394][  T311] 
[   23.284492][  T320]  __should_failslab+0xa4/0xe0
[   23.288485][  T311] CPU: 0 PID: 311 Comm: syz-executor338 Not tainted 5.15.119-syzkaller-android13-5.15.119_r00 #0
[   23.292216][  T320]  ? anon_vma_fork+0x1df/0x4e0
[   23.296469][  T311] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023
[   23.298638][  T320]  should_failslab+0x9/0x20
[   23.303334][  T311] RIP: 0010:refcount_warn_saturate+0x158/0x1a0
[   23.313654][  T320]  slab_pre_alloc_hook+0x37/0xd0
[   23.318256][  T311] Code: 04 01 48 c7 c7 c0 93 82 85 e8 44 d7 dd fe 0f 0b eb 8b e8 6b 51 0c ff c6 05 79 34 9f 04 01 48 c7 c7 20 94 82 85 e8 28 d7 dd fe <0f> 0b e9 6c ff ff ff e8 4c 51 0c ff c6 05 5b 34 9f 04 01 48 c7 c7
[   23.328146][  T320]  ? anon_vma_fork+0x1df/0x4e0
[   23.332497][  T311] RSP: 0018:ffffc90000ab7948 EFLAGS: 00010246
[   23.338477][  T320]  kmem_cache_alloc+0x44/0x200
[   23.343278][  T311] 
[   23.362690][  T320]  anon_vma_fork+0x1df/0x4e0
[   23.367291][  T311] RAX: 9b24f227eba88400 RBX: 0000000000000003 RCX: ffff88811ec462c0
[   23.373193][  T320]  dup_mm+0x8c5/0x12c0
[   23.377791][  T311] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
[   23.379964][  T320]  ? copy_init_mm+0x20/0x20
[   23.384397][  T311] RBP: ffffc90000ab7958 R08: ffffffff81573155 R09: 0000000000000003
[   23.392291][  T320]  copy_mm+0x107/0x1b0
[   23.396216][  T311] R10: fffff52000156e84 R11: dffffc0000000001 R12: 1ffff1102393dfd0
[   23.404004][  T320]  copy_process+0x12bc/0x3260
[   23.408341][  T311] R13: ffff88811c9efe80 R14: 0000000000000003 R15: ffff88811ec77181
[   23.416161][  T320]  ? pidfd_show_fdinfo+0x2b0/0x2b0
[   23.420187][  T311] FS:  00007ff6e0b016c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
[   23.428000][  T320]  ? __kasan_check_write+0x14/0x20
[   23.432525][  T311] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   23.440334][  T320]  kernel_clone+0x21e/0x9e0
[   23.445370][  T311] CR2: 00005555570c7690 CR3: 000000011f64f000 CR4: 00000000003506b0
[   23.454141][  T320]  ? _raw_spin_unlock_irq+0x4e/0x70
[   23.459075][  T311] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   23.465504][  T320]  ? create_io_thread+0x1e0/0x1e0
[   23.469830][  T311] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   23.477649][  T320]  __x64_sys_clone+0x23f/0x290
[   23.482775][  T311] Call Trace:
[   23.490599][  T320]  ? __do_sys_vfork+0x130/0x130
[   23.495454][  T311]  <TASK>
[   23.503251][  T320]  ? __kasan_check_read+0x11/0x20
[   23.507849][  T311]  ? show_regs+0x58/0x60
[   23.510972][  T320]  ? syscall_enter_from_user_mode+0x70/0x1b0
[   23.515672][  T311]  ? __warn+0x160/0x2f0
[   23.518442][  T320]  do_syscall_64+0x3d/0xb0
[   23.523306][  T311]  ? refcount_warn_saturate+0x158/0x1a0
[   23.527376][  T320]  entry_SYSCALL_64_after_hwframe+0x61/0xcb
[   23.533300][  T311]  ? report_bug+0x3d9/0x5b0
[   23.537277][  T320] RIP: 0033:0x7ff6e0b41399
[   23.541543][  T311]  ? refcount_warn_saturate+0x158/0x1a0
[   23.546915][  T320] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
[   23.552652][  T311]  ? handle_bug+0x41/0x70
[   23.556978][  T320] RSP: 002b:00007ff6e0b01208 EFLAGS: 00000246
[   23.561236][  T311]  ? exc_invalid_op+0x1b/0x50
[   23.566613][  T320]  ORIG_RAX: 0000000000000038
[   23.566624][  T320] RAX: ffffffffffffffda RBX: 00007ff6e0bcb3c8 RCX: 00007ff6e0b41399
[   23.586069][  T311]  ? asm_exc_invalid_op+0x1b/0x20
[   23.590221][  T320] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000030000000
[   23.596139][  T311]  ? __wake_up_klogd+0xd5/0x110
[   23.600638][  T320] RBP: 00007ff6e0bcb3c0 R08: 0000000000000000 R09: 0000000000003337
./strace-static-x86_64: Process 322 attached
[pid   321] set_robust_list(0x5555570c76a0, 24 <unfinished ...>
[pid   320] <... clone resumed>)        = -1 ENOMEM (Cannot allocate memory)
[pid   316] <... clone resumed>)        = -1 ENOMEM (Cannot allocate memory)
[pid   314] close(29 <unfinished ...>
[pid   313] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid   320] futex(0x7ff6e0bcb3cc, FUTEX_WAKE_PRIVATE, 1000000) = 0
[   23.605256][  T311]  ? refcount_warn_saturate+0x158/0x1a0
[   23.613046][  T320] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff6e0bcb3cc
[   23.613061][  T320] R13: 00007ff6e0b01210 R14: 0000000000000002 R15: 00007ff6e0b9801d
[   23.617910][  T311]  ? refcount_warn_saturate+0x158/0x1a0
[   23.625728][  T320]  </TASK>
[   23.652461][  T319] CPU: 1 PID: 319 Comm: syz-executor338 Not tainted 5.15.119-syzkaller-android13-5.15.119_r00 #0
[   23.659966][  T311]  vm_area_free_no_check+0x123/0x130
[   23.664775][  T319] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023
[   23.664789][  T319] Call Trace:
[   23.664795][  T319]  <TASK>
[   23.664801][  T319]  dump_stack_lvl+0x151/0x1b7
[   23.664823][  T319]  ? io_uring_drop_tctx_refs+0x190/0x190
[   23.667641][  T311]  dup_mm+0xd73/0x12c0
[   23.677968][  T319]  ? avc_denied+0x1b0/0x1b0
[   23.677991][  T319]  dump_stack+0x15/0x17
[   23.683102][  T311]  ? copy_init_mm+0x20/0x20
[   23.693091][  T319]  should_fail+0x3c6/0x510
[   23.696219][  T311]  copy_mm+0x107/0x1b0
[   23.698994][  T319]  __should_failslab+0xa4/0xe0
[   23.703519][  T311]  copy_process+0x12bc/0x3260
[   23.708979][  T319]  ? vm_area_dup+0x26/0x230
[   23.712899][  T311]  ? pidfd_show_fdinfo+0x2b0/0x2b0
[   23.717222][  T319]  should_failslab+0x9/0x20
[   23.721219][  T311]  ? __kasan_check_write+0x14/0x20
[   23.725548][  T319]  slab_pre_alloc_hook+0x37/0xd0
[   23.729804][  T311]  kernel_clone+0x21e/0x9e0
[   23.733709][  T319]  ? vm_area_dup+0x26/0x230
[   23.738311][  T311]  ? _raw_spin_unlock_irq+0x4e/0x70
[   23.742823][  T319]  kmem_cache_alloc+0x44/0x200
[   23.747163][  T311]  ? create_io_thread+0x1e0/0x1e0
[   23.752111][  T319]  vm_area_dup+0x26/0x230
[   23.756451][  T311]  __x64_sys_clone+0x23f/0x290
[   23.761400][  T319]  dup_mm+0x81b/0x12c0
[   23.766183][  T311]  ? __do_sys_vfork+0x130/0x130
[   23.770511][  T319]  ? copy_init_mm+0x20/0x20
[   23.774955][  T311]  ? __kasan_check_read+0x11/0x20
[   23.779970][  T319]  copy_mm+0x107/0x1b0
[   23.784587][  T311]  ? syscall_enter_from_user_mode+0x70/0x1b0
[   23.789432][  T319]  copy_process+0x12bc/0x3260
[   23.793611][  T311]  do_syscall_64+0x3d/0xb0
[   23.798203][  T319]  ? pidfd_show_fdinfo+0x2b0/0x2b0
[   23.802116][  T311]  entry_SYSCALL_64_after_hwframe+0x61/0xcb
[   23.806788][  T319]  ? __kasan_check_write+0x14/0x20
[   23.811147][  T311] RIP: 0033:0x7ff6e0b41399
[   23.815987][  T319]  kernel_clone+0x21e/0x9e0
[   23.819898][  T311] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
[   23.825716][  T319]  ? _raw_spin_unlock_irq+0x4e/0x70
[   23.830224][  T311] RSP: 002b:00007ff6e0b01208 EFLAGS: 00000246
[   23.834473][  T319]  ? create_io_thread+0x1e0/0x1e0
[   23.839595][  T311]  ORIG_RAX: 0000000000000038
[   23.845325][  T319]  __x64_sys_clone+0x23f/0x290
[   23.850272][  T311] RAX: ffffffffffffffda RBX: 00007ff6e0bcb3c8 RCX: 00007ff6e0b41399
[   23.854527][  T319]  ? __do_sys_vfork+0x130/0x130
[   23.858860][  T311] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000030000000
[   23.878425][  T319]  ? __kasan_check_read+0x11/0x20
[   23.883458][  T311] RBP: 00007ff6e0bcb3c0 R08: 0000000000000000 R09: 0000000000003337
[pid   320] futex(0x7ff6e0bcb3c8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid   322] set_robust_list(0x5555570c76a0, 24 <unfinished ...>
[pid   321] <... set_robust_list resumed>) = 0
[pid   316] futex(0x7ff6e0bcb3cc, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid   314] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   311] <... clone resumed>)        = -1 ENOMEM (Cannot allocate memory)
[pid   322] <... set_robust_list resumed>) = 0
[pid   321] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid   316] <... futex resumed>)        = 0
[pid   314] exit_group(0 <unfinished ...>
[pid   322] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid   321] <... prctl resumed>)        = 0
[pid   314] <... exit_group resumed>)   = ?
[pid   322] <... prctl resumed>)        = 0
[pid   321] setpgid(0, 0 <unfinished ...>
[pid   316] +++ exited with 0 +++
[pid   314] +++ exited with 0 +++
[pid   322] setpgid(0, 0 <unfinished ...>
[pid   321] <... setpgid resumed>)      = 0
[pid   322] <... setpgid resumed>)      = 0
[pid   321] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   322] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   321] <... openat resumed>)       = 3
[pid   322] <... openat resumed>)       = 3
[pid   321] write(3, "1000", 4 <unfinished ...>
[pid   322] write(3, "1000", 4 <unfinished ...>
[pid   321] <... write resumed>)        = 4
[pid   322] <... write resumed>)        = 4
[pid   321] close(3 <unfinished ...>
[pid   322] close(3 <unfinished ...>
[pid   321] <... close resumed>)        = 0
[pid   322] <... close resumed>)        = 0
[pid   321] read(200,  <unfinished ...>
[pid   322] read(200,  <unfinished ...>
[pid   321] <... read resumed>"\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x38\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\xc2\x46\x00\x00\x00\x02\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\xaa\xaa\xaa\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00"..., 1000) = 110
[pid   322] <... read resumed>"\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x24\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\x6f\xb5\x00\x00\x00\x01\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\x00\x00\xaa", 1000) = 90
[pid   321] read(200,  <unfinished ...>
[pid   322] read(200,  <unfinished ...>
[pid   321] <... read resumed>"\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x38\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\xc2\x46\x00\x00\x00\x02\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\xaa\xaa\xaa\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00"..., 1000) = 110
[pid   322] <... read resumed>"\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x38\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\xc2\x46\x00\x00\x00\x02\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\xaa\xaa\xaa\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00"..., 1000) = 110
[pid   321] read(200,  <unfinished ...>
[pid   322] read(200,  <unfinished ...>
[pid   321] <... read resumed>0x7ffd00327490, 1000) = -1 EAGAIN (Resource temporarily unavailable)
[pid   322] <... read resumed>"\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x38\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\xc2\x46\x00\x00\x00\x02\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\xaa\xaa\xaa\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00"..., 1000) = 110
[pid   321] futex(0x7ff6e0bcb3cc, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid   322] read(200,  <unfinished ...>
[pid   321] <... futex resumed>)        = 0
[pid   322] <... read resumed>"\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x38\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\xc2\x46\x00\x00\x00\x02\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\xaa\xaa\xaa\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00"..., 1000) = 110
[pid   321] rt_sigaction(SIGRT_1, {sa_handler=0x7ff6e0b68fa0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7ff6e0b5a620},  <unfinished ...>
[pid   322] read(200,  <unfinished ...>
[pid   321] <... rt_sigaction resumed>NULL, 8) = 0
[pid   322] <... read resumed>0x7ffd00327490, 1000) = -1 EAGAIN (Resource temporarily unavailable)
[pid   321] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1],  <unfinished ...>
[pid   322] futex(0x7ff6e0bcb3cc, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid   321] <... rt_sigprocmask resumed>NULL, 8) = 0
[pid   322] <... futex resumed>)        = 0
[pid   321] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid   322] rt_sigaction(SIGRT_1, {sa_handler=0x7ff6e0b68fa0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7ff6e0b5a620},  <unfinished ...>
[pid   321] <... mmap resumed>)         = 0x7ff6e0ae1000
[pid   322] <... rt_sigaction resumed>NULL, 8) = 0
[pid   321] mprotect(0x7ff6e0ae2000, 131072, PROT_READ|PROT_WRITE <unfinished ...>
[pid   322] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1],  <unfinished ...>
[pid   321] <... mprotect resumed>)     = 0
[pid   322] <... rt_sigprocmask resumed>NULL, 8) = 0
[pid   321] rt_sigprocmask(SIG_BLOCK, ~[],  <unfinished ...>
[pid   322] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid   321] <... rt_sigprocmask resumed>[], 8) = 0
[pid   322] <... mmap resumed>)         = 0x7ff6e0ae1000
[pid   321] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7ff6e0b01990, parent_tid=0x7ff6e0b01990, exit_signal=0, stack=0x7ff6e0ae1000, stack_size=0x20300, tls=0x7ff6e0b016c0} <unfinished ...>
[pid   322] mprotect(0x7ff6e0ae2000, 131072, PROT_READ|PROT_WRITE) = 0
[pid   321] <... clone3 resumed> => {parent_tid=[7]}, 88) = 7
[pid   322] rt_sigprocmask(SIG_BLOCK, ~[],  <unfinished ...>
[pid   321] rt_sigprocmask(SIG_SETMASK, [],  <unfinished ...>
[pid   322] <... rt_sigprocmask resumed>[], 8) = 0
[pid   321] <... rt_sigprocmask resumed>NULL, 8) = 0
[pid   322] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7ff6e0b01990, parent_tid=0x7ff6e0b01990, exit_signal=0, stack=0x7ff6e0ae1000, stack_size=0x20300, tls=0x7ff6e0b016c0} <unfinished ...>
[pid   321] futex(0x7ff6e0bcb3c8, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid   322] <... clone3 resumed> => {parent_tid=[5]}, 88) = 5
[pid   321] futex(0x7ff6e0bcb3cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid   322] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid   322] futex(0x7ff6e0bcb3c8, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid   322] futex(0x7ff6e0bcb3cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid   311] futex(0x7ff6e0bcb3cc, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid   311] futex(0x7ff6e0bcb3c8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 324 attached
 <unfinished ...>
[pid   324] set_robust_list(0x7ff6e0b019a0, 24) = 0
[pid   324] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid   324] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 3
[pid   324] write(3, "73", 2)           = 2
[   23.889328][  T319]  ? syscall_enter_from_user_mode+0x70/0x1b0
[   23.894215][  T311] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff6e0bcb3cc
[   23.898704][  T319]  do_syscall_64+0x3d/0xb0
[   23.903313][  T311] R13: 00007ff6e0b01210 R14: 0000000000000002 R15: 00007ff6e0b9801d
[   23.911127][  T319]  entry_SYSCALL_64_after_hwframe+0x61/0xcb
[   23.915817][  T311]  </TASK>
[   23.923699][  T319] RIP: 0033:0x7ff6e0b41399
[pid   324] clone(child_stack=NULL, flags=CLONE_NEWUSER|CLONE_NEWPID <unfinished ...>
[pid   321] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid   322] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[   23.923718][  T319] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
[   23.928566][  T311] ---[ end trace bcd46918c74c0ce3 ]---
[   23.936388][  T319] RSP: 002b:00007ff6e0b01208 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
[   23.961965][  T324] FAULT_INJECTION: forcing a failure.
[   23.961965][  T324] name failslab, interval 1, probability 0, space 0, times 0
[   23.962057][  T319] RAX: ffffffffffffffda RBX: 00007ff6e0bcb3c8 RCX: 00007ff6e0b41399
[   24.028113][  T319] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000030000000
[   24.036006][  T319] RBP: 00007ff6e0bcb3c0 R08: 0000000000000000 R09: 0000000000003337
[   24.043823][  T319] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff6e0bcb3cc
[   24.051634][  T319] R13: 00007ff6e0b01210 R14: 0000000000000002 R15: 00007ff6e0b9801d
[   24.059453][  T319]  </TASK>
[   24.062395][  T324] CPU: 0 PID: 324 Comm: syz-executor338 Tainted: G        W         5.15.119-syzkaller-android13-5.15.119_r00 #0
[   24.070157][  T323] general protection fault, probably for non-canonical address 0xe3d8c15820000001: 0000 [#1] PREEMPT SMP KASAN
[   24.074024][  T324] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023
[   24.085566][  T323] KASAN: maybe wild-memory-access in range [0x1ec62ac100000008-0x1ec62ac10000000f]
[   24.095461][  T324] Call Trace:
[   24.095470][  T324]  <TASK>
[   24.104571][  T323] CPU: 1 PID: 323 Comm: syz-executor338 Tainted: G        W         5.15.119-syzkaller-android13-5.15.119_r00 #0
[   24.107698][  T324]  dump_stack_lvl+0x151/0x1b7
[   24.110471][  T323] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023
[   24.122193][  T324]  ? io_uring_drop_tctx_refs+0x190/0x190
[   24.126703][  T323] RIP: 0010:__rb_insert_augmented+0x91/0x610
[   24.136599][  T324]  dump_stack+0x15/0x17
[   24.142066][  T323] Code: 00 74 08 4c 89 ef e8 3e 71 2b ff 49 8b 45 00 a8 01 0f 85 60 05 00 00 48 89 5d a0 48 89 45 c0 48 8d 58 08 49 89 de 49 c1 ee 03 <43> 80 3c 26 00 74 08 48 89 df e8 10 71 2b ff 48 89 d8 48 8b 1b 4c
[   24.147879][  T324]  should_fail+0x3c6/0x510
[   24.151873][  T323] RSP: 0018:ffffc90000b078d8 EFLAGS: 00010202
[   24.171325][  T324]  __should_failslab+0xa4/0xe0
[   24.175568][  T323] 
[   24.175575][  T323] RAX: 1ec62ac100000000 RBX: 1ec62ac100000008 RCX: dffffc0000000000
[   24.181469][  T324]  ? anon_vma_fork+0xf7/0x4e0
[   24.186067][  T323] RDX: ffffffff81a46220 RSI: ffff88810be68920 RDI: ffff88811c99a058
[   24.188238][  T324]  should_failslab+0x9/0x20
[   24.196051][  T323] RBP: ffffc90000b07940 R08: dffffc0000000000 R09: ffff88811c99a060
[   24.200563][  T324]  slab_pre_alloc_hook+0x37/0xd0
[   24.208373][  T323] R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000
[   24.212715][  T324]  ? anon_vma_fork+0xf7/0x4e0
[   24.220528][  T323] R13: ffff88811eab0e34 R14: 03d8c55820000001 R15: ffff88811eca3620
[   24.225307][  T324]  kmem_cache_alloc+0x44/0x200
[   24.233128][  T323] FS:  00007ff6e0b016c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
[   24.237656][  T324]  anon_vma_fork+0xf7/0x4e0
[   24.245448][  T323] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   24.250040][  T324]  ? anon_vma_name+0x43/0x70
[   24.258799][  T323] CR2: 00007ffd00327788 CR3: 000000011f071000 CR4: 00000000003506a0
[   24.263142][  T324]  ? vm_area_dup+0x17a/0x230
[   24.269672][  T323] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   24.274100][  T324]  dup_mm+0x8c5/0x12c0
[   24.281908][  T323] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   24.286339][  T324]  ? copy_init_mm+0x20/0x20
[   24.294152][  T323] Call Trace:
[   24.294161][  T323]  <TASK>
[   24.298055][  T324]  copy_mm+0x107/0x1b0
[   24.305971][  T323]  ? __die_body+0x62/0xb0
[   24.310311][  T324]  copy_process+0x12bc/0x3260
[   24.313431][  T323]  ? die_addr+0x9f/0xd0
[   24.316213][  T324]  ? pidfd_show_fdinfo+0x2b0/0x2b0
[   24.320116][  T323]  ? exc_general_protection+0x311/0x4b0
[   24.324281][  T324]  ? __kasan_check_write+0x14/0x20
[   24.328798][  T323]  ? asm_exc_general_protection+0x27/0x30
[   24.332791][  T324]  kernel_clone+0x21e/0x9e0
[   24.337734][  T323]  ? anon_vma_interval_tree_iter_next+0x390/0x390
[   24.343120][  T324]  ? _raw_spin_unlock_irq+0x4e/0x70
[   24.348063][  T323]  ? __rb_insert_augmented+0x91/0x610
[   24.353617][  T324]  ? create_io_thread+0x1e0/0x1e0
[   24.357958][  T323]  ? anon_vma_interval_tree_iter_next+0x390/0x390
[   24.364208][  T324]  __x64_sys_clone+0x23f/0x290
[   24.369244][  T323]  vma_interval_tree_insert_after+0x2be/0x2d0
[   24.374451][  T324]  ? __do_sys_vfork+0x130/0x130
[   24.379312][  T323]  dup_mm+0xa11/0x12c0
[   24.385558][  T324]  ? __kasan_check_read+0x11/0x20
[   24.390162][  T323]  ? copy_init_mm+0x20/0x20
[   24.396058][  T324]  ? syscall_enter_from_user_mode+0x70/0x1b0
[   24.400752][  T323]  copy_mm+0x107/0x1b0
[   24.404654][  T324]  do_syscall_64+0x3d/0xb0
[   24.409511][  T323]  copy_process+0x12bc/0x3260
[   24.413849][  T324]  entry_SYSCALL_64_after_hwframe+0x61/0xcb
[   24.419672][  T323]  ? pidfd_show_fdinfo+0x2b0/0x2b0
[   24.423570][  T324] RIP: 0033:0x7ff6e0b41399
[   24.427828][  T323]  ? __kasan_check_write+0x14/0x20
[   24.432340][  T324] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
[   24.438067][  T323]  kernel_clone+0x21e/0x9e0
[   24.443013][  T324] RSP: 002b:00007ff6e0b01208 EFLAGS: 00000246
[   24.447269][  T323]  ? _raw_spin_unlock_irq+0x4e/0x70
[   24.452212][  T324]  ORIG_RAX: 0000000000000038
[   24.471763][  T323]  ? create_io_thread+0x1e0/0x1e0
[   24.476102][  T324] RAX: ffffffffffffffda RBX: 00007ff6e0bcb3c8 RCX: 00007ff6e0b41399
[   24.482010][  T323]  __x64_sys_clone+0x23f/0x290
[   24.487039][  T324] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000030000000
[   24.491551][  T323]  ? __do_sys_vfork+0x130/0x130
[   24.496412][  T324] RBP: 00007ff6e0bcb3c0 R08: 0000000000000000 R09: 0000000000003337
[   24.504230][  T323]  ? __kasan_check_read+0x11/0x20
[   24.508825][  T324] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff6e0bcb3cc
./strace-static-x86_64: Process 323 attached
[pid   319] <... clone resumed>)        = -1 ENOMEM (Cannot allocate memory)
[pid   310] close(3 <unfinished ...>
[pid   323] set_robust_list(0x7ff6e0b019a0, 24 <unfinished ...>
[pid   318] close(3 <unfinished ...>
[pid   310] <... close resumed>)        = 0
[pid   303] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=2} ---
[pid   323] <... set_robust_list resumed>) = 0
[pid   318] <... close resumed>)        = 0
[pid   310] close(4 <unfinished ...>
[pid   323] rt_sigprocmask(SIG_SETMASK, [],  <unfinished ...>
[pid   318] close(4 <unfinished ...>
[pid   310] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   323] <... rt_sigprocmask resumed>NULL, 8) = 0
[pid   318] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   310] close(5 <unfinished ...>
[pid   303] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid   323] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR <unfinished ...>
[pid   318] close(5 <unfinished ...>
[pid   310] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   323] <... openat resumed>)       = 3
[pid   318] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   310] close(6 <unfinished ...>
[pid   303] <... clone resumed>, child_tidptr=0x5555570c7690) = 4
[pid   323] write(3, "73", 2 <unfinished ...>
[pid   318] close(6 <unfinished ...>
[pid   310] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   323] <... write resumed>)        = 2
[pid   318] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   310] close(7 <unfinished ...>
[pid   323] clone(child_stack=NULL, flags=CLONE_NEWUSER|CLONE_NEWPID <unfinished ...>
[pid   318] close(7 <unfinished ...>
[pid   310] <... close resumed>)        = -1 EBADF (Bad file descriptor)
./strace-static-x86_64: Process 326 attached
[pid   319] futex(0x7ff6e0bcb3cc, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid   318] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   310] close(8 <unfinished ...>
[pid   326] set_robust_list(0x5555570c76a0, 24) = 0
[pid   326] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   326] setpgid(0, 0 <unfinished ...>
[pid   313] close(3 <unfinished ...>
[pid   326] <... setpgid resumed>)      = 0
[pid   313] <... close resumed>)        = 0
[pid   326] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   313] close(4 <unfinished ...>
[pid   326] <... openat resumed>)       = 3
[pid   313] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   326] write(3, "1000", 4 <unfinished ...>
[pid   313] close(5 <unfinished ...>
[pid   326] <... write resumed>)        = 4
[pid   313] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   326] close(3 <unfinished ...>
[pid   313] close(6 <unfinished ...>
[pid   326] <... close resumed>)        = 0
[pid   313] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   326] read(200,  <unfinished ...>
[pid   313] close(7 <unfinished ...>
[pid   326] <... read resumed>"\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x24\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\x6f\xb5\x00\x00\x00\x01\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\x00\x00\xaa", 1000) = 90
[pid   313] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   326] read(200,  <unfinished ...>
[pid   313] close(8 <unfinished ...>
[pid   326] <... read resumed>"\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x38\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\xc2\x46\x00\x00\x00\x02\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\xaa\xaa\xaa\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00"..., 1000) = 110
[pid   313] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   326] read(200,  <unfinished ...>
[pid   313] close(9 <unfinished ...>
[pid   326] <... read resumed>"\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x38\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\xc2\x46\x00\x00\x00\x02\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\xaa\xaa\xaa\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00"..., 1000) = 110
[pid   313] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   326] read(200,  <unfinished ...>
[pid   313] close(10 <unfinished ...>
[pid   326] <... read resumed>"\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x38\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\xc2\x46\x00\x00\x00\x02\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\xaa\xaa\xaa\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00"..., 1000) = 110
[pid   313] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   326] read(200,  <unfinished ...>
[pid   313] close(11 <unfinished ...>
[pid   326] <... read resumed>0x7ffd00327490, 1000) = -1 EAGAIN (Resource temporarily unavailable)
[pid   313] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   326] futex(0x7ff6e0bcb3cc, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid   313] close(12 <unfinished ...>
[pid   326] <... futex resumed>)        = 0
[pid   313] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   326] rt_sigaction(SIGRT_1, {sa_handler=0x7ff6e0b68fa0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7ff6e0b5a620},  <unfinished ...>
[pid   313] close(13 <unfinished ...>
[pid   326] <... rt_sigaction resumed>NULL, 8) = 0
[pid   313] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   326] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1],  <unfinished ...>
[pid   313] close(14 <unfinished ...>
[pid   326] <... rt_sigprocmask resumed>NULL, 8) = 0
[pid   313] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   326] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 <unfinished ...>
[pid   313] close(15 <unfinished ...>
[pid   326] <... mmap resumed>)         = 0x7ff6e0ae1000
[pid   313] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   326] mprotect(0x7ff6e0ae2000, 131072, PROT_READ|PROT_WRITE <unfinished ...>
[pid   313] close(16 <unfinished ...>
[pid   326] <... mprotect resumed>)     = 0
[pid   313] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   326] rt_sigprocmask(SIG_BLOCK, ~[],  <unfinished ...>
[pid   313] close(17 <unfinished ...>
[pid   326] <... rt_sigprocmask resumed>[], 8) = 0
[pid   313] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   326] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7ff6e0b01990, parent_tid=0x7ff6e0b01990, exit_signal=0, stack=0x7ff6e0ae1000, stack_size=0x20300, tls=0x7ff6e0b016c0} <unfinished ...>
[pid   319] <... futex resumed>)        = 0
[pid   313] close(18 <unfinished ...>
[pid   319] futex(0x7ff6e0bcb3c8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid   313] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   326] <... clone3 resumed> => {parent_tid=[5]}, 88) = 5
[pid   313] close(19 <unfinished ...>
[pid   326] rt_sigprocmask(SIG_SETMASK, [],  <unfinished ...>
[pid   313] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   326] <... rt_sigprocmask resumed>NULL, 8) = 0
[pid   313] close(20 <unfinished ...>
[pid   326] futex(0x7ff6e0bcb3c8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid   313] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   326] <... futex resumed>)        = 0
[pid   313] close(21 <unfinished ...>
[pid   326] futex(0x7ff6e0bcb3cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid   313] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   313] close(22)                   = -1 EBADF (Bad file descriptor)
[pid   313] close(23)                   = -1 EBADF (Bad file descriptor)
[pid   313] close(24)                   = -1 EBADF (Bad file descriptor)
[pid   313] close(25)                   = -1 EBADF (Bad file descriptor)
[pid   313] close(26)                   = -1 EBADF (Bad file descriptor)
[pid   313] close(27)                   = -1 EBADF (Bad file descriptor)
[pid   313] close(28)                   = -1 EBADF (Bad file descriptor)
[pid   313] close(29)                   = -1 EBADF (Bad file descriptor)
[pid   313] exit_group(0 <unfinished ...>
[pid   319] <... futex resumed>)        = ?
[pid   313] <... exit_group resumed>)   = ?
[pid   319] +++ exited with 0 +++
[pid   318] close(8)                    = -1 EBADF (Bad file descriptor)
[pid   318] close(9)                    = -1 EBADF (Bad file descriptor)
[pid   318] close(10)                   = -1 EBADF (Bad file descriptor)
[pid   318] close(11)                   = -1 EBADF (Bad file descriptor)
[pid   318] close(12)                   = -1 EBADF (Bad file descriptor)
[pid   318] close(13)                   = -1 EBADF (Bad file descriptor)
[pid   318] close(14)                   = -1 EBADF (Bad file descriptor)
[pid   318] close(15)                   = -1 EBADF (Bad file descriptor)
[pid   318] close(16)                   = -1 EBADF (Bad file descriptor)
[pid   318] close(17)                   = -1 EBADF (Bad file descriptor)
[pid   318] close(18)                   = -1 EBADF (Bad file descriptor)
[pid   318] close(19)                   = -1 EBADF (Bad file descriptor)
[pid   318] close(20)                   = -1 EBADF (Bad file descriptor)
[pid   318] close(21)                   = -1 EBADF (Bad file descriptor)
[pid   318] close(22)                   = -1 EBADF (Bad file descriptor)
[pid   318] close(23)                   = -1 EBADF (Bad file descriptor)
[pid   318] close(24)                   = -1 EBADF (Bad file descriptor)
[pid   318] close(25)                   = -1 EBADF (Bad file descriptor)
[pid   318] close(26)                   = -1 EBADF (Bad file descriptor)
[pid   318] close(27)                   = -1 EBADF (Bad file descriptor)
[pid   318] close(28)                   = -1 EBADF (Bad file descriptor)
[pid   318] close(29)                   = -1 EBADF (Bad file descriptor)
[pid   318] exit_group(0)               = ?
[pid   310] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   310] close(9)                    = -1 EBADF (Bad file descriptor)
[pid   310] close(10)                   = -1 EBADF (Bad file descriptor)
[pid   310] close(11)                   = -1 EBADF (Bad file descriptor)
[pid   310] close(12)                   = -1 EBADF (Bad file descriptor)
[pid   310] close(13)                   = -1 EBADF (Bad file descriptor)
[pid   310] close(14)                   = -1 EBADF (Bad file descriptor)
[pid   310] close(15)                   = -1 EBADF (Bad file descriptor)
[pid   310] close(16)                   = -1 EBADF (Bad file descriptor)
[pid   310] close(17)                   = -1 EBADF (Bad file descriptor)
[pid   310] close(18)                   = -1 EBADF (Bad file descriptor)
[pid   310] close(19)                   = -1 EBADF (Bad file descriptor)
[pid   310] close(20)                   = -1 EBADF (Bad file descriptor)
[pid   310] close(21)                   = -1 EBADF (Bad file descriptor)
[   24.516635][  T323]  ? syscall_enter_from_user_mode+0x70/0x1b0
[   24.521319][  T324] R13: 00007ff6e0b01210 R14: 0000000000000002 R15: 00007ff6e0b9801d
[   24.529137][  T323]  do_syscall_64+0x3d/0xb0
[   24.534000][  T324]  </TASK>
[   24.541817][  T323]  entry_SYSCALL_64_after_hwframe+0x61/0xcb
[   24.569510][  T323] RIP: 0033:0x7ff6e0b41399
[   24.573760][  T323] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
[pid   310] close(22)                   = -1 EBADF (Bad file descriptor)
[pid   310] close(23)                   = -1 EBADF (Bad file descriptor)
[pid   310] close(24)                   = -1 EBADF (Bad file descriptor)
[pid   310] close(25)                   = -1 EBADF (Bad file descriptor)
[pid   310] close(26)                   = -1 EBADF (Bad file descriptor)
[pid   310] close(27)                   = -1 EBADF (Bad file descriptor)
[pid   310] close(28)                   = -1 EBADF (Bad file descriptor)
[pid   310] close(29)                   = -1 EBADF (Bad file descriptor)
[pid   310] exit_group(0 <unfinished ...>
[pid   311] <... futex resumed>)        = ?
[pid   310] <... exit_group resumed>)   = ?
[pid   311] +++ exited with 0 +++
./strace-static-x86_64: Process 327 attached
[pid   327] set_robust_list(0x7ff6e0b019a0, 24) = 0
[pid   327] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid   327] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 3
[pid   327] write(3, "73", 2)           = 2
[pid   327] clone(child_stack=NULL, flags=CLONE_NEWUSER|CLONE_NEWPID <unfinished ...>
[pid   320] <... futex resumed>)        = ?
[pid   326] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[   24.593205][  T323] RSP: 002b:00007ff6e0b01208 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
[   24.601448][  T323] RAX: ffffffffffffffda RBX: 00007ff6e0bcb3c8 RCX: 00007ff6e0b41399
[   24.609263][  T323] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000030000000
[   24.617066][  T323] RBP: 00007ff6e0bcb3c0 R08: 0000000000000000 R09: 0000000000003337
[   24.624875][  T323] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff6e0bcb3cc
[   24.632689][  T323] R13: 00007ff6e0b01210 R14: 0000000000000002 R15: 00007ff6e0b9801d
[   24.640503][  T323]  </TASK>
[   24.643364][  T323] Modules linked in:
[   24.647668][  T323] ---[ end trace bcd46918c74c0ce4 ]---
[   24.653471][  T323] RIP: 0010:__rb_insert_augmented+0x91/0x610
[   24.659316][  T323] Code: 00 74 08 4c 89 ef e8 3e 71 2b ff 49 8b 45 00 a8 01 0f 85 60 05 00 00 48 89 5d a0 48 89 45 c0 48 8d 58 08 49 89 de 49 c1 ee 03 <43> 80 3c 26 00 74 08 48 89 df e8 10 71 2b ff 48 89 d8 48 8b 1b 4c
[   24.679158][  T323] RSP: 0018:ffffc90000b078d8 EFLAGS: 00010202
[   24.685185][  T323] RAX: 1ec62ac100000000 RBX: 1ec62ac100000008 RCX: dffffc0000000000
[pid   322] close(3)                    = 0
[pid   322] close(4)                    = -1 EBADF (Bad file descriptor)
[pid   322] close(5)                    = -1 EBADF (Bad file descriptor)
[pid   322] close(6)                    = -1 EBADF (Bad file descriptor)
[pid   322] close(7)                    = -1 EBADF (Bad file descriptor)
[pid   322] close(8)                    = -1 EBADF (Bad file descriptor)
[pid   322] close(9)                    = -1 EBADF (Bad file descriptor)
[pid   322] close(10)                   = -1 EBADF (Bad file descriptor)
[pid   322] close(11)                   = -1 EBADF (Bad file descriptor)
[pid   322] close(12)                   = -1 EBADF (Bad file descriptor)
[pid   322] close(13)                   = -1 EBADF (Bad file descriptor)
[pid   322] close(14)                   = -1 EBADF (Bad file descriptor)
[pid   322] close(15)                   = -1 EBADF (Bad file descriptor)
[pid   322] close(16)                   = -1 EBADF (Bad file descriptor)
[pid   322] close(17)                   = -1 EBADF (Bad file descriptor)
[pid   322] close(18)                   = -1 EBADF (Bad file descriptor)
[pid   322] close(19)                   = -1 EBADF (Bad file descriptor)
[pid   322] close(20)                   = -1 EBADF (Bad file descriptor)
[pid   322] close(21)                   = -1 EBADF (Bad file descriptor)
[pid   322] close(22)                   = -1 EBADF (Bad file descriptor)
[pid   322] close(23)                   = -1 EBADF (Bad file descriptor)
[pid   322] close(24)                   = -1 EBADF (Bad file descriptor)
[pid   322] close(25)                   = -1 EBADF (Bad file descriptor)
[pid   322] close(26)                   = -1 EBADF (Bad file descriptor)
[pid   322] close(27)                   = -1 EBADF (Bad file descriptor)
[pid   322] close(28)                   = -1 EBADF (Bad file descriptor)
[pid   322] close(29)                   = -1 EBADF (Bad file descriptor)
[pid   322] exit_group(0)               = ?
[   24.693474][  T323] RDX: ffffffff81a46220 RSI: ffff88810be68920 RDI: ffff88811c99a058
[   24.701678][  T323] RBP: ffffc90000b07940 R08: dffffc0000000000 R09: ffff88811c99a060
[   24.709475][  T323] R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000
[   24.717605][  T323] R13: ffff88811eab0e34 R14: 03d8c55820000001 R15: ffff88811eca3620
[   24.725632][  T323] FS:  00007ff6e0b016c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
[   24.734419][  T323] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   24.740815][  T323] CR2: 00007ffd00327788 CR3: 000000011f071000 CR4: 00000000003506a0
[   24.748664][  T323] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   24.756695][  T323] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   24.764667][  T323] Kernel panic - not syncing: Fatal exception
[   24.770800][  T323] Kernel Offset: disabled
[   24.774940][  T323] Rebooting in 86400 seconds..