./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1660507987 <...> Warning: Permanently added '10.128.0.209' (ED25519) to the list of known hosts. execve("./syz-executor1660507987", ["./syz-executor1660507987"], 0x7ffe3d124aa0 /* 10 vars */) = 0 brk(NULL) = 0x55555d6c4000 brk(0x55555d6c4d40) = 0x55555d6c4d40 arch_prctl(ARCH_SET_FS, 0x55555d6c43c0) = 0 set_tid_address(0x55555d6c4690) = 5073 set_robust_list(0x55555d6c46a0, 24) = 0 rseq(0x55555d6c4ce0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor1660507987", 4096) = 28 getrandom("\x21\x1d\xe0\x62\x14\x86\x4b\x47", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55555d6c4d40 brk(0x55555d6e5d40) = 0x55555d6e5d40 brk(0x55555d6e6000) = 0x55555d6e6000 mprotect(0x7f3e2f6d7000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555d6c4690) = 5074 ./strace-static-x86_64: Process 5074 attached [pid 5073] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] set_robust_list(0x55555d6c46a0, 24) = 0 ./strace-static-x86_64: Process 5075 attached [pid 5074] mkdir("./syzkaller.byJ8C5", 0700 [pid 5073] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5075 [pid 5075] set_robust_list(0x55555d6c46a0, 24 [pid 5073] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5075] <... set_robust_list resumed>) = 0 ./strace-static-x86_64: Process 5076 attached [pid 5073] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5076 [pid 5075] getrandom( [pid 5074] <... mkdir resumed>) = 0 [pid 5073] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] chmod("./syzkaller.byJ8C5", 0777) = 0 [pid 5074] chdir("./syzkaller.byJ8C5"./strace-static-x86_64: Process 5077 attached [pid 5076] set_robust_list(0x55555d6c46a0, 24 [pid 5075] <... getrandom resumed>"\x21\xbc\xa2\xf9\x8a\x37\x9c\xd9", 8, GRND_NONBLOCK) = 8 [pid 5073] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5077 [pid 5077] set_robust_list(0x55555d6c46a0, 24 [pid 5076] <... set_robust_list resumed>) = 0 [pid 5075] mkdir("./syzkaller.RlBgFv", 0700 [pid 5074] <... chdir resumed>) = 0 [pid 5073] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5077] <... set_robust_list resumed>) = 0 [pid 5076] mkdir("./syzkaller.ut8bcX", 0700 [pid 5075] <... mkdir resumed>) = 0 [pid 5074] mkdir("./0", 0777./strace-static-x86_64: Process 5078 attached [pid 5077] mkdir("./syzkaller.HOsycJ", 0700 [pid 5073] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5078 [pid 5078] set_robust_list(0x55555d6c46a0, 24) = 0 [pid 5077] <... mkdir resumed>) = 0 [pid 5076] <... mkdir resumed>) = 0 [pid 5075] chmod("./syzkaller.RlBgFv", 0777 [pid 5074] <... mkdir resumed>) = 0 [pid 5077] chmod("./syzkaller.HOsycJ", 0777 [pid 5076] chmod("./syzkaller.ut8bcX", 0777 [pid 5078] mkdir("./syzkaller.Jmld95", 0700 [pid 5077] <... chmod resumed>) = 0 [pid 5076] <... chmod resumed>) = 0 [pid 5075] <... chmod resumed>) = 0 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5077] chdir("./syzkaller.HOsycJ" [pid 5076] chdir("./syzkaller.ut8bcX" [pid 5077] <... chdir resumed>) = 0 [pid 5076] <... chdir resumed>) = 0 [pid 5077] mkdir("./0", 0777 [pid 5076] mkdir("./0", 0777 [pid 5075] chdir("./syzkaller.RlBgFv") = 0 [pid 5075] mkdir("./0", 0777 [pid 5076] <... mkdir resumed>) = 0 [pid 5075] <... mkdir resumed>) = 0 ./strace-static-x86_64: Process 5079 attached [pid 5078] <... mkdir resumed>) = 0 [pid 5077] <... mkdir resumed>) = 0 [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5079] set_robust_list(0x55555d6c46a0, 24 [pid 5078] chmod("./syzkaller.Jmld95", 0777 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5079 ./strace-static-x86_64: Process 5080 attached [pid 5080] set_robust_list(0x55555d6c46a0, 24) = 0 ./strace-static-x86_64: Process 5081 attached [pid 5079] <... set_robust_list resumed>) = 0 [pid 5078] <... chmod resumed>) = 0 [pid 5081] set_robust_list(0x55555d6c46a0, 24 [pid 5079] chdir("./0" [pid 5078] chdir("./syzkaller.Jmld95" [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5080 [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5082 ./strace-static-x86_64: Process 5082 attached [pid 5081] <... set_robust_list resumed>) = 0 [pid 5080] chdir("./0" [pid 5079] <... chdir resumed>) = 0 [pid 5078] <... chdir resumed>) = 0 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5081 [pid 5081] chdir("./0" [pid 5079] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5078] mkdir("./0", 0777 [pid 5082] set_robust_list(0x55555d6c46a0, 24 [pid 5080] <... chdir resumed>) = 0 [pid 5079] <... prctl resumed>) = 0 [pid 5081] <... chdir resumed>) = 0 [pid 5082] <... set_robust_list resumed>) = 0 [pid 5080] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5079] setpgid(0, 0 [pid 5081] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5082] chdir("./0" [pid 5080] <... prctl resumed>) = 0 [pid 5081] <... prctl resumed>) = 0 [pid 5082] <... chdir resumed>) = 0 [pid 5079] <... setpgid resumed>) = 0 [pid 5078] <... mkdir resumed>) = 0 [pid 5080] setpgid(0, 0 [pid 5081] setpgid(0, 0 [pid 5082] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5080] <... setpgid resumed>) = 0 [pid 5079] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5081] <... setpgid resumed>) = 0 [pid 5082] <... prctl resumed>) = 0 [pid 5080] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5082] setpgid(0, 0 [pid 5080] <... openat resumed>) = 3 [pid 5082] <... setpgid resumed>) = 0 [pid 5081] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5082] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5079] <... openat resumed>) = 3 ./strace-static-x86_64: Process 5083 attached [pid 5080] write(3, "1000", 4 [pid 5083] set_robust_list(0x55555d6c46a0, 24 [pid 5081] <... openat resumed>) = 3 [pid 5080] <... write resumed>) = 4 [pid 5079] write(3, "1000", 4 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5083 [pid 5083] <... set_robust_list resumed>) = 0 [pid 5081] write(3, "1000", 4 [pid 5082] <... openat resumed>) = 3 [pid 5080] close(3 [pid 5079] <... write resumed>) = 4 [pid 5083] chdir("./0" [pid 5081] <... write resumed>) = 4 [pid 5080] <... close resumed>) = 0 [pid 5079] close(3 [pid 5083] <... chdir resumed>) = 0 [pid 5081] close(3 [pid 5080] symlink("/dev/binderfs", "./binderfs" [pid 5079] <... close resumed>) = 0 [pid 5082] write(3, "1000", 4 [pid 5083] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5081] <... close resumed>) = 0 [pid 5082] <... write resumed>) = 4 [pid 5083] <... prctl resumed>) = 0 [pid 5081] symlink("/dev/binderfs", "./binderfs" [pid 5079] symlink("/dev/binderfs", "./binderfs" [pid 5083] setpgid(0, 0 [pid 5082] close(3) = 0 [pid 5083] <... setpgid resumed>) = 0 [pid 5082] symlink("/dev/binderfs", "./binderfs" [pid 5083] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5080] <... symlink resumed>) = 0 [pid 5081] <... symlink resumed>) = 0 [pid 5079] <... symlink resumed>) = 0 [pid 5081] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5079] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5080] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5081] <... futex resumed>) = 0 [pid 5080] <... futex resumed>) = 0 [pid 5079] <... futex resumed>) = 0 [pid 5081] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5080] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5079] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5083] <... openat resumed>) = 3 [pid 5081] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5080] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5079] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5083] write(3, "1000", 4 [pid 5082] <... symlink resumed>) = 0 [pid 5079] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5080] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5083] <... write resumed>) = 4 [pid 5081] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5082] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5083] close(3 [pid 5081] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5082] <... futex resumed>) = 0 [pid 5080] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5079] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5083] <... close resumed>) = 0 [pid 5081] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5079] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5082] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5080] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5083] symlink("/dev/binderfs", "./binderfs" [pid 5080] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5081] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5082] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5081] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5082] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5080] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5079] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5083] <... symlink resumed>) = 0 [pid 5082] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5082] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5080] <... mprotect resumed>) = 0 [pid 5083] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5081] <... mprotect resumed>) = 0 [pid 5082] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5083] <... futex resumed>) = 0 [pid 5080] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5079] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5083] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5081] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5079] <... mprotect resumed>) = 0 [pid 5082] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5083] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5081] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5082] <... mprotect resumed>) = 0 [pid 5080] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5079] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5083] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5083] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f3e2f5ed000 [pid 5079] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5083] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5081] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5079] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5082] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5080] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0}./strace-static-x86_64: Process 5084 attached [pid 5083] <... mprotect resumed>) = 0 [pid 5082] <... rt_sigprocmask resumed>[], 8) = 0 ./strace-static-x86_64: Process 5085 attached [pid 5084] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5083] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5081] <... clone3 resumed> => {parent_tid=[5084]}, 88) = 5084 [pid 5082] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5085] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5084] <... rseq resumed>) = 0 [pid 5081] rt_sigprocmask(SIG_SETMASK, [], [pid 5084] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5081] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5085] <... rseq resumed>) = 0 [pid 5084] <... set_robust_list resumed>) = 0 [pid 5081] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5080] <... clone3 resumed> => {parent_tid=[5086]}, 88) = 5086 [pid 5085] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5081] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5086 attached [pid 5083] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5079] <... clone3 resumed> => {parent_tid=[5085]}, 88) = 5085 [pid 5086] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5083] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5079] rt_sigprocmask(SIG_SETMASK, [], [pid 5081] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5088 attached ./strace-static-x86_64: Process 5087 attached [pid 5086] <... rseq resumed>) = 0 [pid 5085] <... set_robust_list resumed>) = 0 [pid 5084] rt_sigprocmask(SIG_SETMASK, [], [pid 5080] rt_sigprocmask(SIG_SETMASK, [], [pid 5079] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5088] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5087] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5086] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5085] rt_sigprocmask(SIG_SETMASK, [], [pid 5084] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5083] <... clone3 resumed> => {parent_tid=[5088]}, 88) = 5088 [pid 5082] <... clone3 resumed> => {parent_tid=[5087]}, 88) = 5087 [pid 5080] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5079] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5088] <... rseq resumed>) = 0 [pid 5087] <... rseq resumed>) = 0 [pid 5086] <... set_robust_list resumed>) = 0 [pid 5085] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5084] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5083] rt_sigprocmask(SIG_SETMASK, [], [pid 5082] rt_sigprocmask(SIG_SETMASK, [], [pid 5080] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5079] <... futex resumed>) = 0 [pid 5088] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5087] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5086] rt_sigprocmask(SIG_SETMASK, [], [pid 5085] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5084] <... bpf resumed>) = 3 [pid 5083] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5082] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5080] <... futex resumed>) = 0 [pid 5079] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5088] <... set_robust_list resumed>) = 0 [pid 5087] <... set_robust_list resumed>) = 0 [pid 5086] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5085] <... bpf resumed>) = 3 [pid 5084] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5083] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5082] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5080] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5088] rt_sigprocmask(SIG_SETMASK, [], [pid 5087] rt_sigprocmask(SIG_SETMASK, [], [pid 5086] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5085] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5084] <... futex resumed>) = 1 [pid 5083] <... futex resumed>) = 0 [pid 5081] <... futex resumed>) = 0 [pid 5082] <... futex resumed>) = 0 [pid 5088] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5087] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5086] <... bpf resumed>) = 3 [pid 5085] <... futex resumed>) = 1 [pid 5084] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5083] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5081] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5082] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5079] <... futex resumed>) = 0 [pid 5088] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5087] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5086] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5085] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5084] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5081] <... futex resumed>) = 0 [pid 5079] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5088] <... bpf resumed>) = 3 [pid 5086] <... futex resumed>) = 1 [pid 5085] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5084] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5081] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5080] <... futex resumed>) = 0 [pid 5087] <... bpf resumed>) = 3 [pid 5079] <... futex resumed>) = 0 [pid 5088] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5087] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5086] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5085] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5084] <... bpf resumed>) = 4 [pid 5080] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5079] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5088] <... futex resumed>) = 1 [pid 5087] <... futex resumed>) = 1 [pid 5086] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5083] <... futex resumed>) = 0 [pid 5082] <... futex resumed>) = 0 [pid 5080] <... futex resumed>) = 0 [pid 5085] <... bpf resumed>) = 4 [pid 5088] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5087] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5086] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5084] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5083] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5082] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5080] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5088] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5087] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5086] <... bpf resumed>) = 4 [pid 5085] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5084] <... futex resumed>) = 1 [pid 5083] <... futex resumed>) = 0 [pid 5081] <... futex resumed>) = 0 [pid 5082] <... futex resumed>) = 0 [pid 5088] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5087] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5086] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5085] <... futex resumed>) = 1 [pid 5084] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5083] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5081] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5082] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5079] <... futex resumed>) = 0 [pid 5088] <... bpf resumed>) = 4 [pid 5086] <... futex resumed>) = 1 [pid 5080] <... futex resumed>) = 0 [pid 5079] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5088] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5086] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5080] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5079] <... futex resumed>) = 0 [pid 5088] <... futex resumed>) = 1 [pid 5086] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5085] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5083] <... futex resumed>) = 0 [pid 5081] <... futex resumed>) = 0 [pid 5080] <... futex resumed>) = 0 [pid 5079] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5088] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5087] <... bpf resumed>) = 4 [pid 5086] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5084] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5083] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5080] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5088] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5087] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5086] <... bpf resumed>) = 5 [pid 5085] <... bpf resumed>) = 5 [pid 5084] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5083] <... futex resumed>) = 0 [pid 5081] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5088] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5087] <... futex resumed>) = 1 [pid 5086] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5085] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5083] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5082] <... futex resumed>) = 0 [pid 5088] <... bpf resumed>) = 5 [pid 5087] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5086] <... futex resumed>) = 1 [pid 5085] <... futex resumed>) = 1 [pid 5084] <... bpf resumed>) = 5 [pid 5082] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5080] <... futex resumed>) = 0 [pid 5079] <... futex resumed>) = 0 [pid 5088] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5087] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5086] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5085] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5082] <... futex resumed>) = 0 [pid 5080] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5084] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5079] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5088] <... futex resumed>) = 1 [pid 5087] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5086] <... bpf resumed>) = 6 [pid 5085] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5084] <... futex resumed>) = 1 [pid 5083] <... futex resumed>) = 0 [pid 5081] <... futex resumed>) = 0 [pid 5082] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5080] <... futex resumed>) = 0 [pid 5079] <... futex resumed>) = 0 [pid 5088] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5085] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5081] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5088] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5083] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5080] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5079] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5088] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5085] <... bpf resumed>) = 6 [pid 5083] <... futex resumed>) = 0 [pid 5081] <... futex resumed>) = 0 [pid 5088] <... bpf resumed>) = 6 [pid 5087] <... bpf resumed>) = 5 [pid 5086] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5085] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5084] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5083] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5081] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5088] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5086] <... futex resumed>) = 1 [pid 5083] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5080] <... futex resumed>) = 0 [pid 5088] <... futex resumed>) = 0 [pid 5086] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5083] exit_group(0 [pid 5080] exit_group(0 [pid 5086] <... futex resumed>) = ? [pid 5085] <... futex resumed>) = 1 [pid 5084] <... bpf resumed>) = 6 [pid 5083] <... exit_group resumed>) = ? [pid 5080] <... exit_group resumed>) = ? [pid 5079] <... futex resumed>) = 0 [pid 5087] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5088] +++ exited with 0 +++ [pid 5086] +++ exited with 0 +++ [pid 5085] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5084] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5083] +++ exited with 0 +++ [pid 5082] <... futex resumed>) = 0 [pid 5080] +++ exited with 0 +++ [pid 5079] exit_group(0 [pid 5087] <... futex resumed>) = 1 [pid 5085] <... futex resumed>) = ? [pid 5084] <... futex resumed>) = 1 [pid 5081] <... futex resumed>) = 0 [pid 5082] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5079] <... exit_group resumed>) = ? [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5080, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5087] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5085] +++ exited with 0 +++ [pid 5084] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5081] exit_group(0 [pid 5082] <... futex resumed>) = 0 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5083, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5082] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5084] <... futex resumed>) = ? [pid 5081] <... exit_group resumed>) = ? [pid 5078] restart_syscall(<... resuming interrupted clone ...> [pid 5087] <... bpf resumed>) = 6 [pid 5078] <... restart_syscall resumed>) = 0 [pid 5087] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5082] <... futex resumed>) = 0 [pid 5087] <... futex resumed>) = 1 [pid 5082] exit_group(0) = ? [pid 5078] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5078] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5077] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5078] <... openat resumed>) = 3 [pid 5078] newfstatat(3, "", [pid 5079] +++ exited with 0 +++ [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5079, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5074] restart_syscall(<... resuming interrupted clone ...> [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] <... restart_syscall resumed>) = 0 [pid 5078] getdents64(3, [pid 5077] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5074] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5077] newfstatat(3, "", [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5078] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5074] <... openat resumed>) = 3 [pid 5078] newfstatat(AT_FDCWD, "./0/binderfs", [pid 5074] newfstatat(3, "", [pid 5087] +++ exited with 0 +++ [pid 5084] +++ exited with 0 +++ [pid 5081] +++ exited with 0 +++ [pid 5082] +++ exited with 0 +++ [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5077] getdents64(3, [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5082, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5078] unlink("./0/binderfs" [pid 5076] restart_syscall(<... resuming interrupted clone ...> [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5081, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5078] <... unlink resumed>) = 0 [pid 5077] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] <... restart_syscall resumed>) = 0 [pid 5074] getdents64(3, [pid 5078] getdents64(3, [pid 5077] newfstatat(AT_FDCWD, "./0/binderfs", [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5075] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5074] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5078] close(3) = 0 [pid 5075] <... openat resumed>) = 3 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5078] rmdir("./0" [pid 5076] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] newfstatat(AT_FDCWD, "./0/binderfs", [pid 5078] <... rmdir resumed>) = 0 [pid 5077] unlink("./0/binderfs" [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] newfstatat(3, "", [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5078] mkdir("./1", 0777 [pid 5077] <... unlink resumed>) = 0 [pid 5076] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5074] unlink("./0/binderfs" [pid 5076] <... openat resumed>) = 3 [pid 5078] <... mkdir resumed>) = 0 [pid 5077] getdents64(3, [pid 5076] newfstatat(3, "", [pid 5075] getdents64(3, [pid 5074] <... unlink resumed>) = 0 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5076] getdents64(3, [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5074] getdents64(3, [pid 5075] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5077] close(3 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] close(3 [pid 5076] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] newfstatat(AT_FDCWD, "./0/binderfs", [pid 5074] <... close resumed>) = 0 [pid 5077] <... close resumed>) = 0 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] rmdir("./0"./strace-static-x86_64: Process 5089 attached [pid 5077] rmdir("./0" [pid 5076] newfstatat(AT_FDCWD, "./0/binderfs", [pid 5074] <... rmdir resumed>) = 0 [pid 5089] set_robust_list(0x55555d6c46a0, 24 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5089 [pid 5075] unlink("./0/binderfs" [pid 5089] <... set_robust_list resumed>) = 0 [pid 5089] chdir("./1" [pid 5077] <... rmdir resumed>) = 0 [pid 5089] <... chdir resumed>) = 0 [pid 5077] mkdir("./1", 0777 [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5075] <... unlink resumed>) = 0 [pid 5074] mkdir("./1", 0777 [pid 5076] unlink("./0/binderfs" [pid 5089] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5089] setpgid(0, 0) = 0 [pid 5089] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5074] <... mkdir resumed>) = 0 [pid 5089] <... openat resumed>) = 3 [pid 5089] write(3, "1000", 4) = 4 [pid 5076] <... unlink resumed>) = 0 [pid 5089] close(3) = 0 [pid 5089] symlink("/dev/binderfs", "./binderfs" [pid 5077] <... mkdir resumed>) = 0 [pid 5076] getdents64(3, [pid 5075] getdents64(3, [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5089] <... symlink resumed>) = 0 [pid 5075] close(3 [pid 5089] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5089] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, ./strace-static-x86_64: Process 5090 attached [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5076] close(3 [pid 5075] <... close resumed>) = 0 [pid 5090] set_robust_list(0x55555d6c46a0, 24 [pid 5089] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5076] <... close resumed>) = 0 [pid 5075] rmdir("./0" [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5090 [pid 5090] <... set_robust_list resumed>) = 0 [pid 5089] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], ./strace-static-x86_64: Process 5091 attached NULL, 8) = 0 [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5091 [pid 5089] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5091] set_robust_list(0x55555d6c46a0, 24 [pid 5089] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5076] rmdir("./0" [pid 5075] <... rmdir resumed>) = 0 [pid 5090] chdir("./1" [pid 5091] <... set_robust_list resumed>) = 0 [pid 5090] <... chdir resumed>) = 0 [pid 5089] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5075] mkdir("./1", 0777 [pid 5091] chdir("./1" [pid 5090] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5091] <... chdir resumed>) = 0 [pid 5090] <... prctl resumed>) = 0 [pid 5089] <... mprotect resumed>) = 0 [pid 5076] <... rmdir resumed>) = 0 [pid 5091] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5090] setpgid(0, 0 [pid 5091] <... prctl resumed>) = 0 [pid 5090] <... setpgid resumed>) = 0 [pid 5076] mkdir("./1", 0777 [pid 5091] setpgid(0, 0 [pid 5090] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5089] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5076] <... mkdir resumed>) = 0 [pid 5091] <... setpgid resumed>) = 0 [pid 5091] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5075] <... mkdir resumed>) = 0 [pid 5091] <... openat resumed>) = 3 [pid 5090] <... openat resumed>) = 3 [pid 5089] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5091] write(3, "1000", 4) = 4 [pid 5089] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5091] close(3) = 0 [pid 5091] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5091] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5094 attached ./strace-static-x86_64: Process 5093 attached ./strace-static-x86_64: Process 5092 attached [pid 5090] write(3, "1000", 4 [pid 5093] set_robust_list(0x55555d6c46a0, 24 [pid 5091] <... futex resumed>) = 0 [pid 5089] <... clone3 resumed> => {parent_tid=[5094]}, 88) = 5094 [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5092 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5093 [pid 5094] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5093] <... set_robust_list resumed>) = 0 [pid 5092] set_robust_list(0x55555d6c46a0, 24 [pid 5090] <... write resumed>) = 4 [pid 5089] rt_sigprocmask(SIG_SETMASK, [], [pid 5091] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5094] <... rseq resumed>) = 0 [pid 5093] chdir("./1" [pid 5090] close(3 [pid 5089] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5094] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5093] <... chdir resumed>) = 0 [pid 5092] <... set_robust_list resumed>) = 0 [pid 5091] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5090] <... close resumed>) = 0 [pid 5089] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5094] <... set_robust_list resumed>) = 0 [pid 5093] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5092] chdir("./1" [pid 5091] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5090] symlink("/dev/binderfs", "./binderfs" [pid 5089] <... futex resumed>) = 0 [pid 5094] rt_sigprocmask(SIG_SETMASK, [], [pid 5093] <... prctl resumed>) = 0 [pid 5091] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5090] <... symlink resumed>) = 0 [pid 5089] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5094] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5093] setpgid(0, 0 [pid 5092] <... chdir resumed>) = 0 [pid 5091] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5094] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5093] <... setpgid resumed>) = 0 [pid 5092] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5091] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5090] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5092] <... prctl resumed>) = 0 [pid 5091] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5090] <... futex resumed>) = 0 [pid 5092] setpgid(0, 0 [pid 5094] <... bpf resumed>) = 3 [pid 5093] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5090] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5094] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5092] <... setpgid resumed>) = 0 [pid 5091] <... mprotect resumed>) = 0 [pid 5090] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5094] <... futex resumed>) = 1 [pid 5089] <... futex resumed>) = 0 [pid 5094] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5093] <... openat resumed>) = 3 [pid 5092] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5090] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5089] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5094] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5090] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5089] <... futex resumed>) = 0 [pid 5093] write(3, "1000", 4 [pid 5090] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5092] <... openat resumed>) = 3 [pid 5094] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5093] <... write resumed>) = 4 [pid 5091] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5089] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5093] close(3 [pid 5092] write(3, "1000", 4 [pid 5091] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5090] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5094] <... bpf resumed>) = 4 [pid 5093] <... close resumed>) = 0 [pid 5091] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5093] symlink("/dev/binderfs", "./binderfs" [pid 5090] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE./strace-static-x86_64: Process 5095 attached [pid 5093] <... symlink resumed>) = 0 [pid 5092] <... write resumed>) = 4 [pid 5094] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5090] <... mprotect resumed>) = 0 [pid 5095] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5094] <... futex resumed>) = 1 [pid 5092] close(3 [pid 5091] <... clone3 resumed> => {parent_tid=[5095]}, 88) = 5095 [pid 5095] <... rseq resumed>) = 0 [pid 5094] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5093] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5092] <... close resumed>) = 0 [pid 5089] <... futex resumed>) = 0 [pid 5095] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5093] <... futex resumed>) = 0 [pid 5092] symlink("/dev/binderfs", "./binderfs" [pid 5091] rt_sigprocmask(SIG_SETMASK, [], [pid 5090] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5089] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5095] <... set_robust_list resumed>) = 0 [pid 5093] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5091] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5095] rt_sigprocmask(SIG_SETMASK, [], [pid 5093] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5095] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5093] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5092] <... symlink resumed>) = 0 [pid 5089] <... futex resumed>) = 1 [pid 5095] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5094] <... futex resumed>) = 0 [pid 5093] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5091] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5090] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5092] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5089] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5095] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5094] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5093] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5091] <... futex resumed>) = 0 [pid 5090] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5095] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5093] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5092] <... futex resumed>) = 0 [pid 5091] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5096 attached [pid 5095] <... bpf resumed>) = 3 [pid 5093] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5092] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5096] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5095] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5093] <... mprotect resumed>) = 0 [pid 5096] <... rseq resumed>) = 0 [pid 5095] <... futex resumed>) = 1 [pid 5094] <... bpf resumed>) = 5 [pid 5091] <... futex resumed>) = 0 [pid 5092] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5090] <... clone3 resumed> => {parent_tid=[5096]}, 88) = 5096 [pid 5096] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5095] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5094] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5093] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5092] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5091] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5090] rt_sigprocmask(SIG_SETMASK, [], [pid 5096] <... set_robust_list resumed>) = 0 [pid 5094] <... futex resumed>) = 1 [pid 5092] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5091] <... futex resumed>) = 0 [pid 5090] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5089] <... futex resumed>) = 0 [pid 5094] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5092] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5091] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5090] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5089] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5096] rt_sigprocmask(SIG_SETMASK, [], [pid 5095] <... bpf resumed>) = 4 [pid 5094] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5093] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5092] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5090] <... futex resumed>) = 0 [pid 5089] <... futex resumed>) = 0 [pid 5096] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5095] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5094] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5093] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5092] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5090] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5089] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000}./strace-static-x86_64: Process 5097 attached [pid 5096] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5095] <... futex resumed>) = 1 [pid 5094] <... bpf resumed>) = 6 [pid 5092] <... mprotect resumed>) = 0 [pid 5091] <... futex resumed>) = 0 [pid 5097] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5096] <... bpf resumed>) = 3 [pid 5095] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5093] <... clone3 resumed> => {parent_tid=[5097]}, 88) = 5097 [pid 5097] <... rseq resumed>) = 0 [pid 5096] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5095] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5094] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5093] rt_sigprocmask(SIG_SETMASK, [], [pid 5092] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5091] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5097] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5096] <... futex resumed>) = 1 [pid 5095] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5094] <... futex resumed>) = 1 [pid 5093] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5091] <... futex resumed>) = 0 [pid 5090] <... futex resumed>) = 0 [pid 5089] <... futex resumed>) = 0 [pid 5097] <... set_robust_list resumed>) = 0 [pid 5096] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5094] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5092] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5091] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5090] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5089] exit_group(0 [pid 5097] rt_sigprocmask(SIG_SETMASK, [], [pid 5096] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5095] <... bpf resumed>) = 5 [pid 5094] <... futex resumed>) = ? [pid 5093] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5092] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5090] <... futex resumed>) = 0 [pid 5089] <... exit_group resumed>) = ? ./strace-static-x86_64: Process 5098 attached [pid 5097] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5096] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5095] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5094] +++ exited with 0 +++ [pid 5093] <... futex resumed>) = 0 [pid 5090] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5089] +++ exited with 0 +++ [pid 5098] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5097] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5096] <... bpf resumed>) = 4 [pid 5093] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5092] <... clone3 resumed> => {parent_tid=[5098]}, 88) = 5098 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5089, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5095] <... futex resumed>) = 1 [pid 5091] <... futex resumed>) = 0 [pid 5098] <... rseq resumed>) = 0 [pid 5097] <... bpf resumed>) = 3 [pid 5096] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5095] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5092] rt_sigprocmask(SIG_SETMASK, [], [pid 5091] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5098] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5096] <... futex resumed>) = 1 [pid 5092] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5091] <... futex resumed>) = 0 [pid 5090] <... futex resumed>) = 0 [pid 5098] <... set_robust_list resumed>) = 0 [pid 5097] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5096] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5095] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5092] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5091] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5090] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5098] rt_sigprocmask(SIG_SETMASK, [], [pid 5097] <... futex resumed>) = 1 [pid 5096] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5095] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5093] <... futex resumed>) = 0 [pid 5092] <... futex resumed>) = 0 [pid 5090] <... futex resumed>) = 0 [pid 5098] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5097] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5096] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5093] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5092] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5090] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5098] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5097] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5093] <... futex resumed>) = 0 [pid 5078] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5098] <... bpf resumed>) = 3 [pid 5097] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5093] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5096] <... bpf resumed>) = 5 [pid 5098] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5097] <... bpf resumed>) = 4 [pid 5078] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5098] <... futex resumed>) = 1 [pid 5096] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5095] <... bpf resumed>) = 6 [pid 5097] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5092] <... futex resumed>) = 0 [pid 5078] <... openat resumed>) = 3 [pid 5098] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5097] <... futex resumed>) = 1 [pid 5096] <... futex resumed>) = 1 [pid 5095] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5093] <... futex resumed>) = 0 [pid 5092] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5090] <... futex resumed>) = 0 [pid 5096] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5095] <... futex resumed>) = 1 [pid 5093] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5091] <... futex resumed>) = 0 [pid 5095] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5093] <... futex resumed>) = 0 [pid 5091] exit_group(0 [pid 5093] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5095] <... futex resumed>) = ? [pid 5091] <... exit_group resumed>) = ? [pid 5098] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5097] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5095] +++ exited with 0 +++ [pid 5092] <... futex resumed>) = 0 [pid 5090] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] newfstatat(3, "", [pid 5098] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5097] <... bpf resumed>) = 5 [pid 5096] <... futex resumed>) = 0 [pid 5092] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5091] +++ exited with 0 +++ [pid 5090] <... futex resumed>) = 1 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5098] <... bpf resumed>) = 4 [pid 5090] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] getdents64(3, [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5091, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5098] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5096] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5098] <... futex resumed>) = 1 [pid 5097] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5092] <... futex resumed>) = 0 [pid 5098] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5092] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5098] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5097] <... futex resumed>) = 1 [pid 5093] <... futex resumed>) = 0 [pid 5092] <... futex resumed>) = 0 [pid 5078] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5077] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5098] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5097] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5093] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5092] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5098] <... bpf resumed>) = 5 [pid 5097] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5093] <... futex resumed>) = 0 [pid 5078] newfstatat(AT_FDCWD, "./1/binderfs", [pid 5077] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5093] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5097] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5077] <... openat resumed>) = 3 [pid 5098] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5092] <... futex resumed>) = 0 [pid 5078] unlink("./1/binderfs" [pid 5077] newfstatat(3, "", [pid 5098] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5092] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... unlink resumed>) = 0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5098] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5092] <... futex resumed>) = 0 [pid 5092] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5098] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5078] getdents64(3, [pid 5077] getdents64(3, [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5078] close(3 [pid 5077] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5078] <... close resumed>) = 0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5078] rmdir("./1" [pid 5077] newfstatat(AT_FDCWD, "./1/binderfs", [pid 5078] <... rmdir resumed>) = 0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5077] unlink("./1/binderfs" [pid 5098] <... bpf resumed>) = 6 [pid 5097] <... bpf resumed>) = 6 [pid 5096] <... bpf resumed>) = 6 [pid 5078] mkdir("./2", 0777 [pid 5077] <... unlink resumed>) = 0 [pid 5098] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5097] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5096] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... mkdir resumed>) = 0 [pid 5077] getdents64(3, [pid 5098] <... futex resumed>) = 1 [pid 5097] <... futex resumed>) = 1 [pid 5096] <... futex resumed>) = 1 [pid 5092] <... futex resumed>) = 0 [pid 5090] <... futex resumed>) = 0 [pid 5097] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5096] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5092] exit_group(0 [pid 5090] exit_group(0 [pid 5096] <... futex resumed>) = ? [pid 5090] <... exit_group resumed>) = ? [pid 5098] +++ exited with 0 +++ [pid 5096] +++ exited with 0 +++ [pid 5093] <... futex resumed>) = 0 [pid 5092] <... exit_group resumed>) = ? [pid 5090] +++ exited with 0 +++ [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5093] exit_group(0 [pid 5077] close(3 [pid 5093] <... exit_group resumed>) = ? [pid 5077] <... close resumed>) = 0 [pid 5097] <... futex resumed>) = ? [pid 5077] rmdir("./1"./strace-static-x86_64: Process 5099 attached ) = 0 [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5090, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5074] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5074] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5099] set_robust_list(0x55555d6c46a0, 24 [pid 5097] +++ exited with 0 +++ [pid 5093] +++ exited with 0 +++ [pid 5092] +++ exited with 0 +++ [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5099 [pid 5077] mkdir("./2", 0777 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5099] <... set_robust_list resumed>) = 0 [pid 5077] <... mkdir resumed>) = 0 [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5092, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5074] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5099] chdir("./2" [pid 5074] <... openat resumed>) = 3 [pid 5099] <... chdir resumed>) = 0 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5093, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5074] newfstatat(3, "", [pid 5099] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5076] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5099] <... prctl resumed>) = 0 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] getdents64(3, ./strace-static-x86_64: Process 5100 attached [pid 5099] setpgid(0, 0 [pid 5076] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5100] set_robust_list(0x55555d6c46a0, 24 [pid 5099] <... setpgid resumed>) = 0 [pid 5075] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5100] <... set_robust_list resumed>) = 0 [pid 5076] <... openat resumed>) = 3 [pid 5100] chdir("./2") = 0 [pid 5099] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5076] newfstatat(3, "", [pid 5075] <... openat resumed>) = 3 [pid 5074] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5100] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5099] <... openat resumed>) = 3 [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5075] newfstatat(3, "", [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5100] <... prctl resumed>) = 0 [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5100] setpgid(0, 0) = 0 [pid 5099] write(3, "1000", 4 [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5100 [pid 5076] getdents64(3, [pid 5075] getdents64(3, [pid 5074] newfstatat(AT_FDCWD, "./1/binderfs", [pid 5100] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5099] <... write resumed>) = 4 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5099] close(3 [pid 5076] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] unlink("./1/binderfs" [pid 5100] <... openat resumed>) = 3 [pid 5099] <... close resumed>) = 0 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... unlink resumed>) = 0 [pid 5099] symlink("/dev/binderfs", "./binderfs" [pid 5076] newfstatat(AT_FDCWD, "./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5100] write(3, "1000", 4 [pid 5099] <... symlink resumed>) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5100] <... write resumed>) = 4 [pid 5099] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] unlink("./1/binderfs" [pid 5075] newfstatat(AT_FDCWD, "./1/binderfs", [pid 5074] getdents64(3, [pid 5100] close(3 [pid 5099] <... futex resumed>) = 0 [pid 5076] <... unlink resumed>) = 0 [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5099] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5076] getdents64(3, [pid 5074] close(3 [pid 5099] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5074] <... close resumed>) = 0 [pid 5099] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5076] close(3 [pid 5074] rmdir("./1" [pid 5100] <... close resumed>) = 0 [pid 5099] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5076] <... close resumed>) = 0 [pid 5075] unlink("./1/binderfs" [pid 5074] <... rmdir resumed>) = 0 [pid 5100] symlink("/dev/binderfs", "./binderfs" [pid 5099] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f3e2f5ed000 [pid 5076] rmdir("./1" [pid 5100] <... symlink resumed>) = 0 [pid 5099] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5076] <... rmdir resumed>) = 0 [pid 5075] <... unlink resumed>) = 0 [pid 5074] mkdir("./2", 0777 [pid 5100] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5099] <... mprotect resumed>) = 0 [pid 5100] <... futex resumed>) = 0 [pid 5076] mkdir("./2", 0777 [pid 5075] getdents64(3, [pid 5074] <... mkdir resumed>) = 0 [pid 5100] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5099] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5076] <... mkdir resumed>) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5100] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5099] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5101 attached ./strace-static-x86_64: Process 5102 attached [pid 5100] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5099] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5075] close(3./strace-static-x86_64: Process 5103 attached [pid 5103] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053) = 0 [pid 5101] set_robust_list(0x55555d6c46a0, 24 [pid 5103] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5102] set_robust_list(0x55555d6c46a0, 24 [pid 5101] <... set_robust_list resumed>) = 0 [pid 5100] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] <... close resumed>) = 0 [pid 5103] <... set_robust_list resumed>) = 0 [pid 5102] <... set_robust_list resumed>) = 0 [pid 5101] chdir("./2" [pid 5100] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5099] <... clone3 resumed> => {parent_tid=[5103]}, 88) = 5103 [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5102 [pid 5075] rmdir("./1" [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5101 [pid 5103] rt_sigprocmask(SIG_SETMASK, [], [pid 5102] chdir("./2" [pid 5100] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5099] rt_sigprocmask(SIG_SETMASK, [], [pid 5103] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5099] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] <... rmdir resumed>) = 0 [pid 5103] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5099] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5103] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5101] <... chdir resumed>) = 0 [pid 5100] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5099] <... futex resumed>) = 0 [pid 5103] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5102] <... chdir resumed>) = 0 [pid 5101] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5100] <... mprotect resumed>) = 0 [pid 5099] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] mkdir("./2", 0777 [pid 5103] <... bpf resumed>) = 3 [pid 5103] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5099] <... futex resumed>) = 0 [pid 5075] <... mkdir resumed>) = 0 [pid 5103] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5102] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5101] <... prctl resumed>) = 0 [pid 5100] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5099] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5103] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5099] <... futex resumed>) = 0 [pid 5103] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5099] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5103] <... bpf resumed>) = 4 [pid 5102] <... prctl resumed>) = 0 [pid 5101] setpgid(0, 0 [pid 5100] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5103] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5102] setpgid(0, 0 [pid 5101] <... setpgid resumed>) = 0 [pid 5100] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5103] <... futex resumed>) = 1 [pid 5099] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5104 attached [pid 5103] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5102] <... setpgid resumed>) = 0 [pid 5101] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5099] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5104] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5103] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5099] <... futex resumed>) = 0 [pid 5104] <... rseq resumed>) = 0 [pid 5103] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5099] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5104] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5103] <... bpf resumed>) = 5 [pid 5102] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5100] <... clone3 resumed> => {parent_tid=[5104]}, 88) = 5104 [pid 5104] <... set_robust_list resumed>) = 0 [pid 5101] <... openat resumed>) = 3 [pid 5100] rt_sigprocmask(SIG_SETMASK, [], [pid 5104] rt_sigprocmask(SIG_SETMASK, [], [pid 5102] <... openat resumed>) = 3 [pid 5100] <... rt_sigprocmask resumed>NULL, 8) = 0 ./strace-static-x86_64: Process 5105 attached [pid 5104] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5101] write(3, "1000", 4 [pid 5100] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5105] set_robust_list(0x55555d6c46a0, 24 [pid 5104] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5103] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5102] write(3, "1000", 4 [pid 5101] <... write resumed>) = 4 [pid 5100] <... futex resumed>) = 0 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5105 [pid 5105] <... set_robust_list resumed>) = 0 [pid 5104] <... bpf resumed>) = 3 [pid 5103] <... futex resumed>) = 1 [pid 5099] <... futex resumed>) = 0 [pid 5100] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5105] chdir("./2" [pid 5104] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5103] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5102] <... write resumed>) = 4 [pid 5101] close(3 [pid 5100] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5099] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5105] <... chdir resumed>) = 0 [pid 5104] <... futex resumed>) = 0 [pid 5103] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5099] <... futex resumed>) = 0 [pid 5100] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5105] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5104] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5103] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5102] close(3 [pid 5101] <... close resumed>) = 0 [pid 5100] <... futex resumed>) = 0 [pid 5099] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5105] <... prctl resumed>) = 0 [pid 5104] <... bpf resumed>) = 4 [pid 5103] <... bpf resumed>) = 6 [pid 5102] <... close resumed>) = 0 [pid 5101] symlink("/dev/binderfs", "./binderfs" [pid 5100] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5102] symlink("/dev/binderfs", "./binderfs" [pid 5105] setpgid(0, 0 [pid 5104] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5103] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5105] <... setpgid resumed>) = 0 [pid 5104] <... futex resumed>) = 1 [pid 5103] <... futex resumed>) = 1 [pid 5101] <... symlink resumed>) = 0 [pid 5100] <... futex resumed>) = 0 [pid 5099] <... futex resumed>) = 0 [pid 5105] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5104] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5103] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5102] <... symlink resumed>) = 0 [pid 5100] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5099] exit_group(0 [pid 5105] <... openat resumed>) = 3 [pid 5104] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5103] <... futex resumed>) = ? [pid 5102] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5101] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5100] <... futex resumed>) = 0 [pid 5099] <... exit_group resumed>) = ? [pid 5102] <... futex resumed>) = 0 [pid 5101] <... futex resumed>) = 0 [pid 5100] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5105] write(3, "1000", 4 [pid 5104] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5103] +++ exited with 0 +++ [pid 5102] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5101] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5099] +++ exited with 0 +++ [pid 5105] <... write resumed>) = 4 [pid 5104] <... bpf resumed>) = 5 [pid 5102] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5101] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5099, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5105] close(3 [pid 5102] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5101] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5105] <... close resumed>) = 0 [pid 5104] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5102] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5101] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5105] symlink("/dev/binderfs", "./binderfs" [pid 5104] <... futex resumed>) = 1 [pid 5078] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5105] <... symlink resumed>) = 0 [pid 5104] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5102] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5101] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5100] <... futex resumed>) = 0 [pid 5102] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5105] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5102] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5101] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5100] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5105] <... futex resumed>) = 0 [pid 5104] <... futex resumed>) = 0 [pid 5102] <... mprotect resumed>) = 0 [pid 5101] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5100] <... futex resumed>) = 1 [pid 5078] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5105] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5104] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5078] <... openat resumed>) = 3 [pid 5105] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5105] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5078] newfstatat(3, "", [pid 5105] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5105] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5104] <... bpf resumed>) = 6 [pid 5100] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5105] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5101] <... mprotect resumed>) = 0 [pid 5102] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5105] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5104] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] getdents64(3, [pid 5105] <... mprotect resumed>) = 0 [pid 5104] <... futex resumed>) = 0 [pid 5101] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5100] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5102] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5105] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5104] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5102] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5078] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5100] exit_group(0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5105] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5078] newfstatat(AT_FDCWD, "./2/binderfs", ./strace-static-x86_64: Process 5106 attached [pid 5105] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5104] <... futex resumed>) = ? [pid 5100] <... exit_group resumed>) = ? [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 ./strace-static-x86_64: Process 5107 attached [pid 5106] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5104] +++ exited with 0 +++ [pid 5102] <... clone3 resumed> => {parent_tid=[5106]}, 88) = 5106 [pid 5101] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5107] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5106] <... rseq resumed>) = 0 [pid 5105] <... clone3 resumed> => {parent_tid=[5107]}, 88) = 5107 [pid 5102] rt_sigprocmask(SIG_SETMASK, [], [pid 5101] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5078] unlink("./2/binderfs" [pid 5107] <... rseq resumed>) = 0 [pid 5106] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5105] rt_sigprocmask(SIG_SETMASK, [], [pid 5078] <... unlink resumed>) = 0 [pid 5107] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5106] <... set_robust_list resumed>) = 0 [pid 5105] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5107] <... set_robust_list resumed>) = 0 [pid 5106] rt_sigprocmask(SIG_SETMASK, [], [pid 5105] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] getdents64(3, [pid 5107] rt_sigprocmask(SIG_SETMASK, [], [pid 5106] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5105] <... futex resumed>) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5107] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5106] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5105] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5107] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5078] close(3 [pid 5102] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5107] <... bpf resumed>) = 3 [pid 5102] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... close resumed>) = 0 [pid 5107] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] rmdir("./2" [pid 5105] <... futex resumed>) = 0 [pid 5102] <... futex resumed>) = 1 [pid 5102] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5108 attached [pid 5107] <... futex resumed>) = 1 [pid 5106] <... futex resumed>) = 0 [pid 5105] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5101] <... clone3 resumed> => {parent_tid=[5108]}, 88) = 5108 [pid 5100] +++ exited with 0 +++ [pid 5078] <... rmdir resumed>) = 0 [pid 5108] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5107] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5106] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5105] <... futex resumed>) = 0 [pid 5101] rt_sigprocmask(SIG_SETMASK, [], [pid 5108] <... rseq resumed>) = 0 [pid 5107] <... bpf resumed>) = 4 [pid 5106] <... bpf resumed>) = 3 [pid 5105] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5101] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] mkdir("./3", 0777 [pid 5108] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5107] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5106] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5101] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... mkdir resumed>) = 0 [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5100, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5108] <... set_robust_list resumed>) = 0 [pid 5107] <... futex resumed>) = 1 [pid 5105] <... futex resumed>) = 0 [pid 5101] <... futex resumed>) = 0 [pid 5108] rt_sigprocmask(SIG_SETMASK, [], [pid 5107] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5106] <... futex resumed>) = 1 [pid 5105] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5102] <... futex resumed>) = 0 [pid 5101] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5109 attached [pid 5108] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5107] <... bpf resumed>) = 5 [pid 5106] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5105] <... futex resumed>) = 0 [pid 5102] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5108] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5102] <... futex resumed>) = 0 [pid 5109] set_robust_list(0x55555d6c46a0, 24 [pid 5102] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5108] <... bpf resumed>) = 3 [pid 5077] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5109] <... set_robust_list resumed>) = 0 [pid 5108] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5109] chdir("./3" [pid 5107] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5106] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5105] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5109 [pid 5107] <... futex resumed>) = 0 [pid 5106] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5105] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5108] <... futex resumed>) = 1 [pid 5109] <... chdir resumed>) = 0 [pid 5107] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5108] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5106] <... bpf resumed>) = 4 [pid 5105] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5101] <... futex resumed>) = 0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5109] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5107] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5106] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5105] <... futex resumed>) = 0 [pid 5101] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5109] <... prctl resumed>) = 0 [pid 5108] <... futex resumed>) = 0 [pid 5107] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5106] <... futex resumed>) = 1 [pid 5105] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5102] <... futex resumed>) = 0 [pid 5101] <... futex resumed>) = 1 [pid 5077] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5109] setpgid(0, 0 [pid 5108] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5107] <... bpf resumed>) = 6 [pid 5106] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5102] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5101] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5109] <... setpgid resumed>) = 0 [pid 5107] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5106] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5102] <... futex resumed>) = 0 [pid 5077] <... openat resumed>) = 3 [pid 5108] <... bpf resumed>) = 4 [pid 5109] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5107] <... futex resumed>) = 1 [pid 5108] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5106] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5105] <... futex resumed>) = 0 [pid 5102] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] newfstatat(3, "", [pid 5109] <... openat resumed>) = 3 [pid 5108] <... futex resumed>) = 1 [pid 5107] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5106] <... bpf resumed>) = 5 [pid 5105] exit_group(0 [pid 5101] <... futex resumed>) = 0 [pid 5109] write(3, "1000", 4 [pid 5108] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5107] <... futex resumed>) = ? [pid 5105] <... exit_group resumed>) = ? [pid 5101] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5109] <... write resumed>) = 4 [pid 5108] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5107] +++ exited with 0 +++ [pid 5106] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5105] +++ exited with 0 +++ [pid 5101] <... futex resumed>) = 0 [pid 5109] close(3 [pid 5108] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5106] <... futex resumed>) = 1 [pid 5102] <... futex resumed>) = 0 [pid 5101] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] getdents64(3, [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5105, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5109] <... close resumed>) = 0 [pid 5106] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5102] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5109] symlink("/dev/binderfs", "./binderfs" [pid 5106] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5102] <... futex resumed>) = 0 [pid 5108] <... bpf resumed>) = 5 [pid 5077] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5108] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5106] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5102] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5109] <... symlink resumed>) = 0 [pid 5108] <... futex resumed>) = 1 [pid 5101] <... futex resumed>) = 0 [pid 5077] newfstatat(AT_FDCWD, "./2/binderfs", [pid 5109] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5108] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5101] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5109] <... futex resumed>) = 0 [pid 5101] <... futex resumed>) = 0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5109] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5101] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] unlink("./2/binderfs" [pid 5075] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5109] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5077] <... unlink resumed>) = 0 [pid 5075] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5109] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5077] getdents64(3, [pid 5109] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5075] <... openat resumed>) = 3 [pid 5109] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f3e2f5ed000 [pid 5077] close(3 [pid 5075] newfstatat(3, "", [pid 5077] <... close resumed>) = 0 [pid 5109] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5077] rmdir("./2" [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5109] <... mprotect resumed>) = 0 [pid 5077] <... rmdir resumed>) = 0 [pid 5109] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5077] mkdir("./3", 0777 [pid 5109] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5075] getdents64(3, [pid 5109] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5077] <... mkdir resumed>) = 0 ./strace-static-x86_64: Process 5110 attached [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5110] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5109] <... clone3 resumed> => {parent_tid=[5110]}, 88) = 5110 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5110] <... rseq resumed>) = 0 [pid 5109] rt_sigprocmask(SIG_SETMASK, [], [pid 5075] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] newfstatat(AT_FDCWD, "./2/binderfs", [pid 5110] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5109] <... rt_sigprocmask resumed>NULL, 8) = 0 ./strace-static-x86_64: Process 5111 attached [pid 5110] <... set_robust_list resumed>) = 0 [pid 5109] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5111] set_robust_list(0x55555d6c46a0, 24 [pid 5110] rt_sigprocmask(SIG_SETMASK, [], [pid 5109] <... futex resumed>) = 0 [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5111 [pid 5075] unlink("./2/binderfs" [pid 5111] <... set_robust_list resumed>) = 0 [pid 5110] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5109] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5111] chdir("./3" [pid 5110] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5075] <... unlink resumed>) = 0 [pid 5111] <... chdir resumed>) = 0 [pid 5110] <... bpf resumed>) = 3 [pid 5108] <... bpf resumed>) = 6 [pid 5106] <... bpf resumed>) = 6 [pid 5111] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5110] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5108] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5106] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5111] <... prctl resumed>) = 0 [pid 5110] <... futex resumed>) = 1 [pid 5109] <... futex resumed>) = 0 [pid 5108] <... futex resumed>) = 1 [pid 5106] <... futex resumed>) = 1 [pid 5102] <... futex resumed>) = 0 [pid 5101] <... futex resumed>) = 0 [pid 5075] getdents64(3, [pid 5111] setpgid(0, 0 [pid 5110] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5109] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5108] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5106] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5102] exit_group(0 [pid 5101] exit_group(0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5111] <... setpgid resumed>) = 0 [pid 5110] <... bpf resumed>) = 4 [pid 5109] <... futex resumed>) = 0 [pid 5108] <... futex resumed>) = ? [pid 5106] <... futex resumed>) = ? [pid 5102] <... exit_group resumed>) = ? [pid 5101] <... exit_group resumed>) = ? [pid 5111] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5110] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5109] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5108] +++ exited with 0 +++ [pid 5106] +++ exited with 0 +++ [pid 5075] close(3) = 0 [pid 5109] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5075] rmdir("./2" [pid 5111] <... openat resumed>) = 3 [pid 5110] <... futex resumed>) = 0 [pid 5109] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... rmdir resumed>) = 0 [pid 5111] write(3, "1000", 4 [pid 5110] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5109] <... futex resumed>) = 0 [pid 5111] <... write resumed>) = 4 [pid 5075] mkdir("./3", 0777 [pid 5111] close(3 [pid 5110] <... bpf resumed>) = 5 [pid 5109] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] <... mkdir resumed>) = 0 [pid 5111] <... close resumed>) = 0 [pid 5110] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5109] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5111] symlink("/dev/binderfs", "./binderfs" [pid 5110] <... futex resumed>) = 0 [pid 5109] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5111] <... symlink resumed>) = 0 [pid 5110] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5109] <... futex resumed>) = 0 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5111] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5109] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5111] <... futex resumed>) = 0 [pid 5111] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, NULL, 8) = 0 ./strace-static-x86_64: Process 5112 attached [pid 5111] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5112] set_robust_list(0x55555d6c46a0, 24 [pid 5111] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5102] +++ exited with 0 +++ [pid 5101] +++ exited with 0 +++ [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5112 [pid 5112] <... set_robust_list resumed>) = 0 [pid 5111] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5112] chdir("./3" [pid 5111] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5102, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5101, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5112] <... chdir resumed>) = 0 [pid 5074] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5112] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5112] <... prctl resumed>) = 0 [pid 5074] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5112] setpgid(0, 0 [pid 5074] <... openat resumed>) = 3 [pid 5112] <... setpgid resumed>) = 0 [pid 5074] newfstatat(3, "", [pid 5112] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5111] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5076] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5112] <... openat resumed>) = 3 [pid 5074] getdents64(3, 0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5112] write(3, "1000", 4 [pid 5074] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5112] <... write resumed>) = 4 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5112] close(3 [pid 5074] newfstatat(AT_FDCWD, "./2/binderfs", [pid 5112] <... close resumed>) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5112] symlink("/dev/binderfs", "./binderfs" [pid 5074] unlink("./2/binderfs" [pid 5112] <... symlink resumed>) = 0 [pid 5111] <... mprotect resumed>) = 0 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] <... unlink resumed>) = 0 [pid 5076] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5112] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] getdents64(3, [pid 5076] <... openat resumed>) = 3 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5112] <... futex resumed>) = 0 [pid 5111] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5076] newfstatat(3, "", [pid 5074] close(3 [pid 5112] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5111] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5074] <... close resumed>) = 0 [pid 5112] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5111] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5076] getdents64(3, [pid 5112] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5074] rmdir("./2"./strace-static-x86_64: Process 5113 attached [pid 5112] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5074] <... rmdir resumed>) = 0 [pid 5113] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5112] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5111] <... clone3 resumed> => {parent_tid=[5113]}, 88) = 5113 [pid 5076] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5113] <... rseq resumed>) = 0 [pid 5112] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5111] rt_sigprocmask(SIG_SETMASK, [], [pid 5110] <... bpf resumed>) = 6 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5113] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5112] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5111] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5110] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] newfstatat(AT_FDCWD, "./2/binderfs", [pid 5074] mkdir("./3", 0777 [pid 5113] <... set_robust_list resumed>) = 0 [pid 5112] <... mprotect resumed>) = 0 [pid 5111] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5110] <... futex resumed>) = 1 [pid 5109] <... futex resumed>) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] <... mkdir resumed>) = 0 [pid 5113] rt_sigprocmask(SIG_SETMASK, [], [pid 5112] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5111] <... futex resumed>) = 0 [pid 5110] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5109] exit_group(0 [pid 5076] unlink("./2/binderfs" [pid 5113] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5111] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5113] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5110] <... futex resumed>) = ? [pid 5109] <... exit_group resumed>) = ? [pid 5076] <... unlink resumed>) = 0 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5113] <... bpf resumed>) = 3 [pid 5112] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5110] +++ exited with 0 +++ [pid 5076] getdents64(3, [pid 5113] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5112] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5113] <... futex resumed>) = 1 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 ./strace-static-x86_64: Process 5115 attached ./strace-static-x86_64: Process 5114 attached [pid 5113] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5112] <... clone3 resumed> => {parent_tid=[5115]}, 88) = 5115 [pid 5115] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5114] set_robust_list(0x55555d6c46a0, 24 [pid 5112] rt_sigprocmask(SIG_SETMASK, [], [pid 5111] <... futex resumed>) = 0 [pid 5076] close(3 [pid 5115] <... rseq resumed>) = 0 [pid 5114] <... set_robust_list resumed>) = 0 [pid 5112] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5111] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5114 [pid 5076] <... close resumed>) = 0 [pid 5115] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5114] chdir("./3" [pid 5113] <... futex resumed>) = 0 [pid 5112] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5111] <... futex resumed>) = 1 [pid 5076] rmdir("./2" [pid 5115] <... set_robust_list resumed>) = 0 [pid 5113] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5112] <... futex resumed>) = 0 [pid 5111] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5115] rt_sigprocmask(SIG_SETMASK, [], [pid 5114] <... chdir resumed>) = 0 [pid 5113] <... bpf resumed>) = 4 [pid 5112] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5109] +++ exited with 0 +++ [pid 5076] <... rmdir resumed>) = 0 [pid 5115] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5114] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5113] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5115] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5114] <... prctl resumed>) = 0 [pid 5113] <... futex resumed>) = 1 [pid 5111] <... futex resumed>) = 0 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5109, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5076] mkdir("./3", 0777 [pid 5115] <... bpf resumed>) = 3 [pid 5114] setpgid(0, 0 [pid 5113] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5111] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] restart_syscall(<... resuming interrupted clone ...> [pid 5115] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5114] <... setpgid resumed>) = 0 [pid 5113] <... bpf resumed>) = 5 [pid 5111] <... futex resumed>) = 0 [pid 5078] <... restart_syscall resumed>) = 0 [pid 5076] <... mkdir resumed>) = 0 [pid 5115] <... futex resumed>) = 1 [pid 5112] <... futex resumed>) = 0 [pid 5111] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5115] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5114] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5112] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5115] <... bpf resumed>) = 4 [pid 5114] <... openat resumed>) = 3 [pid 5113] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5112] <... futex resumed>) = 0 [pid 5115] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5113] <... futex resumed>) = 1 [pid 5112] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5111] <... futex resumed>) = 0 [pid 5078] umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5115] <... futex resumed>) = 0 [pid 5114] write(3, "1000", 4 [pid 5113] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5112] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5111] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5115] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5113] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5112] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5115] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5113] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5112] <... futex resumed>) = 0 [pid 5078] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY./strace-static-x86_64: Process 5116 attached [pid 5115] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5114] <... write resumed>) = 4 [pid 5113] <... bpf resumed>) = 6 [pid 5112] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5111] <... futex resumed>) = 0 [pid 5078] <... openat resumed>) = 3 [pid 5116] set_robust_list(0x55555d6c46a0, 24 [pid 5115] <... bpf resumed>) = 5 [pid 5114] close(3 [pid 5113] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5111] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5116 [pid 5114] <... close resumed>) = 0 [pid 5111] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5114] symlink("/dev/binderfs", "./binderfs" [pid 5115] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5113] <... futex resumed>) = 0 [pid 5078] newfstatat(3, "", [pid 5115] <... futex resumed>) = 1 [pid 5113] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5112] <... futex resumed>) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5114] <... symlink resumed>) = 0 [pid 5116] <... set_robust_list resumed>) = 0 [pid 5115] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5112] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5111] exit_group(0 [pid 5078] getdents64(3, [pid 5115] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5112] <... futex resumed>) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5116] chdir("./3" [pid 5115] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5113] <... futex resumed>) = ? [pid 5112] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5111] <... exit_group resumed>) = ? [pid 5114] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5116] <... chdir resumed>) = 0 [pid 5115] <... bpf resumed>) = 6 [pid 5113] +++ exited with 0 +++ [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5116] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5114] <... futex resumed>) = 0 [pid 5078] newfstatat(AT_FDCWD, "./3/binderfs", [pid 5116] <... prctl resumed>) = 0 [pid 5115] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5114] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5115] <... futex resumed>) = 1 [pid 5112] <... futex resumed>) = 0 [pid 5078] unlink("./3/binderfs" [pid 5116] setpgid(0, 0 [pid 5115] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5114] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5112] exit_group(0 [pid 5078] <... unlink resumed>) = 0 [pid 5116] <... setpgid resumed>) = 0 [pid 5115] <... futex resumed>) = ? [pid 5114] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5116] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5115] +++ exited with 0 +++ [pid 5114] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5112] <... exit_group resumed>) = ? [pid 5078] getdents64(3, [pid 5114] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f3e2f5ed000 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5114] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5116] <... openat resumed>) = 3 [pid 5078] close(3 [pid 5116] write(3, "1000", 4 [pid 5114] <... mprotect resumed>) = 0 [pid 5078] <... close resumed>) = 0 [pid 5116] <... write resumed>) = 4 [pid 5078] rmdir("./3" [pid 5116] close(3 [pid 5114] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5078] <... rmdir resumed>) = 0 [pid 5116] <... close resumed>) = 0 [pid 5114] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5078] mkdir("./4", 0777 [pid 5116] symlink("/dev/binderfs", "./binderfs" [pid 5114] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5116] <... symlink resumed>) = 0 [pid 5078] <... mkdir resumed>) = 0 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5116] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5118 attached ) = 0 ./strace-static-x86_64: Process 5117 attached [pid 5118] set_robust_list(0x55555d6c46a0, 24 [pid 5117] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5116] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5114] <... clone3 resumed> => {parent_tid=[5117]}, 88) = 5117 [pid 5118] <... set_robust_list resumed>) = 0 [pid 5117] <... rseq resumed>) = 0 [pid 5116] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5114] rt_sigprocmask(SIG_SETMASK, [], [pid 5117] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5118 [pid 5118] chdir("./4" [pid 5117] <... set_robust_list resumed>) = 0 [pid 5116] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5114] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5118] <... chdir resumed>) = 0 [pid 5117] rt_sigprocmask(SIG_SETMASK, [], [pid 5116] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5114] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5111] +++ exited with 0 +++ [pid 5117] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5116] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5112] +++ exited with 0 +++ [pid 5118] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5114] <... futex resumed>) = 0 [pid 5117] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5111, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5114] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5118] <... prctl resumed>) = 0 [pid 5117] <... bpf resumed>) = 3 [pid 5116] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5077] restart_syscall(<... resuming interrupted clone ...> [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5112, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5118] setpgid(0, 0 [pid 5117] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5116] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5077] <... restart_syscall resumed>) = 0 [pid 5075] umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5118] <... setpgid resumed>) = 0 [pid 5117] <... futex resumed>) = 1 [pid 5116] <... mprotect resumed>) = 0 [pid 5114] <... futex resumed>) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5118] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5117] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5114] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5117] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5114] <... futex resumed>) = 0 [pid 5075] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5118] <... openat resumed>) = 3 [pid 5117] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5116] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5114] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] <... openat resumed>) = 3 [pid 5118] write(3, "1000", 4 [pid 5117] <... bpf resumed>) = 4 [pid 5116] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5118] <... write resumed>) = 4 [pid 5117] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5116] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5077] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5075] newfstatat(3, "", [pid 5118] close(3./strace-static-x86_64: Process 5119 attached ) = 0 [pid 5117] <... futex resumed>) = 1 [pid 5114] <... futex resumed>) = 0 [pid 5077] <... openat resumed>) = 3 [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5119] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5118] symlink("/dev/binderfs", "./binderfs" [pid 5117] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5116] <... clone3 resumed> => {parent_tid=[5119]}, 88) = 5119 [pid 5114] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] newfstatat(3, "", [pid 5119] <... rseq resumed>) = 0 [pid 5118] <... symlink resumed>) = 0 [pid 5117] <... bpf resumed>) = 5 [pid 5116] rt_sigprocmask(SIG_SETMASK, [], [pid 5114] <... futex resumed>) = 0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5075] getdents64(3, [pid 5119] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5118] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5117] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5116] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5114] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5119] <... set_robust_list resumed>) = 0 [pid 5118] <... futex resumed>) = 0 [pid 5117] <... futex resumed>) = 0 [pid 5116] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5114] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5077] getdents64(3, [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5119] rt_sigprocmask(SIG_SETMASK, [], [pid 5118] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5117] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5116] <... futex resumed>) = 0 [pid 5114] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5075] umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5119] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5118] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5117] <... bpf resumed>) = 6 [pid 5116] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5114] <... futex resumed>) = 0 [pid 5119] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5118] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5117] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5114] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5119] <... bpf resumed>) = 3 [pid 5118] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5114] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5119] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5118] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5114] exit_group(0 [pid 5119] <... futex resumed>) = 1 [pid 5077] newfstatat(AT_FDCWD, "./3/binderfs", [pid 5118] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5116] <... futex resumed>) = 0 [pid 5119] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5118] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5117] <... futex resumed>) = ? [pid 5116] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5114] <... exit_group resumed>) = ? [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5075] newfstatat(AT_FDCWD, "./3/binderfs", [pid 5119] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5118] <... mprotect resumed>) = 0 [pid 5117] +++ exited with 0 +++ [pid 5116] <... futex resumed>) = 0 [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5119] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5118] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5116] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5114] +++ exited with 0 +++ [pid 5077] unlink("./3/binderfs" [pid 5075] unlink("./3/binderfs" [pid 5119] <... bpf resumed>) = 4 [pid 5118] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5077] <... unlink resumed>) = 0 [pid 5075] <... unlink resumed>) = 0 [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5114, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5074] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5119] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] getdents64(3, [pid 5118] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5119] <... futex resumed>) = 1 [pid 5116] <... futex resumed>) = 0 [pid 5077] getdents64(3, [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5119] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5075] close(3 [pid 5074] umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5120 attached [pid 5116] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] close(3 [pid 5075] <... close resumed>) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5120] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5119] <... futex resumed>) = 0 [pid 5118] <... clone3 resumed> => {parent_tid=[5120]}, 88) = 5120 [pid 5116] <... futex resumed>) = 1 [pid 5077] <... close resumed>) = 0 [pid 5075] rmdir("./3" [pid 5074] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5120] <... rseq resumed>) = 0 [pid 5119] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5118] rt_sigprocmask(SIG_SETMASK, [], [pid 5116] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] rmdir("./3" [pid 5075] <... rmdir resumed>) = 0 [pid 5074] <... openat resumed>) = 3 [pid 5120] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5119] <... bpf resumed>) = 5 [pid 5118] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] <... rmdir resumed>) = 0 [pid 5120] <... set_robust_list resumed>) = 0 [pid 5074] newfstatat(3, "", [pid 5120] rt_sigprocmask(SIG_SETMASK, [], [pid 5118] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5120] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5119] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5118] <... futex resumed>) = 0 [pid 5077] mkdir("./4", 0777 [pid 5075] mkdir("./4", 0777 [pid 5074] getdents64(3, [pid 5120] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5119] <... futex resumed>) = 1 [pid 5118] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5116] <... futex resumed>) = 0 [pid 5077] <... mkdir resumed>) = 0 [pid 5075] <... mkdir resumed>) = 0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5120] <... bpf resumed>) = 3 [pid 5119] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5116] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5119] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5116] <... futex resumed>) = 0 [pid 5074] umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5116] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5120] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5119] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5122 attached ./strace-static-x86_64: Process 5121 attached [pid 5120] <... futex resumed>) = 1 [pid 5119] <... bpf resumed>) = 6 [pid 5118] <... futex resumed>) = 0 [pid 5074] newfstatat(AT_FDCWD, "./3/binderfs", [pid 5120] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5119] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5118] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5122] set_robust_list(0x55555d6c46a0, 24 [pid 5121] set_robust_list(0x55555d6c46a0, 24 [pid 5120] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5120] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5122] <... set_robust_list resumed>) = 0 [pid 5121] <... set_robust_list resumed>) = 0 [pid 5118] <... futex resumed>) = 0 [pid 5122] chdir("./4" [pid 5121] chdir("./4" [pid 5120] <... bpf resumed>) = 4 [pid 5119] <... futex resumed>) = 1 [pid 5118] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5116] <... futex resumed>) = 0 [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5121 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5122 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5120] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5119] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5118] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5116] exit_group(0 [pid 5074] unlink("./3/binderfs" [pid 5120] <... futex resumed>) = 0 [pid 5119] <... futex resumed>) = ? [pid 5116] <... exit_group resumed>) = ? [pid 5074] <... unlink resumed>) = 0 [pid 5122] <... chdir resumed>) = 0 [pid 5121] <... chdir resumed>) = 0 [pid 5120] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5119] +++ exited with 0 +++ [pid 5118] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5116] +++ exited with 0 +++ [pid 5122] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5121] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5118] <... futex resumed>) = 0 [pid 5121] <... prctl resumed>) = 0 [pid 5122] <... prctl resumed>) = 0 [pid 5118] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5121] setpgid(0, 0 [pid 5122] setpgid(0, 0 [pid 5121] <... setpgid resumed>) = 0 [pid 5120] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5116, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5074] getdents64(3, [pid 5120] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5122] <... setpgid resumed>) = 0 [pid 5121] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5120] <... bpf resumed>) = 5 [pid 5076] umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] close(3) = 0 [pid 5074] rmdir("./3" [pid 5120] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... rmdir resumed>) = 0 [pid 5122] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5121] <... openat resumed>) = 3 [pid 5120] <... futex resumed>) = 1 [pid 5118] <... futex resumed>) = 0 [pid 5076] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5074] mkdir("./4", 0777 [pid 5120] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5118] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5122] <... openat resumed>) = 3 [pid 5121] write(3, "1000", 4 [pid 5120] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5118] <... futex resumed>) = 0 [pid 5076] <... openat resumed>) = 3 [pid 5074] <... mkdir resumed>) = 0 [pid 5120] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5118] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5121] <... write resumed>) = 4 [pid 5122] write(3, "1000", 4 [pid 5121] close(3 [pid 5076] newfstatat(3, "", [pid 5122] <... write resumed>) = 4 [pid 5121] <... close resumed>) = 0 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5122] close(3 [pid 5121] symlink("/dev/binderfs", "./binderfs" [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 ./strace-static-x86_64: Process 5123 attached [pid 5122] <... close resumed>) = 0 [pid 5120] <... bpf resumed>) = 6 [pid 5076] getdents64(3, [pid 5122] symlink("/dev/binderfs", "./binderfs" [pid 5120] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5121] <... symlink resumed>) = 0 [pid 5120] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5123] set_robust_list(0x55555d6c46a0, 24 [pid 5118] <... futex resumed>) = 0 [pid 5122] <... symlink resumed>) = 0 [pid 5123] <... set_robust_list resumed>) = 0 [pid 5118] exit_group(0 [pid 5076] umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5121] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5120] <... futex resumed>) = ? [pid 5118] <... exit_group resumed>) = ? [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5123 [pid 5123] chdir("./4" [pid 5122] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5121] <... futex resumed>) = 0 [pid 5120] +++ exited with 0 +++ [pid 5118] +++ exited with 0 +++ [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5121] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5118, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5076] newfstatat(AT_FDCWD, "./3/binderfs", [pid 5122] <... futex resumed>) = 0 [pid 5123] <... chdir resumed>) = 0 [pid 5122] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5121] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5123] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5122] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5121] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5122] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5121] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5123] <... prctl resumed>) = 0 [pid 5122] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5076] unlink("./3/binderfs" [pid 5123] setpgid(0, 0 [pid 5121] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5123] <... setpgid resumed>) = 0 [pid 5122] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5121] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5076] <... unlink resumed>) = 0 [pid 5076] getdents64(3, [pid 5078] umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5123] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5122] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5121] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5076] close(3 [pid 5078] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5123] <... openat resumed>) = 3 [pid 5122] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5123] write(3, "1000", 4 [pid 5122] <... mprotect resumed>) = 0 [pid 5121] <... mprotect resumed>) = 0 [pid 5078] <... openat resumed>) = 3 [pid 5076] <... close resumed>) = 0 [pid 5123] <... write resumed>) = 4 [pid 5122] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5121] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5078] newfstatat(3, "", [pid 5076] rmdir("./3" [pid 5123] close(3) = 0 [pid 5122] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5121] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5076] <... rmdir resumed>) = 0 [pid 5123] symlink("/dev/binderfs", "./binderfs" [pid 5122] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5121] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5078] getdents64(3, [pid 5076] mkdir("./4", 0777./strace-static-x86_64: Process 5125 attached ./strace-static-x86_64: Process 5124 attached [pid 5123] <... symlink resumed>) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5125] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5124] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5123] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5122] <... clone3 resumed> => {parent_tid=[5124]}, 88) = 5124 [pid 5121] <... clone3 resumed> => {parent_tid=[5125]}, 88) = 5125 [pid 5078] umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] <... mkdir resumed>) = 0 [pid 5125] <... rseq resumed>) = 0 [pid 5124] <... rseq resumed>) = 0 [pid 5123] <... futex resumed>) = 0 [pid 5122] rt_sigprocmask(SIG_SETMASK, [], [pid 5121] rt_sigprocmask(SIG_SETMASK, [], [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5125] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5124] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5123] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5078] newfstatat(AT_FDCWD, "./4/binderfs", [pid 5122] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5121] <... rt_sigprocmask resumed>NULL, 8) = 0 ./strace-static-x86_64: Process 5126 attached [pid 5125] <... set_robust_list resumed>) = 0 [pid 5124] <... set_robust_list resumed>) = 0 [pid 5123] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5122] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5121] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5126] set_robust_list(0x55555d6c46a0, 24 [pid 5125] rt_sigprocmask(SIG_SETMASK, [], [pid 5124] rt_sigprocmask(SIG_SETMASK, [], [pid 5123] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5122] <... futex resumed>) = 0 [pid 5121] <... futex resumed>) = 0 [pid 5078] unlink("./4/binderfs" [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5126 [pid 5125] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5124] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5123] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5122] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5121] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5125] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5124] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5123] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5126] <... set_robust_list resumed>) = 0 [pid 5125] <... bpf resumed>) = 3 [pid 5078] <... unlink resumed>) = 0 [pid 5124] <... bpf resumed>) = 3 [pid 5123] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5126] chdir("./4" [pid 5123] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5125] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5124] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5125] <... futex resumed>) = 1 [pid 5124] <... futex resumed>) = 1 [pid 5123] <... mprotect resumed>) = 0 [pid 5122] <... futex resumed>) = 0 [pid 5121] <... futex resumed>) = 0 [pid 5126] <... chdir resumed>) = 0 [pid 5125] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5124] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5122] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5121] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] getdents64(3, [pid 5126] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5125] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5124] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5123] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5122] <... futex resumed>) = 0 [pid 5121] <... futex resumed>) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5126] <... prctl resumed>) = 0 [pid 5125] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5124] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5122] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5121] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5126] setpgid(0, 0 [pid 5125] <... bpf resumed>) = 4 [pid 5124] <... bpf resumed>) = 4 [pid 5123] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5078] close(3 [pid 5126] <... setpgid resumed>) = 0 [pid 5078] <... close resumed>) = 0 [pid 5126] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5125] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5124] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5123] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5078] rmdir("./4" [pid 5126] <... openat resumed>) = 3 [pid 5124] <... futex resumed>) = 1 ./strace-static-x86_64: Process 5127 attached [pid 5126] write(3, "1000", 4 [pid 5125] <... futex resumed>) = 1 [pid 5122] <... futex resumed>) = 0 [pid 5121] <... futex resumed>) = 0 [pid 5127] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5078] <... rmdir resumed>) = 0 [pid 5127] <... rseq resumed>) = 0 [pid 5126] <... write resumed>) = 4 [pid 5122] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5121] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5127] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5126] close(3 [pid 5122] <... futex resumed>) = 0 [pid 5121] <... futex resumed>) = 0 [pid 5127] <... set_robust_list resumed>) = 0 [pid 5126] <... close resumed>) = 0 [pid 5122] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5121] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5127] rt_sigprocmask(SIG_SETMASK, [], [pid 5126] symlink("/dev/binderfs", "./binderfs" [pid 5125] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5124] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5123] <... clone3 resumed> => {parent_tid=[5127]}, 88) = 5127 [pid 5078] mkdir("./5", 0777 [pid 5127] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5126] <... symlink resumed>) = 0 [pid 5123] rt_sigprocmask(SIG_SETMASK, [], [pid 5127] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5123] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5123] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5127] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5126] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5123] <... futex resumed>) = 0 [pid 5127] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5126] <... futex resumed>) = 0 [pid 5123] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5127] <... bpf resumed>) = 3 [pid 5126] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5078] <... mkdir resumed>) = 0 [pid 5127] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5126] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5124] <... bpf resumed>) = 5 [pid 5127] <... futex resumed>) = 1 [pid 5126] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5123] <... futex resumed>) = 0 [pid 5127] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5126] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5126] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f3e2f5ed000 [pid 5123] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5126] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5127] <... futex resumed>) = 0 [pid 5126] <... mprotect resumed>) = 0 [pid 5125] <... bpf resumed>) = 5 [pid 5124] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5123] <... futex resumed>) = 1 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5127] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5126] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5124] <... futex resumed>) = 1 [pid 5123] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5122] <... futex resumed>) = 0 [pid 5124] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5127] <... bpf resumed>) = 4 [pid 5126] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5125] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5122] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5127] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5126] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5124] <... futex resumed>) = 0 [pid 5122] <... futex resumed>) = 1 ./strace-static-x86_64: Process 5129 attached [pid 5127] <... futex resumed>) = 1 [pid 5125] <... futex resumed>) = 1 [pid 5124] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5123] <... futex resumed>) = 0 [pid 5122] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5121] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5128 attached [pid 5129] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5127] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5126] <... clone3 resumed> => {parent_tid=[5129]}, 88) = 5129 [pid 5125] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5124] <... bpf resumed>) = 6 [pid 5123] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5121] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5128 [pid 5128] set_robust_list(0x55555d6c46a0, 24 [pid 5129] <... rseq resumed>) = 0 [pid 5127] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5126] rt_sigprocmask(SIG_SETMASK, [], [pid 5125] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5123] <... futex resumed>) = 0 [pid 5121] <... futex resumed>) = 0 [pid 5128] <... set_robust_list resumed>) = 0 [pid 5129] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5127] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5126] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5125] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5124] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5123] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5121] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5128] chdir("./5" [pid 5129] <... set_robust_list resumed>) = 0 [pid 5127] <... bpf resumed>) = 5 [pid 5126] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5125] <... bpf resumed>) = 6 [pid 5124] <... futex resumed>) = 1 [pid 5122] <... futex resumed>) = 0 [pid 5129] rt_sigprocmask(SIG_SETMASK, [], [pid 5125] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5124] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5128] <... chdir resumed>) = 0 [pid 5126] <... futex resumed>) = 0 [pid 5125] <... futex resumed>) = 1 [pid 5122] exit_group(0 [pid 5128] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5129] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5127] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5126] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5125] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5124] <... futex resumed>) = ? [pid 5122] <... exit_group resumed>) = ? [pid 5121] <... futex resumed>) = 0 [pid 5128] <... prctl resumed>) = 0 [pid 5129] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5127] <... futex resumed>) = 1 [pid 5123] <... futex resumed>) = 0 [pid 5121] exit_group(0 [pid 5128] setpgid(0, 0 [pid 5129] <... bpf resumed>) = 3 [pid 5127] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5123] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5121] <... exit_group resumed>) = ? [pid 5129] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5127] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5123] <... futex resumed>) = 0 [pid 5129] <... futex resumed>) = 1 [pid 5127] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5126] <... futex resumed>) = 0 [pid 5123] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5128] <... setpgid resumed>) = 0 [pid 5129] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5127] <... bpf resumed>) = 6 [pid 5126] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5125] <... futex resumed>) = ? [pid 5129] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5126] <... futex resumed>) = 0 [pid 5129] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5127] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5126] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5128] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5129] <... bpf resumed>) = 4 [pid 5127] <... futex resumed>) = 1 [pid 5123] <... futex resumed>) = 0 [pid 5124] +++ exited with 0 +++ [pid 5122] +++ exited with 0 +++ [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5122, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5075] restart_syscall(<... resuming interrupted clone ...> [pid 5129] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5127] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5123] exit_group(0 [pid 5128] <... openat resumed>) = 3 [pid 5129] <... futex resumed>) = 1 [pid 5127] <... futex resumed>) = ? [pid 5126] <... futex resumed>) = 0 [pid 5123] <... exit_group resumed>) = ? [pid 5128] write(3, "1000", 4 [pid 5129] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5127] +++ exited with 0 +++ [pid 5126] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... restart_syscall resumed>) = 0 [pid 5128] <... write resumed>) = 4 [pid 5128] close(3) = 0 [pid 5075] umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5128] symlink("/dev/binderfs", "./binderfs" [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5129] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5126] <... futex resumed>) = 0 [pid 5075] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5129] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5126] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5128] <... symlink resumed>) = 0 [pid 5129] <... bpf resumed>) = 5 [pid 5075] <... openat resumed>) = 3 [pid 5075] newfstatat(3, "", [pid 5128] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5128] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, NULL, 8) = 0 [pid 5129] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5128] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5129] <... futex resumed>) = 1 [pid 5126] <... futex resumed>) = 0 [pid 5129] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5126] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5128] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5126] <... futex resumed>) = 0 [pid 5075] getdents64(3, [pid 5128] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5126] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5128] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5128] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5125] +++ exited with 0 +++ [pid 5121] +++ exited with 0 +++ [pid 5128] <... mprotect resumed>) = 0 [pid 5075] umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5123] +++ exited with 0 +++ [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5121, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5128] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5075] newfstatat(AT_FDCWD, "./4/binderfs", [pid 5128] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5123, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5128] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5077] umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5130 attached [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] unlink("./4/binderfs" [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5130] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5128] <... clone3 resumed> => {parent_tid=[5130]}, 88) = 5130 [pid 5077] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5074] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5130] <... rseq resumed>) = 0 [pid 5128] rt_sigprocmask(SIG_SETMASK, [], [pid 5077] <... openat resumed>) = 3 [pid 5075] <... unlink resumed>) = 0 [pid 5074] <... openat resumed>) = 3 [pid 5130] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5077] newfstatat(3, "", [pid 5074] newfstatat(3, "", [pid 5130] <... set_robust_list resumed>) = 0 [pid 5128] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5075] getdents64(3, [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5130] rt_sigprocmask(SIG_SETMASK, [], [pid 5128] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] getdents64(3, [pid 5074] getdents64(3, [pid 5130] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5128] <... futex resumed>) = 0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5130] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5128] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] close(3 [pid 5074] umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5130] <... bpf resumed>) = 3 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] <... close resumed>) = 0 [pid 5077] newfstatat(AT_FDCWD, "./4/binderfs", [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] newfstatat(AT_FDCWD, "./4/binderfs", [pid 5077] unlink("./4/binderfs" [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5077] <... unlink resumed>) = 0 [pid 5075] rmdir("./4" [pid 5074] unlink("./4/binderfs" [pid 5130] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] getdents64(3, [pid 5074] <... unlink resumed>) = 0 [pid 5130] <... futex resumed>) = 1 [pid 5128] <... futex resumed>) = 0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5075] <... rmdir resumed>) = 0 [pid 5130] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5128] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] close(3 [pid 5074] getdents64(3, [pid 5077] <... close resumed>) = 0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5077] rmdir("./4" [pid 5130] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5128] <... futex resumed>) = 0 [pid 5129] <... bpf resumed>) = 6 [pid 5075] mkdir("./5", 0777 [pid 5074] close(3 [pid 5130] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5128] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5129] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... rmdir resumed>) = 0 [pid 5075] <... mkdir resumed>) = 0 [pid 5074] <... close resumed>) = 0 [pid 5130] <... bpf resumed>) = 4 [pid 5129] <... futex resumed>) = 1 [pid 5126] <... futex resumed>) = 0 [pid 5077] mkdir("./5", 0777 [pid 5074] rmdir("./4" [pid 5129] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5126] exit_group(0) = ? [pid 5129] <... futex resumed>) = ? [pid 5077] <... mkdir resumed>) = 0 [pid 5130] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5129] +++ exited with 0 +++ [pid 5126] +++ exited with 0 +++ [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] <... rmdir resumed>) = 0 [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5126, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5130] <... futex resumed>) = 1 [pid 5130] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5128] <... futex resumed>) = 0 [pid 5076] umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5130] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5128] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5076] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5074] mkdir("./5", 0777./strace-static-x86_64: Process 5132 attached ./strace-static-x86_64: Process 5131 attached [pid 5130] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5128] <... futex resumed>) = 0 [pid 5132] set_robust_list(0x55555d6c46a0, 24 [pid 5131] set_robust_list(0x55555d6c46a0, 24 [pid 5076] <... openat resumed>) = 3 [pid 5132] <... set_robust_list resumed>) = 0 [pid 5131] <... set_robust_list resumed>) = 0 [pid 5076] newfstatat(3, "", [pid 5132] chdir("./5" [pid 5131] chdir("./5" [pid 5130] <... bpf resumed>) = 5 [pid 5128] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5131 [pid 5074] <... mkdir resumed>) = 0 [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5132 [pid 5132] <... chdir resumed>) = 0 [pid 5131] <... chdir resumed>) = 0 [pid 5130] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5133 attached [pid 5132] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5131] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5130] <... futex resumed>) = 1 [pid 5128] <... futex resumed>) = 0 [pid 5076] getdents64(3, [pid 5132] <... prctl resumed>) = 0 [pid 5131] <... prctl resumed>) = 0 [pid 5130] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5128] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5132] setpgid(0, 0 [pid 5128] <... futex resumed>) = 0 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5131] setpgid(0, 0 [pid 5133] set_robust_list(0x55555d6c46a0, 24 [pid 5132] <... setpgid resumed>) = 0 [pid 5131] <... setpgid resumed>) = 0 [pid 5130] <... bpf resumed>) = 6 [pid 5128] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5133] <... set_robust_list resumed>) = 0 [pid 5076] umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5133 [pid 5132] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5131] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5130] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5133] chdir("./5" [pid 5132] <... openat resumed>) = 3 [pid 5131] <... openat resumed>) = 3 [pid 5130] <... futex resumed>) = 1 [pid 5128] <... futex resumed>) = 0 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5133] <... chdir resumed>) = 0 [pid 5132] write(3, "1000", 4 [pid 5131] write(3, "1000", 4 [pid 5130] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5128] exit_group(0 [pid 5076] newfstatat(AT_FDCWD, "./4/binderfs", [pid 5133] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5132] <... write resumed>) = 4 [pid 5131] <... write resumed>) = 4 [pid 5130] <... futex resumed>) = ? [pid 5128] <... exit_group resumed>) = ? [pid 5133] <... prctl resumed>) = 0 [pid 5132] close(3 [pid 5131] close(3 [pid 5130] +++ exited with 0 +++ [pid 5128] +++ exited with 0 +++ [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5133] setpgid(0, 0 [pid 5132] <... close resumed>) = 0 [pid 5131] <... close resumed>) = 0 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5128, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5076] unlink("./4/binderfs" [pid 5133] <... setpgid resumed>) = 0 [pid 5132] symlink("/dev/binderfs", "./binderfs" [pid 5131] symlink("/dev/binderfs", "./binderfs" [pid 5133] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5132] <... symlink resumed>) = 0 [pid 5131] <... symlink resumed>) = 0 [pid 5076] <... unlink resumed>) = 0 [pid 5133] <... openat resumed>) = 3 [pid 5132] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5132] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5133] write(3, "1000", 4 [pid 5132] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5133] <... write resumed>) = 4 [pid 5132] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5133] close(3) = 0 [pid 5132] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5133] symlink("/dev/binderfs", "./binderfs" [pid 5132] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5131] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] umount2("./5", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] getdents64(3, [pid 5133] <... symlink resumed>) = 0 [pid 5132] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5131] <... futex resumed>) = 0 [pid 5131] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5131] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] close(3 [pid 5131] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5078] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5131] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5076] <... close resumed>) = 0 [pid 5133] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5132] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5131] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5078] <... openat resumed>) = 3 [pid 5076] rmdir("./4" [pid 5133] <... futex resumed>) = 0 [pid 5132] <... mprotect resumed>) = 0 [pid 5133] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5132] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5076] <... rmdir resumed>) = 0 [pid 5133] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5131] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5078] newfstatat(3, "", [pid 5076] mkdir("./5", 0777 [pid 5133] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5132] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5131] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5133] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5132] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5078] getdents64(3, [pid 5131] <... mprotect resumed>) = 0 [pid 5133] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5076] <... mkdir resumed>) = 0 ./strace-static-x86_64: Process 5134 attached [pid 5133] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5132] <... clone3 resumed> => {parent_tid=[5134]}, 88) = 5134 [pid 5131] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5078] umount2("./5/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5134] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5133] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5132] rt_sigprocmask(SIG_SETMASK, [], [pid 5131] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5133] <... mprotect resumed>) = 0 [pid 5132] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5132] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5133] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5132] <... futex resumed>) = 0 [pid 5132] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5133] <... rt_sigprocmask resumed>[], 8) = 0 ./strace-static-x86_64: Process 5135 attached [pid 5134] <... rseq resumed>) = 0 [pid 5131] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5078] newfstatat(AT_FDCWD, "./5/binderfs", [pid 5134] set_robust_list(0x7f3e2f60d9a0, 24./strace-static-x86_64: Process 5136 attached [pid 5135] set_robust_list(0x55555d6c46a0, 24 [pid 5134] <... set_robust_list resumed>) = 0 [pid 5133] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5135 ./strace-static-x86_64: Process 5137 attached [pid 5136] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5135] <... set_robust_list resumed>) = 0 [pid 5134] rt_sigprocmask(SIG_SETMASK, [], [pid 5131] <... clone3 resumed> => {parent_tid=[5136]}, 88) = 5136 [pid 5078] unlink("./5/binderfs" [pid 5137] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5136] <... rseq resumed>) = 0 [pid 5135] chdir("./5" [pid 5134] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5133] <... clone3 resumed> => {parent_tid=[5137]}, 88) = 5137 [pid 5131] rt_sigprocmask(SIG_SETMASK, [], [pid 5078] <... unlink resumed>) = 0 [pid 5137] <... rseq resumed>) = 0 [pid 5136] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5133] rt_sigprocmask(SIG_SETMASK, [], [pid 5131] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5136] <... set_robust_list resumed>) = 0 [pid 5131] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5136] rt_sigprocmask(SIG_SETMASK, [], [pid 5131] <... futex resumed>) = 0 [pid 5136] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5137] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5135] <... chdir resumed>) = 0 [pid 5133] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5131] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] getdents64(3, [pid 5137] <... set_robust_list resumed>) = 0 [pid 5135] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5133] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5137] rt_sigprocmask(SIG_SETMASK, [], [pid 5135] <... prctl resumed>) = 0 [pid 5133] <... futex resumed>) = 0 [pid 5078] close(3 [pid 5137] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5136] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5135] setpgid(0, 0 [pid 5134] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5133] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... close resumed>) = 0 [pid 5137] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5136] <... bpf resumed>) = 3 [pid 5135] <... setpgid resumed>) = 0 [pid 5134] <... bpf resumed>) = 3 [pid 5078] rmdir("./5" [pid 5137] <... bpf resumed>) = 3 [pid 5136] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5135] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5134] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... rmdir resumed>) = 0 [pid 5136] <... futex resumed>) = 1 [pid 5134] <... futex resumed>) = 1 [pid 5132] <... futex resumed>) = 0 [pid 5131] <... futex resumed>) = 0 [pid 5136] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5134] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5132] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5131] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5136] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5134] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5132] <... futex resumed>) = 0 [pid 5131] <... futex resumed>) = 0 [pid 5136] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5134] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5132] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5131] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5136] <... bpf resumed>) = 4 [pid 5137] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5136] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5135] <... openat resumed>) = 3 [pid 5134] <... bpf resumed>) = 4 [pid 5078] mkdir("./6", 0777 [pid 5137] <... futex resumed>) = 1 [pid 5136] <... futex resumed>) = 1 [pid 5135] write(3, "1000", 4 [pid 5134] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5133] <... futex resumed>) = 0 [pid 5131] <... futex resumed>) = 0 [pid 5078] <... mkdir resumed>) = 0 [pid 5137] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5136] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5135] <... write resumed>) = 4 [pid 5134] <... futex resumed>) = 1 [pid 5133] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5132] <... futex resumed>) = 0 [pid 5131] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5137] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5136] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5135] close(3 [pid 5134] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5133] <... futex resumed>) = 0 [pid 5132] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5131] <... futex resumed>) = 0 [pid 5137] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5135] <... close resumed>) = 0 [pid 5133] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5138 attached [pid 5136] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5135] symlink("/dev/binderfs", "./binderfs" [pid 5134] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5132] <... futex resumed>) = 0 [pid 5131] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5138 [pid 5138] set_robust_list(0x55555d6c46a0, 24 [pid 5137] <... bpf resumed>) = 4 [pid 5136] <... bpf resumed>) = 5 [pid 5135] <... symlink resumed>) = 0 [pid 5134] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5132] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5138] <... set_robust_list resumed>) = 0 [pid 5137] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5136] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5135] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5138] chdir("./6" [pid 5137] <... futex resumed>) = 1 [pid 5136] <... futex resumed>) = 1 [pid 5135] <... futex resumed>) = 0 [pid 5134] <... bpf resumed>) = 5 [pid 5133] <... futex resumed>) = 0 [pid 5131] <... futex resumed>) = 0 [pid 5138] <... chdir resumed>) = 0 [pid 5137] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5136] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5135] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5134] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5133] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5131] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5138] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5133] <... futex resumed>) = 0 [pid 5133] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5135] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5138] setpgid(0, 0 [pid 5136] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5135] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5134] <... futex resumed>) = 1 [pid 5132] <... futex resumed>) = 0 [pid 5131] <... futex resumed>) = 0 [pid 5136] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5134] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5132] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5131] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5137] <... bpf resumed>) = 5 [pid 5136] <... bpf resumed>) = 6 [pid 5135] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5134] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5132] <... futex resumed>) = 0 [pid 5138] <... setpgid resumed>) = 0 [pid 5136] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5134] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5132] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5138] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5136] <... futex resumed>) = 1 [pid 5135] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5134] <... bpf resumed>) = 6 [pid 5131] <... futex resumed>) = 0 [pid 5137] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5136] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5135] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5131] exit_group(0 [pid 5137] <... futex resumed>) = 1 [pid 5137] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5136] <... futex resumed>) = ? [pid 5135] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5134] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5133] <... futex resumed>) = 0 [pid 5131] <... exit_group resumed>) = ? [pid 5138] <... openat resumed>) = 3 [pid 5136] +++ exited with 0 +++ [pid 5135] <... mprotect resumed>) = 0 [pid 5134] <... futex resumed>) = 1 [pid 5133] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5132] <... futex resumed>) = 0 [pid 5138] write(3, "1000", 4 [pid 5137] <... futex resumed>) = 0 [pid 5135] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5134] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5133] <... futex resumed>) = 1 [pid 5138] <... write resumed>) = 4 [pid 5137] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5133] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5132] exit_group(0 [pid 5138] close(3 [pid 5135] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5134] <... futex resumed>) = ? [pid 5132] <... exit_group resumed>) = ? [pid 5138] <... close resumed>) = 0 [pid 5135] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5134] +++ exited with 0 +++ [pid 5138] symlink("/dev/binderfs", "./binderfs") = 0 ./strace-static-x86_64: Process 5139 attached [pid 5139] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053) = 0 [pid 5135] <... clone3 resumed> => {parent_tid=[5139]}, 88) = 5139 [pid 5139] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5138] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5135] rt_sigprocmask(SIG_SETMASK, [], [pid 5139] <... set_robust_list resumed>) = 0 [pid 5138] <... futex resumed>) = 0 [pid 5139] rt_sigprocmask(SIG_SETMASK, [], [pid 5138] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5135] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5139] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5138] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5139] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5138] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5135] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5139] <... futex resumed>) = 0 [pid 5138] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5135] <... futex resumed>) = 1 [pid 5139] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5138] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5135] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5139] <... bpf resumed>) = 3 [pid 5138] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5139] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5138] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5135] <... futex resumed>) = 0 [pid 5139] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5138] <... mprotect resumed>) = 0 [pid 5135] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5139] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5138] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5137] <... bpf resumed>) = 6 [pid 5135] <... futex resumed>) = 0 [pid 5131] +++ exited with 0 +++ [pid 5139] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5138] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5137] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5135] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5131, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- [pid 5139] <... bpf resumed>) = 4 [pid 5138] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5137] <... futex resumed>) = 1 [pid 5133] <... futex resumed>) = 0 [pid 5075] restart_syscall(<... resuming interrupted clone ...>./strace-static-x86_64: Process 5140 attached [pid 5139] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5137] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5133] exit_group(0 [pid 5140] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5139] <... futex resumed>) = 1 [pid 5135] <... futex resumed>) = 0 [pid 5140] <... rseq resumed>) = 0 [pid 5139] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5135] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5140] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5139] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5138] <... clone3 resumed> => {parent_tid=[5140]}, 88) = 5140 [pid 5137] <... futex resumed>) = ? [pid 5135] <... futex resumed>) = 0 [pid 5133] <... exit_group resumed>) = ? [pid 5075] <... restart_syscall resumed>) = 0 [pid 5140] <... set_robust_list resumed>) = 0 [pid 5139] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5138] rt_sigprocmask(SIG_SETMASK, [], [pid 5137] +++ exited with 0 +++ [pid 5135] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5140] rt_sigprocmask(SIG_SETMASK, [], [pid 5138] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5138] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] umount2("./5", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5139] <... bpf resumed>) = 5 [pid 5138] <... futex resumed>) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5140] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5139] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5138] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5140] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5139] <... futex resumed>) = 1 [pid 5135] <... futex resumed>) = 0 [pid 5075] <... openat resumed>) = 3 [pid 5140] <... bpf resumed>) = 3 [pid 5139] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5135] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5140] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5135] <... futex resumed>) = 0 [pid 5075] newfstatat(3, "", [pid 5140] <... futex resumed>) = 1 [pid 5138] <... futex resumed>) = 0 [pid 5135] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5140] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5138] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5140] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5138] <... futex resumed>) = 0 [pid 5075] getdents64(3, [pid 5140] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 4 [pid 5138] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5132] +++ exited with 0 +++ [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5075] umount2("./5/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5140] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5132, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5140] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5077] umount2("./5", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] newfstatat(AT_FDCWD, "./5/binderfs", [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5138] <... futex resumed>) = 0 [pid 5077] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5133] +++ exited with 0 +++ [pid 5077] <... openat resumed>) = 3 [pid 5138] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] newfstatat(3, "", [pid 5075] unlink("./5/binderfs" [pid 5140] <... futex resumed>) = 0 [pid 5138] <... futex resumed>) = 1 [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5075] <... unlink resumed>) = 0 [pid 5138] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5140] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5077] getdents64(3, [pid 5075] getdents64(3, [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5133, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5140] <... bpf resumed>) = 5 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5074] umount2("./5", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5077] umount2("./5/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] close(3 [pid 5074] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5140] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] <... close resumed>) = 0 [pid 5074] <... openat resumed>) = 3 [pid 5140] <... futex resumed>) = 1 [pid 5138] <... futex resumed>) = 0 [pid 5077] newfstatat(AT_FDCWD, "./5/binderfs", [pid 5075] rmdir("./5" [pid 5138] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5140] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5138] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5075] <... rmdir resumed>) = 0 [pid 5074] newfstatat(3, "", [pid 5077] unlink("./5/binderfs") = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5074] getdents64(3, [pid 5077] getdents64(3, [pid 5075] mkdir("./6", 0777 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5075] <... mkdir resumed>) = 0 [pid 5077] close(3 [pid 5074] umount2("./5/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5077] <... close resumed>) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5077] rmdir("./5" [pid 5074] newfstatat(AT_FDCWD, "./5/binderfs", [pid 5140] <... bpf resumed>) = 6 [pid 5139] <... bpf resumed>) = 6 [pid 5077] <... rmdir resumed>) = 0 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5140] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] unlink("./5/binderfs" [pid 5140] <... futex resumed>) = 1 [pid 5074] <... unlink resumed>) = 0 [pid 5140] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5077] mkdir("./6", 0777) = 0 [pid 5139] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5138] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5141 attached [pid 5139] <... futex resumed>) = 1 [pid 5138] exit_group(0 [pid 5139] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5138] <... exit_group resumed>) = ? [pid 5141] set_robust_list(0x55555d6c46a0, 24 [pid 5140] <... futex resumed>) = ? [pid 5135] <... futex resumed>) = 0 [pid 5074] getdents64(3, [pid 5141] <... set_robust_list resumed>) = 0 [pid 5140] +++ exited with 0 +++ [pid 5138] +++ exited with 0 +++ [pid 5135] exit_group(0 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 ./strace-static-x86_64: Process 5142 attached [pid 5141] chdir("./6" [pid 5139] <... futex resumed>) = ? [pid 5135] <... exit_group resumed>) = ? [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5138, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5141 [pid 5074] close(3 [pid 5142] set_robust_list(0x55555d6c46a0, 24 [pid 5141] <... chdir resumed>) = 0 [pid 5139] +++ exited with 0 +++ [pid 5135] +++ exited with 0 +++ [pid 5142] <... set_robust_list resumed>) = 0 [pid 5074] <... close resumed>) = 0 [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5135, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5142] chdir("./6" [pid 5074] rmdir("./5" [pid 5141] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5078] umount2("./6", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5142] <... chdir resumed>) = 0 [pid 5141] <... prctl resumed>) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5142 [pid 5076] restart_syscall(<... resuming interrupted clone ...> [pid 5074] <... rmdir resumed>) = 0 [pid 5142] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5141] setpgid(0, 0 [pid 5078] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5076] <... restart_syscall resumed>) = 0 [pid 5074] mkdir("./6", 0777 [pid 5142] <... prctl resumed>) = 0 [pid 5141] <... setpgid resumed>) = 0 [pid 5078] <... openat resumed>) = 3 [pid 5074] <... mkdir resumed>) = 0 [pid 5142] setpgid(0, 0 [pid 5076] umount2("./5", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5076] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5141] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5078] newfstatat(3, "", [pid 5076] <... openat resumed>) = 3 [pid 5076] newfstatat(3, "", [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5142] <... setpgid resumed>) = 0 [pid 5141] <... openat resumed>) = 3 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 ./strace-static-x86_64: Process 5143 attached [pid 5142] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5076] getdents64(3, 0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5076] umount2("./5/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5078] getdents64(3, [pid 5076] newfstatat(AT_FDCWD, "./5/binderfs", [pid 5143] set_robust_list(0x55555d6c46a0, 24 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5141] write(3, "1000", 4 [pid 5076] unlink("./5/binderfs" [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5143 [pid 5143] <... set_robust_list resumed>) = 0 [pid 5142] <... openat resumed>) = 3 [pid 5141] <... write resumed>) = 4 [pid 5078] umount2("./6/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] <... unlink resumed>) = 0 [pid 5141] close(3 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5143] chdir("./6" [pid 5142] write(3, "1000", 4 [pid 5141] <... close resumed>) = 0 [pid 5078] newfstatat(AT_FDCWD, "./6/binderfs", [pid 5076] getdents64(3, [pid 5143] <... chdir resumed>) = 0 [pid 5142] <... write resumed>) = 4 [pid 5141] symlink("/dev/binderfs", "./binderfs" [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5142] close(3 [pid 5078] unlink("./6/binderfs" [pid 5076] close(3) = 0 [pid 5143] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5142] <... close resumed>) = 0 [pid 5141] <... symlink resumed>) = 0 [pid 5078] <... unlink resumed>) = 0 [pid 5076] rmdir("./5" [pid 5143] <... prctl resumed>) = 0 [pid 5142] symlink("/dev/binderfs", "./binderfs" [pid 5143] setpgid(0, 0 [pid 5141] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] getdents64(3, [pid 5076] <... rmdir resumed>) = 0 [pid 5143] <... setpgid resumed>) = 0 [pid 5142] <... symlink resumed>) = 0 [pid 5141] <... futex resumed>) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5141] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5143] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5141] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5078] close(3 [pid 5142] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5141] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5078] <... close resumed>) = 0 [pid 5076] mkdir("./6", 0777 [pid 5143] <... openat resumed>) = 3 [pid 5142] <... futex resumed>) = 0 [pid 5141] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] rmdir("./6" [pid 5076] <... mkdir resumed>) = 0 [pid 5142] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5141] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5143] write(3, "1000", 4 [pid 5142] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5141] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5078] <... rmdir resumed>) = 0 [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5143] <... write resumed>) = 4 [pid 5142] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5141] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE./strace-static-x86_64: Process 5144 attached [pid 5143] close(3 [pid 5142] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5141] <... mprotect resumed>) = 0 [pid 5143] <... close resumed>) = 0 [pid 5142] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5078] mkdir("./7", 0777 [pid 5141] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5144] set_robust_list(0x55555d6c46a0, 24 [pid 5143] symlink("/dev/binderfs", "./binderfs" [pid 5142] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5141] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5078] <... mkdir resumed>) = 0 [pid 5144] <... set_robust_list resumed>) = 0 [pid 5142] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5141] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0}./strace-static-x86_64: Process 5145 attached [pid 5144] chdir("./6" [pid 5143] <... symlink resumed>) = 0 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5144 [pid 5145] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5144] <... chdir resumed>) = 0 [pid 5142] <... mprotect resumed>) = 0 [pid 5141] <... clone3 resumed> => {parent_tid=[5145]}, 88) = 5145 [pid 5144] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5141] rt_sigprocmask(SIG_SETMASK, [], [pid 5144] <... prctl resumed>) = 0 [pid 5141] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5145] <... rseq resumed>) = 0 [pid 5143] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5145] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5144] setpgid(0, 0 [pid 5143] <... futex resumed>) = 0 [pid 5142] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5141] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5146 attached [pid 5145] <... set_robust_list resumed>) = 0 [pid 5143] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5146] set_robust_list(0x55555d6c46a0, 24 [pid 5145] rt_sigprocmask(SIG_SETMASK, [], [pid 5144] <... setpgid resumed>) = 0 [pid 5143] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5141] <... futex resumed>) = 0 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5146 [pid 5146] <... set_robust_list resumed>) = 0 [pid 5145] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5143] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5146] chdir("./7" [pid 5145] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5144] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5143] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5141] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5146] <... chdir resumed>) = 0 [pid 5145] <... bpf resumed>) = 3 [pid 5143] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5142] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5146] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5145] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5144] <... openat resumed>) = 3 [pid 5143] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5142] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5146] <... prctl resumed>) = 0 [pid 5145] <... futex resumed>) = 1 [pid 5143] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5141] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5147 attached [pid 5146] setpgid(0, 0 [pid 5145] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5144] write(3, "1000", 4 [pid 5143] <... mprotect resumed>) = 0 [pid 5142] <... clone3 resumed> => {parent_tid=[5147]}, 88) = 5147 [pid 5141] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5147] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5146] <... setpgid resumed>) = 0 [pid 5145] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5144] <... write resumed>) = 4 [pid 5143] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5142] rt_sigprocmask(SIG_SETMASK, [], [pid 5141] <... futex resumed>) = 0 [pid 5147] <... rseq resumed>) = 0 [pid 5146] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5145] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5144] close(3 [pid 5143] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5142] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5141] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5147] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5146] <... openat resumed>) = 3 [pid 5145] <... bpf resumed>) = 4 [pid 5144] <... close resumed>) = 0 [pid 5143] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5142] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5148 attached [pid 5147] <... set_robust_list resumed>) = 0 [pid 5146] write(3, "1000", 4 [pid 5145] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5144] symlink("/dev/binderfs", "./binderfs" [pid 5142] <... futex resumed>) = 0 [pid 5148] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5147] rt_sigprocmask(SIG_SETMASK, [], [pid 5146] <... write resumed>) = 4 [pid 5145] <... futex resumed>) = 1 [pid 5143] <... clone3 resumed> => {parent_tid=[5148]}, 88) = 5148 [pid 5142] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5141] <... futex resumed>) = 0 [pid 5147] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5146] close(3 [pid 5145] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5143] rt_sigprocmask(SIG_SETMASK, [], [pid 5148] <... rseq resumed>) = 0 [pid 5147] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5146] <... close resumed>) = 0 [pid 5144] <... symlink resumed>) = 0 [pid 5143] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5141] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5148] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5147] <... bpf resumed>) = 3 [pid 5146] symlink("/dev/binderfs", "./binderfs" [pid 5145] <... futex resumed>) = 0 [pid 5143] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5147] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5146] <... symlink resumed>) = 0 [pid 5145] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5143] <... futex resumed>) = 0 [pid 5148] <... set_robust_list resumed>) = 0 [pid 5147] <... futex resumed>) = 1 [pid 5146] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5145] <... bpf resumed>) = 5 [pid 5144] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5143] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5142] <... futex resumed>) = 0 [pid 5141] <... futex resumed>) = 1 [pid 5148] rt_sigprocmask(SIG_SETMASK, [], [pid 5147] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5146] <... futex resumed>) = 0 [pid 5142] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5148] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5144] <... futex resumed>) = 0 [pid 5141] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5146] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5147] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5147] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5146] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5148] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5147] <... bpf resumed>) = 4 [pid 5146] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5145] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5144] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5142] <... futex resumed>) = 0 [pid 5148] <... bpf resumed>) = 3 [pid 5147] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5146] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5145] <... futex resumed>) = 1 [pid 5144] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5142] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5141] <... futex resumed>) = 0 [pid 5148] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5147] <... futex resumed>) = 0 [pid 5146] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5145] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5144] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5142] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5148] <... futex resumed>) = 1 [pid 5147] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5146] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5145] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5144] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5143] <... futex resumed>) = 0 [pid 5142] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5141] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5148] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5147] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5146] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5145] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5144] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5143] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5142] <... futex resumed>) = 0 [pid 5148] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5147] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5146] <... mprotect resumed>) = 0 [pid 5145] <... bpf resumed>) = 6 [pid 5144] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5143] <... futex resumed>) = 0 [pid 5142] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5141] <... futex resumed>) = 0 [pid 5148] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5147] <... bpf resumed>) = 5 [pid 5146] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5145] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5144] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5143] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5141] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5148] <... bpf resumed>) = 4 [pid 5144] <... mprotect resumed>) = 0 [pid 5141] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5148] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5145] <... futex resumed>) = 0 [pid 5143] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5141] exit_group(0 [pid 5147] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5148] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5146] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5144] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5143] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5141] <... exit_group resumed>) = ? [pid 5147] <... futex resumed>) = 1 [pid 5146] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5145] +++ exited with 0 +++ [pid 5143] <... futex resumed>) = 0 [pid 5142] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5149 attached [pid 5148] <... bpf resumed>) = 5 [pid 5147] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5143] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5149] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5146] <... clone3 resumed> => {parent_tid=[5149]}, 88) = 5149 [pid 5149] <... rseq resumed>) = 0 [pid 5146] rt_sigprocmask(SIG_SETMASK, [], [pid 5149] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5146] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5149] <... set_robust_list resumed>) = 0 [pid 5146] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5149] rt_sigprocmask(SIG_SETMASK, [], [pid 5146] <... futex resumed>) = 0 [pid 5149] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5146] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5141] +++ exited with 0 +++ [pid 5149] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5142] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5149] <... bpf resumed>) = 3 [pid 5148] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5147] <... futex resumed>) = 0 [pid 5144] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5142] <... futex resumed>) = 1 [pid 5149] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5148] <... futex resumed>) = 1 [pid 5147] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5144] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5143] <... futex resumed>) = 0 [pid 5142] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5141, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- ./strace-static-x86_64: Process 5150 attached [pid 5149] <... futex resumed>) = 1 [pid 5148] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5146] <... futex resumed>) = 0 [pid 5143] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] umount2("./6", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5148] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5150] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5149] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5148] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5146] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5144] <... clone3 resumed> => {parent_tid=[5150]}, 88) = 5150 [pid 5143] <... futex resumed>) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5150] <... rseq resumed>) = 0 [pid 5149] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5146] <... futex resumed>) = 0 [pid 5144] rt_sigprocmask(SIG_SETMASK, [], [pid 5143] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5075] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5150] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5149] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5146] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5144] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] <... openat resumed>) = 3 [pid 5150] <... set_robust_list resumed>) = 0 [pid 5149] <... bpf resumed>) = 4 [pid 5144] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] newfstatat(3, "", [pid 5150] rt_sigprocmask(SIG_SETMASK, [], [pid 5149] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5150] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5149] <... futex resumed>) = 1 [pid 5146] <... futex resumed>) = 0 [pid 5150] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5149] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5146] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5150] <... bpf resumed>) = 3 [pid 5149] <... bpf resumed>) = 5 [pid 5148] <... bpf resumed>) = 6 [pid 5147] <... bpf resumed>) = 6 [pid 5146] <... futex resumed>) = 0 [pid 5144] <... futex resumed>) = 0 [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5150] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5148] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5144] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5148] <... futex resumed>) = 1 [pid 5144] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5143] <... futex resumed>) = 0 [pid 5075] getdents64(3, [pid 5148] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5144] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5143] exit_group(0 [pid 5150] <... futex resumed>) = 0 [pid 5148] <... futex resumed>) = ? [pid 5147] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5146] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5144] <... futex resumed>) = 0 [pid 5143] <... exit_group resumed>) = ? [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5150] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5149] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5148] +++ exited with 0 +++ [pid 5147] <... futex resumed>) = 1 [pid 5146] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5144] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5142] <... futex resumed>) = 0 [pid 5150] <... bpf resumed>) = 4 [pid 5149] <... futex resumed>) = 0 [pid 5147] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5146] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5150] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5149] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5146] <... futex resumed>) = 0 [pid 5150] <... futex resumed>) = 0 [pid 5149] <... bpf resumed>) = 6 [pid 5146] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5150] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5149] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5146] <... futex resumed>) = 0 [pid 5144] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5142] exit_group(0 [pid 5075] umount2("./6/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5149] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5147] <... futex resumed>) = ? [pid 5146] exit_group(0 [pid 5144] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5143] +++ exited with 0 +++ [pid 5142] <... exit_group resumed>) = ? [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5150] <... futex resumed>) = 0 [pid 5149] <... futex resumed>) = ? [pid 5147] +++ exited with 0 +++ [pid 5146] <... exit_group resumed>) = ? [pid 5144] <... futex resumed>) = 1 [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5143, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5150] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5149] +++ exited with 0 +++ [pid 5144] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] newfstatat(AT_FDCWD, "./6/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5150] <... bpf resumed>) = 5 [pid 5075] unlink("./6/binderfs") = 0 [pid 5150] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] getdents64(3, 0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5074] umount2("./6", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5150] <... futex resumed>) = 1 [pid 5144] <... futex resumed>) = 0 [pid 5075] close(3 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5150] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5144] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5150] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5146] +++ exited with 0 +++ [pid 5144] <... futex resumed>) = 0 [pid 5142] +++ exited with 0 +++ [pid 5075] <... close resumed>) = 0 [pid 5150] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5144] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5074] <... openat resumed>) = 3 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5146, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5142, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5075] rmdir("./6" [pid 5074] newfstatat(3, "", [pid 5078] restart_syscall(<... resuming interrupted clone ...> [pid 5077] restart_syscall(<... resuming interrupted clone ...> [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5078] <... restart_syscall resumed>) = 0 [pid 5077] <... restart_syscall resumed>) = 0 [pid 5075] <... rmdir resumed>) = 0 [pid 5074] getdents64(3, [pid 5075] mkdir("./7", 0777 [pid 5077] umount2("./6", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5078] umount2("./7", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5077] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5074] umount2("./6/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] <... mkdir resumed>) = 0 [pid 5078] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5077] <... openat resumed>) = 3 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5078] <... openat resumed>) = 3 [pid 5078] newfstatat(3, "", [pid 5077] newfstatat(3, "", [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] newfstatat(AT_FDCWD, "./6/binderfs", [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5078] getdents64(3, [pid 5077] getdents64(3, [pid 5074] unlink("./6/binderfs" [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5074] <... unlink resumed>) = 0 [pid 5078] umount2("./7/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5077] umount2("./6/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5078] newfstatat(AT_FDCWD, "./7/binderfs", [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5077] newfstatat(AT_FDCWD, "./6/binderfs", [pid 5074] getdents64(3, [pid 5078] unlink("./7/binderfs" [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5078] <... unlink resumed>) = 0 [pid 5077] unlink("./6/binderfs" [pid 5074] close(3 [pid 5078] getdents64(3, [pid 5077] <... unlink resumed>) = 0 [pid 5074] <... close resumed>) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 ./strace-static-x86_64: Process 5151 attached [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5151 [pid 5151] set_robust_list(0x55555d6c46a0, 24 [pid 5074] rmdir("./6" [pid 5151] <... set_robust_list resumed>) = 0 [pid 5151] chdir("./7" [pid 5150] <... bpf resumed>) = 6 [pid 5078] close(3 [pid 5077] getdents64(3, [pid 5074] <... rmdir resumed>) = 0 [pid 5151] <... chdir resumed>) = 0 [pid 5150] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... close resumed>) = 0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5151] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5150] <... futex resumed>) = 1 [pid 5144] <... futex resumed>) = 0 [pid 5078] rmdir("./7" [pid 5077] close(3 [pid 5151] setpgid(0, 0 [pid 5150] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5144] exit_group(0 [pid 5078] <... rmdir resumed>) = 0 [pid 5077] <... close resumed>) = 0 [pid 5074] mkdir("./7", 0777 [pid 5151] <... setpgid resumed>) = 0 [pid 5150] <... futex resumed>) = ? [pid 5144] <... exit_group resumed>) = ? [pid 5151] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5150] +++ exited with 0 +++ [pid 5144] +++ exited with 0 +++ [pid 5077] rmdir("./6" [pid 5074] <... mkdir resumed>) = 0 [pid 5151] <... openat resumed>) = 3 [pid 5078] mkdir("./8", 0777 [pid 5077] <... rmdir resumed>) = 0 [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5144, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5151] write(3, "1000", 4) = 4 [pid 5078] <... mkdir resumed>) = 0 [pid 5151] close(3) = 0 [pid 5151] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5077] mkdir("./7", 0777 [pid 5076] umount2("./6", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5152 attached [pid 5151] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5077] <... mkdir resumed>) = 0 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5153 attached [pid 5151] <... futex resumed>) = 0 [pid 5151] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5076] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5152] set_robust_list(0x55555d6c46a0, 24 [pid 5151] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5151] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5153] set_robust_list(0x55555d6c46a0, 24 [pid 5151] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5153] <... set_robust_list resumed>) = 0 [pid 5151] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5076] <... openat resumed>) = 3 [pid 5076] newfstatat(3, "", [pid 5151] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 ./strace-static-x86_64: Process 5154 attached [pid 5153] chdir("./8" [pid 5152] <... set_robust_list resumed>) = 0 [pid 5151] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5153 [pid 5076] getdents64(3, [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5152 [pid 5152] chdir("./7" [pid 5154] set_robust_list(0x55555d6c46a0, 24 [pid 5151] <... mprotect resumed>) = 0 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5154] <... set_robust_list resumed>) = 0 [pid 5153] <... chdir resumed>) = 0 [pid 5152] <... chdir resumed>) = 0 [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5154 [pid 5076] umount2("./6/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5154] chdir("./7" [pid 5153] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5152] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5151] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5152] <... prctl resumed>) = 0 [pid 5076] newfstatat(AT_FDCWD, "./6/binderfs", [pid 5152] setpgid(0, 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5152] <... setpgid resumed>) = 0 [pid 5152] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5076] unlink("./6/binderfs" [pid 5153] <... prctl resumed>) = 0 [pid 5154] <... chdir resumed>) = 0 [pid 5151] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5154] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5151] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5154] <... prctl resumed>) = 0 ./strace-static-x86_64: Process 5155 attached [pid 5154] setpgid(0, 0 [pid 5153] setpgid(0, 0 [pid 5152] <... openat resumed>) = 3 [pid 5076] <... unlink resumed>) = 0 [pid 5155] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5154] <... setpgid resumed>) = 0 [pid 5153] <... setpgid resumed>) = 0 [pid 5152] write(3, "1000", 4 [pid 5151] <... clone3 resumed> => {parent_tid=[5155]}, 88) = 5155 [pid 5155] <... rseq resumed>) = 0 [pid 5152] <... write resumed>) = 4 [pid 5154] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5151] rt_sigprocmask(SIG_SETMASK, [], [pid 5155] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5153] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5152] close(3 [pid 5151] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5155] <... set_robust_list resumed>) = 0 [pid 5152] <... close resumed>) = 0 [pid 5076] getdents64(3, [pid 5155] rt_sigprocmask(SIG_SETMASK, [], [pid 5154] <... openat resumed>) = 3 [pid 5152] symlink("/dev/binderfs", "./binderfs" [pid 5151] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5155] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5152] <... symlink resumed>) = 0 [pid 5151] <... futex resumed>) = 0 [pid 5155] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5154] write(3, "1000", 4 [pid 5153] <... openat resumed>) = 3 [pid 5152] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5151] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] close(3 [pid 5155] <... bpf resumed>) = 3 [pid 5154] <... write resumed>) = 4 [pid 5153] write(3, "1000", 4 [pid 5152] <... futex resumed>) = 0 [pid 5076] <... close resumed>) = 0 [pid 5155] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5154] close(3 [pid 5153] <... write resumed>) = 4 [pid 5152] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5155] <... futex resumed>) = 1 [pid 5154] <... close resumed>) = 0 [pid 5153] close(3 [pid 5152] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5151] <... futex resumed>) = 0 [pid 5076] rmdir("./6" [pid 5155] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5154] symlink("/dev/binderfs", "./binderfs" [pid 5153] <... close resumed>) = 0 [pid 5151] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5154] <... symlink resumed>) = 0 [pid 5153] symlink("/dev/binderfs", "./binderfs" [pid 5152] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5151] <... futex resumed>) = 0 [pid 5155] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5076] <... rmdir resumed>) = 0 [pid 5155] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5154] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5152] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5151] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5154] <... futex resumed>) = 0 [pid 5153] <... symlink resumed>) = 0 [pid 5152] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5154] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5155] <... bpf resumed>) = 4 [pid 5154] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5153] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5152] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5076] mkdir("./7", 0777 [pid 5155] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5154] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5153] <... futex resumed>) = 0 [pid 5152] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5076] <... mkdir resumed>) = 0 [pid 5155] <... futex resumed>) = 1 [pid 5154] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5153] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5152] <... mprotect resumed>) = 0 [pid 5151] <... futex resumed>) = 0 [pid 5155] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5154] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5153] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5152] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5151] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5155] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5154] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5153] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5152] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5151] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5156 attached [pid 5155] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5154] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5153] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5152] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5151] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5157 attached [pid 5156] set_robust_list(0x55555d6c46a0, 24 [pid 5155] <... bpf resumed>) = 5 [pid 5154] <... mprotect resumed>) = 0 [pid 5153] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5156] <... set_robust_list resumed>) = 0 [pid 5157] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053) = 0 [pid 5154] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5153] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5157] set_robust_list(0x7f3e2f60d9a0, 24) = 0 [pid 5156] chdir("./7" [pid 5155] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5154] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5153] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5152] <... clone3 resumed> => {parent_tid=[5157]}, 88) = 5157 [pid 5157] rt_sigprocmask(SIG_SETMASK, [], [pid 5156] <... chdir resumed>) = 0 [pid 5155] <... futex resumed>) = 1 [pid 5154] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5153] <... mprotect resumed>) = 0 [pid 5152] rt_sigprocmask(SIG_SETMASK, [], [pid 5151] <... futex resumed>) = 0 [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5156 [pid 5157] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5155] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5152] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5157] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5153] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5152] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5151] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5157] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5157] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72./strace-static-x86_64: Process 5158 attached ) = 3 [pid 5156] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5155] <... futex resumed>) = 0 [pid 5153] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5152] <... futex resumed>) = 0 [pid 5151] <... futex resumed>) = 1 [pid 5157] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5156] <... prctl resumed>) = 0 [pid 5155] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5154] <... clone3 resumed> => {parent_tid=[5158]}, 88) = 5158 [pid 5153] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5158] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5152] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5151] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5157] <... futex resumed>) = 0 [pid 5156] setpgid(0, 0 [pid 5155] <... bpf resumed>) = 6 [pid 5154] rt_sigprocmask(SIG_SETMASK, [], ./strace-static-x86_64: Process 5159 attached [pid 5158] <... rseq resumed>) = 0 [pid 5157] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5156] <... setpgid resumed>) = 0 [pid 5155] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5154] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5152] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5159] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5158] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5155] <... futex resumed>) = 1 [pid 5152] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5151] <... futex resumed>) = 0 [pid 5154] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5153] <... clone3 resumed> => {parent_tid=[5159]}, 88) = 5159 [pid 5159] <... rseq resumed>) = 0 [pid 5158] <... set_robust_list resumed>) = 0 [pid 5157] <... futex resumed>) = 0 [pid 5156] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5155] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5154] <... futex resumed>) = 0 [pid 5153] rt_sigprocmask(SIG_SETMASK, [], [pid 5152] <... futex resumed>) = 1 [pid 5151] exit_group(0 [pid 5159] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5158] rt_sigprocmask(SIG_SETMASK, [], [pid 5157] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5155] <... futex resumed>) = ? [pid 5151] <... exit_group resumed>) = ? [pid 5159] <... set_robust_list resumed>) = 0 [pid 5158] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5157] <... bpf resumed>) = 4 [pid 5156] <... openat resumed>) = 3 [pid 5155] +++ exited with 0 +++ [pid 5154] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5153] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5152] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5151] +++ exited with 0 +++ [pid 5159] rt_sigprocmask(SIG_SETMASK, [], [pid 5158] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5157] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5156] write(3, "1000", 4 [pid 5153] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5159] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5158] <... bpf resumed>) = 3 [pid 5157] <... futex resumed>) = 1 [pid 5156] <... write resumed>) = 4 [pid 5153] <... futex resumed>) = 0 [pid 5152] <... futex resumed>) = 0 [pid 5159] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5158] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5157] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5153] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5152] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5151, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5159] <... bpf resumed>) = 3 [pid 5158] <... futex resumed>) = 1 [pid 5157] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5156] close(3 [pid 5154] <... futex resumed>) = 0 [pid 5152] <... futex resumed>) = 0 [pid 5075] umount2("./7", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5159] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5158] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5157] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5156] <... close resumed>) = 0 [pid 5154] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5152] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5159] <... futex resumed>) = 1 [pid 5158] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5157] <... bpf resumed>) = 5 [pid 5156] symlink("/dev/binderfs", "./binderfs" [pid 5154] <... futex resumed>) = 0 [pid 5153] <... futex resumed>) = 0 [pid 5075] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5154] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5159] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5075] <... openat resumed>) = 3 [pid 5153] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5158] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5153] <... futex resumed>) = 0 [pid 5075] newfstatat(3, "", [pid 5156] <... symlink resumed>) = 0 [pid 5159] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5158] <... bpf resumed>) = 4 [pid 5157] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5159] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5157] <... futex resumed>) = 1 [pid 5153] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5152] <... futex resumed>) = 0 [pid 5159] <... bpf resumed>) = 4 [pid 5158] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5157] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5156] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5152] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5159] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5158] <... futex resumed>) = 1 [pid 5157] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5156] <... futex resumed>) = 0 [pid 5154] <... futex resumed>) = 0 [pid 5152] <... futex resumed>) = 0 [pid 5075] getdents64(3, [pid 5159] <... futex resumed>) = 1 [pid 5158] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5157] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5156] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5154] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5153] <... futex resumed>) = 0 [pid 5152] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5159] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5158] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5157] <... bpf resumed>) = 6 [pid 5156] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5154] <... futex resumed>) = 0 [pid 5153] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5159] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5158] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5157] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5156] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5154] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5153] <... futex resumed>) = 0 [pid 5159] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5157] <... futex resumed>) = 1 [pid 5153] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5152] <... futex resumed>) = 0 [pid 5159] <... bpf resumed>) = 5 [pid 5158] <... bpf resumed>) = 5 [pid 5157] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5156] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5152] exit_group(0 [pid 5075] umount2("./7/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5159] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5157] <... futex resumed>) = ? [pid 5152] <... exit_group resumed>) = ? [pid 5159] <... futex resumed>) = 1 [pid 5158] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5157] +++ exited with 0 +++ [pid 5156] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5153] <... futex resumed>) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5159] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5158] <... futex resumed>) = 1 [pid 5156] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5154] <... futex resumed>) = 0 [pid 5153] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5152] +++ exited with 0 +++ [pid 5075] newfstatat(AT_FDCWD, "./7/binderfs", [pid 5158] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5156] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5154] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5153] <... futex resumed>) = 0 [pid 5156] <... mprotect resumed>) = 0 [pid 5154] <... futex resumed>) = 0 [pid 5153] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5154] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5152, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5156] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5075] unlink("./7/binderfs" [pid 5074] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5156] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5156] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5075] <... unlink resumed>) = 0 ./strace-static-x86_64: Process 5160 attached [pid 5156] <... clone3 resumed> => {parent_tid=[5160]}, 88) = 5160 [pid 5160] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053) = 0 [pid 5156] rt_sigprocmask(SIG_SETMASK, [], [pid 5160] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5156] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5160] <... set_robust_list resumed>) = 0 [pid 5160] rt_sigprocmask(SIG_SETMASK, [], [pid 5156] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5160] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5156] <... futex resumed>) = 0 [pid 5160] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5156] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] getdents64(3, [pid 5074] umount2("./7", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5160] <... bpf resumed>) = 3 [pid 5159] <... bpf resumed>) = 6 [pid 5158] <... bpf resumed>) = 6 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5074] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5160] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5159] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5158] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] close(3 [pid 5160] <... futex resumed>) = 1 [pid 5156] <... futex resumed>) = 0 [pid 5074] <... openat resumed>) = 3 [pid 5154] <... futex resumed>) = 0 [pid 5075] <... close resumed>) = 0 [pid 5160] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5159] <... futex resumed>) = 1 [pid 5158] <... futex resumed>) = 1 [pid 5156] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5154] exit_group(0 [pid 5153] <... futex resumed>) = 0 [pid 5075] rmdir("./7" [pid 5074] newfstatat(3, "", [pid 5160] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5159] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5156] <... futex resumed>) = 0 [pid 5154] <... exit_group resumed>) = ? [pid 5153] exit_group(0 [pid 5160] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5156] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] <... rmdir resumed>) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5160] <... bpf resumed>) = 4 [pid 5159] <... futex resumed>) = ? [pid 5158] +++ exited with 0 +++ [pid 5153] <... exit_group resumed>) = ? [pid 5160] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5159] +++ exited with 0 +++ [pid 5154] +++ exited with 0 +++ [pid 5153] +++ exited with 0 +++ [pid 5075] mkdir("./8", 0777 [pid 5074] getdents64(3, [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5154, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5160] <... futex resumed>) = 1 [pid 5156] <... futex resumed>) = 0 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5153, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5160] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5156] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5160] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5156] <... futex resumed>) = 0 [pid 5077] restart_syscall(<... resuming interrupted clone ...> [pid 5075] <... mkdir resumed>) = 0 [pid 5074] umount2("./7/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5160] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144) = 5 [pid 5156] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... restart_syscall resumed>) = 0 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] newfstatat(AT_FDCWD, "./7/binderfs", [pid 5160] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5077] umount2("./7", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] unlink("./7/binderfs" [pid 5160] <... futex resumed>) = 1 [pid 5156] <... futex resumed>) = 0 [pid 5156] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5160] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5156] <... futex resumed>) = 0 [pid 5156] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] umount2("./8", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5161 attached [pid 5160] <... bpf resumed>) = 6 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] <... unlink resumed>) = 0 [pid 5161] set_robust_list(0x55555d6c46a0, 24 [pid 5160] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5077] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5160] <... futex resumed>) = 1 [pid 5156] <... futex resumed>) = 0 [pid 5160] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5161] <... set_robust_list resumed>) = 0 [pid 5156] exit_group(0 [pid 5078] <... openat resumed>) = 3 [pid 5077] <... openat resumed>) = 3 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5161 [pid 5074] getdents64(3, [pid 5160] <... futex resumed>) = ? [pid 5156] <... exit_group resumed>) = ? [pid 5161] chdir("./8" [pid 5160] +++ exited with 0 +++ [pid 5078] newfstatat(3, "", [pid 5077] newfstatat(3, "", [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5161] <... chdir resumed>) = 0 [pid 5156] +++ exited with 0 +++ [pid 5078] getdents64(3, [pid 5077] getdents64(3, [pid 5161] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5074] close(3 [pid 5161] <... prctl resumed>) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5077] umount2("./7/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5156, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5074] <... close resumed>) = 0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] rmdir("./7" [pid 5077] newfstatat(AT_FDCWD, "./7/binderfs", [pid 5161] setpgid(0, 0 [pid 5078] umount2("./8/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] <... rmdir resumed>) = 0 [pid 5077] unlink("./7/binderfs" [pid 5076] umount2("./7", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] mkdir("./8", 0777 [pid 5161] <... setpgid resumed>) = 0 [pid 5078] newfstatat(AT_FDCWD, "./8/binderfs", [pid 5077] <... unlink resumed>) = 0 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5161] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5077] getdents64(3, [pid 5076] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5074] <... mkdir resumed>) = 0 [pid 5161] <... openat resumed>) = 3 [pid 5078] unlink("./8/binderfs" [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5076] <... openat resumed>) = 3 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5076] newfstatat(3, "", [pid 5161] write(3, "1000", 4 [pid 5078] <... unlink resumed>) = 0 [pid 5161] <... write resumed>) = 4 [pid 5161] close(3./strace-static-x86_64: Process 5162 attached ) = 0 [pid 5078] getdents64(3, [pid 5077] close(3 [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5162] set_robust_list(0x55555d6c46a0, 24 [pid 5161] symlink("/dev/binderfs", "./binderfs" [pid 5162] <... set_robust_list resumed>) = 0 [pid 5077] <... close resumed>) = 0 [pid 5076] getdents64(3, [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5162 [pid 5162] chdir("./8" [pid 5161] <... symlink resumed>) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5077] rmdir("./7" [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5162] <... chdir resumed>) = 0 [pid 5161] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] close(3 [pid 5076] umount2("./7/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5161] <... futex resumed>) = 0 [pid 5078] <... close resumed>) = 0 [pid 5162] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5161] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5078] rmdir("./8" [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5162] <... prctl resumed>) = 0 [pid 5161] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5078] <... rmdir resumed>) = 0 [pid 5161] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5077] <... rmdir resumed>) = 0 [pid 5162] setpgid(0, 0 [pid 5161] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5162] <... setpgid resumed>) = 0 [pid 5161] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5077] mkdir("./8", 0777 [pid 5076] newfstatat(AT_FDCWD, "./7/binderfs", [pid 5161] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5078] mkdir("./9", 0777 [pid 5162] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5161] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5078] <... mkdir resumed>) = 0 [pid 5077] <... mkdir resumed>) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5161] <... mprotect resumed>) = 0 [pid 5161] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5161] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5163 attached [pid 5162] <... openat resumed>) = 3 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5076] unlink("./7/binderfs"./strace-static-x86_64: Process 5164 attached [pid 5163] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5162] write(3, "1000", 4 [pid 5164] set_robust_list(0x55555d6c46a0, 24 [pid 5163] <... rseq resumed>) = 0 [pid 5161] <... clone3 resumed> => {parent_tid=[5163]}, 88) = 5163 [pid 5161] rt_sigprocmask(SIG_SETMASK, [], [pid 5164] <... set_robust_list resumed>) = 0 [pid 5163] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5162] <... write resumed>) = 4 [pid 5161] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5161] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5164 [pid 5164] chdir("./9" [pid 5163] <... set_robust_list resumed>) = 0 [pid 5162] close(3 [pid 5161] <... futex resumed>) = 0 [pid 5161] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5163] rt_sigprocmask(SIG_SETMASK, [], [pid 5076] <... unlink resumed>) = 0 [pid 5163] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5162] <... close resumed>) = 0 [pid 5162] symlink("/dev/binderfs", "./binderfs" [pid 5164] <... chdir resumed>) = 0 [pid 5163] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5162] <... symlink resumed>) = 0 [pid 5164] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5164] setpgid(0, 0) = 0 [pid 5164] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5076] getdents64(3, [pid 5164] write(3, "1000", 4 [pid 5163] <... bpf resumed>) = 3 [pid 5162] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5165 attached [pid 5164] <... write resumed>) = 4 [pid 5163] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5162] <... futex resumed>) = 0 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5165] set_robust_list(0x55555d6c46a0, 24 [pid 5164] close(3 [pid 5163] <... futex resumed>) = 1 [pid 5162] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5161] <... futex resumed>) = 0 [pid 5076] close(3 [pid 5165] <... set_robust_list resumed>) = 0 [pid 5164] <... close resumed>) = 0 [pid 5163] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5162] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5161] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5165 [pid 5163] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5162] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5076] <... close resumed>) = 0 [pid 5163] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5162] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5162] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5076] rmdir("./7" [pid 5165] chdir("./8" [pid 5164] symlink("/dev/binderfs", "./binderfs" [pid 5162] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5161] <... futex resumed>) = 0 [pid 5165] <... chdir resumed>) = 0 [pid 5164] <... symlink resumed>) = 0 [pid 5162] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5161] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] <... rmdir resumed>) = 0 [pid 5165] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5164] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5163] <... bpf resumed>) = 4 [pid 5162] <... mprotect resumed>) = 0 [pid 5165] <... prctl resumed>) = 0 [pid 5164] <... futex resumed>) = 0 [pid 5165] setpgid(0, 0 [pid 5164] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5165] <... setpgid resumed>) = 0 [pid 5164] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5165] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5164] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5162] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5165] <... openat resumed>) = 3 [pid 5164] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5163] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] mkdir("./8", 0777 [pid 5164] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5163] <... futex resumed>) = 1 [pid 5161] <... futex resumed>) = 0 [pid 5165] write(3, "1000", 4 [pid 5164] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5161] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5165] <... write resumed>) = 4 [pid 5164] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5161] <... futex resumed>) = 0 [pid 5165] close(3 [pid 5164] <... mprotect resumed>) = 0 [pid 5163] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5162] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5161] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5165] <... close resumed>) = 0 [pid 5164] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5076] <... mkdir resumed>) = 0 [pid 5162] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5165] symlink("/dev/binderfs", "./binderfs" [pid 5164] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5165] <... symlink resumed>) = 0 [pid 5164] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0}./strace-static-x86_64: Process 5166 attached ./strace-static-x86_64: Process 5167 attached [pid 5165] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5163] <... bpf resumed>) = 5 [pid 5162] <... clone3 resumed> => {parent_tid=[5166]}, 88) = 5166 [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5166] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5164] <... clone3 resumed> => {parent_tid=[5167]}, 88) = 5167 [pid 5163] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5167] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5166] <... rseq resumed>) = 0 [pid 5165] <... futex resumed>) = 0 [pid 5164] rt_sigprocmask(SIG_SETMASK, [], [pid 5166] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5165] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5164] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5166] <... set_robust_list resumed>) = 0 [pid 5165] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5164] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5166] rt_sigprocmask(SIG_SETMASK, [], [pid 5165] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5164] <... futex resumed>) = 0 [pid 5166] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5165] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5164] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5166] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5165] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5167] <... rseq resumed>) = 0 [pid 5165] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5163] <... futex resumed>) = 1 [pid 5162] rt_sigprocmask(SIG_SETMASK, [], [pid 5161] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5168 attached [pid 5167] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5165] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5163] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5162] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5161] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5168] set_robust_list(0x55555d6c46a0, 24 [pid 5167] <... set_robust_list resumed>) = 0 [pid 5165] <... mprotect resumed>) = 0 [pid 5163] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5162] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5161] <... futex resumed>) = 0 [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5168 [pid 5168] <... set_robust_list resumed>) = 0 [pid 5167] rt_sigprocmask(SIG_SETMASK, [], [pid 5166] <... futex resumed>) = 0 [pid 5165] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5163] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5162] <... futex resumed>) = 1 [pid 5161] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5168] chdir("./8" [pid 5167] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5166] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5168] <... chdir resumed>) = 0 [pid 5167] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5166] <... bpf resumed>) = 3 [pid 5165] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5163] <... bpf resumed>) = 6 [pid 5162] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5168] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5167] <... bpf resumed>) = 3 [pid 5166] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5165] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5163] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5162] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) ./strace-static-x86_64: Process 5169 attached [pid 5168] <... prctl resumed>) = 0 [pid 5167] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5166] <... futex resumed>) = 0 [pid 5162] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5169] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5168] setpgid(0, 0 [pid 5167] <... futex resumed>) = 1 [pid 5166] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5165] <... clone3 resumed> => {parent_tid=[5169]}, 88) = 5169 [pid 5164] <... futex resumed>) = 0 [pid 5163] <... futex resumed>) = 1 [pid 5162] <... futex resumed>) = 0 [pid 5161] <... futex resumed>) = 0 [pid 5169] <... rseq resumed>) = 0 [pid 5168] <... setpgid resumed>) = 0 [pid 5167] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5166] <... bpf resumed>) = 4 [pid 5165] rt_sigprocmask(SIG_SETMASK, [], [pid 5164] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5163] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5162] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5161] exit_group(0 [pid 5169] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5168] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5167] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5166] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5165] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5164] <... futex resumed>) = 0 [pid 5163] <... futex resumed>) = ? [pid 5161] <... exit_group resumed>) = ? [pid 5169] <... set_robust_list resumed>) = 0 [pid 5167] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5166] <... futex resumed>) = 1 [pid 5165] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5164] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5163] +++ exited with 0 +++ [pid 5162] <... futex resumed>) = 0 [pid 5161] +++ exited with 0 +++ [pid 5169] rt_sigprocmask(SIG_SETMASK, [], [pid 5168] <... openat resumed>) = 3 [pid 5167] <... bpf resumed>) = 4 [pid 5166] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5165] <... futex resumed>) = 0 [pid 5162] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5169] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5168] write(3, "1000", 4 [pid 5166] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5165] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5162] <... futex resumed>) = 0 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5161, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5169] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5168] <... write resumed>) = 4 [pid 5167] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5166] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5162] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5169] <... bpf resumed>) = 3 [pid 5168] close(3 [pid 5167] <... futex resumed>) = 1 [pid 5166] <... bpf resumed>) = 5 [pid 5164] <... futex resumed>) = 0 [pid 5169] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5168] <... close resumed>) = 0 [pid 5167] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5169] <... futex resumed>) = 1 [pid 5168] symlink("/dev/binderfs", "./binderfs" [pid 5169] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5168] <... symlink resumed>) = 0 [pid 5166] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5165] <... futex resumed>) = 0 [pid 5164] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5166] <... futex resumed>) = 1 [pid 5165] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5164] <... futex resumed>) = 1 [pid 5162] <... futex resumed>) = 0 [pid 5167] <... futex resumed>) = 0 [pid 5169] <... futex resumed>) = 0 [pid 5168] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5166] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5165] <... futex resumed>) = 1 [pid 5164] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5162] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5169] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5168] <... futex resumed>) = 0 [pid 5167] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5166] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5165] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5162] <... futex resumed>) = 0 [pid 5169] <... bpf resumed>) = 4 [pid 5168] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5166] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5162] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5168] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5169] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5168] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5167] <... bpf resumed>) = 5 [pid 5166] <... bpf resumed>) = 6 [pid 5075] umount2("./8", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5169] <... futex resumed>) = 1 [pid 5168] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5165] <... futex resumed>) = 0 [pid 5168] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5166] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5165] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5169] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5168] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5166] <... futex resumed>) = 1 [pid 5165] <... futex resumed>) = 0 [pid 5162] <... futex resumed>) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5167] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5168] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5166] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5165] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5162] exit_group(0 [pid 5075] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5168] <... mprotect resumed>) = 0 [pid 5166] <... futex resumed>) = ? [pid 5162] <... exit_group resumed>) = ? [pid 5169] <... bpf resumed>) = 5 [pid 5167] <... futex resumed>) = 1 [pid 5166] +++ exited with 0 +++ [pid 5162] +++ exited with 0 +++ [pid 5075] <... openat resumed>) = 3 [pid 5168] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5164] <... futex resumed>) = 0 [pid 5168] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5167] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5164] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] newfstatat(3, "", [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5162, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5169] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5168] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5167] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5164] <... futex resumed>) = 0 [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 ./strace-static-x86_64: Process 5170 attached [pid 5167] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5164] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5075] getdents64(3, [pid 5170] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5169] <... futex resumed>) = 1 [pid 5168] <... clone3 resumed> => {parent_tid=[5170]}, 88) = 5170 [pid 5165] <... futex resumed>) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5170] <... rseq resumed>) = 0 [pid 5169] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5168] rt_sigprocmask(SIG_SETMASK, [], [pid 5165] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] umount2("./8", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5170] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5168] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5165] <... futex resumed>) = 0 [pid 5075] umount2("./8/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5170] <... set_robust_list resumed>) = 0 [pid 5169] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5168] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5165] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5170] rt_sigprocmask(SIG_SETMASK, [], [pid 5169] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5168] <... futex resumed>) = 0 [pid 5074] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5170] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5168] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] newfstatat(AT_FDCWD, "./8/binderfs", [pid 5074] <... openat resumed>) = 3 [pid 5170] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5170] <... bpf resumed>) = 3 [pid 5075] unlink("./8/binderfs" [pid 5074] newfstatat(3, "", [pid 5170] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... unlink resumed>) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5170] <... futex resumed>) = 1 [pid 5168] <... futex resumed>) = 0 [pid 5168] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] getdents64(3, [pid 5170] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5168] <... futex resumed>) = 0 [pid 5075] getdents64(3, [pid 5170] <... bpf resumed>) = 4 [pid 5169] <... bpf resumed>) = 6 [pid 5168] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5167] <... bpf resumed>) = 6 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5170] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5169] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5167] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] umount2("./8/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5170] <... futex resumed>) = 1 [pid 5169] <... futex resumed>) = 1 [pid 5168] <... futex resumed>) = 0 [pid 5167] <... futex resumed>) = 1 [pid 5165] <... futex resumed>) = 0 [pid 5075] close(3 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5170] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5169] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5168] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5167] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5165] exit_group(0 [pid 5164] <... futex resumed>) = 0 [pid 5075] <... close resumed>) = 0 [pid 5074] newfstatat(AT_FDCWD, "./8/binderfs", [pid 5170] <... bpf resumed>) = 5 [pid 5169] <... futex resumed>) = ? [pid 5168] <... futex resumed>) = 0 [pid 5165] <... exit_group resumed>) = ? [pid 5164] exit_group(0 [pid 5075] rmdir("./8" [pid 5168] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5167] <... futex resumed>) = ? [pid 5164] <... exit_group resumed>) = ? [pid 5075] <... rmdir resumed>) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5170] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5168] <... futex resumed>) = 0 [pid 5170] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5168] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] mkdir("./9", 0777 [pid 5170] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5168] <... futex resumed>) = 0 [pid 5075] <... mkdir resumed>) = 0 [pid 5170] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5168] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5170] <... bpf resumed>) = 6 [pid 5169] +++ exited with 0 +++ [pid 5165] +++ exited with 0 +++ [pid 5074] unlink("./8/binderfs"./strace-static-x86_64: Process 5171 attached [pid 5170] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5165, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5074] <... unlink resumed>) = 0 [pid 5171] set_robust_list(0x55555d6c46a0, 24 [pid 5170] <... futex resumed>) = 1 [pid 5168] <... futex resumed>) = 0 [pid 5077] restart_syscall(<... resuming interrupted clone ...> [pid 5074] getdents64(3, [pid 5171] <... set_robust_list resumed>) = 0 [pid 5077] <... restart_syscall resumed>) = 0 [pid 5171] chdir("./9" [pid 5170] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5168] exit_group(0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5170] <... futex resumed>) = ? [pid 5168] <... exit_group resumed>) = ? [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5171 [pid 5171] <... chdir resumed>) = 0 [pid 5170] +++ exited with 0 +++ [pid 5074] close(3) = 0 [pid 5074] rmdir("./8" [pid 5171] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5077] umount2("./8", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... rmdir resumed>) = 0 [pid 5171] <... prctl resumed>) = 0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5167] +++ exited with 0 +++ [pid 5164] +++ exited with 0 +++ [pid 5171] setpgid(0, 0 [pid 5077] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5171] <... setpgid resumed>) = 0 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5164, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5074] mkdir("./9", 0777 [pid 5078] restart_syscall(<... resuming interrupted clone ...> [pid 5077] <... openat resumed>) = 3 [pid 5077] newfstatat(3, "", [pid 5078] <... restart_syscall resumed>) = 0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5171] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5168] +++ exited with 0 +++ [pid 5078] umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5077] getdents64(3, [pid 5074] <... mkdir resumed>) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5171] <... openat resumed>) = 3 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5168, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5078] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5171] write(3, "1000", 4 [pid 5078] <... openat resumed>) = 3 [pid 5077] umount2("./8/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] restart_syscall(<... resuming interrupted clone ...> [pid 5171] <... write resumed>) = 4 [pid 5078] newfstatat(3, "", [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] <... restart_syscall resumed>) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 ./strace-static-x86_64: Process 5172 attached [pid 5171] close(3 [pid 5078] getdents64(3, [pid 5077] newfstatat(AT_FDCWD, "./8/binderfs", [pid 5171] <... close resumed>) = 0 [pid 5172] set_robust_list(0x55555d6c46a0, 24 [pid 5171] symlink("/dev/binderfs", "./binderfs" [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5172 [pid 5172] <... set_robust_list resumed>) = 0 [pid 5171] <... symlink resumed>) = 0 [pid 5077] unlink("./8/binderfs") = 0 [pid 5076] umount2("./8", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5172] chdir("./9" [pid 5171] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5171] <... futex resumed>) = 0 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5171] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5077] getdents64(3, [pid 5076] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5172] <... chdir resumed>) = 0 [pid 5171] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5078] newfstatat(AT_FDCWD, "./9/binderfs", [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5172] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5076] <... openat resumed>) = 3 [pid 5172] <... prctl resumed>) = 0 [pid 5171] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5077] close(3 [pid 5076] newfstatat(3, "", [pid 5172] setpgid(0, 0 [pid 5171] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] <... close resumed>) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5172] <... setpgid resumed>) = 0 [pid 5171] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5078] unlink("./9/binderfs" [pid 5077] rmdir("./8" [pid 5076] getdents64(3, [pid 5077] <... rmdir resumed>) = 0 [pid 5078] <... unlink resumed>) = 0 [pid 5172] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5171] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5078] getdents64(3, [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5172] <... openat resumed>) = 3 [pid 5171] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5077] mkdir("./9", 0777 [pid 5076] umount2("./8/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5172] write(3, "1000", 4 [pid 5171] <... mprotect resumed>) = 0 [pid 5078] close(3 [pid 5077] <... mkdir resumed>) = 0 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5078] <... close resumed>) = 0 [pid 5078] rmdir("./9" [pid 5172] <... write resumed>) = 4 [pid 5076] newfstatat(AT_FDCWD, "./8/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5076] unlink("./8/binderfs" [pid 5172] close(3 [pid 5171] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5078] <... rmdir resumed>) = 0 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5076] <... unlink resumed>) = 0 [pid 5172] <... close resumed>) = 0 [pid 5171] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5078] mkdir("./10", 0777 [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5173 ./strace-static-x86_64: Process 5173 attached [pid 5172] symlink("/dev/binderfs", "./binderfs" [pid 5171] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5078] <... mkdir resumed>) = 0 [pid 5076] getdents64(3, [pid 5173] set_robust_list(0x55555d6c46a0, 24 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 ./strace-static-x86_64: Process 5175 attached ./strace-static-x86_64: Process 5174 attached [pid 5173] <... set_robust_list resumed>) = 0 [pid 5172] <... symlink resumed>) = 0 [pid 5175] set_robust_list(0x55555d6c46a0, 24 [pid 5174] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5173] chdir("./9" [pid 5076] close(3) = 0 [pid 5173] <... chdir resumed>) = 0 [pid 5076] rmdir("./8" [pid 5175] <... set_robust_list resumed>) = 0 [pid 5174] <... rseq resumed>) = 0 [pid 5173] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5172] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5171] <... clone3 resumed> => {parent_tid=[5174]}, 88) = 5174 [pid 5175] chdir("./10" [pid 5174] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5173] <... prctl resumed>) = 0 [pid 5172] <... futex resumed>) = 0 [pid 5171] rt_sigprocmask(SIG_SETMASK, [], [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5175 [pid 5076] <... rmdir resumed>) = 0 [pid 5175] <... chdir resumed>) = 0 [pid 5174] <... set_robust_list resumed>) = 0 [pid 5173] setpgid(0, 0 [pid 5172] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5171] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5175] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5174] rt_sigprocmask(SIG_SETMASK, [], [pid 5173] <... setpgid resumed>) = 0 [pid 5076] mkdir("./9", 0777 [pid 5175] <... prctl resumed>) = 0 [pid 5174] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5173] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5172] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5171] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5172] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5171] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5175] setpgid(0, 0 [pid 5172] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5175] <... setpgid resumed>) = 0 [pid 5174] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5173] <... openat resumed>) = 3 [pid 5172] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5175] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5174] <... bpf resumed>) = 3 [pid 5173] write(3, "1000", 4 [pid 5172] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5076] <... mkdir resumed>) = 0 [pid 5173] <... write resumed>) = 4 [pid 5173] close(3) = 0 [pid 5173] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5175] <... openat resumed>) = 3 [pid 5174] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5172] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE./strace-static-x86_64: Process 5176 attached [pid 5175] write(3, "1000", 4 [pid 5174] <... futex resumed>) = 1 [pid 5173] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5171] <... futex resumed>) = 0 [pid 5176] set_robust_list(0x55555d6c46a0, 24 [pid 5175] <... write resumed>) = 4 [pid 5174] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5173] <... futex resumed>) = 0 [pid 5172] <... mprotect resumed>) = 0 [pid 5171] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5176] <... set_robust_list resumed>) = 0 [pid 5175] close(3 [pid 5174] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5173] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5172] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5175] <... close resumed>) = 0 [pid 5174] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5173] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5176] chdir("./9" [pid 5175] symlink("/dev/binderfs", "./binderfs" [pid 5173] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5172] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5171] <... futex resumed>) = 0 [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5176 [pid 5174] <... bpf resumed>) = 4 [pid 5173] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5171] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5176] <... chdir resumed>) = 0 [pid 5175] <... symlink resumed>) = 0 [pid 5174] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5173] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5172] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5176] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5175] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5174] <... futex resumed>) = 1 [pid 5173] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5171] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5177 attached [pid 5176] <... prctl resumed>) = 0 [pid 5175] <... futex resumed>) = 0 [pid 5174] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5173] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5171] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5177] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5176] setpgid(0, 0 [pid 5175] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5174] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5173] <... mprotect resumed>) = 0 [pid 5171] <... futex resumed>) = 0 [pid 5177] <... rseq resumed>) = 0 [pid 5176] <... setpgid resumed>) = 0 [pid 5175] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5174] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5172] <... clone3 resumed> => {parent_tid=[5177]}, 88) = 5177 [pid 5171] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5177] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5173] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5177] <... set_robust_list resumed>) = 0 [pid 5175] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5172] rt_sigprocmask(SIG_SETMASK, [], [pid 5177] rt_sigprocmask(SIG_SETMASK, [], [pid 5175] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5173] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5172] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5176] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5177] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5173] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5172] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5178 attached [pid 5177] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5176] <... openat resumed>) = 3 [pid 5175] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5174] <... bpf resumed>) = 5 [pid 5172] <... futex resumed>) = 0 [pid 5178] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5177] <... bpf resumed>) = 3 [pid 5176] write(3, "1000", 4 [pid 5175] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5174] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5173] <... clone3 resumed> => {parent_tid=[5178]}, 88) = 5178 [pid 5172] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5178] <... rseq resumed>) = 0 [pid 5177] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5176] <... write resumed>) = 4 [pid 5175] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5174] <... futex resumed>) = 1 [pid 5173] rt_sigprocmask(SIG_SETMASK, [], [pid 5172] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5171] <... futex resumed>) = 0 [pid 5178] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5177] <... futex resumed>) = 0 [pid 5176] close(3 [pid 5175] <... mprotect resumed>) = 0 [pid 5174] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5173] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5172] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5171] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5178] <... set_robust_list resumed>) = 0 [pid 5177] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5176] <... close resumed>) = 0 [pid 5175] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5174] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5173] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5172] <... futex resumed>) = 0 [pid 5171] <... futex resumed>) = 0 [pid 5178] rt_sigprocmask(SIG_SETMASK, [], [pid 5177] <... bpf resumed>) = 4 [pid 5176] symlink("/dev/binderfs", "./binderfs" [pid 5175] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5174] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5173] <... futex resumed>) = 0 [pid 5172] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5171] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5178] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5177] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5176] <... symlink resumed>) = 0 [pid 5175] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5173] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5172] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) ./strace-static-x86_64: Process 5179 attached [pid 5178] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5177] <... futex resumed>) = 0 [pid 5174] <... bpf resumed>) = 6 [pid 5172] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5176] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5179] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5178] <... bpf resumed>) = 3 [pid 5177] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5175] <... clone3 resumed> => {parent_tid=[5179]}, 88) = 5179 [pid 5176] <... futex resumed>) = 0 [pid 5174] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5172] <... futex resumed>) = 0 [pid 5179] <... rseq resumed>) = 0 [pid 5178] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5177] <... bpf resumed>) = 5 [pid 5176] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5175] rt_sigprocmask(SIG_SETMASK, [], [pid 5174] <... futex resumed>) = 1 [pid 5172] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5171] <... futex resumed>) = 0 [pid 5179] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5178] <... futex resumed>) = 1 [pid 5177] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5176] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5175] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5174] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5173] <... futex resumed>) = 0 [pid 5172] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5179] <... set_robust_list resumed>) = 0 [pid 5178] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5177] <... futex resumed>) = 0 [pid 5176] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5175] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5173] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5172] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5171] exit_group(0 [pid 5177] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5173] <... futex resumed>) = 0 [pid 5178] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5175] <... futex resumed>) = 0 [pid 5176] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5172] <... futex resumed>) = 0 [pid 5171] <... exit_group resumed>) = ? [pid 5179] rt_sigprocmask(SIG_SETMASK, [], [pid 5178] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5177] <... bpf resumed>) = 6 [pid 5176] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5175] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5174] <... futex resumed>) = ? [pid 5173] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5172] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5179] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5177] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5177] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5176] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5172] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5179] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5178] <... bpf resumed>) = 4 [pid 5176] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5172] exit_group(0 [pid 5179] <... bpf resumed>) = 3 [pid 5178] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5172] <... exit_group resumed>) = ? [pid 5178] <... futex resumed>) = 1 [pid 5178] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5177] <... futex resumed>) = ? [pid 5173] <... futex resumed>) = 0 [pid 5176] <... mprotect resumed>) = 0 [pid 5179] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5173] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5179] <... futex resumed>) = 1 [pid 5178] <... futex resumed>) = 0 [pid 5175] <... futex resumed>) = 0 [pid 5173] <... futex resumed>) = 1 [pid 5179] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5178] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5176] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5175] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5173] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5179] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5176] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5175] <... futex resumed>) = 0 [pid 5179] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5178] <... bpf resumed>) = 5 [pid 5176] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5175] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5180 attached [pid 5179] <... bpf resumed>) = 4 [pid 5178] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5180] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5179] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5178] <... futex resumed>) = 1 [pid 5177] +++ exited with 0 +++ [pid 5176] <... clone3 resumed> => {parent_tid=[5180]}, 88) = 5180 [pid 5174] +++ exited with 0 +++ [pid 5173] <... futex resumed>) = 0 [pid 5172] +++ exited with 0 +++ [pid 5171] +++ exited with 0 +++ [pid 5180] <... rseq resumed>) = 0 [pid 5179] <... futex resumed>) = 1 [pid 5178] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5176] rt_sigprocmask(SIG_SETMASK, [], [pid 5175] <... futex resumed>) = 0 [pid 5173] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5171, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5172, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5180] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5178] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5175] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5173] <... futex resumed>) = 0 [pid 5179] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5176] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] restart_syscall(<... resuming interrupted clone ...> [pid 5180] <... set_robust_list resumed>) = 0 [pid 5178] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5175] <... futex resumed>) = 0 [pid 5173] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5179] <... bpf resumed>) = 5 [pid 5176] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5075] getdents64(3, [pid 5180] rt_sigprocmask(SIG_SETMASK, [], [pid 5179] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5176] <... futex resumed>) = 0 [pid 5175] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] <... restart_syscall resumed>) = 0 [pid 5176] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5175] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5179] <... futex resumed>) = 0 [pid 5175] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5179] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5175] <... futex resumed>) = 0 [pid 5175] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5075] umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5178] <... bpf resumed>) = 6 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5180] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5178] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5179] <... bpf resumed>) = 6 [pid 5075] newfstatat(AT_FDCWD, "./9/binderfs", [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5180] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5179] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5178] <... futex resumed>) = 1 [pid 5173] <... futex resumed>) = 0 [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5180] <... bpf resumed>) = 3 [pid 5179] <... futex resumed>) = 1 [pid 5178] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5175] <... futex resumed>) = 0 [pid 5173] exit_group(0 [pid 5075] unlink("./9/binderfs" [pid 5074] <... openat resumed>) = 3 [pid 5180] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5179] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5178] <... futex resumed>) = ? [pid 5175] exit_group(0 [pid 5173] <... exit_group resumed>) = ? [pid 5075] <... unlink resumed>) = 0 [pid 5074] newfstatat(3, "", [pid 5180] <... futex resumed>) = 1 [pid 5179] <... futex resumed>) = ? [pid 5178] +++ exited with 0 +++ [pid 5176] <... futex resumed>) = 0 [pid 5175] <... exit_group resumed>) = ? [pid 5179] +++ exited with 0 +++ [pid 5075] getdents64(3, [pid 5180] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5075] close(3 [pid 5074] getdents64(3, [pid 5075] <... close resumed>) = 0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5075] rmdir("./9" [pid 5074] umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] <... rmdir resumed>) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5176] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5176] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5180] <... futex resumed>) = 0 [pid 5074] newfstatat(AT_FDCWD, "./9/binderfs", [pid 5180] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5075] mkdir("./10", 0777 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5180] <... bpf resumed>) = 4 [pid 5075] <... mkdir resumed>) = 0 [pid 5074] unlink("./9/binderfs" [pid 5180] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... unlink resumed>) = 0 [pid 5180] <... futex resumed>) = 1 [pid 5180] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5074] getdents64(3, [pid 5176] <... futex resumed>) = 0 [pid 5175] +++ exited with 0 +++ [pid 5173] +++ exited with 0 +++ [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5181 attached [pid 5176] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5175, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5173, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5180] <... futex resumed>) = 0 [pid 5180] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5176] <... futex resumed>) = 1 [pid 5074] close(3 [pid 5181] set_robust_list(0x55555d6c46a0, 24 [pid 5180] <... bpf resumed>) = 5 [pid 5176] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5181 [pid 5074] <... close resumed>) = 0 [pid 5181] <... set_robust_list resumed>) = 0 [pid 5074] rmdir("./9" [pid 5181] chdir("./10") = 0 [pid 5074] <... rmdir resumed>) = 0 [pid 5181] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5180] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5181] <... prctl resumed>) = 0 [pid 5180] <... futex resumed>) = 1 [pid 5176] <... futex resumed>) = 0 [pid 5078] umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5077] umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5180] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5176] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5181] setpgid(0, 0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] mkdir("./10", 0777 [pid 5181] <... setpgid resumed>) = 0 [pid 5180] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5176] <... futex resumed>) = 0 [pid 5078] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5077] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5074] <... mkdir resumed>) = 0 [pid 5181] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5180] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5176] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] <... openat resumed>) = 3 [pid 5077] <... openat resumed>) = 3 [pid 5077] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5077] getdents64(3, [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5181] <... openat resumed>) = 3 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5180] <... bpf resumed>) = 6 [pid 5078] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5180] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] getdents64(3, [pid 5181] write(3, "1000", 4 [pid 5180] <... futex resumed>) = 1 [pid 5176] <... futex resumed>) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5077] umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5181] <... write resumed>) = 4 [pid 5180] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5181] close(3 [pid 5176] exit_group(0 [pid 5078] umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5181] <... close resumed>) = 0 [pid 5180] <... futex resumed>) = ? [pid 5176] <... exit_group resumed>) = ? [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5077] newfstatat(AT_FDCWD, "./9/binderfs", ./strace-static-x86_64: Process 5182 attached [pid 5181] symlink("/dev/binderfs", "./binderfs" [pid 5180] +++ exited with 0 +++ [pid 5176] +++ exited with 0 +++ [pid 5078] newfstatat(AT_FDCWD, "./10/binderfs", [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5077] unlink("./9/binderfs" [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5176, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5182 [pid 5078] unlink("./10/binderfs" [pid 5077] <... unlink resumed>) = 0 [pid 5182] set_robust_list(0x55555d6c46a0, 24 [pid 5181] <... symlink resumed>) = 0 [pid 5078] <... unlink resumed>) = 0 [pid 5182] <... set_robust_list resumed>) = 0 [pid 5182] chdir("./10" [pid 5181] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5182] <... chdir resumed>) = 0 [pid 5181] <... futex resumed>) = 0 [pid 5078] getdents64(3, [pid 5077] getdents64(3, [pid 5076] umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5181] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5182] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5181] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5078] close(3 [pid 5077] close(3 [pid 5076] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5182] <... prctl resumed>) = 0 [pid 5181] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5078] <... close resumed>) = 0 [pid 5077] <... close resumed>) = 0 [pid 5076] <... openat resumed>) = 3 [pid 5182] setpgid(0, 0 [pid 5181] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] rmdir("./10" [pid 5077] rmdir("./9" [pid 5076] newfstatat(3, "", [pid 5182] <... setpgid resumed>) = 0 [pid 5181] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5078] <... rmdir resumed>) = 0 [pid 5077] <... rmdir resumed>) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5078] mkdir("./11", 0777 [pid 5181] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5182] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5181] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5078] <... mkdir resumed>) = 0 [pid 5076] getdents64(3, [pid 5077] mkdir("./10", 0777 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5181] <... mprotect resumed>) = 0 [pid 5077] <... mkdir resumed>) = 0 [pid 5076] umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5182] <... openat resumed>) = 3 [pid 5182] write(3, "1000", 4 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5183 attached [pid 5182] <... write resumed>) = 4 [pid 5181] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5076] newfstatat(AT_FDCWD, "./9/binderfs", [pid 5182] close(3) = 0 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5183] set_robust_list(0x55555d6c46a0, 24./strace-static-x86_64: Process 5184 attached ) = 0 [pid 5182] symlink("/dev/binderfs", "./binderfs" [pid 5181] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5076] unlink("./9/binderfs" [pid 5182] <... symlink resumed>) = 0 [pid 5181] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5183 [pid 5076] <... unlink resumed>) = 0 [pid 5183] chdir("./11" [pid 5076] getdents64(3, [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5184 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5184] set_robust_list(0x55555d6c46a0, 24 [pid 5182] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5185 attached [pid 5184] <... set_robust_list resumed>) = 0 [pid 5183] <... chdir resumed>) = 0 [pid 5182] <... futex resumed>) = 0 [pid 5181] <... clone3 resumed> => {parent_tid=[5185]}, 88) = 5185 [pid 5076] close(3 [pid 5185] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5182] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5181] rt_sigprocmask(SIG_SETMASK, [], [pid 5076] <... close resumed>) = 0 [pid 5185] <... rseq resumed>) = 0 [pid 5184] chdir("./10" [pid 5183] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5182] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5181] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5076] rmdir("./9" [pid 5185] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5184] <... chdir resumed>) = 0 [pid 5183] <... prctl resumed>) = 0 [pid 5182] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5181] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... rmdir resumed>) = 0 [pid 5185] <... set_robust_list resumed>) = 0 [pid 5184] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5183] setpgid(0, 0 [pid 5182] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5181] <... futex resumed>) = 0 [pid 5185] rt_sigprocmask(SIG_SETMASK, [], [pid 5182] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5181] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5185] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5182] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5185] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5184] <... prctl resumed>) = 0 [pid 5183] <... setpgid resumed>) = 0 [pid 5182] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5076] mkdir("./10", 0777 [pid 5185] <... bpf resumed>) = 3 [pid 5184] setpgid(0, 0 [pid 5183] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5182] <... mprotect resumed>) = 0 [pid 5076] <... mkdir resumed>) = 0 [pid 5185] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5181] <... futex resumed>) = 0 [pid 5185] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5184] <... setpgid resumed>) = 0 [pid 5181] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5185] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5183] <... openat resumed>) = 3 [pid 5182] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5181] <... futex resumed>) = 0 [pid 5185] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5184] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5181] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5183] write(3, "1000", 4 [pid 5182] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5185] <... bpf resumed>) = 4 [pid 5184] <... openat resumed>) = 3 [pid 5183] <... write resumed>) = 4 ./strace-static-x86_64: Process 5186 attached [pid 5185] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5182] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5183] close(3 [pid 5184] write(3, "1000", 4 [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5186 ./strace-static-x86_64: Process 5187 attached [pid 5186] set_robust_list(0x55555d6c46a0, 24 [pid 5185] <... futex resumed>) = 1 [pid 5184] <... write resumed>) = 4 [pid 5183] <... close resumed>) = 0 [pid 5181] <... futex resumed>) = 0 [pid 5187] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5186] <... set_robust_list resumed>) = 0 [pid 5185] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5184] close(3 [pid 5183] symlink("/dev/binderfs", "./binderfs" [pid 5182] <... clone3 resumed> => {parent_tid=[5187]}, 88) = 5187 [pid 5181] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5187] <... rseq resumed>) = 0 [pid 5186] chdir("./10" [pid 5185] <... bpf resumed>) = 5 [pid 5184] <... close resumed>) = 0 [pid 5182] rt_sigprocmask(SIG_SETMASK, [], [pid 5181] <... futex resumed>) = 0 [pid 5183] <... symlink resumed>) = 0 [pid 5181] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5186] <... chdir resumed>) = 0 [pid 5187] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5186] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5185] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5184] symlink("/dev/binderfs", "./binderfs" [pid 5182] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5187] <... set_robust_list resumed>) = 0 [pid 5186] <... prctl resumed>) = 0 [pid 5185] <... futex resumed>) = 1 [pid 5183] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5182] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5181] <... futex resumed>) = 0 [pid 5187] rt_sigprocmask(SIG_SETMASK, [], [pid 5186] setpgid(0, 0 [pid 5185] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5184] <... symlink resumed>) = 0 [pid 5183] <... futex resumed>) = 0 [pid 5182] <... futex resumed>) = 0 [pid 5181] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5187] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5186] <... setpgid resumed>) = 0 [pid 5185] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5182] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5181] <... futex resumed>) = 0 [pid 5187] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5186] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5185] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5184] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5183] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5181] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5187] <... bpf resumed>) = 3 [pid 5185] <... bpf resumed>) = 6 [pid 5184] <... futex resumed>) = 0 [pid 5183] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5187] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5186] <... openat resumed>) = 3 [pid 5185] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5184] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5183] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5187] <... futex resumed>) = 1 [pid 5184] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5183] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5182] <... futex resumed>) = 0 [pid 5187] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5186] write(3, "1000", 4 [pid 5185] <... futex resumed>) = 1 [pid 5184] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5183] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5182] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5181] <... futex resumed>) = 0 [pid 5187] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5186] <... write resumed>) = 4 [pid 5185] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5184] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5183] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5182] <... futex resumed>) = 0 [pid 5187] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5184] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5183] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5182] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5181] exit_group(0 [pid 5187] <... bpf resumed>) = 4 [pid 5186] close(3 [pid 5185] <... futex resumed>) = ? [pid 5184] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5183] <... mprotect resumed>) = 0 [pid 5181] <... exit_group resumed>) = ? [pid 5187] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5186] <... close resumed>) = 0 [pid 5185] +++ exited with 0 +++ [pid 5184] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5186] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5186] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5181] +++ exited with 0 +++ [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5181, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5075] restart_syscall(<... resuming interrupted clone ...> [pid 5186] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5183] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5075] <... restart_syscall resumed>) = 0 [pid 5187] <... futex resumed>) = 1 [pid 5186] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5184] <... mprotect resumed>) = 0 [pid 5182] <... futex resumed>) = 0 [pid 5186] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5075] umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5186] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5187] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5182] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5187] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5186] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5184] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5183] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5182] <... futex resumed>) = 0 [pid 5075] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5187] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5186] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5183] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5182] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] <... openat resumed>) = 3 [pid 5186] <... mprotect resumed>) = 0 [pid 5184] <... rt_sigprocmask resumed>[], 8) = 0 ./strace-static-x86_64: Process 5188 attached [pid 5186] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5075] newfstatat(3, "", [pid 5188] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5184] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5183] <... clone3 resumed> => {parent_tid=[5188]}, 88) = 5188 ./strace-static-x86_64: Process 5189 attached [pid 5188] <... rseq resumed>) = 0 [pid 5186] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5189] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5188] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5186] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5075] getdents64(3, [pid 5189] <... rseq resumed>) = 0 [pid 5188] <... set_robust_list resumed>) = 0 [pid 5187] <... bpf resumed>) = 5 [pid 5184] <... clone3 resumed> => {parent_tid=[5189]}, 88) = 5189 [pid 5183] rt_sigprocmask(SIG_SETMASK, [], ./strace-static-x86_64: Process 5190 attached [pid 5189] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5188] rt_sigprocmask(SIG_SETMASK, [], [pid 5186] <... clone3 resumed> => {parent_tid=[5190]}, 88) = 5190 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5190] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5189] <... set_robust_list resumed>) = 0 [pid 5188] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5186] rt_sigprocmask(SIG_SETMASK, [], [pid 5075] umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5190] <... rseq resumed>) = 0 [pid 5189] rt_sigprocmask(SIG_SETMASK, [], [pid 5188] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5190] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5189] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5186] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5190] <... set_robust_list resumed>) = 0 [pid 5189] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5187] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5186] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5184] rt_sigprocmask(SIG_SETMASK, [], [pid 5183] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] newfstatat(AT_FDCWD, "./10/binderfs", [pid 5190] rt_sigprocmask(SIG_SETMASK, [], [pid 5187] <... futex resumed>) = 1 [pid 5186] <... futex resumed>) = 0 [pid 5184] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5183] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5182] <... futex resumed>) = 0 [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5190] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5187] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5186] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5190] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5188] <... futex resumed>) = 0 [pid 5184] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5183] <... futex resumed>) = 1 [pid 5182] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] unlink("./10/binderfs" [pid 5190] <... bpf resumed>) = 3 [pid 5189] <... futex resumed>) = 0 [pid 5188] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5187] <... futex resumed>) = 0 [pid 5184] <... futex resumed>) = 1 [pid 5183] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5182] <... futex resumed>) = 1 [pid 5190] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5189] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5188] <... bpf resumed>) = 3 [pid 5187] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5184] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5182] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5075] <... unlink resumed>) = 0 [pid 5190] <... futex resumed>) = 1 [pid 5189] <... bpf resumed>) = 3 [pid 5188] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5186] <... futex resumed>) = 0 [pid 5190] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5189] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5188] <... futex resumed>) = 1 [pid 5187] <... bpf resumed>) = 6 [pid 5186] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5183] <... futex resumed>) = 0 [pid 5190] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5189] <... futex resumed>) = 1 [pid 5188] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5187] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5186] <... futex resumed>) = 0 [pid 5184] <... futex resumed>) = 0 [pid 5183] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] getdents64(3, [pid 5190] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5189] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5188] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5187] <... futex resumed>) = 1 [pid 5182] <... futex resumed>) = 0 [pid 5184] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5183] <... futex resumed>) = 0 [pid 5187] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5184] <... futex resumed>) = 0 [pid 5183] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5182] exit_group(0 [pid 5184] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5187] <... futex resumed>) = ? [pid 5182] <... exit_group resumed>) = ? [pid 5190] <... bpf resumed>) = 4 [pid 5189] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5188] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5186] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5190] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5189] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5188] <... bpf resumed>) = 4 [pid 5187] +++ exited with 0 +++ [pid 5186] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5182] +++ exited with 0 +++ [pid 5075] close(3 [pid 5190] <... futex resumed>) = 0 [pid 5189] <... bpf resumed>) = 4 [pid 5188] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5186] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... close resumed>) = 0 [pid 5190] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5189] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5188] <... futex resumed>) = 1 [pid 5186] <... futex resumed>) = 0 [pid 5075] rmdir("./10" [pid 5190] <... bpf resumed>) = 5 [pid 5189] <... futex resumed>) = 1 [pid 5188] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5186] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5184] <... futex resumed>) = 0 [pid 5183] <... futex resumed>) = 0 [pid 5075] <... rmdir resumed>) = 0 [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5182, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5189] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5188] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5184] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5183] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5190] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5189] <... bpf resumed>) = 5 [pid 5188] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5184] <... futex resumed>) = 0 [pid 5183] <... futex resumed>) = 0 [pid 5075] mkdir("./11", 0777 [pid 5074] umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5190] <... futex resumed>) = 1 [pid 5188] <... bpf resumed>) = 5 [pid 5186] <... futex resumed>) = 0 [pid 5184] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5183] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] <... mkdir resumed>) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5190] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5189] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5186] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5184] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5074] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5190] <... bpf resumed>) = 6 [pid 5189] <... futex resumed>) = 0 [pid 5188] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5186] <... futex resumed>) = 0 [pid 5184] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5190] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5189] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5188] <... futex resumed>) = 1 [pid 5186] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5184] <... futex resumed>) = 0 [pid 5183] <... futex resumed>) = 0 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] <... openat resumed>) = 3 [pid 5190] <... futex resumed>) = 0 [pid 5189] <... bpf resumed>) = 6 [pid 5188] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5186] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5190] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5184] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5183] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] newfstatat(3, "", [pid 5183] <... futex resumed>) = 0 [pid 5189] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5188] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5186] exit_group(0 [pid 5183] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5190] <... futex resumed>) = ? [pid 5189] <... futex resumed>) = 1 [pid 5188] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5186] <... exit_group resumed>) = ? ./strace-static-x86_64: Process 5191 attached [pid 5190] +++ exited with 0 +++ [pid 5189] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5188] <... bpf resumed>) = 6 [pid 5184] <... futex resumed>) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5188] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5191 [pid 5188] <... futex resumed>) = 1 [pid 5188] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5183] <... futex resumed>) = 0 [pid 5183] exit_group(0 [pid 5074] getdents64(3, [pid 5188] <... futex resumed>) = ? [pid 5183] <... exit_group resumed>) = ? [pid 5191] set_robust_list(0x55555d6c46a0, 24 [pid 5188] +++ exited with 0 +++ [pid 5184] exit_group(0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5191] <... set_robust_list resumed>) = 0 [pid 5189] <... futex resumed>) = ? [pid 5184] <... exit_group resumed>) = ? [pid 5074] umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5191] chdir("./11" [pid 5186] +++ exited with 0 +++ [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5191] <... chdir resumed>) = 0 [pid 5074] newfstatat(AT_FDCWD, "./10/binderfs", [pid 5191] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5186, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5191] <... prctl resumed>) = 0 [pid 5191] setpgid(0, 0 [pid 5076] restart_syscall(<... resuming interrupted clone ...> [pid 5074] unlink("./10/binderfs" [pid 5191] <... setpgid resumed>) = 0 [pid 5076] <... restart_syscall resumed>) = 0 [pid 5074] <... unlink resumed>) = 0 [pid 5076] umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5191] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5074] getdents64(3, [pid 5076] <... openat resumed>) = 3 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5076] newfstatat(3, "", [pid 5074] close(3 [pid 5191] <... openat resumed>) = 3 [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5191] write(3, "1000", 4 [pid 5074] <... close resumed>) = 0 [pid 5191] <... write resumed>) = 4 [pid 5076] getdents64(3, [pid 5191] close(3) = 0 [pid 5074] rmdir("./10" [pid 5191] symlink("/dev/binderfs", "./binderfs" [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5191] <... symlink resumed>) = 0 [pid 5191] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5189] +++ exited with 0 +++ [pid 5184] +++ exited with 0 +++ [pid 5183] +++ exited with 0 +++ [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] <... rmdir resumed>) = 0 [pid 5191] <... futex resumed>) = 0 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5183, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5184, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5076] newfstatat(AT_FDCWD, "./10/binderfs", [pid 5191] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5074] mkdir("./11", 0777 [pid 5191] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5191] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5076] unlink("./10/binderfs" [pid 5077] umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5191] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] <... unlink resumed>) = 0 [pid 5191] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5077] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5076] getdents64(3, [pid 5074] <... mkdir resumed>) = 0 [pid 5191] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5078] umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5077] <... openat resumed>) = 3 [pid 5191] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5077] newfstatat(3, "", [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5191] <... mprotect resumed>) = 0 [pid 5078] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5076] close(3./strace-static-x86_64: Process 5192 attached [pid 5191] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5078] <... openat resumed>) = 3 [pid 5077] getdents64(3, [pid 5076] <... close resumed>) = 0 [pid 5192] set_robust_list(0x55555d6c46a0, 24 [pid 5191] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5192] <... set_robust_list resumed>) = 0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5191] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5076] rmdir("./10" [pid 5192] chdir("./11" [pid 5078] newfstatat(3, "", ./strace-static-x86_64: Process 5193 attached {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5077] umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5192 [pid 5193] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5192] <... chdir resumed>) = 0 [pid 5191] <... clone3 resumed> => {parent_tid=[5193]}, 88) = 5193 [pid 5078] getdents64(3, [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] <... rmdir resumed>) = 0 [pid 5193] <... rseq resumed>) = 0 [pid 5192] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5191] rt_sigprocmask(SIG_SETMASK, [], [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5077] newfstatat(AT_FDCWD, "./10/binderfs", [pid 5076] mkdir("./11", 0777 [pid 5193] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5192] <... prctl resumed>) = 0 [pid 5191] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5192] setpgid(0, 0 [pid 5191] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5193] <... set_robust_list resumed>) = 0 [pid 5192] <... setpgid resumed>) = 0 [pid 5191] <... futex resumed>) = 0 [pid 5077] unlink("./10/binderfs" [pid 5076] <... mkdir resumed>) = 0 [pid 5078] newfstatat(AT_FDCWD, "./11/binderfs", [pid 5193] rt_sigprocmask(SIG_SETMASK, [], [pid 5192] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5191] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5193] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5077] <... unlink resumed>) = 0 [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5194 attached [pid 5193] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5192] <... openat resumed>) = 3 [pid 5078] unlink("./11/binderfs" [pid 5077] getdents64(3, [pid 5194] set_robust_list(0x55555d6c46a0, 24 [pid 5193] <... bpf resumed>) = 3 [pid 5192] write(3, "1000", 4 [pid 5078] <... unlink resumed>) = 0 [pid 5193] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5194] <... set_robust_list resumed>) = 0 [pid 5192] <... write resumed>) = 4 [pid 5077] close(3 [pid 5193] <... futex resumed>) = 1 [pid 5192] close(3 [pid 5191] <... futex resumed>) = 0 [pid 5078] getdents64(3, [pid 5077] <... close resumed>) = 0 [pid 5194] chdir("./11" [pid 5193] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5192] <... close resumed>) = 0 [pid 5191] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5077] rmdir("./10" [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5194 [pid 5194] <... chdir resumed>) = 0 [pid 5193] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5192] symlink("/dev/binderfs", "./binderfs" [pid 5191] <... futex resumed>) = 0 [pid 5078] close(3 [pid 5193] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5191] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... close resumed>) = 0 [pid 5194] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5193] <... bpf resumed>) = 4 [pid 5192] <... symlink resumed>) = 0 [pid 5078] rmdir("./11" [pid 5077] <... rmdir resumed>) = 0 [pid 5194] <... prctl resumed>) = 0 [pid 5193] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5192] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... rmdir resumed>) = 0 [pid 5077] mkdir("./11", 0777 [pid 5194] setpgid(0, 0 [pid 5193] <... futex resumed>) = 1 [pid 5191] <... futex resumed>) = 0 [pid 5193] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5191] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5194] <... setpgid resumed>) = 0 [pid 5193] <... bpf resumed>) = 5 [pid 5192] <... futex resumed>) = 0 [pid 5191] <... futex resumed>) = 0 [pid 5078] mkdir("./12", 0777 [pid 5077] <... mkdir resumed>) = 0 [pid 5192] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5194] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5192] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5191] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... mkdir resumed>) = 0 [pid 5194] <... openat resumed>) = 3 [pid 5192] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5194] write(3, "1000", 4 [pid 5192] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5194] <... write resumed>) = 4 [pid 5192] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5193] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5193] <... futex resumed>) = 1 [pid 5191] <... futex resumed>) = 0 [pid 5193] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5191] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5193] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5191] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5195 attached ./strace-static-x86_64: Process 5196 attached [pid 5194] close(3 [pid 5193] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5192] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5191] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5196] set_robust_list(0x55555d6c46a0, 24 [pid 5195] set_robust_list(0x55555d6c46a0, 24 [pid 5194] <... close resumed>) = 0 [pid 5193] <... bpf resumed>) = 6 [pid 5192] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5196] <... set_robust_list resumed>) = 0 [pid 5195] <... set_robust_list resumed>) = 0 [pid 5194] symlink("/dev/binderfs", "./binderfs" [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5195 [pid 5196] chdir("./12" [pid 5193] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5194] <... symlink resumed>) = 0 [pid 5191] <... futex resumed>) = 0 [pid 5196] <... chdir resumed>) = 0 [pid 5191] exit_group(0 [pid 5196] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5195] chdir("./11" [pid 5196] <... prctl resumed>) = 0 [pid 5192] <... mprotect resumed>) = 0 [pid 5196] setpgid(0, 0 [pid 5191] <... exit_group resumed>) = ? [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5196 [pid 5196] <... setpgid resumed>) = 0 [pid 5195] <... chdir resumed>) = 0 [pid 5194] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5193] +++ exited with 0 +++ [pid 5192] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5196] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5195] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5194] <... futex resumed>) = 0 [pid 5192] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5195] <... prctl resumed>) = 0 [pid 5194] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5192] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0}./strace-static-x86_64: Process 5197 attached [pid 5195] setpgid(0, 0 [pid 5194] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5191] +++ exited with 0 +++ [pid 5196] <... openat resumed>) = 3 [pid 5197] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5195] <... setpgid resumed>) = 0 [pid 5194] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5191, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5197] <... rseq resumed>) = 0 [pid 5194] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5192] <... clone3 resumed> => {parent_tid=[5197]}, 88) = 5197 [pid 5075] restart_syscall(<... resuming interrupted clone ...> [pid 5197] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5196] write(3, "1000", 4 [pid 5195] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5194] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5192] rt_sigprocmask(SIG_SETMASK, [], [pid 5075] <... restart_syscall resumed>) = 0 [pid 5197] <... set_robust_list resumed>) = 0 [pid 5196] <... write resumed>) = 4 [pid 5194] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5192] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5197] rt_sigprocmask(SIG_SETMASK, [], [pid 5195] <... openat resumed>) = 3 [pid 5197] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5196] close(3 [pid 5195] write(3, "1000", 4 [pid 5194] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5192] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5197] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5196] <... close resumed>) = 0 [pid 5194] <... mprotect resumed>) = 0 [pid 5192] <... futex resumed>) = 0 [pid 5195] <... write resumed>) = 4 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5197] <... bpf resumed>) = 3 [pid 5196] symlink("/dev/binderfs", "./binderfs" [pid 5195] close(3 [pid 5192] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5194] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5197] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5195] <... close resumed>) = 0 [pid 5192] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5197] <... futex resumed>) = 0 [pid 5196] <... symlink resumed>) = 0 [pid 5195] symlink("/dev/binderfs", "./binderfs" [pid 5194] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5192] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... openat resumed>) = 3 [pid 5197] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5195] <... symlink resumed>) = 0 [pid 5075] newfstatat(3, "", [pid 5194] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5197] <... bpf resumed>) = 4 [pid 5196] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5195] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5192] <... futex resumed>) = 0 [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5197] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] getdents64(3, [pid 5197] <... futex resumed>) = 0 [pid 5192] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5197] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5196] <... futex resumed>) = 0 [pid 5195] <... futex resumed>) = 0 [pid 5192] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5075] umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] newfstatat(AT_FDCWD, "./11/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5075] unlink("./11/binderfs"./strace-static-x86_64: Process 5198 attached [pid 5196] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5195] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5192] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5198] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5197] <... futex resumed>) = 0 [pid 5196] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5195] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5194] <... clone3 resumed> => {parent_tid=[5198]}, 88) = 5198 [pid 5192] <... futex resumed>) = 1 [pid 5075] <... unlink resumed>) = 0 [pid 5198] <... rseq resumed>) = 0 [pid 5197] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5196] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5195] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5194] rt_sigprocmask(SIG_SETMASK, [], [pid 5192] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5198] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5197] <... bpf resumed>) = 5 [pid 5194] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] getdents64(3, [pid 5198] <... set_robust_list resumed>) = 0 [pid 5196] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5195] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5196] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5195] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5198] rt_sigprocmask(SIG_SETMASK, [], [pid 5196] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5195] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5194] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5198] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5197] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5194] <... futex resumed>) = 0 [pid 5075] close(3 [pid 5198] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5197] <... futex resumed>) = 1 [pid 5196] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5195] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5194] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5192] <... futex resumed>) = 0 [pid 5075] <... close resumed>) = 0 [pid 5198] <... bpf resumed>) = 3 [pid 5197] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5196] <... mprotect resumed>) = 0 [pid 5195] <... mprotect resumed>) = 0 [pid 5192] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] rmdir("./11" [pid 5198] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5197] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5195] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5192] <... futex resumed>) = 0 [pid 5196] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5075] <... rmdir resumed>) = 0 [pid 5198] <... futex resumed>) = 1 [pid 5197] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5194] <... futex resumed>) = 0 [pid 5194] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5198] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5197] <... bpf resumed>) = 6 [pid 5194] <... futex resumed>) = 0 [pid 5198] <... bpf resumed>) = 4 [pid 5196] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5195] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5194] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5192] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5075] mkdir("./12", 0777 [pid 5198] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5197] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5196] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5195] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5194] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5192] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5075] <... mkdir resumed>) = 0 [pid 5198] <... futex resumed>) = 0 [pid 5197] <... futex resumed>) = 0 [pid 5194] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5192] exit_group(0 [pid 5197] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5198] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5194] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5200 attached ./strace-static-x86_64: Process 5199 attached [pid 5198] <... bpf resumed>) = 5 [pid 5197] <... futex resumed>) = ? [pid 5194] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5192] <... exit_group resumed>) = ? [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5200] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5199] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053./strace-static-x86_64: Process 5201 attached [pid 5200] <... rseq resumed>) = 0 [pid 5199] <... rseq resumed>) = 0 [pid 5197] +++ exited with 0 +++ [pid 5196] <... clone3 resumed> => {parent_tid=[5200]}, 88) = 5200 [pid 5195] <... clone3 resumed> => {parent_tid=[5199]}, 88) = 5199 [pid 5192] +++ exited with 0 +++ [pid 5200] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5199] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5198] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5201] set_robust_list(0x55555d6c46a0, 24 [pid 5200] <... set_robust_list resumed>) = 0 [pid 5199] <... set_robust_list resumed>) = 0 [pid 5198] <... futex resumed>) = 1 [pid 5196] rt_sigprocmask(SIG_SETMASK, [], [pid 5195] rt_sigprocmask(SIG_SETMASK, [], [pid 5194] <... futex resumed>) = 0 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5201 [pid 5201] <... set_robust_list resumed>) = 0 [pid 5200] rt_sigprocmask(SIG_SETMASK, [], [pid 5199] rt_sigprocmask(SIG_SETMASK, [], [pid 5198] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5196] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5195] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5194] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5192, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5201] chdir("./12" [pid 5200] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5199] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5198] <... bpf resumed>) = 6 [pid 5196] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5195] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5194] <... futex resumed>) = 0 [pid 5074] umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5201] <... chdir resumed>) = 0 [pid 5200] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5196] <... futex resumed>) = 0 [pid 5195] <... futex resumed>) = 0 [pid 5194] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5201] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5200] <... bpf resumed>) = 3 [pid 5199] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5198] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5196] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5195] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5194] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5074] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5201] <... prctl resumed>) = 0 [pid 5200] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5199] <... bpf resumed>) = 3 [pid 5198] <... futex resumed>) = 0 [pid 5196] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5194] exit_group(0 [pid 5074] <... openat resumed>) = 3 [pid 5201] setpgid(0, 0 [pid 5200] <... futex resumed>) = 0 [pid 5199] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5196] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5194] <... exit_group resumed>) = ? [pid 5074] newfstatat(3, "", [pid 5201] <... setpgid resumed>) = 0 [pid 5200] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5199] <... futex resumed>) = 1 [pid 5198] +++ exited with 0 +++ [pid 5196] <... futex resumed>) = 0 [pid 5195] <... futex resumed>) = 0 [pid 5194] +++ exited with 0 +++ [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5201] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5200] <... bpf resumed>) = 4 [pid 5199] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5196] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5195] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5194, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5200] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5196] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5195] <... futex resumed>) = 0 [pid 5201] <... openat resumed>) = 3 [pid 5200] <... futex resumed>) = 0 [pid 5196] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5195] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] getdents64(3, [pid 5201] write(3, "1000", 4 [pid 5200] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5199] <... bpf resumed>) = 4 [pid 5196] <... futex resumed>) = 0 [pid 5201] <... write resumed>) = 4 [pid 5200] <... bpf resumed>) = 5 [pid 5196] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5201] close(3) = 0 [pid 5076] umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5199] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5201] symlink("/dev/binderfs", "./binderfs" [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5200] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5201] <... symlink resumed>) = 0 [pid 5200] <... futex resumed>) = 1 [pid 5196] <... futex resumed>) = 0 [pid 5074] newfstatat(AT_FDCWD, "./11/binderfs", [pid 5200] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5196] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5196] <... futex resumed>) = 0 [pid 5074] unlink("./11/binderfs" [pid 5201] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5199] <... futex resumed>) = 1 [pid 5196] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5076] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5074] <... unlink resumed>) = 0 [pid 5201] <... futex resumed>) = 0 [pid 5199] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5195] <... futex resumed>) = 0 [pid 5076] <... openat resumed>) = 3 [pid 5201] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, NULL, 8) = 0 [pid 5200] <... bpf resumed>) = 6 [pid 5195] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] newfstatat(3, "", [pid 5201] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5200] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5199] <... futex resumed>) = 0 [pid 5195] <... futex resumed>) = 1 [pid 5201] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5200] <... futex resumed>) = 1 [pid 5199] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5196] <... futex resumed>) = 0 [pid 5195] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5074] getdents64(3, [pid 5201] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5200] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5196] exit_group(0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5200] <... futex resumed>) = ? [pid 5196] <... exit_group resumed>) = ? [pid 5201] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5200] +++ exited with 0 +++ [pid 5199] <... bpf resumed>) = 5 [pid 5196] +++ exited with 0 +++ [pid 5076] getdents64(3, [pid 5074] close(3) = 0 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5196, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5078] restart_syscall(<... resuming interrupted clone ...> [pid 5074] rmdir("./11" [pid 5201] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5199] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... restart_syscall resumed>) = 0 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5074] <... rmdir resumed>) = 0 [pid 5201] <... mprotect resumed>) = 0 [pid 5076] umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5199] <... futex resumed>) = 1 [pid 5195] <... futex resumed>) = 0 [pid 5199] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5195] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] mkdir("./12", 0777 [pid 5201] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5199] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5195] <... futex resumed>) = 0 [pid 5076] newfstatat(AT_FDCWD, "./11/binderfs", [pid 5201] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5199] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5195] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] umount2("./12", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... mkdir resumed>) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5078] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5201] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5076] unlink("./11/binderfs" [pid 5078] <... openat resumed>) = 3 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5078] newfstatat(3, "", [pid 5076] <... unlink resumed>) = 0 ./strace-static-x86_64: Process 5203 attached ./strace-static-x86_64: Process 5202 attached [pid 5201] <... clone3 resumed> => {parent_tid=[5202]}, 88) = 5202 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5076] getdents64(3, [pid 5203] set_robust_list(0x55555d6c46a0, 24 [pid 5202] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053) = 0 [pid 5202] set_robust_list(0x7f3e2f60d9a0, 24) = 0 [pid 5201] rt_sigprocmask(SIG_SETMASK, [], [pid 5078] getdents64(3, [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5203] <... set_robust_list resumed>) = 0 [pid 5201] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5076] close(3 [pid 5202] rt_sigprocmask(SIG_SETMASK, [], [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5202] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] umount2("./12/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] <... close resumed>) = 0 [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5203 [pid 5203] chdir("./12" [pid 5202] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5201] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5199] <... bpf resumed>) = 6 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] rmdir("./11" [pid 5202] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5201] <... futex resumed>) = 0 [pid 5078] newfstatat(AT_FDCWD, "./12/binderfs", [pid 5202] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5202] <... bpf resumed>) = 3 [pid 5201] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] <... rmdir resumed>) = 0 [pid 5203] <... chdir resumed>) = 0 [pid 5202] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5199] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] unlink("./12/binderfs" [pid 5202] <... futex resumed>) = 0 [pid 5201] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5078] <... unlink resumed>) = 0 [pid 5203] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5202] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5201] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5199] <... futex resumed>) = 1 [pid 5195] <... futex resumed>) = 0 [pid 5076] mkdir("./12", 0777 [pid 5203] setpgid(0, 0 [pid 5202] <... bpf resumed>) = 4 [pid 5201] <... futex resumed>) = 0 [pid 5199] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5195] exit_group(0 [pid 5078] getdents64(3, [pid 5203] <... setpgid resumed>) = 0 [pid 5202] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5201] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5199] <... futex resumed>) = ? [pid 5195] <... exit_group resumed>) = ? [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5203] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5202] <... futex resumed>) = 0 [pid 5078] close(3 [pid 5202] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5201] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5201] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5202] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5201] <... futex resumed>) = 0 [pid 5078] <... close resumed>) = 0 [pid 5202] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5201] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5199] +++ exited with 0 +++ [pid 5195] +++ exited with 0 +++ [pid 5076] <... mkdir resumed>) = 0 [pid 5203] <... openat resumed>) = 3 [pid 5202] <... bpf resumed>) = 5 [pid 5078] rmdir("./12" [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5195, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5203] write(3, "1000", 4 [pid 5078] <... rmdir resumed>) = 0 [pid 5202] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5203] <... write resumed>) = 4 [pid 5203] close(3 [pid 5202] <... futex resumed>) = 1 [pid 5201] <... futex resumed>) = 0 [pid 5077] umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5204 attached [pid 5203] <... close resumed>) = 0 [pid 5202] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5201] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] mkdir("./13", 0777 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5201] <... futex resumed>) = 0 [pid 5204] set_robust_list(0x55555d6c46a0, 24 [pid 5203] symlink("/dev/binderfs", "./binderfs" [pid 5201] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] <... mkdir resumed>) = 0 [pid 5077] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5204] <... set_robust_list resumed>) = 0 [pid 5203] <... symlink resumed>) = 0 [pid 5202] <... bpf resumed>) = 6 [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5204 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5077] <... openat resumed>) = 3 [pid 5204] chdir("./12" [pid 5077] newfstatat(3, "", [pid 5204] <... chdir resumed>) = 0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5204] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5077] getdents64(3, [pid 5204] <... prctl resumed>) = 0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5204] setpgid(0, 0 [pid 5203] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5202] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5204] <... setpgid resumed>) = 0 [pid 5202] <... futex resumed>) = 1 [pid 5077] umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5201] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5205 attached [pid 5204] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5203] <... futex resumed>) = 0 [pid 5202] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5205] set_robust_list(0x55555d6c46a0, 24 [pid 5203] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5201] exit_group(0 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5205 [pid 5205] <... set_robust_list resumed>) = 0 [pid 5203] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5202] <... futex resumed>) = ? [pid 5201] <... exit_group resumed>) = ? [pid 5203] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5202] +++ exited with 0 +++ [pid 5203] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5203] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5205] chdir("./13" [pid 5204] <... openat resumed>) = 3 [pid 5203] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5077] newfstatat(AT_FDCWD, "./11/binderfs", [pid 5204] write(3, "1000", 4 [pid 5203] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5205] <... chdir resumed>) = 0 [pid 5204] <... write resumed>) = 4 [pid 5077] unlink("./11/binderfs" [pid 5205] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5204] close(3 [pid 5203] <... mprotect resumed>) = 0 [pid 5077] <... unlink resumed>) = 0 [pid 5204] <... close resumed>) = 0 [pid 5077] getdents64(3, [pid 5205] <... prctl resumed>) = 0 [pid 5204] symlink("/dev/binderfs", "./binderfs" [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5205] setpgid(0, 0 [pid 5204] <... symlink resumed>) = 0 [pid 5203] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5077] close(3 [pid 5205] <... setpgid resumed>) = 0 [pid 5204] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... close resumed>) = 0 [pid 5204] <... futex resumed>) = 0 [pid 5077] rmdir("./11" [pid 5204] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5201] +++ exited with 0 +++ [pid 5077] <... rmdir resumed>) = 0 [pid 5205] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5203] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5205] <... openat resumed>) = 3 [pid 5204] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5203] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5201, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5204] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5077] mkdir("./12", 0777./strace-static-x86_64: Process 5206 attached [pid 5205] write(3, "1000", 4 [pid 5204] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5206] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5205] <... write resumed>) = 4 [pid 5204] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5077] <... mkdir resumed>) = 0 [pid 5075] umount2("./12", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5206] <... rseq resumed>) = 0 [pid 5204] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5206] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5204] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5205] close(3 [pid 5203] <... clone3 resumed> => {parent_tid=[5206]}, 88) = 5206 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5206] <... set_robust_list resumed>) = 0 [pid 5205] <... close resumed>) = 0 [pid 5203] rt_sigprocmask(SIG_SETMASK, [], [pid 5075] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY./strace-static-x86_64: Process 5207 attached [pid 5206] rt_sigprocmask(SIG_SETMASK, [], [pid 5205] symlink("/dev/binderfs", "./binderfs" [pid 5204] <... mprotect resumed>) = 0 [pid 5203] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] <... openat resumed>) = 3 [pid 5207] set_robust_list(0x55555d6c46a0, 24 [pid 5206] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5205] <... symlink resumed>) = 0 [pid 5203] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5207 [pid 5207] <... set_robust_list resumed>) = 0 [pid 5204] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5207] chdir("./12" [pid 5206] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5205] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5204] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5203] <... futex resumed>) = 0 [pid 5075] newfstatat(3, "", [pid 5207] <... chdir resumed>) = 0 [pid 5205] <... futex resumed>) = 0 [pid 5203] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5205] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5075] getdents64(3, [pid 5205] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5206] <... bpf resumed>) = 3 [pid 5205] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5204] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5207] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5206] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5205] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] umount2("./12/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5207] <... prctl resumed>) = 0 [pid 5206] <... futex resumed>) = 1 [pid 5205] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5203] <... futex resumed>) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5208 attached [pid 5207] setpgid(0, 0 [pid 5206] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5205] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5203] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] newfstatat(AT_FDCWD, "./12/binderfs", [pid 5208] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5207] <... setpgid resumed>) = 0 [pid 5206] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5205] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5204] <... clone3 resumed> => {parent_tid=[5208]}, 88) = 5208 [pid 5203] <... futex resumed>) = 0 [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5208] <... rseq resumed>) = 0 [pid 5207] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5206] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5205] <... mprotect resumed>) = 0 [pid 5204] rt_sigprocmask(SIG_SETMASK, [], [pid 5203] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5208] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5207] <... openat resumed>) = 3 [pid 5206] <... bpf resumed>) = 4 [pid 5205] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5204] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] unlink("./12/binderfs" [pid 5208] <... set_robust_list resumed>) = 0 [pid 5205] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5075] <... unlink resumed>) = 0 [pid 5206] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5204] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5208] rt_sigprocmask(SIG_SETMASK, [], [pid 5207] write(3, "1000", 4 [pid 5205] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5075] getdents64(3, [pid 5206] <... futex resumed>) = 1 [pid 5204] <... futex resumed>) = 0 [pid 5203] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5209 attached [pid 5208] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5207] <... write resumed>) = 4 [pid 5206] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5204] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5203] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5209] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5208] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5207] close(3 [pid 5206] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5209] <... rseq resumed>) = 0 [pid 5208] <... bpf resumed>) = 3 [pid 5207] <... close resumed>) = 0 [pid 5206] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5205] <... clone3 resumed> => {parent_tid=[5209]}, 88) = 5209 [pid 5203] <... futex resumed>) = 0 [pid 5075] close(3 [pid 5209] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5208] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5207] symlink("/dev/binderfs", "./binderfs" [pid 5205] rt_sigprocmask(SIG_SETMASK, [], [pid 5203] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] <... close resumed>) = 0 [pid 5209] <... set_robust_list resumed>) = 0 [pid 5208] <... futex resumed>) = 1 [pid 5205] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] rmdir("./12" [pid 5209] rt_sigprocmask(SIG_SETMASK, [], [pid 5208] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5207] <... symlink resumed>) = 0 [pid 5205] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5204] <... futex resumed>) = 0 [pid 5075] <... rmdir resumed>) = 0 [pid 5209] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5206] <... bpf resumed>) = 5 [pid 5205] <... futex resumed>) = 0 [pid 5204] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5206] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5204] <... futex resumed>) = 1 [pid 5207] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5206] <... futex resumed>) = 1 [pid 5204] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5207] <... futex resumed>) = 0 [pid 5206] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5209] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5208] <... futex resumed>) = 0 [pid 5205] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5203] <... futex resumed>) = 0 [pid 5075] mkdir("./13", 0777 [pid 5209] <... bpf resumed>) = 3 [pid 5208] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5207] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5203] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... mkdir resumed>) = 0 [pid 5209] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5208] <... bpf resumed>) = 4 [pid 5207] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5206] <... futex resumed>) = 0 [pid 5203] <... futex resumed>) = 1 [pid 5207] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5206] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5207] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5209] <... futex resumed>) = 1 [pid 5208] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5207] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5206] <... bpf resumed>) = 6 [pid 5205] <... futex resumed>) = 0 [pid 5203] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5210 attached [pid 5209] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5208] <... futex resumed>) = 1 [pid 5207] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5206] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5205] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5204] <... futex resumed>) = 0 [pid 5210] set_robust_list(0x55555d6c46a0, 24 [pid 5209] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5208] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5205] <... futex resumed>) = 0 [pid 5206] <... futex resumed>) = 1 [pid 5204] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5207] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5210] <... set_robust_list resumed>) = 0 [pid 5206] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5204] <... futex resumed>) = 0 [pid 5204] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5207] <... mprotect resumed>) = 0 [pid 5209] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5208] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5205] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5203] <... futex resumed>) = 0 [pid 5210] chdir("./13" [pid 5209] <... bpf resumed>) = 4 [pid 5208] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5207] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5203] exit_group(0 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5210 [pid 5210] <... chdir resumed>) = 0 [pid 5209] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5208] <... bpf resumed>) = 5 [pid 5207] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5206] <... futex resumed>) = ? [pid 5203] <... exit_group resumed>) = ? [pid 5210] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5209] <... futex resumed>) = 1 [pid 5207] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5206] +++ exited with 0 +++ [pid 5205] <... futex resumed>) = 0 [pid 5203] +++ exited with 0 +++ ./strace-static-x86_64: Process 5211 attached [pid 5210] <... prctl resumed>) = 0 [pid 5209] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5208] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5205] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5203, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5211] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5210] setpgid(0, 0 [pid 5209] <... bpf resumed>) = 5 [pid 5208] <... futex resumed>) = 1 [pid 5207] <... clone3 resumed> => {parent_tid=[5211]}, 88) = 5211 [pid 5205] <... futex resumed>) = 0 [pid 5204] <... futex resumed>) = 0 [pid 5205] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5211] <... rseq resumed>) = 0 [pid 5210] <... setpgid resumed>) = 0 [pid 5207] rt_sigprocmask(SIG_SETMASK, [], [pid 5209] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5208] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5204] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5211] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5210] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5209] <... futex resumed>) = 1 [pid 5207] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5205] <... futex resumed>) = 0 [pid 5204] <... futex resumed>) = 0 [pid 5211] <... set_robust_list resumed>) = 0 [pid 5210] <... openat resumed>) = 3 [pid 5209] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5208] <... bpf resumed>) = 6 [pid 5207] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5205] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5204] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5211] rt_sigprocmask(SIG_SETMASK, [], [pid 5210] write(3, "1000", 4 [pid 5209] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5208] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5207] <... futex resumed>) = 0 [pid 5205] <... futex resumed>) = 0 [pid 5204] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5074] umount2("./12", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5211] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5210] <... write resumed>) = 4 [pid 5209] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5208] <... futex resumed>) = 0 [pid 5207] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5205] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5204] exit_group(0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5211] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5210] close(3 [pid 5209] <... bpf resumed>) = 6 [pid 5204] <... exit_group resumed>) = ? [pid 5074] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5211] <... bpf resumed>) = 3 [pid 5210] <... close resumed>) = 0 [pid 5211] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5210] symlink("/dev/binderfs", "./binderfs" [pid 5211] <... futex resumed>) = 1 [pid 5210] <... symlink resumed>) = 0 [pid 5209] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5207] <... futex resumed>) = 0 [pid 5074] <... openat resumed>) = 3 [pid 5211] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5074] newfstatat(3, "", [pid 5210] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5209] <... futex resumed>) = 1 [pid 5208] +++ exited with 0 +++ [pid 5207] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5205] <... futex resumed>) = 0 [pid 5204] +++ exited with 0 +++ [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5211] <... futex resumed>) = 0 [pid 5210] <... futex resumed>) = 0 [pid 5209] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5207] <... futex resumed>) = 1 [pid 5211] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5210] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5207] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5205] exit_group(0 [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5204, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5074] getdents64(3, [pid 5211] <... bpf resumed>) = 4 [pid 5210] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5209] <... futex resumed>) = ? [pid 5205] <... exit_group resumed>) = ? [pid 5210] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5209] +++ exited with 0 +++ [pid 5210] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5210] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f3e2f5ed000 [pid 5210] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5210] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5205] +++ exited with 0 +++ [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5205, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5211] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5210] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5078] umount2("./13", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5211] <... futex resumed>) = 1 [pid 5210] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5207] <... futex resumed>) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] umount2("./12/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5211] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5207] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY./strace-static-x86_64: Process 5212 attached [pid 5211] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5207] <... futex resumed>) = 0 [pid 5078] <... openat resumed>) = 3 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5212] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5211] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5076] umount2("./12", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] newfstatat(AT_FDCWD, "./12/binderfs", [pid 5212] <... rseq resumed>) = 0 [pid 5210] <... clone3 resumed> => {parent_tid=[5212]}, 88) = 5212 [pid 5207] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] newfstatat(3, "", [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5212] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5210] rt_sigprocmask(SIG_SETMASK, [], [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5210] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] getdents64(3, [pid 5212] <... set_robust_list resumed>) = 0 [pid 5211] <... bpf resumed>) = 5 [pid 5210] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5076] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5074] unlink("./12/binderfs" [pid 5210] <... futex resumed>) = 0 [pid 5078] umount2("./13/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5212] rt_sigprocmask(SIG_SETMASK, [], [pid 5210] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5212] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] newfstatat(AT_FDCWD, "./13/binderfs", [pid 5076] <... openat resumed>) = 3 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5078] unlink("./13/binderfs") = 0 [pid 5078] getdents64(3, 0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5078] close(3) = 0 [pid 5074] <... unlink resumed>) = 0 [pid 5212] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5076] newfstatat(3, "", [pid 5211] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] getdents64(3, [pid 5212] <... bpf resumed>) = 3 [pid 5211] <... futex resumed>) = 1 [pid 5207] <... futex resumed>) = 0 [pid 5078] rmdir("./13" [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5212] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5211] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5207] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... rmdir resumed>) = 0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5207] <... futex resumed>) = 0 [pid 5078] mkdir("./14", 0777 [pid 5212] <... futex resumed>) = 1 [pid 5211] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5210] <... futex resumed>) = 0 [pid 5207] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] <... mkdir resumed>) = 0 [pid 5076] getdents64(3, [pid 5074] close(3 [pid 5212] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5211] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5210] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5210] <... futex resumed>) = 0 [pid 5212] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5210] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5076] umount2("./12/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... close resumed>) = 0 ./strace-static-x86_64: Process 5213 attached [pid 5212] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] rmdir("./12" [pid 5213] set_robust_list(0x55555d6c46a0, 24 [pid 5211] <... bpf resumed>) = 6 [pid 5211] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5213 [pid 5211] <... futex resumed>) = 1 [pid 5207] <... futex resumed>) = 0 [pid 5213] <... set_robust_list resumed>) = 0 [pid 5212] <... bpf resumed>) = 4 [pid 5211] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5207] exit_group(0 [pid 5076] newfstatat(AT_FDCWD, "./12/binderfs", [pid 5074] <... rmdir resumed>) = 0 [pid 5213] chdir("./14" [pid 5211] <... futex resumed>) = ? [pid 5207] <... exit_group resumed>) = ? [pid 5213] <... chdir resumed>) = 0 [pid 5212] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5211] +++ exited with 0 +++ [pid 5207] +++ exited with 0 +++ [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] mkdir("./13", 0777 [pid 5213] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5212] <... futex resumed>) = 1 [pid 5210] <... futex resumed>) = 0 [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5207, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5076] unlink("./12/binderfs" [pid 5212] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5210] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5210] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5213] <... prctl resumed>) = 0 [pid 5212] <... bpf resumed>) = 5 [pid 5213] setpgid(0, 0 [pid 5076] <... unlink resumed>) = 0 [pid 5074] <... mkdir resumed>) = 0 [pid 5212] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5213] <... setpgid resumed>) = 0 [pid 5076] getdents64(3, [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5213] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5212] <... futex resumed>) = 1 [pid 5210] <... futex resumed>) = 0 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5212] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5210] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] close(3 [pid 5210] <... futex resumed>) = 0 [pid 5213] <... openat resumed>) = 3 [pid 5210] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000}./strace-static-x86_64: Process 5214 attached [pid 5076] <... close resumed>) = 0 [pid 5077] umount2("./12", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] rmdir("./12" [pid 5214] set_robust_list(0x55555d6c46a0, 24 [pid 5213] write(3, "1000", 4 [pid 5212] <... bpf resumed>) = 6 [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5214 [pid 5214] <... set_robust_list resumed>) = 0 [pid 5213] <... write resumed>) = 4 [pid 5212] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5214] chdir("./13" [pid 5213] close(3 [pid 5212] <... futex resumed>) = 1 [pid 5210] <... futex resumed>) = 0 [pid 5077] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5076] <... rmdir resumed>) = 0 [pid 5212] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5210] exit_group(0 [pid 5213] <... close resumed>) = 0 [pid 5077] <... openat resumed>) = 3 [pid 5214] <... chdir resumed>) = 0 [pid 5213] symlink("/dev/binderfs", "./binderfs" [pid 5212] <... futex resumed>) = ? [pid 5210] <... exit_group resumed>) = ? [pid 5077] newfstatat(3, "", [pid 5076] mkdir("./13", 0777 [pid 5214] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5213] <... symlink resumed>) = 0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5076] <... mkdir resumed>) = 0 [pid 5213] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5213] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, NULL, 8) = 0 [pid 5213] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5214] setpgid(0, 0 [pid 5213] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5212] +++ exited with 0 +++ [pid 5210] +++ exited with 0 +++ [pid 5077] getdents64(3, [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5214] <... setpgid resumed>) = 0 [pid 5213] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5210, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5214] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5213] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5077] umount2("./12/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5215 attached [pid 5214] <... openat resumed>) = 3 [pid 5213] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5215 [pid 5075] umount2("./13", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5077] newfstatat(AT_FDCWD, "./12/binderfs", [pid 5215] set_robust_list(0x55555d6c46a0, 24 [pid 5214] write(3, "1000", 4 [pid 5213] <... mprotect resumed>) = 0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5215] <... set_robust_list resumed>) = 0 [pid 5214] <... write resumed>) = 4 [pid 5213] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5077] unlink("./12/binderfs" [pid 5075] openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5214] close(3 [pid 5213] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5077] <... unlink resumed>) = 0 [pid 5075] <... openat resumed>) = 3 [pid 5215] chdir("./13" [pid 5214] <... close resumed>) = 0 [pid 5213] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5077] getdents64(3, [pid 5215] <... chdir resumed>) = 0 [pid 5214] symlink("/dev/binderfs", "./binderfs" [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5215] prctl(PR_SET_PDEATHSIG, SIGKILL./strace-static-x86_64: Process 5216 attached ) = 0 [pid 5214] <... symlink resumed>) = 0 [pid 5077] close(3 [pid 5075] newfstatat(3, "", [pid 5216] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5214] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5213] <... clone3 resumed> => {parent_tid=[5216]}, 88) = 5216 [pid 5077] <... close resumed>) = 0 [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5216] <... rseq resumed>) = 0 [pid 5215] setpgid(0, 0 [pid 5214] <... futex resumed>) = 0 [pid 5213] rt_sigprocmask(SIG_SETMASK, [], [pid 5077] rmdir("./12" [pid 5075] getdents64(3, [pid 5215] <... setpgid resumed>) = 0 [pid 5213] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5213] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5216] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5215] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5214] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5077] <... rmdir resumed>) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5213] <... futex resumed>) = 0 [pid 5215] <... openat resumed>) = 3 [pid 5214] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5214] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5213] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] umount2("./13/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5215] write(3, "1000", 4 [pid 5214] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5215] <... write resumed>) = 4 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5214] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5215] close(3 [pid 5216] <... set_robust_list resumed>) = 0 [pid 5215] <... close resumed>) = 0 [pid 5214] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5077] mkdir("./13", 0777 [pid 5075] newfstatat(AT_FDCWD, "./13/binderfs", [pid 5216] rt_sigprocmask(SIG_SETMASK, [], [pid 5215] symlink("/dev/binderfs", "./binderfs" [pid 5214] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5077] <... mkdir resumed>) = 0 [pid 5216] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 ./strace-static-x86_64: Process 5217 attached [pid 5216] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5215] <... symlink resumed>) = 0 [pid 5214] <... mprotect resumed>) = 0 [pid 5075] unlink("./13/binderfs" [pid 5217] set_robust_list(0x55555d6c46a0, 24 [pid 5216] <... bpf resumed>) = 3 [pid 5216] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5216] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5213] <... futex resumed>) = 0 [pid 5213] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5216] <... futex resumed>) = 0 [pid 5213] <... futex resumed>) = 1 [pid 5217] <... set_robust_list resumed>) = 0 [pid 5075] <... unlink resumed>) = 0 [pid 5216] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5213] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5217 [pid 5216] <... bpf resumed>) = 4 [pid 5214] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5216] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5217] chdir("./13" [pid 5215] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] getdents64(3, [pid 5217] <... chdir resumed>) = 0 [pid 5215] <... futex resumed>) = 0 [pid 5215] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5214] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5215] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5216] <... futex resumed>) = 1 [pid 5213] <... futex resumed>) = 0 [pid 5215] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5217] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5216] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5215] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5214] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5213] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] close(3 [pid 5217] <... prctl resumed>) = 0 [pid 5216] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5215] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5213] <... futex resumed>) = 0 [pid 5217] setpgid(0, 0 [pid 5216] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5213] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] <... close resumed>) = 0 ./strace-static-x86_64: Process 5218 attached [pid 5217] <... setpgid resumed>) = 0 [pid 5216] <... bpf resumed>) = 5 [pid 5215] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5075] rmdir("./13" [pid 5218] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053) = 0 [pid 5216] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5218] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5217] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5216] <... futex resumed>) = 1 [pid 5213] <... futex resumed>) = 0 [pid 5218] <... set_robust_list resumed>) = 0 [pid 5216] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5213] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5218] rt_sigprocmask(SIG_SETMASK, [], [pid 5216] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5213] <... futex resumed>) = 0 [pid 5218] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5216] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5215] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5213] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5218] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5216] <... bpf resumed>) = 6 [pid 5214] <... clone3 resumed> => {parent_tid=[5218]}, 88) = 5218 [pid 5075] <... rmdir resumed>) = 0 [pid 5217] <... openat resumed>) = 3 [pid 5216] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5215] <... mprotect resumed>) = 0 [pid 5214] rt_sigprocmask(SIG_SETMASK, [], [pid 5216] <... futex resumed>) = 1 [pid 5213] <... futex resumed>) = 0 [pid 5216] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5215] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5213] exit_group(0 [pid 5214] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5216] <... futex resumed>) = ? [pid 5214] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5213] <... exit_group resumed>) = ? [pid 5217] write(3, "1000", 4 [pid 5216] +++ exited with 0 +++ [pid 5215] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5214] <... futex resumed>) = 1 [pid 5213] +++ exited with 0 +++ [pid 5075] mkdir("./14", 0777 [pid 5217] <... write resumed>) = 4 [pid 5214] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5213, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5217] close(3 [pid 5215] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5218] <... futex resumed>) = 0 [pid 5218] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72./strace-static-x86_64: Process 5219 attached ) = 3 [pid 5217] <... close resumed>) = 0 [pid 5078] umount2("./14", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5219] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5218] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5217] symlink("/dev/binderfs", "./binderfs" [pid 5215] <... clone3 resumed> => {parent_tid=[5219]}, 88) = 5219 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] <... mkdir resumed>) = 0 [pid 5219] <... rseq resumed>) = 0 [pid 5218] <... futex resumed>) = 1 [pid 5214] <... futex resumed>) = 0 [pid 5219] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5218] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5217] <... symlink resumed>) = 0 [pid 5078] openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5219] <... set_robust_list resumed>) = 0 [pid 5219] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5219] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5215] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5215] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5217] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5214] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... openat resumed>) = 3 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5219] <... futex resumed>) = 0 [pid 5218] <... futex resumed>) = 0 [pid 5217] <... futex resumed>) = 0 [pid 5215] <... futex resumed>) = 1 [pid 5214] <... futex resumed>) = 1 [pid 5078] newfstatat(3, "", [pid 5219] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5218] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5217] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5215] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5214] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5220 attached [pid 5219] <... bpf resumed>) = 3 [pid 5218] <... bpf resumed>) = 4 [pid 5217] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5220] set_robust_list(0x55555d6c46a0, 24 [pid 5219] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5218] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5217] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5078] getdents64(3, [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5220 [pid 5220] <... set_robust_list resumed>) = 0 [pid 5219] <... futex resumed>) = 1 [pid 5215] <... futex resumed>) = 0 [pid 5220] chdir("./14" [pid 5217] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5215] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5219] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5220] <... chdir resumed>) = 0 [pid 5219] <... bpf resumed>) = 4 [pid 5218] <... futex resumed>) = 1 [pid 5217] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5215] <... futex resumed>) = 0 [pid 5214] <... futex resumed>) = 0 [pid 5078] umount2("./14/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5220] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5219] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5218] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5217] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5215] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5214] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5220] <... prctl resumed>) = 0 [pid 5219] <... futex resumed>) = 0 [pid 5218] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5217] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5215] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5214] <... futex resumed>) = 0 [pid 5078] newfstatat(AT_FDCWD, "./14/binderfs", [pid 5220] setpgid(0, 0 [pid 5219] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5218] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5217] <... mprotect resumed>) = 0 [pid 5215] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5214] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5220] <... setpgid resumed>) = 0 [pid 5219] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5218] <... bpf resumed>) = 5 [pid 5217] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5215] <... futex resumed>) = 0 [pid 5078] unlink("./14/binderfs" [pid 5219] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5215] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5220] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5218] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5217] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5078] <... unlink resumed>) = 0 [pid 5218] <... futex resumed>) = 1 [pid 5217] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5214] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5221 attached [pid 5220] <... openat resumed>) = 3 [pid 5219] <... bpf resumed>) = 5 [pid 5218] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5214] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] getdents64(3, [pid 5221] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5220] write(3, "1000", 4 [pid 5218] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5217] <... clone3 resumed> => {parent_tid=[5221]}, 88) = 5221 [pid 5214] <... futex resumed>) = 0 [pid 5220] <... write resumed>) = 4 [pid 5218] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5217] rt_sigprocmask(SIG_SETMASK, [], [pid 5214] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5221] <... rseq resumed>) = 0 [pid 5219] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5221] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5220] close(3 [pid 5218] <... bpf resumed>) = 6 [pid 5217] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5215] <... futex resumed>) = 0 [pid 5219] <... futex resumed>) = 1 [pid 5078] close(3 [pid 5221] <... set_robust_list resumed>) = 0 [pid 5220] <... close resumed>) = 0 [pid 5219] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5218] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5217] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5215] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... close resumed>) = 0 [pid 5221] rt_sigprocmask(SIG_SETMASK, [], [pid 5220] symlink("/dev/binderfs", "./binderfs" [pid 5214] <... futex resumed>) = 0 [pid 5221] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5219] <... bpf resumed>) = 6 [pid 5221] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5218] <... futex resumed>) = 1 [pid 5217] <... futex resumed>) = 0 [pid 5214] exit_group(0 [pid 5078] rmdir("./14" [pid 5221] <... bpf resumed>) = 3 [pid 5220] <... symlink resumed>) = 0 [pid 5219] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5217] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5215] <... futex resumed>) = 0 [pid 5214] <... exit_group resumed>) = ? [pid 5078] <... rmdir resumed>) = 0 [pid 5221] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5220] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5219] <... futex resumed>) = 0 [pid 5218] +++ exited with 0 +++ [pid 5217] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5215] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5221] <... futex resumed>) = 0 [pid 5220] <... futex resumed>) = 0 [pid 5219] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5215] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5221] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5220] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5215] exit_group(0 [pid 5220] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5217] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] mkdir("./15", 0777 [pid 5221] <... futex resumed>) = 0 [pid 5220] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5219] <... futex resumed>) = ? [pid 5217] <... futex resumed>) = 1 [pid 5215] <... exit_group resumed>) = ? [pid 5078] <... mkdir resumed>) = 0 [pid 5217] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5221] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5220] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5219] +++ exited with 0 +++ [pid 5215] +++ exited with 0 +++ [pid 5214] +++ exited with 0 +++ [pid 5221] <... bpf resumed>) = 4 ./strace-static-x86_64: Process 5222 attached [pid 5220] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5222] set_robust_list(0x55555d6c46a0, 24 [pid 5221] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5220] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5222 [pid 5222] <... set_robust_list resumed>) = 0 [pid 5221] <... futex resumed>) = 1 [pid 5220] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5217] <... futex resumed>) = 0 [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5215, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5214, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5222] chdir("./15" [pid 5221] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5217] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5220] <... mprotect resumed>) = 0 [pid 5076] umount2("./13", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] umount2("./13", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5222] <... chdir resumed>) = 0 [pid 5221] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5217] <... futex resumed>) = 0 [pid 5222] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5221] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5217] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5222] <... prctl resumed>) = 0 [pid 5220] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5222] setpgid(0, 0) = 0 [pid 5222] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5221] <... bpf resumed>) = 5 [pid 5220] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5076] openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5074] openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5221] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5220] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0}./strace-static-x86_64: Process 5223 attached [pid 5223] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5220] <... clone3 resumed> => {parent_tid=[5223]}, 88) = 5223 [pid 5223] <... rseq resumed>) = 0 [pid 5221] <... futex resumed>) = 1 [pid 5217] <... futex resumed>) = 0 [pid 5076] <... openat resumed>) = 3 [pid 5220] rt_sigprocmask(SIG_SETMASK, [], [pid 5074] <... openat resumed>) = 3 [pid 5223] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5217] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5220] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5223] <... set_robust_list resumed>) = 0 [pid 5221] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5220] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5217] <... futex resumed>) = 0 [pid 5076] newfstatat(3, "", [pid 5074] newfstatat(3, "", [pid 5223] rt_sigprocmask(SIG_SETMASK, [], [pid 5220] <... futex resumed>) = 0 [pid 5217] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5223] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5220] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5223] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5222] <... openat resumed>) = 3 [pid 5076] getdents64(3, [pid 5223] <... bpf resumed>) = 3 [pid 5221] <... bpf resumed>) = 6 [pid 5074] getdents64(3, [pid 5223] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5222] write(3, "1000", 4 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5223] <... futex resumed>) = 1 [pid 5221] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5223] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5222] <... write resumed>) = 4 [pid 5221] <... futex resumed>) = 1 [pid 5220] <... futex resumed>) = 0 [pid 5217] <... futex resumed>) = 0 [pid 5076] umount2("./13/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] umount2("./13/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5222] close(3 [pid 5221] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5220] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5217] exit_group(0 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5223] <... futex resumed>) = 0 [pid 5222] <... close resumed>) = 0 [pid 5221] <... futex resumed>) = ? [pid 5220] <... futex resumed>) = 1 [pid 5217] <... exit_group resumed>) = ? [pid 5074] newfstatat(AT_FDCWD, "./13/binderfs", [pid 5223] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5222] symlink("/dev/binderfs", "./binderfs" [pid 5221] +++ exited with 0 +++ [pid 5220] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] newfstatat(AT_FDCWD, "./13/binderfs", [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5223] <... bpf resumed>) = 4 [pid 5222] <... symlink resumed>) = 0 [pid 5217] +++ exited with 0 +++ [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] unlink("./13/binderfs" [pid 5223] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5222] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] unlink("./13/binderfs" [pid 5223] <... futex resumed>) = 1 [pid 5220] <... futex resumed>) = 0 [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5217, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5076] <... unlink resumed>) = 0 [pid 5074] <... unlink resumed>) = 0 [pid 5222] <... futex resumed>) = 0 [pid 5223] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5220] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] umount2("./13", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] getdents64(3, [pid 5074] getdents64(3, [pid 5222] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5220] <... futex resumed>) = 0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5223] <... bpf resumed>) = 5 [pid 5222] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5220] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5223] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5222] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5220] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5077] <... openat resumed>) = 3 [pid 5076] close(3 [pid 5223] <... futex resumed>) = 0 [pid 5222] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5220] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] newfstatat(3, "", [pid 5076] <... close resumed>) = 0 [pid 5074] close(3 [pid 5223] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5220] <... futex resumed>) = 0 [pid 5222] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5220] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5076] rmdir("./13" [pid 5074] <... close resumed>) = 0 [pid 5222] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5077] getdents64(3, [pid 5076] <... rmdir resumed>) = 0 [pid 5074] rmdir("./13" [pid 5222] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5074] <... rmdir resumed>) = 0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5076] mkdir("./14", 0777 [pid 5223] <... bpf resumed>) = 6 [pid 5222] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5077] umount2("./13/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5222] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5074] mkdir("./14", 0777 [pid 5223] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5222] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5223] <... futex resumed>) = 1 [pid 5220] <... futex resumed>) = 0 [pid 5223] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5222] <... clone3 resumed> => {parent_tid=[5224]}, 88) = 5224 [pid 5220] exit_group(0 [pid 5074] <... mkdir resumed>) = 0 [pid 5076] <... mkdir resumed>) = 0 [pid 5223] <... futex resumed>) = ? [pid 5222] rt_sigprocmask(SIG_SETMASK, [], [pid 5220] <... exit_group resumed>) = ? ./strace-static-x86_64: Process 5224 attached [pid 5223] +++ exited with 0 +++ [pid 5222] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] newfstatat(AT_FDCWD, "./13/binderfs", [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5222] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5225 attached ./strace-static-x86_64: Process 5226 attached [pid 5224] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5222] <... futex resumed>) = 0 [pid 5220] +++ exited with 0 +++ [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5222] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5226] set_robust_list(0x55555d6c46a0, 24) = 0 [pid 5225] set_robust_list(0x55555d6c46a0, 24 [pid 5226] chdir("./14" [pid 5225] <... set_robust_list resumed>) = 0 [pid 5224] <... rseq resumed>) = 0 [pid 5077] unlink("./13/binderfs" [pid 5226] <... chdir resumed>) = 0 [pid 5225] chdir("./14" [pid 5224] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5077] <... unlink resumed>) = 0 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5220, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5226 [pid 5226] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5225] <... chdir resumed>) = 0 [pid 5224] <... set_robust_list resumed>) = 0 [pid 5077] getdents64(3, [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5225 [pid 5075] umount2("./14", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5226] <... prctl resumed>) = 0 [pid 5225] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5224] rt_sigprocmask(SIG_SETMASK, [], [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5226] setpgid(0, 0 [pid 5225] <... prctl resumed>) = 0 [pid 5224] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] close(3 [pid 5075] openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5226] <... setpgid resumed>) = 0 [pid 5225] setpgid(0, 0 [pid 5224] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5077] <... close resumed>) = 0 [pid 5226] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5225] <... setpgid resumed>) = 0 [pid 5224] <... bpf resumed>) = 3 [pid 5077] rmdir("./13" [pid 5075] <... openat resumed>) = 3 [pid 5224] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] newfstatat(3, "", [pid 5226] <... openat resumed>) = 3 [pid 5225] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5224] <... futex resumed>) = 1 [pid 5222] <... futex resumed>) = 0 [pid 5077] <... rmdir resumed>) = 0 [pid 5226] write(3, "1000", 4 [pid 5225] <... openat resumed>) = 3 [pid 5224] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5222] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5226] <... write resumed>) = 4 [pid 5225] write(3, "1000", 4 [pid 5224] <... bpf resumed>) = 4 [pid 5222] <... futex resumed>) = 0 [pid 5077] mkdir("./14", 0777 [pid 5075] getdents64(3, [pid 5226] close(3 [pid 5225] <... write resumed>) = 4 [pid 5224] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5222] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5226] <... close resumed>) = 0 [pid 5225] close(3 [pid 5224] <... futex resumed>) = 0 [pid 5222] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5077] <... mkdir resumed>) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5226] symlink("/dev/binderfs", "./binderfs" [pid 5225] <... close resumed>) = 0 [pid 5224] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5222] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5226] <... symlink resumed>) = 0 [pid 5225] symlink("/dev/binderfs", "./binderfs" [pid 5224] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5222] <... futex resumed>) = 0 [pid 5075] umount2("./14/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5226] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5225] <... symlink resumed>) = 0 [pid 5224] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5222] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5226] <... futex resumed>) = 0 [pid 5225] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5224] <... bpf resumed>) = 5 ./strace-static-x86_64: Process 5227 attached [pid 5226] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5225] <... futex resumed>) = 0 [pid 5227] set_robust_list(0x55555d6c46a0, 24 [pid 5226] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5227] <... set_robust_list resumed>) = 0 [pid 5225] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5226] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5227] chdir("./14" [pid 5226] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5225] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5224] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] newfstatat(AT_FDCWD, "./14/binderfs", [pid 5227] <... chdir resumed>) = 0 [pid 5226] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5225] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5224] <... futex resumed>) = 1 [pid 5222] <... futex resumed>) = 0 [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5227 [pid 5227] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5226] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5225] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5222] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5227] <... prctl resumed>) = 0 [pid 5226] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5225] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5224] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5222] <... futex resumed>) = 0 [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5227] setpgid(0, 0 [pid 5226] <... mprotect resumed>) = 0 [pid 5225] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5224] <... bpf resumed>) = 6 [pid 5222] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5075] unlink("./14/binderfs" [pid 5227] <... setpgid resumed>) = 0 [pid 5226] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5225] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5224] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5222] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5227] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5224] <... futex resumed>) = 0 [pid 5075] <... unlink resumed>) = 0 [pid 5227] <... openat resumed>) = 3 [pid 5226] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5225] <... mprotect resumed>) = 0 [pid 5224] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5222] exit_group(0 [pid 5075] getdents64(3, [pid 5227] write(3, "1000", 4 [pid 5226] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5225] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5224] <... futex resumed>) = ? [pid 5222] <... exit_group resumed>) = ? [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 ./strace-static-x86_64: Process 5228 attached [pid 5227] <... write resumed>) = 4 [pid 5225] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5224] +++ exited with 0 +++ [pid 5228] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5227] close(3 [pid 5075] close(3 [pid 5228] <... rseq resumed>) = 0 [pid 5227] <... close resumed>) = 0 [pid 5226] <... clone3 resumed> => {parent_tid=[5228]}, 88) = 5228 [pid 5225] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5228] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5227] symlink("/dev/binderfs", "./binderfs" [pid 5226] rt_sigprocmask(SIG_SETMASK, [], [pid 5222] +++ exited with 0 +++ [pid 5075] <... close resumed>) = 0 ./strace-static-x86_64: Process 5229 attached [pid 5228] <... set_robust_list resumed>) = 0 [pid 5227] <... symlink resumed>) = 0 [pid 5226] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5222, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5075] rmdir("./14" [pid 5229] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5228] rt_sigprocmask(SIG_SETMASK, [], [pid 5227] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5226] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5225] <... clone3 resumed> => {parent_tid=[5229]}, 88) = 5229 [pid 5229] <... rseq resumed>) = 0 [pid 5228] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5227] <... futex resumed>) = 0 [pid 5226] <... futex resumed>) = 0 [pid 5225] rt_sigprocmask(SIG_SETMASK, [], [pid 5075] <... rmdir resumed>) = 0 [pid 5229] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5228] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5227] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5226] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5225] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] umount2("./15", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5229] <... set_robust_list resumed>) = 0 [pid 5228] <... bpf resumed>) = 3 [pid 5227] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5225] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] mkdir("./15", 0777 [pid 5229] rt_sigprocmask(SIG_SETMASK, [], [pid 5228] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5227] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5225] <... futex resumed>) = 0 [pid 5078] openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5229] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5228] <... futex resumed>) = 1 [pid 5227] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5226] <... futex resumed>) = 0 [pid 5225] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... openat resumed>) = 3 [pid 5075] <... mkdir resumed>) = 0 [pid 5229] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5228] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5227] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5226] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] newfstatat(3, "", [pid 5229] <... bpf resumed>) = 3 [pid 5228] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5227] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5226] <... futex resumed>) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5230 attached [pid 5229] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5228] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5227] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5226] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] getdents64(3, [pid 5230] set_robust_list(0x55555d6c46a0, 24 [pid 5229] <... futex resumed>) = 1 [pid 5228] <... bpf resumed>) = 4 [pid 5227] <... mprotect resumed>) = 0 [pid 5225] <... futex resumed>) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5230] <... set_robust_list resumed>) = 0 [pid 5229] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5228] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5230] chdir("./15" [pid 5228] <... futex resumed>) = 1 [pid 5226] <... futex resumed>) = 0 [pid 5225] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] umount2("./15/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5230] <... chdir resumed>) = 0 [pid 5229] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5228] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5227] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5226] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5225] <... futex resumed>) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5230] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5229] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5227] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5226] <... futex resumed>) = 0 [pid 5225] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] newfstatat(AT_FDCWD, "./15/binderfs", [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5230 [pid 5230] <... prctl resumed>) = 0 [pid 5229] <... bpf resumed>) = 4 [pid 5228] <... bpf resumed>) = 5 [pid 5227] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5226] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 ./strace-static-x86_64: Process 5231 attached [pid 5230] setpgid(0, 0 [pid 5229] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5228] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] unlink("./15/binderfs" [pid 5231] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5230] <... setpgid resumed>) = 0 [pid 5229] <... futex resumed>) = 1 [pid 5228] <... futex resumed>) = 1 [pid 5227] <... clone3 resumed> => {parent_tid=[5231]}, 88) = 5231 [pid 5226] <... futex resumed>) = 0 [pid 5225] <... futex resumed>) = 0 [pid 5078] <... unlink resumed>) = 0 [pid 5231] <... rseq resumed>) = 0 [pid 5230] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5229] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5228] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5227] rt_sigprocmask(SIG_SETMASK, [], [pid 5226] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5225] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] getdents64(3, [pid 5231] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5230] <... openat resumed>) = 3 [pid 5229] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5228] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5227] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5226] <... futex resumed>) = 0 [pid 5225] <... futex resumed>) = 0 [pid 5231] <... set_robust_list resumed>) = 0 [pid 5230] write(3, "1000", 4 [pid 5229] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5228] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5227] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5226] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5225] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5231] rt_sigprocmask(SIG_SETMASK, [], [pid 5230] <... write resumed>) = 4 [pid 5231] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] close(3 [pid 5231] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5229] <... bpf resumed>) = 5 [pid 5078] <... close resumed>) = 0 [pid 5231] <... bpf resumed>) = 3 [pid 5230] close(3 [pid 5229] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5228] <... bpf resumed>) = 6 [pid 5227] <... futex resumed>) = 0 [pid 5078] rmdir("./15" [pid 5231] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5230] <... close resumed>) = 0 [pid 5229] <... futex resumed>) = 1 [pid 5231] <... futex resumed>) = 0 [pid 5231] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5230] symlink("/dev/binderfs", "./binderfs" [pid 5229] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5228] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5227] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5225] <... futex resumed>) = 0 [pid 5230] <... symlink resumed>) = 0 [pid 5228] <... futex resumed>) = 1 [pid 5227] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5226] <... futex resumed>) = 0 [pid 5225] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... rmdir resumed>) = 0 [pid 5230] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5229] <... futex resumed>) = 0 [pid 5228] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5227] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5226] exit_group(0 [pid 5225] <... futex resumed>) = 1 [pid 5230] <... futex resumed>) = 0 [pid 5229] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5228] <... futex resumed>) = ? [pid 5227] <... futex resumed>) = 1 [pid 5226] <... exit_group resumed>) = ? [pid 5225] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5231] <... futex resumed>) = 0 [pid 5230] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5229] <... bpf resumed>) = 6 [pid 5228] +++ exited with 0 +++ [pid 5227] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] mkdir("./16", 0777 [pid 5231] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5230] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5229] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5230] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5229] <... futex resumed>) = 1 [pid 5225] <... futex resumed>) = 0 [pid 5230] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5225] exit_group(0 [pid 5230] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5225] <... exit_group resumed>) = ? [pid 5231] <... bpf resumed>) = 4 [pid 5078] <... mkdir resumed>) = 0 [pid 5231] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5230] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5231] <... futex resumed>) = 1 [pid 5230] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5227] <... futex resumed>) = 0 [pid 5231] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5230] <... mprotect resumed>) = 0 [pid 5231] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5227] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5231] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144) = 5 [pid 5230] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5227] <... futex resumed>) = 0 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5232 attached [pid 5231] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5230] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5227] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5232] set_robust_list(0x55555d6c46a0, 24 [pid 5231] <... futex resumed>) = 0 [pid 5230] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5227] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) ./strace-static-x86_64: Process 5233 attached [pid 5232] <... set_robust_list resumed>) = 0 [pid 5231] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5227] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5226] +++ exited with 0 +++ [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5232 [pid 5233] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5232] chdir("./16" [pid 5231] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5230] <... clone3 resumed> => {parent_tid=[5233]}, 88) = 5233 [pid 5229] +++ exited with 0 +++ [pid 5227] <... futex resumed>) = 0 [pid 5225] +++ exited with 0 +++ [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5226, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5233] <... rseq resumed>) = 0 [pid 5232] <... chdir resumed>) = 0 [pid 5231] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5230] rt_sigprocmask(SIG_SETMASK, [], [pid 5227] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5225, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5233] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5232] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5230] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5233] <... set_robust_list resumed>) = 0 [pid 5232] <... prctl resumed>) = 0 [pid 5230] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] umount2("./14", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5233] rt_sigprocmask(SIG_SETMASK, [], [pid 5232] setpgid(0, 0 [pid 5230] <... futex resumed>) = 0 [pid 5076] umount2("./14", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5233] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5232] <... setpgid resumed>) = 0 [pid 5230] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5233] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5232] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5076] openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5074] openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5233] <... bpf resumed>) = 3 [pid 5232] <... openat resumed>) = 3 [pid 5076] <... openat resumed>) = 3 [pid 5233] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5232] write(3, "1000", 4 [pid 5076] newfstatat(3, "", [pid 5074] <... openat resumed>) = 3 [pid 5233] <... futex resumed>) = 1 [pid 5232] <... write resumed>) = 4 [pid 5230] <... futex resumed>) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5074] newfstatat(3, "", [pid 5233] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5232] close(3 [pid 5230] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] getdents64(3, [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5233] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5232] <... close resumed>) = 0 [pid 5230] <... futex resumed>) = 0 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5074] getdents64(3, [pid 5233] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5232] symlink("/dev/binderfs", "./binderfs" [pid 5230] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5233] <... bpf resumed>) = 4 [pid 5232] <... symlink resumed>) = 0 [pid 5076] umount2("./14/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5233] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5232] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5233] <... futex resumed>) = 1 [pid 5232] <... futex resumed>) = 0 [pid 5230] <... futex resumed>) = 0 [pid 5076] newfstatat(AT_FDCWD, "./14/binderfs", [pid 5074] umount2("./14/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5233] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5232] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5230] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5233] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5232] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5231] <... bpf resumed>) = 6 [pid 5230] <... futex resumed>) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5233] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5232] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5231] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5230] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] unlink("./14/binderfs" [pid 5233] <... bpf resumed>) = 5 [pid 5232] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5231] <... futex resumed>) = 1 [pid 5227] <... futex resumed>) = 0 [pid 5076] <... unlink resumed>) = 0 [pid 5074] newfstatat(AT_FDCWD, "./14/binderfs", [pid 5233] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5232] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5231] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5227] exit_group(0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5233] <... futex resumed>) = 1 [pid 5232] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5231] <... futex resumed>) = ? [pid 5230] <... futex resumed>) = 0 [pid 5227] <... exit_group resumed>) = ? [pid 5076] getdents64(3, [pid 5233] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5232] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5231] +++ exited with 0 +++ [pid 5230] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5074] unlink("./14/binderfs" [pid 5233] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5232] <... mprotect resumed>) = 0 [pid 5230] <... futex resumed>) = 0 [pid 5076] close(3 [pid 5074] <... unlink resumed>) = 0 [pid 5233] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5232] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5230] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5076] <... close resumed>) = 0 [pid 5232] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5227] +++ exited with 0 +++ [pid 5076] rmdir("./14" [pid 5074] getdents64(3, [pid 5232] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5227, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5076] <... rmdir resumed>) = 0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 ./strace-static-x86_64: Process 5234 attached [pid 5077] restart_syscall(<... resuming interrupted clone ...> [pid 5234] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5232] <... clone3 resumed> => {parent_tid=[5234]}, 88) = 5234 [pid 5234] <... rseq resumed>) = 0 [pid 5232] rt_sigprocmask(SIG_SETMASK, [], [pid 5234] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5232] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5234] <... set_robust_list resumed>) = 0 [pid 5232] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... restart_syscall resumed>) = 0 [pid 5076] mkdir("./15", 0777 [pid 5074] close(3 [pid 5234] rt_sigprocmask(SIG_SETMASK, [], [pid 5232] <... futex resumed>) = 0 [pid 5076] <... mkdir resumed>) = 0 [pid 5074] <... close resumed>) = 0 [pid 5234] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5232] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5234] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5077] umount2("./14", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] rmdir("./14" [pid 5234] <... bpf resumed>) = 3 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] <... rmdir resumed>) = 0 [pid 5234] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5074] mkdir("./15", 0777 [pid 5077] newfstatat(3, "", ./strace-static-x86_64: Process 5235 attached [pid 5234] <... futex resumed>) = 1 [pid 5232] <... futex resumed>) = 0 [pid 5074] <... mkdir resumed>) = 0 [pid 5234] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5232] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5235 [pid 5234] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5232] <... futex resumed>) = 0 [pid 5234] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5232] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5235] set_robust_list(0x55555d6c46a0, 24 [pid 5234] <... bpf resumed>) = 4 [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5236 attached [pid 5235] <... set_robust_list resumed>) = 0 [pid 5234] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] getdents64(3, [pid 5236] set_robust_list(0x55555d6c46a0, 24 [pid 5234] <... futex resumed>) = 1 [pid 5232] <... futex resumed>) = 0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5236] <... set_robust_list resumed>) = 0 [pid 5235] chdir("./15" [pid 5234] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5233] <... bpf resumed>) = 6 [pid 5232] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] umount2("./14/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5236] chdir("./15" [pid 5235] <... chdir resumed>) = 0 [pid 5234] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5233] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5232] <... futex resumed>) = 0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5236 [pid 5236] <... chdir resumed>) = 0 [pid 5235] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5234] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5233] <... futex resumed>) = 1 [pid 5232] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5230] <... futex resumed>) = 0 [pid 5077] newfstatat(AT_FDCWD, "./14/binderfs", [pid 5236] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5235] <... prctl resumed>) = 0 [pid 5233] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5230] exit_group(0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5236] <... prctl resumed>) = 0 [pid 5235] setpgid(0, 0 [pid 5233] <... futex resumed>) = ? [pid 5234] <... bpf resumed>) = 5 [pid 5230] <... exit_group resumed>) = ? [pid 5077] unlink("./14/binderfs" [pid 5235] <... setpgid resumed>) = 0 [pid 5233] +++ exited with 0 +++ [pid 5077] <... unlink resumed>) = 0 [pid 5235] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5230] +++ exited with 0 +++ [pid 5236] setpgid(0, 0 [pid 5234] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] getdents64(3, [pid 5236] <... setpgid resumed>) = 0 [pid 5234] <... futex resumed>) = 1 [pid 5232] <... futex resumed>) = 0 [pid 5232] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5234] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5232] <... futex resumed>) = 0 [pid 5236] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5235] <... openat resumed>) = 3 [pid 5232] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5230, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5236] <... openat resumed>) = 3 [pid 5077] close(3 [pid 5075] restart_syscall(<... resuming interrupted clone ...> [pid 5236] write(3, "1000", 4 [pid 5235] write(3, "1000", 4 [pid 5077] <... close resumed>) = 0 [pid 5075] <... restart_syscall resumed>) = 0 [pid 5236] <... write resumed>) = 4 [pid 5235] <... write resumed>) = 4 [pid 5077] rmdir("./14" [pid 5236] close(3 [pid 5235] close(3 [pid 5236] <... close resumed>) = 0 [pid 5235] <... close resumed>) = 0 [pid 5236] symlink("/dev/binderfs", "./binderfs" [pid 5235] symlink("/dev/binderfs", "./binderfs" [pid 5236] <... symlink resumed>) = 0 [pid 5235] <... symlink resumed>) = 0 [pid 5075] umount2("./15", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5236] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... rmdir resumed>) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5235] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5236] <... futex resumed>) = 0 [pid 5236] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5235] <... futex resumed>) = 0 [pid 5077] mkdir("./15", 0777 [pid 5075] openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5236] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5235] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5236] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5236] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f3e2f5ed000 [pid 5077] <... mkdir resumed>) = 0 [pid 5236] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5235] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5075] <... openat resumed>) = 3 [pid 5235] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5075] newfstatat(3, "", [pid 5235] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5236] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5235] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5236] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5236] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0}./strace-static-x86_64: Process 5237 attached => {parent_tid=[5237]}, 88) = 5237 [pid 5235] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5075] getdents64(3, [pid 5237] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5236] rt_sigprocmask(SIG_SETMASK, [], [pid 5234] <... bpf resumed>) = 6 [pid 5236] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5236] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5234] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5236] <... futex resumed>) = 0 [pid 5234] <... futex resumed>) = 1 [pid 5232] <... futex resumed>) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 ./strace-static-x86_64: Process 5238 attached [pid 5237] <... rseq resumed>) = 0 [pid 5236] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5235] <... mprotect resumed>) = 0 [pid 5234] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5232] exit_group(0 [pid 5075] umount2("./15/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5237] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5234] <... futex resumed>) = ? [pid 5232] <... exit_group resumed>) = ? [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5238 [pid 5238] set_robust_list(0x55555d6c46a0, 24 [pid 5237] <... set_robust_list resumed>) = 0 [pid 5235] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5234] +++ exited with 0 +++ [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5238] <... set_robust_list resumed>) = 0 [pid 5237] rt_sigprocmask(SIG_SETMASK, [], [pid 5235] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5075] newfstatat(AT_FDCWD, "./15/binderfs", [pid 5238] chdir("./15" [pid 5237] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5235] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5232] +++ exited with 0 +++ ./strace-static-x86_64: Process 5239 attached [pid 5238] <... chdir resumed>) = 0 [pid 5237] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5239] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5238] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5232, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5075] unlink("./15/binderfs" [pid 5239] <... rseq resumed>) = 0 [pid 5238] <... prctl resumed>) = 0 [pid 5237] <... bpf resumed>) = 3 [pid 5235] <... clone3 resumed> => {parent_tid=[5239]}, 88) = 5239 [pid 5078] restart_syscall(<... resuming interrupted clone ...> [pid 5239] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5238] setpgid(0, 0 [pid 5237] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5235] rt_sigprocmask(SIG_SETMASK, [], [pid 5078] <... restart_syscall resumed>) = 0 [pid 5075] <... unlink resumed>) = 0 [pid 5239] <... set_robust_list resumed>) = 0 [pid 5238] <... setpgid resumed>) = 0 [pid 5237] <... futex resumed>) = 1 [pid 5236] <... futex resumed>) = 0 [pid 5235] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5239] rt_sigprocmask(SIG_SETMASK, [], [pid 5238] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5237] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5236] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5235] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] getdents64(3, [pid 5239] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5236] <... futex resumed>) = 0 [pid 5239] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5238] <... openat resumed>) = 3 [pid 5237] <... bpf resumed>) = 4 [pid 5236] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5235] <... futex resumed>) = 0 [pid 5078] umount2("./16", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5239] <... bpf resumed>) = 3 [pid 5238] write(3, "1000", 4 [pid 5237] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5235] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] close(3 [pid 5239] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5238] <... write resumed>) = 4 [pid 5237] <... futex resumed>) = 1 [pid 5236] <... futex resumed>) = 0 [pid 5235] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5078] openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5239] <... futex resumed>) = 0 [pid 5238] close(3 [pid 5237] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5236] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5235] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... openat resumed>) = 3 [pid 5075] <... close resumed>) = 0 [pid 5239] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5238] <... close resumed>) = 0 [pid 5237] <... bpf resumed>) = 5 [pid 5236] <... futex resumed>) = 0 [pid 5235] <... futex resumed>) = 0 [pid 5078] newfstatat(3, "", [pid 5075] rmdir("./15" [pid 5239] <... bpf resumed>) = 4 [pid 5238] symlink("/dev/binderfs", "./binderfs" [pid 5237] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5236] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5235] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5075] <... rmdir resumed>) = 0 [pid 5239] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5238] <... symlink resumed>) = 0 [pid 5237] <... futex resumed>) = 0 [pid 5236] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5235] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5078] getdents64(3, [pid 5239] <... futex resumed>) = 0 [pid 5238] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5237] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5236] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5235] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5239] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5238] <... futex resumed>) = 0 [pid 5237] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5236] <... futex resumed>) = 0 [pid 5235] <... futex resumed>) = 0 [pid 5078] umount2("./16/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] mkdir("./16", 0777 [pid 5238] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5237] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5236] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5235] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] <... mkdir resumed>) = 0 [pid 5239] <... bpf resumed>) = 5 [pid 5238] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5237] <... bpf resumed>) = 6 [pid 5239] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5238] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5237] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] newfstatat(AT_FDCWD, "./16/binderfs", [pid 5239] <... futex resumed>) = 1 [pid 5238] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5237] <... futex resumed>) = 1 [pid 5236] <... futex resumed>) = 0 [pid 5235] <... futex resumed>) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5240 attached [pid 5239] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5238] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5237] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5236] exit_group(0 [pid 5235] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] unlink("./16/binderfs" [pid 5240] set_robust_list(0x55555d6c46a0, 24 [pid 5239] <... bpf resumed>) = 6 [pid 5238] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5237] <... futex resumed>) = ? [pid 5236] <... exit_group resumed>) = ? [pid 5235] <... futex resumed>) = 0 [pid 5078] <... unlink resumed>) = 0 [pid 5237] +++ exited with 0 +++ [pid 5235] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5238] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5078] getdents64(3, 0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5238] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5078] close(3 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5240 [pid 5240] <... set_robust_list resumed>) = 0 [pid 5239] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... close resumed>) = 0 [pid 5238] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5078] rmdir("./16" [pid 5240] chdir("./16" [pid 5239] <... futex resumed>) = 1 [pid 5238] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5235] <... futex resumed>) = 0 [pid 5078] <... rmdir resumed>) = 0 ./strace-static-x86_64: Process 5241 attached [pid 5240] <... chdir resumed>) = 0 [pid 5239] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5235] exit_group(0 [pid 5241] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5240] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5239] <... futex resumed>) = ? [pid 5241] <... rseq resumed>) = 0 [pid 5240] <... prctl resumed>) = 0 [pid 5235] <... exit_group resumed>) = ? [pid 5239] +++ exited with 0 +++ [pid 5240] setpgid(0, 0 [pid 5238] <... clone3 resumed> => {parent_tid=[5241]}, 88) = 5241 [pid 5078] mkdir("./17", 0777 [pid 5241] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5240] <... setpgid resumed>) = 0 [pid 5238] rt_sigprocmask(SIG_SETMASK, [], [pid 5078] <... mkdir resumed>) = 0 [pid 5238] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5238] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5238] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5241] <... set_robust_list resumed>) = 0 [pid 5240] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5241] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5241] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 3 [pid 5240] <... openat resumed>) = 3 [pid 5241] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5240] write(3, "1000", 4 [pid 5241] <... futex resumed>) = 1 [pid 5240] <... write resumed>) = 4 [pid 5238] <... futex resumed>) = 0 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5242 ./strace-static-x86_64: Process 5242 attached [pid 5241] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5240] close(3 [pid 5238] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5242] set_robust_list(0x55555d6c46a0, 24 [pid 5241] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5240] <... close resumed>) = 0 [pid 5238] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5236] +++ exited with 0 +++ [pid 5235] +++ exited with 0 +++ [pid 5242] <... set_robust_list resumed>) = 0 [pid 5241] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5240] symlink("/dev/binderfs", "./binderfs" [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5236, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5242] chdir("./17" [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5235, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- [pid 5240] <... symlink resumed>) = 0 [pid 5076] restart_syscall(<... resuming interrupted clone ...> [pid 5242] <... chdir resumed>) = 0 [pid 5241] <... bpf resumed>) = 4 [pid 5076] <... restart_syscall resumed>) = 0 [pid 5242] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5241] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5240] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5242] <... prctl resumed>) = 0 [pid 5242] setpgid(0, 0 [pid 5241] <... futex resumed>) = 1 [pid 5240] <... futex resumed>) = 0 [pid 5238] <... futex resumed>) = 0 [pid 5242] <... setpgid resumed>) = 0 [pid 5241] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5240] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5238] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] umount2("./15", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5242] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5241] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5240] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5238] <... futex resumed>) = 0 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] umount2("./15", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5241] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5240] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5238] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5242] <... openat resumed>) = 3 [pid 5240] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5076] <... openat resumed>) = 3 [pid 5242] write(3, "1000", 4 [pid 5241] <... bpf resumed>) = 5 [pid 5240] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5076] newfstatat(3, "", [pid 5074] openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5242] <... write resumed>) = 4 [pid 5241] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5240] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5074] <... openat resumed>) = 3 [pid 5242] close(3 [pid 5241] <... futex resumed>) = 1 [pid 5240] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5238] <... futex resumed>) = 0 [pid 5074] newfstatat(3, "", [pid 5076] getdents64(3, [pid 5242] <... close resumed>) = 0 [pid 5241] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5240] <... mprotect resumed>) = 0 [pid 5238] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5242] symlink("/dev/binderfs", "./binderfs" [pid 5241] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5240] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5238] <... futex resumed>) = 0 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5242] <... symlink resumed>) = 0 [pid 5241] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5240] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5238] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5076] umount2("./15/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5242] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5241] <... bpf resumed>) = 6 [pid 5240] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] getdents64(3, ./strace-static-x86_64: Process 5243 attached [pid 5242] <... futex resumed>) = 0 [pid 5241] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] newfstatat(AT_FDCWD, "./15/binderfs", [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5243] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5242] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5241] <... futex resumed>) = 1 [pid 5240] <... clone3 resumed> => {parent_tid=[5243]}, 88) = 5243 [pid 5238] <... futex resumed>) = 0 [pid 5243] <... rseq resumed>) = 0 [pid 5242] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5241] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5240] rt_sigprocmask(SIG_SETMASK, [], [pid 5238] exit_group(0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] umount2("./15/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5243] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5242] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5241] <... futex resumed>) = ? [pid 5240] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5238] <... exit_group resumed>) = ? [pid 5076] unlink("./15/binderfs" [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5243] <... set_robust_list resumed>) = 0 [pid 5242] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5241] +++ exited with 0 +++ [pid 5240] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5238] +++ exited with 0 +++ [pid 5074] newfstatat(AT_FDCWD, "./15/binderfs", [pid 5243] rt_sigprocmask(SIG_SETMASK, [], [pid 5242] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5240] <... futex resumed>) = 0 [pid 5076] <... unlink resumed>) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5243] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5242] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5240] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5238, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5076] getdents64(3, [pid 5074] unlink("./15/binderfs" [pid 5243] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5242] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5243] <... bpf resumed>) = 3 [pid 5243] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5242] <... mprotect resumed>) = 0 [pid 5077] restart_syscall(<... resuming interrupted clone ...> [pid 5076] close(3 [pid 5074] <... unlink resumed>) = 0 [pid 5243] <... futex resumed>) = 1 [pid 5240] <... futex resumed>) = 0 [pid 5077] <... restart_syscall resumed>) = 0 [pid 5243] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5242] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5240] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... close resumed>) = 0 [pid 5074] getdents64(3, [pid 5243] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5242] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5240] <... futex resumed>) = 0 [pid 5076] rmdir("./15" [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5243] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5242] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5240] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5244 attached [pid 5243] <... bpf resumed>) = 4 [pid 5077] umount2("./15", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] <... rmdir resumed>) = 0 [pid 5074] close(3 [pid 5244] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5243] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5242] <... clone3 resumed> => {parent_tid=[5244]}, 88) = 5244 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] mkdir("./16", 0777 [pid 5074] <... close resumed>) = 0 [pid 5244] <... rseq resumed>) = 0 [pid 5243] <... futex resumed>) = 1 [pid 5242] rt_sigprocmask(SIG_SETMASK, [], [pid 5240] <... futex resumed>) = 0 [pid 5077] openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5074] rmdir("./15" [pid 5244] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5243] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5242] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5240] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... openat resumed>) = 3 [pid 5076] <... mkdir resumed>) = 0 [pid 5244] <... set_robust_list resumed>) = 0 [pid 5243] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5242] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5240] <... futex resumed>) = 0 [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5244] rt_sigprocmask(SIG_SETMASK, [], [pid 5243] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5242] <... futex resumed>) = 0 [pid 5240] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5245 attached [pid 5244] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5243] <... bpf resumed>) = 5 [pid 5242] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] newfstatat(3, "", [pid 5074] <... rmdir resumed>) = 0 [pid 5245] set_robust_list(0x55555d6c46a0, 24 [pid 5244] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5243] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5245 [pid 5245] <... set_robust_list resumed>) = 0 [pid 5244] <... bpf resumed>) = 3 [pid 5243] <... futex resumed>) = 1 [pid 5240] <... futex resumed>) = 0 [pid 5077] getdents64(3, [pid 5074] mkdir("./16", 0777 [pid 5245] chdir("./16" [pid 5244] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5243] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5240] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5074] <... mkdir resumed>) = 0 [pid 5245] <... chdir resumed>) = 0 [pid 5244] <... futex resumed>) = 1 [pid 5243] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5242] <... futex resumed>) = 0 [pid 5240] <... futex resumed>) = 0 [pid 5077] umount2("./15/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5245] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5244] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5243] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5242] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5240] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5245] <... prctl resumed>) = 0 [pid 5244] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5243] <... bpf resumed>) = 6 [pid 5242] <... futex resumed>) = 0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5245] setpgid(0, 0 [pid 5244] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5243] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5242] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] newfstatat(AT_FDCWD, "./15/binderfs", ./strace-static-x86_64: Process 5246 attached [pid 5245] <... setpgid resumed>) = 0 [pid 5244] <... bpf resumed>) = 4 [pid 5243] <... futex resumed>) = 1 [pid 5240] <... futex resumed>) = 0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5246] set_robust_list(0x55555d6c46a0, 24 [pid 5245] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5244] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5243] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5240] exit_group(0 [pid 5077] unlink("./15/binderfs" [pid 5246] <... set_robust_list resumed>) = 0 [pid 5245] <... openat resumed>) = 3 [pid 5244] <... futex resumed>) = 1 [pid 5243] <... futex resumed>) = ? [pid 5242] <... futex resumed>) = 0 [pid 5240] <... exit_group resumed>) = ? [pid 5077] <... unlink resumed>) = 0 [pid 5246] chdir("./16" [pid 5244] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5243] +++ exited with 0 +++ [pid 5242] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5245] write(3, "1000", 4 [pid 5077] getdents64(3, [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5246 [pid 5245] <... write resumed>) = 4 [pid 5245] close(3 [pid 5244] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5242] <... futex resumed>) = 0 [pid 5240] +++ exited with 0 +++ [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5246] <... chdir resumed>) = 0 [pid 5245] <... close resumed>) = 0 [pid 5244] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5242] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] close(3 [pid 5246] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5245] symlink("/dev/binderfs", "./binderfs" [pid 5077] <... close resumed>) = 0 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5240, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5246] <... prctl resumed>) = 0 [pid 5245] <... symlink resumed>) = 0 [pid 5244] <... bpf resumed>) = 5 [pid 5077] rmdir("./15" [pid 5075] restart_syscall(<... resuming interrupted clone ...> [pid 5246] setpgid(0, 0 [pid 5245] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5244] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... rmdir resumed>) = 0 [pid 5075] <... restart_syscall resumed>) = 0 [pid 5246] <... setpgid resumed>) = 0 [pid 5245] <... futex resumed>) = 0 [pid 5244] <... futex resumed>) = 1 [pid 5242] <... futex resumed>) = 0 [pid 5245] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5244] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5242] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5246] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5245] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5244] <... bpf resumed>) = 6 [pid 5242] <... futex resumed>) = 0 [pid 5077] mkdir("./16", 0777 [pid 5246] <... openat resumed>) = 3 [pid 5245] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5244] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5242] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] <... mkdir resumed>) = 0 [pid 5245] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] umount2("./16", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5245] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5245] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5244] <... futex resumed>) = 0 [pid 5242] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5244] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5245] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5246] write(3, "1000", 4 [pid 5242] exit_group(0 [pid 5075] openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5246] <... write resumed>) = 4 [pid 5245] <... mprotect resumed>) = 0 [pid 5244] <... futex resumed>) = ? [pid 5242] <... exit_group resumed>) = ? [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5075] <... openat resumed>) = 3 [pid 5246] close(3 [pid 5245] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5244] +++ exited with 0 +++ [pid 5075] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5075] getdents64(3, [pid 5245] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 ./strace-static-x86_64: Process 5247 attached [pid 5246] <... close resumed>) = 0 [pid 5245] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5247 [pid 5075] umount2("./16/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5248 attached [pid 5247] set_robust_list(0x55555d6c46a0, 24 [pid 5246] symlink("/dev/binderfs", "./binderfs" [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5248] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5247] <... set_robust_list resumed>) = 0 [pid 5245] <... clone3 resumed> => {parent_tid=[5248]}, 88) = 5248 [pid 5075] newfstatat(AT_FDCWD, "./16/binderfs", [pid 5247] chdir("./16" [pid 5245] rt_sigprocmask(SIG_SETMASK, [], [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5247] <... chdir resumed>) = 0 [pid 5245] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5248] <... rseq resumed>) = 0 [pid 5247] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5245] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] unlink("./16/binderfs" [pid 5248] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5247] <... prctl resumed>) = 0 [pid 5245] <... futex resumed>) = 0 [pid 5248] <... set_robust_list resumed>) = 0 [pid 5247] setpgid(0, 0 [pid 5246] <... symlink resumed>) = 0 [pid 5245] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] <... unlink resumed>) = 0 [pid 5248] rt_sigprocmask(SIG_SETMASK, [], [pid 5247] <... setpgid resumed>) = 0 [pid 5242] +++ exited with 0 +++ [pid 5248] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5247] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5246] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] getdents64(3, [pid 5248] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5246] <... futex resumed>) = 0 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5242, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5248] <... bpf resumed>) = 3 [pid 5247] <... openat resumed>) = 3 [pid 5246] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5078] restart_syscall(<... resuming interrupted clone ...> [pid 5075] close(3 [pid 5248] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5247] write(3, "1000", 4 [pid 5075] <... close resumed>) = 0 [pid 5248] <... futex resumed>) = 1 [pid 5247] <... write resumed>) = 4 [pid 5245] <... futex resumed>) = 0 [pid 5078] <... restart_syscall resumed>) = 0 [pid 5075] rmdir("./16" [pid 5248] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5247] close(3 [pid 5246] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5245] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... rmdir resumed>) = 0 [pid 5248] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5247] <... close resumed>) = 0 [pid 5246] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5245] <... futex resumed>) = 0 [pid 5248] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5246] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] umount2("./17", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5247] symlink("/dev/binderfs", "./binderfs" [pid 5245] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] mkdir("./17", 0777 [pid 5248] <... bpf resumed>) = 4 [pid 5247] <... symlink resumed>) = 0 [pid 5246] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] <... mkdir resumed>) = 0 [pid 5248] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5247] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5248] <... futex resumed>) = 1 [pid 5247] <... futex resumed>) = 0 [pid 5246] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5245] <... futex resumed>) = 0 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5078] <... openat resumed>) = 3 [pid 5248] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5247] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5246] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5245] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] newfstatat(3, "", [pid 5245] <... futex resumed>) = 0 [pid 5246] <... mprotect resumed>) = 0 [pid 5245] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5247] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5247] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], ./strace-static-x86_64: Process 5249 attached NULL, 8) = 0 [pid 5246] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5078] getdents64(3, [pid 5249] set_robust_list(0x55555d6c46a0, 24 [pid 5247] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5249 [pid 5249] <... set_robust_list resumed>) = 0 [pid 5247] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5249] chdir("./17" [pid 5247] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5248] <... bpf resumed>) = 5 [pid 5249] <... chdir resumed>) = 0 [pid 5247] <... mprotect resumed>) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5249] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5248] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5246] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5078] umount2("./17/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5246] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5250 attached [pid 5249] <... prctl resumed>) = 0 [pid 5248] <... futex resumed>) = 1 [pid 5247] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5245] <... futex resumed>) = 0 [pid 5078] newfstatat(AT_FDCWD, "./17/binderfs", [pid 5250] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5249] setpgid(0, 0 [pid 5248] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5247] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5246] <... clone3 resumed> => {parent_tid=[5250]}, 88) = 5250 [pid 5245] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5250] <... rseq resumed>) = 0 [pid 5249] <... setpgid resumed>) = 0 [pid 5248] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5247] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5246] rt_sigprocmask(SIG_SETMASK, [], [pid 5245] <... futex resumed>) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 ./strace-static-x86_64: Process 5251 attached [pid 5250] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5249] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5248] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5246] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5245] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] unlink("./17/binderfs" [pid 5251] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5250] <... set_robust_list resumed>) = 0 [pid 5249] <... openat resumed>) = 3 [pid 5248] <... bpf resumed>) = 6 [pid 5246] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5247] <... clone3 resumed> => {parent_tid=[5251]}, 88) = 5251 [pid 5078] <... unlink resumed>) = 0 [pid 5250] rt_sigprocmask(SIG_SETMASK, [], [pid 5251] <... rseq resumed>) = 0 [pid 5249] write(3, "1000", 4 [pid 5248] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5247] rt_sigprocmask(SIG_SETMASK, [], [pid 5246] <... futex resumed>) = 0 [pid 5251] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5250] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5249] <... write resumed>) = 4 [pid 5247] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5248] <... futex resumed>) = 1 [pid 5246] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5245] <... futex resumed>) = 0 [pid 5078] getdents64(3, [pid 5251] <... set_robust_list resumed>) = 0 [pid 5250] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5249] close(3 [pid 5248] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5247] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5245] exit_group(0 [pid 5251] rt_sigprocmask(SIG_SETMASK, [], [pid 5250] <... bpf resumed>) = 3 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5251] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5250] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] close(3 [pid 5251] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5250] <... futex resumed>) = 1 [pid 5249] <... close resumed>) = 0 [pid 5248] <... futex resumed>) = ? [pid 5247] <... futex resumed>) = 0 [pid 5246] <... futex resumed>) = 0 [pid 5245] <... exit_group resumed>) = ? [pid 5078] <... close resumed>) = 0 [pid 5251] <... bpf resumed>) = 3 [pid 5250] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5249] symlink("/dev/binderfs", "./binderfs" [pid 5248] +++ exited with 0 +++ [pid 5247] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5246] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5245] +++ exited with 0 +++ [pid 5078] rmdir("./17" [pid 5251] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5250] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5249] <... symlink resumed>) = 0 [pid 5247] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5246] <... futex resumed>) = 0 [pid 5249] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5247] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5249] <... futex resumed>) = 0 [pid 5247] <... futex resumed>) = 0 [pid 5249] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5247] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5249] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5249] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5249] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f3e2f5ed000 [pid 5249] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5251] <... futex resumed>) = 1 [pid 5250] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5247] <... futex resumed>) = 0 [pid 5246] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... rmdir resumed>) = 0 [pid 5251] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5250] <... bpf resumed>) = 4 [pid 5249] <... mprotect resumed>) = 0 [pid 5247] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=37000000} [pid 5078] mkdir("./18", 0777 [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5245, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5251] <... bpf resumed>) = 4 [pid 5250] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5249] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5251] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5250] <... futex resumed>) = 1 [pid 5246] <... futex resumed>) = 0 [pid 5251] <... futex resumed>) = 1 [pid 5250] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5246] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5249] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5078] <... mkdir resumed>) = 0 [pid 5076] restart_syscall(<... resuming interrupted clone ...> [pid 5251] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5250] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5249] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5247] <... futex resumed>) = 0 [pid 5246] <... futex resumed>) = 0 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5076] <... restart_syscall resumed>) = 0 [pid 5250] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5247] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5246] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5253 attached ./strace-static-x86_64: Process 5252 attached [pid 5251] <... futex resumed>) = 0 [pid 5250] <... bpf resumed>) = 5 [pid 5249] <... clone3 resumed> => {parent_tid=[5252]}, 88) = 5252 [pid 5247] <... futex resumed>) = 1 [pid 5253] set_robust_list(0x55555d6c46a0, 24 [pid 5252] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5251] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5250] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5249] rt_sigprocmask(SIG_SETMASK, [], [pid 5247] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5253 [pid 5253] <... set_robust_list resumed>) = 0 [pid 5252] <... rseq resumed>) = 0 [pid 5251] <... bpf resumed>) = 5 [pid 5250] <... futex resumed>) = 1 [pid 5249] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5246] <... futex resumed>) = 0 [pid 5076] umount2("./16", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5076] openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5249] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... openat resumed>) = 3 [pid 5249] <... futex resumed>) = 0 [pid 5076] newfstatat(3, "", [pid 5253] chdir("./18" [pid 5252] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5251] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5250] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5249] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5246] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5253] <... chdir resumed>) = 0 [pid 5252] <... set_robust_list resumed>) = 0 [pid 5251] <... futex resumed>) = 1 [pid 5250] <... bpf resumed>) = 6 [pid 5247] <... futex resumed>) = 0 [pid 5246] <... futex resumed>) = 0 [pid 5253] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5252] rt_sigprocmask(SIG_SETMASK, [], [pid 5251] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5250] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5247] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5246] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5076] getdents64(3, [pid 5253] <... prctl resumed>) = 0 [pid 5252] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5251] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5250] <... futex resumed>) = 0 [pid 5247] <... futex resumed>) = 0 [pid 5246] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5253] setpgid(0, 0 [pid 5252] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5251] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5250] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5247] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5246] exit_group(0 [pid 5253] <... setpgid resumed>) = 0 [pid 5252] <... bpf resumed>) = 3 [pid 5251] <... bpf resumed>) = 6 [pid 5076] umount2("./16/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5250] <... futex resumed>) = ? [pid 5246] <... exit_group resumed>) = ? [pid 5251] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5251] <... futex resumed>) = 1 [pid 5247] <... futex resumed>) = 0 [pid 5076] newfstatat(AT_FDCWD, "./16/binderfs", [pid 5251] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5247] exit_group(0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5251] <... futex resumed>) = ? [pid 5247] <... exit_group resumed>) = ? [pid 5253] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5252] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5251] +++ exited with 0 +++ [pid 5076] unlink("./16/binderfs" [pid 5253] <... openat resumed>) = 3 [pid 5252] <... futex resumed>) = 1 [pid 5249] <... futex resumed>) = 0 [pid 5076] <... unlink resumed>) = 0 [pid 5252] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5249] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5252] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5249] <... futex resumed>) = 0 [pid 5253] write(3, "1000", 4 [pid 5252] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5249] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] getdents64(3, [pid 5253] <... write resumed>) = 4 [pid 5252] <... bpf resumed>) = 4 [pid 5250] +++ exited with 0 +++ [pid 5246] +++ exited with 0 +++ [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5246, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5252] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] close(3 [pid 5252] <... futex resumed>) = 1 [pid 5249] <... futex resumed>) = 0 [pid 5252] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5249] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... close resumed>) = 0 [pid 5074] umount2("./16", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5253] close(3 [pid 5252] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5249] <... futex resumed>) = 0 [pid 5076] rmdir("./16" [pid 5253] <... close resumed>) = 0 [pid 5252] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5249] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5247] +++ exited with 0 +++ [pid 5076] <... rmdir resumed>) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5253] symlink("/dev/binderfs", "./binderfs" [pid 5074] openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5076] mkdir("./17", 0777 [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5247, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5076] <... mkdir resumed>) = 0 [pid 5074] <... openat resumed>) = 3 [pid 5252] <... bpf resumed>) = 5 [pid 5253] <... symlink resumed>) = 0 [pid 5252] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] newfstatat(3, "", [pid 5253] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5252] <... futex resumed>) = 1 [pid 5249] <... futex resumed>) = 0 [pid 5253] <... futex resumed>) = 0 [pid 5252] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5249] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5253] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5252] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5249] <... futex resumed>) = 0 [pid 5077] umount2("./16", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] getdents64(3, [pid 5253] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5252] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5249] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 ./strace-static-x86_64: Process 5254 attached [pid 5253] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5252] <... bpf resumed>) = 6 [pid 5077] openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5074] umount2("./16/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5254] set_robust_list(0x55555d6c46a0, 24 [pid 5253] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5252] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5254 [pid 5254] <... set_robust_list resumed>) = 0 [pid 5253] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5252] <... futex resumed>) = 1 [pid 5249] <... futex resumed>) = 0 [pid 5077] <... openat resumed>) = 3 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5253] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5252] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5074] newfstatat(AT_FDCWD, "./16/binderfs", [pid 5254] chdir("./17" [pid 5253] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5249] exit_group(0 [pid 5077] newfstatat(3, "", [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5254] <... chdir resumed>) = 0 [pid 5253] <... mprotect resumed>) = 0 [pid 5252] <... futex resumed>) = ? [pid 5249] <... exit_group resumed>) = ? [pid 5253] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5074] unlink("./16/binderfs" [pid 5252] +++ exited with 0 +++ [pid 5249] +++ exited with 0 +++ [pid 5074] <... unlink resumed>) = 0 [pid 5254] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5077] getdents64(3, [pid 5254] <... prctl resumed>) = 0 [pid 5253] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5249, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5074] getdents64(3, [pid 5254] setpgid(0, 0 [pid 5253] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5077] umount2("./16/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] umount2("./17", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5254] <... setpgid resumed>) = 0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5255 attached [pid 5077] newfstatat(AT_FDCWD, "./16/binderfs", [pid 5075] openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5255] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5254] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5253] <... clone3 resumed> => {parent_tid=[5255]}, 88) = 5255 [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5075] <... openat resumed>) = 3 [pid 5074] close(3 [pid 5255] <... rseq resumed>) = 0 [pid 5253] rt_sigprocmask(SIG_SETMASK, [], [pid 5074] <... close resumed>) = 0 [pid 5255] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5254] <... openat resumed>) = 3 [pid 5253] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] unlink("./16/binderfs" [pid 5075] newfstatat(3, "", [pid 5074] rmdir("./16" [pid 5255] <... set_robust_list resumed>) = 0 [pid 5255] rt_sigprocmask(SIG_SETMASK, [], [pid 5254] write(3, "1000", 4 [pid 5253] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... unlink resumed>) = 0 [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5074] <... rmdir resumed>) = 0 [pid 5255] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5254] <... write resumed>) = 4 [pid 5253] <... futex resumed>) = 0 [pid 5077] getdents64(3, [pid 5075] getdents64(3, [pid 5253] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5255] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5074] mkdir("./17", 0777 [pid 5255] <... bpf resumed>) = 3 [pid 5254] close(3 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5255] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5254] <... close resumed>) = 0 [pid 5077] close(3 [pid 5074] <... mkdir resumed>) = 0 [pid 5255] <... futex resumed>) = 1 [pid 5254] symlink("/dev/binderfs", "./binderfs" [pid 5253] <... futex resumed>) = 0 [pid 5077] <... close resumed>) = 0 [pid 5075] umount2("./17/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5255] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5253] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5255] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5254] <... symlink resumed>) = 0 [pid 5253] <... futex resumed>) = 0 [pid 5077] rmdir("./16" [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5256 attached [pid 5255] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5254] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5253] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... rmdir resumed>) = 0 [pid 5075] newfstatat(AT_FDCWD, "./17/binderfs", [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5256 [pid 5256] set_robust_list(0x55555d6c46a0, 24 [pid 5255] <... bpf resumed>) = 4 [pid 5254] <... futex resumed>) = 0 [pid 5077] mkdir("./17", 0777 [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5256] <... set_robust_list resumed>) = 0 [pid 5255] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5254] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5077] <... mkdir resumed>) = 0 [pid 5075] unlink("./17/binderfs" [pid 5256] chdir("./17" [pid 5255] <... futex resumed>) = 1 [pid 5254] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5253] <... futex resumed>) = 0 [pid 5256] <... chdir resumed>) = 0 [pid 5255] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5253] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5256] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5255] <... bpf resumed>) = 5 [pid 5254] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5253] <... futex resumed>) = 0 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5075] <... unlink resumed>) = 0 [pid 5256] <... prctl resumed>) = 0 [pid 5254] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5253] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5254] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5256] setpgid(0, 0 [pid 5254] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5075] getdents64(3, [pid 5256] <... setpgid resumed>) = 0 [pid 5256] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5255] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5254] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5255] <... futex resumed>) = 1 [pid 5256] <... openat resumed>) = 3 [pid 5255] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5253] <... futex resumed>) = 0 [pid 5075] close(3./strace-static-x86_64: Process 5257 attached [pid 5256] write(3, "1000", 4 [pid 5254] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5253] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... close resumed>) = 0 [pid 5257] set_robust_list(0x55555d6c46a0, 24 [pid 5256] <... write resumed>) = 4 [pid 5255] <... futex resumed>) = 0 [pid 5254] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5253] <... futex resumed>) = 1 [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5257 [pid 5075] rmdir("./17" [pid 5257] <... set_robust_list resumed>) = 0 [pid 5256] close(3 [pid 5255] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5254] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5253] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5257] chdir("./17" [pid 5256] <... close resumed>) = 0 [pid 5255] <... bpf resumed>) = 6 [pid 5256] symlink("/dev/binderfs", "./binderfs" [pid 5255] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5258 attached [pid 5257] <... chdir resumed>) = 0 [pid 5256] <... symlink resumed>) = 0 [pid 5255] <... futex resumed>) = 1 [pid 5254] <... clone3 resumed> => {parent_tid=[5258]}, 88) = 5258 [pid 5253] <... futex resumed>) = 0 [pid 5075] <... rmdir resumed>) = 0 [pid 5258] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5257] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5255] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5254] rt_sigprocmask(SIG_SETMASK, [], [pid 5253] exit_group(0 [pid 5258] <... rseq resumed>) = 0 [pid 5257] <... prctl resumed>) = 0 [pid 5256] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5255] <... futex resumed>) = ? [pid 5253] <... exit_group resumed>) = ? [pid 5258] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5257] setpgid(0, 0 [pid 5256] <... futex resumed>) = 0 [pid 5255] +++ exited with 0 +++ [pid 5254] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5253] +++ exited with 0 +++ [pid 5075] mkdir("./18", 0777 [pid 5258] <... set_robust_list resumed>) = 0 [pid 5257] <... setpgid resumed>) = 0 [pid 5256] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5254] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5256] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5253, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5258] rt_sigprocmask(SIG_SETMASK, [], [pid 5257] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5256] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5254] <... futex resumed>) = 0 [pid 5078] restart_syscall(<... resuming interrupted clone ...> [pid 5256] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] <... restart_syscall resumed>) = 0 [pid 5258] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5256] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5254] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] <... mkdir resumed>) = 0 [pid 5258] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5256] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5256] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5078] umount2("./18", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5258] <... bpf resumed>) = 3 [pid 5257] <... openat resumed>) = 3 [pid 5256] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5258] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5257] write(3, "1000", 4 [pid 5258] <... futex resumed>) = 1 ./strace-static-x86_64: Process 5259 attached [pid 5258] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5257] <... write resumed>) = 4 [pid 5254] <... futex resumed>) = 0 [pid 5078] openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5257] close(3 [pid 5256] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5254] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... openat resumed>) = 3 [pid 5259] set_robust_list(0x55555d6c46a0, 24 [pid 5257] <... close resumed>) = 0 [pid 5258] <... futex resumed>) = 0 [pid 5259] <... set_robust_list resumed>) = 0 [pid 5257] symlink("/dev/binderfs", "./binderfs" [pid 5258] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5254] <... futex resumed>) = 1 [pid 5257] <... symlink resumed>) = 0 [pid 5256] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5078] newfstatat(3, "", ./strace-static-x86_64: Process 5260 attached [pid 5258] <... bpf resumed>) = 4 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5259 [pid 5260] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5256] <... clone3 resumed> => {parent_tid=[5260]}, 88) = 5260 [pid 5078] getdents64(3, [pid 5260] <... rseq resumed>) = 0 [pid 5259] chdir("./18" [pid 5258] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5257] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5256] rt_sigprocmask(SIG_SETMASK, [], [pid 5254] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5260] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5257] <... futex resumed>) = 0 [pid 5256] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5254] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5078] umount2("./18/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5260] <... set_robust_list resumed>) = 0 [pid 5259] <... chdir resumed>) = 0 [pid 5258] <... futex resumed>) = 0 [pid 5257] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5256] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5254] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5260] rt_sigprocmask(SIG_SETMASK, [], [pid 5259] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5258] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5257] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5256] <... futex resumed>) = 0 [pid 5254] <... futex resumed>) = 0 [pid 5078] newfstatat(AT_FDCWD, "./18/binderfs", [pid 5260] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5259] <... prctl resumed>) = 0 [pid 5257] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5256] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5254] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5260] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5257] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] unlink("./18/binderfs" [pid 5260] <... bpf resumed>) = 3 [pid 5259] setpgid(0, 0 [pid 5258] <... bpf resumed>) = 5 [pid 5257] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5078] <... unlink resumed>) = 0 [pid 5260] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5259] <... setpgid resumed>) = 0 [pid 5078] getdents64(3, [pid 5260] <... futex resumed>) = 1 [pid 5258] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5259] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5257] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5256] <... futex resumed>) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5260] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5257] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5256] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5254] <... futex resumed>) = 0 [pid 5078] close(3 [pid 5260] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5258] <... futex resumed>) = 1 [pid 5256] <... futex resumed>) = 0 [pid 5254] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5260] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5257] <... mprotect resumed>) = 0 [pid 5256] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5254] <... futex resumed>) = 0 [pid 5078] <... close resumed>) = 0 [pid 5260] <... bpf resumed>) = 4 [pid 5259] <... openat resumed>) = 3 [pid 5258] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5254] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] rmdir("./18" [pid 5257] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5260] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5259] write(3, "1000", 4 [pid 5258] <... bpf resumed>) = 6 [pid 5078] <... rmdir resumed>) = 0 [pid 5260] <... futex resumed>) = 1 [pid 5257] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5256] <... futex resumed>) = 0 [pid 5260] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5256] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5259] <... write resumed>) = 4 [pid 5260] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5258] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5257] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5256] <... futex resumed>) = 0 [pid 5259] close(3 [pid 5260] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5258] <... futex resumed>) = 1 [pid 5256] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5254] <... futex resumed>) = 0 [pid 5078] mkdir("./19", 0777./strace-static-x86_64: Process 5261 attached [pid 5260] <... bpf resumed>) = 5 [pid 5259] <... close resumed>) = 0 [pid 5258] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5254] exit_group(0 [pid 5078] <... mkdir resumed>) = 0 [pid 5261] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5259] symlink("/dev/binderfs", "./binderfs" [pid 5258] <... futex resumed>) = ? [pid 5257] <... clone3 resumed> => {parent_tid=[5261]}, 88) = 5261 [pid 5254] <... exit_group resumed>) = ? [pid 5261] <... rseq resumed>) = 0 [pid 5260] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5258] +++ exited with 0 +++ [pid 5257] rt_sigprocmask(SIG_SETMASK, [], [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5261] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5260] <... futex resumed>) = 1 [pid 5256] <... futex resumed>) = 0 [pid 5254] +++ exited with 0 +++ [pid 5261] <... set_robust_list resumed>) = 0 [pid 5260] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5259] <... symlink resumed>) = 0 [pid 5257] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5256] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5254, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5259] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5257] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5259] <... futex resumed>) = 0 [pid 5257] <... futex resumed>) = 0 [pid 5259] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5257] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5259] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5261] rt_sigprocmask(SIG_SETMASK, [], [pid 5259] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5256] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5262 attached [pid 5261] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5259] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5256] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5262] set_robust_list(0x55555d6c46a0, 24 [pid 5261] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5259] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5262 [pid 5262] <... set_robust_list resumed>) = 0 [pid 5261] <... bpf resumed>) = 3 [pid 5259] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5262] chdir("./19" [pid 5261] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5259] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5262] <... chdir resumed>) = 0 [pid 5261] <... futex resumed>) = 1 [pid 5259] <... mprotect resumed>) = 0 [pid 5257] <... futex resumed>) = 0 [pid 5076] umount2("./17", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5262] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5261] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5262] <... prctl resumed>) = 0 [pid 5261] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5259] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5257] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5262] setpgid(0, 0 [pid 5261] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5259] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5257] <... futex resumed>) = 0 [pid 5076] openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5262] <... setpgid resumed>) = 0 [pid 5259] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5257] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5263 attached [pid 5262] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5261] <... bpf resumed>) = 4 [pid 5076] <... openat resumed>) = 3 [pid 5263] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5260] <... bpf resumed>) = 6 [pid 5076] newfstatat(3, "", [pid 5260] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5261] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5260] <... futex resumed>) = 1 [pid 5256] <... futex resumed>) = 0 [pid 5261] <... futex resumed>) = 1 [pid 5257] <... futex resumed>) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5263] <... rseq resumed>) = 0 [pid 5262] <... openat resumed>) = 3 [pid 5261] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5260] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5259] <... clone3 resumed> => {parent_tid=[5263]}, 88) = 5263 [pid 5257] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5256] exit_group(0 [pid 5076] getdents64(3, [pid 5261] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5260] <... futex resumed>) = ? [pid 5257] <... futex resumed>) = 0 [pid 5256] <... exit_group resumed>) = ? [pid 5260] +++ exited with 0 +++ [pid 5263] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5262] write(3, "1000", 4 [pid 5259] rt_sigprocmask(SIG_SETMASK, [], [pid 5263] <... set_robust_list resumed>) = 0 [pid 5262] <... write resumed>) = 4 [pid 5259] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5263] rt_sigprocmask(SIG_SETMASK, [], [pid 5262] close(3 [pid 5259] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5263] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5262] <... close resumed>) = 0 [pid 5259] <... futex resumed>) = 0 [pid 5263] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5262] symlink("/dev/binderfs", "./binderfs" [pid 5259] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5263] <... bpf resumed>) = 3 [pid 5261] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5257] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5256] +++ exited with 0 +++ [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5263] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5262] <... symlink resumed>) = 0 [pid 5263] <... futex resumed>) = 1 [pid 5262] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5259] <... futex resumed>) = 0 [pid 5076] umount2("./17/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5256, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5259] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5263] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5262] <... futex resumed>) = 0 [pid 5259] <... futex resumed>) = 0 [pid 5076] newfstatat(AT_FDCWD, "./17/binderfs", [pid 5263] <... bpf resumed>) = 4 [pid 5262] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5261] <... bpf resumed>) = 5 [pid 5259] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5263] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5262] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5261] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5259] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5263] <... futex resumed>) = 0 [pid 5262] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5259] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5257] <... futex resumed>) = 0 [pid 5263] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5262] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5261] <... futex resumed>) = 1 [pid 5259] <... futex resumed>) = 0 [pid 5257] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] unlink("./17/binderfs" [pid 5261] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5257] <... futex resumed>) = 0 [pid 5263] <... bpf resumed>) = 5 [pid 5262] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5261] <... bpf resumed>) = 6 [pid 5259] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5257] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5076] <... unlink resumed>) = 0 [pid 5263] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5262] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5261] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5259] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5263] <... futex resumed>) = 0 [pid 5262] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5259] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5263] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16) = 6 [pid 5262] <... mprotect resumed>) = 0 [pid 5261] <... futex resumed>) = 1 [pid 5259] <... futex resumed>) = 0 [pid 5257] <... futex resumed>) = 0 [pid 5076] getdents64(3, [pid 5074] umount2("./17", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5263] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5262] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5261] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5259] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5257] exit_group(0 [pid 5263] <... futex resumed>) = 0 [pid 5262] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5259] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5263] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5262] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5259] exit_group(0./strace-static-x86_64: Process 5264 attached [pid 5263] <... futex resumed>) = ? [pid 5261] <... futex resumed>) = ? [pid 5259] <... exit_group resumed>) = ? [pid 5257] <... exit_group resumed>) = ? [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5264] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5263] +++ exited with 0 +++ [pid 5262] <... clone3 resumed> => {parent_tid=[5264]}, 88) = 5264 [pid 5261] +++ exited with 0 +++ [pid 5259] +++ exited with 0 +++ [pid 5264] <... rseq resumed>) = 0 [pid 5262] rt_sigprocmask(SIG_SETMASK, [], [pid 5264] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5262] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5264] <... set_robust_list resumed>) = 0 [pid 5262] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5264] rt_sigprocmask(SIG_SETMASK, [], [pid 5262] <... futex resumed>) = 0 [pid 5264] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5262] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5264] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5076] close(3 [pid 5074] openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5264] <... bpf resumed>) = 3 [pid 5257] +++ exited with 0 +++ [pid 5076] <... close resumed>) = 0 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5259, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5074] <... openat resumed>) = 3 [pid 5264] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] rmdir("./17" [pid 5075] umount2("./18", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] newfstatat(3, "", [pid 5264] <... futex resumed>) = 1 [pid 5262] <... futex resumed>) = 0 [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5257, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- [pid 5076] <... rmdir resumed>) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5264] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5262] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] restart_syscall(<... resuming interrupted clone ...> [pid 5076] mkdir("./18", 0777 [pid 5075] openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5074] getdents64(3, [pid 5264] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5262] <... futex resumed>) = 0 [pid 5077] <... restart_syscall resumed>) = 0 [pid 5262] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5264] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 4 [pid 5075] <... openat resumed>) = 3 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5264] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5262] <... futex resumed>) = 0 [pid 5077] umount2("./17", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5264] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5262] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... mkdir resumed>) = 0 [pid 5074] umount2("./17/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5075] newfstatat(3, "", [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5077] openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5074] newfstatat(AT_FDCWD, "./17/binderfs", [pid 5262] <... futex resumed>) = 0 [pid 5077] <... openat resumed>) = 3 [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5077] newfstatat(3, "", [pid 5264] <... bpf resumed>) = 5 ./strace-static-x86_64: Process 5265 attached [pid 5264] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5262] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5074] unlink("./17/binderfs" [pid 5265] set_robust_list(0x55555d6c46a0, 24 [pid 5264] <... futex resumed>) = 0 [pid 5262] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5077] getdents64(3, [pid 5074] <... unlink resumed>) = 0 [pid 5265] <... set_robust_list resumed>) = 0 [pid 5264] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5262] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5265 [pid 5075] getdents64(3, [pid 5265] chdir("./18" [pid 5264] <... bpf resumed>) = 6 [pid 5262] <... futex resumed>) = 0 [pid 5077] umount2("./17/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5074] getdents64(3, [pid 5265] <... chdir resumed>) = 0 [pid 5264] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5262] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] umount2("./18/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5265] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5264] <... futex resumed>) = 0 [pid 5262] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5077] newfstatat(AT_FDCWD, "./17/binderfs", [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] close(3 [pid 5265] <... prctl resumed>) = 0 [pid 5264] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5262] exit_group(0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5075] newfstatat(AT_FDCWD, "./18/binderfs", [pid 5074] <... close resumed>) = 0 [pid 5265] setpgid(0, 0 [pid 5264] <... futex resumed>) = ? [pid 5262] <... exit_group resumed>) = ? [pid 5077] unlink("./17/binderfs" [pid 5265] <... setpgid resumed>) = 0 [pid 5264] +++ exited with 0 +++ [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] rmdir("./17" [pid 5077] <... unlink resumed>) = 0 [pid 5075] unlink("./18/binderfs" [pid 5074] <... rmdir resumed>) = 0 [pid 5265] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5262] +++ exited with 0 +++ [pid 5077] getdents64(3, [pid 5075] <... unlink resumed>) = 0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5265] <... openat resumed>) = 3 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5262, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5077] close(3 [pid 5265] write(3, "1000", 4 [pid 5074] mkdir("./18", 0777 [pid 5265] <... write resumed>) = 4 [pid 5077] <... close resumed>) = 0 [pid 5074] <... mkdir resumed>) = 0 [pid 5265] close(3 [pid 5077] rmdir("./17" [pid 5265] <... close resumed>) = 0 [pid 5078] umount2("./19", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5077] <... rmdir resumed>) = 0 [pid 5075] getdents64(3, [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5078] openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5075] close(3 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5265] symlink("/dev/binderfs", "./binderfs" [pid 5078] <... openat resumed>) = 3 [pid 5077] mkdir("./18", 0777 [pid 5075] <... close resumed>) = 0 ./strace-static-x86_64: Process 5266 attached [pid 5265] <... symlink resumed>) = 0 [pid 5078] newfstatat(3, "", [pid 5077] <... mkdir resumed>) = 0 [pid 5075] rmdir("./18" [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5266] set_robust_list(0x55555d6c46a0, 24 [pid 5265] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] getdents64(3, [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5075] <... rmdir resumed>) = 0 [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5266 ./strace-static-x86_64: Process 5267 attached [pid 5266] <... set_robust_list resumed>) = 0 [pid 5265] <... futex resumed>) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5267] set_robust_list(0x55555d6c46a0, 24 [pid 5265] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5078] umount2("./19/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] mkdir("./19", 0777 [pid 5267] <... set_robust_list resumed>) = 0 [pid 5266] chdir("./18" [pid 5265] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5265] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5267 [pid 5075] <... mkdir resumed>) = 0 [pid 5267] chdir("./18" [pid 5266] <... chdir resumed>) = 0 [pid 5265] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] newfstatat(AT_FDCWD, "./19/binderfs", [pid 5266] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5267] <... chdir resumed>) = 0 [pid 5266] <... prctl resumed>) = 0 [pid 5265] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5267] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5266] setpgid(0, 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5267] <... prctl resumed>) = 0 [pid 5265] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5078] unlink("./19/binderfs" [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5267] setpgid(0, 0 [pid 5266] <... setpgid resumed>) = 0 [pid 5265] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5078] <... unlink resumed>) = 0 [pid 5267] <... setpgid resumed>) = 0 [pid 5266] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5265] <... mprotect resumed>) = 0 [pid 5078] getdents64(3, [pid 5267] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5078] close(3 [pid 5267] <... openat resumed>) = 3 [pid 5078] <... close resumed>) = 0 ./strace-static-x86_64: Process 5268 attached [pid 5267] write(3, "1000", 4 [pid 5078] rmdir("./19" [pid 5267] <... write resumed>) = 4 [pid 5266] <... openat resumed>) = 3 [pid 5265] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5268] set_robust_list(0x55555d6c46a0, 24 [pid 5267] close(3 [pid 5266] write(3, "1000", 4 [pid 5265] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5078] <... rmdir resumed>) = 0 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5268 [pid 5268] <... set_robust_list resumed>) = 0 [pid 5267] <... close resumed>) = 0 [pid 5266] <... write resumed>) = 4 [pid 5078] mkdir("./20", 0777 [pid 5268] chdir("./19" [pid 5267] symlink("/dev/binderfs", "./binderfs" [pid 5266] close(3 [pid 5265] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5078] <... mkdir resumed>) = 0 [pid 5268] <... chdir resumed>) = 0 [pid 5268] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5268] setpgid(0, 0 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5269 attached ./strace-static-x86_64: Process 5270 attached [pid 5268] <... setpgid resumed>) = 0 [pid 5267] <... symlink resumed>) = 0 [pid 5266] <... close resumed>) = 0 [pid 5265] <... clone3 resumed> => {parent_tid=[5269]}, 88) = 5269 [pid 5269] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5268] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5270] set_robust_list(0x55555d6c46a0, 24 [pid 5269] <... rseq resumed>) = 0 [pid 5266] symlink("/dev/binderfs", "./binderfs" [pid 5265] rt_sigprocmask(SIG_SETMASK, [], [pid 5270] <... set_robust_list resumed>) = 0 [pid 5269] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5268] <... openat resumed>) = 3 [pid 5266] <... symlink resumed>) = 0 [pid 5265] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5268] write(3, "1000", 4 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5270 [pid 5270] chdir("./20") = 0 [pid 5269] <... set_robust_list resumed>) = 0 [pid 5268] <... write resumed>) = 4 [pid 5267] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5266] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5265] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5270] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5269] rt_sigprocmask(SIG_SETMASK, [], [pid 5268] close(3 [pid 5267] <... futex resumed>) = 0 [pid 5266] <... futex resumed>) = 0 [pid 5265] <... futex resumed>) = 0 [pid 5270] <... prctl resumed>) = 0 [pid 5269] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5268] <... close resumed>) = 0 [pid 5267] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5266] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5265] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5270] setpgid(0, 0 [pid 5269] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5268] symlink("/dev/binderfs", "./binderfs" [pid 5267] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5266] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5270] <... setpgid resumed>) = 0 [pid 5269] <... bpf resumed>) = 3 [pid 5268] <... symlink resumed>) = 0 [pid 5267] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5266] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5267] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5266] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5268] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5267] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5266] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5268] <... futex resumed>) = 0 [pid 5268] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5266] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5268] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5268] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5270] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5269] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5268] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5267] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5266] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5269] <... futex resumed>) = 1 [pid 5268] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5267] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5266] <... mprotect resumed>) = 0 [pid 5265] <... futex resumed>) = 0 [pid 5270] <... openat resumed>) = 3 [pid 5269] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5268] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5265] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5268] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5266] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5265] <... futex resumed>) = 0 [pid 5270] write(3, "1000", 4 [pid 5269] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5268] <... mprotect resumed>) = 0 [pid 5267] <... mprotect resumed>) = 0 [pid 5266] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5265] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5270] <... write resumed>) = 4 [pid 5269] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5268] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5267] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5266] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5270] close(3 [pid 5269] <... bpf resumed>) = 4 ./strace-static-x86_64: Process 5271 attached [pid 5270] <... close resumed>) = 0 [pid 5269] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5268] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5267] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5271] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5270] symlink("/dev/binderfs", "./binderfs" [pid 5269] <... futex resumed>) = 1 [pid 5268] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5267] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5266] <... clone3 resumed> => {parent_tid=[5271]}, 88) = 5271 [pid 5265] <... futex resumed>) = 0 [pid 5271] <... rseq resumed>) = 0 [pid 5270] <... symlink resumed>) = 0 [pid 5269] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5266] rt_sigprocmask(SIG_SETMASK, [], [pid 5265] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5272 attached [pid 5271] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5265] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5273 attached [pid 5272] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5271] <... set_robust_list resumed>) = 0 [pid 5270] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5269] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5266] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5265] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5268] <... clone3 resumed> => {parent_tid=[5272]}, 88) = 5272 [pid 5273] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5272] <... rseq resumed>) = 0 [pid 5271] rt_sigprocmask(SIG_SETMASK, [], [pid 5270] <... futex resumed>) = 0 [pid 5269] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5268] rt_sigprocmask(SIG_SETMASK, [], [pid 5267] <... clone3 resumed> => {parent_tid=[5273]}, 88) = 5273 [pid 5266] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5273] <... rseq resumed>) = 0 [pid 5272] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5271] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5270] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5268] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5267] rt_sigprocmask(SIG_SETMASK, [], [pid 5266] <... futex resumed>) = 0 [pid 5273] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5272] <... set_robust_list resumed>) = 0 [pid 5271] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5270] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5269] <... bpf resumed>) = 5 [pid 5268] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5267] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5266] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5273] <... set_robust_list resumed>) = 0 [pid 5272] rt_sigprocmask(SIG_SETMASK, [], [pid 5271] <... bpf resumed>) = 3 [pid 5268] <... futex resumed>) = 0 [pid 5272] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5271] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5268] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5273] rt_sigprocmask(SIG_SETMASK, [], [pid 5272] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5271] <... futex resumed>) = 0 [pid 5270] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5267] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5273] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5269] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5266] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5270] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5267] <... futex resumed>) = 0 [pid 5272] <... bpf resumed>) = 3 [pid 5271] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5270] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5269] <... futex resumed>) = 1 [pid 5267] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5266] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5265] <... futex resumed>) = 0 [pid 5273] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5272] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5271] <... bpf resumed>) = 4 [pid 5270] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5269] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5266] <... futex resumed>) = 0 [pid 5265] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5273] <... bpf resumed>) = 3 [pid 5273] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5272] <... futex resumed>) = 1 [pid 5271] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5269] <... bpf resumed>) = 6 [pid 5268] <... futex resumed>) = 0 [pid 5266] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5265] <... futex resumed>) = 0 [pid 5273] <... futex resumed>) = 1 [pid 5272] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5271] <... futex resumed>) = 0 [pid 5270] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5268] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5267] <... futex resumed>) = 0 [pid 5266] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5269] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5265] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5273] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5272] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5271] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5268] <... futex resumed>) = 0 [pid 5267] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5266] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5265] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5273] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5272] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5271] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5270] <... mprotect resumed>) = 0 [pid 5269] <... futex resumed>) = 0 [pid 5268] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5267] <... futex resumed>) = 0 [pid 5266] <... futex resumed>) = 0 [pid 5265] exit_group(0 [pid 5273] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5272] <... bpf resumed>) = 4 [pid 5271] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5270] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5267] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5266] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5265] <... exit_group resumed>) = ? [pid 5273] <... bpf resumed>) = 4 [pid 5272] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5271] <... bpf resumed>) = 5 [pid 5270] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5269] +++ exited with 0 +++ [pid 5273] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5272] <... futex resumed>) = 1 [pid 5271] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5270] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5268] <... futex resumed>) = 0 [pid 5265] +++ exited with 0 +++ ./strace-static-x86_64: Process 5274 attached [pid 5273] <... futex resumed>) = 1 [pid 5272] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5271] <... futex resumed>) = 1 [pid 5268] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5267] <... futex resumed>) = 0 [pid 5266] <... futex resumed>) = 0 [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5265, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5274] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5273] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5272] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5271] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5270] <... clone3 resumed> => {parent_tid=[5274]}, 88) = 5274 [pid 5268] <... futex resumed>) = 0 [pid 5267] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5266] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5274] <... rseq resumed>) = 0 [pid 5273] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5272] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5271] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5270] rt_sigprocmask(SIG_SETMASK, [], [pid 5268] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5267] <... futex resumed>) = 0 [pid 5266] <... futex resumed>) = 0 [pid 5274] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5273] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5272] <... bpf resumed>) = 5 [pid 5271] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5270] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5267] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5266] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5274] <... set_robust_list resumed>) = 0 [pid 5273] <... bpf resumed>) = 5 [pid 5272] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5271] <... bpf resumed>) = 6 [pid 5270] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5274] rt_sigprocmask(SIG_SETMASK, [], [pid 5273] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5272] <... futex resumed>) = 1 [pid 5271] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5268] <... futex resumed>) = 0 [pid 5076] umount2("./18", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5274] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5273] <... futex resumed>) = 1 [pid 5272] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5271] <... futex resumed>) = 1 [pid 5270] <... futex resumed>) = 0 [pid 5268] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5267] <... futex resumed>) = 0 [pid 5266] <... futex resumed>) = 0 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5274] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5273] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5272] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5271] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5270] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5268] <... futex resumed>) = 0 [pid 5267] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5266] exit_group(0 [pid 5076] openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5274] <... bpf resumed>) = 3 [pid 5273] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5272] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5271] <... futex resumed>) = ? [pid 5268] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5267] <... futex resumed>) = 0 [pid 5266] <... exit_group resumed>) = ? [pid 5076] <... openat resumed>) = 3 [pid 5274] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5273] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5272] <... bpf resumed>) = 6 [pid 5271] +++ exited with 0 +++ [pid 5267] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5076] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5274] <... futex resumed>) = 1 [pid 5272] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5270] <... futex resumed>) = 0 [pid 5272] <... futex resumed>) = 1 [pid 5270] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5268] <... futex resumed>) = 0 [pid 5272] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5270] <... futex resumed>) = 0 [pid 5268] exit_group(0 [pid 5272] <... futex resumed>) = ? [pid 5270] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5268] <... exit_group resumed>) = ? [pid 5274] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5273] <... bpf resumed>) = 6 [pid 5272] +++ exited with 0 +++ [pid 5266] +++ exited with 0 +++ [pid 5076] getdents64(3, [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5266, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5274] <... bpf resumed>) = 4 [pid 5273] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5274] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5273] <... futex resumed>) = 1 [pid 5267] <... futex resumed>) = 0 [pid 5274] <... futex resumed>) = 1 [pid 5273] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5270] <... futex resumed>) = 0 [pid 5076] umount2("./18/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5270] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5274] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5267] exit_group(0 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5274] <... bpf resumed>) = 5 [pid 5273] <... futex resumed>) = ? [pid 5270] <... futex resumed>) = 0 [pid 5267] <... exit_group resumed>) = ? [pid 5076] newfstatat(AT_FDCWD, "./18/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5273] +++ exited with 0 +++ [pid 5274] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5270] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] unlink("./18/binderfs" [pid 5074] umount2("./18", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5274] <... futex resumed>) = 0 [pid 5076] <... unlink resumed>) = 0 [pid 5274] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5270] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5270] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5270] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5274] <... futex resumed>) = 0 [pid 5268] +++ exited with 0 +++ [pid 5267] +++ exited with 0 +++ [pid 5076] getdents64(3, [pid 5074] <... openat resumed>) = 3 [pid 5274] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5267, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5268, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5074] newfstatat(3, "", [pid 5076] close(3 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5076] <... close resumed>) = 0 [pid 5075] restart_syscall(<... resuming interrupted clone ...> [pid 5077] umount2("./18", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] rmdir("./18" [pid 5074] getdents64(3, [pid 5075] <... restart_syscall resumed>) = 0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] <... rmdir resumed>) = 0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5077] openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5075] umount2("./19", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] umount2("./18/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5077] <... openat resumed>) = 3 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] newfstatat(AT_FDCWD, "./18/binderfs", [pid 5077] newfstatat(3, "", [pid 5076] mkdir("./19", 0777 [pid 5075] <... openat resumed>) = 3 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5076] <... mkdir resumed>) = 0 [pid 5077] getdents64(3, [pid 5074] unlink("./18/binderfs" [pid 5075] newfstatat(3, "", [pid 5074] <... unlink resumed>) = 0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5077] umount2("./18/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 ./strace-static-x86_64: Process 5275 attached [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] getdents64(3, [pid 5077] newfstatat(AT_FDCWD, "./18/binderfs", [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] close(3 [pid 5077] unlink("./18/binderfs" [pid 5074] <... close resumed>) = 0 [pid 5275] set_robust_list(0x55555d6c46a0, 24 [pid 5274] <... bpf resumed>) = 6 [pid 5077] <... unlink resumed>) = 0 [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5275 [pid 5075] getdents64(3, [pid 5074] rmdir("./18" [pid 5275] <... set_robust_list resumed>) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5074] <... rmdir resumed>) = 0 [pid 5274] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] getdents64(3, [pid 5075] umount2("./19/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5275] chdir("./19" [pid 5274] <... futex resumed>) = 1 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5270] <... futex resumed>) = 0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5274] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5077] close(3 [pid 5275] <... chdir resumed>) = 0 [pid 5270] exit_group(0 [pid 5077] <... close resumed>) = 0 [pid 5075] newfstatat(AT_FDCWD, "./19/binderfs", [pid 5074] mkdir("./19", 0777 [pid 5275] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5274] <... futex resumed>) = ? [pid 5270] <... exit_group resumed>) = ? [pid 5077] rmdir("./18" [pid 5275] <... prctl resumed>) = 0 [pid 5274] +++ exited with 0 +++ [pid 5077] <... rmdir resumed>) = 0 [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] <... mkdir resumed>) = 0 [pid 5077] mkdir("./19", 0777 [pid 5275] setpgid(0, 0) = 0 [pid 5275] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5077] <... mkdir resumed>) = 0 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5075] unlink("./19/binderfs"./strace-static-x86_64: Process 5276 attached [pid 5276] set_robust_list(0x55555d6c46a0, 24 [pid 5275] <... openat resumed>) = 3 [pid 5075] <... unlink resumed>) = 0 [pid 5276] <... set_robust_list resumed>) = 0 [pid 5275] write(3, "1000", 4) = 4 [pid 5275] close(3 [pid 5276] chdir("./19" [pid 5275] <... close resumed>) = 0 [pid 5270] +++ exited with 0 +++ [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5075] getdents64(3, ./strace-static-x86_64: Process 5277 attached [pid 5276] <... chdir resumed>) = 0 [pid 5275] symlink("/dev/binderfs", "./binderfs" [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5276 [pid 5277] set_robust_list(0x55555d6c46a0, 24 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5270, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5078] restart_syscall(<... resuming interrupted clone ...> [pid 5075] close(3 [pid 5078] <... restart_syscall resumed>) = 0 [pid 5075] <... close resumed>) = 0 [pid 5277] <... set_robust_list resumed>) = 0 [pid 5276] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5275] <... symlink resumed>) = 0 [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5277 [pid 5075] rmdir("./19" [pid 5277] chdir("./19" [pid 5276] <... prctl resumed>) = 0 [pid 5275] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... rmdir resumed>) = 0 [pid 5276] setpgid(0, 0 [pid 5078] umount2("./20", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5276] <... setpgid resumed>) = 0 [pid 5275] <... futex resumed>) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] mkdir("./20", 0777 [pid 5277] <... chdir resumed>) = 0 [pid 5276] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5275] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5078] openat(AT_FDCWD, "./20", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5075] <... mkdir resumed>) = 0 [pid 5277] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5275] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5078] <... openat resumed>) = 3 [pid 5275] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5078] newfstatat(3, "", [pid 5277] <... prctl resumed>) = 0 [pid 5275] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5277] setpgid(0, 0 [pid 5276] <... openat resumed>) = 3 [pid 5275] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5078] getdents64(3, [pid 5276] write(3, "1000", 4 [pid 5277] <... setpgid resumed>) = 0 [pid 5276] <... write resumed>) = 4 [pid 5275] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5277] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5276] close(3 [pid 5275] <... mprotect resumed>) = 0 [pid 5078] umount2("./20/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5278 attached [pid 5277] <... openat resumed>) = 3 [pid 5276] <... close resumed>) = 0 [pid 5275] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5078] newfstatat(AT_FDCWD, "./20/binderfs", [pid 5278] set_robust_list(0x55555d6c46a0, 24 [pid 5277] write(3, "1000", 4 [pid 5276] symlink("/dev/binderfs", "./binderfs" [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5278] <... set_robust_list resumed>) = 0 [pid 5275] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5078] unlink("./20/binderfs" [pid 5278] chdir("./20" [pid 5277] <... write resumed>) = 4 [pid 5276] <... symlink resumed>) = 0 [pid 5275] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5078] <... unlink resumed>) = 0 [pid 5277] close(3./strace-static-x86_64: Process 5279 attached [pid 5278] <... chdir resumed>) = 0 [pid 5277] <... close resumed>) = 0 [pid 5276] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] getdents64(3, [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5278 [pid 5279] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5278] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5277] symlink("/dev/binderfs", "./binderfs" [pid 5276] <... futex resumed>) = 0 [pid 5275] <... clone3 resumed> => {parent_tid=[5279]}, 88) = 5279 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5279] <... rseq resumed>) = 0 [pid 5278] <... prctl resumed>) = 0 [pid 5275] rt_sigprocmask(SIG_SETMASK, [], [pid 5078] close(3 [pid 5279] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5278] setpgid(0, 0 [pid 5277] <... symlink resumed>) = 0 [pid 5276] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5275] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] <... close resumed>) = 0 [pid 5279] <... set_robust_list resumed>) = 0 [pid 5278] <... setpgid resumed>) = 0 [pid 5275] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] rmdir("./20" [pid 5278] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5275] <... futex resumed>) = 0 [pid 5078] <... rmdir resumed>) = 0 [pid 5275] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5279] rt_sigprocmask(SIG_SETMASK, [], [pid 5278] <... openat resumed>) = 3 [pid 5277] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5276] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5279] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5277] <... futex resumed>) = 0 [pid 5276] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5078] mkdir("./21", 0777 [pid 5279] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5278] write(3, "1000", 4 [pid 5277] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5276] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] <... mkdir resumed>) = 0 [pid 5278] <... write resumed>) = 4 [pid 5276] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5279] <... bpf resumed>) = 3 [pid 5278] close(3 [pid 5276] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5277] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5279] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5278] <... close resumed>) = 0 [pid 5277] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5276] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5279] <... futex resumed>) = 1 [pid 5278] symlink("/dev/binderfs", "./binderfs" [pid 5275] <... futex resumed>) = 0 [pid 5277] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5280 attached [pid 5279] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5278] <... symlink resumed>) = 0 [pid 5277] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5276] <... mprotect resumed>) = 0 [pid 5275] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5279] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5277] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5275] <... futex resumed>) = 0 [pid 5278] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5275] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5279] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5278] <... futex resumed>) = 0 [pid 5280] set_robust_list(0x55555d6c46a0, 24 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5280 [pid 5277] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5276] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5280] <... set_robust_list resumed>) = 0 [pid 5279] <... bpf resumed>) = 4 [pid 5278] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5277] <... mprotect resumed>) = 0 [pid 5276] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5279] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5278] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5278] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5277] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5278] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5278] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f3e2f5ed000 [pid 5279] <... futex resumed>) = 1 [pid 5278] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5276] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5275] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5281 attached [pid 5280] chdir("./21" [pid 5279] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5278] <... mprotect resumed>) = 0 [pid 5277] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5275] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5281] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5280] <... chdir resumed>) = 0 [pid 5279] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5278] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5277] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5276] <... clone3 resumed> => {parent_tid=[5281]}, 88) = 5281 [pid 5275] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5282 attached [pid 5281] <... rseq resumed>) = 0 [pid 5280] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5279] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5278] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5276] rt_sigprocmask(SIG_SETMASK, [], [pid 5275] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5282] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5281] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5280] <... prctl resumed>) = 0 [pid 5278] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5277] <... clone3 resumed> => {parent_tid=[5282]}, 88) = 5282 [pid 5276] <... rt_sigprocmask resumed>NULL, 8) = 0 ./strace-static-x86_64: Process 5283 attached [pid 5282] <... rseq resumed>) = 0 [pid 5281] <... set_robust_list resumed>) = 0 [pid 5280] setpgid(0, 0 [pid 5279] <... bpf resumed>) = 5 [pid 5277] rt_sigprocmask(SIG_SETMASK, [], [pid 5276] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5283] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5282] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5281] rt_sigprocmask(SIG_SETMASK, [], [pid 5283] <... rseq resumed>) = 0 [pid 5282] <... set_robust_list resumed>) = 0 [pid 5281] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5278] <... clone3 resumed> => {parent_tid=[5283]}, 88) = 5283 [pid 5283] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5282] rt_sigprocmask(SIG_SETMASK, [], [pid 5281] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5278] rt_sigprocmask(SIG_SETMASK, [], [pid 5283] <... set_robust_list resumed>) = 0 [pid 5282] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5281] <... bpf resumed>) = 3 [pid 5280] <... setpgid resumed>) = 0 [pid 5279] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5278] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5277] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5276] <... futex resumed>) = 0 [pid 5283] rt_sigprocmask(SIG_SETMASK, [], [pid 5282] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5281] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5278] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5283] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5282] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5281] <... futex resumed>) = 0 [pid 5280] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5279] <... futex resumed>) = 1 [pid 5278] <... futex resumed>) = 0 [pid 5277] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5276] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5275] <... futex resumed>) = 0 [pid 5283] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5282] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5281] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5280] <... openat resumed>) = 3 [pid 5279] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5278] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5277] <... futex resumed>) = 0 [pid 5276] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5275] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5283] <... bpf resumed>) = 3 [pid 5282] <... bpf resumed>) = 3 [pid 5280] write(3, "1000", 4 [pid 5279] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5277] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5276] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5275] <... futex resumed>) = 0 [pid 5281] <... futex resumed>) = 0 [pid 5279] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5276] <... futex resumed>) = 1 [pid 5281] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5276] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5279] <... bpf resumed>) = 6 [pid 5279] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5283] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5282] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5281] <... bpf resumed>) = 4 [pid 5280] <... write resumed>) = 4 [pid 5279] <... futex resumed>) = 0 [pid 5275] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5283] <... futex resumed>) = 1 [pid 5282] <... futex resumed>) = 1 [pid 5280] close(3 [pid 5278] <... futex resumed>) = 0 [pid 5275] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5283] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5282] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5281] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5280] <... close resumed>) = 0 [pid 5279] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5278] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5277] <... futex resumed>) = 0 [pid 5275] exit_group(0 [pid 5283] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5281] <... futex resumed>) = 1 [pid 5280] symlink("/dev/binderfs", "./binderfs" [pid 5279] <... futex resumed>) = ? [pid 5278] <... futex resumed>) = 0 [pid 5277] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5276] <... futex resumed>) = 0 [pid 5275] <... exit_group resumed>) = ? [pid 5283] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5282] <... futex resumed>) = 0 [pid 5281] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5280] <... symlink resumed>) = 0 [pid 5279] +++ exited with 0 +++ [pid 5278] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5277] <... futex resumed>) = 1 [pid 5276] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5283] <... bpf resumed>) = 4 [pid 5282] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5281] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5277] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5276] <... futex resumed>) = 0 [pid 5280] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5275] +++ exited with 0 +++ [pid 5283] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5282] <... bpf resumed>) = 4 [pid 5281] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5280] <... futex resumed>) = 0 [pid 5276] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5283] <... futex resumed>) = 1 [pid 5282] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5280] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5278] <... futex resumed>) = 0 [pid 5283] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5282] <... futex resumed>) = 1 [pid 5281] <... bpf resumed>) = 5 [pid 5280] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5278] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5277] <... futex resumed>) = 0 [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5275, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5283] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5282] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5281] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5280] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5278] <... futex resumed>) = 0 [pid 5277] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] restart_syscall(<... resuming interrupted clone ...> [pid 5283] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5282] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5281] <... futex resumed>) = 1 [pid 5280] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5278] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5277] <... futex resumed>) = 0 [pid 5276] <... futex resumed>) = 0 [pid 5076] <... restart_syscall resumed>) = 0 [pid 5282] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5280] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5283] <... bpf resumed>) = 5 [pid 5282] <... bpf resumed>) = 5 [pid 5281] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5280] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5277] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5276] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5280] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5276] <... futex resumed>) = 0 [pid 5280] <... mprotect resumed>) = 0 [pid 5281] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5280] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5276] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5283] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5281] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5282] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5280] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5282] <... futex resumed>) = 1 [pid 5280] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5277] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5284 attached [pid 5283] <... futex resumed>) = 1 [pid 5282] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5281] <... bpf resumed>) = 6 [pid 5278] <... futex resumed>) = 0 [pid 5277] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] umount2("./19", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5284] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5283] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5282] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5280] <... clone3 resumed> => {parent_tid=[5284]}, 88) = 5284 [pid 5277] <... futex resumed>) = 0 [pid 5284] <... rseq resumed>) = 0 [pid 5283] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5282] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5281] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5278] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5284] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5283] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5282] <... bpf resumed>) = 6 [pid 5281] <... futex resumed>) = 1 [pid 5280] rt_sigprocmask(SIG_SETMASK, [], [pid 5278] <... futex resumed>) = 0 [pid 5277] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5276] <... futex resumed>) = 0 [pid 5076] openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5284] <... set_robust_list resumed>) = 0 [pid 5283] <... bpf resumed>) = 6 [pid 5282] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5281] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5280] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5278] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5277] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5276] exit_group(0 [pid 5284] rt_sigprocmask(SIG_SETMASK, [], [pid 5283] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5282] <... futex resumed>) = 0 [pid 5280] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5277] exit_group(0 [pid 5076] <... openat resumed>) = 3 [pid 5284] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5280] <... futex resumed>) = 0 [pid 5277] <... exit_group resumed>) = ? [pid 5284] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5283] <... futex resumed>) = 0 [pid 5282] +++ exited with 0 +++ [pid 5281] <... futex resumed>) = ? [pid 5280] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5278] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5277] +++ exited with 0 +++ [pid 5276] <... exit_group resumed>) = ? [pid 5076] newfstatat(3, "", [pid 5284] <... bpf resumed>) = 3 [pid 5283] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5281] +++ exited with 0 +++ [pid 5278] exit_group(0 [pid 5284] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5280] <... futex resumed>) = 0 [pid 5284] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5280] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5284] <... bpf resumed>) = 4 [pid 5280] <... futex resumed>) = 0 [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5277, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5280] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5278] <... exit_group resumed>) = ? [pid 5283] <... futex resumed>) = ? [pid 5077] restart_syscall(<... resuming interrupted clone ...> [pid 5076] getdents64(3, [pid 5283] +++ exited with 0 +++ [pid 5077] <... restart_syscall resumed>) = 0 [pid 5284] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5280] <... futex resumed>) = 0 [pid 5284] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5280] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5284] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5280] <... futex resumed>) = 0 [pid 5284] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5280] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5284] <... bpf resumed>) = 5 [pid 5278] +++ exited with 0 +++ [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5278, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5076] umount2("./19/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5077] umount2("./19", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] newfstatat(AT_FDCWD, "./19/binderfs", [pid 5075] umount2("./20", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] openat(AT_FDCWD, "./20", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5284] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... openat resumed>) = 3 [pid 5284] <... futex resumed>) = 1 [pid 5280] <... futex resumed>) = 0 [pid 5280] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5284] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5280] <... futex resumed>) = 0 [pid 5075] newfstatat(3, "", [pid 5280] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5075] getdents64(3, [pid 5276] +++ exited with 0 +++ [pid 5077] openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5076] unlink("./19/binderfs" [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5077] <... openat resumed>) = 3 [pid 5076] <... unlink resumed>) = 0 [pid 5075] umount2("./20/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5276, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5077] newfstatat(3, "", [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] restart_syscall(<... resuming interrupted clone ...> [pid 5076] getdents64(3, [pid 5074] <... restart_syscall resumed>) = 0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5075] newfstatat(AT_FDCWD, "./20/binderfs", [pid 5077] getdents64(3, [pid 5076] close(3 [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5076] <... close resumed>) = 0 [pid 5077] umount2("./19/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] rmdir("./19" [pid 5075] unlink("./20/binderfs" [pid 5074] umount2("./19", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] <... rmdir resumed>) = 0 [pid 5075] <... unlink resumed>) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] mkdir("./20", 0777 [pid 5074] openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5284] <... bpf resumed>) = 6 [pid 5077] newfstatat(AT_FDCWD, "./19/binderfs", [pid 5075] getdents64(3, [pid 5284] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5074] <... openat resumed>) = 3 [pid 5284] <... futex resumed>) = 1 [pid 5280] <... futex resumed>) = 0 [pid 5077] unlink("./19/binderfs" [pid 5076] <... mkdir resumed>) = 0 [pid 5075] close(3 [pid 5074] newfstatat(3, "", [pid 5284] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5280] exit_group(0 [pid 5077] <... unlink resumed>) = 0 [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5075] <... close resumed>) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5284] <... futex resumed>) = ? [pid 5280] <... exit_group resumed>) = ? [pid 5077] getdents64(3, [pid 5075] rmdir("./20"./strace-static-x86_64: Process 5285 attached [pid 5284] +++ exited with 0 +++ [pid 5280] +++ exited with 0 +++ [pid 5074] getdents64(3, [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5075] <... rmdir resumed>) = 0 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5280, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5077] close(3 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5285] set_robust_list(0x55555d6c46a0, 24 [pid 5077] <... close resumed>) = 0 [pid 5074] umount2("./19/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5285] <... set_robust_list resumed>) = 0 [pid 5077] rmdir("./19" [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5285 [pid 5285] chdir("./20" [pid 5078] umount2("./21", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5077] <... rmdir resumed>) = 0 [pid 5075] mkdir("./21", 0777 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5285] <... chdir resumed>) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5285] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5074] newfstatat(AT_FDCWD, "./19/binderfs", [pid 5285] setpgid(0, 0) = 0 [pid 5078] openat(AT_FDCWD, "./21", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5075] <... mkdir resumed>) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5078] <... openat resumed>) = 3 [pid 5077] mkdir("./20", 0777 [pid 5078] newfstatat(3, "", [pid 5077] <... mkdir resumed>) = 0 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5285] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5074] unlink("./19/binderfs" [pid 5285] <... openat resumed>) = 3 [pid 5078] getdents64(3, [pid 5074] <... unlink resumed>) = 0 ./strace-static-x86_64: Process 5286 attached [pid 5285] write(3, "1000", 4 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5287 attached [pid 5286] set_robust_list(0x55555d6c46a0, 24 [pid 5285] <... write resumed>) = 4 [pid 5078] umount2("./21/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] getdents64(3, [pid 5287] set_robust_list(0x55555d6c46a0, 24 [pid 5286] <... set_robust_list resumed>) = 0 [pid 5285] close(3 [pid 5287] <... set_robust_list resumed>) = 0 [pid 5286] chdir("./21" [pid 5285] <... close resumed>) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5286 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5287] chdir("./20" [pid 5078] newfstatat(AT_FDCWD, "./21/binderfs", [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5287 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5078] unlink("./21/binderfs" [pid 5285] symlink("/dev/binderfs", "./binderfs" [pid 5078] <... unlink resumed>) = 0 [pid 5074] close(3 [pid 5287] <... chdir resumed>) = 0 [pid 5286] <... chdir resumed>) = 0 [pid 5287] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5074] <... close resumed>) = 0 [pid 5287] <... prctl resumed>) = 0 [pid 5286] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5287] setpgid(0, 0 [pid 5286] <... prctl resumed>) = 0 [pid 5078] getdents64(3, [pid 5287] <... setpgid resumed>) = 0 [pid 5286] setpgid(0, 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5074] rmdir("./19" [pid 5285] <... symlink resumed>) = 0 [pid 5078] close(3 [pid 5287] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5078] <... close resumed>) = 0 [pid 5286] <... setpgid resumed>) = 0 [pid 5078] rmdir("./21" [pid 5286] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5287] <... openat resumed>) = 3 [pid 5078] <... rmdir resumed>) = 0 [pid 5074] <... rmdir resumed>) = 0 [pid 5285] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] mkdir("./22", 0777 [pid 5287] write(3, "1000", 4 [pid 5286] <... openat resumed>) = 3 [pid 5285] <... futex resumed>) = 0 [pid 5074] mkdir("./20", 0777 [pid 5286] write(3, "1000", 4 [pid 5285] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5286] <... write resumed>) = 4 [pid 5285] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5286] close(3 [pid 5285] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5286] <... close resumed>) = 0 [pid 5285] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5286] symlink("/dev/binderfs", "./binderfs" [pid 5285] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5287] <... write resumed>) = 4 [pid 5286] <... symlink resumed>) = 0 [pid 5285] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5078] <... mkdir resumed>) = 0 [pid 5074] <... mkdir resumed>) = 0 [pid 5287] close(3 [pid 5286] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5285] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5288 attached [pid 5287] <... close resumed>) = 0 [pid 5286] <... futex resumed>) = 0 [pid 5285] <... mprotect resumed>) = 0 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5287] symlink("/dev/binderfs", "./binderfs" [pid 5286] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5285] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5288] set_robust_list(0x55555d6c46a0, 24 [pid 5286] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5285] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5288] <... set_robust_list resumed>) = 0 [pid 5286] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5285] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0}./strace-static-x86_64: Process 5290 attached ./strace-static-x86_64: Process 5289 attached [pid 5288] chdir("./20" [pid 5287] <... symlink resumed>) = 0 [pid 5286] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5290] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053) = 0 [pid 5288] <... chdir resumed>) = 0 [pid 5286] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5285] <... clone3 resumed> => {parent_tid=[5290]}, 88) = 5290 [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5288 [pid 5290] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5289] set_robust_list(0x55555d6c46a0, 24 [pid 5288] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5287] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5286] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5285] rt_sigprocmask(SIG_SETMASK, [], [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5289 [pid 5290] <... set_robust_list resumed>) = 0 [pid 5289] <... set_robust_list resumed>) = 0 [pid 5288] <... prctl resumed>) = 0 [pid 5287] <... futex resumed>) = 0 [pid 5287] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, NULL, 8) = 0 [pid 5287] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5289] chdir("./22" [pid 5287] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5289] <... chdir resumed>) = 0 [pid 5287] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5290] rt_sigprocmask(SIG_SETMASK, [], [pid 5289] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5288] setpgid(0, 0 [pid 5287] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5286] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5285] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5290] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5289] <... prctl resumed>) = 0 [pid 5288] <... setpgid resumed>) = 0 [pid 5287] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5286] <... mprotect resumed>) = 0 [pid 5285] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5290] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5289] setpgid(0, 0 [pid 5287] <... mprotect resumed>) = 0 [pid 5285] <... futex resumed>) = 0 [pid 5289] <... setpgid resumed>) = 0 [pid 5288] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5287] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5286] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5285] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5290] <... bpf resumed>) = 3 [pid 5289] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5288] <... openat resumed>) = 3 [pid 5286] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5290] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5289] <... openat resumed>) = 3 [pid 5288] write(3, "1000", 4 [pid 5287] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5286] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0}./strace-static-x86_64: Process 5291 attached [pid 5290] <... futex resumed>) = 1 [pid 5289] write(3, "1000", 4 [pid 5288] <... write resumed>) = 4 [pid 5287] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5285] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5292 attached [pid 5291] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5290] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5289] <... write resumed>) = 4 [pid 5288] close(3 [pid 5286] <... clone3 resumed> => {parent_tid=[5291]}, 88) = 5291 [pid 5285] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5292] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5291] <... rseq resumed>) = 0 [pid 5290] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5289] close(3 [pid 5288] <... close resumed>) = 0 [pid 5286] rt_sigprocmask(SIG_SETMASK, [], [pid 5285] <... futex resumed>) = 0 [pid 5292] <... rseq resumed>) = 0 [pid 5291] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5290] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5289] <... close resumed>) = 0 [pid 5288] symlink("/dev/binderfs", "./binderfs" [pid 5287] <... clone3 resumed> => {parent_tid=[5292]}, 88) = 5292 [pid 5286] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5285] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5292] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5291] <... set_robust_list resumed>) = 0 [pid 5289] symlink("/dev/binderfs", "./binderfs" [pid 5287] rt_sigprocmask(SIG_SETMASK, [], [pid 5292] <... set_robust_list resumed>) = 0 [pid 5287] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5291] rt_sigprocmask(SIG_SETMASK, [], [pid 5292] rt_sigprocmask(SIG_SETMASK, [], [pid 5291] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5287] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5292] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5291] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5290] <... bpf resumed>) = 4 [pid 5289] <... symlink resumed>) = 0 [pid 5288] <... symlink resumed>) = 0 [pid 5287] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5286] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5292] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5291] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5290] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5289] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5288] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5286] <... futex resumed>) = 0 [pid 5290] <... futex resumed>) = 1 [pid 5288] <... futex resumed>) = 0 [pid 5286] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5285] <... futex resumed>) = 0 [pid 5292] <... bpf resumed>) = 3 [pid 5291] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5290] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5289] <... futex resumed>) = 0 [pid 5288] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5285] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5292] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5291] <... bpf resumed>) = 3 [pid 5290] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5289] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5288] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5285] <... futex resumed>) = 0 [pid 5292] <... futex resumed>) = 1 [pid 5291] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5290] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5289] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5288] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5287] <... futex resumed>) = 0 [pid 5285] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5292] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5291] <... futex resumed>) = 1 [pid 5290] <... bpf resumed>) = 5 [pid 5289] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5288] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5287] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5286] <... futex resumed>) = 0 [pid 5292] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5291] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5289] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5287] <... futex resumed>) = 0 [pid 5292] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5289] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5287] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5290] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5288] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5286] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5292] <... bpf resumed>) = 4 [pid 5291] <... futex resumed>) = 0 [pid 5290] <... futex resumed>) = 1 [pid 5289] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5288] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5286] <... futex resumed>) = 1 [pid 5285] <... futex resumed>) = 0 [pid 5290] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5288] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5286] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5285] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5291] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5292] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5290] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5289] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5288] <... mprotect resumed>) = 0 [pid 5285] <... futex resumed>) = 0 [pid 5292] <... futex resumed>) = 1 [pid 5291] <... bpf resumed>) = 4 [pid 5290] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5289] <... mprotect resumed>) = 0 [pid 5288] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5287] <... futex resumed>) = 0 [pid 5285] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5292] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5291] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5288] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5287] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5290] <... bpf resumed>) = 6 [pid 5289] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5288] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0}./strace-static-x86_64: Process 5293 attached [pid 5292] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5291] <... futex resumed>) = 1 [pid 5290] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5289] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5287] <... futex resumed>) = 0 [pid 5286] <... futex resumed>) = 0 [pid 5293] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5292] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5291] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5290] <... futex resumed>) = 1 [pid 5289] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5287] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5286] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5285] <... futex resumed>) = 0 [pid 5293] <... rseq resumed>) = 0 [pid 5290] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5288] <... clone3 resumed> => {parent_tid=[5293]}, 88) = 5293 [pid 5286] <... futex resumed>) = 0 [pid 5285] exit_group(0 [pid 5293] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5291] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5290] <... futex resumed>) = ? [pid 5288] rt_sigprocmask(SIG_SETMASK, [], [pid 5286] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5285] <... exit_group resumed>) = ? ./strace-static-x86_64: Process 5294 attached [pid 5293] <... set_robust_list resumed>) = 0 [pid 5292] <... bpf resumed>) = 5 [pid 5291] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5290] +++ exited with 0 +++ [pid 5288] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5285] +++ exited with 0 +++ [pid 5294] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5293] rt_sigprocmask(SIG_SETMASK, [], [pid 5292] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5288] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5294] <... rseq resumed>) = 0 [pid 5293] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5288] <... futex resumed>) = 0 [pid 5289] <... clone3 resumed> => {parent_tid=[5294]}, 88) = 5294 [pid 5294] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5293] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5292] <... futex resumed>) = 1 [pid 5289] rt_sigprocmask(SIG_SETMASK, [], [pid 5288] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5287] <... futex resumed>) = 0 [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5285, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5294] <... set_robust_list resumed>) = 0 [pid 5293] <... bpf resumed>) = 3 [pid 5292] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5291] <... bpf resumed>) = 5 [pid 5289] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5287] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] restart_syscall(<... resuming interrupted clone ...> [pid 5294] rt_sigprocmask(SIG_SETMASK, [], [pid 5293] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5292] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5291] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5289] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5287] <... futex resumed>) = 0 [pid 5076] <... restart_syscall resumed>) = 0 [pid 5294] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5293] <... futex resumed>) = 1 [pid 5292] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5289] <... futex resumed>) = 0 [pid 5288] <... futex resumed>) = 0 [pid 5287] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5294] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5293] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5291] <... futex resumed>) = 1 [pid 5289] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5288] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5286] <... futex resumed>) = 0 [pid 5294] <... bpf resumed>) = 3 [pid 5293] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5291] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5288] <... futex resumed>) = 0 [pid 5286] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5294] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5293] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5291] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5288] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5286] <... futex resumed>) = 0 [pid 5294] <... futex resumed>) = 1 [pid 5293] <... bpf resumed>) = 4 [pid 5291] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5286] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5076] umount2("./20", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5294] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5289] <... futex resumed>) = 0 [pid 5289] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5294] <... futex resumed>) = 0 [pid 5289] <... futex resumed>) = 1 [pid 5294] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5293] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5289] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] openat(AT_FDCWD, "./20", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5294] <... bpf resumed>) = 4 [pid 5293] <... futex resumed>) = 1 [pid 5288] <... futex resumed>) = 0 [pid 5294] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5293] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5288] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... openat resumed>) = 3 [pid 5294] <... futex resumed>) = 1 [pid 5293] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5289] <... futex resumed>) = 0 [pid 5288] <... futex resumed>) = 0 [pid 5294] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5293] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5289] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5288] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] newfstatat(3, "", [pid 5294] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5289] <... futex resumed>) = 0 [pid 5294] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144) = 5 [pid 5293] <... bpf resumed>) = 5 [pid 5289] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5294] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5293] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5292] <... bpf resumed>) = 6 [pid 5291] <... bpf resumed>) = 6 [pid 5289] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5076] getdents64(3, [pid 5294] <... futex resumed>) = 0 [pid 5293] <... futex resumed>) = 1 [pid 5291] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5289] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5288] <... futex resumed>) = 0 [pid 5294] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5293] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5292] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5291] <... futex resumed>) = 1 [pid 5289] <... futex resumed>) = 0 [pid 5288] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5286] <... futex resumed>) = 0 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5294] <... bpf resumed>) = 6 [pid 5293] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5292] <... futex resumed>) = 1 [pid 5291] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5289] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5288] <... futex resumed>) = 0 [pid 5287] <... futex resumed>) = 0 [pid 5286] exit_group(0 [pid 5294] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5293] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5292] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5291] <... futex resumed>) = ? [pid 5288] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5287] exit_group(0 [pid 5286] <... exit_group resumed>) = ? [pid 5076] umount2("./20/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5294] <... futex resumed>) = 1 [pid 5293] <... bpf resumed>) = 6 [pid 5292] <... futex resumed>) = ? [pid 5291] +++ exited with 0 +++ [pid 5289] <... futex resumed>) = 0 [pid 5287] <... exit_group resumed>) = ? [pid 5286] +++ exited with 0 +++ [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5294] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5293] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5292] +++ exited with 0 +++ [pid 5293] <... futex resumed>) = 1 [pid 5289] exit_group(0 [pid 5288] <... futex resumed>) = 0 [pid 5287] +++ exited with 0 +++ [pid 5076] newfstatat(AT_FDCWD, "./20/binderfs", [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5286, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5294] <... futex resumed>) = ? [pid 5293] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5289] <... exit_group resumed>) = ? [pid 5288] exit_group(0 [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5287, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5293] <... futex resumed>) = ? [pid 5288] <... exit_group resumed>) = ? [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5075] restart_syscall(<... resuming interrupted clone ...> [pid 5293] +++ exited with 0 +++ [pid 5076] unlink("./20/binderfs" [pid 5075] <... restart_syscall resumed>) = 0 [pid 5076] <... unlink resumed>) = 0 [pid 5294] +++ exited with 0 +++ [pid 5289] +++ exited with 0 +++ [pid 5288] +++ exited with 0 +++ [pid 5076] getdents64(3, [pid 5075] umount2("./21", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5289, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5288, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5076] close(3 [pid 5075] openat(AT_FDCWD, "./21", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5077] umount2("./20", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] <... close resumed>) = 0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5078] umount2("./22", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5077] openat(AT_FDCWD, "./20", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5076] rmdir("./20" [pid 5075] <... openat resumed>) = 3 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5078] openat(AT_FDCWD, "./22", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5077] <... openat resumed>) = 3 [pid 5077] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5076] <... rmdir resumed>) = 0 [pid 5077] getdents64(3, 0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5077] umount2("./20/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5078] <... openat resumed>) = 3 [pid 5076] mkdir("./21", 0777 [pid 5075] newfstatat(3, "", [pid 5074] umount2("./20", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5078] newfstatat(3, "", [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5077] newfstatat(AT_FDCWD, "./20/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5076] <... mkdir resumed>) = 0 [pid 5077] unlink("./20/binderfs" [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5077] <... unlink resumed>) = 0 [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] openat(AT_FDCWD, "./20", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5078] getdents64(3, [pid 5075] getdents64(3, [pid 5077] getdents64(3, ./strace-static-x86_64: Process 5295 attached [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5074] <... openat resumed>) = 3 [pid 5078] umount2("./22/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5295 [pid 5075] umount2("./21/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] newfstatat(3, "", [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5295] set_robust_list(0x55555d6c46a0, 24 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5075] newfstatat(AT_FDCWD, "./21/binderfs", [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5295] <... set_robust_list resumed>) = 0 [pid 5077] close(3 [pid 5295] chdir("./21" [pid 5078] newfstatat(AT_FDCWD, "./22/binderfs", [pid 5077] <... close resumed>) = 0 [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] getdents64(3, [pid 5295] <... chdir resumed>) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5077] rmdir("./20" [pid 5295] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5078] unlink("./22/binderfs" [pid 5075] unlink("./21/binderfs" [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5295] <... prctl resumed>) = 0 [pid 5077] <... rmdir resumed>) = 0 [pid 5074] umount2("./20/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5295] setpgid(0, 0 [pid 5078] <... unlink resumed>) = 0 [pid 5295] <... setpgid resumed>) = 0 [pid 5077] mkdir("./21", 0777 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5295] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5078] getdents64(3, [pid 5077] <... mkdir resumed>) = 0 [pid 5075] <... unlink resumed>) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5074] newfstatat(AT_FDCWD, "./20/binderfs", [pid 5078] close(3 [pid 5075] getdents64(3, [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5078] <... close resumed>) = 0 [pid 5078] rmdir("./22" [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5074] unlink("./20/binderfs" [pid 5295] <... openat resumed>) = 3 [pid 5078] <... rmdir resumed>) = 0 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5075] close(3 [pid 5074] <... unlink resumed>) = 0 [pid 5295] write(3, "1000", 4) = 4 [pid 5295] close(3) = 0 [pid 5075] <... close resumed>) = 0 [pid 5295] symlink("/dev/binderfs", "./binderfs" [pid 5078] mkdir("./23", 0777 [pid 5075] rmdir("./21" [pid 5074] getdents64(3, ./strace-static-x86_64: Process 5296 attached [pid 5295] <... symlink resumed>) = 0 [pid 5078] <... mkdir resumed>) = 0 [pid 5075] <... rmdir resumed>) = 0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5296] set_robust_list(0x55555d6c46a0, 24 [pid 5295] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5296 [pid 5295] <... futex resumed>) = 0 [pid 5295] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5074] close(3 [pid 5295] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5295] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5296] <... set_robust_list resumed>) = 0 [pid 5295] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5075] mkdir("./22", 0777 [pid 5074] <... close resumed>) = 0 ./strace-static-x86_64: Process 5297 attached [pid 5296] chdir("./21" [pid 5295] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5075] <... mkdir resumed>) = 0 [pid 5074] rmdir("./20" [pid 5297] set_robust_list(0x55555d6c46a0, 24 [pid 5296] <... chdir resumed>) = 0 [pid 5295] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5297] <... set_robust_list resumed>) = 0 [pid 5296] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] <... rmdir resumed>) = 0 [pid 5296] <... prctl resumed>) = 0 [pid 5295] <... mprotect resumed>) = 0 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5297 [pid 5297] chdir("./23" [pid 5296] setpgid(0, 0 [pid 5295] rt_sigprocmask(SIG_BLOCK, ~[], ./strace-static-x86_64: Process 5298 attached [pid 5297] <... chdir resumed>) = 0 [pid 5296] <... setpgid resumed>) = 0 [pid 5295] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5074] mkdir("./21", 0777 [pid 5298] set_robust_list(0x55555d6c46a0, 24 [pid 5297] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5296] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5295] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5297] <... prctl resumed>) = 0 ./strace-static-x86_64: Process 5299 attached [pid 5298] <... set_robust_list resumed>) = 0 [pid 5297] setpgid(0, 0 [pid 5296] <... openat resumed>) = 3 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5298 [pid 5074] <... mkdir resumed>) = 0 [pid 5299] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053) = 0 [pid 5297] <... setpgid resumed>) = 0 [pid 5295] <... clone3 resumed> => {parent_tid=[5299]}, 88) = 5299 [pid 5299] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5298] chdir("./22" [pid 5296] write(3, "1000", 4 [pid 5295] rt_sigprocmask(SIG_SETMASK, [], [pid 5299] <... set_robust_list resumed>) = 0 [pid 5296] <... write resumed>) = 4 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5300 attached [pid 5299] rt_sigprocmask(SIG_SETMASK, [], [pid 5298] <... chdir resumed>) = 0 [pid 5297] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5296] close(3 [pid 5295] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5299] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5296] <... close resumed>) = 0 [pid 5300] set_robust_list(0x55555d6c46a0, 24 [pid 5295] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5298] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5296] symlink("/dev/binderfs", "./binderfs" [pid 5300] <... set_robust_list resumed>) = 0 [pid 5299] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5298] <... prctl resumed>) = 0 [pid 5297] <... openat resumed>) = 3 [pid 5295] <... futex resumed>) = 0 [pid 5300] chdir("./21" [pid 5298] setpgid(0, 0 [pid 5295] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5300] <... chdir resumed>) = 0 [pid 5299] <... bpf resumed>) = 3 [pid 5298] <... setpgid resumed>) = 0 [pid 5297] write(3, "1000", 4 [pid 5296] <... symlink resumed>) = 0 [pid 5300] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5299] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5300] <... prctl resumed>) = 0 [pid 5299] <... futex resumed>) = 1 [pid 5298] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5297] <... write resumed>) = 4 [pid 5296] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5295] <... futex resumed>) = 0 [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5300 [pid 5300] setpgid(0, 0 [pid 5299] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5296] <... futex resumed>) = 0 [pid 5295] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5300] <... setpgid resumed>) = 0 [pid 5299] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5297] close(3 [pid 5296] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5295] <... futex resumed>) = 0 [pid 5299] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5297] <... close resumed>) = 0 [pid 5296] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5295] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5300] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5299] <... bpf resumed>) = 4 [pid 5298] <... openat resumed>) = 3 [pid 5297] symlink("/dev/binderfs", "./binderfs" [pid 5296] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5299] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5296] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5299] <... futex resumed>) = 1 [pid 5297] <... symlink resumed>) = 0 [pid 5296] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5295] <... futex resumed>) = 0 [pid 5300] <... openat resumed>) = 3 [pid 5299] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5298] write(3, "1000", 4 [pid 5297] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5296] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5295] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5299] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5299] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5296] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5295] <... futex resumed>) = 0 [pid 5300] write(3, "1000", 4 [pid 5299] <... bpf resumed>) = 5 [pid 5298] <... write resumed>) = 4 [pid 5297] <... futex resumed>) = 0 [pid 5296] <... mprotect resumed>) = 0 [pid 5295] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5300] <... write resumed>) = 4 [pid 5298] close(3 [pid 5297] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5300] close(3 [pid 5298] <... close resumed>) = 0 [pid 5297] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5296] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5300] <... close resumed>) = 0 [pid 5299] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5298] symlink("/dev/binderfs", "./binderfs" [pid 5297] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5300] symlink("/dev/binderfs", "./binderfs" [pid 5299] <... futex resumed>) = 1 [pid 5297] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5296] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5295] <... futex resumed>) = 0 [pid 5299] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5296] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5295] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5299] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5295] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5301 attached [pid 5299] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5300] <... symlink resumed>) = 0 [pid 5298] <... symlink resumed>) = 0 [pid 5297] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5296] <... clone3 resumed> => {parent_tid=[5301]}, 88) = 5301 [pid 5295] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5301] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5300] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5299] <... bpf resumed>) = 6 [pid 5298] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5297] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5296] rt_sigprocmask(SIG_SETMASK, [], [pid 5301] <... rseq resumed>) = 0 [pid 5300] <... futex resumed>) = 0 [pid 5299] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5298] <... futex resumed>) = 0 [pid 5297] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5296] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5301] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5300] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5299] <... futex resumed>) = 1 [pid 5298] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5297] <... mprotect resumed>) = 0 [pid 5296] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5295] <... futex resumed>) = 0 [pid 5301] <... set_robust_list resumed>) = 0 [pid 5300] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5299] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5298] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5297] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5296] <... futex resumed>) = 0 [pid 5295] exit_group(0 [pid 5301] rt_sigprocmask(SIG_SETMASK, [], [pid 5300] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5299] <... futex resumed>) = ? [pid 5298] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5296] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5295] <... exit_group resumed>) = ? [pid 5301] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5300] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5299] +++ exited with 0 +++ [pid 5298] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5297] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5295] +++ exited with 0 +++ [pid 5301] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5300] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5298] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5297] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5295, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5301] <... bpf resumed>) = 3 [pid 5298] <... mmap resumed>) = 0x7f3e2f5ed000 ./strace-static-x86_64: Process 5302 attached [pid 5301] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5298] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5300] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5297] <... clone3 resumed> => {parent_tid=[5302]}, 88) = 5302 [pid 5302] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5301] <... futex resumed>) = 1 [pid 5300] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5298] <... mprotect resumed>) = 0 [pid 5297] rt_sigprocmask(SIG_SETMASK, [], [pid 5296] <... futex resumed>) = 0 [pid 5302] <... rseq resumed>) = 0 [pid 5301] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5297] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5296] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5302] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5301] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5296] <... futex resumed>) = 0 [pid 5302] <... set_robust_list resumed>) = 0 [pid 5301] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5300] <... mprotect resumed>) = 0 [pid 5298] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5297] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5296] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5302] rt_sigprocmask(SIG_SETMASK, [], [pid 5301] <... bpf resumed>) = 4 [pid 5302] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5302] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5301] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5302] <... bpf resumed>) = 3 [pid 5301] <... futex resumed>) = 1 [pid 5300] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5297] <... futex resumed>) = 0 [pid 5296] <... futex resumed>) = 0 [pid 5298] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5297] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5300] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5298] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5076] umount2("./21", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5302] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5301] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5296] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5303 attached [pid 5302] <... futex resumed>) = 1 [pid 5301] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5300] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5297] <... futex resumed>) = 0 [pid 5296] <... futex resumed>) = 0 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5303] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5302] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5301] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5297] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5296] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] openat(AT_FDCWD, "./21", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY./strace-static-x86_64: Process 5304 attached [pid 5303] <... rseq resumed>) = 0 [pid 5302] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5301] <... bpf resumed>) = 5 [pid 5298] <... clone3 resumed> => {parent_tid=[5303]}, 88) = 5303 [pid 5297] <... futex resumed>) = 0 [pid 5076] <... openat resumed>) = 3 [pid 5304] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5303] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5302] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5300] <... clone3 resumed> => {parent_tid=[5304]}, 88) = 5304 [pid 5304] <... rseq resumed>) = 0 [pid 5297] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] newfstatat(3, "", [pid 5304] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5303] <... set_robust_list resumed>) = 0 [pid 5302] <... bpf resumed>) = 4 [pid 5301] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5300] rt_sigprocmask(SIG_SETMASK, [], [pid 5298] rt_sigprocmask(SIG_SETMASK, [], [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5304] <... set_robust_list resumed>) = 0 [pid 5303] rt_sigprocmask(SIG_SETMASK, [], [pid 5302] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5301] <... futex resumed>) = 1 [pid 5300] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5298] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5296] <... futex resumed>) = 0 [pid 5076] getdents64(3, [pid 5304] rt_sigprocmask(SIG_SETMASK, [], [pid 5303] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5302] <... futex resumed>) = 1 [pid 5301] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5300] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5298] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5297] <... futex resumed>) = 0 [pid 5296] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5304] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5303] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5302] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5301] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5300] <... futex resumed>) = 0 [pid 5298] <... futex resumed>) = 0 [pid 5297] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5296] <... futex resumed>) = 0 [pid 5076] umount2("./21/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5304] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5303] <... bpf resumed>) = 3 [pid 5302] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5301] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5300] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5298] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5297] <... futex resumed>) = 0 [pid 5296] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5304] <... bpf resumed>) = 3 [pid 5303] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5302] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5301] <... bpf resumed>) = 6 [pid 5298] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5297] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5304] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5303] <... futex resumed>) = 0 [pid 5302] <... bpf resumed>) = 5 [pid 5301] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5298] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] newfstatat(AT_FDCWD, "./21/binderfs", [pid 5304] <... futex resumed>) = 1 [pid 5303] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5300] <... futex resumed>) = 0 [pid 5298] <... futex resumed>) = 0 [pid 5304] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5303] <... bpf resumed>) = 4 [pid 5301] <... futex resumed>) = 1 [pid 5300] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5298] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5296] <... futex resumed>) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5304] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5303] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5302] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5301] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5300] <... futex resumed>) = 0 [pid 5298] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5296] exit_group(0 [pid 5304] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5303] <... futex resumed>) = 0 [pid 5302] <... futex resumed>) = 1 [pid 5301] <... futex resumed>) = ? [pid 5300] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5298] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5297] <... futex resumed>) = 0 [pid 5296] <... exit_group resumed>) = ? [pid 5076] unlink("./21/binderfs" [pid 5304] <... bpf resumed>) = 4 [pid 5303] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5302] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5301] +++ exited with 0 +++ [pid 5298] <... futex resumed>) = 0 [pid 5297] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5304] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5303] <... bpf resumed>) = 5 [pid 5302] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5298] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5297] <... futex resumed>) = 0 [pid 5076] <... unlink resumed>) = 0 [pid 5304] <... futex resumed>) = 1 [pid 5300] <... futex resumed>) = 0 [pid 5297] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5076] getdents64(3, [pid 5304] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5303] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5302] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5300] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5296] +++ exited with 0 +++ [pid 5304] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5303] <... futex resumed>) = 1 [pid 5300] <... futex resumed>) = 0 [pid 5298] <... futex resumed>) = 0 [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5296, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5304] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5303] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5300] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5298] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5303] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5298] <... futex resumed>) = 0 [pid 5076] close(3 [pid 5303] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5298] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5076] <... close resumed>) = 0 [pid 5076] rmdir("./21" [pid 5304] <... bpf resumed>) = 5 [pid 5077] umount2("./21", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5077] openat(AT_FDCWD, "./21", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5304] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5303] <... bpf resumed>) = 6 [pid 5302] <... bpf resumed>) = 6 [pid 5303] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5302] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5300] <... futex resumed>) = 0 [pid 5077] <... openat resumed>) = 3 [pid 5304] <... futex resumed>) = 1 [pid 5076] <... rmdir resumed>) = 0 [pid 5303] <... futex resumed>) = 1 [pid 5302] <... futex resumed>) = 1 [pid 5298] <... futex resumed>) = 0 [pid 5297] <... futex resumed>) = 0 [pid 5304] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5303] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5302] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5300] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5298] exit_group(0 [pid 5297] exit_group(0 [pid 5077] newfstatat(3, "", [pid 5076] mkdir("./22", 0777 [pid 5304] <... bpf resumed>) = 6 [pid 5303] <... futex resumed>) = ? [pid 5302] <... futex resumed>) = ? [pid 5300] <... futex resumed>) = 0 [pid 5298] <... exit_group resumed>) = ? [pid 5297] <... exit_group resumed>) = ? [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5303] +++ exited with 0 +++ [pid 5302] +++ exited with 0 +++ [pid 5076] <... mkdir resumed>) = 0 [pid 5077] getdents64(3, [pid 5304] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5300] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5298] +++ exited with 0 +++ [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5304] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5300] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5077] umount2("./21/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5300] exit_group(0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5298, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5300] <... exit_group resumed>) = ? [pid 5077] newfstatat(AT_FDCWD, "./21/binderfs", [pid 5075] umount2("./22", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5077] unlink("./21/binderfs" [pid 5075] openat(AT_FDCWD, "./22", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5304] <... futex resumed>) = ? [pid 5077] <... unlink resumed>) = 0 [pid 5075] <... openat resumed>) = 3 ./strace-static-x86_64: Process 5305 attached [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5305 [pid 5305] set_robust_list(0x55555d6c46a0, 24 [pid 5075] newfstatat(3, "", [pid 5077] getdents64(3, [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5305] <... set_robust_list resumed>) = 0 [pid 5305] chdir("./22" [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5077] close(3 [pid 5075] getdents64(3, [pid 5305] <... chdir resumed>) = 0 [pid 5077] <... close resumed>) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5077] rmdir("./21" [pid 5305] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5075] umount2("./22/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5305] <... prctl resumed>) = 0 [pid 5077] <... rmdir resumed>) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5305] setpgid(0, 0) = 0 [pid 5075] newfstatat(AT_FDCWD, "./22/binderfs", [pid 5305] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5077] mkdir("./22", 0777 [pid 5305] <... openat resumed>) = 3 [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5077] <... mkdir resumed>) = 0 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5305] write(3, "1000", 4 [pid 5075] unlink("./22/binderfs" [pid 5305] <... write resumed>) = 4 [pid 5304] +++ exited with 0 +++ [pid 5300] +++ exited with 0 +++ [pid 5297] +++ exited with 0 +++ [pid 5075] <... unlink resumed>) = 0 ./strace-static-x86_64: Process 5306 attached [pid 5305] close(3 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5297, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5306 [pid 5075] getdents64(3, [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5300, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5306] set_robust_list(0x55555d6c46a0, 24 [pid 5305] <... close resumed>) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5306] <... set_robust_list resumed>) = 0 [pid 5305] symlink("/dev/binderfs", "./binderfs" [pid 5306] chdir("./22" [pid 5305] <... symlink resumed>) = 0 [pid 5075] close(3 [pid 5306] <... chdir resumed>) = 0 [pid 5305] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5306] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5074] umount2("./21", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5306] <... prctl resumed>) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5306] setpgid(0, 0 [pid 5305] <... futex resumed>) = 0 [pid 5078] umount2("./23", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] <... close resumed>) = 0 [pid 5074] openat(AT_FDCWD, "./21", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5306] <... setpgid resumed>) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5306] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5305] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5078] openat(AT_FDCWD, "./23", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5075] rmdir("./22" [pid 5074] <... openat resumed>) = 3 [pid 5306] <... openat resumed>) = 3 [pid 5305] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5078] <... openat resumed>) = 3 [pid 5306] write(3, "1000", 4 [pid 5305] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5078] newfstatat(3, "", [pid 5075] <... rmdir resumed>) = 0 [pid 5074] newfstatat(3, "", [pid 5306] <... write resumed>) = 4 [pid 5305] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5306] close(3 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5306] <... close resumed>) = 0 [pid 5305] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5078] getdents64(3, [pid 5075] mkdir("./23", 0777 [pid 5306] symlink("/dev/binderfs", "./binderfs" [pid 5305] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5075] <... mkdir resumed>) = 0 [pid 5074] getdents64(3, [pid 5305] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5078] umount2("./23/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5306] <... symlink resumed>) = 0 [pid 5305] <... mprotect resumed>) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5306] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5305] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5078] newfstatat(AT_FDCWD, "./23/binderfs", [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5306] <... futex resumed>) = 0 [pid 5305] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] umount2("./21/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5306] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5305] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5078] unlink("./23/binderfs"./strace-static-x86_64: Process 5307 attached [pid 5306] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5306] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5074] newfstatat(AT_FDCWD, "./21/binderfs", [pid 5306] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5306] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5307] set_robust_list(0x55555d6c46a0, 24) = 0 [pid 5306] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5078] <... unlink resumed>) = 0 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5307 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 ./strace-static-x86_64: Process 5308 attached [pid 5305] <... clone3 resumed> => {parent_tid=[5308]}, 88) = 5308 [pid 5078] getdents64(3, [pid 5305] rt_sigprocmask(SIG_SETMASK, [], [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5305] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] close(3 [pid 5305] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... close resumed>) = 0 [pid 5305] <... futex resumed>) = 0 [pid 5078] rmdir("./23" [pid 5308] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5307] chdir("./23" [pid 5306] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5305] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... rmdir resumed>) = 0 [pid 5074] unlink("./21/binderfs" [pid 5308] <... rseq resumed>) = 0 [pid 5307] <... chdir resumed>) = 0 [pid 5306] <... mprotect resumed>) = 0 [pid 5308] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5078] mkdir("./24", 0777 [pid 5308] <... set_robust_list resumed>) = 0 [pid 5307] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5306] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5074] <... unlink resumed>) = 0 [pid 5308] rt_sigprocmask(SIG_SETMASK, [], [pid 5307] <... prctl resumed>) = 0 [pid 5074] getdents64(3, [pid 5308] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5308] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5307] setpgid(0, 0 [pid 5306] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5078] <... mkdir resumed>) = 0 [pid 5307] <... setpgid resumed>) = 0 [pid 5308] <... bpf resumed>) = 3 [pid 5306] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 ./strace-static-x86_64: Process 5309 attached [pid 5308] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5307] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5074] close(3 [pid 5309] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5308] <... futex resumed>) = 1 [pid 5307] <... openat resumed>) = 3 [pid 5306] <... clone3 resumed> => {parent_tid=[5309]}, 88) = 5309 [pid 5305] <... futex resumed>) = 0 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5310 attached [pid 5309] <... rseq resumed>) = 0 [pid 5308] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5307] write(3, "1000", 4 [pid 5306] rt_sigprocmask(SIG_SETMASK, [], [pid 5305] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... close resumed>) = 0 [pid 5310] set_robust_list(0x55555d6c46a0, 24 [pid 5309] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5308] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5307] <... write resumed>) = 4 [pid 5306] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5305] <... futex resumed>) = 0 [pid 5305] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5306] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5308] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5310] <... set_robust_list resumed>) = 0 [pid 5074] rmdir("./21" [pid 5309] <... set_robust_list resumed>) = 0 [pid 5307] close(3) = 0 [pid 5306] <... futex resumed>) = 0 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5310 [pid 5309] rt_sigprocmask(SIG_SETMASK, [], [pid 5306] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5310] chdir("./24" [pid 5309] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5308] <... bpf resumed>) = 4 [pid 5307] symlink("/dev/binderfs", "./binderfs" [pid 5074] <... rmdir resumed>) = 0 [pid 5309] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5310] <... chdir resumed>) = 0 [pid 5309] <... bpf resumed>) = 3 [pid 5308] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5307] <... symlink resumed>) = 0 [pid 5074] mkdir("./22", 0777 [pid 5308] <... futex resumed>) = 1 [pid 5305] <... futex resumed>) = 0 [pid 5305] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5305] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5310] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5074] <... mkdir resumed>) = 0 [pid 5309] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5308] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5307] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5310] setpgid(0, 0 [pid 5309] <... futex resumed>) = 1 [pid 5307] <... futex resumed>) = 0 [pid 5306] <... futex resumed>) = 0 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5310] <... setpgid resumed>) = 0 [pid 5309] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5307] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5306] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5310] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5309] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5306] <... futex resumed>) = 0 [pid 5306] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5310] <... openat resumed>) = 3 [pid 5309] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5307] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5307] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5310] write(3, "1000", 4 [pid 5309] <... bpf resumed>) = 4 [pid 5307] <... rt_sigprocmask resumed>NULL, 8) = 0 ./strace-static-x86_64: Process 5311 attached [pid 5310] <... write resumed>) = 4 [pid 5308] <... bpf resumed>) = 5 [pid 5307] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5310] close(3) = 0 [pid 5310] symlink("/dev/binderfs", "./binderfs" [pid 5311] set_robust_list(0x55555d6c46a0, 24 [pid 5310] <... symlink resumed>) = 0 [pid 5309] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5308] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5307] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5311 [pid 5311] <... set_robust_list resumed>) = 0 [pid 5309] <... futex resumed>) = 1 [pid 5308] <... futex resumed>) = 1 [pid 5306] <... futex resumed>) = 0 [pid 5305] <... futex resumed>) = 0 [pid 5311] chdir("./22" [pid 5310] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5309] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5308] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5307] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5306] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5305] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5311] <... chdir resumed>) = 0 [pid 5310] <... futex resumed>) = 0 [pid 5309] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5308] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5306] <... futex resumed>) = 0 [pid 5305] <... futex resumed>) = 0 [pid 5311] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5310] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5309] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5308] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5306] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5305] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5311] <... prctl resumed>) = 0 [pid 5310] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5309] <... bpf resumed>) = 5 [pid 5308] <... bpf resumed>) = 6 [pid 5307] <... mprotect resumed>) = 0 [pid 5311] setpgid(0, 0 [pid 5310] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5307] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5307] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5311] <... setpgid resumed>) = 0 [pid 5310] <... rt_sigprocmask resumed>NULL, 8) = 0 ./strace-static-x86_64: Process 5312 attached [pid 5310] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5308] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5312] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5311] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5310] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5309] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5308] <... futex resumed>) = 1 [pid 5307] <... clone3 resumed> => {parent_tid=[5312]}, 88) = 5312 [pid 5305] <... futex resumed>) = 0 [pid 5312] <... rseq resumed>) = 0 [pid 5311] <... openat resumed>) = 3 [pid 5310] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5309] <... futex resumed>) = 1 [pid 5308] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5307] rt_sigprocmask(SIG_SETMASK, [], [pid 5306] <... futex resumed>) = 0 [pid 5305] exit_group(0 [pid 5312] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5311] write(3, "1000", 4 [pid 5310] <... mprotect resumed>) = 0 [pid 5309] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5308] <... futex resumed>) = ? [pid 5307] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5306] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5305] <... exit_group resumed>) = ? [pid 5312] <... set_robust_list resumed>) = 0 [pid 5311] <... write resumed>) = 4 [pid 5310] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5309] <... bpf resumed>) = 6 [pid 5308] +++ exited with 0 +++ [pid 5307] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5306] <... futex resumed>) = 0 [pid 5312] rt_sigprocmask(SIG_SETMASK, [], [pid 5311] close(3 [pid 5310] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5307] <... futex resumed>) = 0 [pid 5306] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5312] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5311] <... close resumed>) = 0 [pid 5310] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5309] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5307] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5306] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) ./strace-static-x86_64: Process 5313 attached [pid 5312] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5311] symlink("/dev/binderfs", "./binderfs" [pid 5309] <... futex resumed>) = 0 [pid 5306] exit_group(0 [pid 5313] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5312] <... bpf resumed>) = 3 [pid 5311] <... symlink resumed>) = 0 [pid 5310] <... clone3 resumed> => {parent_tid=[5313]}, 88) = 5313 [pid 5306] <... exit_group resumed>) = ? [pid 5313] <... rseq resumed>) = 0 [pid 5312] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5310] rt_sigprocmask(SIG_SETMASK, [], [pid 5309] +++ exited with 0 +++ [pid 5313] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5312] <... futex resumed>) = 1 [pid 5311] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5313] <... set_robust_list resumed>) = 0 [pid 5312] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5311] <... futex resumed>) = 0 [pid 5310] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5307] <... futex resumed>) = 0 [pid 5313] rt_sigprocmask(SIG_SETMASK, [], [pid 5311] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5310] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5307] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5313] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5311] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5310] <... futex resumed>) = 0 [pid 5310] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5313] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5312] <... futex resumed>) = 0 [pid 5311] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5307] <... futex resumed>) = 1 [pid 5312] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5311] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5307] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5313] <... bpf resumed>) = 3 [pid 5313] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5311] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5313] <... futex resumed>) = 1 [pid 5313] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5311] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5310] <... futex resumed>) = 0 [pid 5313] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5312] <... bpf resumed>) = 4 [pid 5311] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5310] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5313] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5312] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5311] <... mprotect resumed>) = 0 [pid 5310] <... futex resumed>) = 0 [pid 5313] <... bpf resumed>) = 4 [pid 5312] <... futex resumed>) = 1 [pid 5307] <... futex resumed>) = 0 [pid 5305] +++ exited with 0 +++ [pid 5312] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5310] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5307] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5313] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5305, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5307] <... futex resumed>) = 1 [pid 5313] <... futex resumed>) = 0 [pid 5307] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] restart_syscall(<... resuming interrupted clone ...> [pid 5312] <... futex resumed>) = 0 [pid 5310] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5311] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5313] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5310] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... restart_syscall resumed>) = 0 [pid 5312] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5310] <... futex resumed>) = 0 [pid 5313] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5312] <... bpf resumed>) = 5 [pid 5311] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5310] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5306] +++ exited with 0 +++ [pid 5313] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5306, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5312] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5311] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5312] <... futex resumed>) = 1 [pid 5307] <... futex resumed>) = 0 [pid 5076] umount2("./22", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5312] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5307] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5312] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5307] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5314 attached [pid 5312] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5307] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5076] openat(AT_FDCWD, "./22", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5314] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5313] <... bpf resumed>) = 5 [pid 5314] <... rseq resumed>) = 0 [pid 5076] <... openat resumed>) = 3 [pid 5314] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5313] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5311] <... clone3 resumed> => {parent_tid=[5314]}, 88) = 5314 [pid 5077] umount2("./22", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] newfstatat(3, "", [pid 5314] <... set_robust_list resumed>) = 0 [pid 5313] <... futex resumed>) = 1 [pid 5311] rt_sigprocmask(SIG_SETMASK, [], [pid 5310] <... futex resumed>) = 0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5314] rt_sigprocmask(SIG_SETMASK, [], [pid 5313] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5311] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5310] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] openat(AT_FDCWD, "./22", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5314] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5313] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5311] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5310] <... futex resumed>) = 0 [pid 5077] <... openat resumed>) = 3 [pid 5076] getdents64(3, [pid 5314] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5311] <... futex resumed>) = 0 [pid 5310] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5314] <... bpf resumed>) = 3 [pid 5313] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5311] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] newfstatat(3, "", [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5314] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5314] <... futex resumed>) = 1 [pid 5311] <... futex resumed>) = 0 [pid 5077] getdents64(3, [pid 5076] umount2("./22/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5314] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5311] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5314] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5313] <... bpf resumed>) = 6 [pid 5312] <... bpf resumed>) = 6 [pid 5311] <... futex resumed>) = 0 [pid 5077] umount2("./22/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] newfstatat(AT_FDCWD, "./22/binderfs", [pid 5314] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5313] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5312] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5311] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5314] <... bpf resumed>) = 4 [pid 5313] <... futex resumed>) = 1 [pid 5312] <... futex resumed>) = 1 [pid 5310] <... futex resumed>) = 0 [pid 5307] <... futex resumed>) = 0 [pid 5077] newfstatat(AT_FDCWD, "./22/binderfs", [pid 5076] unlink("./22/binderfs" [pid 5313] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5310] exit_group(0 [pid 5307] exit_group(0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5307] <... exit_group resumed>) = ? [pid 5314] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5310] <... exit_group resumed>) = ? [pid 5077] unlink("./22/binderfs" [pid 5314] <... futex resumed>) = 1 [pid 5313] <... futex resumed>) = ? [pid 5311] <... futex resumed>) = 0 [pid 5076] <... unlink resumed>) = 0 [pid 5313] +++ exited with 0 +++ [pid 5311] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] getdents64(3, [pid 5311] <... futex resumed>) = 0 [pid 5314] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5311] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... unlink resumed>) = 0 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5314] <... bpf resumed>) = 5 [pid 5314] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] getdents64(3, [pid 5076] close(3 [pid 5314] <... futex resumed>) = 1 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5314] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5077] close(3 [pid 5311] <... futex resumed>) = 0 [pid 5077] <... close resumed>) = 0 [pid 5311] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... close resumed>) = 0 [pid 5314] <... futex resumed>) = 0 [pid 5311] <... futex resumed>) = 1 [pid 5077] rmdir("./22" [pid 5076] rmdir("./22" [pid 5314] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5311] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] <... rmdir resumed>) = 0 [pid 5077] mkdir("./23", 0777 [pid 5312] +++ exited with 0 +++ [pid 5310] +++ exited with 0 +++ [pid 5307] +++ exited with 0 +++ [pid 5077] <... mkdir resumed>) = 0 [pid 5076] <... rmdir resumed>) = 0 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5310, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5307, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5076] mkdir("./23", 0777 [pid 5075] umount2("./23", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5078] umount2("./24", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5075] openat(AT_FDCWD, "./23", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5078] openat(AT_FDCWD, "./24", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5076] <... mkdir resumed>) = 0 [pid 5075] <... openat resumed>) = 3 ./strace-static-x86_64: Process 5315 attached [pid 5078] <... openat resumed>) = 3 [pid 5078] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5075] newfstatat(3, "", [pid 5078] getdents64(3, [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5315 [pid 5075] getdents64(3, [pid 5315] set_robust_list(0x55555d6c46a0, 24 [pid 5078] umount2("./24/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5315] <... set_robust_list resumed>) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5314] <... bpf resumed>) = 6 [pid 5075] umount2("./23/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5316 attached [pid 5314] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] newfstatat(AT_FDCWD, "./24/binderfs", [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5315] chdir("./23" [pid 5316] set_robust_list(0x55555d6c46a0, 24 [pid 5314] <... futex resumed>) = 1 [pid 5311] <... futex resumed>) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5075] newfstatat(AT_FDCWD, "./23/binderfs", [pid 5316] <... set_robust_list resumed>) = 0 [pid 5314] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5078] unlink("./24/binderfs" [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5316] chdir("./23" [pid 5315] <... chdir resumed>) = 0 [pid 5311] exit_group(0 [pid 5078] <... unlink resumed>) = 0 [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5316 [pid 5315] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5311] <... exit_group resumed>) = ? [pid 5315] <... prctl resumed>) = 0 [pid 5316] <... chdir resumed>) = 0 [pid 5314] <... futex resumed>) = ? [pid 5078] getdents64(3, [pid 5075] unlink("./23/binderfs" [pid 5315] setpgid(0, 0 [pid 5316] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5314] +++ exited with 0 +++ [pid 5311] +++ exited with 0 +++ [pid 5315] <... setpgid resumed>) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5075] <... unlink resumed>) = 0 [pid 5316] <... prctl resumed>) = 0 [pid 5078] close(3 [pid 5075] getdents64(3, [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5311, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5316] setpgid(0, 0 [pid 5315] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5078] <... close resumed>) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5074] restart_syscall(<... resuming interrupted clone ...> [pid 5316] <... setpgid resumed>) = 0 [pid 5078] rmdir("./24" [pid 5074] <... restart_syscall resumed>) = 0 [pid 5316] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5315] <... openat resumed>) = 3 [pid 5078] <... rmdir resumed>) = 0 [pid 5075] close(3) = 0 [pid 5316] <... openat resumed>) = 3 [pid 5315] write(3, "1000", 4 [pid 5078] mkdir("./25", 0777 [pid 5075] rmdir("./23" [pid 5315] <... write resumed>) = 4 [pid 5316] write(3, "1000", 4 [pid 5315] close(3 [pid 5078] <... mkdir resumed>) = 0 [pid 5075] <... rmdir resumed>) = 0 [pid 5074] umount2("./22", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5316] <... write resumed>) = 4 [pid 5315] <... close resumed>) = 0 [pid 5316] close(3 [pid 5315] symlink("/dev/binderfs", "./binderfs" [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5075] mkdir("./24", 0777 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5316] <... close resumed>) = 0 [pid 5074] openat(AT_FDCWD, "./22", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5316] symlink("/dev/binderfs", "./binderfs" [pid 5075] <... mkdir resumed>) = 0 [pid 5074] <... openat resumed>) = 3 [pid 5316] <... symlink resumed>) = 0 [pid 5074] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5315] <... symlink resumed>) = 0 [pid 5316] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5315] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] getdents64(3, [pid 5315] <... futex resumed>) = 0 [pid 5316] <... futex resumed>) = 0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 ./strace-static-x86_64: Process 5317 attached [pid 5315] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5317] set_robust_list(0x55555d6c46a0, 24./strace-static-x86_64: Process 5318 attached [pid 5316] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5315] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5317 [pid 5317] <... set_robust_list resumed>) = 0 [pid 5074] umount2("./22/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5318] set_robust_list(0x55555d6c46a0, 24 [pid 5316] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5315] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5318] <... set_robust_list resumed>) = 0 [pid 5317] chdir("./25" [pid 5316] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5315] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5318 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5318] chdir("./24" [pid 5317] <... chdir resumed>) = 0 [pid 5316] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5315] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5318] <... chdir resumed>) = 0 [pid 5317] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5315] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5317] <... prctl resumed>) = 0 [pid 5318] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5317] setpgid(0, 0 [pid 5316] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5315] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5074] newfstatat(AT_FDCWD, "./22/binderfs", [pid 5318] setpgid(0, 0 [pid 5317] <... setpgid resumed>) = 0 [pid 5316] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5315] <... mprotect resumed>) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5318] <... setpgid resumed>) = 0 [pid 5317] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5316] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5074] unlink("./22/binderfs" [pid 5318] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5316] <... mprotect resumed>) = 0 [pid 5315] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5074] <... unlink resumed>) = 0 [pid 5317] <... openat resumed>) = 3 [pid 5316] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5318] <... openat resumed>) = 3 [pid 5074] getdents64(3, [pid 5316] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5315] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5318] write(3, "1000", 4 [pid 5317] write(3, "1000", 4 [pid 5316] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5315] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5074] close(3 [pid 5318] <... write resumed>) = 4 [pid 5317] <... write resumed>) = 4 ./strace-static-x86_64: Process 5320 attached ./strace-static-x86_64: Process 5319 attached [pid 5318] close(3 [pid 5317] close(3 [pid 5074] <... close resumed>) = 0 [pid 5320] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5319] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5317] <... close resumed>) = 0 [pid 5316] <... clone3 resumed> => {parent_tid=[5319]}, 88) = 5319 [pid 5320] <... rseq resumed>) = 0 [pid 5319] <... rseq resumed>) = 0 [pid 5318] <... close resumed>) = 0 [pid 5317] symlink("/dev/binderfs", "./binderfs" [pid 5316] rt_sigprocmask(SIG_SETMASK, [], [pid 5315] <... clone3 resumed> => {parent_tid=[5320]}, 88) = 5320 [pid 5074] rmdir("./22" [pid 5320] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5319] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5318] symlink("/dev/binderfs", "./binderfs" [pid 5317] <... symlink resumed>) = 0 [pid 5316] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5315] rt_sigprocmask(SIG_SETMASK, [], [pid 5074] <... rmdir resumed>) = 0 [pid 5320] <... set_robust_list resumed>) = 0 [pid 5319] <... set_robust_list resumed>) = 0 [pid 5316] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5318] <... symlink resumed>) = 0 [pid 5315] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5320] rt_sigprocmask(SIG_SETMASK, [], [pid 5319] rt_sigprocmask(SIG_SETMASK, [], [pid 5316] <... futex resumed>) = 0 [pid 5315] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5320] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5319] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5316] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] mkdir("./23", 0777 [pid 5320] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5319] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5318] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5317] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5315] <... futex resumed>) = 0 [pid 5074] <... mkdir resumed>) = 0 [pid 5320] <... bpf resumed>) = 3 [pid 5319] <... bpf resumed>) = 3 [pid 5318] <... futex resumed>) = 0 [pid 5317] <... futex resumed>) = 0 [pid 5315] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5320] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5319] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5318] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5317] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5315] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5320] <... futex resumed>) = 0 [pid 5319] <... futex resumed>) = 1 [pid 5318] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5317] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5316] <... futex resumed>) = 0 [pid 5320] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5319] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5318] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5317] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5316] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5315] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5320] <... bpf resumed>) = 4 [pid 5319] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5318] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5317] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5320] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5319] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5318] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5317] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5316] <... futex resumed>) = 0 [pid 5315] <... futex resumed>) = 0 [pid 5320] <... futex resumed>) = 0 [pid 5316] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5315] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5320] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 5321 attached [pid 5319] <... bpf resumed>) = 4 [pid 5318] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5317] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5315] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5319] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5318] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5317] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5315] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5321 [pid 5321] set_robust_list(0x55555d6c46a0, 24 [pid 5320] <... futex resumed>) = 0 [pid 5319] <... futex resumed>) = 1 [pid 5318] <... mprotect resumed>) = 0 [pid 5317] <... mprotect resumed>) = 0 [pid 5316] <... futex resumed>) = 0 [pid 5315] <... futex resumed>) = 1 [pid 5321] <... set_robust_list resumed>) = 0 [pid 5321] chdir("./23" [pid 5320] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5319] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5316] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5315] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5318] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5317] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5321] <... chdir resumed>) = 0 [pid 5318] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5316] <... futex resumed>) = 0 [pid 5321] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5317] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5318] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5321] <... prctl resumed>) = 0 [pid 5317] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5316] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5322 attached [pid 5321] setpgid(0, 0 [pid 5322] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5321] <... setpgid resumed>) = 0 ./strace-static-x86_64: Process 5323 attached [pid 5322] <... rseq resumed>) = 0 [pid 5321] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5320] <... bpf resumed>) = 5 [pid 5319] <... bpf resumed>) = 5 [pid 5323] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5322] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5321] <... openat resumed>) = 3 [pid 5323] <... rseq resumed>) = 0 [pid 5322] <... set_robust_list resumed>) = 0 [pid 5321] write(3, "1000", 4 [pid 5323] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5322] rt_sigprocmask(SIG_SETMASK, [], [pid 5321] <... write resumed>) = 4 [pid 5323] <... set_robust_list resumed>) = 0 [pid 5322] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5321] close(3 [pid 5323] rt_sigprocmask(SIG_SETMASK, [], [pid 5322] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5321] <... close resumed>) = 0 [pid 5323] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5323] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5321] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5318] <... clone3 resumed> => {parent_tid=[5322]}, 88) = 5322 [pid 5321] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5320] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5319] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5318] rt_sigprocmask(SIG_SETMASK, [], [pid 5317] <... clone3 resumed> => {parent_tid=[5323]}, 88) = 5323 [pid 5321] <... futex resumed>) = 0 [pid 5321] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5318] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5317] rt_sigprocmask(SIG_SETMASK, [], [pid 5321] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5320] <... futex resumed>) = 1 [pid 5319] <... futex resumed>) = 1 [pid 5318] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5317] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5316] <... futex resumed>) = 0 [pid 5315] <... futex resumed>) = 0 [pid 5322] <... futex resumed>) = 0 [pid 5321] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5320] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5319] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5318] <... futex resumed>) = 1 [pid 5317] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5316] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5315] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5323] <... futex resumed>) = 0 [pid 5322] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5321] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5320] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5319] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5318] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5317] <... futex resumed>) = 1 [pid 5316] <... futex resumed>) = 0 [pid 5323] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5322] <... bpf resumed>) = 3 [pid 5321] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5320] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5319] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5317] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5316] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5315] <... futex resumed>) = 0 [pid 5323] <... bpf resumed>) = 3 [pid 5322] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5321] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5323] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5322] <... futex resumed>) = 1 [pid 5321] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5320] <... bpf resumed>) = 6 [pid 5318] <... futex resumed>) = 0 [pid 5315] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5323] <... futex resumed>) = 0 [pid 5322] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5321] <... mprotect resumed>) = 0 [pid 5320] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5319] <... bpf resumed>) = 6 [pid 5318] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5317] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5323] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5322] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5321] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5320] <... futex resumed>) = 0 [pid 5319] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5318] <... futex resumed>) = 0 [pid 5317] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5315] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5323] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5322] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5320] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5319] <... futex resumed>) = 1 [pid 5318] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5317] <... futex resumed>) = 0 [pid 5316] <... futex resumed>) = 0 [pid 5315] exit_group(0 [pid 5323] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5322] <... bpf resumed>) = 4 [pid 5321] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5319] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5320] <... futex resumed>) = ? [pid 5317] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5315] <... exit_group resumed>) = ? [pid 5316] exit_group(0 [pid 5323] <... bpf resumed>) = 4 [pid 5322] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5321] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5320] +++ exited with 0 +++ [pid 5319] <... futex resumed>) = ? [pid 5316] <... exit_group resumed>) = ? [pid 5323] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5322] <... futex resumed>) = 1 [pid 5318] <... futex resumed>) = 0 [pid 5323] <... futex resumed>) = 1 [pid 5322] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5321] <... clone3 resumed> => {parent_tid=[5324]}, 88) = 5324 [pid 5318] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5317] <... futex resumed>) = 0 [pid 5323] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5322] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5321] rt_sigprocmask(SIG_SETMASK, [], [pid 5319] +++ exited with 0 +++ [pid 5318] <... futex resumed>) = 0 [pid 5317] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5323] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5322] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5321] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5318] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5317] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5324 attached [pid 5323] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5322] <... bpf resumed>) = 5 [pid 5321] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5317] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5316] +++ exited with 0 +++ [pid 5324] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5316, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5324] <... rseq resumed>) = 0 [pid 5323] <... bpf resumed>) = 5 [pid 5321] <... futex resumed>) = 0 [pid 5315] +++ exited with 0 +++ [pid 5324] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5321] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5315, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5324] <... set_robust_list resumed>) = 0 [pid 5076] umount2("./23", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5324] rt_sigprocmask(SIG_SETMASK, [], [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5324] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5323] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5322] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] openat(AT_FDCWD, "./23", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5324] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5323] <... futex resumed>) = 1 [pid 5322] <... futex resumed>) = 1 [pid 5318] <... futex resumed>) = 0 [pid 5317] <... futex resumed>) = 0 [pid 5323] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5322] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5318] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5317] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... openat resumed>) = 3 [pid 5323] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5322] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5318] <... futex resumed>) = 0 [pid 5317] <... futex resumed>) = 0 [pid 5077] umount2("./23", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5324] <... bpf resumed>) = 3 [pid 5323] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5322] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5318] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5317] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5076] newfstatat(3, "", [pid 5324] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5324] <... futex resumed>) = 1 [pid 5321] <... futex resumed>) = 0 [pid 5077] openat(AT_FDCWD, "./23", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5324] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5321] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... openat resumed>) = 3 [pid 5324] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5321] <... futex resumed>) = 0 [pid 5076] getdents64(3, [pid 5324] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5321] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] newfstatat(3, "", [pid 5323] <... bpf resumed>) = 6 [pid 5322] <... bpf resumed>) = 6 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5324] <... bpf resumed>) = 4 [pid 5323] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5322] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5323] <... futex resumed>) = 1 [pid 5322] <... futex resumed>) = 1 [pid 5318] <... futex resumed>) = 0 [pid 5317] <... futex resumed>) = 0 [pid 5323] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5322] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5318] exit_group(0 [pid 5317] exit_group(0 [pid 5323] <... futex resumed>) = ? [pid 5322] <... futex resumed>) = ? [pid 5318] <... exit_group resumed>) = ? [pid 5317] <... exit_group resumed>) = ? [pid 5324] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5323] +++ exited with 0 +++ [pid 5322] +++ exited with 0 +++ [pid 5077] getdents64(3, [pid 5076] umount2("./23/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5324] <... futex resumed>) = 1 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5324] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5321] <... futex resumed>) = 0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5076] newfstatat(AT_FDCWD, "./23/binderfs", [pid 5321] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] umount2("./23/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5324] <... futex resumed>) = 0 [pid 5321] <... futex resumed>) = 1 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] unlink("./23/binderfs" [pid 5324] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5321] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] newfstatat(AT_FDCWD, "./23/binderfs", [pid 5076] <... unlink resumed>) = 0 [pid 5076] getdents64(3, [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5076] close(3) = 0 [pid 5324] <... bpf resumed>) = 5 [pid 5076] rmdir("./23" [pid 5324] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5318] +++ exited with 0 +++ [pid 5317] +++ exited with 0 +++ [pid 5077] unlink("./23/binderfs" [pid 5324] <... futex resumed>) = 1 [pid 5321] <... futex resumed>) = 0 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5317, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5077] <... unlink resumed>) = 0 [pid 5076] <... rmdir resumed>) = 0 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5318, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5321] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5321] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5324] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5077] getdents64(3, 0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5076] mkdir("./24", 0777 [pid 5078] umount2("./25", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5077] close(3 [pid 5075] umount2("./24", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5077] <... close resumed>) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5078] openat(AT_FDCWD, "./25", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5077] rmdir("./23" [pid 5075] openat(AT_FDCWD, "./24", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5078] newfstatat(3, "", [pid 5077] <... rmdir resumed>) = 0 [pid 5076] <... mkdir resumed>) = 0 [pid 5075] <... openat resumed>) = 3 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5078] getdents64(3, [pid 5075] newfstatat(3, "", [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5078] umount2("./25/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5077] mkdir("./24", 0777 [pid 5075] getdents64(3, [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5077] <... mkdir resumed>) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5078] newfstatat(AT_FDCWD, "./25/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 ./strace-static-x86_64: Process 5325 attached [pid 5324] <... bpf resumed>) = 6 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5325 [pid 5075] umount2("./24/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5325] set_robust_list(0x55555d6c46a0, 24 [pid 5324] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] unlink("./25/binderfs" [pid 5325] <... set_robust_list resumed>) = 0 [pid 5324] <... futex resumed>) = 1 [pid 5321] <... futex resumed>) = 0 [pid 5078] <... unlink resumed>) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5324] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5321] exit_group(0 [pid 5078] getdents64(3, [pid 5075] newfstatat(AT_FDCWD, "./24/binderfs", ./strace-static-x86_64: Process 5326 attached [pid 5325] chdir("./24" [pid 5324] <... futex resumed>) = ? [pid 5321] <... exit_group resumed>) = ? [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5326] set_robust_list(0x55555d6c46a0, 24 [pid 5325] <... chdir resumed>) = 0 [pid 5078] close(3 [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5326 [pid 5075] unlink("./24/binderfs" [pid 5326] <... set_robust_list resumed>) = 0 [pid 5325] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5326] chdir("./24" [pid 5325] <... prctl resumed>) = 0 [pid 5325] setpgid(0, 0 [pid 5326] <... chdir resumed>) = 0 [pid 5326] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5325] <... setpgid resumed>) = 0 [pid 5326] <... prctl resumed>) = 0 [pid 5325] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5324] +++ exited with 0 +++ [pid 5321] +++ exited with 0 +++ [pid 5326] setpgid(0, 0 [pid 5075] <... unlink resumed>) = 0 [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5321, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5078] <... close resumed>) = 0 [pid 5326] <... setpgid resumed>) = 0 [pid 5326] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5078] rmdir("./25" [pid 5075] getdents64(3, [pid 5326] <... openat resumed>) = 3 [pid 5325] <... openat resumed>) = 3 [pid 5078] <... rmdir resumed>) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5075] close(3) = 0 [pid 5075] rmdir("./24" [pid 5326] write(3, "1000", 4 [pid 5325] write(3, "1000", 4 [pid 5078] mkdir("./26", 0777 [pid 5074] umount2("./23", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5326] <... write resumed>) = 4 [pid 5325] <... write resumed>) = 4 [pid 5078] <... mkdir resumed>) = 0 [pid 5075] <... rmdir resumed>) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5326] close(3 [pid 5325] close(3 [pid 5075] mkdir("./25", 0777 [pid 5326] <... close resumed>) = 0 [pid 5325] <... close resumed>) = 0 [pid 5074] openat(AT_FDCWD, "./23", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5326] symlink("/dev/binderfs", "./binderfs" [pid 5074] <... openat resumed>) = 3 [pid 5075] <... mkdir resumed>) = 0 [pid 5325] symlink("/dev/binderfs", "./binderfs" [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] newfstatat(3, "", [pid 5326] <... symlink resumed>) = 0 ./strace-static-x86_64: Process 5328 attached ./strace-static-x86_64: Process 5327 attached [pid 5326] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5325] <... symlink resumed>) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5325] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5328] set_robust_list(0x55555d6c46a0, 24 [pid 5327] set_robust_list(0x55555d6c46a0, 24 [pid 5326] <... futex resumed>) = 0 [pid 5325] <... futex resumed>) = 0 [pid 5328] <... set_robust_list resumed>) = 0 [pid 5327] <... set_robust_list resumed>) = 0 [pid 5326] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5325] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5326] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5328] chdir("./25" [pid 5327] chdir("./26" [pid 5325] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5327 [pid 5326] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5328 [pid 5074] getdents64(3, [pid 5328] <... chdir resumed>) = 0 [pid 5327] <... chdir resumed>) = 0 [pid 5326] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5325] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5328] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5327] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5326] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5325] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5074] umount2("./23/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5328] <... prctl resumed>) = 0 [pid 5327] <... prctl resumed>) = 0 [pid 5326] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5325] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5328] setpgid(0, 0 [pid 5327] setpgid(0, 0 [pid 5325] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5326] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5328] <... setpgid resumed>) = 0 [pid 5327] <... setpgid resumed>) = 0 [pid 5326] <... mprotect resumed>) = 0 [pid 5325] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5074] newfstatat(AT_FDCWD, "./23/binderfs", [pid 5328] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5327] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5326] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5074] unlink("./23/binderfs" [pid 5328] <... openat resumed>) = 3 [pid 5328] write(3, "1000", 4 [pid 5327] <... openat resumed>) = 3 [pid 5326] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5325] <... mprotect resumed>) = 0 [pid 5074] <... unlink resumed>) = 0 [pid 5326] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5074] getdents64(3, ./strace-static-x86_64: Process 5329 attached [pid 5328] <... write resumed>) = 4 [pid 5327] write(3, "1000", 4 [pid 5325] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5329] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5328] close(3 [pid 5327] <... write resumed>) = 4 [pid 5325] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5329] <... rseq resumed>) = 0 [pid 5328] <... close resumed>) = 0 [pid 5327] close(3 [pid 5326] <... clone3 resumed> => {parent_tid=[5329]}, 88) = 5329 [pid 5325] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5074] close(3./strace-static-x86_64: Process 5330 attached [pid 5329] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5328] symlink("/dev/binderfs", "./binderfs" [pid 5327] <... close resumed>) = 0 [pid 5326] rt_sigprocmask(SIG_SETMASK, [], [pid 5329] <... set_robust_list resumed>) = 0 [pid 5326] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5329] rt_sigprocmask(SIG_SETMASK, [], [pid 5327] symlink("/dev/binderfs", "./binderfs" [pid 5326] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5325] <... clone3 resumed> => {parent_tid=[5330]}, 88) = 5330 [pid 5074] <... close resumed>) = 0 [pid 5330] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5329] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5328] <... symlink resumed>) = 0 [pid 5327] <... symlink resumed>) = 0 [pid 5326] <... futex resumed>) = 0 [pid 5325] rt_sigprocmask(SIG_SETMASK, [], [pid 5074] rmdir("./23" [pid 5330] <... rseq resumed>) = 0 [pid 5329] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5328] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5327] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5326] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5325] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5074] <... rmdir resumed>) = 0 [pid 5330] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5327] <... futex resumed>) = 0 [pid 5325] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5330] <... set_robust_list resumed>) = 0 [pid 5327] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5325] <... futex resumed>) = 0 [pid 5330] rt_sigprocmask(SIG_SETMASK, [], [pid 5329] <... bpf resumed>) = 3 [pid 5328] <... futex resumed>) = 0 [pid 5327] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5325] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] mkdir("./24", 0777 [pid 5330] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5329] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5328] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5327] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5074] <... mkdir resumed>) = 0 [pid 5330] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5329] <... futex resumed>) = 1 [pid 5328] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5327] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5326] <... futex resumed>) = 0 [pid 5329] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5328] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5326] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5330] <... bpf resumed>) = 3 [pid 5329] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5328] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5330] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5326] <... futex resumed>) = 0 [pid 5328] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5330] <... futex resumed>) = 1 [pid 5329] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5327] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5326] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5325] <... futex resumed>) = 0 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5328] <... mmap resumed>) = 0x7f3e2f5ed000 ./strace-static-x86_64: Process 5331 attached [pid 5330] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5329] <... bpf resumed>) = 4 [pid 5328] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5327] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5325] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5331] set_robust_list(0x55555d6c46a0, 24 [pid 5330] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5329] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5328] <... mprotect resumed>) = 0 [pid 5327] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5325] <... futex resumed>) = 0 [pid 5329] <... futex resumed>) = 1 [pid 5326] <... futex resumed>) = 0 [pid 5330] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5329] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5326] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5331] <... set_robust_list resumed>) = 0 [pid 5328] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5326] <... futex resumed>) = 0 [pid 5329] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5327] <... mprotect resumed>) = 0 [pid 5331] chdir("./24" [pid 5326] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5325] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5331 [pid 5330] <... bpf resumed>) = 4 [pid 5329] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5328] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5327] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5331] <... chdir resumed>) = 0 [pid 5327] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5327] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5328] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5331] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5330] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5332 attached [pid 5331] <... prctl resumed>) = 0 [pid 5330] <... futex resumed>) = 1 [pid 5325] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5333 attached [pid 5332] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5331] setpgid(0, 0 [pid 5330] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5327] <... clone3 resumed> => {parent_tid=[5332]}, 88) = 5332 [pid 5325] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5329] <... bpf resumed>) = 5 [pid 5333] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5332] <... rseq resumed>) = 0 [pid 5331] <... setpgid resumed>) = 0 [pid 5327] rt_sigprocmask(SIG_SETMASK, [], [pid 5325] <... futex resumed>) = 0 [pid 5333] <... rseq resumed>) = 0 [pid 5332] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5327] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5325] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5330] <... bpf resumed>) = 5 [pid 5328] <... clone3 resumed> => {parent_tid=[5333]}, 88) = 5333 [pid 5333] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5332] <... set_robust_list resumed>) = 0 [pid 5331] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5329] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5327] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5333] <... set_robust_list resumed>) = 0 [pid 5332] rt_sigprocmask(SIG_SETMASK, [], [pid 5327] <... futex resumed>) = 0 [pid 5333] rt_sigprocmask(SIG_SETMASK, [], [pid 5332] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5327] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5333] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5333] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5332] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 3 [pid 5331] <... openat resumed>) = 3 [pid 5330] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5329] <... futex resumed>) = 1 [pid 5328] rt_sigprocmask(SIG_SETMASK, [], [pid 5326] <... futex resumed>) = 0 [pid 5332] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5331] write(3, "1000", 4 [pid 5330] <... futex resumed>) = 1 [pid 5329] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5328] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5326] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5325] <... futex resumed>) = 0 [pid 5332] <... futex resumed>) = 1 [pid 5331] <... write resumed>) = 4 [pid 5330] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5329] <... bpf resumed>) = 6 [pid 5328] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5327] <... futex resumed>) = 0 [pid 5326] <... futex resumed>) = 0 [pid 5325] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5333] <... futex resumed>) = 0 [pid 5332] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5331] close(3 [pid 5330] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5329] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5328] <... futex resumed>) = 1 [pid 5327] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5326] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5325] <... futex resumed>) = 0 [pid 5333] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5332] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5331] <... close resumed>) = 0 [pid 5330] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5329] <... futex resumed>) = 0 [pid 5328] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5327] <... futex resumed>) = 0 [pid 5326] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5325] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5331] symlink("/dev/binderfs", "./binderfs" [pid 5326] exit_group(0 [pid 5330] <... bpf resumed>) = 6 [pid 5326] <... exit_group resumed>) = ? [pid 5330] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5333] <... bpf resumed>) = 3 [pid 5332] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5327] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5325] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5333] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5332] <... bpf resumed>) = 4 [pid 5330] <... futex resumed>) = 0 [pid 5325] exit_group(0 [pid 5333] <... futex resumed>) = 1 [pid 5332] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5331] <... symlink resumed>) = 0 [pid 5325] <... exit_group resumed>) = ? [pid 5333] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5332] <... futex resumed>) = 1 [pid 5327] <... futex resumed>) = 0 [pid 5332] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5327] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5332] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5331] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5328] <... futex resumed>) = 0 [pid 5327] <... futex resumed>) = 0 [pid 5332] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5331] <... futex resumed>) = 0 [pid 5328] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5327] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5332] <... bpf resumed>) = 5 [pid 5332] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5333] <... futex resumed>) = 0 [pid 5331] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5330] +++ exited with 0 +++ [pid 5329] +++ exited with 0 +++ [pid 5328] <... futex resumed>) = 1 [pid 5326] +++ exited with 0 +++ [pid 5325] +++ exited with 0 +++ [pid 5333] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5332] <... futex resumed>) = 1 [pid 5331] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5328] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5327] <... futex resumed>) = 0 [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5326, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5333] <... bpf resumed>) = 4 [pid 5332] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5331] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5327] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5325, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5333] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5332] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5331] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5327] <... futex resumed>) = 0 [pid 5333] <... futex resumed>) = 1 [pid 5332] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5331] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5328] <... futex resumed>) = 0 [pid 5327] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] umount2("./24", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5333] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5332] <... bpf resumed>) = 6 [pid 5331] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5328] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] umount2("./24", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5333] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5332] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5331] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5328] <... futex resumed>) = 0 [pid 5077] openat(AT_FDCWD, "./24", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5333] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5332] <... futex resumed>) = 1 [pid 5331] <... mprotect resumed>) = 0 [pid 5328] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5327] <... futex resumed>) = 0 [pid 5332] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5333] <... bpf resumed>) = 5 [pid 5331] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5327] exit_group(0 [pid 5077] <... openat resumed>) = 3 [pid 5076] openat(AT_FDCWD, "./24", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5331] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5327] <... exit_group resumed>) = ? [pid 5076] <... openat resumed>) = 3 [pid 5333] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5332] <... futex resumed>) = ? [pid 5331] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5077] newfstatat(3, "", [pid 5076] newfstatat(3, "", [pid 5333] <... futex resumed>) = 1 [pid 5328] <... futex resumed>) = 0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 ./strace-static-x86_64: Process 5334 attached [pid 5333] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5331] <... clone3 resumed> => {parent_tid=[5334]}, 88) = 5334 [pid 5328] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] getdents64(3, [pid 5076] getdents64(3, [pid 5334] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5333] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5331] rt_sigprocmask(SIG_SETMASK, [], [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5334] <... rseq resumed>) = 0 [pid 5333] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5331] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5328] <... futex resumed>) = 0 [pid 5077] umount2("./24/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] umount2("./24/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5334] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5333] <... bpf resumed>) = 6 [pid 5331] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5334] <... set_robust_list resumed>) = 0 [pid 5331] <... futex resumed>) = 0 [pid 5328] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5076] newfstatat(AT_FDCWD, "./24/binderfs", [pid 5334] rt_sigprocmask(SIG_SETMASK, [], [pid 5333] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5331] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5328] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5077] newfstatat(AT_FDCWD, "./24/binderfs", [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5334] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5328] exit_group(0 [pid 5333] <... futex resumed>) = ? [pid 5334] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5328] <... exit_group resumed>) = ? [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5076] unlink("./24/binderfs" [pid 5334] <... bpf resumed>) = 3 [pid 5333] +++ exited with 0 +++ [pid 5077] unlink("./24/binderfs" [pid 5076] <... unlink resumed>) = 0 [pid 5077] <... unlink resumed>) = 0 [pid 5076] getdents64(3, 0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5076] close(3 [pid 5077] getdents64(3, [pid 5076] <... close resumed>) = 0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5077] close(3 [pid 5076] rmdir("./24" [pid 5077] <... close resumed>) = 0 [pid 5334] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5332] +++ exited with 0 +++ [pid 5328] +++ exited with 0 +++ [pid 5327] +++ exited with 0 +++ [pid 5077] rmdir("./24" [pid 5076] <... rmdir resumed>) = 0 [pid 5334] <... futex resumed>) = 1 [pid 5331] <... futex resumed>) = 0 [pid 5077] <... rmdir resumed>) = 0 [pid 5076] mkdir("./25", 0777 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5328, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5334] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5331] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5334] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5331] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5327, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5076] <... mkdir resumed>) = 0 [pid 5334] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 4 [pid 5078] umount2("./26", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5077] mkdir("./25", 0777 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5077] <... mkdir resumed>) = 0 [pid 5078] openat(AT_FDCWD, "./26", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5075] umount2("./25", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5334] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... openat resumed>) = 3 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5336 attached ./strace-static-x86_64: Process 5335 attached [pid 5334] <... futex resumed>) = 1 [pid 5331] <... futex resumed>) = 0 [pid 5078] newfstatat(3, "", [pid 5075] openat(AT_FDCWD, "./25", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5335] set_robust_list(0x55555d6c46a0, 24 [pid 5334] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5331] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5334] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5331] <... futex resumed>) = 0 [pid 5075] <... openat resumed>) = 3 [pid 5336] set_robust_list(0x55555d6c46a0, 24 [pid 5335] <... set_robust_list resumed>) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5075] newfstatat(3, "", [pid 5336] <... set_robust_list resumed>) = 0 [pid 5335] chdir("./25" [pid 5334] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5331] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] getdents64(3, [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5335 [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5336 [pid 5336] chdir("./25" [pid 5335] <... chdir resumed>) = 0 [pid 5334] <... bpf resumed>) = 5 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5336] <... chdir resumed>) = 0 [pid 5335] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5334] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] umount2("./26/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] getdents64(3, [pid 5336] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5335] <... prctl resumed>) = 0 [pid 5334] <... futex resumed>) = 1 [pid 5331] <... futex resumed>) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5336] <... prctl resumed>) = 0 [pid 5335] setpgid(0, 0 [pid 5334] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5331] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] newfstatat(AT_FDCWD, "./26/binderfs", [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5336] setpgid(0, 0 [pid 5335] <... setpgid resumed>) = 0 [pid 5334] <... bpf resumed>) = 6 [pid 5331] <... futex resumed>) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5336] <... setpgid resumed>) = 0 [pid 5335] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5331] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] unlink("./26/binderfs" [pid 5075] umount2("./25/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5336] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5334] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5331] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5334] <... futex resumed>) = 0 [pid 5331] exit_group(0 [pid 5078] <... unlink resumed>) = 0 [pid 5336] <... openat resumed>) = 3 [pid 5335] <... openat resumed>) = 3 [pid 5331] <... exit_group resumed>) = ? [pid 5078] getdents64(3, [pid 5075] newfstatat(AT_FDCWD, "./25/binderfs", [pid 5336] write(3, "1000", 4 [pid 5335] write(3, "1000", 4 [pid 5334] +++ exited with 0 +++ [pid 5331] +++ exited with 0 +++ [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5336] <... write resumed>) = 4 [pid 5335] <... write resumed>) = 4 [pid 5078] close(3 [pid 5075] unlink("./25/binderfs" [pid 5336] close(3 [pid 5335] close(3 [pid 5078] <... close resumed>) = 0 [pid 5075] <... unlink resumed>) = 0 [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5331, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5074] restart_syscall(<... resuming interrupted clone ...> [pid 5336] <... close resumed>) = 0 [pid 5335] <... close resumed>) = 0 [pid 5078] rmdir("./26" [pid 5075] getdents64(3, [pid 5074] <... restart_syscall resumed>) = 0 [pid 5336] symlink("/dev/binderfs", "./binderfs" [pid 5335] symlink("/dev/binderfs", "./binderfs" [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5336] <... symlink resumed>) = 0 [pid 5075] close(3 [pid 5078] <... rmdir resumed>) = 0 [pid 5335] <... symlink resumed>) = 0 [pid 5078] mkdir("./27", 0777 [pid 5336] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... close resumed>) = 0 [pid 5074] umount2("./24", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5336] <... futex resumed>) = 0 [pid 5335] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... mkdir resumed>) = 0 [pid 5075] rmdir("./25" [pid 5336] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5335] <... futex resumed>) = 0 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] openat(AT_FDCWD, "./24", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5336] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5335] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5336] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5074] <... openat resumed>) = 3 [pid 5074] newfstatat(3, "", ./strace-static-x86_64: Process 5337 attached [pid 5336] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5335] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5337] set_robust_list(0x55555d6c46a0, 24 [pid 5336] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5335] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5337 [pid 5075] <... rmdir resumed>) = 0 [pid 5337] <... set_robust_list resumed>) = 0 [pid 5336] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5335] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5074] getdents64(3, [pid 5337] chdir("./27" [pid 5336] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5335] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5075] mkdir("./26", 0777 [pid 5337] <... chdir resumed>) = 0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5075] <... mkdir resumed>) = 0 [pid 5074] umount2("./24/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5337] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5336] <... mprotect resumed>) = 0 [pid 5335] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5337] <... prctl resumed>) = 0 [pid 5336] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5335] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5337] setpgid(0, 0 [pid 5335] <... mprotect resumed>) = 0 [pid 5074] newfstatat(AT_FDCWD, "./24/binderfs", [pid 5337] <... setpgid resumed>) = 0 [pid 5336] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5335] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5336] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 ./strace-static-x86_64: Process 5338 attached [pid 5337] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5335] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5074] unlink("./24/binderfs"./strace-static-x86_64: Process 5339 attached [pid 5338] set_robust_list(0x55555d6c46a0, 24 [pid 5337] <... openat resumed>) = 3 [pid 5335] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5338 [pid 5074] <... unlink resumed>) = 0 ./strace-static-x86_64: Process 5340 attached [pid 5339] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5338] <... set_robust_list resumed>) = 0 [pid 5337] write(3, "1000", 4 [pid 5336] <... clone3 resumed> => {parent_tid=[5339]}, 88) = 5339 [pid 5340] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5339] <... rseq resumed>) = 0 [pid 5337] <... write resumed>) = 4 [pid 5336] rt_sigprocmask(SIG_SETMASK, [], [pid 5335] <... clone3 resumed> => {parent_tid=[5340]}, 88) = 5340 [pid 5340] <... rseq resumed>) = 0 [pid 5339] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5337] close(3 [pid 5336] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5335] rt_sigprocmask(SIG_SETMASK, [], [pid 5340] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5339] <... set_robust_list resumed>) = 0 [pid 5337] <... close resumed>) = 0 [pid 5336] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5335] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5340] <... set_robust_list resumed>) = 0 [pid 5339] rt_sigprocmask(SIG_SETMASK, [], [pid 5337] symlink("/dev/binderfs", "./binderfs" [pid 5336] <... futex resumed>) = 0 [pid 5335] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5340] rt_sigprocmask(SIG_SETMASK, [], [pid 5339] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5340] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5338] chdir("./26" [pid 5337] <... symlink resumed>) = 0 [pid 5336] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] getdents64(3, [pid 5335] <... futex resumed>) = 0 [pid 5339] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5340] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5338] <... chdir resumed>) = 0 [pid 5337] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5335] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5340] <... bpf resumed>) = 3 [pid 5339] <... bpf resumed>) = 3 [pid 5338] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5337] <... futex resumed>) = 0 [pid 5074] close(3 [pid 5340] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5339] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5338] <... prctl resumed>) = 0 [pid 5337] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5074] <... close resumed>) = 0 [pid 5340] <... futex resumed>) = 1 [pid 5339] <... futex resumed>) = 1 [pid 5338] setpgid(0, 0 [pid 5337] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5336] <... futex resumed>) = 0 [pid 5335] <... futex resumed>) = 0 [pid 5074] rmdir("./24" [pid 5340] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5339] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5338] <... setpgid resumed>) = 0 [pid 5337] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5336] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5335] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... rmdir resumed>) = 0 [pid 5340] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5339] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5338] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5074] mkdir("./25", 0777 [pid 5340] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5339] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5338] <... openat resumed>) = 3 [pid 5337] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5336] <... futex resumed>) = 0 [pid 5335] <... futex resumed>) = 0 [pid 5074] <... mkdir resumed>) = 0 [pid 5335] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5337] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5340] <... bpf resumed>) = 4 [pid 5339] <... bpf resumed>) = 4 [pid 5338] write(3, "1000", 4 [pid 5340] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5337] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5336] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5339] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5340] <... futex resumed>) = 1 [pid 5339] <... futex resumed>) = 0 [pid 5337] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5336] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5335] <... futex resumed>) = 0 [pid 5340] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5339] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5336] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5335] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5340] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5339] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5337] <... mprotect resumed>) = 0 [pid 5336] <... futex resumed>) = 0 [pid 5335] <... futex resumed>) = 0 [pid 5340] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5339] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5335] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5337] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5336] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5341 attached [pid 5340] <... bpf resumed>) = 5 [pid 5339] <... bpf resumed>) = 5 [pid 5338] <... write resumed>) = 4 [pid 5337] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5341] set_robust_list(0x55555d6c46a0, 24 [pid 5340] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5339] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5338] close(3 [pid 5337] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5341 [pid 5341] <... set_robust_list resumed>) = 0 [pid 5340] <... futex resumed>) = 1 [pid 5339] <... futex resumed>) = 1 [pid 5338] <... close resumed>) = 0 [pid 5336] <... futex resumed>) = 0 [pid 5335] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5342 attached [pid 5341] chdir("./25" [pid 5340] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5339] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5338] symlink("/dev/binderfs", "./binderfs" [pid 5336] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5335] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5342] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5341] <... chdir resumed>) = 0 [pid 5340] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5339] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5338] <... symlink resumed>) = 0 [pid 5337] <... clone3 resumed> => {parent_tid=[5342]}, 88) = 5342 [pid 5336] <... futex resumed>) = 0 [pid 5335] <... futex resumed>) = 0 [pid 5342] <... rseq resumed>) = 0 [pid 5341] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5340] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5339] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5338] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5337] rt_sigprocmask(SIG_SETMASK, [], [pid 5336] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5335] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5342] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5341] <... prctl resumed>) = 0 [pid 5340] <... bpf resumed>) = 6 [pid 5339] <... bpf resumed>) = 6 [pid 5338] <... futex resumed>) = 0 [pid 5337] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5342] <... set_robust_list resumed>) = 0 [pid 5341] setpgid(0, 0 [pid 5340] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5339] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5338] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5337] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5342] rt_sigprocmask(SIG_SETMASK, [], [pid 5341] <... setpgid resumed>) = 0 [pid 5340] <... futex resumed>) = 1 [pid 5339] <... futex resumed>) = 1 [pid 5338] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5337] <... futex resumed>) = 0 [pid 5336] <... futex resumed>) = 0 [pid 5335] <... futex resumed>) = 0 [pid 5342] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5341] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5340] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5339] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5338] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5337] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5336] exit_group(0 [pid 5335] exit_group(0 [pid 5342] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5341] <... openat resumed>) = 3 [pid 5340] <... futex resumed>) = ? [pid 5339] <... futex resumed>) = ? [pid 5338] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5336] <... exit_group resumed>) = ? [pid 5335] <... exit_group resumed>) = ? [pid 5340] +++ exited with 0 +++ [pid 5342] <... bpf resumed>) = 3 [pid 5339] +++ exited with 0 +++ [pid 5338] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5342] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5342] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5341] write(3, "1000", 4 [pid 5338] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5337] <... futex resumed>) = 0 [pid 5338] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5337] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5342] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5338] <... mprotect resumed>) = 0 [pid 5337] <... futex resumed>) = 0 [pid 5336] +++ exited with 0 +++ [pid 5342] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5341] <... write resumed>) = 4 [pid 5338] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5337] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5342] <... bpf resumed>) = 4 [pid 5341] close(3 [pid 5338] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5335] +++ exited with 0 +++ [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5336, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5342] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5341] <... close resumed>) = 0 [pid 5338] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5076] umount2("./25", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5343 attached [pid 5342] <... futex resumed>) = 1 [pid 5341] symlink("/dev/binderfs", "./binderfs" [pid 5337] <... futex resumed>) = 0 [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5335, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5343] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5342] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5341] <... symlink resumed>) = 0 [pid 5338] <... clone3 resumed> => {parent_tid=[5343]}, 88) = 5343 [pid 5337] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] restart_syscall(<... resuming interrupted clone ...> [pid 5076] openat(AT_FDCWD, "./25", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5343] <... rseq resumed>) = 0 [pid 5342] <... bpf resumed>) = 5 [pid 5341] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5338] rt_sigprocmask(SIG_SETMASK, [], [pid 5337] <... futex resumed>) = 0 [pid 5077] <... restart_syscall resumed>) = 0 [pid 5342] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... openat resumed>) = 3 [pid 5342] <... futex resumed>) = 0 [pid 5076] newfstatat(3, "", [pid 5343] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5341] <... futex resumed>) = 0 [pid 5338] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5342] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5337] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5343] <... set_robust_list resumed>) = 0 [pid 5341] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5338] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5337] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5077] umount2("./25", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] getdents64(3, [pid 5343] rt_sigprocmask(SIG_SETMASK, [], [pid 5341] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5338] <... futex resumed>) = 0 [pid 5337] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5343] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5342] <... futex resumed>) = 0 [pid 5341] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5338] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5337] <... futex resumed>) = 1 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5343] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5342] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5341] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5337] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] openat(AT_FDCWD, "./25", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5076] umount2("./25/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5343] <... bpf resumed>) = 3 [pid 5341] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5343] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5341] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5077] <... openat resumed>) = 3 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5343] <... futex resumed>) = 1 [pid 5341] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5338] <... futex resumed>) = 0 [pid 5076] newfstatat(AT_FDCWD, "./25/binderfs", [pid 5343] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5341] <... mprotect resumed>) = 0 [pid 5338] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] newfstatat(3, "", [pid 5343] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5338] <... futex resumed>) = 0 [pid 5341] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5343] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5342] <... bpf resumed>) = 6 [pid 5341] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5338] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] getdents64(3, [pid 5076] unlink("./25/binderfs" [pid 5343] <... bpf resumed>) = 4 [pid 5342] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5341] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5076] <... unlink resumed>) = 0 [pid 5343] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5342] <... futex resumed>) = 1 [pid 5337] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5344 attached [pid 5342] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5338] <... futex resumed>) = 0 [pid 5077] umount2("./25/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5337] exit_group(0 [pid 5076] getdents64(3, [pid 5343] <... futex resumed>) = 1 [pid 5343] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5342] <... futex resumed>) = ? [pid 5341] <... clone3 resumed> => {parent_tid=[5344]}, 88) = 5344 [pid 5338] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5344] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5337] <... exit_group resumed>) = ? [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5342] +++ exited with 0 +++ [pid 5343] <... bpf resumed>) = 5 [pid 5341] rt_sigprocmask(SIG_SETMASK, [], [pid 5338] <... futex resumed>) = 0 [pid 5344] <... rseq resumed>) = 0 [pid 5077] newfstatat(AT_FDCWD, "./25/binderfs", [pid 5076] close(3 [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5076] <... close resumed>) = 0 [pid 5077] unlink("./25/binderfs" [pid 5076] rmdir("./25" [pid 5337] +++ exited with 0 +++ [pid 5344] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5343] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5341] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5338] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5337, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5077] <... unlink resumed>) = 0 [pid 5076] <... rmdir resumed>) = 0 [pid 5344] <... set_robust_list resumed>) = 0 [pid 5343] <... futex resumed>) = 0 [pid 5341] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5338] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5344] rt_sigprocmask(SIG_SETMASK, [], [pid 5343] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5341] <... futex resumed>) = 0 [pid 5338] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5344] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5343] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5341] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5338] <... futex resumed>) = 0 [pid 5344] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5343] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5338] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] getdents64(3, [pid 5076] mkdir("./26", 0777 [pid 5344] <... bpf resumed>) = 3 [pid 5078] umount2("./27", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5076] <... mkdir resumed>) = 0 [pid 5344] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5077] close(3 [pid 5344] <... futex resumed>) = 1 [pid 5341] <... futex resumed>) = 0 [pid 5078] openat(AT_FDCWD, "./27", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5077] <... close resumed>) = 0 [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5344] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5341] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... openat resumed>) = 3 [pid 5077] rmdir("./25"./strace-static-x86_64: Process 5345 attached [pid 5344] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5341] <... futex resumed>) = 0 [pid 5078] newfstatat(3, "", [pid 5077] <... rmdir resumed>) = 0 [pid 5345] set_robust_list(0x55555d6c46a0, 24 [pid 5344] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5341] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5345] <... set_robust_list resumed>) = 0 [pid 5344] <... bpf resumed>) = 4 [pid 5078] getdents64(3, [pid 5077] mkdir("./26", 0777 [pid 5345] chdir("./26" [pid 5344] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5077] <... mkdir resumed>) = 0 [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5345 [pid 5345] <... chdir resumed>) = 0 [pid 5344] <... futex resumed>) = 1 [pid 5341] <... futex resumed>) = 0 [pid 5078] umount2("./27/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5345] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5344] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5341] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5345] <... prctl resumed>) = 0 [pid 5344] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5341] <... futex resumed>) = 0 [pid 5345] setpgid(0, 0 [pid 5344] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5341] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5346 attached [pid 5345] <... setpgid resumed>) = 0 [pid 5344] <... bpf resumed>) = 5 [pid 5343] <... bpf resumed>) = 6 [pid 5078] newfstatat(AT_FDCWD, "./27/binderfs", [pid 5346] set_robust_list(0x55555d6c46a0, 24 [pid 5345] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5344] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5343] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5346] <... set_robust_list resumed>) = 0 [pid 5344] <... futex resumed>) = 1 [pid 5343] <... futex resumed>) = 1 [pid 5341] <... futex resumed>) = 0 [pid 5338] <... futex resumed>) = 0 [pid 5346] chdir("./26" [pid 5344] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5343] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5341] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5338] exit_group(0 [pid 5078] unlink("./27/binderfs" [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5346 [pid 5346] <... chdir resumed>) = 0 [pid 5345] <... openat resumed>) = 3 [pid 5344] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5343] <... futex resumed>) = ? [pid 5341] <... futex resumed>) = 0 [pid 5338] <... exit_group resumed>) = ? [pid 5078] <... unlink resumed>) = 0 [pid 5346] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5345] write(3, "1000", 4 [pid 5344] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5343] +++ exited with 0 +++ [pid 5341] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] getdents64(3, 0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5346] <... prctl resumed>) = 0 [pid 5345] <... write resumed>) = 4 [pid 5078] close(3 [pid 5345] close(3 [pid 5344] <... bpf resumed>) = 6 [pid 5346] setpgid(0, 0 [pid 5345] <... close resumed>) = 0 [pid 5078] <... close resumed>) = 0 [pid 5346] <... setpgid resumed>) = 0 [pid 5345] symlink("/dev/binderfs", "./binderfs" [pid 5344] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] rmdir("./27" [pid 5346] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5345] <... symlink resumed>) = 0 [pid 5344] <... futex resumed>) = 1 [pid 5341] <... futex resumed>) = 0 [pid 5078] <... rmdir resumed>) = 0 [pid 5345] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5344] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5341] exit_group(0 [pid 5346] <... openat resumed>) = 3 [pid 5345] <... futex resumed>) = 0 [pid 5344] <... futex resumed>) = ? [pid 5341] <... exit_group resumed>) = ? [pid 5078] mkdir("./28", 0777 [pid 5344] +++ exited with 0 +++ [pid 5078] <... mkdir resumed>) = 0 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5346] write(3, "1000", 4 [pid 5345] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5341] +++ exited with 0 +++ [pid 5338] +++ exited with 0 +++ [pid 5345] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5345] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5341, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5345] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5345] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f3e2f5ed000 [pid 5345] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5345] rt_sigprocmask(SIG_BLOCK, ~[], ./strace-static-x86_64: Process 5347 attached [pid 5346] <... write resumed>) = 4 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5338, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5346] close(3 [pid 5347] set_robust_list(0x55555d6c46a0, 24 [pid 5345] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5347] <... set_robust_list resumed>) = 0 [pid 5346] <... close resumed>) = 0 [pid 5345] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5347 [pid 5074] umount2("./25", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5348 attached [pid 5347] chdir("./28" [pid 5346] symlink("/dev/binderfs", "./binderfs" [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5348] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5347] <... chdir resumed>) = 0 [pid 5346] <... symlink resumed>) = 0 [pid 5345] <... clone3 resumed> => {parent_tid=[5348]}, 88) = 5348 [pid 5075] umount2("./26", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] openat(AT_FDCWD, "./25", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5348] <... rseq resumed>) = 0 [pid 5347] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5346] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5345] rt_sigprocmask(SIG_SETMASK, [], [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] <... openat resumed>) = 3 [pid 5348] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5347] <... prctl resumed>) = 0 [pid 5346] <... futex resumed>) = 0 [pid 5345] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] openat(AT_FDCWD, "./26", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5074] newfstatat(3, "", [pid 5348] <... set_robust_list resumed>) = 0 [pid 5347] setpgid(0, 0 [pid 5346] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5345] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... openat resumed>) = 3 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5348] rt_sigprocmask(SIG_SETMASK, [], [pid 5347] <... setpgid resumed>) = 0 [pid 5346] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5345] <... futex resumed>) = 0 [pid 5074] getdents64(3, [pid 5348] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5347] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5346] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5345] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] newfstatat(3, "", [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5348] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5346] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5074] umount2("./25/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5348] <... bpf resumed>) = 3 [pid 5347] <... openat resumed>) = 3 [pid 5346] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5075] getdents64(3, [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5348] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5347] write(3, "1000", 4 [pid 5346] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5074] newfstatat(AT_FDCWD, "./25/binderfs", [pid 5348] <... futex resumed>) = 1 [pid 5347] <... write resumed>) = 4 [pid 5345] <... futex resumed>) = 0 [pid 5346] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5075] umount2("./26/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5348] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5347] close(3 [pid 5346] <... mprotect resumed>) = 0 [pid 5345] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] unlink("./25/binderfs" [pid 5348] <... bpf resumed>) = 4 [pid 5347] <... close resumed>) = 0 [pid 5346] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5345] <... futex resumed>) = 0 [pid 5075] newfstatat(AT_FDCWD, "./26/binderfs", [pid 5074] <... unlink resumed>) = 0 [pid 5348] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5347] symlink("/dev/binderfs", "./binderfs" [pid 5345] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5348] <... futex resumed>) = 0 [pid 5348] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5345] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5347] <... symlink resumed>) = 0 [pid 5346] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5345] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] unlink("./26/binderfs" [pid 5074] getdents64(3, [pid 5348] <... futex resumed>) = 0 [pid 5347] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5346] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5345] <... futex resumed>) = 1 [pid 5075] <... unlink resumed>) = 0 ./strace-static-x86_64: Process 5349 attached [pid 5348] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5347] <... futex resumed>) = 0 [pid 5345] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5349] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5346] <... clone3 resumed> => {parent_tid=[5349]}, 88) = 5349 [pid 5075] getdents64(3, [pid 5349] <... rseq resumed>) = 0 [pid 5348] <... bpf resumed>) = 5 [pid 5347] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5346] rt_sigprocmask(SIG_SETMASK, [], [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5074] close(3 [pid 5349] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5348] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5347] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5346] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] close(3 [pid 5074] <... close resumed>) = 0 [pid 5349] <... set_robust_list resumed>) = 0 [pid 5348] <... futex resumed>) = 1 [pid 5347] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5346] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5345] <... futex resumed>) = 0 [pid 5075] <... close resumed>) = 0 [pid 5349] rt_sigprocmask(SIG_SETMASK, [], [pid 5348] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5347] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5346] <... futex resumed>) = 0 [pid 5345] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] rmdir("./25" [pid 5349] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5348] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5347] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5346] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5345] <... futex resumed>) = 0 [pid 5075] rmdir("./26" [pid 5074] <... rmdir resumed>) = 0 [pid 5349] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5348] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5347] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5345] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5075] <... rmdir resumed>) = 0 [pid 5349] <... bpf resumed>) = 3 [pid 5348] <... bpf resumed>) = 6 [pid 5347] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5075] mkdir("./27", 0777 [pid 5074] mkdir("./26", 0777 [pid 5349] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5348] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5347] <... mprotect resumed>) = 0 [pid 5075] <... mkdir resumed>) = 0 [pid 5074] <... mkdir resumed>) = 0 [pid 5349] <... futex resumed>) = 1 [pid 5345] <... futex resumed>) = 0 [pid 5348] <... futex resumed>) = 1 [pid 5347] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5346] <... futex resumed>) = 0 [pid 5349] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5348] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5345] exit_group(0 [pid 5346] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5349] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5348] <... futex resumed>) = ? [pid 5347] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5346] <... futex resumed>) = 0 [pid 5345] <... exit_group resumed>) = ? [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5348] +++ exited with 0 +++ [pid 5347] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5346] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5350 attached [pid 5350] set_robust_list(0x55555d6c46a0, 24) = 0 [pid 5350] chdir("./27") = 0 [pid 5349] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5345] +++ exited with 0 +++ ./strace-static-x86_64: Process 5352 attached [pid 5350] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5350 ./strace-static-x86_64: Process 5351 attached [pid 5352] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5350] <... prctl resumed>) = 0 [pid 5349] <... bpf resumed>) = 4 [pid 5347] <... clone3 resumed> => {parent_tid=[5352]}, 88) = 5352 [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5345, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5351] set_robust_list(0x55555d6c46a0, 24 [pid 5352] <... rseq resumed>) = 0 [pid 5350] setpgid(0, 0 [pid 5349] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5347] rt_sigprocmask(SIG_SETMASK, [], [pid 5076] umount2("./26", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5351] <... set_robust_list resumed>) = 0 [pid 5352] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5350] <... setpgid resumed>) = 0 [pid 5349] <... futex resumed>) = 1 [pid 5347] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5346] <... futex resumed>) = 0 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5346] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5349] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5346] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5351] chdir("./26" [pid 5352] <... set_robust_list resumed>) = 0 [pid 5350] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5347] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] openat(AT_FDCWD, "./26", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5351] <... chdir resumed>) = 0 [pid 5352] rt_sigprocmask(SIG_SETMASK, [], [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5351 [pid 5351] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5352] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5347] <... futex resumed>) = 0 [pid 5076] <... openat resumed>) = 3 [pid 5351] <... prctl resumed>) = 0 [pid 5352] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5350] <... openat resumed>) = 3 [pid 5349] <... bpf resumed>) = 5 [pid 5347] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] newfstatat(3, "", [pid 5351] setpgid(0, 0 [pid 5352] <... bpf resumed>) = 3 [pid 5350] write(3, "1000", 4 [pid 5351] <... setpgid resumed>) = 0 [pid 5352] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5350] <... write resumed>) = 4 [pid 5349] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5350] close(3 [pid 5349] <... futex resumed>) = 1 [pid 5346] <... futex resumed>) = 0 [pid 5352] <... futex resumed>) = 1 [pid 5350] <... close resumed>) = 0 [pid 5347] <... futex resumed>) = 0 [pid 5346] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] getdents64(3, [pid 5351] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5352] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5349] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5346] <... futex resumed>) = 0 [pid 5350] symlink("/dev/binderfs", "./binderfs" [pid 5347] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5346] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5352] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5351] <... openat resumed>) = 3 [pid 5349] <... bpf resumed>) = 6 [pid 5347] <... futex resumed>) = 0 [pid 5351] write(3, "1000", 4 [pid 5352] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5350] <... symlink resumed>) = 0 [pid 5349] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] umount2("./26/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5351] <... write resumed>) = 4 [pid 5352] <... bpf resumed>) = 4 [pid 5350] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5349] <... futex resumed>) = 1 [pid 5347] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5346] <... futex resumed>) = 0 [pid 5351] close(3 [pid 5352] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5350] <... futex resumed>) = 0 [pid 5349] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5347] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5346] exit_group(0 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5351] <... close resumed>) = 0 [pid 5352] <... futex resumed>) = 0 [pid 5350] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5349] <... futex resumed>) = ? [pid 5347] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5346] <... exit_group resumed>) = ? [pid 5076] newfstatat(AT_FDCWD, "./26/binderfs", [pid 5351] symlink("/dev/binderfs", "./binderfs" [pid 5352] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5350] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5349] +++ exited with 0 +++ [pid 5347] <... futex resumed>) = 0 [pid 5351] <... symlink resumed>) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5351] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5352] <... bpf resumed>) = 5 [pid 5350] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5347] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] unlink("./26/binderfs" [pid 5351] <... futex resumed>) = 0 [pid 5352] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5350] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5346] +++ exited with 0 +++ [pid 5351] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5352] <... futex resumed>) = 1 [pid 5350] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5347] <... futex resumed>) = 0 [pid 5076] <... unlink resumed>) = 0 [pid 5351] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5350] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5352] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5347] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5346, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5076] getdents64(3, [pid 5351] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5350] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5347] <... futex resumed>) = 0 [pid 5077] restart_syscall(<... resuming interrupted clone ...> [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5351] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5350] <... mprotect resumed>) = 0 [pid 5347] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] <... restart_syscall resumed>) = 0 [pid 5076] close(3 [pid 5351] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f3e2f5ed000 [pid 5350] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5351] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5350] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5077] umount2("./26", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] <... close resumed>) = 0 [pid 5351] <... mprotect resumed>) = 0 [pid 5352] <... bpf resumed>) = 6 [pid 5350] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] rmdir("./26" [pid 5351] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5352] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] openat(AT_FDCWD, "./26", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5076] <... rmdir resumed>) = 0 ./strace-static-x86_64: Process 5353 attached [pid 5352] <... futex resumed>) = 1 [pid 5347] <... futex resumed>) = 0 [pid 5077] <... openat resumed>) = 3 [pid 5353] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5351] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5350] <... clone3 resumed> => {parent_tid=[5353]}, 88) = 5353 [pid 5347] exit_group(0 [pid 5352] ???( [pid 5077] newfstatat(3, "", [pid 5353] <... rseq resumed>) = 0 [pid 5351] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5352] <... ??? resumed>) = ? [pid 5350] rt_sigprocmask(SIG_SETMASK, [], [pid 5347] <... exit_group resumed>) = ? [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5076] mkdir("./27", 0777 [pid 5353] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5350] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] getdents64(3, [pid 5076] <... mkdir resumed>) = 0 [pid 5353] <... set_robust_list resumed>) = 0 [pid 5351] <... clone3 resumed> => {parent_tid=[5354]}, 88) = 5354 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5353] rt_sigprocmask(SIG_SETMASK, [], [pid 5351] rt_sigprocmask(SIG_SETMASK, [], [pid 5077] umount2("./26/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5354 attached [pid 5353] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5351] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5352] +++ exited with 0 +++ [pid 5350] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5354] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5353] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5351] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5350] <... futex resumed>) = 0 [pid 5077] newfstatat(AT_FDCWD, "./26/binderfs", [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5355 attached [pid 5354] <... rseq resumed>) = 0 [pid 5353] <... bpf resumed>) = 3 [pid 5351] <... futex resumed>) = 0 [pid 5350] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5347] +++ exited with 0 +++ [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5355] set_robust_list(0x55555d6c46a0, 24 [pid 5354] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5351] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5355] <... set_robust_list resumed>) = 0 [pid 5354] <... set_robust_list resumed>) = 0 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5347, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5354] rt_sigprocmask(SIG_SETMASK, [], [pid 5078] restart_syscall(<... resuming interrupted clone ...> [pid 5354] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5354] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5353] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] unlink("./26/binderfs" [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5355 [pid 5078] <... restart_syscall resumed>) = 0 [pid 5355] chdir("./27" [pid 5353] <... futex resumed>) = 1 [pid 5350] <... futex resumed>) = 0 [pid 5077] <... unlink resumed>) = 0 [pid 5354] <... bpf resumed>) = 3 [pid 5354] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5353] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5350] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] getdents64(3, [pid 5355] <... chdir resumed>) = 0 [pid 5354] <... futex resumed>) = 1 [pid 5353] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5351] <... futex resumed>) = 0 [pid 5350] <... futex resumed>) = 0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5355] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5354] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5353] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5351] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5350] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] umount2("./28", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5077] close(3 [pid 5355] <... prctl resumed>) = 0 [pid 5354] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5353] <... bpf resumed>) = 4 [pid 5351] <... futex resumed>) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5077] <... close resumed>) = 0 [pid 5355] setpgid(0, 0 [pid 5354] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5351] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] openat(AT_FDCWD, "./28", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5355] <... setpgid resumed>) = 0 [pid 5353] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] rmdir("./26" [pid 5353] <... futex resumed>) = 1 [pid 5350] <... futex resumed>) = 0 [pid 5078] <... openat resumed>) = 3 [pid 5077] <... rmdir resumed>) = 0 [pid 5355] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5354] <... bpf resumed>) = 4 [pid 5353] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5350] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5353] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5350] <... futex resumed>) = 0 [pid 5077] mkdir("./27", 0777 [pid 5355] <... openat resumed>) = 3 [pid 5354] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5353] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5350] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] newfstatat(3, "", [pid 5355] write(3, "1000", 4 [pid 5354] <... futex resumed>) = 1 [pid 5351] <... futex resumed>) = 0 [pid 5354] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5355] <... write resumed>) = 4 [pid 5355] close(3 [pid 5353] <... bpf resumed>) = 5 [pid 5351] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] getdents64(3, [pid 5355] <... close resumed>) = 0 [pid 5354] <... futex resumed>) = 0 [pid 5351] <... futex resumed>) = 1 [pid 5354] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5353] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5351] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5355] symlink("/dev/binderfs", "./binderfs" [pid 5354] <... bpf resumed>) = 5 [pid 5353] <... futex resumed>) = 1 [pid 5350] <... futex resumed>) = 0 [pid 5077] <... mkdir resumed>) = 0 [pid 5353] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5350] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] umount2("./28/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5355] <... symlink resumed>) = 0 [pid 5350] <... futex resumed>) = 0 [pid 5350] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5353] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5355] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5354] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5355] <... futex resumed>) = 0 [pid 5078] newfstatat(AT_FDCWD, "./28/binderfs", [pid 5355] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5354] <... futex resumed>) = 1 [pid 5353] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5351] <... futex resumed>) = 0 [pid 5355] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5354] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5351] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5356 attached [pid 5355] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5354] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5351] <... futex resumed>) = 0 [pid 5078] unlink("./28/binderfs" [pid 5356] set_robust_list(0x55555d6c46a0, 24 [pid 5355] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5354] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5353] <... bpf resumed>) = 6 [pid 5351] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5355] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f3e2f5ed000 [pid 5353] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5354] <... bpf resumed>) = 6 [pid 5353] <... futex resumed>) = 1 [pid 5350] <... futex resumed>) = 0 [pid 5350] exit_group(0) = ? [pid 5356] <... set_robust_list resumed>) = 0 [pid 5355] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5354] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... unlink resumed>) = 0 [pid 5356] chdir("./27" [pid 5355] <... mprotect resumed>) = 0 [pid 5354] <... futex resumed>) = 1 [pid 5351] <... futex resumed>) = 0 [pid 5354] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5351] exit_group(0 [pid 5355] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5356] <... chdir resumed>) = 0 [pid 5351] <... exit_group resumed>) = ? [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5356 [pid 5078] getdents64(3, [pid 5356] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5355] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5354] <... futex resumed>) = ? [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5356] <... prctl resumed>) = 0 [pid 5355] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5356] setpgid(0, 0 [pid 5078] close(3./strace-static-x86_64: Process 5357 attached [pid 5356] <... setpgid resumed>) = 0 [pid 5357] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5078] <... close resumed>) = 0 [pid 5357] <... rseq resumed>) = 0 [pid 5356] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5355] <... clone3 resumed> => {parent_tid=[5357]}, 88) = 5357 [pid 5078] rmdir("./28" [pid 5357] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5356] <... openat resumed>) = 3 [pid 5355] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5357] <... set_robust_list resumed>) = 0 [pid 5356] write(3, "1000", 4 [pid 5355] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... rmdir resumed>) = 0 [pid 5357] rt_sigprocmask(SIG_SETMASK, [], [pid 5356] <... write resumed>) = 4 [pid 5355] <... futex resumed>) = 0 [pid 5357] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5356] close(3 [pid 5078] mkdir("./29", 0777 [pid 5357] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5356] <... close resumed>) = 0 [pid 5355] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5354] +++ exited with 0 +++ [pid 5353] +++ exited with 0 +++ [pid 5351] +++ exited with 0 +++ [pid 5350] +++ exited with 0 +++ [pid 5357] <... bpf resumed>) = 3 [pid 5356] symlink("/dev/binderfs", "./binderfs" [pid 5078] <... mkdir resumed>) = 0 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5350, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5351, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5357] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5356] <... symlink resumed>) = 0 [pid 5075] restart_syscall(<... resuming interrupted clone ...> [pid 5357] <... futex resumed>) = 1 [pid 5355] <... futex resumed>) = 0 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] umount2("./26", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5357] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5355] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... restart_syscall resumed>) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5358 attached [pid 5356] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5357] <... bpf resumed>) = 4 [pid 5355] <... futex resumed>) = 0 [pid 5356] <... futex resumed>) = 0 [pid 5358] set_robust_list(0x55555d6c46a0, 24) = 0 [pid 5358] chdir("./29" [pid 5356] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5355] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5357] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5356] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5355] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5358 [pid 5358] <... chdir resumed>) = 0 [pid 5357] <... futex resumed>) = 0 [pid 5356] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5355] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] umount2("./27", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] openat(AT_FDCWD, "./26", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5358] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5357] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5356] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5355] <... futex resumed>) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] <... openat resumed>) = 3 [pid 5358] <... prctl resumed>) = 0 [pid 5356] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5075] openat(AT_FDCWD, "./27", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5358] setpgid(0, 0 [pid 5074] newfstatat(3, "", [pid 5358] <... setpgid resumed>) = 0 [pid 5356] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5075] <... openat resumed>) = 3 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5358] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5357] <... bpf resumed>) = 5 [pid 5355] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5356] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5075] newfstatat(3, "", [pid 5358] <... openat resumed>) = 3 [pid 5074] getdents64(3, [pid 5356] <... mprotect resumed>) = 0 [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5358] write(3, "1000", 4 [pid 5356] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5074] umount2("./26/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5358] <... write resumed>) = 4 [pid 5075] getdents64(3, [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5358] close(3 [pid 5356] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5074] newfstatat(AT_FDCWD, "./26/binderfs", [pid 5358] <... close resumed>) = 0 [pid 5357] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5356] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5075] umount2("./27/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5358] symlink("/dev/binderfs", "./binderfs" [pid 5357] <... futex resumed>) = 1 [pid 5355] <... futex resumed>) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5359 attached [pid 5358] <... symlink resumed>) = 0 [pid 5357] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5355] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] newfstatat(AT_FDCWD, "./27/binderfs", [pid 5074] unlink("./26/binderfs" [pid 5359] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053) = 0 [pid 5358] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5357] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5356] <... clone3 resumed> => {parent_tid=[5359]}, 88) = 5359 [pid 5355] <... futex resumed>) = 0 [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] <... unlink resumed>) = 0 [pid 5359] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5358] <... futex resumed>) = 0 [pid 5357] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5356] rt_sigprocmask(SIG_SETMASK, [], [pid 5355] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5075] unlink("./27/binderfs" [pid 5359] <... set_robust_list resumed>) = 0 [pid 5358] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5356] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5074] getdents64(3, [pid 5359] rt_sigprocmask(SIG_SETMASK, [], [pid 5358] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5359] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5358] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5356] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... unlink resumed>) = 0 [pid 5074] close(3 [pid 5359] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5358] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5356] <... futex resumed>) = 0 [pid 5074] <... close resumed>) = 0 [pid 5359] <... bpf resumed>) = 3 [pid 5358] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5356] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] getdents64(3, [pid 5074] rmdir("./26" [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5075] close(3 [pid 5359] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5358] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5075] <... close resumed>) = 0 [pid 5074] <... rmdir resumed>) = 0 [pid 5359] <... futex resumed>) = 1 [pid 5358] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5356] <... futex resumed>) = 0 [pid 5359] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5358] <... mprotect resumed>) = 0 [pid 5074] mkdir("./27", 0777 [pid 5356] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5075] rmdir("./27" [pid 5356] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5359] <... futex resumed>) = 0 [pid 5358] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5075] <... rmdir resumed>) = 0 [pid 5074] <... mkdir resumed>) = 0 [pid 5359] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5358] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5359] <... bpf resumed>) = 4 [pid 5358] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5360 attached ./strace-static-x86_64: Process 5361 attached [pid 5357] <... bpf resumed>) = 6 [pid 5075] mkdir("./28", 0777 [pid 5360] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5359] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5358] <... clone3 resumed> => {parent_tid=[5360]}, 88) = 5360 [pid 5357] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5359] <... futex resumed>) = 1 [pid 5358] rt_sigprocmask(SIG_SETMASK, [], [pid 5356] <... futex resumed>) = 0 [pid 5359] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5358] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5356] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5361] set_robust_list(0x55555d6c46a0, 24 [pid 5360] <... rseq resumed>) = 0 [pid 5359] <... bpf resumed>) = 5 [pid 5358] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5357] <... futex resumed>) = 1 [pid 5356] <... futex resumed>) = 0 [pid 5355] <... futex resumed>) = 0 [pid 5075] <... mkdir resumed>) = 0 [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5361 [pid 5361] <... set_robust_list resumed>) = 0 [pid 5360] set_robust_list(0x7f3e2f60d9a0, 24) = 0 [pid 5359] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5358] <... futex resumed>) = 0 [pid 5356] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5355] exit_group(0 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5361] chdir("./27" [pid 5360] rt_sigprocmask(SIG_SETMASK, [], [pid 5359] <... futex resumed>) = 0 [pid 5358] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5356] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5355] <... exit_group resumed>) = ? [pid 5361] <... chdir resumed>) = 0 [pid 5360] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5359] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5356] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5361] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5360] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5359] <... bpf resumed>) = 6 [pid 5356] <... futex resumed>) = 0 [pid 5361] <... prctl resumed>) = 0 [pid 5360] <... bpf resumed>) = 3 ./strace-static-x86_64: Process 5362 attached [pid 5361] setpgid(0, 0 [pid 5360] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5359] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5356] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5362 [pid 5362] set_robust_list(0x55555d6c46a0, 24 [pid 5361] <... setpgid resumed>) = 0 [pid 5360] <... futex resumed>) = 1 [pid 5359] <... futex resumed>) = 0 [pid 5358] <... futex resumed>) = 0 [pid 5356] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5362] <... set_robust_list resumed>) = 0 [pid 5361] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5360] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5359] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5358] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5356] exit_group(0 [pid 5362] chdir("./28" [pid 5360] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5359] <... futex resumed>) = ? [pid 5358] <... futex resumed>) = 0 [pid 5356] <... exit_group resumed>) = ? [pid 5362] <... chdir resumed>) = 0 [pid 5361] <... openat resumed>) = 3 [pid 5360] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5359] +++ exited with 0 +++ [pid 5358] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5362] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5361] write(3, "1000", 4 [pid 5356] +++ exited with 0 +++ [pid 5360] <... bpf resumed>) = 4 [pid 5361] <... write resumed>) = 4 [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5356, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5360] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5361] close(3 [pid 5360] <... futex resumed>) = 0 [pid 5361] <... close resumed>) = 0 [pid 5360] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5362] <... prctl resumed>) = 0 [pid 5361] symlink("/dev/binderfs", "./binderfs" [pid 5358] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5357] +++ exited with 0 +++ [pid 5355] +++ exited with 0 +++ [pid 5362] setpgid(0, 0 [pid 5358] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5362] <... setpgid resumed>) = 0 [pid 5358] <... futex resumed>) = 1 [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5355, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5360] <... futex resumed>) = 0 [pid 5362] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5361] <... symlink resumed>) = 0 [pid 5360] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5358] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] umount2("./27", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] restart_syscall(<... resuming interrupted clone ...> [pid 5362] <... openat resumed>) = 3 [pid 5361] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] <... restart_syscall resumed>) = 0 [pid 5362] write(3, "1000", 4 [pid 5361] <... futex resumed>) = 0 [pid 5360] <... bpf resumed>) = 5 [pid 5077] openat(AT_FDCWD, "./27", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5362] <... write resumed>) = 4 [pid 5360] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5362] close(3 [pid 5361] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5360] <... futex resumed>) = 1 [pid 5358] <... futex resumed>) = 0 [pid 5362] <... close resumed>) = 0 [pid 5361] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5360] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5358] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... openat resumed>) = 3 [pid 5362] symlink("/dev/binderfs", "./binderfs" [pid 5361] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5360] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5358] <... futex resumed>) = 0 [pid 5362] <... symlink resumed>) = 0 [pid 5361] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5360] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5358] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] newfstatat(3, "", [pid 5361] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5076] umount2("./27", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5362] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5361] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5360] <... bpf resumed>) = 6 [pid 5077] getdents64(3, [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5362] <... futex resumed>) = 0 [pid 5361] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5360] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5076] openat(AT_FDCWD, "./27", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5362] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5360] <... futex resumed>) = 1 [pid 5361] <... mprotect resumed>) = 0 [pid 5358] <... futex resumed>) = 0 [pid 5362] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5360] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5358] exit_group(0 [pid 5362] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5360] <... futex resumed>) = ? [pid 5358] <... exit_group resumed>) = ? [pid 5077] umount2("./27/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] <... openat resumed>) = 3 [pid 5362] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5361] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5360] +++ exited with 0 +++ [pid 5358] +++ exited with 0 +++ [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] newfstatat(3, "", [pid 5362] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5362] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5362] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5361] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5358, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5077] newfstatat(AT_FDCWD, "./27/binderfs", [pid 5076] getdents64(3, [pid 5362] <... mprotect resumed>) = 0 [pid 5361] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5078] umount2("./29", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 ./strace-static-x86_64: Process 5363 attached [pid 5362] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5077] unlink("./27/binderfs" [pid 5076] umount2("./27/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5363] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5078] openat(AT_FDCWD, "./29", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5077] <... unlink resumed>) = 0 [pid 5363] <... rseq resumed>) = 0 [pid 5362] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5361] <... clone3 resumed> => {parent_tid=[5363]}, 88) = 5363 [pid 5078] <... openat resumed>) = 3 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5363] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5362] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5361] rt_sigprocmask(SIG_SETMASK, [], [pid 5078] newfstatat(3, "", [pid 5077] getdents64(3, [pid 5076] newfstatat(AT_FDCWD, "./27/binderfs", ./strace-static-x86_64: Process 5364 attached [pid 5363] <... set_robust_list resumed>) = 0 [pid 5361] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5364] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5363] rt_sigprocmask(SIG_SETMASK, [], [pid 5362] <... clone3 resumed> => {parent_tid=[5364]}, 88) = 5364 [pid 5361] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] getdents64(3, [pid 5077] close(3 [pid 5364] <... rseq resumed>) = 0 [pid 5363] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5362] rt_sigprocmask(SIG_SETMASK, [], [pid 5361] <... futex resumed>) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5077] <... close resumed>) = 0 [pid 5076] unlink("./27/binderfs" [pid 5364] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5363] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5362] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5361] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] umount2("./29/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5077] rmdir("./27" [pid 5076] <... unlink resumed>) = 0 [pid 5364] <... set_robust_list resumed>) = 0 [pid 5363] <... bpf resumed>) = 3 [pid 5362] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5077] <... rmdir resumed>) = 0 [pid 5364] rt_sigprocmask(SIG_SETMASK, [], [pid 5363] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5362] <... futex resumed>) = 0 [pid 5076] getdents64(3, [pid 5364] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5363] <... futex resumed>) = 1 [pid 5362] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5361] <... futex resumed>) = 0 [pid 5078] newfstatat(AT_FDCWD, "./29/binderfs", [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5364] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5363] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5361] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5077] mkdir("./28", 0777 [pid 5076] close(3 [pid 5364] <... bpf resumed>) = 3 [pid 5363] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5361] <... futex resumed>) = 0 [pid 5078] unlink("./29/binderfs" [pid 5077] <... mkdir resumed>) = 0 [pid 5076] <... close resumed>) = 0 [pid 5364] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5363] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5361] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... unlink resumed>) = 0 [pid 5364] <... futex resumed>) = 1 [pid 5362] <... futex resumed>) = 0 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5076] rmdir("./27"./strace-static-x86_64: Process 5365 attached [pid 5364] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5363] <... bpf resumed>) = 4 [pid 5362] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] getdents64(3, [pid 5076] <... rmdir resumed>) = 0 [pid 5365] set_robust_list(0x55555d6c46a0, 24 [pid 5364] <... bpf resumed>) = 4 [pid 5362] <... futex resumed>) = 0 [pid 5363] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5365] <... set_robust_list resumed>) = 0 [pid 5363] <... futex resumed>) = 1 [pid 5363] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5365] chdir("./28" [pid 5364] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5362] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5361] <... futex resumed>) = 0 [pid 5078] close(3 [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5365 [pid 5076] mkdir("./28", 0777 [pid 5365] <... chdir resumed>) = 0 [pid 5364] <... futex resumed>) = 0 [pid 5362] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5361] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... close resumed>) = 0 [pid 5365] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5364] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5363] <... futex resumed>) = 0 [pid 5362] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5361] <... futex resumed>) = 1 [pid 5078] rmdir("./29" [pid 5076] <... mkdir resumed>) = 0 [pid 5365] <... prctl resumed>) = 0 [pid 5364] <... bpf resumed>) = 5 [pid 5363] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5362] <... futex resumed>) = 0 [pid 5361] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... rmdir resumed>) = 0 [pid 5365] setpgid(0, 0 [pid 5364] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5362] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5366 attached [pid 5365] <... setpgid resumed>) = 0 [pid 5363] <... bpf resumed>) = 5 [pid 5362] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5366] set_robust_list(0x55555d6c46a0, 24 [pid 5365] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5364] <... futex resumed>) = 0 [pid 5362] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] mkdir("./30", 0777 [pid 5366] <... set_robust_list resumed>) = 0 [pid 5364] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5366] chdir("./28" [pid 5364] <... bpf resumed>) = 6 [pid 5362] <... futex resumed>) = 0 [pid 5366] <... chdir resumed>) = 0 [pid 5363] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5366] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5362] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5361] <... futex resumed>) = 0 [pid 5366] <... prctl resumed>) = 0 [pid 5365] <... openat resumed>) = 3 [pid 5364] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5363] <... futex resumed>) = 1 [pid 5361] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... mkdir resumed>) = 0 [pid 5366] setpgid(0, 0 [pid 5365] write(3, "1000", 4 [pid 5364] <... futex resumed>) = 1 [pid 5363] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5362] <... futex resumed>) = 0 [pid 5361] <... futex resumed>) = 0 [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5366 [pid 5365] <... write resumed>) = 4 [pid 5364] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5362] exit_group(0 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5367 attached [pid 5366] <... setpgid resumed>) = 0 [pid 5365] close(3 [pid 5364] <... futex resumed>) = ? [pid 5363] <... bpf resumed>) = 6 [pid 5362] <... exit_group resumed>) = ? [pid 5361] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5367] set_robust_list(0x55555d6c46a0, 24 [pid 5366] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5365] <... close resumed>) = 0 [pid 5364] +++ exited with 0 +++ [pid 5363] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5361] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5367] <... set_robust_list resumed>) = 0 [pid 5365] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5363] <... futex resumed>) = 0 [pid 5361] exit_group(0 [pid 5365] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5366] <... openat resumed>) = 3 [pid 5365] <... futex resumed>) = 0 [pid 5367] chdir("./30" [pid 5366] write(3, "1000", 4 [pid 5365] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5361] <... exit_group resumed>) = ? [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5367 [pid 5367] <... chdir resumed>) = 0 [pid 5366] <... write resumed>) = 4 [pid 5365] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5365] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5366] close(3 [pid 5367] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5365] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5367] <... prctl resumed>) = 0 [pid 5365] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5366] <... close resumed>) = 0 [pid 5367] setpgid(0, 0 [pid 5366] symlink("/dev/binderfs", "./binderfs" [pid 5365] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5365] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5367] <... setpgid resumed>) = 0 [pid 5365] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5366] <... symlink resumed>) = 0 [pid 5367] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5365] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5365] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0}./strace-static-x86_64: Process 5368 attached [pid 5367] <... openat resumed>) = 3 [pid 5366] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5362] +++ exited with 0 +++ [pid 5368] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5367] write(3, "1000", 4 [pid 5366] <... futex resumed>) = 0 [pid 5368] <... rseq resumed>) = 0 [pid 5367] <... write resumed>) = 4 [pid 5366] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5368] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5367] close(3 [pid 5366] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5365] <... clone3 resumed> => {parent_tid=[5368]}, 88) = 5368 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5362, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5368] <... set_robust_list resumed>) = 0 [pid 5367] <... close resumed>) = 0 [pid 5366] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5365] rt_sigprocmask(SIG_SETMASK, [], [pid 5363] +++ exited with 0 +++ [pid 5361] +++ exited with 0 +++ [pid 5368] rt_sigprocmask(SIG_SETMASK, [], [pid 5367] symlink("/dev/binderfs", "./binderfs" [pid 5366] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5365] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5361, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5368] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5365] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5365] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5367] <... symlink resumed>) = 0 [pid 5366] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5368] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5366] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5368] <... bpf resumed>) = 3 [pid 5367] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5366] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5075] umount2("./28", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5367] <... futex resumed>) = 0 [pid 5368] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5366] <... mprotect resumed>) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5367] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5075] openat(AT_FDCWD, "./28", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5368] <... futex resumed>) = 1 [pid 5367] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5365] <... futex resumed>) = 0 [pid 5075] <... openat resumed>) = 3 [pid 5368] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5367] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5366] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5365] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5368] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5367] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5365] <... futex resumed>) = 0 [pid 5075] newfstatat(3, "", [pid 5368] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5367] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5366] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5365] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5368] <... bpf resumed>) = 4 [pid 5366] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0}./strace-static-x86_64: Process 5369 attached [pid 5367] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5075] getdents64(3, [pid 5074] umount2("./27", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5369] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5368] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5367] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5369] <... rseq resumed>) = 0 [pid 5368] <... futex resumed>) = 1 [pid 5366] <... clone3 resumed> => {parent_tid=[5369]}, 88) = 5369 [pid 5365] <... futex resumed>) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5369] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5368] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5367] <... mprotect resumed>) = 0 [pid 5366] rt_sigprocmask(SIG_SETMASK, [], [pid 5365] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] umount2("./28/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] openat(AT_FDCWD, "./27", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5369] <... set_robust_list resumed>) = 0 [pid 5368] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5366] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5365] <... futex resumed>) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5369] rt_sigprocmask(SIG_SETMASK, [], [pid 5365] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] newfstatat(AT_FDCWD, "./28/binderfs", [pid 5369] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5369] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5075] unlink("./28/binderfs" [pid 5368] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5367] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5366] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... openat resumed>) = 3 [pid 5366] <... futex resumed>) = 1 [pid 5074] newfstatat(3, "", [pid 5366] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5369] <... futex resumed>) = 0 [pid 5367] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5075] <... unlink resumed>) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5369] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5367] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5369] <... bpf resumed>) = 3 [pid 5075] getdents64(3, [pid 5074] getdents64(3, ./strace-static-x86_64: Process 5370 attached [pid 5369] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5368] <... bpf resumed>) = 5 [pid 5367] <... clone3 resumed> => {parent_tid=[5370]}, 88) = 5370 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5370] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5369] <... futex resumed>) = 1 [pid 5368] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5367] rt_sigprocmask(SIG_SETMASK, [], [pid 5366] <... futex resumed>) = 0 [pid 5075] close(3 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5370] <... rseq resumed>) = 0 [pid 5369] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5368] <... futex resumed>) = 1 [pid 5367] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5366] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5365] <... futex resumed>) = 0 [pid 5074] umount2("./27/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5370] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5369] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5368] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5367] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5366] <... futex resumed>) = 0 [pid 5365] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... close resumed>) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5370] <... set_robust_list resumed>) = 0 [pid 5369] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5368] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5367] <... futex resumed>) = 0 [pid 5366] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5365] <... futex resumed>) = 0 [pid 5075] rmdir("./28" [pid 5370] rt_sigprocmask(SIG_SETMASK, [], [pid 5367] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5365] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5074] newfstatat(AT_FDCWD, "./27/binderfs", [pid 5369] <... bpf resumed>) = 4 [pid 5368] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5370] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5369] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5368] <... bpf resumed>) = 6 [pid 5075] <... rmdir resumed>) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5370] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5369] <... futex resumed>) = 1 [pid 5368] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5366] <... futex resumed>) = 0 [pid 5369] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5368] <... futex resumed>) = 1 [pid 5366] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5365] <... futex resumed>) = 0 [pid 5369] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5368] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5366] <... futex resumed>) = 0 [pid 5369] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5365] exit_group(0 [pid 5366] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5368] <... futex resumed>) = ? [pid 5365] <... exit_group resumed>) = ? [pid 5370] <... bpf resumed>) = 3 [pid 5368] +++ exited with 0 +++ [pid 5075] mkdir("./29", 0777 [pid 5074] unlink("./27/binderfs" [pid 5370] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5369] <... bpf resumed>) = 5 [pid 5365] +++ exited with 0 +++ [pid 5075] <... mkdir resumed>) = 0 [pid 5074] <... unlink resumed>) = 0 [pid 5370] <... futex resumed>) = 1 [pid 5369] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5367] <... futex resumed>) = 0 [pid 5370] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5369] <... futex resumed>) = 1 [pid 5367] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5366] <... futex resumed>) = 0 [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5365, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] getdents64(3, ./strace-static-x86_64: Process 5371 attached [pid 5370] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5369] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5367] <... futex resumed>) = 0 [pid 5366] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] restart_syscall(<... resuming interrupted clone ...> [pid 5371] set_robust_list(0x55555d6c46a0, 24 [pid 5370] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5369] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5367] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5366] <... futex resumed>) = 0 [pid 5077] <... restart_syscall resumed>) = 0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5371] <... set_robust_list resumed>) = 0 [pid 5370] <... bpf resumed>) = 4 [pid 5369] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5366] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5371] chdir("./29" [pid 5370] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5371 [pid 5074] close(3 [pid 5371] <... chdir resumed>) = 0 [pid 5370] <... futex resumed>) = 1 [pid 5367] <... futex resumed>) = 0 [pid 5077] umount2("./28", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... close resumed>) = 0 [pid 5371] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5370] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5367] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5371] <... prctl resumed>) = 0 [pid 5370] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5367] <... futex resumed>) = 0 [pid 5074] rmdir("./27" [pid 5371] setpgid(0, 0 [pid 5370] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5367] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] openat(AT_FDCWD, "./28", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5371] <... setpgid resumed>) = 0 [pid 5370] <... bpf resumed>) = 5 [pid 5074] <... rmdir resumed>) = 0 [pid 5371] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5077] <... openat resumed>) = 3 [pid 5077] newfstatat(3, "", [pid 5371] <... openat resumed>) = 3 [pid 5371] write(3, "1000", 4 [pid 5370] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5074] mkdir("./28", 0777 [pid 5371] <... write resumed>) = 4 [pid 5370] <... futex resumed>) = 1 [pid 5367] <... futex resumed>) = 0 [pid 5367] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5371] close(3 [pid 5370] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5369] <... bpf resumed>) = 6 [pid 5367] <... futex resumed>) = 0 [pid 5077] getdents64(3, [pid 5371] <... close resumed>) = 0 [pid 5370] <... bpf resumed>) = 6 [pid 5074] <... mkdir resumed>) = 0 [pid 5371] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5370] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5367] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5371] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5370] <... futex resumed>) = 0 [pid 5369] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5367] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5371] <... futex resumed>) = 0 [pid 5370] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5371] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, ./strace-static-x86_64: Process 5372 attached NULL, 8) = 0 [pid 5369] <... futex resumed>) = 1 [pid 5367] exit_group(0 [pid 5366] <... futex resumed>) = 0 [pid 5077] umount2("./28/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5372] set_robust_list(0x55555d6c46a0, 24 [pid 5371] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5370] <... futex resumed>) = ? [pid 5369] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5367] <... exit_group resumed>) = ? [pid 5366] exit_group(0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5372] <... set_robust_list resumed>) = 0 [pid 5371] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5370] +++ exited with 0 +++ [pid 5366] <... exit_group resumed>) = ? [pid 5372] chdir("./28" [pid 5371] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5369] <... futex resumed>) = ? [pid 5367] +++ exited with 0 +++ [pid 5077] newfstatat(AT_FDCWD, "./28/binderfs", [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5372 [pid 5372] <... chdir resumed>) = 0 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5367, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5077] unlink("./28/binderfs" [pid 5371] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5371] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5369] +++ exited with 0 +++ [pid 5366] +++ exited with 0 +++ [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5366, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5372] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5371] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5077] <... unlink resumed>) = 0 [pid 5372] <... prctl resumed>) = 0 [pid 5077] getdents64(3, [pid 5372] setpgid(0, 0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5372] <... setpgid resumed>) = 0 [pid 5371] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5077] close(3 [pid 5076] umount2("./28", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5372] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5371] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5077] <... close resumed>) = 0 ./strace-static-x86_64: Process 5373 attached [pid 5372] <... openat resumed>) = 3 [pid 5077] rmdir("./28" [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5372] write(3, "1000", 4 [pid 5371] <... clone3 resumed> => {parent_tid=[5373]}, 88) = 5373 [pid 5076] openat(AT_FDCWD, "./28", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5373] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5372] <... write resumed>) = 4 [pid 5078] umount2("./30", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5077] <... rmdir resumed>) = 0 [pid 5373] <... rseq resumed>) = 0 [pid 5372] close(3 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5373] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5372] <... close resumed>) = 0 [pid 5078] openat(AT_FDCWD, "./30", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5077] mkdir("./29", 0777 [pid 5371] rt_sigprocmask(SIG_SETMASK, [], [pid 5076] <... openat resumed>) = 3 [pid 5373] <... set_robust_list resumed>) = 0 [pid 5372] symlink("/dev/binderfs", "./binderfs" [pid 5371] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] <... openat resumed>) = 3 [pid 5371] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... mkdir resumed>) = 0 [pid 5373] rt_sigprocmask(SIG_SETMASK, [], [pid 5372] <... symlink resumed>) = 0 [pid 5371] <... futex resumed>) = 0 [pid 5078] newfstatat(3, "", [pid 5373] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5372] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5371] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5373] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5372] <... futex resumed>) = 0 [pid 5078] getdents64(3, [pid 5076] newfstatat(3, "", ./strace-static-x86_64: Process 5374 attached [pid 5373] <... bpf resumed>) = 3 [pid 5372] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5374] set_robust_list(0x55555d6c46a0, 24 [pid 5373] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5372] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5078] umount2("./30/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5374 [pid 5076] getdents64(3, [pid 5374] <... set_robust_list resumed>) = 0 [pid 5373] <... futex resumed>) = 1 [pid 5372] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5371] <... futex resumed>) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5374] chdir("./29" [pid 5373] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5372] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5371] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] newfstatat(AT_FDCWD, "./30/binderfs", [pid 5374] <... chdir resumed>) = 0 [pid 5374] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5373] <... bpf resumed>) = 4 [pid 5372] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5371] <... futex resumed>) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5076] umount2("./28/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5374] <... prctl resumed>) = 0 [pid 5373] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5372] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5371] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] unlink("./30/binderfs" [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5374] setpgid(0, 0 [pid 5373] <... futex resumed>) = 0 [pid 5372] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5371] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5076] newfstatat(AT_FDCWD, "./28/binderfs", [pid 5374] <... setpgid resumed>) = 0 [pid 5373] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5372] <... mprotect resumed>) = 0 [pid 5371] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5374] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5372] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5371] <... futex resumed>) = 0 [pid 5078] <... unlink resumed>) = 0 [pid 5076] unlink("./28/binderfs" [pid 5371] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5374] <... openat resumed>) = 3 [pid 5373] <... bpf resumed>) = 5 [pid 5372] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5078] getdents64(3, [pid 5076] <... unlink resumed>) = 0 [pid 5374] write(3, "1000", 4 [pid 5373] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5372] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5374] <... write resumed>) = 4 [pid 5373] <... futex resumed>) = 1 ./strace-static-x86_64: Process 5375 attached [pid 5374] close(3 [pid 5373] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5371] <... futex resumed>) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5076] getdents64(3, [pid 5375] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5374] <... close resumed>) = 0 [pid 5372] <... clone3 resumed> => {parent_tid=[5375]}, 88) = 5375 [pid 5371] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] close(3 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5375] <... rseq resumed>) = 0 [pid 5374] symlink("/dev/binderfs", "./binderfs" [pid 5373] <... futex resumed>) = 0 [pid 5372] rt_sigprocmask(SIG_SETMASK, [], [pid 5371] <... futex resumed>) = 1 [pid 5078] <... close resumed>) = 0 [pid 5076] close(3 [pid 5375] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5374] <... symlink resumed>) = 0 [pid 5371] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5373] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5076] <... close resumed>) = 0 [pid 5372] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5375] <... set_robust_list resumed>) = 0 [pid 5374] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5373] <... bpf resumed>) = 6 [pid 5078] rmdir("./30" [pid 5076] rmdir("./28" [pid 5375] rt_sigprocmask(SIG_SETMASK, [], [pid 5374] <... futex resumed>) = 0 [pid 5373] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5372] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... rmdir resumed>) = 0 [pid 5375] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5374] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5373] <... futex resumed>) = 1 [pid 5372] <... futex resumed>) = 0 [pid 5371] <... futex resumed>) = 0 [pid 5076] <... rmdir resumed>) = 0 [pid 5375] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5374] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5373] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5372] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5371] exit_group(0 [pid 5078] mkdir("./31", 0777 [pid 5375] <... bpf resumed>) = 3 [pid 5374] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5373] <... futex resumed>) = ? [pid 5371] <... exit_group resumed>) = ? [pid 5078] <... mkdir resumed>) = 0 [pid 5076] mkdir("./29", 0777 [pid 5375] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5374] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5373] +++ exited with 0 +++ [pid 5371] +++ exited with 0 +++ [pid 5375] <... futex resumed>) = 1 [pid 5374] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5372] <... futex resumed>) = 0 [pid 5375] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL) = -1 EAGAIN (Resource temporarily unavailable) [pid 5374] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5372] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5076] <... mkdir resumed>) = 0 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5371, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- ./strace-static-x86_64: Process 5376 attached [pid 5375] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5374] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5372] <... futex resumed>) = 0 [pid 5376] set_robust_list(0x55555d6c46a0, 24 [pid 5375] <... bpf resumed>) = 4 [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5377 attached [pid 5376] <... set_robust_list resumed>) = 0 [pid 5375] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5374] <... mprotect resumed>) = 0 [pid 5372] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5377] set_robust_list(0x55555d6c46a0, 24 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5376 [pid 5377] <... set_robust_list resumed>) = 0 [pid 5376] chdir("./31" [pid 5375] <... futex resumed>) = 0 [pid 5374] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5372] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5377] chdir("./29" [pid 5376] <... chdir resumed>) = 0 [pid 5375] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5374] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5372] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5377 [pid 5075] umount2("./29", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5377] <... chdir resumed>) = 0 [pid 5376] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5375] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5374] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5372] <... futex resumed>) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5378 attached [pid 5377] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5376] <... prctl resumed>) = 0 [pid 5375] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5372] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] openat(AT_FDCWD, "./29", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5378] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5377] <... prctl resumed>) = 0 [pid 5376] setpgid(0, 0 [pid 5075] <... openat resumed>) = 3 [pid 5378] <... rseq resumed>) = 0 [pid 5375] <... bpf resumed>) = 5 [pid 5075] newfstatat(3, "", [pid 5378] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5377] setpgid(0, 0 [pid 5376] <... setpgid resumed>) = 0 [pid 5375] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5374] <... clone3 resumed> => {parent_tid=[5378]}, 88) = 5378 [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5378] <... set_robust_list resumed>) = 0 [pid 5377] <... setpgid resumed>) = 0 [pid 5376] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5375] <... futex resumed>) = 1 [pid 5374] rt_sigprocmask(SIG_SETMASK, [], [pid 5372] <... futex resumed>) = 0 [pid 5378] rt_sigprocmask(SIG_SETMASK, [], [pid 5374] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5372] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] getdents64(3, [pid 5378] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5377] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5376] <... openat resumed>) = 3 [pid 5375] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5374] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5372] <... futex resumed>) = 0 [pid 5376] write(3, "1000", 4 [pid 5378] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5377] <... openat resumed>) = 3 [pid 5376] <... write resumed>) = 4 [pid 5375] <... bpf resumed>) = 6 [pid 5374] <... futex resumed>) = 0 [pid 5372] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5378] <... bpf resumed>) = 3 [pid 5376] close(3 [pid 5375] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5372] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5378] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5377] write(3, "1000", 4 [pid 5376] <... close resumed>) = 0 [pid 5375] <... futex resumed>) = 0 [pid 5374] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5372] exit_group(0 [pid 5075] umount2("./29/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5378] <... futex resumed>) = 0 [pid 5377] <... write resumed>) = 4 [pid 5376] symlink("/dev/binderfs", "./binderfs" [pid 5374] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5372] <... exit_group resumed>) = ? [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5378] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5377] close(3 [pid 5374] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5378] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5377] <... close resumed>) = 0 [pid 5376] <... symlink resumed>) = 0 [pid 5375] +++ exited with 0 +++ [pid 5075] newfstatat(AT_FDCWD, "./29/binderfs", [pid 5378] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5377] symlink("/dev/binderfs", "./binderfs" [pid 5374] <... futex resumed>) = 0 [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5378] <... bpf resumed>) = 4 [pid 5377] <... symlink resumed>) = 0 [pid 5376] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5374] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5372] +++ exited with 0 +++ [pid 5376] <... futex resumed>) = 0 [pid 5378] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5377] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5376] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5075] unlink("./29/binderfs" [pid 5378] <... futex resumed>) = 1 [pid 5377] <... futex resumed>) = 0 [pid 5376] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5374] <... futex resumed>) = 0 [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5372, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5378] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5377] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5374] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... unlink resumed>) = 0 [pid 5378] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5377] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5374] <... futex resumed>) = 0 [pid 5378] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5377] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5374] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5378] <... bpf resumed>) = 5 [pid 5377] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5376] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5075] getdents64(3, [pid 5074] umount2("./28", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5376] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] close(3 [pid 5376] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5074] openat(AT_FDCWD, "./28", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5377] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5075] <... close resumed>) = 0 [pid 5378] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5377] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5376] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5075] rmdir("./29" [pid 5074] <... openat resumed>) = 3 [pid 5378] <... futex resumed>) = 1 [pid 5377] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5374] <... futex resumed>) = 0 [pid 5378] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5377] <... mprotect resumed>) = 0 [pid 5374] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5378] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5075] <... rmdir resumed>) = 0 [pid 5074] newfstatat(3, "", [pid 5376] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5378] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5377] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5374] <... futex resumed>) = 0 [pid 5075] mkdir("./30", 0777 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5376] <... mprotect resumed>) = 0 [pid 5378] <... bpf resumed>) = 6 [pid 5377] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5374] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5378] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5377] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5374] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5378] <... futex resumed>) = 0 [pid 5374] exit_group(0 [pid 5075] <... mkdir resumed>) = 0 [pid 5074] getdents64(3, [pid 5376] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5374] <... exit_group resumed>) = ? [pid 5378] +++ exited with 0 +++ ./strace-static-x86_64: Process 5379 attached [pid 5377] <... clone3 resumed> => {parent_tid=[5379]}, 88) = 5379 [pid 5376] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5374] +++ exited with 0 +++ [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5379] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5377] rt_sigprocmask(SIG_SETMASK, [], [pid 5376] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5374, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5074] umount2("./28/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5380 attached [pid 5379] <... rseq resumed>) = 0 [pid 5377] <... rt_sigprocmask resumed>NULL, 8) = 0 ./strace-static-x86_64: Process 5381 attached [pid 5380] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5379] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5377] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5381] set_robust_list(0x55555d6c46a0, 24 [pid 5380] <... rseq resumed>) = 0 [pid 5379] <... set_robust_list resumed>) = 0 [pid 5376] <... clone3 resumed> => {parent_tid=[5380]}, 88) = 5380 [pid 5074] newfstatat(AT_FDCWD, "./28/binderfs", [pid 5381] <... set_robust_list resumed>) = 0 [pid 5379] rt_sigprocmask(SIG_SETMASK, [], [pid 5376] rt_sigprocmask(SIG_SETMASK, [], [pid 5077] umount2("./29", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5379] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5376] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5381] chdir("./30" [pid 5380] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5379] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5377] <... futex resumed>) = 0 [pid 5376] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] openat(AT_FDCWD, "./29", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5381 [pid 5074] unlink("./28/binderfs" [pid 5379] <... bpf resumed>) = 3 [pid 5376] <... futex resumed>) = 0 [pid 5381] <... chdir resumed>) = 0 [pid 5380] <... set_robust_list resumed>) = 0 [pid 5379] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5377] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5376] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... openat resumed>) = 3 [pid 5074] <... unlink resumed>) = 0 [pid 5381] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5380] rt_sigprocmask(SIG_SETMASK, [], [pid 5379] <... futex resumed>) = 0 [pid 5377] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5077] newfstatat(3, "", [pid 5381] <... prctl resumed>) = 0 [pid 5380] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5379] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5377] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5074] getdents64(3, [pid 5381] setpgid(0, 0 [pid 5380] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5379] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5377] <... futex resumed>) = 0 [pid 5077] getdents64(3, [pid 5381] <... setpgid resumed>) = 0 [pid 5380] <... bpf resumed>) = 3 [pid 5379] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5381] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5380] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5379] <... bpf resumed>) = 4 [pid 5377] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5074] close(3 [pid 5381] <... openat resumed>) = 3 [pid 5380] <... futex resumed>) = 1 [pid 5379] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5377] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5376] <... futex resumed>) = 0 [pid 5077] umount2("./29/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... close resumed>) = 0 [pid 5381] write(3, "1000", 4 [pid 5380] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5379] <... futex resumed>) = 0 [pid 5377] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5376] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] rmdir("./28" [pid 5381] <... write resumed>) = 4 [pid 5380] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5379] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5377] <... futex resumed>) = 0 [pid 5376] <... futex resumed>) = 0 [pid 5077] newfstatat(AT_FDCWD, "./29/binderfs", [pid 5381] close(3 [pid 5380] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5377] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] <... rmdir resumed>) = 0 [pid 5381] <... close resumed>) = 0 [pid 5380] <... bpf resumed>) = 4 [pid 5379] <... bpf resumed>) = 5 [pid 5376] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] mkdir("./29", 0777 [pid 5381] symlink("/dev/binderfs", "./binderfs" [pid 5380] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5379] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] unlink("./29/binderfs" [pid 5381] <... symlink resumed>) = 0 [pid 5380] <... futex resumed>) = 1 [pid 5379] <... futex resumed>) = 1 [pid 5377] <... futex resumed>) = 0 [pid 5376] <... futex resumed>) = 0 [pid 5074] <... mkdir resumed>) = 0 [pid 5380] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5379] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5377] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5376] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... unlink resumed>) = 0 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5381] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5380] <... bpf resumed>) = 5 [pid 5379] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5377] <... futex resumed>) = 0 [pid 5376] <... futex resumed>) = 0 [pid 5077] getdents64(3, [pid 5381] <... futex resumed>) = 0 [pid 5381] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, NULL, 8) = 0 [pid 5381] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5379] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5377] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5376] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5382 attached [pid 5381] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5380] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5379] <... bpf resumed>) = 6 [pid 5376] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5382 [pid 5382] set_robust_list(0x55555d6c46a0, 24 [pid 5381] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5380] <... futex resumed>) = 0 [pid 5379] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5376] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] close(3 [pid 5382] <... set_robust_list resumed>) = 0 [pid 5381] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5380] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5382] chdir("./29" [pid 5381] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5380] <... bpf resumed>) = 6 [pid 5379] <... futex resumed>) = 1 [pid 5377] <... futex resumed>) = 0 [pid 5376] <... futex resumed>) = 0 [pid 5077] <... close resumed>) = 0 [pid 5382] <... chdir resumed>) = 0 [pid 5381] <... mprotect resumed>) = 0 [pid 5380] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5379] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5377] exit_group(0 [pid 5376] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] rmdir("./29" [pid 5382] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5381] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5380] <... futex resumed>) = 0 [pid 5379] <... futex resumed>) = ? [pid 5377] <... exit_group resumed>) = ? [pid 5376] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5379] +++ exited with 0 +++ [pid 5381] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5380] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5381] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5382] <... prctl resumed>) = 0 [pid 5376] exit_group(0 [pid 5077] <... rmdir resumed>) = 0 ./strace-static-x86_64: Process 5383 attached [pid 5382] setpgid(0, 0 [pid 5381] <... clone3 resumed> => {parent_tid=[5383]}, 88) = 5383 [pid 5380] <... futex resumed>) = ? [pid 5376] <... exit_group resumed>) = ? [pid 5077] mkdir("./30", 0777 [pid 5383] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5382] <... setpgid resumed>) = 0 [pid 5381] rt_sigprocmask(SIG_SETMASK, [], [pid 5380] +++ exited with 0 +++ [pid 5383] <... rseq resumed>) = 0 [pid 5381] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5381] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5383] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5381] <... futex resumed>) = 0 [pid 5077] <... mkdir resumed>) = 0 [pid 5383] <... set_robust_list resumed>) = 0 [pid 5382] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5381] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5383] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5382] <... openat resumed>) = 3 [pid 5383] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5382] write(3, "1000", 4 [pid 5383] <... bpf resumed>) = 3 [pid 5383] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5382] <... write resumed>) = 4 [pid 5381] <... futex resumed>) = 0 [pid 5383] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5382] close(3./strace-static-x86_64: Process 5384 attached ) = 0 [pid 5381] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5384] set_robust_list(0x55555d6c46a0, 24 [pid 5383] <... futex resumed>) = 0 [pid 5382] symlink("/dev/binderfs", "./binderfs" [pid 5381] <... futex resumed>) = 1 [pid 5384] <... set_robust_list resumed>) = 0 [pid 5383] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5381] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5384 [pid 5384] chdir("./30" [pid 5383] <... bpf resumed>) = 4 [pid 5382] <... symlink resumed>) = 0 [pid 5384] <... chdir resumed>) = 0 [pid 5383] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5382] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5384] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5383] <... futex resumed>) = 1 [pid 5382] <... futex resumed>) = 0 [pid 5381] <... futex resumed>) = 0 [pid 5384] <... prctl resumed>) = 0 [pid 5383] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5382] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5381] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5384] setpgid(0, 0 [pid 5383] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5382] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5381] <... futex resumed>) = 0 [pid 5384] <... setpgid resumed>) = 0 [pid 5383] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5382] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5381] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5384] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5382] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5384] <... openat resumed>) = 3 [pid 5383] <... bpf resumed>) = 5 [pid 5382] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5376] +++ exited with 0 +++ [pid 5377] +++ exited with 0 +++ [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5377, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5384] write(3, "1000", 4 [pid 5382] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5376, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5384] <... write resumed>) = 4 [pid 5382] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5384] close(3 [pid 5078] umount2("./31", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5384] <... close resumed>) = 0 [pid 5383] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5382] <... mprotect resumed>) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5384] symlink("/dev/binderfs", "./binderfs" [pid 5383] <... futex resumed>) = 1 [pid 5381] <... futex resumed>) = 0 [pid 5078] openat(AT_FDCWD, "./31", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5384] <... symlink resumed>) = 0 [pid 5383] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5381] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... openat resumed>) = 3 [pid 5384] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5383] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5382] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5381] <... futex resumed>) = 0 [pid 5078] newfstatat(3, "", [pid 5384] <... futex resumed>) = 0 [pid 5383] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5382] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5381] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5384] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5382] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5078] getdents64(3, [pid 5076] umount2("./29", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5385 attached [pid 5384] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5385] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5384] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5382] <... clone3 resumed> => {parent_tid=[5385]}, 88) = 5385 [pid 5078] umount2("./31/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] openat(AT_FDCWD, "./29", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5385] <... rseq resumed>) = 0 [pid 5384] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5382] rt_sigprocmask(SIG_SETMASK, [], [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] <... openat resumed>) = 3 [pid 5385] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5384] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5382] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] newfstatat(AT_FDCWD, "./31/binderfs", [pid 5076] newfstatat(3, "", [pid 5385] <... set_robust_list resumed>) = 0 [pid 5384] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5382] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5385] rt_sigprocmask(SIG_SETMASK, [], [pid 5384] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5382] <... futex resumed>) = 0 [pid 5078] unlink("./31/binderfs" [pid 5385] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5384] <... mprotect resumed>) = 0 [pid 5382] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] getdents64(3, [pid 5385] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5078] <... unlink resumed>) = 0 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5385] <... bpf resumed>) = 3 [pid 5384] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5078] getdents64(3, [pid 5385] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5384] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5385] <... futex resumed>) = 1 [pid 5384] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5382] <... futex resumed>) = 0 [pid 5078] close(3./strace-static-x86_64: Process 5386 attached [pid 5385] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5383] <... bpf resumed>) = 6 [pid 5382] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] umount2("./29/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5078] <... close resumed>) = 0 [pid 5386] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5385] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5384] <... clone3 resumed> => {parent_tid=[5386]}, 88) = 5386 [pid 5383] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5382] <... futex resumed>) = 0 [pid 5078] rmdir("./31" [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5386] <... rseq resumed>) = 0 [pid 5385] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5384] rt_sigprocmask(SIG_SETMASK, [], [pid 5383] <... futex resumed>) = 1 [pid 5382] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5381] <... futex resumed>) = 0 [pid 5076] newfstatat(AT_FDCWD, "./29/binderfs", [pid 5386] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5385] <... bpf resumed>) = 4 [pid 5384] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5383] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5381] exit_group(0 [pid 5078] <... rmdir resumed>) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5386] <... set_robust_list resumed>) = 0 [pid 5385] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5384] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5383] <... futex resumed>) = ? [pid 5381] <... exit_group resumed>) = ? [pid 5078] mkdir("./32", 0777 [pid 5076] unlink("./29/binderfs" [pid 5386] rt_sigprocmask(SIG_SETMASK, [], [pid 5385] <... futex resumed>) = 1 [pid 5384] <... futex resumed>) = 0 [pid 5383] +++ exited with 0 +++ [pid 5382] <... futex resumed>) = 0 [pid 5381] +++ exited with 0 +++ [pid 5076] <... unlink resumed>) = 0 [pid 5078] <... mkdir resumed>) = 0 [pid 5076] getdents64(3, 0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5381, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5076] close(3 [pid 5075] restart_syscall(<... resuming interrupted clone ...> [pid 5076] <... close resumed>) = 0 [pid 5075] <... restart_syscall resumed>) = 0 [pid 5076] rmdir("./29" [pid 5386] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5385] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5384] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5382] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5076] <... rmdir resumed>) = 0 [pid 5386] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5075] umount2("./30", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5386] <... bpf resumed>) = 3 [pid 5382] <... futex resumed>) = 0 [pid 5076] mkdir("./30", 0777 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5386] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5382] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] <... mkdir resumed>) = 0 [pid 5075] openat(AT_FDCWD, "./30", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5386] <... futex resumed>) = 1 [pid 5384] <... futex resumed>) = 0 [pid 5075] <... openat resumed>) = 3 [pid 5384] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] newfstatat(3, "", [pid 5386] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5384] <... futex resumed>) = 0 [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5386] <... bpf resumed>) = 4 [pid 5384] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5388 attached ./strace-static-x86_64: Process 5387 attached [pid 5075] getdents64(3, [pid 5388] set_robust_list(0x55555d6c46a0, 24 [pid 5387] set_robust_list(0x55555d6c46a0, 24 [pid 5386] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5386] <... futex resumed>) = 1 [pid 5384] <... futex resumed>) = 0 [pid 5385] <... bpf resumed>) = 5 [pid 5386] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5385] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5384] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5387 [pid 5385] <... futex resumed>) = 1 [pid 5384] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5382] <... futex resumed>) = 0 [pid 5388] <... set_robust_list resumed>) = 0 [pid 5387] <... set_robust_list resumed>) = 0 [pid 5385] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5382] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5388 [pid 5075] umount2("./30/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5388] chdir("./30" [pid 5387] chdir("./32" [pid 5382] <... futex resumed>) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5388] <... chdir resumed>) = 0 [pid 5387] <... chdir resumed>) = 0 [pid 5386] <... bpf resumed>) = 5 [pid 5382] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5075] newfstatat(AT_FDCWD, "./30/binderfs", [pid 5388] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5387] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5388] <... prctl resumed>) = 0 [pid 5387] <... prctl resumed>) = 0 [pid 5075] unlink("./30/binderfs" [pid 5388] setpgid(0, 0 [pid 5387] setpgid(0, 0 [pid 5386] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5385] <... bpf resumed>) = 6 [pid 5388] <... setpgid resumed>) = 0 [pid 5387] <... setpgid resumed>) = 0 [pid 5384] <... futex resumed>) = 0 [pid 5386] <... futex resumed>) = 1 [pid 5075] <... unlink resumed>) = 0 [pid 5388] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5387] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5386] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5385] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5384] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5385] <... futex resumed>) = 1 [pid 5388] <... openat resumed>) = 3 [pid 5387] <... openat resumed>) = 3 [pid 5386] <... bpf resumed>) = 6 [pid 5385] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5384] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5382] <... futex resumed>) = 0 [pid 5075] getdents64(3, [pid 5386] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5384] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5382] exit_group(0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5386] <... futex resumed>) = 0 [pid 5385] <... futex resumed>) = ? [pid 5382] <... exit_group resumed>) = ? [pid 5386] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5384] exit_group(0 [pid 5388] write(3, "1000", 4 [pid 5387] write(3, "1000", 4 [pid 5075] close(3 [pid 5384] <... exit_group resumed>) = ? [pid 5388] <... write resumed>) = 4 [pid 5387] <... write resumed>) = 4 [pid 5386] <... futex resumed>) = ? [pid 5075] <... close resumed>) = 0 [pid 5388] close(3 [pid 5387] close(3 [pid 5386] +++ exited with 0 +++ [pid 5075] rmdir("./30" [pid 5388] <... close resumed>) = 0 [pid 5387] <... close resumed>) = 0 [pid 5075] <... rmdir resumed>) = 0 [pid 5388] symlink("/dev/binderfs", "./binderfs" [pid 5387] symlink("/dev/binderfs", "./binderfs" [pid 5388] <... symlink resumed>) = 0 [pid 5387] <... symlink resumed>) = 0 [pid 5075] mkdir("./31", 0777) = 0 [pid 5388] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5387] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5388] <... futex resumed>) = 0 [pid 5387] <... futex resumed>) = 0 [pid 5388] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, NULL, 8) = 0 [pid 5388] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5387] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5388] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5387] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5388] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5387] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5385] +++ exited with 0 +++ [pid 5382] +++ exited with 0 +++ [pid 5388] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5387] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5387] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5388] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5387] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5388] <... mprotect resumed>) = 0 [pid 5387] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5388] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5387] <... mprotect resumed>) = 0 [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5382, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5387] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5384] +++ exited with 0 +++ [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5384, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5388] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5387] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5388] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5387] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5074] umount2("./29", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5391 attached ./strace-static-x86_64: Process 5390 attached ./strace-static-x86_64: Process 5389 attached ) = -1 EINVAL (Invalid argument) [pid 5391] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5074] openat(AT_FDCWD, "./29", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5390] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5388] <... clone3 resumed> => {parent_tid=[5390]}, 88) = 5390 [pid 5391] <... rseq resumed>) = 0 [pid 5389] set_robust_list(0x55555d6c46a0, 24 [pid 5074] <... openat resumed>) = 3 [pid 5391] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5389] <... set_robust_list resumed>) = 0 [pid 5391] <... set_robust_list resumed>) = 0 [pid 5391] rt_sigprocmask(SIG_SETMASK, [], [pid 5390] <... rseq resumed>) = 0 [pid 5388] rt_sigprocmask(SIG_SETMASK, [], [pid 5387] <... clone3 resumed> => {parent_tid=[5391]}, 88) = 5391 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5389 [pid 5391] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5390] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5389] chdir("./31" [pid 5388] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5387] rt_sigprocmask(SIG_SETMASK, [], [pid 5391] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5390] <... set_robust_list resumed>) = 0 [pid 5388] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5387] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5074] newfstatat(3, "", [pid 5390] rt_sigprocmask(SIG_SETMASK, [], [pid 5389] <... chdir resumed>) = 0 [pid 5388] <... futex resumed>) = 0 [pid 5387] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] umount2("./30", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5391] <... futex resumed>) = 0 [pid 5390] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5389] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5388] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5387] <... futex resumed>) = 1 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5391] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5390] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5389] <... prctl resumed>) = 0 [pid 5387] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] getdents64(3, [pid 5391] <... bpf resumed>) = 3 [pid 5390] <... bpf resumed>) = 3 [pid 5389] setpgid(0, 0 [pid 5077] openat(AT_FDCWD, "./30", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5391] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5390] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5389] <... setpgid resumed>) = 0 [pid 5077] <... openat resumed>) = 3 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5391] <... futex resumed>) = 1 [pid 5390] <... futex resumed>) = 1 [pid 5389] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5388] <... futex resumed>) = 0 [pid 5387] <... futex resumed>) = 0 [pid 5077] newfstatat(3, "", [pid 5391] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5390] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5388] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5387] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5074] umount2("./29/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5391] <... bpf resumed>) = 4 [pid 5390] <... bpf resumed>) = 4 [pid 5389] <... openat resumed>) = 3 [pid 5388] <... futex resumed>) = 0 [pid 5387] <... futex resumed>) = 0 [pid 5077] getdents64(3, [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5391] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5390] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5389] write(3, "1000", 4 [pid 5388] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5387] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5074] newfstatat(AT_FDCWD, "./29/binderfs", [pid 5391] <... futex resumed>) = 0 [pid 5390] <... futex resumed>) = 0 [pid 5389] <... write resumed>) = 4 [pid 5077] umount2("./30/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5391] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5390] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5389] close(3 [pid 5388] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5387] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] unlink("./29/binderfs" [pid 5389] <... close resumed>) = 0 [pid 5388] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5387] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] newfstatat(AT_FDCWD, "./30/binderfs", [pid 5074] <... unlink resumed>) = 0 [pid 5391] <... futex resumed>) = 0 [pid 5390] <... futex resumed>) = 0 [pid 5389] symlink("/dev/binderfs", "./binderfs" [pid 5388] <... futex resumed>) = 1 [pid 5387] <... futex resumed>) = 1 [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5391] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5390] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5389] <... symlink resumed>) = 0 [pid 5388] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5387] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] unlink("./30/binderfs" [pid 5074] getdents64(3, [pid 5391] <... bpf resumed>) = 5 [pid 5390] <... bpf resumed>) = 5 [pid 5391] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5389] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... unlink resumed>) = 0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5391] <... futex resumed>) = 1 [pid 5389] <... futex resumed>) = 0 [pid 5387] <... futex resumed>) = 0 [pid 5074] close(3 [pid 5391] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5390] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5389] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5387] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] getdents64(3, [pid 5074] <... close resumed>) = 0 [pid 5391] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5390] <... futex resumed>) = 1 [pid 5389] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5074] rmdir("./29" [pid 5391] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5390] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5389] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5388] <... futex resumed>) = 0 [pid 5387] <... futex resumed>) = 0 [pid 5077] close(3 [pid 5391] <... bpf resumed>) = 6 [pid 5389] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5388] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5387] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] <... close resumed>) = 0 [pid 5074] <... rmdir resumed>) = 0 [pid 5390] <... futex resumed>) = 0 [pid 5389] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5388] <... futex resumed>) = 1 [pid 5077] rmdir("./30" [pid 5391] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5390] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5389] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5388] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] <... rmdir resumed>) = 0 [pid 5074] mkdir("./30", 0777 [pid 5391] <... futex resumed>) = 1 [pid 5390] <... bpf resumed>) = 6 [pid 5389] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5387] <... futex resumed>) = 0 [pid 5391] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5390] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5389] <... mprotect resumed>) = 0 [pid 5387] exit_group(0 [pid 5074] <... mkdir resumed>) = 0 [pid 5391] <... futex resumed>) = ? [pid 5390] <... futex resumed>) = 1 [pid 5389] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5388] <... futex resumed>) = 0 [pid 5387] <... exit_group resumed>) = ? [pid 5077] mkdir("./31", 0777 [pid 5391] +++ exited with 0 +++ [pid 5390] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5388] exit_group(0 [pid 5077] <... mkdir resumed>) = 0 [pid 5389] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5389] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5393 attached ./strace-static-x86_64: Process 5392 attached [pid 5390] <... futex resumed>) = ? [pid 5388] <... exit_group resumed>) = ? [pid 5393] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5392] set_robust_list(0x55555d6c46a0, 24) = 0 [pid 5393] <... rseq resumed>) = 0 [pid 5393] set_robust_list(0x7f3e2f60d9a0, 24) = 0 [pid 5392] chdir("./30" [pid 5389] <... clone3 resumed> => {parent_tid=[5393]}, 88) = 5393 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5393] rt_sigprocmask(SIG_SETMASK, [], [pid 5389] rt_sigprocmask(SIG_SETMASK, [], [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5392 [pid 5392] <... chdir resumed>) = 0 ./strace-static-x86_64: Process 5394 attached [pid 5393] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5389] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5394] set_robust_list(0x55555d6c46a0, 24 [pid 5393] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5392] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5389] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5394 [pid 5394] <... set_robust_list resumed>) = 0 [pid 5393] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5392] <... prctl resumed>) = 0 [pid 5389] <... futex resumed>) = 0 [pid 5394] chdir("./31" [pid 5392] setpgid(0, 0 [pid 5389] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5393] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5392] <... setpgid resumed>) = 0 [pid 5394] <... chdir resumed>) = 0 [pid 5393] <... bpf resumed>) = 3 [pid 5394] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5393] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5392] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5394] <... prctl resumed>) = 0 [pid 5393] <... futex resumed>) = 1 [pid 5392] <... openat resumed>) = 3 [pid 5389] <... futex resumed>) = 0 [pid 5394] setpgid(0, 0 [pid 5389] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5393] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5394] <... setpgid resumed>) = 0 [pid 5392] write(3, "1000", 4 [pid 5389] <... futex resumed>) = 0 [pid 5394] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5393] <... bpf resumed>) = 4 [pid 5392] <... write resumed>) = 4 [pid 5390] +++ exited with 0 +++ [pid 5389] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5388] +++ exited with 0 +++ [pid 5387] +++ exited with 0 +++ [pid 5394] <... openat resumed>) = 3 [pid 5393] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5392] close(3 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5387, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5388, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5394] write(3, "1000", 4 [pid 5393] <... futex resumed>) = 1 [pid 5392] <... close resumed>) = 0 [pid 5389] <... futex resumed>) = 0 [pid 5394] <... write resumed>) = 4 [pid 5389] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] umount2("./30", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5393] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5392] symlink("/dev/binderfs", "./binderfs" [pid 5389] <... futex resumed>) = 0 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5394] close(3) = 0 [pid 5076] openat(AT_FDCWD, "./30", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5394] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5076] <... openat resumed>) = 3 [pid 5394] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5393] <... bpf resumed>) = 5 [pid 5394] <... futex resumed>) = 0 [pid 5394] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, NULL, 8) = 0 [pid 5393] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5392] <... symlink resumed>) = 0 [pid 5389] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] newfstatat(3, "", [pid 5394] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5393] <... futex resumed>) = 0 [pid 5392] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5389] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5078] umount2("./32", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5394] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5393] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5389] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] getdents64(3, [pid 5394] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5393] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5389] <... futex resumed>) = 0 [pid 5078] openat(AT_FDCWD, "./32", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5394] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5393] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5392] <... futex resumed>) = 0 [pid 5394] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5392] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5389] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] <... openat resumed>) = 3 [pid 5076] umount2("./30/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5394] <... mprotect resumed>) = 0 [pid 5393] <... bpf resumed>) = 6 [pid 5392] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5078] newfstatat(3, "", [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5394] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5393] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5392] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5076] newfstatat(AT_FDCWD, "./30/binderfs", [pid 5393] <... futex resumed>) = 1 [pid 5392] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5389] <... futex resumed>) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5393] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5392] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5394] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5392] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5389] exit_group(0 [pid 5078] getdents64(3, [pid 5076] unlink("./30/binderfs" [pid 5394] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5393] <... futex resumed>) = ? [pid 5392] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5389] <... exit_group resumed>) = ? [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5076] <... unlink resumed>) = 0 ./strace-static-x86_64: Process 5395 attached [pid 5392] <... mprotect resumed>) = 0 [pid 5078] umount2("./32/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5394] <... clone3 resumed> => {parent_tid=[5395]}, 88) = 5395 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] getdents64(3, [pid 5394] rt_sigprocmask(SIG_SETMASK, [], [pid 5078] newfstatat(AT_FDCWD, "./32/binderfs", [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5394] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5076] close(3 [pid 5394] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5393] +++ exited with 0 +++ [pid 5389] +++ exited with 0 +++ [pid 5394] <... futex resumed>) = 0 [pid 5078] unlink("./32/binderfs" [pid 5076] <... close resumed>) = 0 [pid 5394] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... unlink resumed>) = 0 [pid 5076] rmdir("./30" [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5389, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5076] <... rmdir resumed>) = 0 [pid 5075] restart_syscall(<... resuming interrupted clone ...> [pid 5078] getdents64(3, 0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5075] <... restart_syscall resumed>) = 0 [pid 5078] close(3) = 0 [pid 5078] rmdir("./32" [pid 5076] mkdir("./31", 0777 [pid 5392] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5395] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053) = 0 [pid 5392] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5076] <... mkdir resumed>) = 0 [pid 5075] umount2("./31", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5078] <... rmdir resumed>) = 0 [pid 5395] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5392] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5395] <... set_robust_list resumed>) = 0 ./strace-static-x86_64: Process 5396 attached [pid 5395] rt_sigprocmask(SIG_SETMASK, [], [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5396] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5395] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5392] <... clone3 resumed> => {parent_tid=[5396]}, 88) = 5396 [pid 5078] mkdir("./33", 0777 [pid 5075] openat(AT_FDCWD, "./31", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5396] <... rseq resumed>) = 0 [pid 5395] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5392] rt_sigprocmask(SIG_SETMASK, [], [pid 5078] <... mkdir resumed>) = 0 [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5075] <... openat resumed>) = 3 [pid 5396] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5395] <... bpf resumed>) = 3 [pid 5392] <... rt_sigprocmask resumed>NULL, 8) = 0 ./strace-static-x86_64: Process 5397 attached [pid 5396] <... set_robust_list resumed>) = 0 [pid 5395] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5392] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] newfstatat(3, "", [pid 5396] rt_sigprocmask(SIG_SETMASK, [], [pid 5395] <... futex resumed>) = 1 [pid 5394] <... futex resumed>) = 0 [pid 5392] <... futex resumed>) = 0 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5396] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5395] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5397] set_robust_list(0x55555d6c46a0, 24 [pid 5396] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5392] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5398 attached [pid 5397] <... set_robust_list resumed>) = 0 [pid 5396] <... bpf resumed>) = 3 [pid 5398] set_robust_list(0x55555d6c46a0, 24 [pid 5396] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5394] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5392] <... futex resumed>) = 0 [pid 5397] chdir("./31" [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5397 [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5398] <... set_robust_list resumed>) = 0 [pid 5396] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5395] <... futex resumed>) = 0 [pid 5394] <... futex resumed>) = 1 [pid 5392] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5398 [pid 5075] getdents64(3, [pid 5398] chdir("./33" [pid 5397] <... chdir resumed>) = 0 [pid 5396] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5395] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5394] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5392] <... futex resumed>) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5398] <... chdir resumed>) = 0 [pid 5397] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5396] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5395] <... bpf resumed>) = 4 [pid 5392] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] umount2("./31/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5398] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5397] <... prctl resumed>) = 0 [pid 5395] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5398] <... prctl resumed>) = 0 [pid 5396] <... bpf resumed>) = 4 [pid 5395] <... futex resumed>) = 1 [pid 5394] <... futex resumed>) = 0 [pid 5075] newfstatat(AT_FDCWD, "./31/binderfs", [pid 5398] setpgid(0, 0 [pid 5397] setpgid(0, 0 [pid 5396] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5395] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5394] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5398] <... setpgid resumed>) = 0 [pid 5395] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5394] <... futex resumed>) = 0 [pid 5392] <... futex resumed>) = 0 [pid 5396] <... futex resumed>) = 1 [pid 5075] unlink("./31/binderfs" [pid 5398] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5397] <... setpgid resumed>) = 0 [pid 5396] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5395] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5394] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5392] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... unlink resumed>) = 0 [pid 5397] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5396] <... bpf resumed>) = 5 [pid 5395] <... bpf resumed>) = 5 [pid 5392] <... futex resumed>) = 0 [pid 5398] <... openat resumed>) = 3 [pid 5395] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5392] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] getdents64(3, [pid 5395] <... futex resumed>) = 1 [pid 5394] <... futex resumed>) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5398] write(3, "1000", 4 [pid 5395] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5394] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5398] <... write resumed>) = 4 [pid 5397] <... openat resumed>) = 3 [pid 5395] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5396] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5394] <... futex resumed>) = 0 [pid 5075] close(3 [pid 5398] close(3 [pid 5397] write(3, "1000", 4 [pid 5396] <... futex resumed>) = 1 [pid 5395] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5394] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5392] <... futex resumed>) = 0 [pid 5398] <... close resumed>) = 0 [pid 5397] <... write resumed>) = 4 [pid 5396] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5395] <... bpf resumed>) = 6 [pid 5392] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... close resumed>) = 0 [pid 5398] symlink("/dev/binderfs", "./binderfs" [pid 5397] close(3 [pid 5396] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5395] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5392] <... futex resumed>) = 0 [pid 5075] rmdir("./31" [pid 5397] <... close resumed>) = 0 [pid 5396] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5395] <... futex resumed>) = 1 [pid 5394] <... futex resumed>) = 0 [pid 5392] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5398] <... symlink resumed>) = 0 [pid 5075] <... rmdir resumed>) = 0 [pid 5397] symlink("/dev/binderfs", "./binderfs" [pid 5396] <... bpf resumed>) = 6 [pid 5395] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5394] exit_group(0 [pid 5395] <... futex resumed>) = ? [pid 5394] <... exit_group resumed>) = ? [pid 5396] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5398] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5397] <... symlink resumed>) = 0 [pid 5395] +++ exited with 0 +++ [pid 5392] <... futex resumed>) = 0 [pid 5396] <... futex resumed>) = 1 [pid 5075] mkdir("./32", 0777 [pid 5398] <... futex resumed>) = 0 [pid 5397] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5396] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5392] exit_group(0 [pid 5075] <... mkdir resumed>) = 0 [pid 5398] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5397] <... futex resumed>) = 0 [pid 5396] <... futex resumed>) = ? [pid 5392] <... exit_group resumed>) = ? [pid 5396] +++ exited with 0 +++ [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5397] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5398] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5397] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5398] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5397] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5398] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5397] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5398] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5397] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0./strace-static-x86_64: Process 5399 attached [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5399 [pid 5399] set_robust_list(0x55555d6c46a0, 24 [pid 5398] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5397] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5399] <... set_robust_list resumed>) = 0 [pid 5398] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5397] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5398] <... mprotect resumed>) = 0 [pid 5399] chdir("./32" [pid 5397] <... mprotect resumed>) = 0 [pid 5398] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5399] <... chdir resumed>) = 0 [pid 5397] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5399] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5398] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5397] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5394] +++ exited with 0 +++ [pid 5399] <... prctl resumed>) = 0 [pid 5398] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5397] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5399] setpgid(0, 0./strace-static-x86_64: Process 5400 attached [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5394, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5399] <... setpgid resumed>) = 0 [pid 5400] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5398] <... clone3 resumed> => {parent_tid=[5400]}, 88) = 5400 ./strace-static-x86_64: Process 5401 attached [pid 5400] <... rseq resumed>) = 0 [pid 5399] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5398] rt_sigprocmask(SIG_SETMASK, [], [pid 5397] <... clone3 resumed> => {parent_tid=[5401]}, 88) = 5401 [pid 5392] +++ exited with 0 +++ [pid 5401] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5400] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5398] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5392, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5397] rt_sigprocmask(SIG_SETMASK, [], [pid 5401] <... rseq resumed>) = 0 [pid 5400] <... set_robust_list resumed>) = 0 [pid 5399] <... openat resumed>) = 3 [pid 5398] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5397] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5401] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5400] rt_sigprocmask(SIG_SETMASK, [], [pid 5401] <... set_robust_list resumed>) = 0 [pid 5400] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5397] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5398] <... futex resumed>) = 0 [pid 5077] umount2("./31", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5399] write(3, "1000", 4 [pid 5401] rt_sigprocmask(SIG_SETMASK, [], [pid 5400] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5398] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5397] <... futex resumed>) = 0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5401] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5400] <... bpf resumed>) = 3 [pid 5399] <... write resumed>) = 4 [pid 5397] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] openat(AT_FDCWD, "./31", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5074] umount2("./30", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5401] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5400] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5399] close(3 [pid 5077] <... openat resumed>) = 3 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5399] <... close resumed>) = 0 [pid 5074] openat(AT_FDCWD, "./30", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5401] <... bpf resumed>) = 3 [pid 5400] <... futex resumed>) = 1 [pid 5399] symlink("/dev/binderfs", "./binderfs" [pid 5398] <... futex resumed>) = 0 [pid 5077] newfstatat(3, "", [pid 5401] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5400] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5399] <... symlink resumed>) = 0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5398] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... openat resumed>) = 3 [pid 5401] <... futex resumed>) = 1 [pid 5400] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5398] <... futex resumed>) = 0 [pid 5397] <... futex resumed>) = 0 [pid 5077] getdents64(3, [pid 5401] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5400] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5399] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5398] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5397] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5074] newfstatat(3, "", [pid 5401] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5400] <... bpf resumed>) = 4 [pid 5397] <... futex resumed>) = 0 [pid 5401] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5400] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5399] <... futex resumed>) = 0 [pid 5397] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] umount2("./31/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5400] <... futex resumed>) = 1 [pid 5399] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5398] <... futex resumed>) = 0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] getdents64(3, [pid 5401] <... bpf resumed>) = 4 [pid 5400] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5399] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5398] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] newfstatat(AT_FDCWD, "./31/binderfs", [pid 5401] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5400] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5401] <... futex resumed>) = 1 [pid 5400] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5398] <... futex resumed>) = 0 [pid 5401] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5400] <... bpf resumed>) = 5 [pid 5399] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5398] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5397] <... futex resumed>) = 0 [pid 5077] unlink("./31/binderfs" [pid 5074] umount2("./30/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5401] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5399] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5397] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5401] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5399] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5397] <... futex resumed>) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5400] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... unlink resumed>) = 0 [pid 5401] <... bpf resumed>) = 5 [pid 5400] <... futex resumed>) = 1 [pid 5399] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5398] <... futex resumed>) = 0 [pid 5397] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] newfstatat(AT_FDCWD, "./30/binderfs", [pid 5401] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5400] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5399] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5398] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5397] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5077] getdents64(3, [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5401] <... futex resumed>) = 0 [pid 5400] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5399] <... mprotect resumed>) = 0 [pid 5398] <... futex resumed>) = 0 [pid 5397] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5074] unlink("./30/binderfs" [pid 5401] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5400] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5398] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] close(3 [pid 5399] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5401] <... bpf resumed>) = 6 [pid 5400] <... bpf resumed>) = 6 [pid 5397] <... futex resumed>) = 0 [pid 5399] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5074] <... unlink resumed>) = 0 [pid 5401] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5400] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... close resumed>) = 0 [pid 5401] <... futex resumed>) = 0 [pid 5400] <... futex resumed>) = 1 [pid 5399] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5398] <... futex resumed>) = 0 [pid 5397] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] rmdir("./31" [pid 5074] getdents64(3, [pid 5401] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5400] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5397] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5398] exit_group(0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5397] exit_group(0./strace-static-x86_64: Process 5402 attached [pid 5400] <... futex resumed>) = ? [pid 5398] <... exit_group resumed>) = ? [pid 5077] <... rmdir resumed>) = 0 [pid 5401] <... futex resumed>) = ? [pid 5397] <... exit_group resumed>) = ? [pid 5074] close(3 [pid 5402] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5399] <... clone3 resumed> => {parent_tid=[5402]}, 88) = 5402 [pid 5401] +++ exited with 0 +++ [pid 5074] <... close resumed>) = 0 [pid 5399] rt_sigprocmask(SIG_SETMASK, [], [pid 5402] <... rseq resumed>) = 0 [pid 5400] +++ exited with 0 +++ [pid 5399] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5398] +++ exited with 0 +++ [pid 5397] +++ exited with 0 +++ [pid 5077] mkdir("./32", 0777 [pid 5074] rmdir("./30" [pid 5402] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5399] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... mkdir resumed>) = 0 [pid 5402] <... set_robust_list resumed>) = 0 [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5397, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- [pid 5402] rt_sigprocmask(SIG_SETMASK, [], [pid 5076] restart_syscall(<... resuming interrupted clone ...> [pid 5402] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5399] <... futex resumed>) = 0 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5398, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5076] <... restart_syscall resumed>) = 0 [pid 5074] <... rmdir resumed>) = 0 ./strace-static-x86_64: Process 5403 attached [pid 5402] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5399] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] restart_syscall(<... resuming interrupted clone ...> [pid 5074] mkdir("./31", 0777 [pid 5403] set_robust_list(0x55555d6c46a0, 24 [pid 5402] <... bpf resumed>) = 3 [pid 5078] <... restart_syscall resumed>) = 0 [pid 5403] <... set_robust_list resumed>) = 0 [pid 5402] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5403] chdir("./32" [pid 5402] <... futex resumed>) = 1 [pid 5076] umount2("./31", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5399] <... futex resumed>) = 0 [pid 5402] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5403] <... chdir resumed>) = 0 [pid 5399] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] umount2("./33", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5403 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] <... mkdir resumed>) = 0 [pid 5403] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5399] <... futex resumed>) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5403] <... prctl resumed>) = 0 [pid 5399] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] openat(AT_FDCWD, "./33", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5402] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5076] openat(AT_FDCWD, "./31", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5402] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5076] <... openat resumed>) = 3 ./strace-static-x86_64: Process 5404 attached [pid 5403] setpgid(0, 0 [pid 5402] <... bpf resumed>) = 4 [pid 5078] <... openat resumed>) = 3 [pid 5076] newfstatat(3, "", [pid 5404] set_robust_list(0x55555d6c46a0, 24 [pid 5403] <... setpgid resumed>) = 0 [pid 5402] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] newfstatat(3, "", [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5404 [pid 5404] <... set_robust_list resumed>) = 0 [pid 5403] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5402] <... futex resumed>) = 1 [pid 5399] <... futex resumed>) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5076] getdents64(3, [pid 5402] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5399] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5404] chdir("./31" [pid 5403] <... openat resumed>) = 3 [pid 5402] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5399] <... futex resumed>) = 0 [pid 5078] getdents64(3, [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5402] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5399] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5404] <... chdir resumed>) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5404] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5403] write(3, "1000", 4 [pid 5404] <... prctl resumed>) = 0 [pid 5078] umount2("./33/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5403] <... write resumed>) = 4 [pid 5404] setpgid(0, 0 [pid 5402] <... bpf resumed>) = 5 [pid 5076] umount2("./31/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5402] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5402] <... futex resumed>) = 1 [pid 5399] <... futex resumed>) = 0 [pid 5076] newfstatat(AT_FDCWD, "./31/binderfs", [pid 5402] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5399] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5402] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5399] <... futex resumed>) = 0 [pid 5076] unlink("./31/binderfs" [pid 5402] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5399] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5403] close(3 [pid 5076] <... unlink resumed>) = 0 [pid 5404] <... setpgid resumed>) = 0 [pid 5403] <... close resumed>) = 0 [pid 5402] <... bpf resumed>) = 6 [pid 5078] newfstatat(AT_FDCWD, "./33/binderfs", [pid 5404] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5403] symlink("/dev/binderfs", "./binderfs" [pid 5402] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5076] getdents64(3, [pid 5402] <... futex resumed>) = 1 [pid 5399] <... futex resumed>) = 0 [pid 5078] unlink("./33/binderfs" [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5402] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5399] exit_group(0 [pid 5076] close(3 [pid 5402] <... futex resumed>) = ? [pid 5399] <... exit_group resumed>) = ? [pid 5078] <... unlink resumed>) = 0 [pid 5404] <... openat resumed>) = 3 [pid 5403] <... symlink resumed>) = 0 [pid 5402] +++ exited with 0 +++ [pid 5399] +++ exited with 0 +++ [pid 5078] getdents64(3, [pid 5076] <... close resumed>) = 0 [pid 5076] rmdir("./31" [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5399, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5404] write(3, "1000", 4 [pid 5403] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] close(3 [pid 5076] <... rmdir resumed>) = 0 [pid 5404] <... write resumed>) = 4 [pid 5404] close(3 [pid 5403] <... futex resumed>) = 0 [pid 5078] <... close resumed>) = 0 [pid 5076] mkdir("./32", 0777 [pid 5404] <... close resumed>) = 0 [pid 5403] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5078] rmdir("./33" [pid 5075] umount2("./32", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5404] symlink("/dev/binderfs", "./binderfs" [pid 5403] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5076] <... mkdir resumed>) = 0 [pid 5078] <... rmdir resumed>) = 0 [pid 5403] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5404] <... symlink resumed>) = 0 [pid 5403] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] mkdir("./34", 0777 [pid 5075] openat(AT_FDCWD, "./32", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5404] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5403] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0./strace-static-x86_64: Process 5405 attached [pid 5404] <... futex resumed>) = 0 [pid 5403] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5078] <... mkdir resumed>) = 0 [pid 5075] <... openat resumed>) = 3 [pid 5404] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5403] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5075] newfstatat(3, "", [pid 5405] set_robust_list(0x55555d6c46a0, 24 [pid 5404] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5404] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5403] <... mprotect resumed>) = 0 [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5405 [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5405] <... set_robust_list resumed>) = 0 [pid 5404] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5404] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5405] chdir("./32" [pid 5404] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5403] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5075] getdents64(3, [pid 5404] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5405] <... chdir resumed>) = 0 [pid 5404] <... mprotect resumed>) = 0 [pid 5405] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5405] <... prctl resumed>) = 0 [pid 5403] <... rt_sigprocmask resumed>[], 8) = 0 ./strace-static-x86_64: Process 5406 attached [pid 5405] setpgid(0, 0 [pid 5404] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5403] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5075] umount2("./32/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5407 attached [pid 5406] set_robust_list(0x55555d6c46a0, 24 [pid 5405] <... setpgid resumed>) = 0 [pid 5404] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5407] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5406] <... set_robust_list resumed>) = 0 [pid 5407] <... rseq resumed>) = 0 [pid 5407] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5406] chdir("./34" [pid 5404] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5403] <... clone3 resumed> => {parent_tid=[5407]}, 88) = 5407 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5406 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5405] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5075] newfstatat(AT_FDCWD, "./32/binderfs", [pid 5407] <... set_robust_list resumed>) = 0 [pid 5406] <... chdir resumed>) = 0 [pid 5403] rt_sigprocmask(SIG_SETMASK, [], ./strace-static-x86_64: Process 5408 attached [pid 5407] rt_sigprocmask(SIG_SETMASK, [], [pid 5406] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5405] <... openat resumed>) = 3 [pid 5403] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5407] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5406] <... prctl resumed>) = 0 [pid 5403] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5408] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5407] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5406] setpgid(0, 0 [pid 5405] write(3, "1000", 4 [pid 5404] <... clone3 resumed> => {parent_tid=[5408]}, 88) = 5408 [pid 5403] <... futex resumed>) = 0 [pid 5075] unlink("./32/binderfs" [pid 5408] <... rseq resumed>) = 0 [pid 5405] <... write resumed>) = 4 [pid 5404] rt_sigprocmask(SIG_SETMASK, [], [pid 5408] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5405] close(3 [pid 5404] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5408] <... set_robust_list resumed>) = 0 [pid 5407] <... bpf resumed>) = 3 [pid 5406] <... setpgid resumed>) = 0 [pid 5405] <... close resumed>) = 0 [pid 5404] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5403] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5408] rt_sigprocmask(SIG_SETMASK, [], [pid 5407] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5406] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5405] symlink("/dev/binderfs", "./binderfs" [pid 5404] <... futex resumed>) = 0 [pid 5403] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5075] <... unlink resumed>) = 0 [pid 5408] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5407] <... futex resumed>) = 0 [pid 5406] <... openat resumed>) = 3 [pid 5405] <... symlink resumed>) = 0 [pid 5404] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5403] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] getdents64(3, [pid 5408] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5407] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5406] write(3, "1000", 4 [pid 5405] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5403] <... futex resumed>) = 0 [pid 5408] <... bpf resumed>) = 3 [pid 5406] <... write resumed>) = 4 [pid 5405] <... futex resumed>) = 0 [pid 5403] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5408] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5407] <... bpf resumed>) = 4 [pid 5406] close(3 [pid 5405] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5408] <... futex resumed>) = 1 [pid 5404] <... futex resumed>) = 0 [pid 5075] close(3 [pid 5408] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5407] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5406] <... close resumed>) = 0 [pid 5405] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5404] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... close resumed>) = 0 [pid 5408] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5407] <... futex resumed>) = 1 [pid 5406] symlink("/dev/binderfs", "./binderfs" [pid 5405] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5404] <... futex resumed>) = 0 [pid 5403] <... futex resumed>) = 0 [pid 5075] rmdir("./32" [pid 5408] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5405] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5404] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5406] <... symlink resumed>) = 0 [pid 5408] <... bpf resumed>) = 4 [pid 5407] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5406] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5405] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5403] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... rmdir resumed>) = 0 [pid 5408] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5406] <... futex resumed>) = 0 [pid 5405] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5403] <... futex resumed>) = 0 [pid 5408] <... futex resumed>) = 1 [pid 5406] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5405] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5404] <... futex resumed>) = 0 [pid 5403] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5408] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5407] <... bpf resumed>) = 5 [pid 5406] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5405] <... mprotect resumed>) = 0 [pid 5404] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] mkdir("./33", 0777 [pid 5408] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5404] <... futex resumed>) = 0 [pid 5408] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5406] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5405] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5404] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5408] <... bpf resumed>) = 5 [pid 5407] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5406] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] <... mkdir resumed>) = 0 [pid 5407] <... futex resumed>) = 1 [pid 5406] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5403] <... futex resumed>) = 0 [pid 5407] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5406] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5405] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5403] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5408] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5407] <... futex resumed>) = 0 [pid 5406] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5405] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5403] <... futex resumed>) = 1 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5409 attached [pid 5408] <... futex resumed>) = 1 [pid 5407] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5406] <... mprotect resumed>) = 0 [pid 5404] <... futex resumed>) = 0 [pid 5403] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5408] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5407] <... bpf resumed>) = 6 [pid 5404] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5408] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5407] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5405] <... clone3 resumed> => {parent_tid=[5409]}, 88) = 5409 [pid 5404] <... futex resumed>) = 0 [pid 5403] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5408] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5407] <... futex resumed>) = 0 [pid 5405] rt_sigprocmask(SIG_SETMASK, [], [pid 5404] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5409] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5408] <... bpf resumed>) = 6 [pid 5405] <... rt_sigprocmask resumed>NULL, 8) = 0 ./strace-static-x86_64: Process 5410 attached [pid 5409] <... rseq resumed>) = 0 [pid 5407] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5406] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5405] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5403] exit_group(0 [pid 5410] set_robust_list(0x55555d6c46a0, 24 [pid 5409] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5408] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5407] <... futex resumed>) = ? [pid 5406] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5405] <... futex resumed>) = 0 [pid 5403] <... exit_group resumed>) = ? [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5410 [pid 5410] <... set_robust_list resumed>) = 0 [pid 5409] <... set_robust_list resumed>) = 0 [pid 5408] <... futex resumed>) = 1 [pid 5407] +++ exited with 0 +++ [pid 5406] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5405] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5404] <... futex resumed>) = 0 [pid 5410] chdir("./33" [pid 5408] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5404] exit_group(0 [pid 5409] rt_sigprocmask(SIG_SETMASK, [], [pid 5408] <... futex resumed>) = ? [pid 5404] <... exit_group resumed>) = ? ./strace-static-x86_64: Process 5411 attached [pid 5410] <... chdir resumed>) = 0 [pid 5409] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5408] +++ exited with 0 +++ [pid 5406] <... clone3 resumed> => {parent_tid=[5411]}, 88) = 5411 [pid 5411] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5410] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5406] rt_sigprocmask(SIG_SETMASK, [], [pid 5409] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5411] <... rseq resumed>) = 0 [pid 5410] <... prctl resumed>) = 0 [pid 5409] <... bpf resumed>) = 3 [pid 5406] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5411] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5410] setpgid(0, 0 [pid 5409] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5406] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5411] <... set_robust_list resumed>) = 0 [pid 5410] <... setpgid resumed>) = 0 [pid 5409] <... futex resumed>) = 1 [pid 5406] <... futex resumed>) = 0 [pid 5405] <... futex resumed>) = 0 [pid 5411] rt_sigprocmask(SIG_SETMASK, [], [pid 5410] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5409] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5406] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5405] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5411] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5409] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5411] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5410] <... openat resumed>) = 3 [pid 5409] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5405] <... futex resumed>) = 0 [pid 5411] <... bpf resumed>) = 3 [pid 5410] write(3, "1000", 4 [pid 5405] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5411] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5410] <... write resumed>) = 4 [pid 5409] <... bpf resumed>) = 4 [pid 5403] +++ exited with 0 +++ [pid 5411] <... futex resumed>) = 1 [pid 5406] <... futex resumed>) = 0 [pid 5411] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5409] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5406] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5411] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5406] <... futex resumed>) = 0 [pid 5409] <... futex resumed>) = 1 [pid 5406] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5409] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5411] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5410] close(3 [pid 5405] <... futex resumed>) = 0 [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5403, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5411] <... bpf resumed>) = 4 [pid 5410] <... close resumed>) = 0 [pid 5405] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5410] symlink("/dev/binderfs", "./binderfs" [pid 5405] <... futex resumed>) = 1 [pid 5411] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5410] <... symlink resumed>) = 0 [pid 5409] <... futex resumed>) = 0 [pid 5405] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5404] +++ exited with 0 +++ [pid 5410] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5411] <... futex resumed>) = 1 [pid 5410] <... futex resumed>) = 0 [pid 5409] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5406] <... futex resumed>) = 0 [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5404, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5411] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5410] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5406] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] restart_syscall(<... resuming interrupted clone ...> [pid 5410] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5077] umount2("./32", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... restart_syscall resumed>) = 0 [pid 5410] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5409] <... bpf resumed>) = 5 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5411] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5410] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5409] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5406] <... futex resumed>) = 0 [pid 5077] openat(AT_FDCWD, "./32", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5411] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5410] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5409] <... futex resumed>) = 1 [pid 5406] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5405] <... futex resumed>) = 0 [pid 5077] <... openat resumed>) = 3 [pid 5074] umount2("./31", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5410] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5405] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] newfstatat(3, "", [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5411] <... bpf resumed>) = 5 [pid 5410] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5409] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5405] <... futex resumed>) = 0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5074] openat(AT_FDCWD, "./31", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5411] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5410] <... mprotect resumed>) = 0 [pid 5405] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] getdents64(3, [pid 5074] <... openat resumed>) = 3 [pid 5411] <... futex resumed>) = 1 [pid 5410] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5406] <... futex resumed>) = 0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5074] newfstatat(3, "", [pid 5411] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5406] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5411] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5410] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5406] <... futex resumed>) = 0 [pid 5077] umount2("./32/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5411] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5410] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5406] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] getdents64(3, ./strace-static-x86_64: Process 5412 attached [pid 5412] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053) = 0 [pid 5412] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5410] <... clone3 resumed> => {parent_tid=[5412]}, 88) = 5412 [pid 5077] newfstatat(AT_FDCWD, "./32/binderfs", [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5412] <... set_robust_list resumed>) = 0 [pid 5410] rt_sigprocmask(SIG_SETMASK, [], [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] umount2("./31/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5412] rt_sigprocmask(SIG_SETMASK, [], [pid 5410] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] unlink("./32/binderfs" [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5412] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5410] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... unlink resumed>) = 0 [pid 5412] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5410] <... futex resumed>) = 0 [pid 5074] newfstatat(AT_FDCWD, "./31/binderfs", [pid 5412] <... bpf resumed>) = 3 [pid 5410] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] getdents64(3, [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5412] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] close(3 [pid 5074] unlink("./31/binderfs" [pid 5412] <... futex resumed>) = 1 [pid 5410] <... futex resumed>) = 0 [pid 5077] <... close resumed>) = 0 [pid 5074] <... unlink resumed>) = 0 [pid 5412] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5410] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5409] <... bpf resumed>) = 6 [pid 5411] <... bpf resumed>) = 6 [pid 5410] <... futex resumed>) = 0 [pid 5077] rmdir("./32" [pid 5412] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5411] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5410] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5412] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5409] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... rmdir resumed>) = 0 [pid 5074] getdents64(3, [pid 5411] <... futex resumed>) = 1 [pid 5406] <... futex resumed>) = 0 [pid 5411] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5409] <... futex resumed>) = 1 [pid 5406] exit_group(0 [pid 5405] <... futex resumed>) = 0 [pid 5077] mkdir("./33", 0777 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5412] <... bpf resumed>) = 4 [pid 5411] <... futex resumed>) = ? [pid 5409] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5406] <... exit_group resumed>) = ? [pid 5405] exit_group(0 [pid 5077] <... mkdir resumed>) = 0 [pid 5074] close(3 [pid 5412] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5411] +++ exited with 0 +++ [pid 5405] <... exit_group resumed>) = ? [pid 5412] <... futex resumed>) = 1 [pid 5410] <... futex resumed>) = 0 [pid 5409] <... futex resumed>) = ? [pid 5406] +++ exited with 0 +++ [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] <... close resumed>) = 0 [pid 5412] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5410] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5406, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5074] rmdir("./31" [pid 5412] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5410] <... futex resumed>) = 0 [pid 5074] <... rmdir resumed>) = 0 [pid 5412] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144./strace-static-x86_64: Process 5413 attached ) = 5 [pid 5410] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] mkdir("./32", 0777 [pid 5413] set_robust_list(0x55555d6c46a0, 24 [pid 5078] umount2("./34", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5413 [pid 5413] <... set_robust_list resumed>) = 0 [pid 5412] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5412] <... futex resumed>) = 1 [pid 5410] <... futex resumed>) = 0 [pid 5412] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5410] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... mkdir resumed>) = 0 [pid 5413] chdir("./33" [pid 5412] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5410] <... futex resumed>) = 0 [pid 5409] +++ exited with 0 +++ [pid 5405] +++ exited with 0 +++ [pid 5078] openat(AT_FDCWD, "./34", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5412] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5410] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] <... openat resumed>) = 3 [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5405, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5078] newfstatat(3, "", ./strace-static-x86_64: Process 5414 attached [pid 5414] set_robust_list(0x55555d6c46a0, 24 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5413] <... chdir resumed>) = 0 [pid 5414] <... set_robust_list resumed>) = 0 [pid 5414] chdir("./32" [pid 5413] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5078] getdents64(3, [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5414 [pid 5413] <... prctl resumed>) = 0 [pid 5414] <... chdir resumed>) = 0 [pid 5413] setpgid(0, 0 [pid 5412] <... bpf resumed>) = 6 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5076] umount2("./32", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5413] <... setpgid resumed>) = 0 [pid 5414] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5412] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5414] <... prctl resumed>) = 0 [pid 5413] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5412] <... futex resumed>) = 1 [pid 5410] <... futex resumed>) = 0 [pid 5076] openat(AT_FDCWD, "./32", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5078] umount2("./34/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5414] setpgid(0, 0 [pid 5412] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5410] exit_group(0 [pid 5414] <... setpgid resumed>) = 0 [pid 5412] <... futex resumed>) = ? [pid 5410] <... exit_group resumed>) = ? [pid 5076] <... openat resumed>) = 3 [pid 5414] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5413] <... openat resumed>) = 3 [pid 5412] +++ exited with 0 +++ [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5078] newfstatat(AT_FDCWD, "./34/binderfs", [pid 5076] newfstatat(3, "", [pid 5410] +++ exited with 0 +++ [pid 5413] write(3, "1000", 4 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5410, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5413] <... write resumed>) = 4 [pid 5078] unlink("./34/binderfs" [pid 5076] getdents64(3, [pid 5413] close(3 [pid 5078] <... unlink resumed>) = 0 [pid 5414] <... openat resumed>) = 3 [pid 5413] <... close resumed>) = 0 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5414] write(3, "1000", 4) = 4 [pid 5414] close(3 [pid 5413] symlink("/dev/binderfs", "./binderfs" [pid 5414] <... close resumed>) = 0 [pid 5078] getdents64(3, [pid 5076] umount2("./32/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5414] symlink("/dev/binderfs", "./binderfs" [pid 5413] <... symlink resumed>) = 0 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] umount2("./33", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5414] <... symlink resumed>) = 0 [pid 5078] close(3 [pid 5076] newfstatat(AT_FDCWD, "./32/binderfs", [pid 5414] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5413] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... close resumed>) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5414] <... futex resumed>) = 0 [pid 5413] <... futex resumed>) = 0 [pid 5078] rmdir("./34" [pid 5075] openat(AT_FDCWD, "./33", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5414] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5413] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5076] unlink("./32/binderfs" [pid 5075] <... openat resumed>) = 3 [pid 5414] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5413] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5078] <... rmdir resumed>) = 0 [pid 5075] newfstatat(3, "", [pid 5414] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5413] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5414] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5413] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5076] <... unlink resumed>) = 0 [pid 5075] getdents64(3, [pid 5414] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5413] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5078] mkdir("./35", 0777 [pid 5076] getdents64(3, [pid 5414] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5413] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5414] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5413] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5075] umount2("./33/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5414] <... mprotect resumed>) = 0 [pid 5413] <... mprotect resumed>) = 0 [pid 5078] <... mkdir resumed>) = 0 [pid 5414] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5413] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5076] close(3 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] <... close resumed>) = 0 [pid 5076] rmdir("./32" [pid 5414] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5413] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5075] newfstatat(AT_FDCWD, "./33/binderfs", [pid 5414] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5413] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 ./strace-static-x86_64: Process 5416 attached [pid 5076] <... rmdir resumed>) = 0 [pid 5075] unlink("./33/binderfs" [pid 5416] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5414] <... clone3 resumed> => {parent_tid=[5415]}, 88) = 5415 [pid 5416] <... rseq resumed>) = 0 [pid 5414] rt_sigprocmask(SIG_SETMASK, [], [pid 5413] <... clone3 resumed> => {parent_tid=[5416]}, 88) = 5416 [pid 5075] <... unlink resumed>) = 0 [pid 5416] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5414] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5413] rt_sigprocmask(SIG_SETMASK, [], ./strace-static-x86_64: Process 5415 attached [pid 5076] mkdir("./33", 0777 [pid 5415] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5416] <... set_robust_list resumed>) = 0 [pid 5415] <... rseq resumed>) = 0 [pid 5414] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5413] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] getdents64(3, [pid 5416] rt_sigprocmask(SIG_SETMASK, [], [pid 5415] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5414] <... futex resumed>) = 0 [pid 5413] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5416] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5415] <... set_robust_list resumed>) = 0 [pid 5414] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5413] <... futex resumed>) = 0 [pid 5416] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5413] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] close(3 [pid 5416] <... bpf resumed>) = 3 [pid 5075] <... close resumed>) = 0 [pid 5415] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5417 ./strace-static-x86_64: Process 5417 attached [pid 5416] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] rmdir("./33" [pid 5416] <... futex resumed>) = 1 [pid 5415] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5413] <... futex resumed>) = 0 [pid 5075] <... rmdir resumed>) = 0 [pid 5417] set_robust_list(0x55555d6c46a0, 24 [pid 5416] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5415] <... bpf resumed>) = 3 [pid 5413] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... mkdir resumed>) = 0 [pid 5417] <... set_robust_list resumed>) = 0 [pid 5416] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5415] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5413] <... futex resumed>) = 0 [pid 5417] chdir("./35" [pid 5416] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5413] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] mkdir("./34", 0777 [pid 5415] <... futex resumed>) = 1 [pid 5414] <... futex resumed>) = 0 [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5417] <... chdir resumed>) = 0 [pid 5416] <... bpf resumed>) = 4 [pid 5415] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5414] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... mkdir resumed>) = 0 [pid 5417] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5415] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5416] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5414] <... futex resumed>) = 0 [pid 5416] <... futex resumed>) = 1 [pid 5414] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5413] <... futex resumed>) = 0 [pid 5416] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5413] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5417] <... prctl resumed>) = 0 [pid 5416] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5415] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5413] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5419 attached ./strace-static-x86_64: Process 5418 attached [pid 5417] setpgid(0, 0 [pid 5416] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5413] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5418] set_robust_list(0x55555d6c46a0, 24 [pid 5417] <... setpgid resumed>) = 0 [pid 5415] <... bpf resumed>) = 4 [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5419 [pid 5419] set_robust_list(0x55555d6c46a0, 24 [pid 5418] <... set_robust_list resumed>) = 0 [pid 5417] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5416] <... bpf resumed>) = 5 [pid 5415] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5418 [pid 5419] <... set_robust_list resumed>) = 0 [pid 5419] chdir("./33" [pid 5418] chdir("./34" [pid 5415] <... futex resumed>) = 1 [pid 5414] <... futex resumed>) = 0 [pid 5419] <... chdir resumed>) = 0 [pid 5418] <... chdir resumed>) = 0 [pid 5417] <... openat resumed>) = 3 [pid 5416] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5415] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5414] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5419] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5418] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5416] <... futex resumed>) = 1 [pid 5414] <... futex resumed>) = 0 [pid 5413] <... futex resumed>) = 0 [pid 5419] <... prctl resumed>) = 0 [pid 5418] <... prctl resumed>) = 0 [pid 5417] write(3, "1000", 4 [pid 5416] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5415] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5414] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5413] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5419] setpgid(0, 0 [pid 5418] setpgid(0, 0 [pid 5417] <... write resumed>) = 4 [pid 5416] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5415] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5413] <... futex resumed>) = 0 [pid 5419] <... setpgid resumed>) = 0 [pid 5418] <... setpgid resumed>) = 0 [pid 5417] close(3 [pid 5416] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5413] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5419] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5418] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5417] <... close resumed>) = 0 [pid 5416] <... bpf resumed>) = 6 [pid 5416] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5415] <... bpf resumed>) = 5 [pid 5413] <... futex resumed>) = 0 [pid 5419] <... openat resumed>) = 3 [pid 5417] symlink("/dev/binderfs", "./binderfs" [pid 5416] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5413] exit_group(0 [pid 5418] <... openat resumed>) = 3 [pid 5413] <... exit_group resumed>) = ? [pid 5419] write(3, "1000", 4 [pid 5416] <... futex resumed>) = ? [pid 5419] <... write resumed>) = 4 [pid 5418] write(3, "1000", 4 [pid 5417] <... symlink resumed>) = 0 [pid 5416] +++ exited with 0 +++ [pid 5415] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5413] +++ exited with 0 +++ [pid 5419] close(3 [pid 5418] <... write resumed>) = 4 [pid 5415] <... futex resumed>) = 1 [pid 5414] <... futex resumed>) = 0 [pid 5419] <... close resumed>) = 0 [pid 5418] close(3 [pid 5417] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5415] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5414] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5413, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5419] symlink("/dev/binderfs", "./binderfs" [pid 5414] <... futex resumed>) = 0 [pid 5419] <... symlink resumed>) = 0 [pid 5418] <... close resumed>) = 0 [pid 5417] <... futex resumed>) = 0 [pid 5414] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] restart_syscall(<... resuming interrupted clone ...> [pid 5418] symlink("/dev/binderfs", "./binderfs" [pid 5417] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5419] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5415] <... bpf resumed>) = 6 [pid 5077] <... restart_syscall resumed>) = 0 [pid 5417] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5417] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5415] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5417] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5419] <... futex resumed>) = 0 [pid 5418] <... symlink resumed>) = 0 [pid 5417] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5415] <... futex resumed>) = 1 [pid 5414] <... futex resumed>) = 0 [pid 5419] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5418] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5417] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5415] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5414] exit_group(0 [pid 5077] umount2("./33", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5419] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5418] <... futex resumed>) = 0 [pid 5417] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5415] <... futex resumed>) = ? [pid 5414] <... exit_group resumed>) = ? [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5419] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5418] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5417] <... mprotect resumed>) = 0 [pid 5415] +++ exited with 0 +++ [pid 5077] openat(AT_FDCWD, "./33", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5419] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5418] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5419] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f3e2f5ed000 [pid 5419] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5418] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5419] <... mprotect resumed>) = 0 [pid 5419] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5418] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5414] +++ exited with 0 +++ [pid 5077] <... openat resumed>) = 3 [pid 5417] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5419] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5418] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5417] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5077] newfstatat(3, "", [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5414, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5419] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5418] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5417] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 ./strace-static-x86_64: Process 5421 attached ./strace-static-x86_64: Process 5420 attached [pid 5418] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5077] getdents64(3, [pid 5421] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5420] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5418] <... mprotect resumed>) = 0 [pid 5417] <... clone3 resumed> => {parent_tid=[5421]}, 88) = 5421 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5421] <... rseq resumed>) = 0 [pid 5420] <... rseq resumed>) = 0 [pid 5419] <... clone3 resumed> => {parent_tid=[5420]}, 88) = 5420 [pid 5418] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5417] rt_sigprocmask(SIG_SETMASK, [], [pid 5077] umount2("./33/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5421] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5420] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5417] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5421] <... set_robust_list resumed>) = 0 [pid 5420] <... set_robust_list resumed>) = 0 [pid 5419] rt_sigprocmask(SIG_SETMASK, [], [pid 5418] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5417] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] newfstatat(AT_FDCWD, "./33/binderfs", [pid 5074] umount2("./32", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5421] rt_sigprocmask(SIG_SETMASK, [], [pid 5420] rt_sigprocmask(SIG_SETMASK, [], [pid 5419] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5418] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5417] <... futex resumed>) = 0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5422 attached [pid 5421] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5420] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5419] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5417] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] unlink("./33/binderfs" [pid 5074] openat(AT_FDCWD, "./32", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5422] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5421] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5420] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5419] <... futex resumed>) = 0 [pid 5418] <... clone3 resumed> => {parent_tid=[5422]}, 88) = 5422 [pid 5422] <... rseq resumed>) = 0 [pid 5421] <... bpf resumed>) = 3 [pid 5420] <... bpf resumed>) = 3 [pid 5419] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5418] rt_sigprocmask(SIG_SETMASK, [], [pid 5077] <... unlink resumed>) = 0 [pid 5074] <... openat resumed>) = 3 [pid 5422] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5421] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5420] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5419] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5418] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] getdents64(3, [pid 5074] newfstatat(3, "", [pid 5422] <... set_robust_list resumed>) = 0 [pid 5421] <... futex resumed>) = 1 [pid 5420] <... futex resumed>) = 0 [pid 5419] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5418] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5417] <... futex resumed>) = 0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5422] rt_sigprocmask(SIG_SETMASK, [], [pid 5421] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5420] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5419] <... futex resumed>) = 0 [pid 5418] <... futex resumed>) = 0 [pid 5417] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] close(3 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5422] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5421] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5420] <... bpf resumed>) = 4 [pid 5419] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5418] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5417] <... futex resumed>) = 0 [pid 5077] <... close resumed>) = 0 [pid 5422] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5421] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5420] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5417] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] rmdir("./33" [pid 5074] getdents64(3, [pid 5422] <... bpf resumed>) = 3 [pid 5421] <... bpf resumed>) = 4 [pid 5420] <... futex resumed>) = 1 [pid 5419] <... futex resumed>) = 0 [pid 5419] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... rmdir resumed>) = 0 [pid 5422] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5421] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5420] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5419] <... futex resumed>) = 0 [pid 5077] mkdir("./34", 0777 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5422] <... futex resumed>) = 1 [pid 5421] <... futex resumed>) = 1 [pid 5419] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5418] <... futex resumed>) = 0 [pid 5417] <... futex resumed>) = 0 [pid 5418] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5421] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5077] <... mkdir resumed>) = 0 [pid 5074] umount2("./32/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5422] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5418] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5417] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5422] <... bpf resumed>) = 4 [pid 5421] <... futex resumed>) = 0 [pid 5420] <... bpf resumed>) = 5 [pid 5417] <... futex resumed>) = 1 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5422] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5421] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5420] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5417] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5422] <... futex resumed>) = 1 [pid 5418] <... futex resumed>) = 0 [pid 5074] newfstatat(AT_FDCWD, "./32/binderfs", [pid 5422] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5418] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5423 attached [pid 5420] <... futex resumed>) = 1 [pid 5419] <... futex resumed>) = 0 [pid 5418] <... futex resumed>) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5423] set_robust_list(0x55555d6c46a0, 24 [pid 5422] <... bpf resumed>) = 5 [pid 5420] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5419] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5418] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5421] <... bpf resumed>) = 5 [pid 5074] unlink("./32/binderfs" [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5423 [pid 5423] <... set_robust_list resumed>) = 0 [pid 5422] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5421] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5420] <... bpf resumed>) = 6 [pid 5419] <... futex resumed>) = 0 [pid 5418] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5423] chdir("./34" [pid 5422] <... futex resumed>) = 0 [pid 5421] <... futex resumed>) = 1 [pid 5420] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5419] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5418] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5417] <... futex resumed>) = 0 [pid 5074] <... unlink resumed>) = 0 [pid 5423] <... chdir resumed>) = 0 [pid 5422] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5421] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5420] <... futex resumed>) = 0 [pid 5419] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5418] <... futex resumed>) = 0 [pid 5417] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] getdents64(3, [pid 5423] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5422] <... bpf resumed>) = 6 [pid 5421] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5420] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5419] exit_group(0 [pid 5418] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5417] <... futex resumed>) = 0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5423] <... prctl resumed>) = 0 [pid 5422] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5421] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5420] <... futex resumed>) = ? [pid 5419] <... exit_group resumed>) = ? [pid 5418] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5417] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5074] close(3 [pid 5423] setpgid(0, 0 [pid 5422] <... futex resumed>) = 0 [pid 5421] <... bpf resumed>) = 6 [pid 5418] exit_group(0 [pid 5423] <... setpgid resumed>) = 0 [pid 5421] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5418] <... exit_group resumed>) = ? [pid 5074] <... close resumed>) = 0 [pid 5422] +++ exited with 0 +++ [pid 5421] <... futex resumed>) = 1 [pid 5420] +++ exited with 0 +++ [pid 5419] +++ exited with 0 +++ [pid 5417] <... futex resumed>) = 0 [pid 5074] rmdir("./32" [pid 5423] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5421] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5417] exit_group(0 [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5419, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5423] <... openat resumed>) = 3 [pid 5076] restart_syscall(<... resuming interrupted clone ...> [pid 5074] <... rmdir resumed>) = 0 [pid 5423] write(3, "1000", 4 [pid 5421] <... futex resumed>) = ? [pid 5417] <... exit_group resumed>) = ? [pid 5076] <... restart_syscall resumed>) = 0 [pid 5074] mkdir("./33", 0777 [pid 5423] <... write resumed>) = 4 [pid 5418] +++ exited with 0 +++ [pid 5423] close(3 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5418, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5423] <... close resumed>) = 0 [pid 5423] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5074] <... mkdir resumed>) = 0 [pid 5076] umount2("./33", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] umount2("./34", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] openat(AT_FDCWD, "./33", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5423] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5423] <... futex resumed>) = 0 [pid 5076] <... openat resumed>) = 3 [pid 5421] +++ exited with 0 +++ [pid 5417] +++ exited with 0 +++ [pid 5075] openat(AT_FDCWD, "./34", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5423] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, NULL, 8) = 0 [pid 5076] newfstatat(3, "", [pid 5075] <... openat resumed>) = 3 [pid 5423] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5417, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5075] newfstatat(3, "", [pid 5423] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5078] umount2("./35", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5424 attached [pid 5423] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5076] getdents64(3, [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5424] set_robust_list(0x55555d6c46a0, 24 [pid 5423] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] getdents64(3, [pid 5424] <... set_robust_list resumed>) = 0 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5424 [pid 5078] openat(AT_FDCWD, "./35", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5424] chdir("./33" [pid 5423] <... mprotect resumed>) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5424] <... chdir resumed>) = 0 [pid 5423] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5078] <... openat resumed>) = 3 [pid 5076] umount2("./33/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] umount2("./34/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5424] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5078] newfstatat(3, "", [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5424] <... prctl resumed>) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5076] newfstatat(AT_FDCWD, "./33/binderfs", [pid 5424] setpgid(0, 0 [pid 5075] newfstatat(AT_FDCWD, "./34/binderfs", [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5078] getdents64(3, [pid 5424] <... setpgid resumed>) = 0 [pid 5423] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5423] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0}./strace-static-x86_64: Process 5425 attached [pid 5424] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5076] unlink("./33/binderfs" [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5425] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5423] <... clone3 resumed> => {parent_tid=[5425]}, 88) = 5425 [pid 5425] <... rseq resumed>) = 0 [pid 5423] rt_sigprocmask(SIG_SETMASK, [], [pid 5078] umount2("./35/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] <... unlink resumed>) = 0 [pid 5075] unlink("./34/binderfs" [pid 5425] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5424] <... openat resumed>) = 3 [pid 5423] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] getdents64(3, [pid 5425] <... set_robust_list resumed>) = 0 [pid 5424] write(3, "1000", 4 [pid 5423] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... unlink resumed>) = 0 [pid 5425] rt_sigprocmask(SIG_SETMASK, [], [pid 5424] <... write resumed>) = 4 [pid 5423] <... futex resumed>) = 0 [pid 5078] newfstatat(AT_FDCWD, "./35/binderfs", [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5075] getdents64(3, [pid 5425] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5424] close(3 [pid 5423] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5425] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5424] <... close resumed>) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5076] close(3 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5425] <... bpf resumed>) = 3 [pid 5424] symlink("/dev/binderfs", "./binderfs" [pid 5078] unlink("./35/binderfs" [pid 5076] <... close resumed>) = 0 [pid 5425] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] close(3 [pid 5424] <... symlink resumed>) = 0 [pid 5425] <... futex resumed>) = 1 [pid 5423] <... futex resumed>) = 0 [pid 5078] <... unlink resumed>) = 0 [pid 5076] rmdir("./33" [pid 5075] <... close resumed>) = 0 [pid 5425] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5424] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5423] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] getdents64(3, [pid 5425] <... bpf resumed>) = 4 [pid 5424] <... futex resumed>) = 0 [pid 5423] <... futex resumed>) = 0 [pid 5076] <... rmdir resumed>) = 0 [pid 5075] rmdir("./34" [pid 5425] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5424] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5423] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5076] mkdir("./34", 0777 [pid 5425] <... futex resumed>) = 0 [pid 5424] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5423] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5078] close(3 [pid 5075] <... rmdir resumed>) = 0 [pid 5425] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5424] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5423] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5425] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5424] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5423] <... futex resumed>) = 0 [pid 5078] <... close resumed>) = 0 [pid 5075] mkdir("./35", 0777 [pid 5425] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5424] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5423] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] rmdir("./35" [pid 5076] <... mkdir resumed>) = 0 [pid 5424] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5075] <... mkdir resumed>) = 0 [pid 5425] <... bpf resumed>) = 5 [pid 5424] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5078] <... rmdir resumed>) = 0 [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5078] mkdir("./36", 0777./strace-static-x86_64: Process 5427 attached ./strace-static-x86_64: Process 5426 attached [pid 5425] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5424] <... mprotect resumed>) = 0 [pid 5427] set_robust_list(0x55555d6c46a0, 24 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5426 [pid 5427] <... set_robust_list resumed>) = 0 [pid 5427] chdir("./34" [pid 5426] set_robust_list(0x55555d6c46a0, 24 [pid 5425] <... futex resumed>) = 1 [pid 5424] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5423] <... futex resumed>) = 0 [pid 5078] <... mkdir resumed>) = 0 [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5427 [pid 5427] <... chdir resumed>) = 0 [pid 5426] <... set_robust_list resumed>) = 0 [pid 5425] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5423] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5427] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5426] chdir("./35" [pid 5425] <... bpf resumed>) = 6 [pid 5424] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5423] <... futex resumed>) = 0 [pid 5427] <... prctl resumed>) = 0 [pid 5426] <... chdir resumed>) = 0 [pid 5425] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5424] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5423] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5428 attached ./strace-static-x86_64: Process 5429 attached [pid 5427] setpgid(0, 0 [pid 5426] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5425] <... futex resumed>) = 0 [pid 5423] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5429] set_robust_list(0x55555d6c46a0, 24 [pid 5428] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5426] <... prctl resumed>) = 0 [pid 5425] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5424] <... clone3 resumed> => {parent_tid=[5428]}, 88) = 5428 [pid 5423] exit_group(0 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5429 [pid 5429] <... set_robust_list resumed>) = 0 [pid 5426] setpgid(0, 0 [pid 5425] <... futex resumed>) = ? [pid 5424] rt_sigprocmask(SIG_SETMASK, [], [pid 5423] <... exit_group resumed>) = ? [pid 5429] chdir("./36" [pid 5428] <... rseq resumed>) = 0 [pid 5427] <... setpgid resumed>) = 0 [pid 5426] <... setpgid resumed>) = 0 [pid 5425] +++ exited with 0 +++ [pid 5424] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5423] +++ exited with 0 +++ [pid 5429] <... chdir resumed>) = 0 [pid 5428] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5427] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5426] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5424] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5423, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5429] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5428] <... set_robust_list resumed>) = 0 [pid 5424] <... futex resumed>) = 0 [pid 5429] <... prctl resumed>) = 0 [pid 5428] rt_sigprocmask(SIG_SETMASK, [], [pid 5427] <... openat resumed>) = 3 [pid 5426] <... openat resumed>) = 3 [pid 5424] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5429] setpgid(0, 0) = 0 [pid 5077] umount2("./34", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5429] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5428] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5427] write(3, "1000", 4 [pid 5426] write(3, "1000", 4 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5077] openat(AT_FDCWD, "./34", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5429] <... openat resumed>) = 3 [pid 5428] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5427] <... write resumed>) = 4 [pid 5426] <... write resumed>) = 4 [pid 5077] <... openat resumed>) = 3 [pid 5429] write(3, "1000", 4 [pid 5427] close(3 [pid 5426] close(3 [pid 5077] newfstatat(3, "", [pid 5429] <... write resumed>) = 4 [pid 5427] <... close resumed>) = 0 [pid 5426] <... close resumed>) = 0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5429] close(3 [pid 5427] symlink("/dev/binderfs", "./binderfs" [pid 5426] symlink("/dev/binderfs", "./binderfs" [pid 5429] <... close resumed>) = 0 [pid 5427] <... symlink resumed>) = 0 [pid 5426] <... symlink resumed>) = 0 [pid 5077] getdents64(3, [pid 5429] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5428] <... bpf resumed>) = 3 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5426] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] umount2("./34/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5429] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5426] <... futex resumed>) = 0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5429] <... futex resumed>) = 0 [pid 5426] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5077] newfstatat(AT_FDCWD, "./34/binderfs", [pid 5429] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5426] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5429] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5428] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5427] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5426] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5428] <... futex resumed>) = 1 [pid 5426] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5424] <... futex resumed>) = 0 [pid 5428] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5426] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5424] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5428] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5429] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5428] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5427] <... futex resumed>) = 0 [pid 5426] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5424] <... futex resumed>) = 0 [pid 5077] unlink("./34/binderfs" [pid 5429] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5427] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5077] <... unlink resumed>) = 0 [pid 5429] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5428] <... bpf resumed>) = 4 [pid 5427] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5426] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5424] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5429] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5427] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5426] <... mprotect resumed>) = 0 [pid 5077] getdents64(3, [pid 5429] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5427] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5429] <... mprotect resumed>) = 0 [pid 5427] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5428] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5427] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5426] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5077] close(3 [pid 5428] <... futex resumed>) = 1 [pid 5426] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5424] <... futex resumed>) = 0 [pid 5428] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5426] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5424] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5428] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5424] <... futex resumed>) = 0 [pid 5428] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5424] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5429] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5428] <... bpf resumed>) = 5 [pid 5427] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5077] <... close resumed>) = 0 ./strace-static-x86_64: Process 5430 attached [pid 5429] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5428] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5427] <... mprotect resumed>) = 0 [pid 5426] <... clone3 resumed> => {parent_tid=[5430]}, 88) = 5430 [pid 5077] rmdir("./34" [pid 5430] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5429] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5428] <... futex resumed>) = 1 [pid 5427] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5426] rt_sigprocmask(SIG_SETMASK, [], [pid 5424] <... futex resumed>) = 0 [pid 5077] <... rmdir resumed>) = 0 ./strace-static-x86_64: Process 5431 attached [pid 5430] <... rseq resumed>) = 0 [pid 5428] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5426] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5424] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5431] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5424] <... futex resumed>) = 0 [pid 5431] <... rseq resumed>) = 0 [pid 5430] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5429] <... clone3 resumed> => {parent_tid=[5431]}, 88) = 5431 [pid 5428] <... bpf resumed>) = 6 [pid 5427] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5426] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5424] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] mkdir("./35", 0777 [pid 5431] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5430] <... set_robust_list resumed>) = 0 [pid 5429] rt_sigprocmask(SIG_SETMASK, [], [pid 5428] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5427] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5426] <... futex resumed>) = 0 [pid 5424] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5077] <... mkdir resumed>) = 0 ./strace-static-x86_64: Process 5432 attached [pid 5431] <... set_robust_list resumed>) = 0 [pid 5430] rt_sigprocmask(SIG_SETMASK, [], [pid 5429] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5428] <... futex resumed>) = 0 [pid 5426] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5424] exit_group(0 [pid 5432] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5431] rt_sigprocmask(SIG_SETMASK, [], [pid 5430] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5429] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5427] <... clone3 resumed> => {parent_tid=[5432]}, 88) = 5432 [pid 5424] <... exit_group resumed>) = ? [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5432] <... rseq resumed>) = 0 [pid 5431] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5430] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5429] <... futex resumed>) = 0 [pid 5428] +++ exited with 0 +++ [pid 5427] rt_sigprocmask(SIG_SETMASK, [], ./strace-static-x86_64: Process 5433 attached [pid 5432] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5431] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5430] <... bpf resumed>) = 3 [pid 5429] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5427] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5433] set_robust_list(0x55555d6c46a0, 24 [pid 5432] <... set_robust_list resumed>) = 0 [pid 5431] <... bpf resumed>) = 3 [pid 5430] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5427] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5433] <... set_robust_list resumed>) = 0 [pid 5432] rt_sigprocmask(SIG_SETMASK, [], [pid 5431] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5430] <... futex resumed>) = 1 [pid 5427] <... futex resumed>) = 0 [pid 5426] <... futex resumed>) = 0 [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5433 [pid 5433] chdir("./35" [pid 5432] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5431] <... futex resumed>) = 1 [pid 5430] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5429] <... futex resumed>) = 0 [pid 5427] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5426] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5424] +++ exited with 0 +++ [pid 5433] <... chdir resumed>) = 0 [pid 5432] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5431] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5430] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5429] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5426] <... futex resumed>) = 0 [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5424, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5433] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5432] <... bpf resumed>) = 3 [pid 5431] <... bpf resumed>) = 4 [pid 5430] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5429] <... futex resumed>) = 0 [pid 5426] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5433] <... prctl resumed>) = 0 [pid 5432] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5431] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5430] <... bpf resumed>) = 4 [pid 5429] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5433] setpgid(0, 0 [pid 5430] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5429] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5433] <... setpgid resumed>) = 0 [pid 5430] <... futex resumed>) = 1 [pid 5429] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5426] <... futex resumed>) = 0 [pid 5433] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5432] <... futex resumed>) = 1 [pid 5431] <... futex resumed>) = 0 [pid 5430] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5429] <... futex resumed>) = 0 [pid 5427] <... futex resumed>) = 0 [pid 5426] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5433] <... openat resumed>) = 3 [pid 5432] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5431] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5430] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5429] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5427] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5426] <... futex resumed>) = 0 [pid 5433] write(3, "1000", 4 [pid 5432] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5430] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5427] <... futex resumed>) = 0 [pid 5426] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] umount2("./33", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5433] <... write resumed>) = 4 [pid 5432] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5431] <... bpf resumed>) = 5 [pid 5430] <... bpf resumed>) = 5 [pid 5427] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5433] close(3) = 0 [pid 5432] <... bpf resumed>) = 4 [pid 5074] openat(AT_FDCWD, "./33", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5433] symlink("/dev/binderfs", "./binderfs" [pid 5432] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5430] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5433] <... symlink resumed>) = 0 [pid 5432] <... futex resumed>) = 1 [pid 5431] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5430] <... futex resumed>) = 1 [pid 5427] <... futex resumed>) = 0 [pid 5426] <... futex resumed>) = 0 [pid 5074] <... openat resumed>) = 3 [pid 5433] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5432] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5431] <... futex resumed>) = 1 [pid 5430] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5429] <... futex resumed>) = 0 [pid 5427] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5426] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5433] <... futex resumed>) = 0 [pid 5432] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5430] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5429] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5427] <... futex resumed>) = 0 [pid 5426] <... futex resumed>) = 0 [pid 5433] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5432] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5431] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5430] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5429] <... futex resumed>) = 0 [pid 5427] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5426] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5074] newfstatat(3, "", [pid 5433] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5429] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5433] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5430] <... bpf resumed>) = 6 [pid 5433] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5430] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5431] <... bpf resumed>) = 6 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5433] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5432] <... bpf resumed>) = 5 [pid 5431] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5430] <... futex resumed>) = 1 [pid 5426] <... futex resumed>) = 0 [pid 5074] getdents64(3, [pid 5433] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5432] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5431] <... futex resumed>) = 1 [pid 5430] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5429] <... futex resumed>) = 0 [pid 5426] exit_group(0 [pid 5433] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5432] <... futex resumed>) = 1 [pid 5431] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5430] <... futex resumed>) = ? [pid 5429] exit_group(0 [pid 5427] <... futex resumed>) = 0 [pid 5426] <... exit_group resumed>) = ? [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5433] <... mprotect resumed>) = 0 [pid 5432] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5431] <... futex resumed>) = ? [pid 5430] +++ exited with 0 +++ [pid 5429] <... exit_group resumed>) = ? [pid 5427] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5432] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5431] +++ exited with 0 +++ [pid 5433] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5427] <... futex resumed>) = 0 [pid 5432] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5074] umount2("./33/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5433] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5427] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5433] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5434 attached [pid 5074] newfstatat(AT_FDCWD, "./33/binderfs", [pid 5434] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5433] <... clone3 resumed> => {parent_tid=[5434]}, 88) = 5434 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5433] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5074] unlink("./33/binderfs" [pid 5434] <... rseq resumed>) = 0 [pid 5433] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... unlink resumed>) = 0 [pid 5434] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5433] <... futex resumed>) = 0 [pid 5429] +++ exited with 0 +++ [pid 5426] +++ exited with 0 +++ [pid 5434] <... set_robust_list resumed>) = 0 [pid 5434] rt_sigprocmask(SIG_SETMASK, [], [pid 5433] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5429, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5426, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- [pid 5074] getdents64(3, [pid 5434] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] restart_syscall(<... resuming interrupted clone ...> [pid 5075] restart_syscall(<... resuming interrupted clone ...> [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5434] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5078] <... restart_syscall resumed>) = 0 [pid 5075] <... restart_syscall resumed>) = 0 [pid 5434] <... bpf resumed>) = 3 [pid 5074] close(3 [pid 5434] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... close resumed>) = 0 [pid 5434] <... futex resumed>) = 1 [pid 5433] <... futex resumed>) = 0 [pid 5078] umount2("./36", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] umount2("./35", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] rmdir("./33" [pid 5434] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5433] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] <... rmdir resumed>) = 0 [pid 5434] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5433] <... futex resumed>) = 0 [pid 5078] openat(AT_FDCWD, "./36", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5434] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 4 [pid 5433] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... openat resumed>) = 3 [pid 5075] openat(AT_FDCWD, "./35", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5074] mkdir("./34", 0777 [pid 5078] newfstatat(3, "", [pid 5075] <... openat resumed>) = 3 [pid 5434] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... mkdir resumed>) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5075] newfstatat(3, "", [pid 5078] getdents64(3, [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5075] getdents64(3, [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5435 attached [pid 5434] <... futex resumed>) = 1 [pid 5433] <... futex resumed>) = 0 [pid 5078] umount2("./36/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5434] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5433] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5433] <... futex resumed>) = 0 [pid 5075] umount2("./35/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5433] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] newfstatat(AT_FDCWD, "./36/binderfs", [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5435] set_robust_list(0x55555d6c46a0, 24 [pid 5434] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5435] <... set_robust_list resumed>) = 0 [pid 5434] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5075] newfstatat(AT_FDCWD, "./35/binderfs", [pid 5435] chdir("./34" [pid 5432] <... bpf resumed>) = 6 [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5435 [pid 5435] <... chdir resumed>) = 0 [pid 5434] <... bpf resumed>) = 5 [pid 5432] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] unlink("./36/binderfs" [pid 5075] unlink("./35/binderfs" [pid 5435] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5434] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5432] <... futex resumed>) = 1 [pid 5427] <... futex resumed>) = 0 [pid 5435] <... prctl resumed>) = 0 [pid 5434] <... futex resumed>) = 1 [pid 5433] <... futex resumed>) = 0 [pid 5432] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5427] exit_group(0 [pid 5078] <... unlink resumed>) = 0 [pid 5075] <... unlink resumed>) = 0 [pid 5435] setpgid(0, 0 [pid 5434] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5433] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5432] <... futex resumed>) = ? [pid 5427] <... exit_group resumed>) = ? [pid 5435] <... setpgid resumed>) = 0 [pid 5434] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5433] <... futex resumed>) = 0 [pid 5432] +++ exited with 0 +++ [pid 5427] +++ exited with 0 +++ [pid 5078] getdents64(3, [pid 5075] getdents64(3, [pid 5435] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5433] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5427, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5434] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5078] close(3 [pid 5435] <... openat resumed>) = 3 [pid 5078] <... close resumed>) = 0 [pid 5076] umount2("./34", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] close(3 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] openat(AT_FDCWD, "./34", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5435] write(3, "1000", 4 [pid 5434] <... bpf resumed>) = 6 [pid 5078] rmdir("./36" [pid 5075] <... close resumed>) = 0 [pid 5434] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5435] <... write resumed>) = 4 [pid 5434] <... futex resumed>) = 1 [pid 5433] <... futex resumed>) = 0 [pid 5078] <... rmdir resumed>) = 0 [pid 5076] <... openat resumed>) = 3 [pid 5075] rmdir("./35" [pid 5434] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5433] exit_group(0 [pid 5435] close(3 [pid 5434] <... futex resumed>) = ? [pid 5433] <... exit_group resumed>) = ? [pid 5076] newfstatat(3, "", [pid 5075] <... rmdir resumed>) = 0 [pid 5435] <... close resumed>) = 0 [pid 5434] +++ exited with 0 +++ [pid 5078] mkdir("./37", 0777 [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5435] symlink("/dev/binderfs", "./binderfs" [pid 5078] <... mkdir resumed>) = 0 [pid 5076] getdents64(3, [pid 5075] mkdir("./36", 0777 [pid 5435] <... symlink resumed>) = 0 [pid 5433] +++ exited with 0 +++ [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5433, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5075] <... mkdir resumed>) = 0 [pid 5435] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] umount2("./34/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5435] <... futex resumed>) = 0 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5077] umount2("./35", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5435] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5435] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5435] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5435] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0./strace-static-x86_64: Process 5436 attached [pid 5077] openat(AT_FDCWD, "./35", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5076] newfstatat(AT_FDCWD, "./34/binderfs", [pid 5436] set_robust_list(0x55555d6c46a0, 24./strace-static-x86_64: Process 5437 attached ) = 0 [pid 5435] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5077] <... openat resumed>) = 3 [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5435] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5076] unlink("./34/binderfs" [pid 5436] chdir("./37" [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5436 [pid 5077] newfstatat(3, "", [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5437 [pid 5436] <... chdir resumed>) = 0 [pid 5435] <... mprotect resumed>) = 0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5076] <... unlink resumed>) = 0 [pid 5437] set_robust_list(0x55555d6c46a0, 24 [pid 5436] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5435] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5077] getdents64(3, [pid 5076] getdents64(3, [pid 5437] <... set_robust_list resumed>) = 0 [pid 5436] <... prctl resumed>) = 0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5435] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5435] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0}./strace-static-x86_64: Process 5438 attached [pid 5436] setpgid(0, 0 [pid 5077] umount2("./35/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] close(3 [pid 5438] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5435] <... clone3 resumed> => {parent_tid=[5438]}, 88) = 5438 [pid 5438] <... rseq resumed>) = 0 [pid 5437] chdir("./36" [pid 5435] rt_sigprocmask(SIG_SETMASK, [], [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5438] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5436] <... setpgid resumed>) = 0 [pid 5435] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5076] <... close resumed>) = 0 [pid 5438] <... set_robust_list resumed>) = 0 [pid 5435] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] newfstatat(AT_FDCWD, "./35/binderfs", [pid 5438] rt_sigprocmask(SIG_SETMASK, [], [pid 5435] <... futex resumed>) = 0 [pid 5076] rmdir("./34" [pid 5438] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5437] <... chdir resumed>) = 0 [pid 5435] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5438] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5436] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5438] <... bpf resumed>) = 3 [pid 5438] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5437] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5436] <... openat resumed>) = 3 [pid 5077] unlink("./35/binderfs" [pid 5076] <... rmdir resumed>) = 0 [pid 5438] <... futex resumed>) = 1 [pid 5437] <... prctl resumed>) = 0 [pid 5436] write(3, "1000", 4 [pid 5435] <... futex resumed>) = 0 [pid 5077] <... unlink resumed>) = 0 [pid 5076] mkdir("./35", 0777 [pid 5438] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5437] setpgid(0, 0 [pid 5436] <... write resumed>) = 4 [pid 5435] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5438] <... bpf resumed>) = 4 [pid 5437] <... setpgid resumed>) = 0 [pid 5436] close(3 [pid 5435] <... futex resumed>) = 0 [pid 5077] getdents64(3, [pid 5076] <... mkdir resumed>) = 0 [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5438] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5437] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5436] <... close resumed>) = 0 [pid 5435] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 ./strace-static-x86_64: Process 5439 attached [pid 5438] <... futex resumed>) = 0 [pid 5436] symlink("/dev/binderfs", "./binderfs" [pid 5435] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5077] close(3 [pid 5439] set_robust_list(0x55555d6c46a0, 24 [pid 5438] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5437] <... openat resumed>) = 3 [pid 5436] <... symlink resumed>) = 0 [pid 5435] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... close resumed>) = 0 [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5439 [pid 5439] <... set_robust_list resumed>) = 0 [pid 5438] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5435] <... futex resumed>) = 0 [pid 5077] rmdir("./35" [pid 5439] chdir("./35" [pid 5438] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5437] write(3, "1000", 4 [pid 5436] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5435] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... rmdir resumed>) = 0 [pid 5439] <... chdir resumed>) = 0 [pid 5439] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5438] <... bpf resumed>) = 5 [pid 5437] <... write resumed>) = 4 [pid 5436] <... futex resumed>) = 0 [pid 5077] mkdir("./36", 0777 [pid 5439] setpgid(0, 0) = 0 [pid 5437] close(3 [pid 5436] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, NULL, 8) = 0 [pid 5077] <... mkdir resumed>) = 0 [pid 5439] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5437] <... close resumed>) = 0 [pid 5436] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5438] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5437] symlink("/dev/binderfs", "./binderfs" [pid 5436] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5440 attached [pid 5439] <... openat resumed>) = 3 [pid 5438] <... futex resumed>) = 1 [pid 5437] <... symlink resumed>) = 0 [pid 5436] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5435] <... futex resumed>) = 0 [pid 5439] write(3, "1000", 4 [pid 5438] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5437] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5436] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5435] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5440] set_robust_list(0x55555d6c46a0, 24 [pid 5439] <... write resumed>) = 4 [pid 5440] <... set_robust_list resumed>) = 0 [pid 5439] close(3 [pid 5438] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5439] <... close resumed>) = 0 [pid 5438] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5436] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5435] <... futex resumed>) = 0 [pid 5440] chdir("./36" [pid 5439] symlink("/dev/binderfs", "./binderfs" [pid 5438] <... bpf resumed>) = 6 [pid 5437] <... futex resumed>) = 0 [pid 5436] <... mprotect resumed>) = 0 [pid 5435] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5440 [pid 5440] <... chdir resumed>) = 0 [pid 5439] <... symlink resumed>) = 0 [pid 5438] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5437] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5435] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5440] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5439] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5440] <... prctl resumed>) = 0 [pid 5439] <... futex resumed>) = 0 [pid 5440] setpgid(0, 0 [pid 5439] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5438] <... futex resumed>) = 0 [pid 5437] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5436] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5435] exit_group(0 [pid 5437] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5436] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5435] <... exit_group resumed>) = ? [pid 5440] <... setpgid resumed>) = 0 [pid 5439] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5438] +++ exited with 0 +++ [pid 5437] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5436] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5435] +++ exited with 0 +++ ./strace-static-x86_64: Process 5441 attached [pid 5440] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5439] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5437] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5435, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5441] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5439] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5437] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5436] <... clone3 resumed> => {parent_tid=[5441]}, 88) = 5441 [pid 5441] <... rseq resumed>) = 0 [pid 5439] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5437] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5436] rt_sigprocmask(SIG_SETMASK, [], [pid 5441] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5440] <... openat resumed>) = 3 [pid 5439] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5437] <... mprotect resumed>) = 0 [pid 5436] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5441] <... set_robust_list resumed>) = 0 [pid 5440] write(3, "1000", 4 [pid 5439] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5437] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5436] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] umount2("./34", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5441] rt_sigprocmask(SIG_SETMASK, [], [pid 5440] <... write resumed>) = 4 [pid 5439] <... mprotect resumed>) = 0 [pid 5437] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5436] <... futex resumed>) = 0 [pid 5441] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5440] close(3 [pid 5439] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5437] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5442 attached [pid 5441] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5440] <... close resumed>) = 0 [pid 5439] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5436] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] openat(AT_FDCWD, "./34", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5442] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5441] <... bpf resumed>) = 3 [pid 5440] symlink("/dev/binderfs", "./binderfs" [pid 5439] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5437] <... clone3 resumed> => {parent_tid=[5442]}, 88) = 5442 [pid 5442] <... rseq resumed>) = 0 [pid 5441] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5440] <... symlink resumed>) = 0 [pid 5437] rt_sigprocmask(SIG_SETMASK, [], [pid 5074] <... openat resumed>) = 3 ./strace-static-x86_64: Process 5443 attached [pid 5441] <... futex resumed>) = 1 [pid 5437] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5436] <... futex resumed>) = 0 [pid 5443] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5442] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5441] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5439] <... clone3 resumed> => {parent_tid=[5443]}, 88) = 5443 [pid 5437] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5436] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] newfstatat(3, "", [pid 5443] <... rseq resumed>) = 0 [pid 5442] <... set_robust_list resumed>) = 0 [pid 5441] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5440] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5439] rt_sigprocmask(SIG_SETMASK, [], [pid 5437] <... futex resumed>) = 0 [pid 5436] <... futex resumed>) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5443] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5442] rt_sigprocmask(SIG_SETMASK, [], [pid 5441] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5440] <... futex resumed>) = 0 [pid 5439] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5437] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5436] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] getdents64(3, [pid 5443] <... set_robust_list resumed>) = 0 [pid 5442] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5441] <... bpf resumed>) = 4 [pid 5440] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5439] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5443] rt_sigprocmask(SIG_SETMASK, [], [pid 5442] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5441] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5440] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5439] <... futex resumed>) = 0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5443] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5442] <... bpf resumed>) = 3 [pid 5441] <... futex resumed>) = 1 [pid 5440] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5439] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5436] <... futex resumed>) = 0 [pid 5443] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5442] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5441] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5436] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] umount2("./34/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5442] <... futex resumed>) = 1 [pid 5441] <... bpf resumed>) = 5 [pid 5440] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5437] <... futex resumed>) = 0 [pid 5443] <... bpf resumed>) = 3 [pid 5442] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5440] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5437] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5436] <... futex resumed>) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5443] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5442] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5441] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5440] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5437] <... futex resumed>) = 0 [pid 5436] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5443] <... futex resumed>) = 1 [pid 5442] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5441] <... futex resumed>) = 0 [pid 5440] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5439] <... futex resumed>) = 0 [pid 5437] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5436] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5074] newfstatat(AT_FDCWD, "./34/binderfs", [pid 5443] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5442] <... bpf resumed>) = 4 [pid 5441] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5440] <... mprotect resumed>) = 0 [pid 5439] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5436] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5443] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5442] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5441] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5440] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5439] <... futex resumed>) = 0 [pid 5436] <... futex resumed>) = 0 [pid 5074] unlink("./34/binderfs" [pid 5443] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5442] <... futex resumed>) = 1 [pid 5441] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5437] <... futex resumed>) = 0 [pid 5443] <... bpf resumed>) = 4 [pid 5442] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5441] <... bpf resumed>) = 6 [pid 5440] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5439] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5437] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5436] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5074] <... unlink resumed>) = 0 [pid 5443] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5442] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5441] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5440] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5437] <... futex resumed>) = 0 [pid 5436] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5443] <... futex resumed>) = 1 [pid 5442] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5441] <... futex resumed>) = 0 [pid 5439] <... futex resumed>) = 0 [pid 5437] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] getdents64(3, ./strace-static-x86_64: Process 5444 attached [pid 5443] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5442] <... bpf resumed>) = 5 [pid 5441] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5440] <... clone3 resumed> => {parent_tid=[5444]}, 88) = 5444 [pid 5439] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5436] exit_group(0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5444] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5443] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5439] <... futex resumed>) = 0 [pid 5436] <... exit_group resumed>) = ? [pid 5444] <... rseq resumed>) = 0 [pid 5439] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5444] set_robust_list(0x7f3e2f60d9a0, 24) = 0 [pid 5444] rt_sigprocmask(SIG_SETMASK, [], [pid 5443] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5441] <... futex resumed>) = ? [pid 5440] rt_sigprocmask(SIG_SETMASK, [], [pid 5074] close(3 [pid 5444] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5443] <... bpf resumed>) = 5 [pid 5442] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5441] +++ exited with 0 +++ [pid 5440] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5436] +++ exited with 0 +++ [pid 5074] <... close resumed>) = 0 [pid 5444] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5074] rmdir("./34" [pid 5442] <... futex resumed>) = 1 [pid 5440] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5437] <... futex resumed>) = 0 [pid 5074] <... rmdir resumed>) = 0 [pid 5444] <... futex resumed>) = 0 [pid 5442] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5440] <... futex resumed>) = 1 [pid 5437] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5436, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5444] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5443] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5440] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5437] <... futex resumed>) = 0 [pid 5078] restart_syscall(<... resuming interrupted clone ...> [pid 5074] mkdir("./35", 0777 [pid 5443] <... futex resumed>) = 1 [pid 5437] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] <... restart_syscall resumed>) = 0 [pid 5444] <... bpf resumed>) = 3 [pid 5443] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5439] <... futex resumed>) = 0 [pid 5074] <... mkdir resumed>) = 0 [pid 5444] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5439] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5444] <... futex resumed>) = 1 [pid 5440] <... futex resumed>) = 0 [pid 5440] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] umount2("./37", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5444] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5439] <... futex resumed>) = 1 [pid 5443] <... futex resumed>) = 0 [pid 5444] <... bpf resumed>) = 4 [pid 5442] <... bpf resumed>) = 6 [pid 5440] <... futex resumed>) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5439] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5444] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5443] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5442] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5440] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] openat(AT_FDCWD, "./37", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5444] <... futex resumed>) = 0 [pid 5443] <... bpf resumed>) = 6 [pid 5442] <... futex resumed>) = 1 [pid 5440] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5437] <... futex resumed>) = 0 [pid 5078] <... openat resumed>) = 3 [pid 5442] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5440] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5437] exit_group(0 [pid 5078] newfstatat(3, "", [pid 5443] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5440] <... futex resumed>) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5443] <... futex resumed>) = 1 [pid 5442] <... futex resumed>) = ? [pid 5440] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5439] <... futex resumed>) = 0 [pid 5437] <... exit_group resumed>) = ? [pid 5078] getdents64(3, ./strace-static-x86_64: Process 5445 attached [pid 5444] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5443] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5442] +++ exited with 0 +++ [pid 5439] exit_group(0 [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5445 [pid 5445] set_robust_list(0x55555d6c46a0, 24 [pid 5443] <... futex resumed>) = ? [pid 5439] <... exit_group resumed>) = ? [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5445] <... set_robust_list resumed>) = 0 [pid 5444] <... bpf resumed>) = 5 [pid 5443] +++ exited with 0 +++ [pid 5078] umount2("./37/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5445] chdir("./35") = 0 [pid 5078] newfstatat(AT_FDCWD, "./37/binderfs", [pid 5445] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5078] unlink("./37/binderfs" [pid 5445] <... prctl resumed>) = 0 [pid 5444] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5439] +++ exited with 0 +++ [pid 5437] +++ exited with 0 +++ [pid 5445] setpgid(0, 0 [pid 5444] <... futex resumed>) = 1 [pid 5440] <... futex resumed>) = 0 [pid 5078] <... unlink resumed>) = 0 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5437, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5440] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5445] <... setpgid resumed>) = 0 [pid 5444] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5440] <... futex resumed>) = 0 [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5439, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5445] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5440] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] getdents64(3, [pid 5076] umount2("./35", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5075] umount2("./36", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5445] <... openat resumed>) = 3 [pid 5078] close(3) = 0 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5445] write(3, "1000", 4 [pid 5078] rmdir("./37" [pid 5076] openat(AT_FDCWD, "./35", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5075] openat(AT_FDCWD, "./36", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5445] <... write resumed>) = 4 [pid 5078] <... rmdir resumed>) = 0 [pid 5076] <... openat resumed>) = 3 [pid 5075] <... openat resumed>) = 3 [pid 5445] close(3 [pid 5076] newfstatat(3, "", [pid 5445] <... close resumed>) = 0 [pid 5445] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5078] mkdir("./38", 0777) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5075] newfstatat(3, "", [pid 5445] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5445] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, NULL, 8) = 0 [pid 5444] <... bpf resumed>) = 6 [pid 5076] getdents64(3, [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5446 attached [pid 5445] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5444] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5075] getdents64(3, [pid 5445] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5444] <... futex resumed>) = 1 [pid 5445] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5444] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5440] <... futex resumed>) = 0 [pid 5440] exit_group(0 [pid 5445] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5444] <... futex resumed>) = ? [pid 5440] <... exit_group resumed>) = ? [pid 5446] set_robust_list(0x55555d6c46a0, 24 [pid 5444] +++ exited with 0 +++ [pid 5440] +++ exited with 0 +++ [pid 5076] umount2("./35/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5446] <... set_robust_list resumed>) = 0 [pid 5445] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5446 [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5440, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] umount2("./36/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5446] chdir("./38" [pid 5076] newfstatat(AT_FDCWD, "./35/binderfs", [pid 5446] <... chdir resumed>) = 0 [pid 5445] <... mprotect resumed>) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5446] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5445] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5075] newfstatat(AT_FDCWD, "./36/binderfs", [pid 5446] <... prctl resumed>) = 0 [pid 5445] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5446] setpgid(0, 0 [pid 5077] umount2("./36", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] unlink("./35/binderfs" [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5446] <... setpgid resumed>) = 0 [pid 5446] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5445] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] <... unlink resumed>) = 0 [pid 5075] unlink("./36/binderfs"./strace-static-x86_64: Process 5447 attached [pid 5446] <... openat resumed>) = 3 [pid 5075] <... unlink resumed>) = 0 [pid 5447] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5446] write(3, "1000", 4 [pid 5075] getdents64(3, [pid 5447] <... rseq resumed>) = 0 [pid 5446] <... write resumed>) = 4 [pid 5447] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5446] close(3 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5447] <... set_robust_list resumed>) = 0 [pid 5446] <... close resumed>) = 0 [pid 5447] rt_sigprocmask(SIG_SETMASK, [], [pid 5075] close(3 [pid 5446] symlink("/dev/binderfs", "./binderfs" [pid 5447] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] <... close resumed>) = 0 [pid 5447] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5446] <... symlink resumed>) = 0 [pid 5445] <... clone3 resumed> => {parent_tid=[5447]}, 88) = 5447 [pid 5077] openat(AT_FDCWD, "./36", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5076] getdents64(3, [pid 5075] rmdir("./36" [pid 5445] rt_sigprocmask(SIG_SETMASK, [], [pid 5077] <... openat resumed>) = 3 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5445] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] newfstatat(3, "", [pid 5076] close(3 [pid 5445] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5076] <... close resumed>) = 0 [pid 5445] <... futex resumed>) = 0 [pid 5077] getdents64(3, [pid 5076] rmdir("./35" [pid 5447] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5445] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5076] <... rmdir resumed>) = 0 [pid 5077] umount2("./36/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] <... rmdir resumed>) = 0 [pid 5446] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5447] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5446] <... futex resumed>) = 0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] mkdir("./36", 0777 [pid 5075] mkdir("./37", 0777 [pid 5447] <... bpf resumed>) = 3 [pid 5446] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5077] newfstatat(AT_FDCWD, "./36/binderfs", [pid 5076] <... mkdir resumed>) = 0 [pid 5447] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5446] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5447] <... futex resumed>) = 1 [pid 5446] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5447] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5446] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5446] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5445] <... futex resumed>) = 0 [pid 5077] unlink("./36/binderfs" [pid 5446] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5445] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... unlink resumed>) = 0 [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5075] <... mkdir resumed>) = 0 [pid 5447] <... futex resumed>) = 0 [pid 5446] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5445] <... futex resumed>) = 1 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5447] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5446] <... mprotect resumed>) = 0 [pid 5445] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] getdents64(3, ./strace-static-x86_64: Process 5448 attached 0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5077] close(3 [pid 5447] <... bpf resumed>) = 4 [pid 5077] <... close resumed>) = 0 [pid 5077] rmdir("./36"./strace-static-x86_64: Process 5449 attached [pid 5448] set_robust_list(0x55555d6c46a0, 24 [pid 5447] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5446] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5077] <... rmdir resumed>) = 0 [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5448 [pid 5449] set_robust_list(0x55555d6c46a0, 24 [pid 5448] <... set_robust_list resumed>) = 0 [pid 5447] <... futex resumed>) = 1 [pid 5445] <... futex resumed>) = 0 [pid 5449] <... set_robust_list resumed>) = 0 [pid 5447] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5446] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5445] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5449 [pid 5449] chdir("./37" [pid 5448] chdir("./36" [pid 5446] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5445] <... futex resumed>) = 0 [pid 5077] mkdir("./37", 0777./strace-static-x86_64: Process 5450 attached [pid 5449] <... chdir resumed>) = 0 [pid 5448] <... chdir resumed>) = 0 [pid 5447] <... bpf resumed>) = 5 [pid 5445] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... mkdir resumed>) = 0 [pid 5450] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5449] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5446] <... clone3 resumed> => {parent_tid=[5450]}, 88) = 5450 [pid 5450] <... rseq resumed>) = 0 [pid 5449] <... prctl resumed>) = 0 [pid 5448] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5446] rt_sigprocmask(SIG_SETMASK, [], [pid 5450] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5449] setpgid(0, 0 [pid 5448] <... prctl resumed>) = 0 [pid 5447] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5446] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5450] <... set_robust_list resumed>) = 0 [pid 5449] <... setpgid resumed>) = 0 [pid 5448] setpgid(0, 0 [pid 5447] <... futex resumed>) = 1 [pid 5446] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5445] <... futex resumed>) = 0 [pid 5450] rt_sigprocmask(SIG_SETMASK, [], [pid 5448] <... setpgid resumed>) = 0 [pid 5450] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5447] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5449] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5450] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5448] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5446] <... futex resumed>) = 0 [pid 5447] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5445] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5450] <... bpf resumed>) = 3 [pid 5449] <... openat resumed>) = 3 [pid 5446] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5445] <... futex resumed>) = 0 [pid 5447] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16./strace-static-x86_64: Process 5451 attached [pid 5450] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5449] write(3, "1000", 4 [pid 5446] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5445] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5451 [pid 5450] <... futex resumed>) = 0 [pid 5449] <... write resumed>) = 4 [pid 5448] <... openat resumed>) = 3 [pid 5446] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5451] set_robust_list(0x55555d6c46a0, 24 [pid 5450] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5449] close(3 [pid 5448] write(3, "1000", 4 [pid 5447] <... bpf resumed>) = 6 [pid 5446] <... futex resumed>) = 0 [pid 5451] <... set_robust_list resumed>) = 0 [pid 5450] <... bpf resumed>) = 4 [pid 5449] <... close resumed>) = 0 [pid 5448] <... write resumed>) = 4 [pid 5447] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5446] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5451] chdir("./37" [pid 5450] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5449] symlink("/dev/binderfs", "./binderfs" [pid 5448] close(3 [pid 5447] <... futex resumed>) = 1 [pid 5446] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5445] <... futex resumed>) = 0 [pid 5451] <... chdir resumed>) = 0 [pid 5450] <... futex resumed>) = 0 [pid 5449] <... symlink resumed>) = 0 [pid 5448] <... close resumed>) = 0 [pid 5447] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5446] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5445] exit_group(0 [pid 5451] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5450] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5448] symlink("/dev/binderfs", "./binderfs" [pid 5447] <... futex resumed>) = ? [pid 5446] <... futex resumed>) = 0 [pid 5445] <... exit_group resumed>) = ? [pid 5451] <... prctl resumed>) = 0 [pid 5449] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5446] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5451] setpgid(0, 0 [pid 5450] <... bpf resumed>) = 5 [pid 5449] <... futex resumed>) = 0 [pid 5451] <... setpgid resumed>) = 0 [pid 5449] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5448] <... symlink resumed>) = 0 [pid 5447] +++ exited with 0 +++ [pid 5451] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5450] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5449] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5448] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5449] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5448] <... futex resumed>) = 0 [pid 5450] <... futex resumed>) = 1 [pid 5446] <... futex resumed>) = 0 [pid 5451] <... openat resumed>) = 3 [pid 5450] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5449] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5448] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5446] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5445] +++ exited with 0 +++ [pid 5451] write(3, "1000", 4 [pid 5450] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5449] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5448] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5446] <... futex resumed>) = 0 [pid 5449] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5446] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5451] <... write resumed>) = 4 [pid 5450] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5449] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5448] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5445, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5451] close(3 [pid 5449] <... mprotect resumed>) = 0 [pid 5448] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5451] <... close resumed>) = 0 [pid 5448] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5074] restart_syscall(<... resuming interrupted clone ...> [pid 5451] symlink("/dev/binderfs", "./binderfs" [pid 5449] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5448] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5074] <... restart_syscall resumed>) = 0 [pid 5451] <... symlink resumed>) = 0 [pid 5449] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5449] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5448] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5451] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5448] <... mprotect resumed>) = 0 ./strace-static-x86_64: Process 5452 attached [pid 5449] <... clone3 resumed> => {parent_tid=[5452]}, 88) = 5452 [pid 5452] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5449] rt_sigprocmask(SIG_SETMASK, [], [pid 5448] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5452] <... rseq resumed>) = 0 [pid 5451] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5449] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5452] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5449] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5452] <... set_robust_list resumed>) = 0 [pid 5451] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5449] <... futex resumed>) = 0 [pid 5448] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5074] umount2("./35", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5452] rt_sigprocmask(SIG_SETMASK, [], [pid 5451] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5449] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5448] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5452] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5451] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5450] <... bpf resumed>) = 6 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5453 attached [pid 5452] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5451] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5450] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] openat(AT_FDCWD, "./35", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5453] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5452] <... bpf resumed>) = 3 [pid 5451] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5450] <... futex resumed>) = 1 [pid 5448] <... clone3 resumed> => {parent_tid=[5453]}, 88) = 5453 [pid 5446] <... futex resumed>) = 0 [pid 5453] <... rseq resumed>) = 0 [pid 5450] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5446] exit_group(0 [pid 5453] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5452] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5453] <... set_robust_list resumed>) = 0 [pid 5452] <... futex resumed>) = 1 [pid 5451] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5450] <... futex resumed>) = ? [pid 5449] <... futex resumed>) = 0 [pid 5448] rt_sigprocmask(SIG_SETMASK, [], [pid 5446] <... exit_group resumed>) = ? [pid 5074] <... openat resumed>) = 3 [pid 5453] rt_sigprocmask(SIG_SETMASK, [], [pid 5452] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5450] +++ exited with 0 +++ [pid 5449] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5448] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5453] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5452] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5449] <... futex resumed>) = 0 [pid 5448] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5453] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5452] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5451] <... mprotect resumed>) = 0 [pid 5449] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5448] <... futex resumed>) = 0 [pid 5074] newfstatat(3, "", [pid 5453] <... bpf resumed>) = 3 [pid 5452] <... bpf resumed>) = 4 [pid 5453] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5453] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5452] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5449] <... futex resumed>) = 0 [pid 5452] <... futex resumed>) = 1 [pid 5449] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5452] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5449] <... futex resumed>) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5452] <... bpf resumed>) = 5 [pid 5451] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5449] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5448] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5446] +++ exited with 0 +++ [pid 5074] getdents64(3, [pid 5451] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5446, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5448] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5078] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5451] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5448] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] umount2("./35/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5453] <... futex resumed>) = 0 [pid 5452] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5448] <... futex resumed>) = 1 ./strace-static-x86_64: Process 5454 attached [pid 5453] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5452] <... futex resumed>) = 1 [pid 5449] <... futex resumed>) = 0 [pid 5448] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] umount2("./38", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5454] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5453] <... bpf resumed>) = 4 [pid 5452] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5449] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5454] <... rseq resumed>) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] newfstatat(AT_FDCWD, "./35/binderfs", [pid 5454] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5453] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5452] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5451] <... clone3 resumed> => {parent_tid=[5454]}, 88) = 5454 [pid 5449] <... futex resumed>) = 0 [pid 5078] openat(AT_FDCWD, "./38", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5454] <... set_robust_list resumed>) = 0 [pid 5453] <... futex resumed>) = 1 [pid 5452] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5454] rt_sigprocmask(SIG_SETMASK, [], [pid 5453] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5452] <... bpf resumed>) = 6 [pid 5451] rt_sigprocmask(SIG_SETMASK, [], [pid 5449] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5448] <... futex resumed>) = 0 [pid 5078] <... openat resumed>) = 3 [pid 5454] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5452] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5451] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5448] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] newfstatat(3, "", [pid 5074] unlink("./35/binderfs" [pid 5454] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5452] <... futex resumed>) = 1 [pid 5451] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5449] <... futex resumed>) = 0 [pid 5454] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5453] <... futex resumed>) = 0 [pid 5452] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5451] <... futex resumed>) = 0 [pid 5448] <... futex resumed>) = 1 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5449] exit_group(0 [pid 5074] <... unlink resumed>) = 0 [pid 5453] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5451] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5449] <... exit_group resumed>) = ? [pid 5448] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] getdents64(3, [pid 5074] getdents64(3, [pid 5454] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5452] <... futex resumed>) = ? [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5454] <... bpf resumed>) = 3 [pid 5453] <... bpf resumed>) = 5 [pid 5452] +++ exited with 0 +++ [pid 5449] +++ exited with 0 +++ [pid 5078] umount2("./38/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] close(3 [pid 5454] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5453] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5449, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5454] <... futex resumed>) = 1 [pid 5453] <... futex resumed>) = 1 [pid 5451] <... futex resumed>) = 0 [pid 5448] <... futex resumed>) = 0 [pid 5078] newfstatat(AT_FDCWD, "./38/binderfs", [pid 5074] <... close resumed>) = 0 [pid 5454] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5453] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5451] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5448] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] rmdir("./35" [pid 5454] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5451] <... futex resumed>) = 0 [pid 5448] <... futex resumed>) = 0 [pid 5078] unlink("./38/binderfs" [pid 5454] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5451] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5448] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] <... unlink resumed>) = 0 [pid 5074] <... rmdir resumed>) = 0 [pid 5075] umount2("./37", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5078] getdents64(3, [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] mkdir("./36", 0777 [pid 5454] <... bpf resumed>) = 4 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5075] openat(AT_FDCWD, "./37", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5454] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] close(3 [pid 5075] <... openat resumed>) = 3 [pid 5074] <... mkdir resumed>) = 0 [pid 5075] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5454] <... futex resumed>) = 1 [pid 5451] <... futex resumed>) = 0 [pid 5078] <... close resumed>) = 0 [pid 5075] getdents64(3, [pid 5454] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5451] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] rmdir("./38" [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5454] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5451] <... futex resumed>) = 0 [pid 5075] umount2("./37/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] newfstatat(AT_FDCWD, "./37/binderfs", [pid 5454] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5453] <... bpf resumed>) = 6 [pid 5451] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... rmdir resumed>) = 0 [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 ./strace-static-x86_64: Process 5455 attached [pid 5453] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] unlink("./37/binderfs" [pid 5453] <... futex resumed>) = 1 [pid 5448] <... futex resumed>) = 0 [pid 5078] mkdir("./39", 0777 [pid 5455] set_robust_list(0x55555d6c46a0, 24 [pid 5454] <... bpf resumed>) = 5 [pid 5453] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5448] exit_group(0 [pid 5075] <... unlink resumed>) = 0 [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5455 [pid 5455] <... set_robust_list resumed>) = 0 [pid 5454] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5453] <... futex resumed>) = ? [pid 5448] <... exit_group resumed>) = ? [pid 5455] chdir("./36" [pid 5454] <... futex resumed>) = 1 [pid 5453] +++ exited with 0 +++ [pid 5451] <... futex resumed>) = 0 [pid 5448] +++ exited with 0 +++ [pid 5078] <... mkdir resumed>) = 0 [pid 5075] getdents64(3, [pid 5455] <... chdir resumed>) = 0 [pid 5454] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5451] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5448, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5455] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5454] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5451] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5456 attached [pid 5455] <... prctl resumed>) = 0 [pid 5454] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5451] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5075] close(3 [pid 5456] set_robust_list(0x55555d6c46a0, 24 [pid 5455] setpgid(0, 0 [pid 5454] <... bpf resumed>) = 6 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5456 [pid 5075] <... close resumed>) = 0 [pid 5455] <... setpgid resumed>) = 0 [pid 5454] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] umount2("./36", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5456] <... set_robust_list resumed>) = 0 [pid 5454] <... futex resumed>) = 1 [pid 5451] <... futex resumed>) = 0 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] rmdir("./37" [pid 5456] chdir("./39" [pid 5455] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5454] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5451] exit_group(0 [pid 5076] openat(AT_FDCWD, "./36", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5075] <... rmdir resumed>) = 0 [pid 5456] <... chdir resumed>) = 0 [pid 5454] <... futex resumed>) = ? [pid 5451] <... exit_group resumed>) = ? [pid 5076] <... openat resumed>) = 3 [pid 5456] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5455] <... openat resumed>) = 3 [pid 5454] +++ exited with 0 +++ [pid 5075] mkdir("./38", 0777 [pid 5456] <... prctl resumed>) = 0 [pid 5075] <... mkdir resumed>) = 0 [pid 5076] newfstatat(3, "", [pid 5455] write(3, "1000", 4) = 4 [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5455] close(3) = 0 [pid 5076] getdents64(3, [pid 5456] setpgid(0, 0 [pid 5455] symlink("/dev/binderfs", "./binderfs" [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5457 attached [pid 5456] <... setpgid resumed>) = 0 [pid 5455] <... symlink resumed>) = 0 [pid 5451] +++ exited with 0 +++ [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5456] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5455] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5451, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5457] set_robust_list(0x55555d6c46a0, 24 [pid 5455] <... futex resumed>) = 0 [pid 5076] umount2("./36/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5457] <... set_robust_list resumed>) = 0 [pid 5455] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] newfstatat(AT_FDCWD, "./36/binderfs", [pid 5457] chdir("./38" [pid 5456] <... openat resumed>) = 3 [pid 5455] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5457 [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5457] <... chdir resumed>) = 0 [pid 5456] write(3, "1000", 4 [pid 5455] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5077] umount2("./37", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] unlink("./36/binderfs" [pid 5457] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5456] <... write resumed>) = 4 [pid 5455] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5457] <... prctl resumed>) = 0 [pid 5456] close(3 [pid 5455] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5077] openat(AT_FDCWD, "./37", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5076] <... unlink resumed>) = 0 [pid 5457] setpgid(0, 0 [pid 5456] <... close resumed>) = 0 [pid 5457] <... setpgid resumed>) = 0 [pid 5456] symlink("/dev/binderfs", "./binderfs" [pid 5077] <... openat resumed>) = 3 [pid 5076] getdents64(3, [pid 5077] newfstatat(3, "", [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5457] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5076] close(3 [pid 5456] <... symlink resumed>) = 0 [pid 5077] getdents64(3, [pid 5076] <... close resumed>) = 0 [pid 5457] <... openat resumed>) = 3 [pid 5076] rmdir("./36" [pid 5456] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5077] umount2("./37/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5457] write(3, "1000", 4 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5456] <... futex resumed>) = 0 [pid 5457] <... write resumed>) = 4 [pid 5077] newfstatat(AT_FDCWD, "./37/binderfs", [pid 5456] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5457] close(3 [pid 5076] <... rmdir resumed>) = 0 [pid 5456] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5456] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5076] mkdir("./37", 0777 [pid 5457] <... close resumed>) = 0 [pid 5456] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] unlink("./37/binderfs" [pid 5076] <... mkdir resumed>) = 0 [pid 5456] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5077] <... unlink resumed>) = 0 [pid 5457] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5456] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5456] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5455] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5077] getdents64(3, [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5457] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5456] <... mprotect resumed>) = 0 [pid 5455] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5457] <... futex resumed>) = 0 [pid 5077] close(3 [pid 5457] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5077] <... close resumed>) = 0 [pid 5457] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5455] <... mprotect resumed>) = 0 [pid 5457] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5456] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5457] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] rmdir("./37" [pid 5457] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f3e2f5ed000 [pid 5457] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5455] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5456] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5456] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5455] <... rt_sigprocmask resumed>[], 8) = 0 ./strace-static-x86_64: Process 5458 attached [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5458 [pid 5455] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0}./strace-static-x86_64: Process 5459 attached [pid 5457] <... mprotect resumed>) = 0 [pid 5077] <... rmdir resumed>) = 0 ./strace-static-x86_64: Process 5460 attached [pid 5459] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5458] set_robust_list(0x55555d6c46a0, 24 [pid 5457] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5456] <... clone3 resumed> => {parent_tid=[5460]}, 88) = 5460 [pid 5455] <... clone3 resumed> => {parent_tid=[5459]}, 88) = 5459 [pid 5077] mkdir("./38", 0777 [pid 5460] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5459] <... rseq resumed>) = 0 [pid 5458] <... set_robust_list resumed>) = 0 [pid 5457] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5456] rt_sigprocmask(SIG_SETMASK, [], [pid 5455] rt_sigprocmask(SIG_SETMASK, [], [pid 5077] <... mkdir resumed>) = 0 [pid 5460] <... rseq resumed>) = 0 [pid 5459] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5457] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5456] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5455] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5460] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5458] chdir("./37" [pid 5456] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5455] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5460] <... set_robust_list resumed>) = 0 [pid 5458] <... chdir resumed>) = 0 [pid 5456] <... futex resumed>) = 0 [pid 5455] <... futex resumed>) = 0 [pid 5460] rt_sigprocmask(SIG_SETMASK, [], [pid 5458] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5456] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5460] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5458] <... prctl resumed>) = 0 [pid 5455] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5461 attached [pid 5460] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5459] <... set_robust_list resumed>) = 0 [pid 5458] setpgid(0, 0 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5462 attached [pid 5461] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5460] <... bpf resumed>) = 3 [pid 5459] rt_sigprocmask(SIG_SETMASK, [], [pid 5458] <... setpgid resumed>) = 0 [pid 5457] <... clone3 resumed> => {parent_tid=[5461]}, 88) = 5461 [pid 5462] set_robust_list(0x55555d6c46a0, 24 [pid 5459] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5457] rt_sigprocmask(SIG_SETMASK, [], [pid 5461] <... rseq resumed>) = 0 [pid 5459] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5457] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5462] <... set_robust_list resumed>) = 0 [pid 5461] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5460] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5459] <... bpf resumed>) = 3 [pid 5458] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5457] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5462 [pid 5462] chdir("./38" [pid 5459] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5457] <... futex resumed>) = 0 [pid 5460] <... futex resumed>) = 1 [pid 5462] <... chdir resumed>) = 0 [pid 5461] <... set_robust_list resumed>) = 0 [pid 5460] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5459] <... futex resumed>) = 1 [pid 5457] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5456] <... futex resumed>) = 0 [pid 5455] <... futex resumed>) = 0 [pid 5462] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5461] rt_sigprocmask(SIG_SETMASK, [], [pid 5459] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5458] <... openat resumed>) = 3 [pid 5456] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5455] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5462] <... prctl resumed>) = 0 [pid 5461] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5460] <... futex resumed>) = 0 [pid 5459] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5458] write(3, "1000", 4 [pid 5456] <... futex resumed>) = 1 [pid 5461] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5460] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5459] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5456] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5455] <... futex resumed>) = 0 [pid 5458] <... write resumed>) = 4 [pid 5462] setpgid(0, 0 [pid 5459] <... bpf resumed>) = 4 [pid 5455] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5460] <... bpf resumed>) = 4 [pid 5461] <... bpf resumed>) = 3 [pid 5462] <... setpgid resumed>) = 0 [pid 5461] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5459] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5458] close(3 [pid 5461] <... futex resumed>) = 1 [pid 5460] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5459] <... futex resumed>) = 1 [pid 5457] <... futex resumed>) = 0 [pid 5455] <... futex resumed>) = 0 [pid 5461] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5460] <... futex resumed>) = 1 [pid 5459] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5458] <... close resumed>) = 0 [pid 5457] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5456] <... futex resumed>) = 0 [pid 5455] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5459] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5457] <... futex resumed>) = 0 [pid 5455] <... futex resumed>) = 0 [pid 5462] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5461] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5460] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5459] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5458] symlink("/dev/binderfs", "./binderfs" [pid 5457] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5456] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5455] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5462] <... openat resumed>) = 3 [pid 5461] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5460] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5459] <... bpf resumed>) = 5 [pid 5458] <... symlink resumed>) = 0 [pid 5456] <... futex resumed>) = 0 [pid 5460] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5462] write(3, "1000", 4 [pid 5461] <... bpf resumed>) = 4 [pid 5459] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5456] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5462] <... write resumed>) = 4 [pid 5459] <... futex resumed>) = 1 [pid 5455] <... futex resumed>) = 0 [pid 5462] close(3 [pid 5459] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5455] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5458] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5462] <... close resumed>) = 0 [pid 5461] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5459] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5458] <... futex resumed>) = 0 [pid 5455] <... futex resumed>) = 0 [pid 5462] symlink("/dev/binderfs", "./binderfs" [pid 5461] <... futex resumed>) = 1 [pid 5459] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5458] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5457] <... futex resumed>) = 0 [pid 5455] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5462] <... symlink resumed>) = 0 [pid 5461] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5460] <... bpf resumed>) = 5 [pid 5459] <... bpf resumed>) = 6 [pid 5458] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5457] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5462] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5459] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5457] <... futex resumed>) = 0 [pid 5460] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5462] <... futex resumed>) = 0 [pid 5459] <... futex resumed>) = 1 [pid 5458] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5457] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5455] <... futex resumed>) = 0 [pid 5460] <... futex resumed>) = 1 [pid 5462] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5459] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5458] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5456] <... futex resumed>) = 0 [pid 5455] exit_group(0 [pid 5462] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5461] <... bpf resumed>) = 5 [pid 5460] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5459] <... futex resumed>) = ? [pid 5458] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5456] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5455] <... exit_group resumed>) = ? [pid 5462] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5461] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5460] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5459] +++ exited with 0 +++ [pid 5458] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5456] <... futex resumed>) = 0 [pid 5455] +++ exited with 0 +++ [pid 5462] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5461] <... futex resumed>) = 1 [pid 5460] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5458] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5457] <... futex resumed>) = 0 [pid 5456] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5462] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5461] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5458] <... mprotect resumed>) = 0 [pid 5457] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5462] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5457] <... futex resumed>) = 0 [pid 5457] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5462] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5458] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5455, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5462] <... mprotect resumed>) = 0 [pid 5458] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5074] umount2("./36", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5462] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5461] <... bpf resumed>) = 6 [pid 5460] <... bpf resumed>) = 6 [pid 5458] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5460] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5460] <... futex resumed>) = 1 [pid 5456] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5463 attached [pid 5462] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5460] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5463] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5462] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5463] <... rseq resumed>) = 0 [pid 5463] set_robust_list(0x7f3e2f60d9a0, 24) = 0 [pid 5463] rt_sigprocmask(SIG_SETMASK, [], [pid 5462] <... clone3 resumed> => {parent_tid=[5464]}, 88) = 5464 [pid 5461] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5464 attached [pid 5463] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5462] rt_sigprocmask(SIG_SETMASK, [], [pid 5461] <... futex resumed>) = 1 [pid 5458] <... clone3 resumed> => {parent_tid=[5463]}, 88) = 5463 [pid 5457] <... futex resumed>) = 0 [pid 5456] exit_group(0 [pid 5074] openat(AT_FDCWD, "./36", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5464] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5463] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5462] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5461] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5460] <... futex resumed>) = ? [pid 5458] rt_sigprocmask(SIG_SETMASK, [], [pid 5457] exit_group(0 [pid 5456] <... exit_group resumed>) = ? [pid 5074] <... openat resumed>) = 3 [pid 5464] <... rseq resumed>) = 0 [pid 5462] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5461] <... futex resumed>) = ? [pid 5460] +++ exited with 0 +++ [pid 5458] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5457] <... exit_group resumed>) = ? [pid 5462] <... futex resumed>) = 0 [pid 5462] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5464] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5074] newfstatat(3, "", [pid 5458] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5464] <... set_robust_list resumed>) = 0 [pid 5463] <... futex resumed>) = 0 [pid 5458] <... futex resumed>) = 1 [pid 5464] rt_sigprocmask(SIG_SETMASK, [], [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5464] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5463] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5458] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5464] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5463] <... bpf resumed>) = 3 [pid 5074] getdents64(3, [pid 5464] <... bpf resumed>) = 3 [pid 5463] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5464] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5463] <... futex resumed>) = 1 [pid 5458] <... futex resumed>) = 0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5464] <... futex resumed>) = 1 [pid 5463] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5462] <... futex resumed>) = 0 [pid 5458] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5464] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5458] <... futex resumed>) = 0 [pid 5074] umount2("./36/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5458] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5463] <... bpf resumed>) = 4 [pid 5462] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5464] <... futex resumed>) = 0 [pid 5463] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5462] <... futex resumed>) = 1 [pid 5458] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5074] newfstatat(AT_FDCWD, "./36/binderfs", [pid 5464] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5463] <... futex resumed>) = 0 [pid 5462] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5458] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5464] <... bpf resumed>) = 4 [pid 5463] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5458] <... futex resumed>) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5464] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5463] <... bpf resumed>) = 5 [pid 5458] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5464] <... futex resumed>) = 1 [pid 5462] <... futex resumed>) = 0 [pid 5074] unlink("./36/binderfs" [pid 5464] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5462] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5464] <... bpf resumed>) = 5 [pid 5463] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5462] <... futex resumed>) = 0 [pid 5074] <... unlink resumed>) = 0 [pid 5462] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5463] <... futex resumed>) = 1 [pid 5463] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5464] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5458] <... futex resumed>) = 0 [pid 5456] +++ exited with 0 +++ [pid 5074] getdents64(3, [pid 5461] +++ exited with 0 +++ [pid 5458] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5457] +++ exited with 0 +++ [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5462] <... futex resumed>) = 0 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5457, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5074] close(3 [pid 5464] <... futex resumed>) = 1 [pid 5463] <... futex resumed>) = 0 [pid 5462] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5458] <... futex resumed>) = 1 [pid 5075] restart_syscall(<... resuming interrupted clone ...> [pid 5074] <... close resumed>) = 0 [pid 5464] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5463] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5462] <... futex resumed>) = 0 [pid 5458] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5075] <... restart_syscall resumed>) = 0 [pid 5074] rmdir("./36" [pid 5462] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5456, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5078] umount2("./39", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] umount2("./38", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... rmdir resumed>) = 0 [pid 5074] mkdir("./37", 0777 [pid 5078] openat(AT_FDCWD, "./39", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] openat(AT_FDCWD, "./38", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5078] <... openat resumed>) = 3 [pid 5075] <... openat resumed>) = 3 [pid 5074] <... mkdir resumed>) = 0 [pid 5078] newfstatat(3, "", [pid 5075] newfstatat(3, "", [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5464] <... bpf resumed>) = 6 [pid 5463] <... bpf resumed>) = 6 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5464] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5463] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] getdents64(3, [pid 5463] <... futex resumed>) = 1 [pid 5075] getdents64(3, ./strace-static-x86_64: Process 5465 attached [pid 5458] <... futex resumed>) = 0 [pid 5465] set_robust_list(0x55555d6c46a0, 24 [pid 5464] <... futex resumed>) = 1 [pid 5463] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5462] <... futex resumed>) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5465 [pid 5465] <... set_robust_list resumed>) = 0 [pid 5464] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5462] exit_group(0 [pid 5458] exit_group(0 [pid 5075] umount2("./38/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5465] chdir("./37" [pid 5464] <... futex resumed>) = ? [pid 5462] <... exit_group resumed>) = ? [pid 5078] umount2("./39/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5465] <... chdir resumed>) = 0 [pid 5464] +++ exited with 0 +++ [pid 5463] <... futex resumed>) = ? [pid 5462] +++ exited with 0 +++ [pid 5458] <... exit_group resumed>) = ? [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5463] +++ exited with 0 +++ [pid 5078] newfstatat(AT_FDCWD, "./39/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5078] unlink("./39/binderfs" [pid 5465] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5458] +++ exited with 0 +++ [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5462, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5075] newfstatat(AT_FDCWD, "./38/binderfs", [pid 5465] <... prctl resumed>) = 0 [pid 5078] <... unlink resumed>) = 0 [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5458, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5465] setpgid(0, 0 [pid 5076] restart_syscall(<... resuming interrupted clone ...> [pid 5465] <... setpgid resumed>) = 0 [pid 5078] getdents64(3, [pid 5076] <... restart_syscall resumed>) = 0 [pid 5075] unlink("./38/binderfs" [pid 5465] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5078] close(3 [pid 5465] <... openat resumed>) = 3 [pid 5078] <... close resumed>) = 0 [pid 5077] umount2("./38", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5078] rmdir("./39" [pid 5465] write(3, "1000", 4 [pid 5078] <... rmdir resumed>) = 0 [pid 5465] <... write resumed>) = 4 [pid 5075] <... unlink resumed>) = 0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5077] openat(AT_FDCWD, "./38", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5076] umount2("./37", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] getdents64(3, [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] openat(AT_FDCWD, "./37", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5077] <... openat resumed>) = 3 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5465] close(3 [pid 5078] mkdir("./40", 0777 [pid 5076] <... openat resumed>) = 3 [pid 5465] <... close resumed>) = 0 [pid 5078] <... mkdir resumed>) = 0 [pid 5077] newfstatat(3, "", [pid 5075] close(3 [pid 5465] symlink("/dev/binderfs", "./binderfs" [pid 5076] newfstatat(3, "", [pid 5465] <... symlink resumed>) = 0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5075] <... close resumed>) = 0 [pid 5465] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5465] <... futex resumed>) = 0 [pid 5077] getdents64(3, [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5075] rmdir("./38" [pid 5465] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, NULL, 8) = 0 [pid 5465] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5465] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f3e2f5ed000 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5466 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5465] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5075] <... rmdir resumed>) = 0 ./strace-static-x86_64: Process 5466 attached [pid 5076] getdents64(3, [pid 5466] set_robust_list(0x55555d6c46a0, 24 [pid 5465] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5465] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5466] <... set_robust_list resumed>) = 0 [pid 5077] umount2("./38/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] umount2("./37/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] mkdir("./39", 0777 [pid 5466] chdir("./40" [pid 5465] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] newfstatat(AT_FDCWD, "./37/binderfs", ./strace-static-x86_64: Process 5467 attached [pid 5466] <... chdir resumed>) = 0 [pid 5465] <... clone3 resumed> => {parent_tid=[5467]}, 88) = 5467 [pid 5077] newfstatat(AT_FDCWD, "./38/binderfs", [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5467] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5466] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5465] rt_sigprocmask(SIG_SETMASK, [], [pid 5075] <... mkdir resumed>) = 0 [pid 5467] <... rseq resumed>) = 0 [pid 5466] <... prctl resumed>) = 0 [pid 5465] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5076] unlink("./37/binderfs" [pid 5467] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5466] setpgid(0, 0 [pid 5077] unlink("./38/binderfs" [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5467] <... set_robust_list resumed>) = 0 [pid 5466] <... setpgid resumed>) = 0 [pid 5465] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... unlink resumed>) = 0 [pid 5076] <... unlink resumed>) = 0 [pid 5467] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5466] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5465] <... futex resumed>) = 0 [pid 5077] getdents64(3, [pid 5076] getdents64(3, [pid 5467] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 ./strace-static-x86_64: Process 5468 attached [pid 5467] <... bpf resumed>) = 3 [pid 5466] <... openat resumed>) = 3 [pid 5465] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] close(3 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5468] set_robust_list(0x55555d6c46a0, 24 [pid 5467] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5466] write(3, "1000", 4 [pid 5465] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5076] close(3 [pid 5468] <... set_robust_list resumed>) = 0 [pid 5467] <... futex resumed>) = 0 [pid 5466] <... write resumed>) = 4 [pid 5465] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... close resumed>) = 0 [pid 5076] <... close resumed>) = 0 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5468 [pid 5468] chdir("./39" [pid 5467] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5466] close(3 [pid 5465] <... futex resumed>) = 0 [pid 5077] rmdir("./38" [pid 5076] rmdir("./37" [pid 5468] <... chdir resumed>) = 0 [pid 5468] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5467] <... bpf resumed>) = 4 [pid 5466] <... close resumed>) = 0 [pid 5465] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... rmdir resumed>) = 0 [pid 5076] <... rmdir resumed>) = 0 [pid 5468] <... prctl resumed>) = 0 [pid 5467] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5466] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5468] setpgid(0, 0 [pid 5466] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5468] <... setpgid resumed>) = 0 [pid 5467] <... futex resumed>) = 1 [pid 5465] <... futex resumed>) = 0 [pid 5467] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5466] <... futex resumed>) = 0 [pid 5465] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] mkdir("./38", 0777 [pid 5467] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5468] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5466] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5465] <... futex resumed>) = 0 [pid 5077] mkdir("./39", 0777 [pid 5076] <... mkdir resumed>) = 0 [pid 5467] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5466] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5465] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5466] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5466] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5468] <... openat resumed>) = 3 [pid 5467] <... bpf resumed>) = 5 [pid 5466] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5077] <... mkdir resumed>) = 0 [pid 5468] write(3, "1000", 4 [pid 5467] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5466] <... mmap resumed>) = 0x7f3e2f5ed000 ./strace-static-x86_64: Process 5469 attached [pid 5468] <... write resumed>) = 4 [pid 5466] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5470 attached [pid 5469] set_robust_list(0x55555d6c46a0, 24 [pid 5468] close(3 [pid 5467] <... futex resumed>) = 1 [pid 5466] <... mprotect resumed>) = 0 [pid 5465] <... futex resumed>) = 0 [pid 5470] set_robust_list(0x55555d6c46a0, 24 [pid 5469] <... set_robust_list resumed>) = 0 [pid 5468] <... close resumed>) = 0 [pid 5467] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5466] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5465] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5469 [pid 5468] symlink("/dev/binderfs", "./binderfs" [pid 5467] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5465] <... futex resumed>) = 0 [pid 5468] <... symlink resumed>) = 0 [pid 5467] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5470] <... set_robust_list resumed>) = 0 [pid 5466] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5465] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5469] chdir("./38" [pid 5466] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5470 [pid 5467] <... bpf resumed>) = 6 ./strace-static-x86_64: Process 5471 attached [pid 5470] chdir("./39" [pid 5469] <... chdir resumed>) = 0 [pid 5468] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5467] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5471] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5470] <... chdir resumed>) = 0 [pid 5469] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5468] <... futex resumed>) = 0 [pid 5467] <... futex resumed>) = 1 [pid 5466] <... clone3 resumed> => {parent_tid=[5471]}, 88) = 5471 [pid 5465] <... futex resumed>) = 0 [pid 5471] <... rseq resumed>) = 0 [pid 5470] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5469] <... prctl resumed>) = 0 [pid 5468] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5467] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5466] rt_sigprocmask(SIG_SETMASK, [], [pid 5465] exit_group(0 [pid 5471] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5470] <... prctl resumed>) = 0 [pid 5469] setpgid(0, 0 [pid 5468] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5467] <... futex resumed>) = ? [pid 5466] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5465] <... exit_group resumed>) = ? [pid 5471] <... set_robust_list resumed>) = 0 [pid 5470] setpgid(0, 0 [pid 5469] <... setpgid resumed>) = 0 [pid 5468] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5467] +++ exited with 0 +++ [pid 5466] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5465] +++ exited with 0 +++ [pid 5471] rt_sigprocmask(SIG_SETMASK, [], [pid 5470] <... setpgid resumed>) = 0 [pid 5469] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5468] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5466] <... futex resumed>) = 0 [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5465, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5471] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5470] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5468] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5466] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5471] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5470] <... openat resumed>) = 3 [pid 5469] <... openat resumed>) = 3 [pid 5468] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5471] <... bpf resumed>) = 3 [pid 5470] write(3, "1000", 4 [pid 5469] write(3, "1000", 4 [pid 5468] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5470] <... write resumed>) = 4 [pid 5469] <... write resumed>) = 4 [pid 5470] close(3 [pid 5468] <... mprotect resumed>) = 0 [pid 5470] <... close resumed>) = 0 [pid 5469] close(3 [pid 5470] symlink("/dev/binderfs", "./binderfs" [pid 5471] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5469] <... close resumed>) = 0 [pid 5468] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5074] umount2("./37", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5471] <... futex resumed>) = 1 [pid 5470] <... symlink resumed>) = 0 [pid 5469] symlink("/dev/binderfs", "./binderfs" [pid 5468] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5466] <... futex resumed>) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5471] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5470] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5469] <... symlink resumed>) = 0 [pid 5468] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5466] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5471] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5470] <... futex resumed>) = 0 [pid 5469] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5466] <... futex resumed>) = 0 [pid 5074] openat(AT_FDCWD, "./37", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5471] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5470] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5469] <... futex resumed>) = 0 [pid 5466] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] <... openat resumed>) = 3 ./strace-static-x86_64: Process 5472 attached [pid 5471] <... bpf resumed>) = 4 [pid 5470] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5469] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5472] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5471] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5470] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5469] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5468] <... clone3 resumed> => {parent_tid=[5472]}, 88) = 5472 [pid 5074] newfstatat(3, "", [pid 5472] <... rseq resumed>) = 0 [pid 5471] <... futex resumed>) = 1 [pid 5470] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5469] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5468] rt_sigprocmask(SIG_SETMASK, [], [pid 5466] <... futex resumed>) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5472] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5471] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5470] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5469] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5468] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5466] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] getdents64(3, [pid 5472] <... set_robust_list resumed>) = 0 [pid 5471] <... bpf resumed>) = 5 [pid 5469] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5470] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5468] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5466] <... futex resumed>) = 0 [pid 5472] rt_sigprocmask(SIG_SETMASK, [], [pid 5471] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5470] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5469] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5468] <... futex resumed>) = 0 [pid 5466] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5472] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5471] <... futex resumed>) = 0 [pid 5470] <... mprotect resumed>) = 0 [pid 5469] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5468] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5466] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5472] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5471] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5470] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5466] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] umount2("./37/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5472] <... bpf resumed>) = 3 [pid 5471] <... bpf resumed>) = 6 [pid 5470] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5469] <... mprotect resumed>) = 0 [pid 5466] <... futex resumed>) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5472] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5471] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5470] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5469] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5466] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000}./strace-static-x86_64: Process 5473 attached [pid 5472] <... futex resumed>) = 1 [pid 5471] <... futex resumed>) = 0 [pid 5469] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5468] <... futex resumed>) = 0 [pid 5466] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5074] newfstatat(AT_FDCWD, "./37/binderfs", [pid 5473] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5472] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5471] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5470] <... clone3 resumed> => {parent_tid=[5473]}, 88) = 5473 [pid 5469] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5468] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5466] exit_group(0./strace-static-x86_64: Process 5474 attached [pid 5473] <... rseq resumed>) = 0 [pid 5472] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5471] <... futex resumed>) = ? [pid 5470] rt_sigprocmask(SIG_SETMASK, [], [pid 5468] <... futex resumed>) = 0 [pid 5466] <... exit_group resumed>) = ? [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5474] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5473] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5472] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5471] +++ exited with 0 +++ [pid 5470] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5469] <... clone3 resumed> => {parent_tid=[5474]}, 88) = 5474 [pid 5468] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5466] +++ exited with 0 +++ [pid 5474] <... rseq resumed>) = 0 [pid 5473] <... set_robust_list resumed>) = 0 [pid 5472] <... bpf resumed>) = 4 [pid 5470] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5469] rt_sigprocmask(SIG_SETMASK, [], [pid 5074] unlink("./37/binderfs" [pid 5474] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5473] rt_sigprocmask(SIG_SETMASK, [], [pid 5472] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5470] <... futex resumed>) = 0 [pid 5469] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5466, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5074] <... unlink resumed>) = 0 [pid 5474] <... set_robust_list resumed>) = 0 [pid 5473] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5472] <... futex resumed>) = 1 [pid 5470] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5469] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5468] <... futex resumed>) = 0 [pid 5078] restart_syscall(<... resuming interrupted clone ...> [pid 5474] rt_sigprocmask(SIG_SETMASK, [], [pid 5473] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5472] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5469] <... futex resumed>) = 0 [pid 5468] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... restart_syscall resumed>) = 0 [pid 5074] getdents64(3, [pid 5474] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5473] <... bpf resumed>) = 3 [pid 5472] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5469] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5468] <... futex resumed>) = 0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5474] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5473] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5472] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5468] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5473] <... futex resumed>) = 1 [pid 5470] <... futex resumed>) = 0 [pid 5474] <... bpf resumed>) = 3 [pid 5078] umount2("./40", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] close(3 [pid 5474] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5473] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5472] <... bpf resumed>) = 5 [pid 5470] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] <... close resumed>) = 0 [pid 5474] <... futex resumed>) = 1 [pid 5473] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5470] <... futex resumed>) = 0 [pid 5469] <... futex resumed>) = 0 [pid 5078] openat(AT_FDCWD, "./40", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5074] rmdir("./37" [pid 5474] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5473] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5472] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5470] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5469] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... openat resumed>) = 3 [pid 5074] <... rmdir resumed>) = 0 [pid 5474] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5473] <... bpf resumed>) = 4 [pid 5472] <... futex resumed>) = 1 [pid 5469] <... futex resumed>) = 0 [pid 5468] <... futex resumed>) = 0 [pid 5078] newfstatat(3, "", [pid 5474] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5473] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5472] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5469] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5468] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5074] mkdir("./38", 0777 [pid 5474] <... bpf resumed>) = 4 [pid 5473] <... futex resumed>) = 1 [pid 5472] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5470] <... futex resumed>) = 0 [pid 5468] <... futex resumed>) = 0 [pid 5078] getdents64(3, [pid 5474] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5473] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5472] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5470] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5468] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5074] <... mkdir resumed>) = 0 [pid 5474] <... futex resumed>) = 1 [pid 5473] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5472] <... bpf resumed>) = 6 [pid 5470] <... futex resumed>) = 0 [pid 5469] <... futex resumed>) = 0 [pid 5078] umount2("./40/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5474] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5473] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5472] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5470] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5469] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5474] <... bpf resumed>) = 5 [pid 5078] newfstatat(AT_FDCWD, "./40/binderfs", [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5475 attached [pid 5473] <... bpf resumed>) = 5 [pid 5472] <... futex resumed>) = 1 [pid 5469] <... futex resumed>) = 0 [pid 5468] <... futex resumed>) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5475] set_robust_list(0x55555d6c46a0, 24 [pid 5473] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5472] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5469] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5468] exit_group(0 [pid 5078] unlink("./40/binderfs" [pid 5468] <... exit_group resumed>) = ? [pid 5472] <... futex resumed>) = ? [pid 5475] <... set_robust_list resumed>) = 0 [pid 5473] <... futex resumed>) = 1 [pid 5475] chdir("./38" [pid 5474] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5472] +++ exited with 0 +++ [pid 5470] <... futex resumed>) = 0 [pid 5468] +++ exited with 0 +++ [pid 5078] <... unlink resumed>) = 0 [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5475 [pid 5475] <... chdir resumed>) = 0 [pid 5474] <... futex resumed>) = 1 [pid 5473] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5469] <... futex resumed>) = 0 [pid 5475] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5469] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5475] <... prctl resumed>) = 0 [pid 5474] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5469] <... futex resumed>) = 0 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5468, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- [pid 5475] setpgid(0, 0 [pid 5469] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5475] <... setpgid resumed>) = 0 [pid 5470] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5473] <... futex resumed>) = 0 [pid 5470] <... futex resumed>) = 1 [pid 5475] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5473] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5470] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5475] <... openat resumed>) = 3 [pid 5475] write(3, "1000", 4 [pid 5078] getdents64(3, [pid 5475] <... write resumed>) = 4 [pid 5075] umount2("./39", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5475] close(3 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5475] <... close resumed>) = 0 [pid 5078] close(3 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5475] symlink("/dev/binderfs", "./binderfs" [pid 5078] <... close resumed>) = 0 [pid 5075] openat(AT_FDCWD, "./39", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5078] rmdir("./40" [pid 5475] <... symlink resumed>) = 0 [pid 5475] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5475] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, NULL, 8) = 0 [pid 5475] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5475] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f3e2f5ed000 [pid 5075] <... openat resumed>) = 3 [pid 5078] <... rmdir resumed>) = 0 [pid 5075] newfstatat(3, "", [pid 5078] mkdir("./41", 0777 [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5475] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5475] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5078] <... mkdir resumed>) = 0 [pid 5075] getdents64(3, [pid 5475] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5475] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0}./strace-static-x86_64: Process 5476 attached [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5476] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053) = 0 [pid 5475] <... clone3 resumed> => {parent_tid=[5476]}, 88) = 5476 [pid 5476] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5475] rt_sigprocmask(SIG_SETMASK, [], [pid 5075] umount2("./39/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5476] <... set_robust_list resumed>) = 0 [pid 5475] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5476] rt_sigprocmask(SIG_SETMASK, [], [pid 5475] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5474] <... bpf resumed>) = 6 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5473] <... bpf resumed>) = 6 [pid 5075] newfstatat(AT_FDCWD, "./39/binderfs", [pid 5473] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5470] <... futex resumed>) = 0 [pid 5473] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5470] exit_group(0) = ? [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5473] <... futex resumed>) = ? [pid 5476] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5475] <... futex resumed>) = 0 [pid 5476] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5475] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5476] <... bpf resumed>) = 3 [pid 5476] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5475] <... futex resumed>) = 0 [pid 5474] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] unlink("./39/binderfs" [pid 5476] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5475] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5474] <... futex resumed>) = 1 [pid 5469] <... futex resumed>) = 0 [pid 5476] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5475] <... futex resumed>) = 0 [pid 5469] exit_group(0 [pid 5476] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5475] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5469] <... exit_group resumed>) = ? [pid 5476] <... bpf resumed>) = 4 [pid 5075] <... unlink resumed>) = 0 [pid 5075] getdents64(3, [pid 5476] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5475] <... futex resumed>) = 0 [pid 5476] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5475] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5476] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5475] <... futex resumed>) = 0 [pid 5476] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5475] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5476] <... bpf resumed>) = 5 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5476] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5477 attached [pid 5075] close(3 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5477 [pid 5075] <... close resumed>) = 0 [pid 5477] set_robust_list(0x55555d6c46a0, 24 [pid 5476] <... futex resumed>) = 1 [pid 5475] <... futex resumed>) = 0 [pid 5075] rmdir("./39" [pid 5477] <... set_robust_list resumed>) = 0 [pid 5476] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5475] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5477] chdir("./41" [pid 5476] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5475] <... futex resumed>) = 0 [pid 5075] <... rmdir resumed>) = 0 [pid 5476] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5475] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5477] <... chdir resumed>) = 0 [pid 5075] mkdir("./40", 0777 [pid 5477] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5477] setpgid(0, 0) = 0 [pid 5477] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5474] +++ exited with 0 +++ [pid 5473] +++ exited with 0 +++ [pid 5470] +++ exited with 0 +++ [pid 5469] +++ exited with 0 +++ [pid 5075] <... mkdir resumed>) = 0 [pid 5477] write(3, "1000", 4) = 4 [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5470, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5469, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5477] close(3) = 0 [pid 5077] restart_syscall(<... resuming interrupted clone ...> [pid 5076] restart_syscall(<... resuming interrupted clone ...> [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5477] symlink("/dev/binderfs", "./binderfs" [pid 5077] <... restart_syscall resumed>) = 0 [pid 5076] <... restart_syscall resumed>) = 0 ./strace-static-x86_64: Process 5478 attached [pid 5477] <... symlink resumed>) = 0 [pid 5478] set_robust_list(0x55555d6c46a0, 24 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5478 [pid 5478] <... set_robust_list resumed>) = 0 [pid 5478] chdir("./40" [pid 5477] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] umount2("./38", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5478] <... chdir resumed>) = 0 [pid 5477] <... futex resumed>) = 0 [pid 5478] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5477] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5077] umount2("./39", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5478] <... prctl resumed>) = 0 [pid 5477] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5476] <... bpf resumed>) = 6 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5477] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5476] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5477] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5477] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5475] <... futex resumed>) = 0 [pid 5478] setpgid(0, 0 [pid 5077] openat(AT_FDCWD, "./39", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5076] openat(AT_FDCWD, "./38", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5478] <... setpgid resumed>) = 0 [pid 5477] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5476] <... futex resumed>) = 1 [pid 5475] exit_group(0 [pid 5077] <... openat resumed>) = 3 [pid 5076] <... openat resumed>) = 3 [pid 5478] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5477] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5475] <... exit_group resumed>) = ? [pid 5077] newfstatat(3, "", [pid 5076] newfstatat(3, "", [pid 5478] <... openat resumed>) = 3 [pid 5477] <... mprotect resumed>) = 0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5478] write(3, "1000", 4 [pid 5477] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5077] getdents64(3, [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5478] <... write resumed>) = 4 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5076] getdents64(3, [pid 5478] close(3 [pid 5477] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5476] +++ exited with 0 +++ [pid 5475] +++ exited with 0 +++ [pid 5077] umount2("./39/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5478] <... close resumed>) = 0 [pid 5477] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] umount2("./38/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5478] symlink("/dev/binderfs", "./binderfs" [pid 5077] newfstatat(AT_FDCWD, "./39/binderfs", [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5475, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- ./strace-static-x86_64: Process 5479 attached [pid 5478] <... symlink resumed>) = 0 [pid 5477] <... clone3 resumed> => {parent_tid=[5479]}, 88) = 5479 [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5076] newfstatat(AT_FDCWD, "./38/binderfs", [pid 5479] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5477] rt_sigprocmask(SIG_SETMASK, [], [pid 5479] <... rseq resumed>) = 0 [pid 5479] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5477] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5479] <... set_robust_list resumed>) = 0 [pid 5477] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5479] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5478] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5477] <... futex resumed>) = 0 [pid 5077] unlink("./39/binderfs" [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5479] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5478] <... futex resumed>) = 0 [pid 5477] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... unlink resumed>) = 0 [pid 5076] unlink("./38/binderfs" [pid 5479] <... bpf resumed>) = 3 [pid 5478] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5077] getdents64(3, [pid 5076] <... unlink resumed>) = 0 [pid 5479] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5478] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5479] <... futex resumed>) = 1 [pid 5478] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5477] <... futex resumed>) = 0 [pid 5077] close(3 [pid 5479] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5478] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5477] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... close resumed>) = 0 [pid 5076] getdents64(3, [pid 5074] umount2("./38", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5479] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5478] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5477] <... futex resumed>) = 0 [pid 5077] rmdir("./39" [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5479] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5478] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5477] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... rmdir resumed>) = 0 [pid 5076] close(3 [pid 5074] openat(AT_FDCWD, "./38", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5478] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5479] <... bpf resumed>) = 4 [pid 5478] <... mprotect resumed>) = 0 [pid 5479] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... openat resumed>) = 3 [pid 5479] <... futex resumed>) = 1 [pid 5478] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5477] <... futex resumed>) = 0 [pid 5077] mkdir("./40", 0777 [pid 5076] <... close resumed>) = 0 [pid 5074] newfstatat(3, "", [pid 5479] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5477] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] rmdir("./38" [pid 5477] <... futex resumed>) = 0 [pid 5477] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5479] <... bpf resumed>) = 5 [pid 5478] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5077] <... mkdir resumed>) = 0 [pid 5076] <... rmdir resumed>) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5478] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5074] getdents64(3, ./strace-static-x86_64: Process 5480 attached [pid 5479] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5478] <... clone3 resumed> => {parent_tid=[5480]}, 88) = 5480 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5480] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5479] <... futex resumed>) = 1 [pid 5478] rt_sigprocmask(SIG_SETMASK, [], [pid 5477] <... futex resumed>) = 0 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5076] mkdir("./39", 0777 [pid 5479] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5477] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5480] <... rseq resumed>) = 0 [pid 5480] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5478] <... rt_sigprocmask resumed>NULL, 8) = 0 ./strace-static-x86_64: Process 5481 attached [pid 5480] <... set_robust_list resumed>) = 0 [pid 5479] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5478] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5477] <... futex resumed>) = 0 [pid 5076] <... mkdir resumed>) = 0 [pid 5479] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5477] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5480] rt_sigprocmask(SIG_SETMASK, [], [pid 5478] <... futex resumed>) = 0 [pid 5481] set_robust_list(0x55555d6c46a0, 24 [pid 5480] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5479] <... bpf resumed>) = 6 [pid 5478] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] umount2("./38/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5481] <... set_robust_list resumed>) = 0 [pid 5480] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5479] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5481 [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5482 attached [pid 5481] chdir("./40" [pid 5480] <... bpf resumed>) = 3 [pid 5479] <... futex resumed>) = 1 [pid 5477] <... futex resumed>) = 0 [pid 5074] newfstatat(AT_FDCWD, "./38/binderfs", [pid 5481] <... chdir resumed>) = 0 [pid 5480] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5479] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5477] exit_group(0 [pid 5482] set_robust_list(0x55555d6c46a0, 24 [pid 5481] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5477] <... exit_group resumed>) = ? [pid 5479] <... futex resumed>) = ? [pid 5482] <... set_robust_list resumed>) = 0 [pid 5481] <... prctl resumed>) = 0 [pid 5481] setpgid(0, 0 [pid 5480] <... futex resumed>) = 1 [pid 5479] +++ exited with 0 +++ [pid 5478] <... futex resumed>) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5482] chdir("./39" [pid 5480] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5478] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5482 [pid 5074] unlink("./38/binderfs" [pid 5482] <... chdir resumed>) = 0 [pid 5481] <... setpgid resumed>) = 0 [pid 5480] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5478] <... futex resumed>) = 0 [pid 5074] <... unlink resumed>) = 0 [pid 5480] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5478] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5480] <... bpf resumed>) = 4 [pid 5074] getdents64(3, [pid 5481] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5480] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5482] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5480] <... futex resumed>) = 1 [pid 5478] <... futex resumed>) = 0 [pid 5482] <... prctl resumed>) = 0 [pid 5074] close(3 [pid 5482] setpgid(0, 0 [pid 5480] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5478] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... close resumed>) = 0 [pid 5482] <... setpgid resumed>) = 0 [pid 5481] <... openat resumed>) = 3 [pid 5480] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5478] <... futex resumed>) = 0 [pid 5480] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5478] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] rmdir("./38" [pid 5482] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5481] write(3, "1000", 4 [pid 5480] <... bpf resumed>) = 5 [pid 5477] +++ exited with 0 +++ [pid 5074] <... rmdir resumed>) = 0 [pid 5481] <... write resumed>) = 4 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5477, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5481] close(3 [pid 5482] <... openat resumed>) = 3 [pid 5481] <... close resumed>) = 0 [pid 5074] mkdir("./39", 0777 [pid 5481] symlink("/dev/binderfs", "./binderfs" [pid 5482] write(3, "1000", 4 [pid 5480] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5482] <... write resumed>) = 4 [pid 5481] <... symlink resumed>) = 0 [pid 5480] <... futex resumed>) = 1 [pid 5478] <... futex resumed>) = 0 [pid 5074] <... mkdir resumed>) = 0 [pid 5482] close(3 [pid 5480] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5478] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5482] <... close resumed>) = 0 [pid 5478] <... futex resumed>) = 0 [pid 5478] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5482] symlink("/dev/binderfs", "./binderfs" [pid 5481] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] umount2("./41", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5483 attached [pid 5483] set_robust_list(0x55555d6c46a0, 24 [pid 5482] <... symlink resumed>) = 0 [pid 5481] <... futex resumed>) = 0 [pid 5480] <... bpf resumed>) = 6 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5483 [pid 5483] <... set_robust_list resumed>) = 0 [pid 5482] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5481] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5480] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] openat(AT_FDCWD, "./41", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5482] <... futex resumed>) = 0 [pid 5481] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5482] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5078] <... openat resumed>) = 3 [pid 5482] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5481] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5078] newfstatat(3, "", [pid 5482] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5481] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5481] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5482] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] getdents64(3, [pid 5483] chdir("./39" [pid 5482] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5481] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5480] <... futex resumed>) = 1 [pid 5478] <... futex resumed>) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5483] <... chdir resumed>) = 0 [pid 5482] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5480] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5478] exit_group(0 [pid 5483] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5480] <... futex resumed>) = ? [pid 5478] <... exit_group resumed>) = ? [pid 5483] <... prctl resumed>) = 0 [pid 5482] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5481] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5480] +++ exited with 0 +++ [pid 5478] +++ exited with 0 +++ [pid 5078] umount2("./41/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5483] setpgid(0, 0 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5478, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5483] <... setpgid resumed>) = 0 [pid 5482] <... mprotect resumed>) = 0 [pid 5481] <... mprotect resumed>) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5482] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5078] newfstatat(AT_FDCWD, "./41/binderfs", [pid 5483] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5481] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5075] umount2("./40", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5483] <... openat resumed>) = 3 [pid 5482] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5481] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5483] write(3, "1000", 4 [pid 5075] openat(AT_FDCWD, "./40", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5483] <... write resumed>) = 4 [pid 5075] <... openat resumed>) = 3 [pid 5483] close(3) = 0 [pid 5075] newfstatat(3, "", [pid 5483] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5482] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5481] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5078] unlink("./41/binderfs" [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 ./strace-static-x86_64: Process 5484 attached [pid 5483] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] getdents64(3, [pid 5484] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5483] <... futex resumed>) = 0 [pid 5484] <... rseq resumed>) = 0 [pid 5483] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5484] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5483] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5484] <... set_robust_list resumed>) = 0 [pid 5483] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5075] umount2("./40/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5484] rt_sigprocmask(SIG_SETMASK, [], [pid 5483] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5484] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5483] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5075] newfstatat(AT_FDCWD, "./40/binderfs", [pid 5484] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5483] <... mmap resumed>) = 0x7f3e2f5ed000 ./strace-static-x86_64: Process 5485 attached [pid 5483] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5482] <... clone3 resumed> => {parent_tid=[5485]}, 88) = 5485 [pid 5481] <... clone3 resumed> => {parent_tid=[5484]}, 88) = 5484 [pid 5078] <... unlink resumed>) = 0 [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5485] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5483] <... mprotect resumed>) = 0 [pid 5482] rt_sigprocmask(SIG_SETMASK, [], [pid 5481] rt_sigprocmask(SIG_SETMASK, [], [pid 5078] getdents64(3, [pid 5485] <... rseq resumed>) = 0 [pid 5482] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5485] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5482] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5481] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5485] <... set_robust_list resumed>) = 0 [pid 5483] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5482] <... futex resumed>) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5075] unlink("./40/binderfs" [pid 5485] rt_sigprocmask(SIG_SETMASK, [], [pid 5483] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5482] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5481] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] close(3 [pid 5075] <... unlink resumed>) = 0 [pid 5485] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5484] <... futex resumed>) = 0 [pid 5483] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5481] <... futex resumed>) = 1 [pid 5078] <... close resumed>) = 0 ./strace-static-x86_64: Process 5486 attached [pid 5485] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5484] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5481] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] rmdir("./41" [pid 5075] getdents64(3, [pid 5486] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5485] <... bpf resumed>) = 3 [pid 5484] <... bpf resumed>) = 3 [pid 5483] <... clone3 resumed> => {parent_tid=[5486]}, 88) = 5486 [pid 5486] <... rseq resumed>) = 0 [pid 5485] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5484] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5483] rt_sigprocmask(SIG_SETMASK, [], [pid 5078] <... rmdir resumed>) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5486] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5485] <... futex resumed>) = 1 [pid 5484] <... futex resumed>) = 1 [pid 5483] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5482] <... futex resumed>) = 0 [pid 5481] <... futex resumed>) = 0 [pid 5078] mkdir("./42", 0777 [pid 5075] close(3 [pid 5486] <... set_robust_list resumed>) = 0 [pid 5485] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5484] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5483] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5482] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5481] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... close resumed>) = 0 [pid 5486] rt_sigprocmask(SIG_SETMASK, [], [pid 5485] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5484] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5483] <... futex resumed>) = 0 [pid 5482] <... futex resumed>) = 0 [pid 5481] <... futex resumed>) = 0 [pid 5078] <... mkdir resumed>) = 0 [pid 5486] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5485] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5484] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5483] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] rmdir("./40" [pid 5482] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5481] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5486] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5485] <... bpf resumed>) = 4 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5486] <... bpf resumed>) = 3 [pid 5485] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5487 attached [pid 5486] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5484] <... bpf resumed>) = 4 [pid 5483] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5482] <... futex resumed>) = 0 [pid 5075] <... rmdir resumed>) = 0 [pid 5485] <... futex resumed>) = 1 [pid 5486] <... futex resumed>) = 0 [pid 5485] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5483] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5482] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5487 [pid 5075] mkdir("./41", 0777 [pid 5486] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5483] <... futex resumed>) = 0 [pid 5487] set_robust_list(0x55555d6c46a0, 24 [pid 5484] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5483] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5482] <... futex resumed>) = 0 [pid 5487] <... set_robust_list resumed>) = 0 [pid 5486] <... bpf resumed>) = 4 [pid 5484] <... futex resumed>) = 1 [pid 5482] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5481] <... futex resumed>) = 0 [pid 5075] <... mkdir resumed>) = 0 [pid 5487] chdir("./42" [pid 5486] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5485] <... bpf resumed>) = 5 [pid 5484] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5481] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5487] <... chdir resumed>) = 0 [pid 5486] <... futex resumed>) = 1 [pid 5485] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5484] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5483] <... futex resumed>) = 0 [pid 5487] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5486] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5485] <... futex resumed>) = 1 [pid 5484] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5483] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5482] <... futex resumed>) = 0 [pid 5481] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5488 attached [pid 5487] <... prctl resumed>) = 0 [pid 5486] <... bpf resumed>) = 5 [pid 5485] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5484] <... bpf resumed>) = 5 [pid 5483] <... futex resumed>) = 0 [pid 5482] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5481] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5488] set_robust_list(0x55555d6c46a0, 24 [pid 5487] setpgid(0, 0) = 0 [pid 5484] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5487] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5485] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5484] <... futex resumed>) = 0 [pid 5488] <... set_robust_list resumed>) = 0 [pid 5483] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5482] <... futex resumed>) = 0 [pid 5481] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5488 [pid 5487] <... openat resumed>) = 3 [pid 5484] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5485] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5482] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5481] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5488] chdir("./41" [pid 5486] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5481] <... futex resumed>) = 0 [pid 5481] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5486] <... futex resumed>) = 1 [pid 5483] <... futex resumed>) = 0 [pid 5488] <... chdir resumed>) = 0 [pid 5487] write(3, "1000", 4 [pid 5486] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5485] <... bpf resumed>) = 6 [pid 5484] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5483] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5488] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5487] <... write resumed>) = 4 [pid 5486] <... bpf resumed>) = 6 [pid 5485] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5484] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5483] <... futex resumed>) = 0 [pid 5488] setpgid(0, 0 [pid 5487] close(3 [pid 5486] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5485] <... futex resumed>) = 1 [pid 5484] <... bpf resumed>) = 6 [pid 5483] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5482] <... futex resumed>) = 0 [pid 5488] <... setpgid resumed>) = 0 [pid 5487] <... close resumed>) = 0 [pid 5486] <... futex resumed>) = 0 [pid 5485] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5482] exit_group(0 [pid 5488] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5487] symlink("/dev/binderfs", "./binderfs" [pid 5486] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5485] <... futex resumed>) = ? [pid 5484] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5483] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5482] <... exit_group resumed>) = ? [pid 5488] <... openat resumed>) = 3 [pid 5487] <... symlink resumed>) = 0 [pid 5485] +++ exited with 0 +++ [pid 5484] <... futex resumed>) = 1 [pid 5481] <... futex resumed>) = 0 [pid 5483] exit_group(0 [pid 5487] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5484] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5481] exit_group(0 [pid 5487] <... futex resumed>) = 0 [pid 5484] <... futex resumed>) = ? [pid 5481] <... exit_group resumed>) = ? [pid 5484] +++ exited with 0 +++ [pid 5488] write(3, "1000", 4 [pid 5487] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5486] <... futex resumed>) = ? [pid 5483] <... exit_group resumed>) = ? [pid 5482] +++ exited with 0 +++ [pid 5488] <... write resumed>) = 4 [pid 5486] +++ exited with 0 +++ [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5482, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5488] close(3 [pid 5487] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5488] <... close resumed>) = 0 [pid 5487] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5076] restart_syscall(<... resuming interrupted clone ...> [pid 5488] symlink("/dev/binderfs", "./binderfs" [pid 5076] <... restart_syscall resumed>) = 0 [pid 5487] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5488] <... symlink resumed>) = 0 [pid 5487] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5488] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5487] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5488] <... futex resumed>) = 0 [pid 5488] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5487] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5488] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5488] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5076] umount2("./39", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5488] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5487] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5483] +++ exited with 0 +++ [pid 5481] +++ exited with 0 +++ [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5488] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5481, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5483, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5487] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5076] openat(AT_FDCWD, "./39", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5488] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5487] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0}./strace-static-x86_64: Process 5489 attached [pid 5076] <... openat resumed>) = 3 [pid 5489] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5487] <... clone3 resumed> => {parent_tid=[5489]}, 88) = 5489 [pid 5489] <... rseq resumed>) = 0 [pid 5487] rt_sigprocmask(SIG_SETMASK, [], [pid 5489] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5487] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5489] <... set_robust_list resumed>) = 0 [pid 5487] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5489] rt_sigprocmask(SIG_SETMASK, [], [pid 5487] <... futex resumed>) = 0 [pid 5077] umount2("./40", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5489] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5487] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5489] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5077] openat(AT_FDCWD, "./40", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5489] <... bpf resumed>) = 3 [pid 5488] <... mprotect resumed>) = 0 [pid 5076] newfstatat(3, "", [pid 5074] umount2("./39", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5489] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5488] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5077] <... openat resumed>) = 3 [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5488] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5489] <... futex resumed>) = 1 [pid 5488] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5487] <... futex resumed>) = 0 [pid 5077] newfstatat(3, "", [pid 5076] getdents64(3, [pid 5074] openat(AT_FDCWD, "./39", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5489] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5487] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5489] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5487] <... futex resumed>) = 0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 ./strace-static-x86_64: Process 5490 attached [pid 5489] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5488] <... clone3 resumed> => {parent_tid=[5490]}, 88) = 5490 [pid 5487] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] umount2("./39/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... openat resumed>) = 3 [pid 5490] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5489] <... bpf resumed>) = 4 [pid 5488] rt_sigprocmask(SIG_SETMASK, [], [pid 5077] getdents64(3, [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] newfstatat(AT_FDCWD, "./39/binderfs", [pid 5490] <... rseq resumed>) = 0 [pid 5489] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5488] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] newfstatat(3, "", [pid 5490] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5489] <... futex resumed>) = 1 [pid 5488] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5487] <... futex resumed>) = 0 [pid 5077] umount2("./40/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5488] <... futex resumed>) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5490] <... set_robust_list resumed>) = 0 [pid 5488] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5490] rt_sigprocmask(SIG_SETMASK, [], [pid 5074] getdents64(3, [pid 5490] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5489] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5487] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] unlink("./39/binderfs" [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5490] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5489] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5487] <... futex resumed>) = 0 [pid 5077] newfstatat(AT_FDCWD, "./40/binderfs", [pid 5076] <... unlink resumed>) = 0 [pid 5489] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5487] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5076] getdents64(3, [pid 5074] umount2("./39/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5490] <... bpf resumed>) = 3 [pid 5489] <... bpf resumed>) = 5 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5076] close(3) = 0 [pid 5076] rmdir("./39" [pid 5490] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] unlink("./40/binderfs" [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5488] <... futex resumed>) = 0 [pid 5490] <... futex resumed>) = 1 [pid 5489] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5488] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... unlink resumed>) = 0 [pid 5076] <... rmdir resumed>) = 0 [pid 5490] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5489] <... futex resumed>) = 1 [pid 5488] <... futex resumed>) = 0 [pid 5487] <... futex resumed>) = 0 [pid 5074] newfstatat(AT_FDCWD, "./39/binderfs", [pid 5489] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5488] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5487] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] getdents64(3, [pid 5076] mkdir("./40", 0777 [pid 5490] <... bpf resumed>) = 4 [pid 5489] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5487] <... futex resumed>) = 0 [pid 5076] <... mkdir resumed>) = 0 [pid 5490] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5489] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5487] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5490] <... futex resumed>) = 1 [pid 5489] <... bpf resumed>) = 6 [pid 5488] <... futex resumed>) = 0 [pid 5077] close(3 [pid 5489] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5491 attached [pid 5490] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5489] <... futex resumed>) = 1 [pid 5488] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5487] <... futex resumed>) = 0 [pid 5077] <... close resumed>) = 0 [pid 5074] unlink("./39/binderfs" [pid 5490] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5489] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5488] <... futex resumed>) = 0 [pid 5487] exit_group(0 [pid 5077] rmdir("./40" [pid 5490] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5488] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... rmdir resumed>) = 0 [pid 5489] <... futex resumed>) = ? [pid 5487] <... exit_group resumed>) = ? [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5491 [pid 5491] set_robust_list(0x55555d6c46a0, 24 [pid 5490] <... bpf resumed>) = 5 [pid 5489] +++ exited with 0 +++ [pid 5487] +++ exited with 0 +++ [pid 5077] mkdir("./41", 0777 [pid 5074] <... unlink resumed>) = 0 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5487, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5491] <... set_robust_list resumed>) = 0 [pid 5491] chdir("./40") = 0 [pid 5491] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5490] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... mkdir resumed>) = 0 [pid 5074] getdents64(3, [pid 5491] <... prctl resumed>) = 0 [pid 5490] <... futex resumed>) = 1 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5491] setpgid(0, 0 [pid 5490] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5488] <... futex resumed>) = 0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5491] <... setpgid resumed>) = 0 [pid 5078] umount2("./42", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5488] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5492 attached [pid 5491] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5488] <... futex resumed>) = 1 [pid 5078] openat(AT_FDCWD, "./42", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5074] close(3 [pid 5492] set_robust_list(0x55555d6c46a0, 24 [pid 5488] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5074] <... close resumed>) = 0 [pid 5492] <... set_robust_list resumed>) = 0 [pid 5491] <... openat resumed>) = 3 [pid 5490] <... futex resumed>) = 0 [pid 5078] <... openat resumed>) = 3 [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5492 [pid 5074] rmdir("./39" [pid 5492] chdir("./41" [pid 5491] write(3, "1000", 4 [pid 5490] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5078] newfstatat(3, "", [pid 5074] <... rmdir resumed>) = 0 [pid 5491] <... write resumed>) = 4 [pid 5492] <... chdir resumed>) = 0 [pid 5490] <... bpf resumed>) = 6 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5491] close(3 [pid 5490] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] getdents64(3, [pid 5492] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5491] <... close resumed>) = 0 [pid 5490] <... futex resumed>) = 1 [pid 5488] <... futex resumed>) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5492] <... prctl resumed>) = 0 [pid 5491] symlink("/dev/binderfs", "./binderfs" [pid 5490] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5488] exit_group(0 [pid 5074] mkdir("./40", 0777 [pid 5492] setpgid(0, 0 [pid 5491] <... symlink resumed>) = 0 [pid 5490] <... futex resumed>) = ? [pid 5488] <... exit_group resumed>) = ? [pid 5078] umount2("./42/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5492] <... setpgid resumed>) = 0 [pid 5074] <... mkdir resumed>) = 0 [pid 5492] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5078] newfstatat(AT_FDCWD, "./42/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5491] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5493 attached [pid 5492] write(3, "1000", 4 [pid 5491] <... futex resumed>) = 0 [pid 5078] unlink("./42/binderfs" [pid 5493] set_robust_list(0x55555d6c46a0, 24 [pid 5492] <... write resumed>) = 4 [pid 5491] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5078] <... unlink resumed>) = 0 [pid 5493] <... set_robust_list resumed>) = 0 [pid 5492] close(3 [pid 5493] chdir("./40" [pid 5492] <... close resumed>) = 0 [pid 5491] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5490] +++ exited with 0 +++ [pid 5488] +++ exited with 0 +++ [pid 5493] <... chdir resumed>) = 0 [pid 5492] symlink("/dev/binderfs", "./binderfs" [pid 5491] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5078] getdents64(3, [pid 5493] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5492] <... symlink resumed>) = 0 [pid 5491] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5488, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5493 [pid 5493] <... prctl resumed>) = 0 [pid 5492] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5491] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5078] close(3 [pid 5075] restart_syscall(<... resuming interrupted clone ...> [pid 5493] setpgid(0, 0 [pid 5492] <... futex resumed>) = 0 [pid 5491] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5075] <... restart_syscall resumed>) = 0 [pid 5493] <... setpgid resumed>) = 0 [pid 5492] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5491] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5078] <... close resumed>) = 0 [pid 5493] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5492] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5491] <... mprotect resumed>) = 0 [pid 5078] rmdir("./42" [pid 5493] <... openat resumed>) = 3 [pid 5492] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5491] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5078] <... rmdir resumed>) = 0 [pid 5075] umount2("./41", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5492] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5492] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5493] write(3, "1000", 4 [pid 5492] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5493] <... write resumed>) = 4 [pid 5492] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5493] close(3 [pid 5492] <... mprotect resumed>) = 0 [pid 5493] <... close resumed>) = 0 [pid 5492] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5493] symlink("/dev/binderfs", "./binderfs" [pid 5492] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5493] <... symlink resumed>) = 0 [pid 5492] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5491] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5075] openat(AT_FDCWD, "./41", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY./strace-static-x86_64: Process 5494 attached [pid 5493] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5491] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5075] <... openat resumed>) = 3 ./strace-static-x86_64: Process 5495 attached [pid 5494] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5493] <... futex resumed>) = 0 [pid 5492] <... clone3 resumed> => {parent_tid=[5494]}, 88) = 5494 [pid 5078] mkdir("./43", 0777 [pid 5075] newfstatat(3, "", [pid 5495] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5494] <... rseq resumed>) = 0 [pid 5493] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5492] rt_sigprocmask(SIG_SETMASK, [], [pid 5491] <... clone3 resumed> => {parent_tid=[5495]}, 88) = 5495 [pid 5078] <... mkdir resumed>) = 0 [pid 5495] <... rseq resumed>) = 0 [pid 5494] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5491] rt_sigprocmask(SIG_SETMASK, [], [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5495] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5494] <... set_robust_list resumed>) = 0 [pid 5493] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5492] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5495] <... set_robust_list resumed>) = 0 [pid 5494] rt_sigprocmask(SIG_SETMASK, [], [pid 5493] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5495] rt_sigprocmask(SIG_SETMASK, [], [pid 5492] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5491] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5075] getdents64(3, [pid 5495] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5494] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5493] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5492] <... futex resumed>) = 0 [pid 5491] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5496 attached [pid 5495] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5494] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5493] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5492] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5491] <... futex resumed>) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5496] set_robust_list(0x55555d6c46a0, 24 [pid 5495] <... bpf resumed>) = 3 [pid 5494] <... bpf resumed>) = 3 [pid 5493] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5491] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5496] <... set_robust_list resumed>) = 0 [pid 5494] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5493] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5496] chdir("./43" [pid 5495] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5494] <... futex resumed>) = 1 [pid 5493] <... mprotect resumed>) = 0 [pid 5492] <... futex resumed>) = 0 [pid 5075] umount2("./41/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5495] <... futex resumed>) = 1 [pid 5494] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5493] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5492] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5491] <... futex resumed>) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5496] <... chdir resumed>) = 0 [pid 5495] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5494] <... bpf resumed>) = 4 [pid 5493] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5492] <... futex resumed>) = 0 [pid 5491] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5496 [pid 5075] newfstatat(AT_FDCWD, "./41/binderfs", [pid 5496] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5495] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5494] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5493] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5492] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5491] <... futex resumed>) = 0 [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5496] <... prctl resumed>) = 0 [pid 5495] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5494] <... futex resumed>) = 0 [pid 5492] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5491] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5497 attached [pid 5496] setpgid(0, 0 [pid 5495] <... bpf resumed>) = 4 [pid 5494] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5492] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] unlink("./41/binderfs" [pid 5497] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5496] <... setpgid resumed>) = 0 [pid 5495] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5494] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5493] <... clone3 resumed> => {parent_tid=[5497]}, 88) = 5497 [pid 5492] <... futex resumed>) = 0 [pid 5497] <... rseq resumed>) = 0 [pid 5496] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5495] <... futex resumed>) = 1 [pid 5494] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5493] rt_sigprocmask(SIG_SETMASK, [], [pid 5492] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5491] <... futex resumed>) = 0 [pid 5075] <... unlink resumed>) = 0 [pid 5497] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5495] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5491] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5497] <... set_robust_list resumed>) = 0 [pid 5496] <... openat resumed>) = 3 [pid 5495] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5494] <... bpf resumed>) = 5 [pid 5493] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5491] <... futex resumed>) = 0 [pid 5075] getdents64(3, [pid 5497] rt_sigprocmask(SIG_SETMASK, [], [pid 5495] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5491] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5497] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5496] write(3, "1000", 4 [pid 5495] <... bpf resumed>) = 5 [pid 5494] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5493] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] close(3 [pid 5497] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5496] <... write resumed>) = 4 [pid 5494] <... futex resumed>) = 1 [pid 5493] <... futex resumed>) = 0 [pid 5492] <... futex resumed>) = 0 [pid 5497] <... bpf resumed>) = 3 [pid 5496] close(3 [pid 5494] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5493] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5492] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5497] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5496] <... close resumed>) = 0 [pid 5494] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5493] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5492] <... futex resumed>) = 0 [pid 5497] <... futex resumed>) = 0 [pid 5496] symlink("/dev/binderfs", "./binderfs" [pid 5494] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5493] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5492] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5497] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5493] <... futex resumed>) = 0 [pid 5494] <... bpf resumed>) = 6 [pid 5496] <... symlink resumed>) = 0 [pid 5493] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5495] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5494] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... close resumed>) = 0 [pid 5497] <... bpf resumed>) = 4 [pid 5495] <... futex resumed>) = 1 [pid 5491] <... futex resumed>) = 0 [pid 5496] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5497] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5496] <... futex resumed>) = 0 [pid 5495] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5494] <... futex resumed>) = 1 [pid 5492] <... futex resumed>) = 0 [pid 5491] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] rmdir("./41" [pid 5497] <... futex resumed>) = 1 [pid 5496] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5495] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5494] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5493] <... futex resumed>) = 0 [pid 5492] exit_group(0 [pid 5491] <... futex resumed>) = 0 [pid 5075] <... rmdir resumed>) = 0 [pid 5497] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5496] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5495] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5494] <... futex resumed>) = ? [pid 5493] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5492] <... exit_group resumed>) = ? [pid 5491] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5497] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5496] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5495] <... bpf resumed>) = 6 [pid 5494] +++ exited with 0 +++ [pid 5075] mkdir("./42", 0777 [pid 5497] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5496] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5495] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5493] <... futex resumed>) = 0 [pid 5496] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5495] <... futex resumed>) = 1 [pid 5491] <... futex resumed>) = 0 [pid 5075] <... mkdir resumed>) = 0 [pid 5495] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5491] exit_group(0 [pid 5497] <... bpf resumed>) = 5 [pid 5496] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5493] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5491] <... exit_group resumed>) = ? [pid 5497] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5496] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5495] <... futex resumed>) = ? [pid 5493] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5497] <... futex resumed>) = 0 [pid 5496] <... mprotect resumed>) = 0 [pid 5493] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5497] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5496] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5493] <... futex resumed>) = 0 [pid 5496] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5493] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5496] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0}./strace-static-x86_64: Process 5499 attached ./strace-static-x86_64: Process 5498 attached [pid 5498] set_robust_list(0x55555d6c46a0, 24 [pid 5496] <... clone3 resumed> => {parent_tid=[5499]}, 88) = 5499 [pid 5499] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5498] <... set_robust_list resumed>) = 0 [pid 5496] rt_sigprocmask(SIG_SETMASK, [], [pid 5499] <... rseq resumed>) = 0 [pid 5496] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5498 [pid 5499] set_robust_list(0x7f3e2f60d9a0, 24) = 0 [pid 5499] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5499] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5498] chdir("./42" [pid 5496] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5499] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5498] <... chdir resumed>) = 0 [pid 5496] <... futex resumed>) = 0 [pid 5499] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5498] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5496] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5499] <... bpf resumed>) = 3 [pid 5498] <... prctl resumed>) = 0 [pid 5498] setpgid(0, 0 [pid 5499] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5498] <... setpgid resumed>) = 0 [pid 5499] <... futex resumed>) = 1 [pid 5496] <... futex resumed>) = 0 [pid 5499] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5498] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5496] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5499] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5496] <... futex resumed>) = 0 [pid 5499] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 4 [pid 5498] <... openat resumed>) = 3 [pid 5496] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5492] +++ exited with 0 +++ [pid 5498] write(3, "1000", 4 [pid 5499] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5498] <... write resumed>) = 4 [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5492, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5499] <... futex resumed>) = 1 [pid 5498] close(3 [pid 5496] <... futex resumed>) = 0 [pid 5077] umount2("./41", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5499] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5498] <... close resumed>) = 0 [pid 5496] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5499] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5077] openat(AT_FDCWD, "./41", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5499] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5498] symlink("/dev/binderfs", "./binderfs" [pid 5496] <... futex resumed>) = 0 [pid 5077] <... openat resumed>) = 3 [pid 5499] <... bpf resumed>) = 5 [pid 5498] <... symlink resumed>) = 0 [pid 5496] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5495] +++ exited with 0 +++ [pid 5491] +++ exited with 0 +++ [pid 5077] newfstatat(3, "", [pid 5499] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5499] <... futex resumed>) = 1 [pid 5498] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5496] <... futex resumed>) = 0 [pid 5077] getdents64(3, [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5491, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5499] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5498] <... futex resumed>) = 0 [pid 5496] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5076] umount2("./40", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5498] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5496] <... futex resumed>) = 0 [pid 5077] umount2("./41/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5498] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5496] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5498] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5076] openat(AT_FDCWD, "./40", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5498] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] newfstatat(AT_FDCWD, "./41/binderfs", [pid 5076] <... openat resumed>) = 3 [pid 5498] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5076] newfstatat(3, "", [pid 5499] <... bpf resumed>) = 6 [pid 5498] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5497] <... bpf resumed>) = 6 [pid 5077] unlink("./41/binderfs" [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5499] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5498] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5497] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... unlink resumed>) = 0 [pid 5076] getdents64(3, [pid 5499] <... futex resumed>) = 1 [pid 5498] <... mprotect resumed>) = 0 [pid 5497] <... futex resumed>) = 1 [pid 5496] <... futex resumed>) = 0 [pid 5493] <... futex resumed>) = 0 [pid 5497] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5496] exit_group(0 [pid 5498] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5496] <... exit_group resumed>) = ? [pid 5493] exit_group(0 [pid 5077] getdents64(3, [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5499] +++ exited with 0 +++ [pid 5076] umount2("./40/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5076] newfstatat(AT_FDCWD, "./40/binderfs", [pid 5496] +++ exited with 0 +++ [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5497] <... futex resumed>) = ? [pid 5493] <... exit_group resumed>) = ? [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5496, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5497] +++ exited with 0 +++ [pid 5076] unlink("./40/binderfs") = 0 [pid 5076] getdents64(3, [pid 5498] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5493] +++ exited with 0 +++ [pid 5077] close(3 [pid 5498] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5077] <... close resumed>) = 0 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5493, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5077] rmdir("./41" [pid 5076] close(3./strace-static-x86_64: Process 5500 attached [pid 5078] umount2("./43", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5077] <... rmdir resumed>) = 0 [pid 5076] <... close resumed>) = 0 [pid 5500] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5498] <... clone3 resumed> => {parent_tid=[5500]}, 88) = 5500 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5077] mkdir("./42", 0777 [pid 5076] rmdir("./40" [pid 5500] <... rseq resumed>) = 0 [pid 5498] rt_sigprocmask(SIG_SETMASK, [], [pid 5078] openat(AT_FDCWD, "./43", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5077] <... mkdir resumed>) = 0 [pid 5076] <... rmdir resumed>) = 0 [pid 5074] umount2("./40", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5500] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5498] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5500] <... set_robust_list resumed>) = 0 [pid 5498] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... openat resumed>) = 3 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5500] rt_sigprocmask(SIG_SETMASK, [], [pid 5498] <... futex resumed>) = 0 [pid 5078] newfstatat(3, "", [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] openat(AT_FDCWD, "./40", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5500] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5500] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5498] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5076] mkdir("./41", 0777 [pid 5074] <... openat resumed>) = 3 ./strace-static-x86_64: Process 5501 attached [pid 5500] <... bpf resumed>) = 3 [pid 5078] getdents64(3, [pid 5076] <... mkdir resumed>) = 0 [pid 5074] newfstatat(3, "", [pid 5501] set_robust_list(0x55555d6c46a0, 24 [pid 5500] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5501] <... set_robust_list resumed>) = 0 [pid 5500] <... futex resumed>) = 1 [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5501 [pid 5500] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5501] chdir("./42" [pid 5498] <... futex resumed>) = 0 [pid 5078] umount2("./43/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5501] <... chdir resumed>) = 0 [pid 5498] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] getdents64(3, [pid 5501] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5500] <... futex resumed>) = 0 [pid 5498] <... futex resumed>) = 1 [pid 5078] newfstatat(AT_FDCWD, "./43/binderfs", [pid 5501] <... prctl resumed>) = 0 [pid 5500] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5498] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 ./strace-static-x86_64: Process 5502 attached [pid 5501] setpgid(0, 0 [pid 5500] <... bpf resumed>) = 4 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] umount2("./40/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5501] <... setpgid resumed>) = 0 [pid 5078] unlink("./43/binderfs" [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5502 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5502] set_robust_list(0x55555d6c46a0, 24 [pid 5501] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5500] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... unlink resumed>) = 0 [pid 5074] newfstatat(AT_FDCWD, "./40/binderfs", [pid 5502] <... set_robust_list resumed>) = 0 [pid 5501] <... openat resumed>) = 3 [pid 5500] <... futex resumed>) = 1 [pid 5498] <... futex resumed>) = 0 [pid 5502] chdir("./41" [pid 5498] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5500] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5498] <... futex resumed>) = 0 [pid 5078] getdents64(3, [pid 5500] <... bpf resumed>) = 5 [pid 5498] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5074] unlink("./40/binderfs" [pid 5502] <... chdir resumed>) = 0 [pid 5501] write(3, "1000", 4 [pid 5078] close(3 [pid 5074] <... unlink resumed>) = 0 [pid 5502] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5501] <... write resumed>) = 4 [pid 5502] <... prctl resumed>) = 0 [pid 5501] close(3 [pid 5502] setpgid(0, 0 [pid 5501] <... close resumed>) = 0 [pid 5500] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... close resumed>) = 0 [pid 5074] getdents64(3, [pid 5501] symlink("/dev/binderfs", "./binderfs" [pid 5500] <... futex resumed>) = 1 [pid 5498] <... futex resumed>) = 0 [pid 5078] rmdir("./43" [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5502] <... setpgid resumed>) = 0 [pid 5501] <... symlink resumed>) = 0 [pid 5500] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5498] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... rmdir resumed>) = 0 [pid 5501] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5500] <... bpf resumed>) = 6 [pid 5074] close(3 [pid 5501] <... futex resumed>) = 0 [pid 5502] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5501] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5500] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5498] <... futex resumed>) = 0 [pid 5074] <... close resumed>) = 0 [pid 5502] <... openat resumed>) = 3 [pid 5501] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5500] <... futex resumed>) = 0 [pid 5498] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] mkdir("./44", 0777 [pid 5502] write(3, "1000", 4 [pid 5501] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5500] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5498] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5078] <... mkdir resumed>) = 0 [pid 5074] rmdir("./40" [pid 5502] <... write resumed>) = 4 [pid 5501] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5498] exit_group(0 [pid 5074] <... rmdir resumed>) = 0 [pid 5502] close(3 [pid 5501] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5502] <... close resumed>) = 0 [pid 5501] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5500] <... futex resumed>) = ? [pid 5498] <... exit_group resumed>) = ? [pid 5074] mkdir("./41", 0777 [pid 5502] symlink("/dev/binderfs", "./binderfs" [pid 5501] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5500] +++ exited with 0 +++ [pid 5498] +++ exited with 0 +++ [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5501] <... mprotect resumed>) = 0 [pid 5502] <... symlink resumed>) = 0 [pid 5501] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5074] <... mkdir resumed>) = 0 ./strace-static-x86_64: Process 5503 attached [pid 5502] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5501] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5498, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5503] set_robust_list(0x55555d6c46a0, 24 [pid 5502] <... futex resumed>) = 0 [pid 5501] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5503 [pid 5075] restart_syscall(<... resuming interrupted clone ...> [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5504 attached [pid 5503] <... set_robust_list resumed>) = 0 [pid 5502] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5075] <... restart_syscall resumed>) = 0 [pid 5504] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5502] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5501] <... clone3 resumed> => {parent_tid=[5504]}, 88) = 5504 [pid 5504] <... rseq resumed>) = 0 [pid 5502] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5501] rt_sigprocmask(SIG_SETMASK, [], [pid 5504] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5502] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5502] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5504] <... set_robust_list resumed>) = 0 [pid 5504] rt_sigprocmask(SIG_SETMASK, [], [pid 5503] chdir("./44" [pid 5502] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5504] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5503] <... chdir resumed>) = 0 [pid 5502] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5501] <... rt_sigprocmask resumed>NULL, 8) = 0 ./strace-static-x86_64: Process 5505 attached [pid 5504] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5503] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5502] <... mprotect resumed>) = 0 [pid 5501] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] umount2("./42", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5505 [pid 5505] set_robust_list(0x55555d6c46a0, 24 [pid 5504] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5503] <... prctl resumed>) = 0 [pid 5502] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5501] <... futex resumed>) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5505] <... set_robust_list resumed>) = 0 [pid 5504] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5503] setpgid(0, 0 [pid 5502] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5501] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] openat(AT_FDCWD, "./42", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5505] chdir("./41" [pid 5504] <... bpf resumed>) = 3 [pid 5503] <... setpgid resumed>) = 0 [pid 5502] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5075] <... openat resumed>) = 3 ./strace-static-x86_64: Process 5506 attached [pid 5505] <... chdir resumed>) = 0 [pid 5504] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5503] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5075] newfstatat(3, "", [pid 5506] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5505] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5504] <... futex resumed>) = 1 [pid 5503] <... openat resumed>) = 3 [pid 5502] <... clone3 resumed> => {parent_tid=[5506]}, 88) = 5506 [pid 5501] <... futex resumed>) = 0 [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5506] <... rseq resumed>) = 0 [pid 5505] <... prctl resumed>) = 0 [pid 5504] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5503] write(3, "1000", 4 [pid 5502] rt_sigprocmask(SIG_SETMASK, [], [pid 5501] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] getdents64(3, [pid 5506] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5505] setpgid(0, 0 [pid 5503] <... write resumed>) = 4 [pid 5502] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5501] <... futex resumed>) = 0 [pid 5506] <... set_robust_list resumed>) = 0 [pid 5503] close(3 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5506] rt_sigprocmask(SIG_SETMASK, [], [pid 5503] <... close resumed>) = 0 [pid 5502] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5501] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5506] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5503] symlink("/dev/binderfs", "./binderfs" [pid 5075] umount2("./42/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5506] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5505] <... setpgid resumed>) = 0 [pid 5504] <... bpf resumed>) = 4 [pid 5503] <... symlink resumed>) = 0 [pid 5502] <... futex resumed>) = 0 [pid 5506] <... bpf resumed>) = 3 [pid 5505] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5504] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5503] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5502] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5506] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5505] <... openat resumed>) = 3 [pid 5504] <... futex resumed>) = 1 [pid 5503] <... futex resumed>) = 0 [pid 5501] <... futex resumed>) = 0 [pid 5075] newfstatat(AT_FDCWD, "./42/binderfs", [pid 5506] <... futex resumed>) = 0 [pid 5504] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5503] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5502] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5501] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5506] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5505] write(3, "1000", 4 [pid 5503] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5502] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5501] <... futex resumed>) = 0 [pid 5075] unlink("./42/binderfs" [pid 5506] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5505] <... write resumed>) = 4 [pid 5504] <... bpf resumed>) = 5 [pid 5503] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5502] <... futex resumed>) = 0 [pid 5501] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5506] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5505] close(3 [pid 5504] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5503] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5502] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5501] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5075] <... unlink resumed>) = 0 [pid 5506] <... bpf resumed>) = 4 [pid 5505] <... close resumed>) = 0 [pid 5504] <... futex resumed>) = 0 [pid 5503] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5501] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5505] symlink("/dev/binderfs", "./binderfs" [pid 5504] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5503] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5501] <... futex resumed>) = 0 [pid 5506] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5505] <... symlink resumed>) = 0 [pid 5503] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5501] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5075] getdents64(3, [pid 5506] <... futex resumed>) = 1 [pid 5504] <... bpf resumed>) = 6 [pid 5503] <... mprotect resumed>) = 0 [pid 5502] <... futex resumed>) = 0 [pid 5502] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5506] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5505] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5504] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5503] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5502] <... futex resumed>) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5506] <... bpf resumed>) = 5 [pid 5505] <... futex resumed>) = 0 [pid 5504] <... futex resumed>) = 1 [pid 5503] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5502] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5501] <... futex resumed>) = 0 [pid 5505] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5504] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5503] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5501] exit_group(0 [pid 5075] close(3 [pid 5506] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5505] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5504] <... futex resumed>) = ? [pid 5501] <... exit_group resumed>) = ? [pid 5075] <... close resumed>) = 0 ./strace-static-x86_64: Process 5507 attached [pid 5506] <... futex resumed>) = 1 [pid 5505] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5504] +++ exited with 0 +++ [pid 5503] <... clone3 resumed> => {parent_tid=[5507]}, 88) = 5507 [pid 5502] <... futex resumed>) = 0 [pid 5075] rmdir("./42" [pid 5507] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5506] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5505] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5503] rt_sigprocmask(SIG_SETMASK, [], [pid 5502] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5507] <... rseq resumed>) = 0 [pid 5506] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5505] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5503] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5502] <... futex resumed>) = 0 [pid 5501] +++ exited with 0 +++ [pid 5075] <... rmdir resumed>) = 0 [pid 5507] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5506] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5505] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5503] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5502] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5501, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5507] <... set_robust_list resumed>) = 0 [pid 5505] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5507] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5505] <... mprotect resumed>) = 0 [pid 5503] <... futex resumed>) = 0 [pid 5075] mkdir("./43", 0777 [pid 5507] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5505] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5503] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] <... mkdir resumed>) = 0 [pid 5507] <... bpf resumed>) = 3 [pid 5505] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5507] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5505] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0}./strace-static-x86_64: Process 5508 attached [pid 5507] <... futex resumed>) = 1 [pid 5503] <... futex resumed>) = 0 [pid 5077] umount2("./42", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5508] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5507] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5505] <... clone3 resumed> => {parent_tid=[5508]}, 88) = 5508 [pid 5503] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5508] <... rseq resumed>) = 0 [pid 5507] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5506] <... bpf resumed>) = 6 [pid 5505] rt_sigprocmask(SIG_SETMASK, [], [pid 5503] <... futex resumed>) = 0 [pid 5508] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5507] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5506] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5505] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5503] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] openat(AT_FDCWD, "./42", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY./strace-static-x86_64: Process 5509 attached [pid 5508] <... set_robust_list resumed>) = 0 [pid 5506] <... futex resumed>) = 1 [pid 5502] <... futex resumed>) = 0 [pid 5509] set_robust_list(0x55555d6c46a0, 24 [pid 5508] rt_sigprocmask(SIG_SETMASK, [], [pid 5507] <... bpf resumed>) = 4 [pid 5506] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5505] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5502] exit_group(0 [pid 5077] <... openat resumed>) = 3 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5509 [pid 5509] <... set_robust_list resumed>) = 0 [pid 5508] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5507] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5506] <... futex resumed>) = ? [pid 5505] <... futex resumed>) = 0 [pid 5502] <... exit_group resumed>) = ? [pid 5077] newfstatat(3, "", [pid 5509] chdir("./43" [pid 5508] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5507] <... futex resumed>) = 1 [pid 5506] +++ exited with 0 +++ [pid 5505] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5503] <... futex resumed>) = 0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5509] <... chdir resumed>) = 0 [pid 5508] <... bpf resumed>) = 3 [pid 5507] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5503] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] getdents64(3, [pid 5509] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5508] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5507] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5503] <... futex resumed>) = 0 [pid 5502] +++ exited with 0 +++ [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5509] <... prctl resumed>) = 0 [pid 5508] <... futex resumed>) = 1 [pid 5507] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5505] <... futex resumed>) = 0 [pid 5503] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] umount2("./42/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5509] setpgid(0, 0 [pid 5508] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5502, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5509] <... setpgid resumed>) = 0 [pid 5508] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5507] <... bpf resumed>) = 5 [pid 5505] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] umount2("./41", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5509] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5508] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5509] <... openat resumed>) = 3 [pid 5508] <... bpf resumed>) = 4 [pid 5505] <... futex resumed>) = 0 [pid 5077] newfstatat(AT_FDCWD, "./42/binderfs", [pid 5076] openat(AT_FDCWD, "./41", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5509] write(3, "1000", 4 [pid 5508] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5507] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5505] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5076] <... openat resumed>) = 3 [pid 5509] <... write resumed>) = 4 [pid 5508] <... futex resumed>) = 0 [pid 5507] <... futex resumed>) = 1 [pid 5505] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5503] <... futex resumed>) = 0 [pid 5077] unlink("./42/binderfs" [pid 5509] close(3 [pid 5508] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5507] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5505] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5503] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... unlink resumed>) = 0 [pid 5076] newfstatat(3, "", [pid 5509] <... close resumed>) = 0 [pid 5508] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5507] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5505] <... futex resumed>) = 0 [pid 5503] <... futex resumed>) = 0 [pid 5077] getdents64(3, [pid 5509] symlink("/dev/binderfs", "./binderfs" [pid 5508] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5507] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5505] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5503] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5509] <... symlink resumed>) = 0 [pid 5508] <... bpf resumed>) = 5 [pid 5077] close(3 [pid 5076] getdents64(3, [pid 5507] <... bpf resumed>) = 6 [pid 5509] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5509] <... futex resumed>) = 0 [pid 5509] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5508] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5507] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... close resumed>) = 0 [pid 5076] umount2("./41/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5509] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5508] <... futex resumed>) = 1 [pid 5507] <... futex resumed>) = 1 [pid 5505] <... futex resumed>) = 0 [pid 5503] <... futex resumed>) = 0 [pid 5077] rmdir("./42" [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5509] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5508] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5507] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5503] exit_group(0 [pid 5076] newfstatat(AT_FDCWD, "./41/binderfs", [pid 5509] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5507] <... futex resumed>) = ? [pid 5505] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5503] <... exit_group resumed>) = ? [pid 5077] <... rmdir resumed>) = 0 [pid 5509] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5507] +++ exited with 0 +++ [pid 5509] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5076] unlink("./41/binderfs" [pid 5509] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5076] <... unlink resumed>) = 0 [pid 5509] <... mprotect resumed>) = 0 [pid 5503] +++ exited with 0 +++ [pid 5508] <... futex resumed>) = 0 [pid 5505] <... futex resumed>) = 1 [pid 5077] mkdir("./43", 0777 [pid 5509] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5508] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5505] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5503, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5077] <... mkdir resumed>) = 0 [pid 5076] getdents64(3, [pid 5078] restart_syscall(<... resuming interrupted clone ...> [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5509] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5078] <... restart_syscall resumed>) = 0 [pid 5076] close(3 [pid 5509] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5076] <... close resumed>) = 0 [pid 5076] rmdir("./41"./strace-static-x86_64: Process 5510 attached [pid 5509] <... clone3 resumed> => {parent_tid=[5510]}, 88) = 5510 [pid 5078] umount2("./44", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] <... rmdir resumed>) = 0 [pid 5509] rt_sigprocmask(SIG_SETMASK, [], [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5509] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] openat(AT_FDCWD, "./44", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5509] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... openat resumed>) = 3 [pid 5076] mkdir("./42", 0777 [pid 5509] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5511 attached [pid 5510] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5509] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] newfstatat(3, "", [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5511 [pid 5076] <... mkdir resumed>) = 0 [pid 5511] set_robust_list(0x55555d6c46a0, 24 [pid 5510] <... rseq resumed>) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5511] <... set_robust_list resumed>) = 0 [pid 5510] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5078] getdents64(3, [pid 5511] chdir("./43" [pid 5510] <... set_robust_list resumed>) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5511] <... chdir resumed>) = 0 [pid 5510] rt_sigprocmask(SIG_SETMASK, [], [pid 5078] umount2("./44/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5512 attached [pid 5511] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5510] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5510] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5078] newfstatat(AT_FDCWD, "./44/binderfs", [pid 5512] set_robust_list(0x55555d6c46a0, 24 [pid 5511] <... prctl resumed>) = 0 [pid 5510] <... bpf resumed>) = 3 [pid 5510] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5510] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5511] setpgid(0, 0 [pid 5509] <... futex resumed>) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5512 [pid 5512] <... set_robust_list resumed>) = 0 [pid 5509] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] unlink("./44/binderfs" [pid 5512] chdir("./42" [pid 5511] <... setpgid resumed>) = 0 [pid 5510] <... futex resumed>) = 0 [pid 5509] <... futex resumed>) = 1 [pid 5078] <... unlink resumed>) = 0 [pid 5512] <... chdir resumed>) = 0 [pid 5511] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5510] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5509] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] getdents64(3, [pid 5512] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5510] <... bpf resumed>) = 4 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5510] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5512] <... prctl resumed>) = 0 [pid 5511] <... openat resumed>) = 3 [pid 5510] <... futex resumed>) = 1 [pid 5509] <... futex resumed>) = 0 [pid 5078] close(3 [pid 5512] setpgid(0, 0 [pid 5511] write(3, "1000", 4 [pid 5510] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5509] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... close resumed>) = 0 [pid 5512] <... setpgid resumed>) = 0 [pid 5511] <... write resumed>) = 4 [pid 5510] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5509] <... futex resumed>) = 0 [pid 5078] rmdir("./44" [pid 5512] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5511] close(3 [pid 5510] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5509] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5511] <... close resumed>) = 0 [pid 5510] <... bpf resumed>) = 5 [pid 5078] <... rmdir resumed>) = 0 [pid 5512] <... openat resumed>) = 3 [pid 5512] write(3, "1000", 4 [pid 5511] symlink("/dev/binderfs", "./binderfs" [pid 5512] <... write resumed>) = 4 [pid 5511] <... symlink resumed>) = 0 [pid 5512] close(3) = 0 [pid 5078] mkdir("./45", 0777 [pid 5512] symlink("/dev/binderfs", "./binderfs" [pid 5078] <... mkdir resumed>) = 0 [pid 5511] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5512] <... symlink resumed>) = 0 [pid 5511] <... futex resumed>) = 0 [pid 5510] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5512] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5511] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5510] <... futex resumed>) = 1 [pid 5509] <... futex resumed>) = 0 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5512] <... futex resumed>) = 0 [pid 5511] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5510] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5509] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5512] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5511] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5509] <... futex resumed>) = 0 [pid 5512] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5511] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5510] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5508] <... bpf resumed>) = 6 [pid 5512] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5511] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5510] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5509] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000}./strace-static-x86_64: Process 5513 attached [pid 5512] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5511] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5510] <... bpf resumed>) = 6 [pid 5508] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5513] set_robust_list(0x55555d6c46a0, 24 [pid 5512] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5511] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5510] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5513 [pid 5513] <... set_robust_list resumed>) = 0 [pid 5512] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5511] <... mprotect resumed>) = 0 [pid 5510] <... futex resumed>) = 1 [pid 5509] <... futex resumed>) = 0 [pid 5508] <... futex resumed>) = 1 [pid 5505] <... futex resumed>) = 0 [pid 5513] chdir("./45" [pid 5512] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5511] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5510] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5509] exit_group(0 [pid 5508] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5505] exit_group(0 [pid 5513] <... chdir resumed>) = 0 [pid 5512] <... mprotect resumed>) = 0 [pid 5511] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5510] <... futex resumed>) = ? [pid 5509] <... exit_group resumed>) = ? [pid 5508] <... futex resumed>) = ? [pid 5505] <... exit_group resumed>) = ? [pid 5513] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5512] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5511] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5510] +++ exited with 0 +++ [pid 5509] +++ exited with 0 +++ [pid 5508] +++ exited with 0 +++ [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5509, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- ./strace-static-x86_64: Process 5514 attached [pid 5513] <... prctl resumed>) = 0 [pid 5512] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5514] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5513] setpgid(0, 0 [pid 5514] <... rseq resumed>) = 0 [pid 5513] <... setpgid resumed>) = 0 [pid 5512] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5511] <... clone3 resumed> => {parent_tid=[5514]}, 88) = 5514 ./strace-static-x86_64: Process 5515 attached [pid 5514] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5513] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5511] rt_sigprocmask(SIG_SETMASK, [], [pid 5075] umount2("./43", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5515] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5514] <... set_robust_list resumed>) = 0 [pid 5513] <... openat resumed>) = 3 [pid 5512] <... clone3 resumed> => {parent_tid=[5515]}, 88) = 5515 [pid 5511] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5505] +++ exited with 0 +++ [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5515] <... rseq resumed>) = 0 [pid 5514] rt_sigprocmask(SIG_SETMASK, [], [pid 5513] write(3, "1000", 4 [pid 5512] rt_sigprocmask(SIG_SETMASK, [], [pid 5511] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] openat(AT_FDCWD, "./43", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5505, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5515] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5514] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5513] <... write resumed>) = 4 [pid 5512] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5511] <... futex resumed>) = 0 [pid 5075] <... openat resumed>) = 3 [pid 5515] <... set_robust_list resumed>) = 0 [pid 5514] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5513] close(3 [pid 5512] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5511] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5515] rt_sigprocmask(SIG_SETMASK, [], [pid 5513] <... close resumed>) = 0 [pid 5512] <... futex resumed>) = 0 [pid 5515] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5513] symlink("/dev/binderfs", "./binderfs" [pid 5512] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5515] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5514] <... bpf resumed>) = 3 [pid 5513] <... symlink resumed>) = 0 [pid 5075] newfstatat(3, "", [pid 5515] <... bpf resumed>) = 3 [pid 5515] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5514] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5513] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5512] <... futex resumed>) = 0 [pid 5515] <... futex resumed>) = 1 [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5515] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5514] <... futex resumed>) = 1 [pid 5513] <... futex resumed>) = 0 [pid 5512] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5511] <... futex resumed>) = 0 [pid 5075] getdents64(3, [pid 5514] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5513] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5512] <... futex resumed>) = 0 [pid 5511] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5515] <... bpf resumed>) = 4 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5514] <... bpf resumed>) = 4 [pid 5513] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5512] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5511] <... futex resumed>) = 0 [pid 5075] umount2("./43/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5515] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5514] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5513] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5512] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5511] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] umount2("./41", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5515] <... futex resumed>) = 0 [pid 5514] <... futex resumed>) = 0 [pid 5513] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5512] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5511] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5075] newfstatat(AT_FDCWD, "./43/binderfs", [pid 5515] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5514] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5513] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5512] <... futex resumed>) = 0 [pid 5511] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5515] <... bpf resumed>) = 5 [pid 5514] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5513] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5512] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5511] <... futex resumed>) = 0 [pid 5075] unlink("./43/binderfs" [pid 5511] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5514] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5513] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5075] <... unlink resumed>) = 0 [pid 5074] openat(AT_FDCWD, "./41", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5515] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5514] <... bpf resumed>) = 5 [pid 5513] <... mprotect resumed>) = 0 [pid 5074] <... openat resumed>) = 3 [pid 5515] <... futex resumed>) = 1 [pid 5513] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5512] <... futex resumed>) = 0 [pid 5075] getdents64(3, [pid 5515] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5514] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5513] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5512] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5074] newfstatat(3, "", [pid 5515] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5514] <... futex resumed>) = 1 [pid 5513] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5512] <... futex resumed>) = 0 [pid 5511] <... futex resumed>) = 0 [pid 5075] close(3 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 ./strace-static-x86_64: Process 5516 attached [pid 5515] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5514] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5512] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5511] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... close resumed>) = 0 [pid 5074] getdents64(3, [pid 5516] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5515] <... bpf resumed>) = 6 [pid 5514] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5513] <... clone3 resumed> => {parent_tid=[5516]}, 88) = 5516 [pid 5511] <... futex resumed>) = 0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5516] <... rseq resumed>) = 0 [pid 5515] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5514] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5513] rt_sigprocmask(SIG_SETMASK, [], [pid 5511] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5075] rmdir("./43" [pid 5074] umount2("./41/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5516] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5515] <... futex resumed>) = 1 [pid 5514] <... bpf resumed>) = 6 [pid 5513] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5512] <... futex resumed>) = 0 [pid 5075] <... rmdir resumed>) = 0 [pid 5516] <... set_robust_list resumed>) = 0 [pid 5515] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5514] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5513] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5512] exit_group(0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5516] rt_sigprocmask(SIG_SETMASK, [], [pid 5515] <... futex resumed>) = ? [pid 5514] <... futex resumed>) = 1 [pid 5513] <... futex resumed>) = 0 [pid 5512] <... exit_group resumed>) = ? [pid 5511] <... futex resumed>) = 0 [pid 5074] newfstatat(AT_FDCWD, "./41/binderfs", [pid 5516] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5515] +++ exited with 0 +++ [pid 5514] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5513] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5511] exit_group(0 [pid 5075] mkdir("./44", 0777 [pid 5516] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5075] <... mkdir resumed>) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5516] <... bpf resumed>) = 3 [pid 5074] unlink("./41/binderfs" [pid 5516] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5514] <... futex resumed>) = ? [pid 5511] <... exit_group resumed>) = ? [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] <... unlink resumed>) = 0 [pid 5516] <... futex resumed>) = 1 [pid 5514] +++ exited with 0 +++ [pid 5513] <... futex resumed>) = 0 [pid 5516] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5513] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5517 attached [pid 5517] set_robust_list(0x55555d6c46a0, 24 [pid 5516] <... bpf resumed>) = 4 [pid 5513] <... futex resumed>) = 0 [pid 5513] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5517] <... set_robust_list resumed>) = 0 [pid 5517] chdir("./44" [pid 5516] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5517] <... chdir resumed>) = 0 [pid 5516] <... futex resumed>) = 1 [pid 5513] <... futex resumed>) = 0 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5517 [pid 5074] getdents64(3, [pid 5517] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5516] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5513] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5517] <... prctl resumed>) = 0 [pid 5516] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5513] <... futex resumed>) = 0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5517] setpgid(0, 0 [pid 5516] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5513] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] close(3 [pid 5517] <... setpgid resumed>) = 0 [pid 5516] <... bpf resumed>) = 5 [pid 5074] <... close resumed>) = 0 [pid 5517] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5516] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] rmdir("./41" [pid 5517] <... openat resumed>) = 3 [pid 5517] write(3, "1000", 4 [pid 5516] <... futex resumed>) = 1 [pid 5513] <... futex resumed>) = 0 [pid 5517] <... write resumed>) = 4 [pid 5517] close(3 [pid 5516] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5513] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... rmdir resumed>) = 0 [pid 5517] <... close resumed>) = 0 [pid 5513] <... futex resumed>) = 0 [pid 5517] symlink("/dev/binderfs", "./binderfs" [pid 5513] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5074] mkdir("./42", 0777 [pid 5517] <... symlink resumed>) = 0 [pid 5517] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5074] <... mkdir resumed>) = 0 [pid 5517] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5517] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5512] +++ exited with 0 +++ [pid 5511] +++ exited with 0 +++ [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5511, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5517] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5512, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5077] umount2("./43", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5517] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] umount2("./42", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5517] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5077] openat(AT_FDCWD, "./43", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5518 attached [pid 5517] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5077] <... openat resumed>) = 3 [pid 5076] openat(AT_FDCWD, "./42", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5518] set_robust_list(0x55555d6c46a0, 24 [pid 5517] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5077] newfstatat(3, "", [pid 5076] <... openat resumed>) = 3 [pid 5518] <... set_robust_list resumed>) = 0 [pid 5517] <... mprotect resumed>) = 0 [pid 5076] newfstatat(3, "", [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5518 [pid 5518] chdir("./42" [pid 5517] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5518] <... chdir resumed>) = 0 [pid 5077] getdents64(3, [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5518] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5517] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5516] <... bpf resumed>) = 6 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5076] getdents64(3, [pid 5518] <... prctl resumed>) = 0 [pid 5517] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5516] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] umount2("./43/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 ./strace-static-x86_64: Process 5519 attached [pid 5518] setpgid(0, 0 [pid 5516] <... futex resumed>) = 1 [pid 5513] <... futex resumed>) = 0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5519] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5518] <... setpgid resumed>) = 0 [pid 5516] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5513] exit_group(0 [pid 5077] newfstatat(AT_FDCWD, "./43/binderfs", [pid 5076] umount2("./42/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5519] <... rseq resumed>) = 0 [pid 5518] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5517] <... clone3 resumed> => {parent_tid=[5519]}, 88) = 5519 [pid 5516] <... futex resumed>) = ? [pid 5513] <... exit_group resumed>) = ? [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5519] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5517] rt_sigprocmask(SIG_SETMASK, [], [pid 5077] unlink("./43/binderfs" [pid 5076] newfstatat(AT_FDCWD, "./42/binderfs", [pid 5519] <... set_robust_list resumed>) = 0 [pid 5517] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] <... unlink resumed>) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5519] rt_sigprocmask(SIG_SETMASK, [], [pid 5517] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5076] unlink("./42/binderfs" [pid 5517] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] <... unlink resumed>) = 0 [pid 5519] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5518] <... openat resumed>) = 3 [pid 5516] +++ exited with 0 +++ [pid 5513] +++ exited with 0 +++ [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5513, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5076] getdents64(3, [pid 5078] umount2("./45", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5078] openat(AT_FDCWD, "./45", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5076] close(3 [pid 5078] newfstatat(3, "", [pid 5076] <... close resumed>) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5078] getdents64(3, [pid 5076] rmdir("./42" [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5077] getdents64(3, [pid 5076] <... rmdir resumed>) = 0 [pid 5519] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5518] write(3, "1000", 4 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5519] <... bpf resumed>) = 3 [pid 5518] <... write resumed>) = 4 [pid 5078] umount2("./45/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5077] close(3 [pid 5076] mkdir("./43", 0777 [pid 5519] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5518] close(3 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5077] <... close resumed>) = 0 [pid 5076] <... mkdir resumed>) = 0 [pid 5519] <... futex resumed>) = 1 [pid 5518] <... close resumed>) = 0 [pid 5078] newfstatat(AT_FDCWD, "./45/binderfs", [pid 5077] rmdir("./43" [pid 5519] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5518] symlink("/dev/binderfs", "./binderfs" [pid 5517] <... futex resumed>) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5518] <... symlink resumed>) = 0 [pid 5517] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] unlink("./45/binderfs" [pid 5077] <... rmdir resumed>) = 0 [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5519] <... futex resumed>) = 0 [pid 5518] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5517] <... futex resumed>) = 1 [pid 5078] <... unlink resumed>) = 0 [pid 5077] mkdir("./44", 0777 [pid 5519] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5518] <... futex resumed>) = 0 [pid 5517] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5519] <... bpf resumed>) = 4 [pid 5518] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5078] getdents64(3, [pid 5077] <... mkdir resumed>) = 0 [pid 5519] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5518] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5520 attached [pid 5519] <... futex resumed>) = 1 [pid 5518] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5517] <... futex resumed>) = 0 [pid 5078] close(3 [pid 5519] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5518] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5517] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... close resumed>) = 0 [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5520 [pid 5520] set_robust_list(0x55555d6c46a0, 24 [pid 5519] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5518] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5517] <... futex resumed>) = 0 [pid 5078] rmdir("./45" [pid 5520] <... set_robust_list resumed>) = 0 [pid 5519] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5518] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5517] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... rmdir resumed>) = 0 ./strace-static-x86_64: Process 5521 attached [pid 5520] chdir("./43" [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5521 [pid 5521] set_robust_list(0x55555d6c46a0, 24 [pid 5520] <... chdir resumed>) = 0 [pid 5519] <... bpf resumed>) = 5 [pid 5518] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5078] mkdir("./46", 0777 [pid 5521] <... set_robust_list resumed>) = 0 [pid 5520] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5518] <... mprotect resumed>) = 0 [pid 5078] <... mkdir resumed>) = 0 [pid 5521] chdir("./44") = 0 [pid 5520] <... prctl resumed>) = 0 [pid 5519] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5518] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5521] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5520] setpgid(0, 0 [pid 5519] <... futex resumed>) = 1 [pid 5518] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5517] <... futex resumed>) = 0 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5521] <... prctl resumed>) = 0 [pid 5520] <... setpgid resumed>) = 0 [pid 5519] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5518] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5517] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5521] setpgid(0, 0./strace-static-x86_64: Process 5523 attached ) = 0 [pid 5517] <... futex resumed>) = 0 [pid 5523] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5520] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5519] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5517] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5523] <... rseq resumed>) = 0 [pid 5521] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5520] <... openat resumed>) = 3 [pid 5519] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5518] <... clone3 resumed> => {parent_tid=[5523]}, 88) = 5523 ./strace-static-x86_64: Process 5522 attached [pid 5523] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5520] write(3, "1000", 4 [pid 5519] <... bpf resumed>) = 6 [pid 5518] rt_sigprocmask(SIG_SETMASK, [], [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5522 [pid 5522] set_robust_list(0x55555d6c46a0, 24 [pid 5523] <... set_robust_list resumed>) = 0 [pid 5521] <... openat resumed>) = 3 [pid 5520] <... write resumed>) = 4 [pid 5519] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5518] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5522] <... set_robust_list resumed>) = 0 [pid 5523] rt_sigprocmask(SIG_SETMASK, [], [pid 5521] write(3, "1000", 4 [pid 5520] close(3 [pid 5519] <... futex resumed>) = 1 [pid 5518] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5517] <... futex resumed>) = 0 [pid 5522] chdir("./46" [pid 5523] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5521] <... write resumed>) = 4 [pid 5520] <... close resumed>) = 0 [pid 5519] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5518] <... futex resumed>) = 0 [pid 5517] exit_group(0 [pid 5522] <... chdir resumed>) = 0 [pid 5523] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5521] close(3 [pid 5520] symlink("/dev/binderfs", "./binderfs" [pid 5519] <... futex resumed>) = ? [pid 5518] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5517] <... exit_group resumed>) = ? [pid 5522] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5523] <... bpf resumed>) = 3 [pid 5521] <... close resumed>) = 0 [pid 5520] <... symlink resumed>) = 0 [pid 5519] +++ exited with 0 +++ [pid 5517] +++ exited with 0 +++ [pid 5522] <... prctl resumed>) = 0 [pid 5521] symlink("/dev/binderfs", "./binderfs" [pid 5523] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5517, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5522] setpgid(0, 0 [pid 5523] <... futex resumed>) = 1 [pid 5521] <... symlink resumed>) = 0 [pid 5520] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5518] <... futex resumed>) = 0 [pid 5075] restart_syscall(<... resuming interrupted clone ...> [pid 5522] <... setpgid resumed>) = 0 [pid 5523] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5520] <... futex resumed>) = 0 [pid 5518] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... restart_syscall resumed>) = 0 [pid 5522] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5523] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5521] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5520] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5518] <... futex resumed>) = 0 [pid 5523] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5521] <... futex resumed>) = 0 [pid 5520] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5518] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5522] <... openat resumed>) = 3 [pid 5523] <... bpf resumed>) = 4 [pid 5521] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5520] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5522] write(3, "1000", 4 [pid 5521] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5520] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] umount2("./44", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5523] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5521] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5520] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5522] <... write resumed>) = 4 [pid 5523] <... futex resumed>) = 1 [pid 5521] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5520] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5518] <... futex resumed>) = 0 [pid 5075] openat(AT_FDCWD, "./44", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5522] close(3 [pid 5523] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5521] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5520] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5518] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... openat resumed>) = 3 [pid 5522] <... close resumed>) = 0 [pid 5523] <... bpf resumed>) = 5 [pid 5521] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5520] <... mprotect resumed>) = 0 [pid 5518] <... futex resumed>) = 0 [pid 5522] symlink("/dev/binderfs", "./binderfs" [pid 5521] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5518] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] newfstatat(3, "", [pid 5521] <... mprotect resumed>) = 0 [pid 5520] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5522] <... symlink resumed>) = 0 [pid 5523] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5522] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5523] <... futex resumed>) = 1 [pid 5521] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5520] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5518] <... futex resumed>) = 0 [pid 5075] getdents64(3, [pid 5522] <... futex resumed>) = 0 [pid 5523] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5521] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5520] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5518] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5524 attached [pid 5522] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5523] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5521] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5518] <... futex resumed>) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 ./strace-static-x86_64: Process 5525 attached [pid 5524] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5522] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5523] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5520] <... clone3 resumed> => {parent_tid=[5524]}, 88) = 5524 [pid 5518] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5525] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5524] <... rseq resumed>) = 0 [pid 5522] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5523] <... bpf resumed>) = 6 [pid 5521] <... clone3 resumed> => {parent_tid=[5525]}, 88) = 5525 [pid 5520] rt_sigprocmask(SIG_SETMASK, [], [pid 5075] umount2("./44/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5525] <... rseq resumed>) = 0 [pid 5524] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5522] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5523] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5521] rt_sigprocmask(SIG_SETMASK, [], [pid 5520] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5525] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5524] <... set_robust_list resumed>) = 0 [pid 5522] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5523] <... futex resumed>) = 1 [pid 5521] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5520] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5518] <... futex resumed>) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5525] <... set_robust_list resumed>) = 0 [pid 5524] rt_sigprocmask(SIG_SETMASK, [], [pid 5523] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5518] exit_group(0 [pid 5525] rt_sigprocmask(SIG_SETMASK, [], [pid 5524] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5522] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5523] <... futex resumed>) = ? [pid 5521] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5520] <... futex resumed>) = 0 [pid 5518] <... exit_group resumed>) = ? [pid 5075] newfstatat(AT_FDCWD, "./44/binderfs", [pid 5525] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5524] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5522] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5523] +++ exited with 0 +++ [pid 5521] <... futex resumed>) = 0 [pid 5520] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5518] +++ exited with 0 +++ [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5525] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5524] <... bpf resumed>) = 3 [pid 5522] <... mprotect resumed>) = 0 [pid 5521] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5525] <... bpf resumed>) = 3 [pid 5524] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] unlink("./44/binderfs" [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5518, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5525] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5524] <... futex resumed>) = 1 [pid 5522] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5521] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5520] <... futex resumed>) = 0 [pid 5075] <... unlink resumed>) = 0 [pid 5525] <... futex resumed>) = 0 [pid 5521] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5524] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5520] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5522] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5525] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5521] <... futex resumed>) = 0 [pid 5524] <... bpf resumed>) = 4 [pid 5075] getdents64(3, [pid 5522] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5521] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5520] <... futex resumed>) = 0 [pid 5525] <... bpf resumed>) = 4 [pid 5520] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5524] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] umount2("./42", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5526 attached [pid 5525] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5524] <... futex resumed>) = 0 [pid 5522] <... clone3 resumed> => {parent_tid=[5526]}, 88) = 5526 [pid 5520] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5075] close(3 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5526] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5525] <... futex resumed>) = 1 [pid 5522] rt_sigprocmask(SIG_SETMASK, [], [pid 5521] <... futex resumed>) = 0 [pid 5520] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... close resumed>) = 0 [pid 5074] openat(AT_FDCWD, "./42", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5526] <... rseq resumed>) = 0 [pid 5525] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5524] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5522] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5521] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5520] <... futex resumed>) = 0 [pid 5075] rmdir("./44" [pid 5074] <... openat resumed>) = 3 [pid 5526] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5525] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5522] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5521] <... futex resumed>) = 0 [pid 5520] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] <... rmdir resumed>) = 0 [pid 5074] newfstatat(3, "", [pid 5526] <... set_robust_list resumed>) = 0 [pid 5525] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5524] <... bpf resumed>) = 5 [pid 5522] <... futex resumed>) = 0 [pid 5521] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5526] rt_sigprocmask(SIG_SETMASK, [], [pid 5525] <... bpf resumed>) = 5 [pid 5075] mkdir("./45", 0777 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5526] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5526] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5525] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5524] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5522] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] getdents64(3, [pid 5526] <... bpf resumed>) = 3 [pid 5525] <... futex resumed>) = 1 [pid 5524] <... futex resumed>) = 1 [pid 5521] <... futex resumed>) = 0 [pid 5520] <... futex resumed>) = 0 [pid 5075] <... mkdir resumed>) = 0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5526] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5525] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5524] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5521] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5520] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5526] <... futex resumed>) = 1 [pid 5525] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5524] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5522] <... futex resumed>) = 0 [pid 5521] <... futex resumed>) = 0 [pid 5520] <... futex resumed>) = 0 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] umount2("./42/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5526] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5525] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5524] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5522] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5521] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5520] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000}./strace-static-x86_64: Process 5527 attached [pid 5526] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5525] <... bpf resumed>) = 6 [pid 5524] <... bpf resumed>) = 6 [pid 5522] <... futex resumed>) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5527] set_robust_list(0x55555d6c46a0, 24 [pid 5526] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5525] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5524] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5522] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5527] <... set_robust_list resumed>) = 0 [pid 5526] <... bpf resumed>) = 4 [pid 5525] <... futex resumed>) = 1 [pid 5524] <... futex resumed>) = 1 [pid 5521] <... futex resumed>) = 0 [pid 5520] <... futex resumed>) = 0 [pid 5074] newfstatat(AT_FDCWD, "./42/binderfs", [pid 5526] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5525] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5524] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5521] exit_group(0 [pid 5520] exit_group(0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5527] chdir("./45" [pid 5526] <... futex resumed>) = 1 [pid 5525] <... futex resumed>) = ? [pid 5524] <... futex resumed>) = ? [pid 5522] <... futex resumed>) = 0 [pid 5521] <... exit_group resumed>) = ? [pid 5520] <... exit_group resumed>) = ? [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5527 [pid 5074] unlink("./42/binderfs" [pid 5527] <... chdir resumed>) = 0 [pid 5527] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5527] setpgid(0, 0 [pid 5524] +++ exited with 0 +++ [pid 5527] <... setpgid resumed>) = 0 [pid 5522] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5527] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5526] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5525] +++ exited with 0 +++ [pid 5522] <... futex resumed>) = 0 [pid 5521] +++ exited with 0 +++ [pid 5520] +++ exited with 0 +++ [pid 5074] <... unlink resumed>) = 0 [pid 5522] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5527] write(3, "1000", 4 [pid 5526] <... bpf resumed>) = 5 [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5521, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5074] getdents64(3, [pid 5527] <... write resumed>) = 4 [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5520, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5527] close(3 [pid 5526] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] umount2("./43", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5527] <... close resumed>) = 0 [pid 5526] <... futex resumed>) = 1 [pid 5522] <... futex resumed>) = 0 [pid 5077] umount2("./44", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] close(3 [pid 5527] symlink("/dev/binderfs", "./binderfs" [pid 5526] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5522] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5527] <... symlink resumed>) = 0 [pid 5526] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5522] <... futex resumed>) = 0 [pid 5077] openat(AT_FDCWD, "./44", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5076] openat(AT_FDCWD, "./43", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5074] <... close resumed>) = 0 [pid 5074] rmdir("./42" [pid 5527] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5526] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5077] <... openat resumed>) = 3 [pid 5076] <... openat resumed>) = 3 [pid 5527] <... futex resumed>) = 0 [pid 5526] <... bpf resumed>) = 6 [pid 5077] newfstatat(3, "", [pid 5527] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, NULL, 8) = 0 [pid 5526] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5522] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5527] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5526] <... futex resumed>) = 0 [pid 5522] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5076] newfstatat(3, "", [pid 5074] <... rmdir resumed>) = 0 [pid 5527] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5526] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5522] exit_group(0 [pid 5077] getdents64(3, [pid 5527] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5526] <... futex resumed>) = ? [pid 5522] <... exit_group resumed>) = ? [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5527] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5526] +++ exited with 0 +++ [pid 5077] umount2("./44/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] getdents64(3, [pid 5074] mkdir("./43", 0777 [pid 5527] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5522] +++ exited with 0 +++ [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5527] <... mprotect resumed>) = 0 [pid 5077] newfstatat(AT_FDCWD, "./44/binderfs", [pid 5076] umount2("./43/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5522, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5078] umount2("./46", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] newfstatat(AT_FDCWD, "./43/binderfs", [pid 5078] openat(AT_FDCWD, "./46", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5527] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5078] <... openat resumed>) = 3 [pid 5077] unlink("./44/binderfs" [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] <... mkdir resumed>) = 0 [pid 5527] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5078] newfstatat(3, "", [pid 5077] <... unlink resumed>) = 0 [pid 5076] unlink("./43/binderfs" [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5527] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5077] getdents64(3, [pid 5076] <... unlink resumed>) = 0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5077] close(3 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5077] <... close resumed>) = 0 [pid 5077] rmdir("./44") = 0 ./strace-static-x86_64: Process 5529 attached ./strace-static-x86_64: Process 5528 attached [pid 5527] <... clone3 resumed> => {parent_tid=[5529]}, 88) = 5529 [pid 5078] getdents64(3, [pid 5076] getdents64(3, [pid 5527] rt_sigprocmask(SIG_SETMASK, [], [pid 5529] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5528] set_robust_list(0x55555d6c46a0, 24 [pid 5527] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5077] mkdir("./45", 0777 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5528 [pid 5528] <... set_robust_list resumed>) = 0 [pid 5527] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] umount2("./46/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] close(3 [pid 5529] <... rseq resumed>) = 0 [pid 5528] chdir("./43" [pid 5527] <... futex resumed>) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5077] <... mkdir resumed>) = 0 [pid 5076] <... close resumed>) = 0 [pid 5529] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5527] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] newfstatat(AT_FDCWD, "./46/binderfs", [pid 5076] rmdir("./43" [pid 5529] <... set_robust_list resumed>) = 0 [pid 5528] <... chdir resumed>) = 0 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5530 attached [pid 5529] rt_sigprocmask(SIG_SETMASK, [], [pid 5528] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5076] <... rmdir resumed>) = 0 [pid 5529] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5528] <... prctl resumed>) = 0 [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5530 [pid 5530] set_robust_list(0x55555d6c46a0, 24 [pid 5529] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5528] setpgid(0, 0 [pid 5078] unlink("./46/binderfs" [pid 5076] mkdir("./44", 0777 [pid 5530] <... set_robust_list resumed>) = 0 [pid 5529] <... bpf resumed>) = 3 [pid 5528] <... setpgid resumed>) = 0 [pid 5078] <... unlink resumed>) = 0 [pid 5076] <... mkdir resumed>) = 0 [pid 5530] chdir("./45" [pid 5529] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5528] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5530] <... chdir resumed>) = 0 [pid 5529] <... futex resumed>) = 1 [pid 5528] <... openat resumed>) = 3 [pid 5527] <... futex resumed>) = 0 [pid 5078] getdents64(3, [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5530] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5529] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5527] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5531 attached [pid 5530] <... prctl resumed>) = 0 [pid 5529] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5528] write(3, "1000", 4 [pid 5527] <... futex resumed>) = 0 [pid 5078] close(3 [pid 5531] set_robust_list(0x55555d6c46a0, 24 [pid 5530] setpgid(0, 0 [pid 5529] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5528] <... write resumed>) = 4 [pid 5527] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... close resumed>) = 0 [pid 5531] <... set_robust_list resumed>) = 0 [pid 5531] chdir("./44" [pid 5530] <... setpgid resumed>) = 0 [pid 5529] <... bpf resumed>) = 4 [pid 5528] close(3 [pid 5078] rmdir("./46" [pid 5531] <... chdir resumed>) = 0 [pid 5530] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5528] <... close resumed>) = 0 [pid 5078] <... rmdir resumed>) = 0 [pid 5530] <... openat resumed>) = 3 [pid 5529] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5528] symlink("/dev/binderfs", "./binderfs" [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5531 [pid 5531] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5530] write(3, "1000", 4 [pid 5529] <... futex resumed>) = 1 [pid 5528] <... symlink resumed>) = 0 [pid 5527] <... futex resumed>) = 0 [pid 5531] setpgid(0, 0 [pid 5530] <... write resumed>) = 4 [pid 5529] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5527] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] mkdir("./47", 0777 [pid 5531] <... setpgid resumed>) = 0 [pid 5530] close(3 [pid 5529] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5528] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5527] <... futex resumed>) = 0 [pid 5078] <... mkdir resumed>) = 0 [pid 5530] <... close resumed>) = 0 [pid 5529] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5527] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5531] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5530] symlink("/dev/binderfs", "./binderfs" [pid 5529] <... bpf resumed>) = 5 [pid 5528] <... futex resumed>) = 0 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5532 attached [pid 5531] write(3, "1000", 4 [pid 5530] <... symlink resumed>) = 0 [pid 5528] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5532] set_robust_list(0x55555d6c46a0, 24 [pid 5530] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5529] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5528] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5531] <... write resumed>) = 4 [pid 5532] <... set_robust_list resumed>) = 0 [pid 5531] close(3 [pid 5530] <... futex resumed>) = 0 [pid 5532] chdir("./47" [pid 5529] <... futex resumed>) = 1 [pid 5528] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5531] <... close resumed>) = 0 [pid 5530] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5529] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5528] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5527] <... futex resumed>) = 0 [pid 5532] <... chdir resumed>) = 0 [pid 5531] symlink("/dev/binderfs", "./binderfs" [pid 5530] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5528] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5527] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5532 [pid 5530] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5528] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5530] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5528] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5531] <... symlink resumed>) = 0 [pid 5532] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5530] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5529] <... futex resumed>) = 0 [pid 5528] <... mprotect resumed>) = 0 [pid 5527] <... futex resumed>) = 1 [pid 5532] <... prctl resumed>) = 0 [pid 5530] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5531] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5529] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5528] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5527] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5532] setpgid(0, 0 [pid 5531] <... futex resumed>) = 0 [pid 5530] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5529] <... bpf resumed>) = 6 [pid 5532] <... setpgid resumed>) = 0 [pid 5531] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5532] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5531] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5530] <... mprotect resumed>) = 0 [pid 5529] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5528] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5530] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5529] <... futex resumed>) = 1 [pid 5528] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5527] <... futex resumed>) = 0 [pid 5531] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5529] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5527] exit_group(0./strace-static-x86_64: Process 5533 attached [pid 5532] <... openat resumed>) = 3 [pid 5531] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5528] <... clone3 resumed> => {parent_tid=[5533]}, 88) = 5533 [pid 5527] <... exit_group resumed>) = ? [pid 5529] <... futex resumed>) = ? [pid 5533] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5532] write(3, "1000", 4 [pid 5531] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5530] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5529] +++ exited with 0 +++ [pid 5528] rt_sigprocmask(SIG_SETMASK, [], [pid 5533] <... rseq resumed>) = 0 [pid 5530] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5528] <... rt_sigprocmask resumed>NULL, 8) = 0 ./strace-static-x86_64: Process 5534 attached [pid 5533] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5532] <... write resumed>) = 4 [pid 5531] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5528] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5534] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5533] <... set_robust_list resumed>) = 0 [pid 5532] close(3 [pid 5531] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5534] <... rseq resumed>) = 0 [pid 5533] rt_sigprocmask(SIG_SETMASK, [], [pid 5532] <... close resumed>) = 0 [pid 5530] <... clone3 resumed> => {parent_tid=[5534]}, 88) = 5534 [pid 5528] <... futex resumed>) = 0 [pid 5531] <... mprotect resumed>) = 0 [pid 5534] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5533] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5532] symlink("/dev/binderfs", "./binderfs" [pid 5530] rt_sigprocmask(SIG_SETMASK, [], [pid 5528] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5534] <... set_robust_list resumed>) = 0 [pid 5533] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5530] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5534] rt_sigprocmask(SIG_SETMASK, [], [pid 5533] <... bpf resumed>) = 3 [pid 5531] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5530] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5527] +++ exited with 0 +++ [pid 5532] <... symlink resumed>) = 0 [pid 5534] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5533] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5531] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5530] <... futex resumed>) = 0 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5527, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5534] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5533] <... futex resumed>) = 1 [pid 5532] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5531] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5530] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5528] <... futex resumed>) = 0 [pid 5075] restart_syscall(<... resuming interrupted clone ...>./strace-static-x86_64: Process 5535 attached [pid 5534] <... bpf resumed>) = 3 [pid 5533] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5532] <... futex resumed>) = 0 [pid 5528] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... restart_syscall resumed>) = 0 [pid 5535] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5534] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5533] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5532] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5531] <... clone3 resumed> => {parent_tid=[5535]}, 88) = 5535 [pid 5528] <... futex resumed>) = 0 [pid 5535] <... rseq resumed>) = 0 [pid 5534] <... futex resumed>) = 1 [pid 5533] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5532] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5531] rt_sigprocmask(SIG_SETMASK, [], [pid 5530] <... futex resumed>) = 0 [pid 5528] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5535] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5534] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5533] <... bpf resumed>) = 4 [pid 5532] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5531] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5530] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5535] <... set_robust_list resumed>) = 0 [pid 5534] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5533] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5532] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5531] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5530] <... futex resumed>) = 0 [pid 5075] umount2("./45", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5535] rt_sigprocmask(SIG_SETMASK, [], [pid 5534] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5533] <... futex resumed>) = 1 [pid 5530] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5531] <... futex resumed>) = 0 [pid 5528] <... futex resumed>) = 0 [pid 5532] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5535] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5534] <... bpf resumed>) = 4 [pid 5533] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5528] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] openat(AT_FDCWD, "./45", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5535] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5533] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5528] <... futex resumed>) = 0 [pid 5075] <... openat resumed>) = 3 [pid 5535] <... bpf resumed>) = 3 [pid 5534] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5533] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5532] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5531] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5528] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5534] <... futex resumed>) = 1 [pid 5532] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5534] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5535] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5533] <... bpf resumed>) = 5 [pid 5532] <... mprotect resumed>) = 0 [pid 5530] <... futex resumed>) = 0 [pid 5075] newfstatat(3, "", [pid 5535] <... futex resumed>) = 1 [pid 5531] <... futex resumed>) = 0 [pid 5535] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5531] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5530] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5534] <... futex resumed>) = 0 [pid 5531] <... futex resumed>) = 1 [pid 5530] <... futex resumed>) = 1 [pid 5535] <... futex resumed>) = 0 [pid 5534] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5532] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5531] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5530] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] getdents64(3, [pid 5535] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5533] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5535] <... bpf resumed>) = 4 [pid 5534] <... bpf resumed>) = 5 [pid 5533] <... futex resumed>) = 1 [pid 5532] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5528] <... futex resumed>) = 0 [pid 5075] umount2("./45/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5535] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5533] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5528] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5535] <... futex resumed>) = 1 [pid 5533] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5528] <... futex resumed>) = 0 [pid 5075] newfstatat(AT_FDCWD, "./45/binderfs", [pid 5535] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5533] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5528] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5533] <... bpf resumed>) = 6 [pid 5532] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5534] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5531] <... futex resumed>) = 0 [pid 5075] unlink("./45/binderfs" [pid 5534] <... futex resumed>) = 1 [pid 5531] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5530] <... futex resumed>) = 0 [pid 5075] <... unlink resumed>) = 0 ./strace-static-x86_64: Process 5536 attached [pid 5535] <... futex resumed>) = 0 [pid 5534] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5533] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5532] <... clone3 resumed> => {parent_tid=[5536]}, 88) = 5536 [pid 5531] <... futex resumed>) = 1 [pid 5530] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5536] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5535] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5534] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5533] <... futex resumed>) = 1 [pid 5532] rt_sigprocmask(SIG_SETMASK, [], [pid 5531] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5530] <... futex resumed>) = 0 [pid 5528] <... futex resumed>) = 0 [pid 5075] getdents64(3, [pid 5536] <... rseq resumed>) = 0 [pid 5535] <... bpf resumed>) = 5 [pid 5534] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5533] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5532] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5530] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5528] exit_group(0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5536] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5532] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5528] <... exit_group resumed>) = ? [pid 5536] <... set_robust_list resumed>) = 0 [pid 5535] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5534] <... bpf resumed>) = 6 [pid 5533] <... futex resumed>) = ? [pid 5532] <... futex resumed>) = 0 [pid 5075] close(3 [pid 5536] rt_sigprocmask(SIG_SETMASK, [], [pid 5535] <... futex resumed>) = 1 [pid 5534] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5531] <... futex resumed>) = 0 [pid 5075] <... close resumed>) = 0 [pid 5536] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5535] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5534] <... futex resumed>) = 1 [pid 5532] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5531] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5530] <... futex resumed>) = 0 [pid 5075] rmdir("./45" [pid 5536] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5534] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5531] <... futex resumed>) = 0 [pid 5530] exit_group(0 [pid 5075] <... rmdir resumed>) = 0 [pid 5536] <... bpf resumed>) = 3 [pid 5534] <... futex resumed>) = ? [pid 5531] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5530] <... exit_group resumed>) = ? [pid 5534] +++ exited with 0 +++ [pid 5536] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] mkdir("./46", 0777 [pid 5536] <... futex resumed>) = 1 [pid 5532] <... futex resumed>) = 0 [pid 5075] <... mkdir resumed>) = 0 [pid 5536] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5532] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5536] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5535] <... bpf resumed>) = 6 [pid 5533] +++ exited with 0 +++ [pid 5532] <... futex resumed>) = 0 [pid 5528] +++ exited with 0 +++ [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5532] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5536] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5535] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5537 attached [pid 5536] <... bpf resumed>) = 4 [pid 5535] <... futex resumed>) = 1 [pid 5531] <... futex resumed>) = 0 [pid 5537] set_robust_list(0x55555d6c46a0, 24 [pid 5536] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5535] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5528, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5537] <... set_robust_list resumed>) = 0 [pid 5536] <... futex resumed>) = 1 [pid 5532] <... futex resumed>) = 0 [pid 5531] exit_group(0 [pid 5074] umount2("./43", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5537] chdir("./46" [pid 5536] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5535] <... futex resumed>) = ? [pid 5532] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5531] <... exit_group resumed>) = ? [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5537] <... chdir resumed>) = 0 [pid 5536] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5532] <... futex resumed>) = 0 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5537 [pid 5074] openat(AT_FDCWD, "./43", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5537] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5536] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5532] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] <... openat resumed>) = 3 [pid 5537] <... prctl resumed>) = 0 [pid 5536] <... bpf resumed>) = 5 [pid 5074] newfstatat(3, "", [pid 5537] setpgid(0, 0) = 0 [pid 5537] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5537] <... openat resumed>) = 3 [pid 5074] getdents64(3, [pid 5537] write(3, "1000", 4 [pid 5536] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5537] <... write resumed>) = 4 [pid 5536] <... futex resumed>) = 1 [pid 5532] <... futex resumed>) = 0 [pid 5537] close(3 [pid 5536] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5532] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] umount2("./43/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5537] <... close resumed>) = 0 [pid 5536] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5532] <... futex resumed>) = 0 [pid 5537] symlink("/dev/binderfs", "./binderfs" [pid 5536] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5532] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5537] <... symlink resumed>) = 0 [pid 5535] +++ exited with 0 +++ [pid 5531] +++ exited with 0 +++ [pid 5530] +++ exited with 0 +++ [pid 5537] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5531, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5074] newfstatat(AT_FDCWD, "./43/binderfs", [pid 5537] <... futex resumed>) = 0 [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5530, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5537] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5077] umount2("./45", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] unlink("./43/binderfs" [pid 5537] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] <... unlink resumed>) = 0 [pid 5537] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5077] openat(AT_FDCWD, "./45", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5076] umount2("./44", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5537] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] <... openat resumed>) = 3 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] getdents64(3, [pid 5537] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5077] newfstatat(3, "", [pid 5076] openat(AT_FDCWD, "./44", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5537] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5076] <... openat resumed>) = 3 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5537] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5077] getdents64(3, [pid 5076] newfstatat(3, "", [pid 5537] <... mprotect resumed>) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5074] close(3 [pid 5537] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5076] getdents64(3, [pid 5537] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5077] umount2("./45/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5537] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5538 attached [pid 5077] newfstatat(AT_FDCWD, "./45/binderfs", [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5074] <... close resumed>) = 0 [pid 5538] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5537] <... clone3 resumed> => {parent_tid=[5538]}, 88) = 5538 [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] rmdir("./43" [pid 5538] <... rseq resumed>) = 0 [pid 5537] rt_sigprocmask(SIG_SETMASK, [], [pid 5077] unlink("./45/binderfs" [pid 5076] umount2("./44/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5538] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5537] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5538] <... set_robust_list resumed>) = 0 [pid 5537] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... unlink resumed>) = 0 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] <... rmdir resumed>) = 0 [pid 5538] rt_sigprocmask(SIG_SETMASK, [], [pid 5537] <... futex resumed>) = 0 [pid 5077] getdents64(3, [pid 5076] newfstatat(AT_FDCWD, "./44/binderfs", [pid 5538] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5537] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] mkdir("./44", 0777 [pid 5077] close(3 [pid 5076] unlink("./44/binderfs" [pid 5538] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5077] <... close resumed>) = 0 [pid 5076] <... unlink resumed>) = 0 [pid 5074] <... mkdir resumed>) = 0 [pid 5538] <... bpf resumed>) = 3 [pid 5077] rmdir("./45" [pid 5076] getdents64(3, [pid 5538] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5537] <... futex resumed>) = 0 [pid 5536] <... bpf resumed>) = 6 [pid 5077] <... rmdir resumed>) = 0 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5539 attached [pid 5538] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5537] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5536] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] mkdir("./46", 0777 [pid 5076] close(3 [pid 5538] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5537] <... futex resumed>) = 0 [pid 5536] <... futex resumed>) = 1 [pid 5532] <... futex resumed>) = 0 [pid 5076] <... close resumed>) = 0 [pid 5536] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5077] <... mkdir resumed>) = 0 [pid 5539] set_robust_list(0x55555d6c46a0, 24 [pid 5538] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5537] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5532] exit_group(0 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5076] rmdir("./44" [pid 5539] <... set_robust_list resumed>) = 0 [pid 5536] <... futex resumed>) = ? [pid 5532] <... exit_group resumed>) = ? [pid 5076] <... rmdir resumed>) = 0 [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5539 ./strace-static-x86_64: Process 5540 attached [pid 5539] chdir("./44" [pid 5538] <... bpf resumed>) = 4 [pid 5536] +++ exited with 0 +++ [pid 5540] set_robust_list(0x55555d6c46a0, 24) = 0 [pid 5540] chdir("./46" [pid 5539] <... chdir resumed>) = 0 [pid 5538] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] mkdir("./45", 0777 [pid 5539] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5538] <... futex resumed>) = 1 [pid 5540] <... chdir resumed>) = 0 [pid 5537] <... futex resumed>) = 0 [pid 5539] <... prctl resumed>) = 0 [pid 5538] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5537] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5532] +++ exited with 0 +++ [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5540 [pid 5540] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5539] setpgid(0, 0 [pid 5538] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5537] <... futex resumed>) = 0 [pid 5076] <... mkdir resumed>) = 0 [pid 5540] <... prctl resumed>) = 0 [pid 5539] <... setpgid resumed>) = 0 [pid 5538] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5537] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5532, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5540] setpgid(0, 0 [pid 5539] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5078] restart_syscall(<... resuming interrupted clone ...>./strace-static-x86_64: Process 5541 attached [pid 5540] <... setpgid resumed>) = 0 [pid 5539] <... openat resumed>) = 3 [pid 5538] <... bpf resumed>) = 5 [pid 5078] <... restart_syscall resumed>) = 0 [pid 5541] set_robust_list(0x55555d6c46a0, 24 [pid 5540] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5539] write(3, "1000", 4 [pid 5538] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5541] <... set_robust_list resumed>) = 0 [pid 5539] <... write resumed>) = 4 [pid 5541] chdir("./45" [pid 5540] <... openat resumed>) = 3 [pid 5539] close(3 [pid 5538] <... futex resumed>) = 1 [pid 5537] <... futex resumed>) = 0 [pid 5541] <... chdir resumed>) = 0 [pid 5540] write(3, "1000", 4 [pid 5539] <... close resumed>) = 0 [pid 5538] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5537] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] umount2("./47", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5541 [pid 5541] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5540] <... write resumed>) = 4 [pid 5539] symlink("/dev/binderfs", "./binderfs" [pid 5538] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5537] <... futex resumed>) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5541] <... prctl resumed>) = 0 [pid 5540] close(3 [pid 5538] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5537] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] openat(AT_FDCWD, "./47", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5541] setpgid(0, 0 [pid 5540] <... close resumed>) = 0 [pid 5539] <... symlink resumed>) = 0 [pid 5078] <... openat resumed>) = 3 [pid 5541] <... setpgid resumed>) = 0 [pid 5540] symlink("/dev/binderfs", "./binderfs" [pid 5539] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5078] newfstatat(3, "", [pid 5539] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5541] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5540] <... symlink resumed>) = 0 [pid 5538] <... bpf resumed>) = 6 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5539] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5541] <... openat resumed>) = 3 [pid 5540] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5539] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5538] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] getdents64(3, [pid 5541] write(3, "1000", 4 [pid 5540] <... futex resumed>) = 0 [pid 5539] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5538] <... futex resumed>) = 1 [pid 5537] <... futex resumed>) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5541] <... write resumed>) = 4 [pid 5540] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5539] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5538] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5537] exit_group(0 [pid 5078] umount2("./47/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5541] close(3 [pid 5540] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5539] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5538] <... futex resumed>) = ? [pid 5537] <... exit_group resumed>) = ? [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5541] <... close resumed>) = 0 [pid 5541] symlink("/dev/binderfs", "./binderfs" [pid 5540] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5540] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f3e2f5ed000 [pid 5540] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5538] +++ exited with 0 +++ [pid 5537] +++ exited with 0 +++ [pid 5539] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5078] newfstatat(AT_FDCWD, "./47/binderfs", [pid 5539] <... mprotect resumed>) = 0 [pid 5540] <... mprotect resumed>) = 0 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5537, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5541] <... symlink resumed>) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5541] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5540] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5539] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5078] unlink("./47/binderfs" [pid 5075] restart_syscall(<... resuming interrupted clone ...> [pid 5541] <... futex resumed>) = 0 [pid 5539] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5078] <... unlink resumed>) = 0 [pid 5075] <... restart_syscall resumed>) = 0 [pid 5541] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5539] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5078] getdents64(3, [pid 5541] <... rt_sigaction resumed>NULL, 8) = 0 ./strace-static-x86_64: Process 5542 attached [pid 5541] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5540] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5542] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5541] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5540] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5539] <... clone3 resumed> => {parent_tid=[5542]}, 88) = 5542 [pid 5078] close(3./strace-static-x86_64: Process 5543 attached [pid 5542] <... rseq resumed>) = 0 [pid 5541] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5539] rt_sigprocmask(SIG_SETMASK, [], [pid 5078] <... close resumed>) = 0 [pid 5543] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5542] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5541] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5539] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] rmdir("./47" [pid 5543] <... rseq resumed>) = 0 [pid 5542] <... set_robust_list resumed>) = 0 [pid 5541] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5539] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5543] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5540] <... clone3 resumed> => {parent_tid=[5543]}, 88) = 5543 [pid 5078] <... rmdir resumed>) = 0 [pid 5075] umount2("./46", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5543] <... set_robust_list resumed>) = 0 [pid 5542] rt_sigprocmask(SIG_SETMASK, [], [pid 5541] <... mprotect resumed>) = 0 [pid 5540] rt_sigprocmask(SIG_SETMASK, [], [pid 5539] <... futex resumed>) = 0 [pid 5078] mkdir("./48", 0777 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5543] rt_sigprocmask(SIG_SETMASK, [], [pid 5542] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5541] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5540] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5539] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] openat(AT_FDCWD, "./46", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5543] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5542] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5541] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5540] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... mkdir resumed>) = 0 [pid 5075] <... openat resumed>) = 3 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5543] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5540] <... futex resumed>) = 0 [pid 5075] newfstatat(3, "", ./strace-static-x86_64: Process 5544 attached [pid 5543] <... bpf resumed>) = 3 [pid 5542] <... bpf resumed>) = 3 [pid 5541] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5540] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 ./strace-static-x86_64: Process 5545 attached [pid 5544] set_robust_list(0x55555d6c46a0, 24 [pid 5543] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5542] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5540] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5544 [pid 5075] getdents64(3, [pid 5545] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5544] <... set_robust_list resumed>) = 0 [pid 5543] <... futex resumed>) = 0 [pid 5542] <... futex resumed>) = 1 [pid 5541] <... clone3 resumed> => {parent_tid=[5545]}, 88) = 5545 [pid 5539] <... futex resumed>) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5545] <... rseq resumed>) = 0 [pid 5544] chdir("./48" [pid 5543] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5542] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5545] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5544] <... chdir resumed>) = 0 [pid 5545] <... set_robust_list resumed>) = 0 [pid 5544] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5540] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5545] rt_sigprocmask(SIG_SETMASK, [], [pid 5544] <... prctl resumed>) = 0 [pid 5543] <... futex resumed>) = 0 [pid 5540] <... futex resumed>) = 1 [pid 5545] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5543] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5545] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5544] setpgid(0, 0 [pid 5540] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5544] <... setpgid resumed>) = 0 [pid 5543] <... bpf resumed>) = 4 [pid 5541] rt_sigprocmask(SIG_SETMASK, [], [pid 5539] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] umount2("./46/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5544] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5543] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5541] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5539] <... futex resumed>) = 1 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5544] <... openat resumed>) = 3 [pid 5543] <... futex resumed>) = 1 [pid 5542] <... futex resumed>) = 0 [pid 5541] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5540] <... futex resumed>) = 0 [pid 5539] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] newfstatat(AT_FDCWD, "./46/binderfs", [pid 5545] <... futex resumed>) = 0 [pid 5544] write(3, "1000", 4 [pid 5543] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5542] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5541] <... futex resumed>) = 1 [pid 5540] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5545] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5544] <... write resumed>) = 4 [pid 5543] <... bpf resumed>) = 5 [pid 5542] <... bpf resumed>) = 4 [pid 5541] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5540] <... futex resumed>) = 0 [pid 5075] unlink("./46/binderfs" [pid 5542] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... unlink resumed>) = 0 [pid 5542] <... futex resumed>) = 1 [pid 5539] <... futex resumed>) = 0 [pid 5075] getdents64(3, [pid 5542] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5539] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5542] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5539] <... futex resumed>) = 0 [pid 5542] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5539] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] close(3 [pid 5545] <... bpf resumed>) = 3 [pid 5544] close(3 [pid 5543] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5540] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5545] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5544] <... close resumed>) = 0 [pid 5543] <... futex resumed>) = 0 [pid 5542] <... bpf resumed>) = 5 [pid 5540] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5075] <... close resumed>) = 0 [pid 5545] <... futex resumed>) = 1 [pid 5544] symlink("/dev/binderfs", "./binderfs" [pid 5543] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5541] <... futex resumed>) = 0 [pid 5540] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5545] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5543] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5540] <... futex resumed>) = 0 [pid 5543] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5540] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5543] <... bpf resumed>) = 6 [pid 5541] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] rmdir("./46" [pid 5545] <... futex resumed>) = 0 [pid 5544] <... symlink resumed>) = 0 [pid 5543] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5541] <... futex resumed>) = 1 [pid 5075] <... rmdir resumed>) = 0 [pid 5545] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5543] <... futex resumed>) = 1 [pid 5541] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5540] <... futex resumed>) = 0 [pid 5075] mkdir("./47", 0777 [pid 5545] <... bpf resumed>) = 4 [pid 5544] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5543] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5542] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5540] exit_group(0 [pid 5075] <... mkdir resumed>) = 0 [pid 5545] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5542] <... futex resumed>) = 1 [pid 5539] <... futex resumed>) = 0 [pid 5545] <... futex resumed>) = 1 [pid 5543] <... futex resumed>) = ? [pid 5541] <... futex resumed>) = 0 [pid 5544] <... futex resumed>) = 0 [pid 5540] <... exit_group resumed>) = ? [pid 5539] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5545] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5544] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5543] +++ exited with 0 +++ [pid 5542] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5541] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5539] <... futex resumed>) = 0 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5545] <... bpf resumed>) = 5 [pid 5544] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5541] <... futex resumed>) = 0 [pid 5540] +++ exited with 0 +++ [pid 5539] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5544] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5540, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5544] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5541] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5544] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5545] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5544] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5544] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5077] umount2("./46", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5545] <... futex resumed>) = 1 [pid 5544] <... mprotect resumed>) = 0 [pid 5541] <... futex resumed>) = 0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5546 attached [pid 5545] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5541] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] openat(AT_FDCWD, "./46", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5545] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5541] <... futex resumed>) = 0 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5546 [pid 5546] set_robust_list(0x55555d6c46a0, 24 [pid 5545] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5541] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] <... openat resumed>) = 3 [pid 5546] <... set_robust_list resumed>) = 0 [pid 5545] <... bpf resumed>) = 6 [pid 5544] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5542] <... bpf resumed>) = 6 [pid 5077] newfstatat(3, "", [pid 5546] chdir("./47" [pid 5544] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5542] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5546] <... chdir resumed>) = 0 [pid 5545] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5544] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5542] <... futex resumed>) = 1 [pid 5539] <... futex resumed>) = 0 [pid 5077] getdents64(3, [pid 5546] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5545] <... futex resumed>) = 1 [pid 5542] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5541] <... futex resumed>) = 0 [pid 5546] <... prctl resumed>) = 0 [pid 5545] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5541] exit_group(0 [pid 5546] setpgid(0, 0 [pid 5545] <... futex resumed>) = ? [pid 5541] <... exit_group resumed>) = ? ./strace-static-x86_64: Process 5547 attached [pid 5546] <... setpgid resumed>) = 0 [pid 5545] +++ exited with 0 +++ [pid 5541] +++ exited with 0 +++ [pid 5539] exit_group(0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5546] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5547] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053) = 0 [pid 5544] <... clone3 resumed> => {parent_tid=[5547]}, 88) = 5547 [pid 5547] set_robust_list(0x7f3e2f60d9a0, 24) = 0 [pid 5546] <... openat resumed>) = 3 [pid 5544] rt_sigprocmask(SIG_SETMASK, [], [pid 5542] <... futex resumed>) = ? [pid 5539] <... exit_group resumed>) = ? [pid 5077] umount2("./46/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5541, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5547] rt_sigprocmask(SIG_SETMASK, [], [pid 5546] write(3, "1000", 4 [pid 5544] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5542] +++ exited with 0 +++ [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5547] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5546] <... write resumed>) = 4 [pid 5544] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] umount2("./45", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5077] newfstatat(AT_FDCWD, "./46/binderfs", [pid 5547] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5546] close(3 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5546] <... close resumed>) = 0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5546] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5547] <... bpf resumed>) = 3 [pid 5544] <... futex resumed>) = 0 [pid 5539] +++ exited with 0 +++ [pid 5077] unlink("./46/binderfs" [pid 5076] openat(AT_FDCWD, "./45", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5547] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5546] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5544] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... unlink resumed>) = 0 [pid 5546] <... futex resumed>) = 0 [pid 5544] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5546] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5544] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5546] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5544] <... futex resumed>) = 0 [pid 5546] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5544] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5546] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5546] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f3e2f5ed000 [pid 5546] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5547] <... futex resumed>) = 1 [pid 5546] <... mprotect resumed>) = 0 [pid 5544] <... futex resumed>) = 0 [pid 5077] getdents64(3, [pid 5076] <... openat resumed>) = 3 [pid 5547] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5546] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5544] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=37000000} [pid 5076] newfstatat(3, "", [pid 5547] <... bpf resumed>) = 4 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5539, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5077] close(3 [pid 5547] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5546] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5077] <... close resumed>) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5074] umount2("./44", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5547] <... futex resumed>) = 1 [pid 5546] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5544] <... futex resumed>) = 0 [pid 5076] getdents64(3, [pid 5547] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5544] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5547] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5547] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5546] <... clone3 resumed> => {parent_tid=[5548]}, 88) = 5548 [pid 5544] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5548 attached [pid 5077] rmdir("./46" [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5548] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5074] openat(AT_FDCWD, "./44", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5548] <... rseq resumed>) = 0 [pid 5548] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5547] <... bpf resumed>) = 5 [pid 5546] rt_sigprocmask(SIG_SETMASK, [], [pid 5544] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... rmdir resumed>) = 0 [pid 5076] umount2("./45/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... openat resumed>) = 3 [pid 5548] <... set_robust_list resumed>) = 0 [pid 5547] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5546] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] mkdir("./47", 0777 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] newfstatat(3, "", [pid 5548] rt_sigprocmask(SIG_SETMASK, [], [pid 5547] <... futex resumed>) = 1 [pid 5546] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5544] <... futex resumed>) = 0 [pid 5076] newfstatat(AT_FDCWD, "./45/binderfs", [pid 5548] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5547] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5546] <... futex resumed>) = 0 [pid 5544] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5548] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5547] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5546] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5544] <... futex resumed>) = 0 [pid 5076] unlink("./45/binderfs" [pid 5548] <... bpf resumed>) = 3 [pid 5547] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5544] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] <... mkdir resumed>) = 0 [pid 5076] <... unlink resumed>) = 0 [pid 5074] getdents64(3, [pid 5548] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5547] <... bpf resumed>) = 6 [pid 5548] <... futex resumed>) = 1 [pid 5546] <... futex resumed>) = 0 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5548] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5547] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5546] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] getdents64(3, [pid 5548] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5547] <... futex resumed>) = 1 [pid 5546] <... futex resumed>) = 0 [pid 5544] <... futex resumed>) = 0 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5547] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5546] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5544] exit_group(0 [pid 5076] close(3 [pid 5548] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5547] <... futex resumed>) = ? [pid 5544] <... exit_group resumed>) = ? [pid 5076] <... close resumed>) = 0 ./strace-static-x86_64: Process 5549 attached [pid 5548] <... bpf resumed>) = 4 [pid 5547] +++ exited with 0 +++ [pid 5544] +++ exited with 0 +++ [pid 5074] umount2("./44/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5549] set_robust_list(0x55555d6c46a0, 24 [pid 5548] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5549 [pid 5076] rmdir("./45" [pid 5549] <... set_robust_list resumed>) = 0 [pid 5548] <... futex resumed>) = 1 [pid 5546] <... futex resumed>) = 0 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5544, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5076] <... rmdir resumed>) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5549] chdir("./47" [pid 5548] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5546] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] umount2("./48", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] newfstatat(AT_FDCWD, "./44/binderfs", [pid 5549] <... chdir resumed>) = 0 [pid 5546] <... futex resumed>) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] mkdir("./46", 0777 [pid 5549] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5546] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] openat(AT_FDCWD, "./48", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5549] <... prctl resumed>) = 0 [pid 5548] <... bpf resumed>) = 5 [pid 5078] <... openat resumed>) = 3 [pid 5076] <... mkdir resumed>) = 0 [pid 5074] unlink("./44/binderfs" [pid 5549] setpgid(0, 0 [pid 5078] newfstatat(3, "", [pid 5549] <... setpgid resumed>) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5549] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5078] getdents64(3, [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] <... unlink resumed>) = 0 [pid 5549] <... openat resumed>) = 3 [pid 5548] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5074] getdents64(3, [pid 5549] write(3, "1000", 4 [pid 5548] <... futex resumed>) = 1 [pid 5546] <... futex resumed>) = 0 [pid 5549] <... write resumed>) = 4 [pid 5548] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5546] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] umount2("./48/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 ./strace-static-x86_64: Process 5550 attached [pid 5549] close(3 [pid 5548] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5546] <... futex resumed>) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] close(3 [pid 5550] set_robust_list(0x55555d6c46a0, 24 [pid 5549] <... close resumed>) = 0 [pid 5548] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5546] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] newfstatat(AT_FDCWD, "./48/binderfs", [pid 5550] <... set_robust_list resumed>) = 0 [pid 5549] symlink("/dev/binderfs", "./binderfs" [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5550 [pid 5074] <... close resumed>) = 0 [pid 5550] chdir("./46" [pid 5549] <... symlink resumed>) = 0 [pid 5078] unlink("./48/binderfs" [pid 5074] rmdir("./44" [pid 5550] <... chdir resumed>) = 0 [pid 5548] <... bpf resumed>) = 6 [pid 5078] <... unlink resumed>) = 0 [pid 5550] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5549] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] getdents64(3, [pid 5549] <... futex resumed>) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5074] <... rmdir resumed>) = 0 [pid 5549] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5078] close(3 [pid 5550] setpgid(0, 0 [pid 5549] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5548] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... close resumed>) = 0 [pid 5074] mkdir("./45", 0777 [pid 5550] <... setpgid resumed>) = 0 [pid 5549] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5548] <... futex resumed>) = 1 [pid 5546] <... futex resumed>) = 0 [pid 5078] rmdir("./48" [pid 5550] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5549] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5548] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5546] exit_group(0 [pid 5078] <... rmdir resumed>) = 0 [pid 5074] <... mkdir resumed>) = 0 [pid 5549] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5548] <... futex resumed>) = ? [pid 5546] <... exit_group resumed>) = ? [pid 5550] <... openat resumed>) = 3 [pid 5549] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5549] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5078] mkdir("./49", 0777 [pid 5549] <... mprotect resumed>) = 0 [pid 5078] <... mkdir resumed>) = 0 [pid 5549] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5550] write(3, "1000", 4 [pid 5549] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5548] +++ exited with 0 +++ [pid 5546] +++ exited with 0 +++ [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5551 attached [pid 5550] <... write resumed>) = 4 [pid 5550] close(3) = 0 [pid 5549] <... clone3 resumed> => {parent_tid=[5552]}, 88) = 5552 ./strace-static-x86_64: Process 5552 attached [pid 5551] set_robust_list(0x55555d6c46a0, 24 [pid 5550] symlink("/dev/binderfs", "./binderfs" [pid 5549] rt_sigprocmask(SIG_SETMASK, [], [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5546, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5552] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5551] <... set_robust_list resumed>) = 0 [pid 5550] <... symlink resumed>) = 0 [pid 5549] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5551 [pid 5552] <... rseq resumed>) = 0 [pid 5551] chdir("./49" [pid 5550] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5549] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5553 attached [pid 5552] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5551] <... chdir resumed>) = 0 [pid 5550] <... futex resumed>) = 0 [pid 5549] <... futex resumed>) = 0 [pid 5075] umount2("./47", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5553] set_robust_list(0x55555d6c46a0, 24 [pid 5552] <... set_robust_list resumed>) = 0 [pid 5550] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5549] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5551] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5553 [pid 5550] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5553] <... set_robust_list resumed>) = 0 [pid 5552] rt_sigprocmask(SIG_SETMASK, [], [pid 5551] <... prctl resumed>) = 0 [pid 5550] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5075] openat(AT_FDCWD, "./47", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5553] chdir("./45" [pid 5552] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5551] setpgid(0, 0 [pid 5550] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5553] <... chdir resumed>) = 0 [pid 5552] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5551] <... setpgid resumed>) = 0 [pid 5550] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5075] <... openat resumed>) = 3 [pid 5553] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5552] <... bpf resumed>) = 3 [pid 5553] <... prctl resumed>) = 0 [pid 5552] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5553] setpgid(0, 0 [pid 5552] <... futex resumed>) = 1 [pid 5550] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5549] <... futex resumed>) = 0 [pid 5075] newfstatat(3, "", [pid 5553] <... setpgid resumed>) = 0 [pid 5552] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5551] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5549] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5553] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5552] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5550] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5549] <... futex resumed>) = 0 [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5553] <... openat resumed>) = 3 [pid 5552] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5551] <... openat resumed>) = 3 [pid 5550] <... mprotect resumed>) = 0 [pid 5549] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5553] write(3, "1000", 4 [pid 5552] <... bpf resumed>) = 4 [pid 5075] getdents64(3, [pid 5553] <... write resumed>) = 4 [pid 5553] close(3) = 0 [pid 5552] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5553] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5552] <... futex resumed>) = 1 [pid 5549] <... futex resumed>) = 0 [pid 5549] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5550] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5553] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5552] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5551] write(3, "1000", 4 [pid 5549] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5550] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5551] <... write resumed>) = 4 [pid 5550] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5551] close(3 [pid 5075] umount2("./47/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5554 attached [pid 5553] <... futex resumed>) = 0 [pid 5552] <... bpf resumed>) = 5 [pid 5551] <... close resumed>) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5554] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5553] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5551] symlink("/dev/binderfs", "./binderfs" [pid 5550] <... clone3 resumed> => {parent_tid=[5554]}, 88) = 5554 [pid 5075] newfstatat(AT_FDCWD, "./47/binderfs", [pid 5554] <... rseq resumed>) = 0 [pid 5553] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5554] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5553] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5552] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5554] <... set_robust_list resumed>) = 0 [pid 5553] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5552] <... futex resumed>) = 1 [pid 5551] <... symlink resumed>) = 0 [pid 5550] rt_sigprocmask(SIG_SETMASK, [], [pid 5549] <... futex resumed>) = 0 [pid 5075] unlink("./47/binderfs" [pid 5554] rt_sigprocmask(SIG_SETMASK, [], [pid 5553] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5552] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5551] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5550] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5549] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5554] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5553] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5552] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5551] <... futex resumed>) = 0 [pid 5550] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5549] <... futex resumed>) = 0 [pid 5075] <... unlink resumed>) = 0 [pid 5554] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5553] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5552] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5551] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5550] <... futex resumed>) = 0 [pid 5549] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5554] <... bpf resumed>) = 3 [pid 5553] <... mprotect resumed>) = 0 [pid 5552] <... bpf resumed>) = 6 [pid 5551] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5550] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] getdents64(3, [pid 5554] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5552] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5551] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5550] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5554] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5553] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5552] <... futex resumed>) = 1 [pid 5551] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5550] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5549] <... futex resumed>) = 0 [pid 5075] close(3 [pid 5554] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5553] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5552] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5549] exit_group(0 [pid 5554] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5553] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5552] <... futex resumed>) = ? [pid 5551] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5549] <... exit_group resumed>) = ? [pid 5075] <... close resumed>) = 0 ./strace-static-x86_64: Process 5555 attached [pid 5554] <... bpf resumed>) = 4 [pid 5552] +++ exited with 0 +++ [pid 5551] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5550] <... futex resumed>) = 0 [pid 5549] +++ exited with 0 +++ [pid 5075] rmdir("./47" [pid 5555] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5549, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5554] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5553] <... clone3 resumed> => {parent_tid=[5555]}, 88) = 5555 [pid 5555] <... rseq resumed>) = 0 [pid 5554] <... futex resumed>) = 0 [pid 5553] rt_sigprocmask(SIG_SETMASK, [], [pid 5551] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5550] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5554] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5553] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5555] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5553] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5550] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5553] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5555] <... set_robust_list resumed>) = 0 [pid 5075] <... rmdir resumed>) = 0 [pid 5551] <... mprotect resumed>) = 0 [pid 5550] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5555] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5550] <... futex resumed>) = 1 [pid 5077] umount2("./47", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5554] <... futex resumed>) = 0 [pid 5550] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] mkdir("./48", 0777 [pid 5555] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5554] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5551] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] <... mkdir resumed>) = 0 [pid 5555] <... bpf resumed>) = 3 [pid 5554] <... bpf resumed>) = 5 [pid 5077] openat(AT_FDCWD, "./47", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5555] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5551] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5077] <... openat resumed>) = 3 [pid 5555] <... futex resumed>) = 1 [pid 5554] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5551] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5077] newfstatat(3, "", ./strace-static-x86_64: Process 5556 attached [pid 5555] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5554] <... futex resumed>) = 1 [pid 5553] <... futex resumed>) = 0 [pid 5550] <... futex resumed>) = 0 [pid 5554] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5553] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5550] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5553] <... futex resumed>) = 0 [pid 5550] <... futex resumed>) = 0 [pid 5554] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5553] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5550] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5554] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16) = 6 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5556 [pid 5554] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5550] <... futex resumed>) = 0 [pid 5554] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5550] exit_group(0 [pid 5554] <... futex resumed>) = ? [pid 5550] <... exit_group resumed>) = ? [pid 5556] set_robust_list(0x55555d6c46a0, 24 [pid 5555] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5554] +++ exited with 0 +++ [pid 5550] +++ exited with 0 +++ [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 ./strace-static-x86_64: Process 5557 attached [pid 5557] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053) = 0 [pid 5551] <... clone3 resumed> => {parent_tid=[5557]}, 88) = 5557 [pid 5557] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5556] <... set_robust_list resumed>) = 0 [pid 5555] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5551] rt_sigprocmask(SIG_SETMASK, [], [pid 5557] <... set_robust_list resumed>) = 0 [pid 5556] chdir("./48" [pid 5551] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] getdents64(3, [pid 5557] rt_sigprocmask(SIG_SETMASK, [], [pid 5556] <... chdir resumed>) = 0 [pid 5555] <... bpf resumed>) = 4 [pid 5551] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5557] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5556] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5551] <... futex resumed>) = 0 [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5550, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5557] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5556] <... prctl resumed>) = 0 [pid 5555] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5551] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] umount2("./47/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] umount2("./46", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5557] <... bpf resumed>) = 3 [pid 5556] setpgid(0, 0 [pid 5555] <... futex resumed>) = 1 [pid 5553] <... futex resumed>) = 0 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5557] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5553] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5557] <... futex resumed>) = 1 [pid 5556] <... setpgid resumed>) = 0 [pid 5555] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5553] <... futex resumed>) = 0 [pid 5551] <... futex resumed>) = 0 [pid 5077] newfstatat(AT_FDCWD, "./47/binderfs", [pid 5076] openat(AT_FDCWD, "./46", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5557] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5556] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5553] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5551] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5557] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5551] <... futex resumed>) = 0 [pid 5076] <... openat resumed>) = 3 [pid 5557] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5551] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5557] <... bpf resumed>) = 4 [pid 5076] newfstatat(3, "", [pid 5557] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5555] <... bpf resumed>) = 5 [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5557] <... futex resumed>) = 1 [pid 5551] <... futex resumed>) = 0 [pid 5556] <... openat resumed>) = 3 [pid 5557] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5551] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] getdents64(3, [pid 5557] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5551] <... futex resumed>) = 0 [pid 5557] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5551] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5557] <... bpf resumed>) = 5 [pid 5556] write(3, "1000", 4 [pid 5555] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] unlink("./47/binderfs" [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5556] <... write resumed>) = 4 [pid 5077] <... unlink resumed>) = 0 [pid 5556] close(3 [pid 5557] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5555] <... futex resumed>) = 1 [pid 5553] <... futex resumed>) = 0 [pid 5077] getdents64(3, [pid 5556] <... close resumed>) = 0 [pid 5076] umount2("./46/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5557] <... futex resumed>) = 1 [pid 5556] symlink("/dev/binderfs", "./binderfs" [pid 5553] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5551] <... futex resumed>) = 0 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5557] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5555] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5553] <... futex resumed>) = 0 [pid 5556] <... symlink resumed>) = 0 [pid 5551] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5076] newfstatat(AT_FDCWD, "./46/binderfs", [pid 5557] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5555] <... bpf resumed>) = 6 [pid 5553] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5551] <... futex resumed>) = 0 [pid 5557] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5557] <... bpf resumed>) = 6 [pid 5551] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] close(3 [pid 5076] unlink("./46/binderfs" [pid 5556] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5555] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... close resumed>) = 0 [pid 5557] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5556] <... futex resumed>) = 0 [pid 5555] <... futex resumed>) = 1 [pid 5553] <... futex resumed>) = 0 [pid 5077] rmdir("./47" [pid 5076] <... unlink resumed>) = 0 [pid 5557] <... futex resumed>) = 1 [pid 5556] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5555] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5553] exit_group(0 [pid 5551] <... futex resumed>) = 0 [pid 5557] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5553] <... exit_group resumed>) = ? [pid 5551] exit_group(0 [pid 5557] <... futex resumed>) = ? [pid 5556] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5555] <... futex resumed>) = ? [pid 5551] <... exit_group resumed>) = ? [pid 5077] <... rmdir resumed>) = 0 [pid 5557] +++ exited with 0 +++ [pid 5556] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5551] +++ exited with 0 +++ [pid 5076] getdents64(3, [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5551, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5078] restart_syscall(<... resuming interrupted clone ...> [pid 5556] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5556] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5077] mkdir("./48", 0777 [pid 5556] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5555] +++ exited with 0 +++ [pid 5553] +++ exited with 0 +++ [pid 5078] <... restart_syscall resumed>) = 0 [pid 5076] close(3 [pid 5078] umount2("./49", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5556] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5077] <... mkdir resumed>) = 0 [pid 5076] <... close resumed>) = 0 [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5553, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5078] openat(AT_FDCWD, "./49", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5078] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5556] <... mprotect resumed>) = 0 [pid 5076] rmdir("./46" [pid 5078] getdents64(3, 0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5078] umount2("./49/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5556] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5076] <... rmdir resumed>) = 0 [pid 5556] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5076] mkdir("./47", 0777 [pid 5556] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0}./strace-static-x86_64: Process 5559 attached ./strace-static-x86_64: Process 5558 attached [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] <... mkdir resumed>) = 0 [pid 5074] umount2("./45", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5078] newfstatat(AT_FDCWD, "./49/binderfs", [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] openat(AT_FDCWD, "./45", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5078] unlink("./49/binderfs" [pid 5074] newfstatat(3, "", [pid 5559] set_robust_list(0x55555d6c46a0, 24 [pid 5558] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5556] <... clone3 resumed> => {parent_tid=[5558]}, 88) = 5558 [pid 5559] <... set_robust_list resumed>) = 0 [pid 5558] <... rseq resumed>) = 0 [pid 5556] rt_sigprocmask(SIG_SETMASK, [], [pid 5078] <... unlink resumed>) = 0 [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5559] chdir("./48" [pid 5556] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] getdents64(3, [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5559 [pid 5074] getdents64(3, [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5078] close(3 [pid 5074] umount2("./45/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5559] <... chdir resumed>) = 0 [pid 5558] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5556] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... close resumed>) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5559] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5558] <... set_robust_list resumed>) = 0 [pid 5556] <... futex resumed>) = 0 [pid 5078] rmdir("./49" [pid 5074] newfstatat(AT_FDCWD, "./45/binderfs", [pid 5556] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5560 attached [pid 5559] <... prctl resumed>) = 0 [pid 5558] rt_sigprocmask(SIG_SETMASK, [], [pid 5078] <... rmdir resumed>) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5559] setpgid(0, 0 [pid 5558] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5560 [pid 5560] set_robust_list(0x55555d6c46a0, 24 [pid 5558] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5078] mkdir("./50", 0777 [pid 5074] unlink("./45/binderfs" [pid 5560] <... set_robust_list resumed>) = 0 [pid 5559] <... setpgid resumed>) = 0 [pid 5558] <... bpf resumed>) = 3 [pid 5078] <... mkdir resumed>) = 0 [pid 5074] <... unlink resumed>) = 0 [pid 5560] chdir("./47" [pid 5559] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5558] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] getdents64(3, [pid 5558] <... futex resumed>) = 1 [pid 5556] <... futex resumed>) = 0 [pid 5558] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5556] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5558] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5556] <... futex resumed>) = 0 [pid 5559] <... openat resumed>) = 3 [pid 5558] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5556] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5561 attached [pid 5560] <... chdir resumed>) = 0 [pid 5559] write(3, "1000", 4 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5560] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5559] <... write resumed>) = 4 [pid 5558] <... bpf resumed>) = 4 [pid 5074] close(3 [pid 5561] set_robust_list(0x55555d6c46a0, 24 [pid 5560] <... prctl resumed>) = 0 [pid 5559] close(3 [pid 5558] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5561 [pid 5074] <... close resumed>) = 0 [pid 5561] <... set_robust_list resumed>) = 0 [pid 5560] setpgid(0, 0 [pid 5559] <... close resumed>) = 0 [pid 5558] <... futex resumed>) = 1 [pid 5556] <... futex resumed>) = 0 [pid 5561] chdir("./50" [pid 5560] <... setpgid resumed>) = 0 [pid 5559] symlink("/dev/binderfs", "./binderfs" [pid 5558] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5556] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] rmdir("./45" [pid 5561] <... chdir resumed>) = 0 [pid 5560] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5559] <... symlink resumed>) = 0 [pid 5556] <... futex resumed>) = 0 [pid 5561] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5560] <... openat resumed>) = 3 [pid 5074] <... rmdir resumed>) = 0 [pid 5561] <... prctl resumed>) = 0 [pid 5561] setpgid(0, 0 [pid 5560] write(3, "1000", 4 [pid 5561] <... setpgid resumed>) = 0 [pid 5560] <... write resumed>) = 4 [pid 5558] <... bpf resumed>) = 5 [pid 5556] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5560] close(3 [pid 5561] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5560] <... close resumed>) = 0 [pid 5559] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5561] <... openat resumed>) = 3 [pid 5560] symlink("/dev/binderfs", "./binderfs" [pid 5559] <... futex resumed>) = 0 [pid 5558] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] mkdir("./46", 0777 [pid 5560] <... symlink resumed>) = 0 [pid 5559] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5558] <... futex resumed>) = 1 [pid 5556] <... futex resumed>) = 0 [pid 5561] write(3, "1000", 4) = 4 [pid 5560] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5559] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5556] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... mkdir resumed>) = 0 [pid 5558] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5561] close(3 [pid 5559] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5556] <... futex resumed>) = 0 [pid 5561] <... close resumed>) = 0 [pid 5560] <... futex resumed>) = 0 [pid 5559] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5558] <... bpf resumed>) = 6 [pid 5556] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5561] symlink("/dev/binderfs", "./binderfs" [pid 5560] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5559] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5558] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5561] <... symlink resumed>) = 0 [pid 5560] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5559] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5558] <... futex resumed>) = 1 [pid 5556] <... futex resumed>) = 0 [pid 5560] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5561] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5560] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5558] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5556] exit_group(0 [pid 5560] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5561] <... futex resumed>) = 0 [pid 5559] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5558] <... futex resumed>) = ? [pid 5556] <... exit_group resumed>) = ? [pid 5561] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5560] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5561] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5560] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5561] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5560] <... mprotect resumed>) = 0 [pid 5561] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5561] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5560] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5559] <... mprotect resumed>) = 0 [pid 5561] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5561] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5560] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5561] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5560] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5559] rt_sigprocmask(SIG_BLOCK, ~[], ./strace-static-x86_64: Process 5563 attached ./strace-static-x86_64: Process 5562 attached [pid 5560] <... clone3 resumed> => {parent_tid=[5563]}, 88) = 5563 [pid 5559] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5558] +++ exited with 0 +++ [pid 5556] +++ exited with 0 +++ [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5562 [pid 5562] set_robust_list(0x55555d6c46a0, 24 [pid 5563] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5562] <... set_robust_list resumed>) = 0 [pid 5561] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5560] rt_sigprocmask(SIG_SETMASK, [], [pid 5559] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5556, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- ./strace-static-x86_64: Process 5564 attached [pid 5563] <... rseq resumed>) = 0 [pid 5562] chdir("./46" [pid 5561] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5560] <... rt_sigprocmask resumed>NULL, 8) = 0 ./strace-static-x86_64: Process 5565 attached [pid 5564] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5563] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5562] <... chdir resumed>) = 0 [pid 5560] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5559] <... clone3 resumed> => {parent_tid=[5564]}, 88) = 5564 [pid 5565] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5564] <... rseq resumed>) = 0 [pid 5563] <... set_robust_list resumed>) = 0 [pid 5562] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5561] <... clone3 resumed> => {parent_tid=[5565]}, 88) = 5565 [pid 5560] <... futex resumed>) = 0 [pid 5559] rt_sigprocmask(SIG_SETMASK, [], [pid 5565] <... rseq resumed>) = 0 [pid 5564] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5563] rt_sigprocmask(SIG_SETMASK, [], [pid 5562] <... prctl resumed>) = 0 [pid 5561] rt_sigprocmask(SIG_SETMASK, [], [pid 5560] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5559] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5565] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5564] <... set_robust_list resumed>) = 0 [pid 5563] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5562] setpgid(0, 0 [pid 5561] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5559] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5565] <... set_robust_list resumed>) = 0 [pid 5564] rt_sigprocmask(SIG_SETMASK, [], [pid 5563] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5562] <... setpgid resumed>) = 0 [pid 5561] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5559] <... futex resumed>) = 0 [pid 5075] umount2("./48", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5565] rt_sigprocmask(SIG_SETMASK, [], [pid 5564] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5563] <... bpf resumed>) = 3 [pid 5561] <... futex resumed>) = 0 [pid 5562] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5565] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5564] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5563] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5561] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5559] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5565] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5564] <... bpf resumed>) = 3 [pid 5563] <... futex resumed>) = 1 [pid 5562] <... openat resumed>) = 3 [pid 5560] <... futex resumed>) = 0 [pid 5075] openat(AT_FDCWD, "./48", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5565] <... bpf resumed>) = 3 [pid 5564] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5563] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5562] write(3, "1000", 4 [pid 5560] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... openat resumed>) = 3 [pid 5565] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5564] <... futex resumed>) = 1 [pid 5563] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5560] <... futex resumed>) = 0 [pid 5559] <... futex resumed>) = 0 [pid 5564] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5563] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5562] <... write resumed>) = 4 [pid 5560] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5565] <... futex resumed>) = 1 [pid 5561] <... futex resumed>) = 0 [pid 5559] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] newfstatat(3, "", [pid 5565] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5564] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5563] <... bpf resumed>) = 4 [pid 5562] close(3 [pid 5561] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5559] <... futex resumed>) = 0 [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5565] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5564] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5562] <... close resumed>) = 0 [pid 5559] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5565] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5563] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5562] symlink("/dev/binderfs", "./binderfs" [pid 5561] <... futex resumed>) = 0 [pid 5075] getdents64(3, [pid 5565] <... bpf resumed>) = 4 [pid 5564] <... bpf resumed>) = 4 [pid 5563] <... futex resumed>) = 1 [pid 5561] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5560] <... futex resumed>) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5565] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5564] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5563] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5562] <... symlink resumed>) = 0 [pid 5560] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] umount2("./48/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5565] <... futex resumed>) = 1 [pid 5564] <... futex resumed>) = 1 [pid 5563] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5562] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5561] <... futex resumed>) = 0 [pid 5560] <... futex resumed>) = 0 [pid 5559] <... futex resumed>) = 0 [pid 5565] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5564] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5563] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5561] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5560] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5562] <... futex resumed>) = 0 [pid 5559] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5565] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5564] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5563] <... bpf resumed>) = 5 [pid 5562] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5561] <... futex resumed>) = 0 [pid 5559] <... futex resumed>) = 0 [pid 5075] newfstatat(AT_FDCWD, "./48/binderfs", [pid 5565] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5564] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5562] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5559] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5565] <... bpf resumed>) = 5 [pid 5564] <... bpf resumed>) = 5 [pid 5563] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5562] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5561] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5565] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5563] <... futex resumed>) = 1 [pid 5562] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5560] <... futex resumed>) = 0 [pid 5075] unlink("./48/binderfs" [pid 5565] <... futex resumed>) = 1 [pid 5564] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5563] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5562] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5561] <... futex resumed>) = 0 [pid 5560] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... unlink resumed>) = 0 [pid 5565] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5564] <... futex resumed>) = 1 [pid 5563] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5562] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5561] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5560] <... futex resumed>) = 0 [pid 5559] <... futex resumed>) = 0 [pid 5565] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5564] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5563] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5562] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5561] <... futex resumed>) = 0 [pid 5560] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5559] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] getdents64(3, [pid 5565] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5564] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5563] <... bpf resumed>) = 6 [pid 5562] <... mprotect resumed>) = 0 [pid 5561] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5559] <... futex resumed>) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5564] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5563] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] close(3 [pid 5564] <... bpf resumed>) = 6 [pid 5563] <... futex resumed>) = 1 [pid 5560] <... futex resumed>) = 0 [pid 5565] <... bpf resumed>) = 6 [pid 5564] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5563] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5560] exit_group(0 [pid 5559] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5075] <... close resumed>) = 0 [pid 5564] <... futex resumed>) = 0 [pid 5563] <... futex resumed>) = ? [pid 5560] <... exit_group resumed>) = ? [pid 5075] rmdir("./48" [pid 5565] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5564] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5563] +++ exited with 0 +++ [pid 5562] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5559] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5565] <... futex resumed>) = 1 [pid 5562] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5561] <... futex resumed>) = 0 [pid 5560] +++ exited with 0 +++ [pid 5559] exit_group(0 [pid 5075] <... rmdir resumed>) = 0 [pid 5565] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5564] <... futex resumed>) = ? [pid 5562] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5561] exit_group(0 [pid 5559] <... exit_group resumed>) = ? ./strace-static-x86_64: Process 5566 attached [pid 5565] <... futex resumed>) = ? [pid 5564] +++ exited with 0 +++ [pid 5561] <... exit_group resumed>) = ? [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5560, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5075] mkdir("./49", 0777 [pid 5566] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5565] +++ exited with 0 +++ [pid 5562] <... clone3 resumed> => {parent_tid=[5566]}, 88) = 5566 [pid 5076] restart_syscall(<... resuming interrupted clone ...> [pid 5566] <... rseq resumed>) = 0 [pid 5562] rt_sigprocmask(SIG_SETMASK, [], [pid 5076] <... restart_syscall resumed>) = 0 [pid 5075] <... mkdir resumed>) = 0 [pid 5566] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5562] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5566] <... set_robust_list resumed>) = 0 [pid 5562] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5561] +++ exited with 0 +++ [pid 5559] +++ exited with 0 +++ [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5566] rt_sigprocmask(SIG_SETMASK, [], [pid 5562] <... futex resumed>) = 0 [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5559, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5076] umount2("./47", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5567 attached [pid 5566] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5562] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5561, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5566] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5078] umount2("./50", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5567] set_robust_list(0x55555d6c46a0, 24 [pid 5076] openat(AT_FDCWD, "./47", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5567] <... set_robust_list resumed>) = 0 [pid 5566] <... bpf resumed>) = 3 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5567] chdir("./49" [pid 5566] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] openat(AT_FDCWD, "./50", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5076] <... openat resumed>) = 3 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5567 [pid 5567] <... chdir resumed>) = 0 [pid 5566] <... futex resumed>) = 1 [pid 5562] <... futex resumed>) = 0 [pid 5078] <... openat resumed>) = 3 [pid 5076] newfstatat(3, "", [pid 5567] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5566] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5562] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] newfstatat(3, "", [pid 5567] <... prctl resumed>) = 0 [pid 5566] <... bpf resumed>) = 4 [pid 5562] <... futex resumed>) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5077] umount2("./48", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5567] setpgid(0, 0 [pid 5566] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5562] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5566] <... futex resumed>) = 0 [pid 5562] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5078] getdents64(3, [pid 5077] openat(AT_FDCWD, "./48", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5567] <... setpgid resumed>) = 0 [pid 5076] getdents64(3, [pid 5566] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5562] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5077] <... openat resumed>) = 3 [pid 5566] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5562] <... futex resumed>) = 0 [pid 5078] umount2("./50/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5077] newfstatat(3, "", [pid 5567] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5566] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5562] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5567] <... openat resumed>) = 3 [pid 5566] <... bpf resumed>) = 5 [pid 5078] newfstatat(AT_FDCWD, "./50/binderfs", [pid 5077] getdents64(3, [pid 5076] umount2("./47/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5567] write(3, "1000", 4 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5567] <... write resumed>) = 4 [pid 5566] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] unlink("./50/binderfs" [pid 5077] umount2("./48/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5567] close(3 [pid 5566] <... futex resumed>) = 1 [pid 5562] <... futex resumed>) = 0 [pid 5078] <... unlink resumed>) = 0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] newfstatat(AT_FDCWD, "./47/binderfs", [pid 5567] <... close resumed>) = 0 [pid 5566] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5562] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5566] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5562] <... futex resumed>) = 0 [pid 5078] getdents64(3, [pid 5077] newfstatat(AT_FDCWD, "./48/binderfs", [pid 5566] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5562] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5566] <... bpf resumed>) = 6 [pid 5078] close(3 [pid 5077] unlink("./48/binderfs" [pid 5567] symlink("/dev/binderfs", "./binderfs" [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5567] <... symlink resumed>) = 0 [pid 5566] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... close resumed>) = 0 [pid 5077] <... unlink resumed>) = 0 [pid 5076] unlink("./47/binderfs" [pid 5566] <... futex resumed>) = 1 [pid 5562] <... futex resumed>) = 0 [pid 5078] rmdir("./50" [pid 5566] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5562] exit_group(0 [pid 5078] <... rmdir resumed>) = 0 [pid 5077] getdents64(3, [pid 5566] <... futex resumed>) = ? [pid 5562] <... exit_group resumed>) = ? [pid 5076] <... unlink resumed>) = 0 [pid 5567] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] getdents64(3, [pid 5567] <... futex resumed>) = 0 [pid 5566] +++ exited with 0 +++ [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5567] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, NULL, 8) = 0 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5567] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5562] +++ exited with 0 +++ [pid 5078] mkdir("./51", 0777 [pid 5077] close(3 [pid 5076] close(3 [pid 5567] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5078] <... mkdir resumed>) = 0 [pid 5077] <... close resumed>) = 0 [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5562, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5076] <... close resumed>) = 0 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5077] rmdir("./48"./strace-static-x86_64: Process 5568 attached [pid 5567] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5077] <... rmdir resumed>) = 0 [pid 5076] rmdir("./47" [pid 5568] set_robust_list(0x55555d6c46a0, 24 [pid 5567] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5568] <... set_robust_list resumed>) = 0 [pid 5567] <... mprotect resumed>) = 0 [pid 5077] mkdir("./49", 0777 [pid 5568] chdir("./51" [pid 5567] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5568 [pid 5077] <... mkdir resumed>) = 0 [pid 5076] <... rmdir resumed>) = 0 [pid 5074] umount2("./46", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5567] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5567] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5076] mkdir("./48", 0777 [pid 5568] <... chdir resumed>) = 0 ./strace-static-x86_64: Process 5569 attached [pid 5568] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5569] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5568] <... prctl resumed>) = 0 [pid 5569] <... rseq resumed>) = 0 [pid 5569] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5568] setpgid(0, 0 [pid 5567] <... clone3 resumed> => {parent_tid=[5569]}, 88) = 5569 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5076] <... mkdir resumed>) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5570 attached [pid 5569] <... set_robust_list resumed>) = 0 [pid 5568] <... setpgid resumed>) = 0 [pid 5567] rt_sigprocmask(SIG_SETMASK, [], [pid 5569] rt_sigprocmask(SIG_SETMASK, [], [pid 5567] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5074] openat(AT_FDCWD, "./46", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5569] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5074] <... openat resumed>) = 3 [pid 5569] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5567] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5568] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] newfstatat(3, "", [pid 5570] set_robust_list(0x55555d6c46a0, 24 [pid 5569] <... bpf resumed>) = 3 [pid 5568] <... openat resumed>) = 3 [pid 5567] <... futex resumed>) = 0 [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5570 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 ./strace-static-x86_64: Process 5571 attached [pid 5570] <... set_robust_list resumed>) = 0 [pid 5569] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5567] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] getdents64(3, [pid 5571] set_robust_list(0x55555d6c46a0, 24 [pid 5570] chdir("./49" [pid 5569] <... futex resumed>) = 0 [pid 5568] write(3, "1000", 4 [pid 5567] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5571 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5571] <... set_robust_list resumed>) = 0 [pid 5570] <... chdir resumed>) = 0 [pid 5569] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5568] <... write resumed>) = 4 [pid 5567] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5571] chdir("./48" [pid 5570] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5569] <... bpf resumed>) = 4 [pid 5568] close(3 [pid 5567] <... futex resumed>) = 0 [pid 5074] umount2("./46/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5571] <... chdir resumed>) = 0 [pid 5570] <... prctl resumed>) = 0 [pid 5569] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5568] <... close resumed>) = 0 [pid 5567] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5571] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5570] setpgid(0, 0 [pid 5569] <... futex resumed>) = 0 [pid 5568] symlink("/dev/binderfs", "./binderfs" [pid 5567] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5074] newfstatat(AT_FDCWD, "./46/binderfs", [pid 5571] <... prctl resumed>) = 0 [pid 5570] <... setpgid resumed>) = 0 [pid 5569] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5568] <... symlink resumed>) = 0 [pid 5567] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5571] setpgid(0, 0 [pid 5570] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5569] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5568] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5567] <... futex resumed>) = 0 [pid 5074] unlink("./46/binderfs" [pid 5571] <... setpgid resumed>) = 0 [pid 5569] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5567] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] <... unlink resumed>) = 0 [pid 5571] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5570] <... openat resumed>) = 3 [pid 5568] <... futex resumed>) = 0 [pid 5568] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, NULL, 8) = 0 [pid 5074] getdents64(3, [pid 5571] <... openat resumed>) = 3 [pid 5569] <... bpf resumed>) = 5 [pid 5568] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5571] write(3, "1000", 4 [pid 5570] write(3, "1000", 4 [pid 5074] close(3 [pid 5571] <... write resumed>) = 4 [pid 5570] <... write resumed>) = 4 [pid 5569] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5568] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5074] <... close resumed>) = 0 [pid 5571] close(3 [pid 5570] close(3 [pid 5568] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5571] <... close resumed>) = 0 [pid 5570] <... close resumed>) = 0 [pid 5569] <... futex resumed>) = 1 [pid 5567] <... futex resumed>) = 0 [pid 5074] rmdir("./46" [pid 5571] symlink("/dev/binderfs", "./binderfs" [pid 5570] symlink("/dev/binderfs", "./binderfs" [pid 5569] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5568] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5567] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5571] <... symlink resumed>) = 0 [pid 5570] <... symlink resumed>) = 0 [pid 5569] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5568] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5567] <... futex resumed>) = 0 [pid 5074] <... rmdir resumed>) = 0 [pid 5571] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5569] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5568] <... mprotect resumed>) = 0 [pid 5567] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5569] <... bpf resumed>) = 6 [pid 5570] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5571] <... futex resumed>) = 0 [pid 5571] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5570] <... futex resumed>) = 0 [pid 5569] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5568] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5074] mkdir("./47", 0777 [pid 5571] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5570] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5569] <... futex resumed>) = 1 [pid 5567] <... futex resumed>) = 0 [pid 5571] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5570] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5569] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5568] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5567] exit_group(0 [pid 5074] <... mkdir resumed>) = 0 [pid 5571] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5570] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5571] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5570] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5568] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5567] <... exit_group resumed>) = ? [pid 5569] <... futex resumed>) = ? ./strace-static-x86_64: Process 5572 attached [pid 5571] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5570] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5571] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5569] +++ exited with 0 +++ [pid 5567] +++ exited with 0 +++ [pid 5571] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5572] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5570] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5568] <... clone3 resumed> => {parent_tid=[5572]}, 88) = 5572 [pid 5572] <... rseq resumed>) = 0 [pid 5572] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5570] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5568] rt_sigprocmask(SIG_SETMASK, [], [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5567, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- ./strace-static-x86_64: Process 5573 attached [pid 5572] <... set_robust_list resumed>) = 0 [pid 5571] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5570] <... mprotect resumed>) = 0 [pid 5568] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5573] set_robust_list(0x55555d6c46a0, 24 [pid 5572] rt_sigprocmask(SIG_SETMASK, [], [pid 5571] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5570] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5568] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5573 ./strace-static-x86_64: Process 5574 attached [pid 5573] <... set_robust_list resumed>) = 0 [pid 5572] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5570] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5568] <... futex resumed>) = 0 [pid 5075] umount2("./49", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5574] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5573] chdir("./47" [pid 5572] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5571] <... clone3 resumed> => {parent_tid=[5574]}, 88) = 5574 [pid 5570] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5568] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5575 attached [pid 5574] <... rseq resumed>) = 0 [pid 5573] <... chdir resumed>) = 0 [pid 5571] rt_sigprocmask(SIG_SETMASK, [], [pid 5572] <... bpf resumed>) = 3 [pid 5075] openat(AT_FDCWD, "./49", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5575] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5574] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5573] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5572] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5571] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5570] <... clone3 resumed> => {parent_tid=[5575]}, 88) = 5575 [pid 5075] <... openat resumed>) = 3 [pid 5575] <... rseq resumed>) = 0 [pid 5574] <... set_robust_list resumed>) = 0 [pid 5573] <... prctl resumed>) = 0 [pid 5571] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5575] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5573] setpgid(0, 0 [pid 5572] <... futex resumed>) = 1 [pid 5571] <... futex resumed>) = 0 [pid 5568] <... futex resumed>) = 0 [pid 5075] newfstatat(3, "", [pid 5575] <... set_robust_list resumed>) = 0 [pid 5574] rt_sigprocmask(SIG_SETMASK, [], [pid 5573] <... setpgid resumed>) = 0 [pid 5572] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5571] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5570] rt_sigprocmask(SIG_SETMASK, [], [pid 5568] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5575] rt_sigprocmask(SIG_SETMASK, [], [pid 5574] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5573] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5572] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5570] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5568] <... futex resumed>) = 0 [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5575] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5574] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5573] <... openat resumed>) = 3 [pid 5572] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5570] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5568] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5575] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5574] <... bpf resumed>) = 3 [pid 5573] write(3, "1000", 4 [pid 5075] getdents64(3, [pid 5575] <... bpf resumed>) = 3 [pid 5574] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5573] <... write resumed>) = 4 [pid 5572] <... bpf resumed>) = 4 [pid 5570] <... futex resumed>) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5575] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5574] <... futex resumed>) = 1 [pid 5573] close(3 [pid 5571] <... futex resumed>) = 0 [pid 5575] <... futex resumed>) = 0 [pid 5573] <... close resumed>) = 0 [pid 5571] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] umount2("./49/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5575] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5573] symlink("/dev/binderfs", "./binderfs" [pid 5571] <... futex resumed>) = 0 [pid 5574] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5573] <... symlink resumed>) = 0 [pid 5572] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5571] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5570] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5574] <... bpf resumed>) = 4 [pid 5572] <... futex resumed>) = 1 [pid 5568] <... futex resumed>) = 0 [pid 5573] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5572] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5570] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5568] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] newfstatat(AT_FDCWD, "./49/binderfs", [pid 5574] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5573] <... futex resumed>) = 0 [pid 5572] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5570] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5568] <... futex resumed>) = 0 [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5575] <... futex resumed>) = 0 [pid 5574] <... futex resumed>) = 1 [pid 5573] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5572] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5571] <... futex resumed>) = 0 [pid 5570] <... futex resumed>) = 1 [pid 5568] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5575] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5574] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5573] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5571] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5570] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] unlink("./49/binderfs" [pid 5575] <... bpf resumed>) = 4 [pid 5574] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5573] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5572] <... bpf resumed>) = 5 [pid 5571] <... futex resumed>) = 0 [pid 5075] <... unlink resumed>) = 0 [pid 5575] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5574] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5573] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5571] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5575] <... futex resumed>) = 1 [pid 5573] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5572] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5570] <... futex resumed>) = 0 [pid 5075] getdents64(3, [pid 5575] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5573] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5572] <... futex resumed>) = 1 [pid 5570] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5568] <... futex resumed>) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5575] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5573] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5572] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5570] <... futex resumed>) = 0 [pid 5568] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5575] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5574] <... bpf resumed>) = 5 [pid 5573] <... mprotect resumed>) = 0 [pid 5572] <... bpf resumed>) = 6 [pid 5570] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5568] <... futex resumed>) = 0 [pid 5075] close(3 [pid 5575] <... bpf resumed>) = 5 [pid 5574] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5573] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5572] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5568] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5574] <... futex resumed>) = 1 [pid 5572] <... futex resumed>) = 0 [pid 5571] <... futex resumed>) = 0 [pid 5568] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5574] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5572] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5571] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5574] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5568] exit_group(0 [pid 5571] <... futex resumed>) = 0 [pid 5574] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5572] <... futex resumed>) = ? [pid 5568] <... exit_group resumed>) = ? [pid 5571] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5575] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5574] <... bpf resumed>) = 6 [pid 5573] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5572] +++ exited with 0 +++ [pid 5075] <... close resumed>) = 0 [pid 5575] <... futex resumed>) = 1 [pid 5574] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5573] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5570] <... futex resumed>) = 0 [pid 5075] rmdir("./49"./strace-static-x86_64: Process 5576 attached [pid 5575] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5574] <... futex resumed>) = 1 [pid 5571] <... futex resumed>) = 0 [pid 5570] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... rmdir resumed>) = 0 [pid 5576] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5575] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5574] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5571] exit_group(0 [pid 5570] <... futex resumed>) = 0 [pid 5568] +++ exited with 0 +++ [pid 5576] <... rseq resumed>) = 0 [pid 5575] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5574] <... futex resumed>) = ? [pid 5573] <... clone3 resumed> => {parent_tid=[5576]}, 88) = 5576 [pid 5571] <... exit_group resumed>) = ? [pid 5570] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5075] mkdir("./50", 0777 [pid 5576] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5575] <... bpf resumed>) = 6 [pid 5574] +++ exited with 0 +++ [pid 5573] rt_sigprocmask(SIG_SETMASK, [], [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5568, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5575] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5573] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] umount2("./51", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] <... mkdir resumed>) = 0 [pid 5575] <... futex resumed>) = 1 [pid 5573] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5570] <... futex resumed>) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5576] <... set_robust_list resumed>) = 0 [pid 5573] <... futex resumed>) = 0 [pid 5078] openat(AT_FDCWD, "./51", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5576] rt_sigprocmask(SIG_SETMASK, [], [pid 5575] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5573] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5570] exit_group(0 [pid 5078] <... openat resumed>) = 3 [pid 5575] <... futex resumed>) = ? [pid 5570] <... exit_group resumed>) = ? [pid 5078] newfstatat(3, "", [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5577 attached [pid 5576] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5575] +++ exited with 0 +++ [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5576] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5078] getdents64(3, [pid 5577] set_robust_list(0x55555d6c46a0, 24) = 0 [pid 5577] chdir("./50" [pid 5576] <... bpf resumed>) = 3 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5577 [pid 5577] <... chdir resumed>) = 0 [pid 5576] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5577] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5576] <... futex resumed>) = 1 [pid 5573] <... futex resumed>) = 0 [pid 5078] umount2("./51/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5577] <... prctl resumed>) = 0 [pid 5577] setpgid(0, 0 [pid 5576] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5573] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5577] <... setpgid resumed>) = 0 [pid 5576] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5573] <... futex resumed>) = 0 [pid 5078] newfstatat(AT_FDCWD, "./51/binderfs", [pid 5577] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5576] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5573] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5078] unlink("./51/binderfs" [pid 5576] <... bpf resumed>) = 4 [pid 5577] <... openat resumed>) = 3 [pid 5576] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... unlink resumed>) = 0 [pid 5571] +++ exited with 0 +++ [pid 5576] <... futex resumed>) = 1 [pid 5078] getdents64(3, [pid 5576] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5571, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5577] write(3, "1000", 4 [pid 5573] <... futex resumed>) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5076] umount2("./48", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5573] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] close(3 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5577] <... write resumed>) = 4 [pid 5576] <... futex resumed>) = 0 [pid 5573] <... futex resumed>) = 1 [pid 5570] +++ exited with 0 +++ [pid 5078] <... close resumed>) = 0 [pid 5076] openat(AT_FDCWD, "./48", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5577] close(3 [pid 5576] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5573] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] rmdir("./51" [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5570, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5076] <... openat resumed>) = 3 [pid 5577] <... close resumed>) = 0 [pid 5078] <... rmdir resumed>) = 0 [pid 5076] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5076] getdents64(3, [pid 5577] symlink("/dev/binderfs", "./binderfs" [pid 5576] <... bpf resumed>) = 5 [pid 5078] mkdir("./52", 0777 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5577] <... symlink resumed>) = 0 [pid 5576] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... mkdir resumed>) = 0 [pid 5077] umount2("./49", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5576] <... futex resumed>) = 1 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5577] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] umount2("./48/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5577] <... futex resumed>) = 0 [pid 5576] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5573] <... futex resumed>) = 0 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5077] openat(AT_FDCWD, "./49", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5578 attached [pid 5577] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5573] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... openat resumed>) = 3 [pid 5076] newfstatat(AT_FDCWD, "./48/binderfs", [pid 5576] <... futex resumed>) = 0 [pid 5573] <... futex resumed>) = 1 [pid 5578] set_robust_list(0x55555d6c46a0, 24 [pid 5577] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5077] newfstatat(3, "", [pid 5578] <... set_robust_list resumed>) = 0 [pid 5577] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5576] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5573] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5577] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5576] <... bpf resumed>) = 6 [pid 5076] unlink("./48/binderfs" [pid 5578] chdir("./52" [pid 5577] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5576] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5578 [pid 5077] getdents64(3, [pid 5076] <... unlink resumed>) = 0 [pid 5578] <... chdir resumed>) = 0 [pid 5577] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5576] <... futex resumed>) = 1 [pid 5573] <... futex resumed>) = 0 [pid 5578] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5577] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5576] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5573] exit_group(0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5076] getdents64(3, [pid 5578] <... prctl resumed>) = 0 [pid 5577] <... mprotect resumed>) = 0 [pid 5576] <... futex resumed>) = ? [pid 5573] <... exit_group resumed>) = ? [pid 5077] umount2("./49/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5578] setpgid(0, 0 [pid 5577] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5576] +++ exited with 0 +++ [pid 5573] +++ exited with 0 +++ [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] close(3) = 0 [pid 5076] rmdir("./48" [pid 5578] <... setpgid resumed>) = 0 [pid 5577] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5077] newfstatat(AT_FDCWD, "./49/binderfs", [pid 5076] <... rmdir resumed>) = 0 [pid 5578] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5577] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5076] mkdir("./49", 0777 [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5573, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5074] restart_syscall(<... resuming interrupted clone ...> [pid 5077] unlink("./49/binderfs" [pid 5074] <... restart_syscall resumed>) = 0 ./strace-static-x86_64: Process 5579 attached [pid 5578] <... openat resumed>) = 3 [pid 5577] <... clone3 resumed> => {parent_tid=[5579]}, 88) = 5579 [pid 5077] <... unlink resumed>) = 0 [pid 5076] <... mkdir resumed>) = 0 [pid 5579] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053) = 0 [pid 5579] set_robust_list(0x7f3e2f60d9a0, 24) = 0 [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5580 attached [pid 5579] rt_sigprocmask(SIG_SETMASK, [], [pid 5578] write(3, "1000", 4 [pid 5577] rt_sigprocmask(SIG_SETMASK, [], [pid 5077] getdents64(3, [pid 5074] umount2("./47", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5579] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5578] <... write resumed>) = 4 [pid 5577] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5577] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5578] close(3 [pid 5580] set_robust_list(0x55555d6c46a0, 24 [pid 5577] <... futex resumed>) = 0 [pid 5074] openat(AT_FDCWD, "./47", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5579] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 3 [pid 5578] <... close resumed>) = 0 [pid 5577] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5580 [pid 5580] <... set_robust_list resumed>) = 0 [pid 5579] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5578] symlink("/dev/binderfs", "./binderfs" [pid 5577] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5077] close(3 [pid 5074] <... openat resumed>) = 3 [pid 5579] <... futex resumed>) = 0 [pid 5077] <... close resumed>) = 0 [pid 5577] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5580] chdir("./49" [pid 5579] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5580] <... chdir resumed>) = 0 [pid 5578] <... symlink resumed>) = 0 [pid 5577] <... futex resumed>) = 0 [pid 5077] rmdir("./49" [pid 5074] newfstatat(3, "", [pid 5580] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5579] <... bpf resumed>) = 4 [pid 5579] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5579] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5077] <... rmdir resumed>) = 0 [pid 5580] <... prctl resumed>) = 0 [pid 5577] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5578] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5074] getdents64(3, [pid 5580] setpgid(0, 0 [pid 5578] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5577] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5077] mkdir("./50", 0777 [pid 5580] <... setpgid resumed>) = 0 [pid 5578] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5577] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5578] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5578] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5580] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5578] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5577] <... futex resumed>) = 1 [pid 5074] umount2("./47/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5579] <... futex resumed>) = 0 [pid 5578] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5579] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5578] <... mprotect resumed>) = 0 [pid 5577] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5580] <... openat resumed>) = 3 [pid 5077] <... mkdir resumed>) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5580] write(3, "1000", 4 [pid 5579] <... bpf resumed>) = 5 [pid 5578] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] newfstatat(AT_FDCWD, "./47/binderfs", ./strace-static-x86_64: Process 5581 attached [pid 5580] <... write resumed>) = 4 [pid 5579] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5578] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5581] set_robust_list(0x55555d6c46a0, 24 [pid 5580] close(3 [pid 5579] <... futex resumed>) = 1 [pid 5578] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5577] <... futex resumed>) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5581] <... set_robust_list resumed>) = 0 [pid 5577] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5580] <... close resumed>) = 0 [pid 5577] <... futex resumed>) = 0 [pid 5577] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5074] unlink("./47/binderfs" [pid 5580] symlink("/dev/binderfs", "./binderfs" [pid 5579] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16./strace-static-x86_64: Process 5582 attached [pid 5581] chdir("./50" [pid 5580] <... symlink resumed>) = 0 [pid 5579] <... bpf resumed>) = 6 [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5581 [pid 5074] <... unlink resumed>) = 0 [pid 5582] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5581] <... chdir resumed>) = 0 [pid 5582] <... rseq resumed>) = 0 [pid 5581] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5580] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5579] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5578] <... clone3 resumed> => {parent_tid=[5582]}, 88) = 5582 [pid 5582] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5581] <... prctl resumed>) = 0 [pid 5580] <... futex resumed>) = 0 [pid 5579] <... futex resumed>) = 1 [pid 5578] rt_sigprocmask(SIG_SETMASK, [], [pid 5577] <... futex resumed>) = 0 [pid 5074] getdents64(3, [pid 5582] <... set_robust_list resumed>) = 0 [pid 5581] setpgid(0, 0 [pid 5580] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5579] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5578] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5577] exit_group(0 [pid 5582] rt_sigprocmask(SIG_SETMASK, [], [pid 5581] <... setpgid resumed>) = 0 [pid 5580] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5578] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5580] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5578] <... futex resumed>) = 0 [pid 5582] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5581] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5580] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5579] <... futex resumed>) = ? [pid 5578] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5577] <... exit_group resumed>) = ? [pid 5074] close(3 [pid 5582] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5581] <... openat resumed>) = 3 [pid 5580] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5579] +++ exited with 0 +++ [pid 5074] <... close resumed>) = 0 [pid 5580] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5582] <... bpf resumed>) = 3 [pid 5581] write(3, "1000", 4 [pid 5580] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5577] +++ exited with 0 +++ [pid 5074] rmdir("./47" [pid 5582] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5581] <... write resumed>) = 4 [pid 5580] <... mprotect resumed>) = 0 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5577, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5582] <... futex resumed>) = 1 [pid 5581] close(3 [pid 5074] <... rmdir resumed>) = 0 [pid 5582] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5581] <... close resumed>) = 0 [pid 5580] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5578] <... futex resumed>) = 0 [pid 5581] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5578] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5582] <... futex resumed>) = 0 [pid 5578] <... futex resumed>) = 1 [pid 5075] umount2("./50", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5582] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5581] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5580] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5578] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] mkdir("./48", 0777 [pid 5582] <... bpf resumed>) = 4 [pid 5581] <... futex resumed>) = 0 [pid 5580] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5075] openat(AT_FDCWD, "./50", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5074] <... mkdir resumed>) = 0 ./strace-static-x86_64: Process 5583 attached [pid 5582] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5581] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5075] <... openat resumed>) = 3 [pid 5582] <... futex resumed>) = 1 [pid 5581] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5582] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5583] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5581] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5583] <... rseq resumed>) = 0 [pid 5583] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5581] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5580] <... clone3 resumed> => {parent_tid=[5583]}, 88) = 5583 [pid 5578] <... futex resumed>) = 0 [pid 5075] newfstatat(3, "", [pid 5583] <... set_robust_list resumed>) = 0 [pid 5581] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5580] rt_sigprocmask(SIG_SETMASK, [], [pid 5583] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5581] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5580] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5578] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5584 attached [pid 5583] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5582] <... futex resumed>) = 0 [pid 5581] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5580] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5578] <... futex resumed>) = 1 [pid 5075] getdents64(3, [pid 5583] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5582] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5581] <... mprotect resumed>) = 0 [pid 5580] <... futex resumed>) = 0 [pid 5578] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5584] set_robust_list(0x55555d6c46a0, 24 [pid 5583] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5582] <... bpf resumed>) = 5 [pid 5581] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5580] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5584 [pid 5584] <... set_robust_list resumed>) = 0 [pid 5583] <... bpf resumed>) = 3 [pid 5582] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5581] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5075] umount2("./50/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5583] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5582] <... futex resumed>) = 1 [pid 5581] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5578] <... futex resumed>) = 0 [pid 5584] chdir("./48" [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5583] <... futex resumed>) = 1 [pid 5582] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5580] <... futex resumed>) = 0 [pid 5578] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] newfstatat(AT_FDCWD, "./50/binderfs", ./strace-static-x86_64: Process 5585 attached [pid 5584] <... chdir resumed>) = 0 [pid 5583] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5582] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5581] <... clone3 resumed> => {parent_tid=[5585]}, 88) = 5585 [pid 5580] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5578] <... futex resumed>) = 0 [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5585] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5584] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5583] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5582] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5581] rt_sigprocmask(SIG_SETMASK, [], [pid 5580] <... futex resumed>) = 0 [pid 5578] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5075] unlink("./50/binderfs" [pid 5585] <... rseq resumed>) = 0 [pid 5584] <... prctl resumed>) = 0 [pid 5583] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5582] <... bpf resumed>) = 6 [pid 5581] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5580] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] <... unlink resumed>) = 0 [pid 5585] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5584] setpgid(0, 0 [pid 5582] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5581] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5585] <... set_robust_list resumed>) = 0 [pid 5583] <... bpf resumed>) = 4 [pid 5582] <... futex resumed>) = 1 [pid 5581] <... futex resumed>) = 0 [pid 5578] <... futex resumed>) = 0 [pid 5584] <... setpgid resumed>) = 0 [pid 5585] rt_sigprocmask(SIG_SETMASK, [], [pid 5583] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5582] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5581] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5578] exit_group(0 [pid 5075] getdents64(3, [pid 5585] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5583] <... futex resumed>) = 1 [pid 5582] <... futex resumed>) = ? [pid 5580] <... futex resumed>) = 0 [pid 5578] <... exit_group resumed>) = ? [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5585] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5584] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5583] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5582] +++ exited with 0 +++ [pid 5580] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5578] +++ exited with 0 +++ [pid 5584] <... openat resumed>) = 3 [pid 5580] <... futex resumed>) = 0 [pid 5075] close(3 [pid 5580] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5578, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5075] <... close resumed>) = 0 [pid 5075] rmdir("./50" [pid 5585] <... bpf resumed>) = 3 [pid 5584] write(3, "1000", 4 [pid 5583] <... bpf resumed>) = 5 [pid 5075] <... rmdir resumed>) = 0 [pid 5585] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5584] <... write resumed>) = 4 [pid 5078] umount2("./52", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5075] mkdir("./51", 0777 [pid 5585] <... futex resumed>) = 1 [pid 5584] close(3 [pid 5583] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] openat(AT_FDCWD, "./52", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5075] <... mkdir resumed>) = 0 [pid 5585] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5584] <... close resumed>) = 0 [pid 5583] <... futex resumed>) = 1 [pid 5581] <... futex resumed>) = 0 [pid 5580] <... futex resumed>) = 0 [pid 5078] <... openat resumed>) = 3 [pid 5584] symlink("/dev/binderfs", "./binderfs" [pid 5583] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5581] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5580] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] newfstatat(3, "", [pid 5585] <... futex resumed>) = 0 [pid 5584] <... symlink resumed>) = 0 [pid 5583] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5581] <... futex resumed>) = 1 [pid 5580] <... futex resumed>) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5586 attached [pid 5585] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5584] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5583] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5581] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5580] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] getdents64(3, [pid 5585] <... bpf resumed>) = 4 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5584] <... futex resumed>) = 0 [pid 5583] <... bpf resumed>) = 6 [pid 5586] set_robust_list(0x55555d6c46a0, 24 [pid 5584] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5078] umount2("./52/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5583] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5586] <... set_robust_list resumed>) = 0 [pid 5585] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5584] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5583] <... futex resumed>) = 1 [pid 5580] <... futex resumed>) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5586] chdir("./51" [pid 5585] <... futex resumed>) = 1 [pid 5584] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5583] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5581] <... futex resumed>) = 0 [pid 5580] exit_group(0 [pid 5078] newfstatat(AT_FDCWD, "./52/binderfs", [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5586 [pid 5586] <... chdir resumed>) = 0 [pid 5585] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5584] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5583] <... futex resumed>) = ? [pid 5581] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5580] <... exit_group resumed>) = ? [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5586] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5585] <... bpf resumed>) = 5 [pid 5584] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5583] +++ exited with 0 +++ [pid 5581] <... futex resumed>) = 0 [pid 5580] +++ exited with 0 +++ [pid 5078] unlink("./52/binderfs" [pid 5586] <... prctl resumed>) = 0 [pid 5581] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5584] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5078] <... unlink resumed>) = 0 [pid 5586] setpgid(0, 0 [pid 5078] getdents64(3, 0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5586] <... setpgid resumed>) = 0 [pid 5585] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5584] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5580, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5586] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5585] <... futex resumed>) = 1 [pid 5584] <... mprotect resumed>) = 0 [pid 5581] <... futex resumed>) = 0 [pid 5078] close(3 [pid 5076] umount2("./49", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5586] <... openat resumed>) = 3 [pid 5585] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5584] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5581] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... close resumed>) = 0 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5586] write(3, "1000", 4 [pid 5585] <... bpf resumed>) = 6 [pid 5584] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5581] <... futex resumed>) = 0 [pid 5078] rmdir("./52" [pid 5076] openat(AT_FDCWD, "./49", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5586] <... write resumed>) = 4 [pid 5585] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5584] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5581] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] <... rmdir resumed>) = 0 [pid 5585] <... futex resumed>) = 0 [pid 5581] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5586] close(3 [pid 5076] <... openat resumed>) = 3 [pid 5586] <... close resumed>) = 0 [pid 5586] symlink("/dev/binderfs", "./binderfs"./strace-static-x86_64: Process 5587 attached [pid 5585] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5581] exit_group(0 [pid 5587] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5585] <... futex resumed>) = ? [pid 5581] <... exit_group resumed>) = ? [pid 5078] mkdir("./53", 0777 [pid 5587] <... rseq resumed>) = 0 [pid 5586] <... symlink resumed>) = 0 [pid 5585] +++ exited with 0 +++ [pid 5076] newfstatat(3, "", [pid 5587] set_robust_list(0x7f3e2f60d9a0, 24) = 0 [pid 5587] rt_sigprocmask(SIG_SETMASK, [], [pid 5584] <... clone3 resumed> => {parent_tid=[5587]}, 88) = 5587 [pid 5587] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5586] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5584] rt_sigprocmask(SIG_SETMASK, [], [pid 5078] <... mkdir resumed>) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5584] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5587] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5584] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5586] <... futex resumed>) = 0 [pid 5076] getdents64(3, [pid 5587] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5586] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5584] <... futex resumed>) = 0 [pid 5581] +++ exited with 0 +++ [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 ./strace-static-x86_64: Process 5588 attached [pid 5587] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5586] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5584] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5581, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5076] umount2("./49/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5588] set_robust_list(0x55555d6c46a0, 24 [pid 5587] <... bpf resumed>) = 3 [pid 5587] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5586] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5588] <... set_robust_list resumed>) = 0 [pid 5587] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5586] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5584] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5584] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5588 [pid 5076] newfstatat(AT_FDCWD, "./49/binderfs", [pid 5587] <... futex resumed>) = 0 [pid 5586] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5584] <... futex resumed>) = 1 [pid 5587] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5584] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5588] chdir("./53" [pid 5587] <... bpf resumed>) = 4 [pid 5586] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5077] umount2("./50", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5588] <... chdir resumed>) = 0 [pid 5587] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5586] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] unlink("./49/binderfs" [pid 5588] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5587] <... futex resumed>) = 1 [pid 5584] <... futex resumed>) = 0 [pid 5077] openat(AT_FDCWD, "./50", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5587] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5584] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5588] <... prctl resumed>) = 0 [pid 5587] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5584] <... futex resumed>) = 0 [pid 5077] <... openat resumed>) = 3 [pid 5076] <... unlink resumed>) = 0 [pid 5588] setpgid(0, 0 [pid 5587] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5584] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5588] <... setpgid resumed>) = 0 [pid 5587] <... bpf resumed>) = 5 [pid 5586] <... mprotect resumed>) = 0 [pid 5077] newfstatat(3, "", [pid 5076] getdents64(3, [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5587] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5588] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5586] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5077] getdents64(3, [pid 5076] close(3 [pid 5586] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5076] <... close resumed>) = 0 [pid 5586] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5077] umount2("./50/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] rmdir("./49"./strace-static-x86_64: Process 5589 attached [pid 5588] <... openat resumed>) = 3 [pid 5587] <... futex resumed>) = 1 [pid 5584] <... futex resumed>) = 0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5589] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5588] write(3, "1000", 4 [pid 5587] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5586] <... clone3 resumed> => {parent_tid=[5589]}, 88) = 5589 [pid 5584] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] newfstatat(AT_FDCWD, "./50/binderfs", [pid 5076] <... rmdir resumed>) = 0 [pid 5589] <... rseq resumed>) = 0 [pid 5588] <... write resumed>) = 4 [pid 5587] <... bpf resumed>) = 6 [pid 5586] rt_sigprocmask(SIG_SETMASK, [], [pid 5584] <... futex resumed>) = 0 [pid 5589] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5588] close(3 [pid 5587] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5586] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5584] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5076] mkdir("./50", 0777 [pid 5589] <... set_robust_list resumed>) = 0 [pid 5586] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5584] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5077] unlink("./50/binderfs" [pid 5589] rt_sigprocmask(SIG_SETMASK, [], [pid 5588] <... close resumed>) = 0 [pid 5587] <... futex resumed>) = 0 [pid 5586] <... futex resumed>) = 0 [pid 5584] exit_group(0 [pid 5589] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5588] symlink("/dev/binderfs", "./binderfs" [pid 5586] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5584] <... exit_group resumed>) = ? [pid 5077] <... unlink resumed>) = 0 [pid 5076] <... mkdir resumed>) = 0 [pid 5589] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5588] <... symlink resumed>) = 0 [pid 5587] +++ exited with 0 +++ [pid 5588] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5588] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5589] <... bpf resumed>) = 3 [pid 5588] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5584] +++ exited with 0 +++ [pid 5077] getdents64(3, [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5588] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5584, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5588] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5588] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5589] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5588] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5074] umount2("./48", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5590 attached [pid 5589] <... futex resumed>) = 1 [pid 5588] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5586] <... futex resumed>) = 0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5590] set_robust_list(0x55555d6c46a0, 24) = 0 [pid 5589] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5588] <... mprotect resumed>) = 0 [pid 5586] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] close(3 [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5590 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5590] chdir("./50" [pid 5589] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5586] <... futex resumed>) = 0 [pid 5077] <... close resumed>) = 0 [pid 5590] <... chdir resumed>) = 0 [pid 5589] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5588] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5586] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] rmdir("./50" [pid 5074] openat(AT_FDCWD, "./48", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5590] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5589] <... bpf resumed>) = 4 [pid 5590] <... prctl resumed>) = 0 [pid 5589] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5588] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5077] <... rmdir resumed>) = 0 [pid 5074] <... openat resumed>) = 3 [pid 5590] setpgid(0, 0) = 0 [pid 5589] <... futex resumed>) = 1 [pid 5588] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5586] <... futex resumed>) = 0 [pid 5074] newfstatat(3, "", [pid 5589] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5586] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5590] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5077] mkdir("./51", 0777 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 ./strace-static-x86_64: Process 5591 attached [pid 5590] <... openat resumed>) = 3 [pid 5589] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5588] <... clone3 resumed> => {parent_tid=[5591]}, 88) = 5591 [pid 5586] <... futex resumed>) = 0 [pid 5077] <... mkdir resumed>) = 0 [pid 5074] getdents64(3, [pid 5591] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5590] write(3, "1000", 4 [pid 5589] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5588] rt_sigprocmask(SIG_SETMASK, [], [pid 5586] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5591] <... rseq resumed>) = 0 [pid 5590] <... write resumed>) = 4 [pid 5589] <... bpf resumed>) = 5 [pid 5588] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5588] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] umount2("./48/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5588] <... futex resumed>) = 0 [pid 5074] newfstatat(AT_FDCWD, "./48/binderfs", [pid 5589] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5588] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5589] <... futex resumed>) = 1 [pid 5586] <... futex resumed>) = 0 [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5592 [pid 5074] unlink("./48/binderfs" [pid 5589] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5586] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... unlink resumed>) = 0 ./strace-static-x86_64: Process 5592 attached [pid 5591] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5590] close(3 [pid 5589] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5586] <... futex resumed>) = 0 [pid 5589] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5586] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5074] getdents64(3, [pid 5592] set_robust_list(0x55555d6c46a0, 24 [pid 5591] <... set_robust_list resumed>) = 0 [pid 5590] <... close resumed>) = 0 [pid 5589] <... bpf resumed>) = 6 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5592] <... set_robust_list resumed>) = 0 [pid 5591] rt_sigprocmask(SIG_SETMASK, [], [pid 5590] symlink("/dev/binderfs", "./binderfs" [pid 5591] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5589] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] close(3 [pid 5592] chdir("./51" [pid 5591] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5590] <... symlink resumed>) = 0 [pid 5589] <... futex resumed>) = 1 [pid 5586] <... futex resumed>) = 0 [pid 5592] <... chdir resumed>) = 0 [pid 5591] <... bpf resumed>) = 3 [pid 5590] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5589] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5586] exit_group(0 [pid 5074] <... close resumed>) = 0 [pid 5592] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5591] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5590] <... futex resumed>) = 0 [pid 5589] <... futex resumed>) = ? [pid 5586] <... exit_group resumed>) = ? [pid 5074] rmdir("./48" [pid 5592] <... prctl resumed>) = 0 [pid 5590] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5074] <... rmdir resumed>) = 0 [pid 5589] +++ exited with 0 +++ [pid 5074] mkdir("./49", 0777 [pid 5592] setpgid(0, 0 [pid 5591] <... futex resumed>) = 1 [pid 5590] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5588] <... futex resumed>) = 0 [pid 5586] +++ exited with 0 +++ [pid 5592] <... setpgid resumed>) = 0 [pid 5591] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5590] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5588] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... mkdir resumed>) = 0 [pid 5592] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5586, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5592] <... openat resumed>) = 3 [pid 5591] <... bpf resumed>) = 4 [pid 5590] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5588] <... futex resumed>) = 0 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5593 attached [pid 5592] write(3, "1000", 4 [pid 5591] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5590] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5588] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5592] <... write resumed>) = 4 [pid 5591] <... futex resumed>) = 0 [pid 5590] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5588] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5593] set_robust_list(0x55555d6c46a0, 24 [pid 5592] close(3 [pid 5591] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5588] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] umount2("./51", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5593] <... set_robust_list resumed>) = 0 [pid 5592] <... close resumed>) = 0 [pid 5591] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5588] <... futex resumed>) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5593] chdir("./49" [pid 5592] symlink("/dev/binderfs", "./binderfs" [pid 5591] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5590] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5588] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5593 [pid 5593] <... chdir resumed>) = 0 [pid 5592] <... symlink resumed>) = 0 [pid 5590] <... mprotect resumed>) = 0 [pid 5075] openat(AT_FDCWD, "./51", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5593] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5592] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5591] <... bpf resumed>) = 5 [pid 5590] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5593] <... prctl resumed>) = 0 [pid 5592] <... futex resumed>) = 0 [pid 5591] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... openat resumed>) = 3 [pid 5593] setpgid(0, 0 [pid 5592] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5075] newfstatat(3, "", [pid 5592] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5591] <... futex resumed>) = 1 [pid 5588] <... futex resumed>) = 0 [pid 5592] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5593] <... setpgid resumed>) = 0 [pid 5588] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5592] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5591] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5588] <... futex resumed>) = 0 [pid 5590] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5593] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5590] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0}./strace-static-x86_64: Process 5594 attached [pid 5594] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5590] <... clone3 resumed> => {parent_tid=[5594]}, 88) = 5594 [pid 5594] <... rseq resumed>) = 0 [pid 5590] rt_sigprocmask(SIG_SETMASK, [], [pid 5594] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5590] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5594] <... set_robust_list resumed>) = 0 [pid 5590] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5594] rt_sigprocmask(SIG_SETMASK, [], [pid 5590] <... futex resumed>) = 0 [pid 5594] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5590] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5594] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 3 [pid 5592] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5594] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] getdents64(3, [pid 5593] <... openat resumed>) = 3 [pid 5592] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5591] <... bpf resumed>) = 6 [pid 5588] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5592] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5591] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5592] <... mprotect resumed>) = 0 [pid 5591] <... futex resumed>) = 0 [pid 5591] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5075] umount2("./51/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5594] <... futex resumed>) = 1 [pid 5593] write(3, "1000", 4 [pid 5590] <... futex resumed>) = 0 [pid 5588] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5594] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5593] <... write resumed>) = 4 [pid 5592] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5590] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5588] exit_group(0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5594] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5593] close(3 [pid 5591] <... futex resumed>) = ? [pid 5590] <... futex resumed>) = 0 [pid 5588] <... exit_group resumed>) = ? [pid 5075] newfstatat(AT_FDCWD, "./51/binderfs", [pid 5594] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5593] <... close resumed>) = 0 [pid 5592] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5591] +++ exited with 0 +++ [pid 5590] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5594] <... bpf resumed>) = 4 [pid 5593] symlink("/dev/binderfs", "./binderfs" [pid 5592] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5588] +++ exited with 0 +++ [pid 5075] unlink("./51/binderfs"./strace-static-x86_64: Process 5595 attached [pid 5594] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5593] <... symlink resumed>) = 0 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5588, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5595] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5594] <... futex resumed>) = 1 [pid 5592] <... clone3 resumed> => {parent_tid=[5595]}, 88) = 5595 [pid 5590] <... futex resumed>) = 0 [pid 5075] <... unlink resumed>) = 0 [pid 5595] <... rseq resumed>) = 0 [pid 5592] rt_sigprocmask(SIG_SETMASK, [], [pid 5590] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] getdents64(3, [pid 5595] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5594] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5593] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5592] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5590] <... futex resumed>) = 0 [pid 5078] umount2("./53", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5595] <... set_robust_list resumed>) = 0 [pid 5594] <... bpf resumed>) = 5 [pid 5593] <... futex resumed>) = 0 [pid 5592] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5590] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5595] rt_sigprocmask(SIG_SETMASK, [], [pid 5075] close(3 [pid 5595] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5592] <... futex resumed>) = 0 [pid 5075] <... close resumed>) = 0 [pid 5075] rmdir("./51" [pid 5592] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5594] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5593] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5078] openat(AT_FDCWD, "./53", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5595] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5594] <... futex resumed>) = 1 [pid 5593] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5590] <... futex resumed>) = 0 [pid 5078] <... openat resumed>) = 3 [pid 5594] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5593] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5590] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] newfstatat(3, "", [pid 5075] <... rmdir resumed>) = 0 [pid 5595] <... bpf resumed>) = 3 [pid 5594] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5593] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5590] <... futex resumed>) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5075] mkdir("./52", 0777 [pid 5595] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5594] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5593] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5590] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] getdents64(3, [pid 5595] <... futex resumed>) = 1 [pid 5593] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5592] <... futex resumed>) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5075] <... mkdir resumed>) = 0 [pid 5595] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5593] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5592] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] umount2("./53/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5595] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5594] <... bpf resumed>) = 6 [pid 5593] <... mprotect resumed>) = 0 [pid 5592] <... futex resumed>) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5595] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5592] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5596 attached [pid 5595] <... bpf resumed>) = 4 [pid 5594] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5593] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5078] newfstatat(AT_FDCWD, "./53/binderfs", [pid 5596] set_robust_list(0x55555d6c46a0, 24 [pid 5595] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5596] <... set_robust_list resumed>) = 0 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5596 [pid 5595] <... futex resumed>) = 1 [pid 5592] <... futex resumed>) = 0 [pid 5596] chdir("./52" [pid 5595] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5594] <... futex resumed>) = 1 [pid 5593] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5592] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5590] <... futex resumed>) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5596] <... chdir resumed>) = 0 [pid 5594] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5593] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5592] <... futex resumed>) = 0 [pid 5590] exit_group(0 [pid 5078] unlink("./53/binderfs"./strace-static-x86_64: Process 5597 attached [pid 5596] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5594] <... futex resumed>) = ? [pid 5592] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5590] <... exit_group resumed>) = ? [pid 5595] <... bpf resumed>) = 5 [pid 5597] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5596] <... prctl resumed>) = 0 [pid 5594] +++ exited with 0 +++ [pid 5593] <... clone3 resumed> => {parent_tid=[5597]}, 88) = 5597 [pid 5078] <... unlink resumed>) = 0 [pid 5597] <... rseq resumed>) = 0 [pid 5596] setpgid(0, 0 [pid 5595] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5593] rt_sigprocmask(SIG_SETMASK, [], [pid 5590] +++ exited with 0 +++ [pid 5078] getdents64(3, [pid 5597] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5596] <... setpgid resumed>) = 0 [pid 5595] <... futex resumed>) = 1 [pid 5593] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5592] <... futex resumed>) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5597] <... set_robust_list resumed>) = 0 [pid 5595] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5593] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5592] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5597] rt_sigprocmask(SIG_SETMASK, [], [pid 5596] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5593] <... futex resumed>) = 0 [pid 5592] <... futex resumed>) = 0 [pid 5078] close(3 [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5590, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5597] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5593] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5592] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] <... close resumed>) = 0 [pid 5596] <... openat resumed>) = 3 [pid 5076] restart_syscall(<... resuming interrupted clone ...> [pid 5597] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5078] rmdir("./53" [pid 5596] write(3, "1000", 4 [pid 5076] <... restart_syscall resumed>) = 0 [pid 5597] <... bpf resumed>) = 3 [pid 5597] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5596] <... write resumed>) = 4 [pid 5597] <... futex resumed>) = 1 [pid 5596] close(3 [pid 5597] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5596] <... close resumed>) = 0 [pid 5593] <... futex resumed>) = 0 [pid 5078] <... rmdir resumed>) = 0 [pid 5596] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5593] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] mkdir("./54", 0777 [pid 5076] umount2("./50", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5595] <... bpf resumed>) = 6 [pid 5593] <... futex resumed>) = 1 [pid 5597] <... futex resumed>) = 0 [pid 5593] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5597] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5596] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5595] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5597] <... bpf resumed>) = 4 [pid 5596] <... futex resumed>) = 0 [pid 5595] <... futex resumed>) = 1 [pid 5592] <... futex resumed>) = 0 [pid 5078] <... mkdir resumed>) = 0 [pid 5076] openat(AT_FDCWD, "./50", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5597] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5596] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5595] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5592] exit_group(0 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5598 attached [pid 5597] <... futex resumed>) = 1 [pid 5596] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5595] <... futex resumed>) = ? [pid 5593] <... futex resumed>) = 0 [pid 5592] <... exit_group resumed>) = ? [pid 5076] <... openat resumed>) = 3 [pid 5598] set_robust_list(0x55555d6c46a0, 24 [pid 5597] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5596] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5595] +++ exited with 0 +++ [pid 5593] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5598] <... set_robust_list resumed>) = 0 [pid 5597] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5596] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5593] <... futex resumed>) = 0 [pid 5076] newfstatat(3, "", [pid 5598] chdir("./54" [pid 5597] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5596] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5593] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5598] <... chdir resumed>) = 0 [pid 5592] +++ exited with 0 +++ [pid 5596] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5598 [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5598] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5596] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5592, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5598] <... prctl resumed>) = 0 [pid 5597] <... bpf resumed>) = 5 [pid 5596] <... mprotect resumed>) = 0 [pid 5076] getdents64(3, [pid 5598] setpgid(0, 0 [pid 5597] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5596] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5598] <... setpgid resumed>) = 0 [pid 5597] <... futex resumed>) = 1 [pid 5596] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5593] <... futex resumed>) = 0 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5598] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5597] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5596] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5593] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] umount2("./51", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] umount2("./50/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5598] <... openat resumed>) = 3 [pid 5597] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5593] <... futex resumed>) = 0 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5599 attached [pid 5598] write(3, "1000", 4 [pid 5597] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5596] <... clone3 resumed> => {parent_tid=[5599]}, 88) = 5599 [pid 5593] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5599] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5598] <... write resumed>) = 4 [pid 5596] rt_sigprocmask(SIG_SETMASK, [], [pid 5076] newfstatat(AT_FDCWD, "./50/binderfs", [pid 5599] <... rseq resumed>) = 0 [pid 5598] close(3 [pid 5596] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] openat(AT_FDCWD, "./51", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5599] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5598] <... close resumed>) = 0 [pid 5596] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... openat resumed>) = 3 [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5599] <... set_robust_list resumed>) = 0 [pid 5598] symlink("/dev/binderfs", "./binderfs" [pid 5596] <... futex resumed>) = 0 [pid 5076] unlink("./50/binderfs" [pid 5599] rt_sigprocmask(SIG_SETMASK, [], [pid 5077] newfstatat(3, "", [pid 5599] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5598] <... symlink resumed>) = 0 [pid 5596] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5599] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5598] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] getdents64(3, [pid 5076] <... unlink resumed>) = 0 [pid 5598] <... futex resumed>) = 0 [pid 5076] getdents64(3, [pid 5599] <... bpf resumed>) = 3 [pid 5598] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5599] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5598] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5597] <... bpf resumed>) = 6 [pid 5077] umount2("./51/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5599] <... futex resumed>) = 1 [pid 5598] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5597] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5596] <... futex resumed>) = 0 [pid 5076] close(3 [pid 5599] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5598] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5597] <... futex resumed>) = 1 [pid 5596] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5593] <... futex resumed>) = 0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5599] <... bpf resumed>) = 4 [pid 5598] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5597] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5596] <... futex resumed>) = 0 [pid 5076] <... close resumed>) = 0 [pid 5596] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5593] exit_group(0 [pid 5076] rmdir("./50" [pid 5598] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5599] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] newfstatat(AT_FDCWD, "./51/binderfs", [pid 5599] <... futex resumed>) = 1 [pid 5598] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5597] <... futex resumed>) = ? [pid 5596] <... futex resumed>) = 0 [pid 5593] <... exit_group resumed>) = ? [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5076] <... rmdir resumed>) = 0 [pid 5599] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5077] unlink("./51/binderfs") = 0 [pid 5077] getdents64(3, [pid 5597] +++ exited with 0 +++ [pid 5596] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5598] <... mprotect resumed>) = 0 [pid 5599] <... futex resumed>) = 0 [pid 5596] <... futex resumed>) = 1 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5076] mkdir("./51", 0777 [pid 5599] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5596] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5599] <... bpf resumed>) = 5 [pid 5598] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5593] +++ exited with 0 +++ [pid 5077] close(3 [pid 5076] <... mkdir resumed>) = 0 [pid 5598] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5598] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5593, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5599] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... close resumed>) = 0 [pid 5074] restart_syscall(<... resuming interrupted clone ...>./strace-static-x86_64: Process 5600 attached [pid 5599] <... futex resumed>) = 1 [pid 5077] rmdir("./51"./strace-static-x86_64: Process 5601 attached [pid 5600] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5599] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5598] <... clone3 resumed> => {parent_tid=[5600]}, 88) = 5600 [pid 5596] <... futex resumed>) = 0 [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5601 [pid 5074] <... restart_syscall resumed>) = 0 [pid 5601] set_robust_list(0x55555d6c46a0, 24 [pid 5600] <... rseq resumed>) = 0 [pid 5598] rt_sigprocmask(SIG_SETMASK, [], [pid 5596] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... rmdir resumed>) = 0 [pid 5601] <... set_robust_list resumed>) = 0 [pid 5600] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5599] <... futex resumed>) = 0 [pid 5598] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5596] <... futex resumed>) = 1 [pid 5077] mkdir("./52", 0777 [pid 5601] chdir("./51" [pid 5600] <... set_robust_list resumed>) = 0 [pid 5599] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5598] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5596] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5074] umount2("./49", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5601] <... chdir resumed>) = 0 [pid 5600] rt_sigprocmask(SIG_SETMASK, [], [pid 5598] <... futex resumed>) = 0 [pid 5077] <... mkdir resumed>) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5601] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5600] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5598] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] openat(AT_FDCWD, "./49", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5600] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5074] <... openat resumed>) = 3 [pid 5601] <... prctl resumed>) = 0 [pid 5600] <... bpf resumed>) = 3 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] newfstatat(3, "", ./strace-static-x86_64: Process 5602 attached [pid 5601] setpgid(0, 0 [pid 5600] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5602] set_robust_list(0x55555d6c46a0, 24 [pid 5601] <... setpgid resumed>) = 0 [pid 5600] <... futex resumed>) = 1 [pid 5599] <... bpf resumed>) = 6 [pid 5598] <... futex resumed>) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5602] <... set_robust_list resumed>) = 0 [pid 5601] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5600] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5598] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5602] chdir("./52" [pid 5601] <... openat resumed>) = 3 [pid 5599] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5598] <... futex resumed>) = 0 [pid 5600] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5602 [pid 5074] getdents64(3, [pid 5602] <... chdir resumed>) = 0 [pid 5601] write(3, "1000", 4 [pid 5600] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5599] <... futex resumed>) = 1 [pid 5598] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5596] <... futex resumed>) = 0 [pid 5602] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5601] <... write resumed>) = 4 [pid 5600] <... bpf resumed>) = 4 [pid 5599] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5602] <... prctl resumed>) = 0 [pid 5601] close(3 [pid 5600] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5596] exit_group(0 [pid 5074] umount2("./49/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5602] setpgid(0, 0 [pid 5601] <... close resumed>) = 0 [pid 5600] <... futex resumed>) = 1 [pid 5599] <... futex resumed>) = ? [pid 5598] <... futex resumed>) = 0 [pid 5596] <... exit_group resumed>) = ? [pid 5602] <... setpgid resumed>) = 0 [pid 5601] symlink("/dev/binderfs", "./binderfs" [pid 5600] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5599] +++ exited with 0 +++ [pid 5598] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5601] <... symlink resumed>) = 0 [pid 5602] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5600] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5598] <... futex resumed>) = 0 [pid 5074] newfstatat(AT_FDCWD, "./49/binderfs", [pid 5601] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5602] <... openat resumed>) = 3 [pid 5600] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5598] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5602] write(3, "1000", 4 [pid 5601] <... futex resumed>) = 0 [pid 5596] +++ exited with 0 +++ [pid 5074] unlink("./49/binderfs" [pid 5601] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5596, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5602] <... write resumed>) = 4 [pid 5601] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5600] <... bpf resumed>) = 5 [pid 5602] close(3 [pid 5601] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5600] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... unlink resumed>) = 0 [pid 5602] <... close resumed>) = 0 [pid 5601] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5600] <... futex resumed>) = 1 [pid 5598] <... futex resumed>) = 0 [pid 5074] getdents64(3, [pid 5602] symlink("/dev/binderfs", "./binderfs" [pid 5601] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5600] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5602] <... symlink resumed>) = 0 [pid 5601] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5600] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5598] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] umount2("./52", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] close(3 [pid 5602] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5600] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5598] <... futex resumed>) = 0 [pid 5602] <... futex resumed>) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5598] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5074] <... close resumed>) = 0 [pid 5602] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5075] openat(AT_FDCWD, "./52", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5074] rmdir("./49" [pid 5602] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5601] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5075] <... openat resumed>) = 3 [pid 5602] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5601] <... mprotect resumed>) = 0 [pid 5075] newfstatat(3, "", [pid 5074] <... rmdir resumed>) = 0 [pid 5602] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5601] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5602] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5601] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5074] mkdir("./50", 0777 [pid 5602] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5601] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5075] getdents64(3, ./strace-static-x86_64: Process 5603 attached [pid 5602] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5074] <... mkdir resumed>) = 0 [pid 5603] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5602] <... mprotect resumed>) = 0 [pid 5601] <... clone3 resumed> => {parent_tid=[5603]}, 88) = 5603 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5603] <... rseq resumed>) = 0 [pid 5602] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5075] umount2("./52/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5601] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5603] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5602] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5601] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5604 attached [pid 5603] <... set_robust_list resumed>) = 0 [pid 5602] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5601] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5605 attached [pid 5604] set_robust_list(0x55555d6c46a0, 24 [pid 5603] rt_sigprocmask(SIG_SETMASK, [], [pid 5601] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] newfstatat(AT_FDCWD, "./52/binderfs", [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5604 [pid 5605] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5604] <... set_robust_list resumed>) = 0 [pid 5603] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5602] <... clone3 resumed> => {parent_tid=[5605]}, 88) = 5605 [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5605] <... rseq resumed>) = 0 [pid 5603] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5602] rt_sigprocmask(SIG_SETMASK, [], [pid 5605] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5604] chdir("./50" [pid 5603] <... bpf resumed>) = 3 [pid 5602] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] unlink("./52/binderfs" [pid 5605] <... set_robust_list resumed>) = 0 [pid 5604] <... chdir resumed>) = 0 [pid 5603] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5602] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5605] rt_sigprocmask(SIG_SETMASK, [], [pid 5602] <... futex resumed>) = 0 [pid 5604] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5603] <... futex resumed>) = 1 [pid 5075] <... unlink resumed>) = 0 [pid 5605] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5604] <... prctl resumed>) = 0 [pid 5603] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5602] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5601] <... futex resumed>) = 0 [pid 5605] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5604] setpgid(0, 0 [pid 5601] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5600] <... bpf resumed>) = 6 [pid 5075] getdents64(3, [pid 5605] <... bpf resumed>) = 3 [pid 5604] <... setpgid resumed>) = 0 [pid 5603] <... futex resumed>) = 0 [pid 5601] <... futex resumed>) = 1 [pid 5600] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5605] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5601] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5604] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5600] <... futex resumed>) = 1 [pid 5603] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5598] <... futex resumed>) = 0 [pid 5605] <... futex resumed>) = 1 [pid 5604] <... openat resumed>) = 3 [pid 5602] <... futex resumed>) = 0 [pid 5600] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5075] close(3 [pid 5605] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5604] write(3, "1000", 4 [pid 5603] <... bpf resumed>) = 4 [pid 5602] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5598] exit_group(0 [pid 5605] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5604] <... write resumed>) = 4 [pid 5603] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5602] <... futex resumed>) = 0 [pid 5600] <... futex resumed>) = ? [pid 5598] <... exit_group resumed>) = ? [pid 5075] <... close resumed>) = 0 [pid 5604] close(3 [pid 5603] <... futex resumed>) = 1 [pid 5602] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5604] <... close resumed>) = 0 [pid 5600] +++ exited with 0 +++ [pid 5075] rmdir("./52" [pid 5603] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5604] symlink("/dev/binderfs", "./binderfs" [pid 5605] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5601] <... futex resumed>) = 0 [pid 5605] <... bpf resumed>) = 4 [pid 5604] <... symlink resumed>) = 0 [pid 5601] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... rmdir resumed>) = 0 [pid 5605] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5601] <... futex resumed>) = 1 [pid 5605] <... futex resumed>) = 1 [pid 5604] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5603] <... futex resumed>) = 0 [pid 5602] <... futex resumed>) = 0 [pid 5601] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5598] +++ exited with 0 +++ [pid 5075] mkdir("./53", 0777 [pid 5604] <... futex resumed>) = 0 [pid 5603] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5602] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5605] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5598, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5075] <... mkdir resumed>) = 0 [pid 5605] <... bpf resumed>) = 5 [pid 5604] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5603] <... bpf resumed>) = 5 [pid 5602] <... futex resumed>) = 0 [pid 5078] restart_syscall(<... resuming interrupted clone ...> [pid 5604] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5602] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... restart_syscall resumed>) = 0 [pid 5603] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5605] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5604] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5605] <... futex resumed>) = 1 [pid 5604] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5603] <... futex resumed>) = 1 [pid 5602] <... futex resumed>) = 0 [pid 5601] <... futex resumed>) = 0 [pid 5605] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5604] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5603] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5602] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5601] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] umount2("./54", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5606 attached [pid 5604] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5602] <... futex resumed>) = 0 [pid 5601] <... futex resumed>) = 0 [pid 5606] set_robust_list(0x55555d6c46a0, 24 [pid 5604] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5602] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5601] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5606 [pid 5606] <... set_robust_list resumed>) = 0 [pid 5604] <... mprotect resumed>) = 0 [pid 5078] openat(AT_FDCWD, "./54", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5606] chdir("./53" [pid 5078] <... openat resumed>) = 3 [pid 5604] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5606] <... chdir resumed>) = 0 [pid 5604] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5078] newfstatat(3, "", [pid 5606] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5604] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 ./strace-static-x86_64: Process 5607 attached [pid 5606] <... prctl resumed>) = 0 [pid 5078] getdents64(3, [pid 5607] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5606] setpgid(0, 0 [pid 5604] <... clone3 resumed> => {parent_tid=[5607]}, 88) = 5607 [pid 5607] <... rseq resumed>) = 0 [pid 5606] <... setpgid resumed>) = 0 [pid 5604] rt_sigprocmask(SIG_SETMASK, [], [pid 5607] set_robust_list(0x7f3e2f60d9a0, 24) = 0 [pid 5606] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5605] <... bpf resumed>) = 6 [pid 5604] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5603] <... bpf resumed>) = 6 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5607] rt_sigprocmask(SIG_SETMASK, [], [pid 5604] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] umount2("./54/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5607] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5606] <... openat resumed>) = 3 [pid 5605] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5604] <... futex resumed>) = 0 [pid 5603] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5607] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5606] write(3, "1000", 4 [pid 5605] <... futex resumed>) = 1 [pid 5604] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5603] <... futex resumed>) = 1 [pid 5602] <... futex resumed>) = 0 [pid 5601] <... futex resumed>) = 0 [pid 5078] newfstatat(AT_FDCWD, "./54/binderfs", [pid 5607] <... bpf resumed>) = 3 [pid 5606] <... write resumed>) = 4 [pid 5605] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5603] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5602] exit_group(0 [pid 5601] exit_group(0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5607] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5606] close(3 [pid 5605] <... futex resumed>) = ? [pid 5603] <... futex resumed>) = ? [pid 5602] <... exit_group resumed>) = ? [pid 5601] <... exit_group resumed>) = ? [pid 5078] unlink("./54/binderfs" [pid 5607] <... futex resumed>) = 1 [pid 5606] <... close resumed>) = 0 [pid 5605] +++ exited with 0 +++ [pid 5604] <... futex resumed>) = 0 [pid 5603] +++ exited with 0 +++ [pid 5602] +++ exited with 0 +++ [pid 5601] +++ exited with 0 +++ [pid 5078] <... unlink resumed>) = 0 [pid 5607] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5606] symlink("/dev/binderfs", "./binderfs" [pid 5604] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] getdents64(3, [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5602, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- [pid 5607] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5606] <... symlink resumed>) = 0 [pid 5604] <... futex resumed>) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5077] restart_syscall(<... resuming interrupted clone ...> [pid 5607] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5606] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5604] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] close(3 [pid 5077] <... restart_syscall resumed>) = 0 [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5601, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5607] <... bpf resumed>) = 4 [pid 5606] <... futex resumed>) = 0 [pid 5078] <... close resumed>) = 0 [pid 5607] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5606] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5078] rmdir("./54" [pid 5076] restart_syscall(<... resuming interrupted clone ...> [pid 5607] <... futex resumed>) = 1 [pid 5606] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5604] <... futex resumed>) = 0 [pid 5078] <... rmdir resumed>) = 0 [pid 5077] umount2("./52", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] <... restart_syscall resumed>) = 0 [pid 5607] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5606] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5604] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5607] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5606] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5604] <... futex resumed>) = 0 [pid 5078] mkdir("./55", 0777 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5607] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5606] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5604] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... mkdir resumed>) = 0 [pid 5077] openat(AT_FDCWD, "./52", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5607] <... bpf resumed>) = 5 [pid 5607] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5606] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5076] umount2("./51", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5607] <... futex resumed>) = 1 [pid 5606] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5604] <... futex resumed>) = 0 [pid 5607] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5606] <... mprotect resumed>) = 0 [pid 5604] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5607] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5076] openat(AT_FDCWD, "./51", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5607] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5604] <... futex resumed>) = 0 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5077] <... openat resumed>) = 3 [pid 5076] <... openat resumed>) = 3 ./strace-static-x86_64: Process 5608 attached [pid 5606] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5604] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] newfstatat(3, "", [pid 5606] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5608] set_robust_list(0x55555d6c46a0, 24 [pid 5606] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5608] <... set_robust_list resumed>) = 0 ./strace-static-x86_64: Process 5609 attached [pid 5608] chdir("./55" [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5609] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5608] <... chdir resumed>) = 0 [pid 5607] <... bpf resumed>) = 6 [pid 5606] <... clone3 resumed> => {parent_tid=[5609]}, 88) = 5609 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5608 [pid 5077] getdents64(3, [pid 5609] <... rseq resumed>) = 0 [pid 5608] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5607] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5606] rt_sigprocmask(SIG_SETMASK, [], [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5076] newfstatat(3, "", [pid 5609] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5608] <... prctl resumed>) = 0 [pid 5607] <... futex resumed>) = 1 [pid 5606] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5604] <... futex resumed>) = 0 [pid 5077] umount2("./52/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5609] <... set_robust_list resumed>) = 0 [pid 5608] setpgid(0, 0 [pid 5607] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5606] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5604] exit_group(0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5609] rt_sigprocmask(SIG_SETMASK, [], [pid 5608] <... setpgid resumed>) = 0 [pid 5607] <... futex resumed>) = ? [pid 5606] <... futex resumed>) = 0 [pid 5604] <... exit_group resumed>) = ? [pid 5077] newfstatat(AT_FDCWD, "./52/binderfs", [pid 5076] getdents64(3, [pid 5606] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5077] unlink("./52/binderfs" [pid 5076] umount2("./51/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5609] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] <... unlink resumed>) = 0 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5609] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5608] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5609] <... bpf resumed>) = 3 [pid 5608] <... openat resumed>) = 3 [pid 5607] +++ exited with 0 +++ [pid 5604] +++ exited with 0 +++ [pid 5077] getdents64(3, [pid 5076] newfstatat(AT_FDCWD, "./51/binderfs", [pid 5609] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5608] write(3, "1000", 4 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5609] <... futex resumed>) = 1 [pid 5608] <... write resumed>) = 4 [pid 5606] <... futex resumed>) = 0 [pid 5077] close(3 [pid 5076] unlink("./51/binderfs" [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5604, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5609] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5608] close(3 [pid 5606] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... close resumed>) = 0 [pid 5076] <... unlink resumed>) = 0 [pid 5074] umount2("./50", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5609] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5608] <... close resumed>) = 0 [pid 5606] <... futex resumed>) = 0 [pid 5077] rmdir("./52" [pid 5609] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5608] symlink("/dev/binderfs", "./binderfs" [pid 5606] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] getdents64(3, [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5609] <... bpf resumed>) = 4 [pid 5608] <... symlink resumed>) = 0 [pid 5077] <... rmdir resumed>) = 0 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5074] openat(AT_FDCWD, "./50", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5609] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5608] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5606] <... futex resumed>) = 0 [pid 5076] close(3 [pid 5609] <... futex resumed>) = 1 [pid 5608] <... futex resumed>) = 0 [pid 5606] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... close resumed>) = 0 [pid 5074] <... openat resumed>) = 3 [pid 5609] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5608] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5606] <... futex resumed>) = 0 [pid 5077] mkdir("./53", 0777 [pid 5076] rmdir("./51" [pid 5074] newfstatat(3, "", [pid 5609] <... bpf resumed>) = 5 [pid 5608] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5606] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... mkdir resumed>) = 0 [pid 5076] <... rmdir resumed>) = 0 [pid 5609] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5608] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5606] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5609] <... futex resumed>) = 0 [pid 5608] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5606] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5609] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5608] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5606] <... futex resumed>) = 0 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5076] mkdir("./52", 0777 [pid 5074] getdents64(3, [pid 5609] <... bpf resumed>) = 6 [pid 5608] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5606] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5609] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5608] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5606] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5609] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5610 attached [pid 5609] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5608] <... mprotect resumed>) = 0 [pid 5606] exit_group(0 [pid 5076] <... mkdir resumed>) = 0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5610] set_robust_list(0x55555d6c46a0, 24 [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5610 [pid 5074] umount2("./50/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5610] <... set_robust_list resumed>) = 0 [pid 5609] <... futex resumed>) = ? [pid 5608] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5606] <... exit_group resumed>) = ? [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5610] chdir("./53" [pid 5609] +++ exited with 0 +++ [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] newfstatat(AT_FDCWD, "./50/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 ./strace-static-x86_64: Process 5611 attached [pid 5610] <... chdir resumed>) = 0 [pid 5608] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5606] +++ exited with 0 +++ [pid 5610] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5074] unlink("./50/binderfs" [pid 5611] set_robust_list(0x55555d6c46a0, 24 [pid 5610] <... prctl resumed>) = 0 [pid 5608] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5074] <... unlink resumed>) = 0 [pid 5611] <... set_robust_list resumed>) = 0 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5606, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5611] chdir("./52" [pid 5610] setpgid(0, 0 [pid 5608] <... clone3 resumed> => {parent_tid=[5612]}, 88) = 5612 [pid 5075] restart_syscall(<... resuming interrupted clone ...>./strace-static-x86_64: Process 5612 attached [pid 5611] <... chdir resumed>) = 0 [pid 5610] <... setpgid resumed>) = 0 [pid 5608] rt_sigprocmask(SIG_SETMASK, [], [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5611 [pid 5074] getdents64(3, [pid 5075] <... restart_syscall resumed>) = 0 [pid 5612] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5611] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5610] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5608] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5612] <... rseq resumed>) = 0 [pid 5611] <... prctl resumed>) = 0 [pid 5610] <... openat resumed>) = 3 [pid 5612] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5611] setpgid(0, 0 [pid 5610] write(3, "1000", 4 [pid 5608] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] close(3 [pid 5612] <... set_robust_list resumed>) = 0 [pid 5611] <... setpgid resumed>) = 0 [pid 5610] <... write resumed>) = 4 [pid 5608] <... futex resumed>) = 0 [pid 5075] umount2("./53", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... close resumed>) = 0 [pid 5612] rt_sigprocmask(SIG_SETMASK, [], [pid 5611] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5610] close(3 [pid 5608] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] rmdir("./50" [pid 5612] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5611] <... openat resumed>) = 3 [pid 5610] <... close resumed>) = 0 [pid 5075] openat(AT_FDCWD, "./53", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5612] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5611] write(3, "1000", 4 [pid 5610] symlink("/dev/binderfs", "./binderfs" [pid 5075] <... openat resumed>) = 3 [pid 5611] <... write resumed>) = 4 [pid 5612] <... bpf resumed>) = 3 [pid 5611] close(3 [pid 5610] <... symlink resumed>) = 0 [pid 5075] newfstatat(3, "", [pid 5074] <... rmdir resumed>) = 0 [pid 5612] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5611] <... close resumed>) = 0 [pid 5610] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5612] <... futex resumed>) = 1 [pid 5611] symlink("/dev/binderfs", "./binderfs" [pid 5610] <... futex resumed>) = 0 [pid 5608] <... futex resumed>) = 0 [pid 5074] mkdir("./51", 0777 [pid 5612] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5611] <... symlink resumed>) = 0 [pid 5610] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5608] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] getdents64(3, [pid 5074] <... mkdir resumed>) = 0 [pid 5612] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5611] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5610] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5608] <... futex resumed>) = 0 [pid 5612] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5611] <... futex resumed>) = 0 [pid 5610] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5608] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5612] <... bpf resumed>) = 4 [pid 5611] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5610] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] umount2("./53/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5613 attached [pid 5612] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5611] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5610] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5613] set_robust_list(0x55555d6c46a0, 24 [pid 5612] <... futex resumed>) = 1 [pid 5611] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5610] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5608] <... futex resumed>) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5613] <... set_robust_list resumed>) = 0 [pid 5612] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5611] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5610] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5608] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] newfstatat(AT_FDCWD, "./53/binderfs", [pid 5612] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5611] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5610] <... mprotect resumed>) = 0 [pid 5612] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5611] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5608] <... futex resumed>) = 0 [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5613] chdir("./51" [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5613 [pid 5612] <... bpf resumed>) = 5 [pid 5610] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5608] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5613] <... chdir resumed>) = 0 [pid 5611] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5075] unlink("./53/binderfs" [pid 5613] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5612] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5610] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5608] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5613] <... prctl resumed>) = 0 [pid 5612] <... futex resumed>) = 0 [pid 5611] <... mprotect resumed>) = 0 [pid 5610] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5608] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... unlink resumed>) = 0 ./strace-static-x86_64: Process 5614 attached [pid 5613] setpgid(0, 0 [pid 5612] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5608] <... futex resumed>) = 0 [pid 5614] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5613] <... setpgid resumed>) = 0 [pid 5612] <... bpf resumed>) = 6 [pid 5611] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5610] <... clone3 resumed> => {parent_tid=[5614]}, 88) = 5614 [pid 5608] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5075] getdents64(3, [pid 5614] <... rseq resumed>) = 0 [pid 5613] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5612] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5611] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5610] rt_sigprocmask(SIG_SETMASK, [], [pid 5608] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5614] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5612] <... futex resumed>) = 0 [pid 5611] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5610] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 ./strace-static-x86_64: Process 5615 attached [pid 5614] <... set_robust_list resumed>) = 0 [pid 5613] <... openat resumed>) = 3 [pid 5612] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5610] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5608] exit_group(0 [pid 5075] close(3 [pid 5615] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5614] rt_sigprocmask(SIG_SETMASK, [], [pid 5613] write(3, "1000", 4 [pid 5612] <... futex resumed>) = ? [pid 5611] <... clone3 resumed> => {parent_tid=[5615]}, 88) = 5615 [pid 5610] <... futex resumed>) = 0 [pid 5608] <... exit_group resumed>) = ? [pid 5075] <... close resumed>) = 0 [pid 5615] <... rseq resumed>) = 0 [pid 5614] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5613] <... write resumed>) = 4 [pid 5612] +++ exited with 0 +++ [pid 5610] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5614] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5615] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5611] rt_sigprocmask(SIG_SETMASK, [], [pid 5608] +++ exited with 0 +++ [pid 5613] close(3 [pid 5075] rmdir("./53" [pid 5615] <... set_robust_list resumed>) = 0 [pid 5613] <... close resumed>) = 0 [pid 5611] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5614] <... bpf resumed>) = 3 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5608, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5075] <... rmdir resumed>) = 0 [pid 5615] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5614] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5613] symlink("/dev/binderfs", "./binderfs" [pid 5611] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] mkdir("./54", 0777 [pid 5615] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5614] <... futex resumed>) = 1 [pid 5613] <... symlink resumed>) = 0 [pid 5611] <... futex resumed>) = 0 [pid 5610] <... futex resumed>) = 0 [pid 5614] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5615] <... bpf resumed>) = 3 [pid 5611] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] <... mkdir resumed>) = 0 [pid 5615] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5613] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5610] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] umount2("./55", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5615] <... futex resumed>) = 0 [pid 5614] <... futex resumed>) = 0 [pid 5613] <... futex resumed>) = 0 [pid 5611] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5610] <... futex resumed>) = 1 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5615] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5614] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5613] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5611] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5610] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] openat(AT_FDCWD, "./55", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY./strace-static-x86_64: Process 5616 attached [pid 5615] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5614] <... bpf resumed>) = 4 [pid 5613] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5611] <... futex resumed>) = 0 [pid 5078] <... openat resumed>) = 3 [pid 5616] set_robust_list(0x55555d6c46a0, 24 [pid 5615] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5614] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5613] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5611] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] newfstatat(3, "", [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5616 [pid 5616] <... set_robust_list resumed>) = 0 [pid 5615] <... bpf resumed>) = 4 [pid 5614] <... futex resumed>) = 1 [pid 5613] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5610] <... futex resumed>) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5616] chdir("./54" [pid 5615] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5614] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5613] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5610] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] getdents64(3, [pid 5616] <... chdir resumed>) = 0 [pid 5615] <... futex resumed>) = 1 [pid 5614] <... bpf resumed>) = 5 [pid 5613] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5611] <... futex resumed>) = 0 [pid 5610] <... futex resumed>) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5616] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5615] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5614] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5613] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5611] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5610] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] umount2("./55/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5616] <... prctl resumed>) = 0 [pid 5615] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5614] <... futex resumed>) = 0 [pid 5613] <... mprotect resumed>) = 0 [pid 5611] <... futex resumed>) = 0 [pid 5610] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5616] setpgid(0, 0 [pid 5615] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5614] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5611] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5610] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5616] <... setpgid resumed>) = 0 [pid 5614] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5613] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5610] <... futex resumed>) = 0 [pid 5078] newfstatat(AT_FDCWD, "./55/binderfs", [pid 5616] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5615] <... bpf resumed>) = 5 [pid 5614] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5613] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5610] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5616] <... openat resumed>) = 3 [pid 5615] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5614] <... bpf resumed>) = 6 [pid 5613] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5078] unlink("./55/binderfs"./strace-static-x86_64: Process 5617 attached [pid 5616] write(3, "1000", 4 [pid 5615] <... futex resumed>) = 1 [pid 5614] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5611] <... futex resumed>) = 0 [pid 5078] <... unlink resumed>) = 0 [pid 5617] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5616] <... write resumed>) = 4 [pid 5615] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5614] <... futex resumed>) = 1 [pid 5613] <... clone3 resumed> => {parent_tid=[5617]}, 88) = 5617 [pid 5611] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5610] <... futex resumed>) = 0 [pid 5617] <... rseq resumed>) = 0 [pid 5616] close(3 [pid 5615] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5614] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5613] rt_sigprocmask(SIG_SETMASK, [], [pid 5611] <... futex resumed>) = 0 [pid 5610] exit_group(0 [pid 5078] getdents64(3, [pid 5617] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5616] <... close resumed>) = 0 [pid 5615] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5614] <... futex resumed>) = ? [pid 5613] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5611] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5610] <... exit_group resumed>) = ? [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5617] <... set_robust_list resumed>) = 0 [pid 5616] symlink("/dev/binderfs", "./binderfs" [pid 5615] <... bpf resumed>) = 6 [pid 5614] +++ exited with 0 +++ [pid 5613] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] close(3 [pid 5617] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5616] <... symlink resumed>) = 0 [pid 5615] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5613] <... futex resumed>) = 0 [pid 5078] <... close resumed>) = 0 [pid 5617] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5615] <... futex resumed>) = 1 [pid 5613] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5611] <... futex resumed>) = 0 [pid 5616] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5615] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5078] rmdir("./55" [pid 5617] <... bpf resumed>) = 3 [pid 5616] <... futex resumed>) = 0 [pid 5611] exit_group(0 [pid 5078] <... rmdir resumed>) = 0 [pid 5617] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5616] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5615] <... futex resumed>) = ? [pid 5611] <... exit_group resumed>) = ? [pid 5078] mkdir("./56", 0777 [pid 5617] <... futex resumed>) = 1 [pid 5616] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5615] +++ exited with 0 +++ [pid 5613] <... futex resumed>) = 0 [pid 5078] <... mkdir resumed>) = 0 [pid 5617] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5616] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5613] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5616] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5613] <... futex resumed>) = 0 [pid 5616] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5613] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5617] <... bpf resumed>) = 4 [pid 5616] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5618 attached [pid 5617] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5616] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5613] <... futex resumed>) = 0 [pid 5616] <... mprotect resumed>) = 0 [pid 5618] set_robust_list(0x55555d6c46a0, 24 [pid 5617] <... futex resumed>) = 1 [pid 5613] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5611] +++ exited with 0 +++ [pid 5610] +++ exited with 0 +++ [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5618 [pid 5618] <... set_robust_list resumed>) = 0 [pid 5617] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5616] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5613] <... futex resumed>) = 0 [pid 5618] chdir("./56" [pid 5616] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5613] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5610, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5611, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5618] <... chdir resumed>) = 0 [pid 5617] <... bpf resumed>) = 5 [pid 5616] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5077] restart_syscall(<... resuming interrupted clone ...>./strace-static-x86_64: Process 5619 attached [pid 5618] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5617] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... restart_syscall resumed>) = 0 [pid 5076] restart_syscall(<... resuming interrupted clone ...> [pid 5619] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5618] <... prctl resumed>) = 0 [pid 5617] <... futex resumed>) = 1 [pid 5616] <... clone3 resumed> => {parent_tid=[5619]}, 88) = 5619 [pid 5613] <... futex resumed>) = 0 [pid 5076] <... restart_syscall resumed>) = 0 [pid 5619] <... rseq resumed>) = 0 [pid 5618] setpgid(0, 0 [pid 5617] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5616] rt_sigprocmask(SIG_SETMASK, [], [pid 5613] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5619] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5618] <... setpgid resumed>) = 0 [pid 5617] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5616] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5613] <... futex resumed>) = 0 [pid 5077] umount2("./53", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5619] <... set_robust_list resumed>) = 0 [pid 5618] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5617] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5616] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5613] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] umount2("./52", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5619] rt_sigprocmask(SIG_SETMASK, [], [pid 5618] <... openat resumed>) = 3 [pid 5616] <... futex resumed>) = 0 [pid 5077] openat(AT_FDCWD, "./53", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5619] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5618] write(3, "1000", 4 [pid 5616] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... openat resumed>) = 3 [pid 5076] openat(AT_FDCWD, "./52", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5619] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5618] <... write resumed>) = 4 [pid 5077] newfstatat(3, "", [pid 5076] <... openat resumed>) = 3 [pid 5619] <... bpf resumed>) = 3 [pid 5618] close(3 [pid 5619] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5618] <... close resumed>) = 0 [pid 5619] <... futex resumed>) = 1 [pid 5618] symlink("/dev/binderfs", "./binderfs" [pid 5616] <... futex resumed>) = 0 [pid 5619] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL) = -1 EAGAIN (Resource temporarily unavailable) [pid 5618] <... symlink resumed>) = 0 [pid 5617] <... bpf resumed>) = 6 [pid 5616] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5076] newfstatat(3, "", [pid 5619] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5618] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5617] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5616] <... futex resumed>) = 0 [pid 5077] getdents64(3, [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5619] <... bpf resumed>) = 4 [pid 5618] <... futex resumed>) = 0 [pid 5617] <... futex resumed>) = 1 [pid 5616] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5613] <... futex resumed>) = 0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5076] getdents64(3, [pid 5619] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5618] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5617] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5616] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5613] exit_group(0 [pid 5077] umount2("./53/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5619] <... futex resumed>) = 0 [pid 5618] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5617] <... futex resumed>) = ? [pid 5616] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5613] <... exit_group resumed>) = ? [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5619] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5618] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5617] +++ exited with 0 +++ [pid 5077] newfstatat(AT_FDCWD, "./53/binderfs", [pid 5076] umount2("./52/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] newfstatat(AT_FDCWD, "./52/binderfs", [pid 5616] <... futex resumed>) = 0 [pid 5613] +++ exited with 0 +++ [pid 5077] unlink("./53/binderfs" [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5619] <... bpf resumed>) = 5 [pid 5618] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5616] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... unlink resumed>) = 0 [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5613, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5619] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5618] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5616] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5076] unlink("./52/binderfs" [pid 5619] <... futex resumed>) = 0 [pid 5618] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5616] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... unlink resumed>) = 0 [pid 5074] restart_syscall(<... resuming interrupted clone ...> [pid 5619] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5618] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5616] <... futex resumed>) = 0 [pid 5077] getdents64(3, [pid 5074] <... restart_syscall resumed>) = 0 [pid 5618] <... mprotect resumed>) = 0 [pid 5616] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5076] getdents64(3, [pid 5618] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5077] close(3 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5077] <... close resumed>) = 0 [pid 5618] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5618] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} => {parent_tid=[5620]}, 88) = 5620 ./strace-static-x86_64: Process 5620 attached [pid 5077] rmdir("./53" [pid 5076] close(3 [pid 5074] umount2("./51", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5618] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5618] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5618] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... rmdir resumed>) = 0 [pid 5076] <... close resumed>) = 0 [pid 5620] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5620] <... rseq resumed>) = 0 [pid 5076] rmdir("./52" [pid 5077] mkdir("./54", 0777 [pid 5074] openat(AT_FDCWD, "./51", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5620] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5074] <... openat resumed>) = 3 [pid 5620] <... set_robust_list resumed>) = 0 [pid 5076] <... rmdir resumed>) = 0 [pid 5620] rt_sigprocmask(SIG_SETMASK, [], [pid 5074] newfstatat(3, "", [pid 5077] <... mkdir resumed>) = 0 [pid 5620] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5076] mkdir("./53", 0777 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5620] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5074] getdents64(3, ./strace-static-x86_64: Process 5621 attached [pid 5620] <... bpf resumed>) = 3 [pid 5619] <... bpf resumed>) = 6 [pid 5076] <... mkdir resumed>) = 0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5620] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5621 [pid 5621] set_robust_list(0x55555d6c46a0, 24 [pid 5619] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5621] <... set_robust_list resumed>) = 0 [pid 5619] <... futex resumed>) = 1 [pid 5616] <... futex resumed>) = 0 [pid 5074] umount2("./51/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5620] <... futex resumed>) = 1 [pid 5618] <... futex resumed>) = 0 [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5621] chdir("./54" [pid 5620] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5619] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5618] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5616] exit_group(0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5622 attached [pid 5621] <... chdir resumed>) = 0 [pid 5620] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5619] <... futex resumed>) = ? [pid 5618] <... futex resumed>) = 0 [pid 5616] <... exit_group resumed>) = ? [pid 5074] newfstatat(AT_FDCWD, "./51/binderfs", [pid 5622] set_robust_list(0x55555d6c46a0, 24 [pid 5621] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5620] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5619] +++ exited with 0 +++ [pid 5618] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5622] <... set_robust_list resumed>) = 0 [pid 5621] <... prctl resumed>) = 0 [pid 5622] chdir("./53" [pid 5621] setpgid(0, 0 [pid 5620] <... bpf resumed>) = 4 [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5622 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5622] <... chdir resumed>) = 0 [pid 5621] <... setpgid resumed>) = 0 [pid 5620] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5616] +++ exited with 0 +++ [pid 5074] unlink("./51/binderfs" [pid 5622] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5621] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5620] <... futex resumed>) = 1 [pid 5618] <... futex resumed>) = 0 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5616, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5622] <... prctl resumed>) = 0 [pid 5621] <... openat resumed>) = 3 [pid 5620] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5618] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] restart_syscall(<... resuming interrupted clone ...> [pid 5074] <... unlink resumed>) = 0 [pid 5622] setpgid(0, 0 [pid 5621] write(3, "1000", 4 [pid 5620] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5618] <... futex resumed>) = 0 [pid 5622] <... setpgid resumed>) = 0 [pid 5621] <... write resumed>) = 4 [pid 5075] <... restart_syscall resumed>) = 0 [pid 5618] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5621] close(3 [pid 5620] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5622] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5074] getdents64(3, [pid 5622] <... openat resumed>) = 3 [pid 5621] <... close resumed>) = 0 [pid 5620] <... bpf resumed>) = 5 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5622] write(3, "1000", 4 [pid 5621] symlink("/dev/binderfs", "./binderfs" [pid 5075] umount2("./54", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5622] <... write resumed>) = 4 [pid 5074] close(3 [pid 5622] close(3 [pid 5621] <... symlink resumed>) = 0 [pid 5620] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] <... close resumed>) = 0 [pid 5622] <... close resumed>) = 0 [pid 5621] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5620] <... futex resumed>) = 1 [pid 5618] <... futex resumed>) = 0 [pid 5075] openat(AT_FDCWD, "./54", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5074] rmdir("./51" [pid 5622] symlink("/dev/binderfs", "./binderfs" [pid 5621] <... futex resumed>) = 0 [pid 5620] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5618] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... openat resumed>) = 3 [pid 5074] <... rmdir resumed>) = 0 [pid 5622] <... symlink resumed>) = 0 [pid 5621] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5618] <... futex resumed>) = 0 [pid 5075] newfstatat(3, "", [pid 5622] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5621] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5620] <... bpf resumed>) = 6 [pid 5618] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5074] mkdir("./52", 0777 [pid 5622] <... futex resumed>) = 0 [pid 5621] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5620] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5618] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5074] <... mkdir resumed>) = 0 [pid 5622] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5621] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5620] <... futex resumed>) = 0 [pid 5618] exit_group(0 [pid 5075] getdents64(3, [pid 5622] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5621] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5618] <... exit_group resumed>) = ? [pid 5622] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5621] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5622] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5621] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5622] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5075] umount2("./54/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5621] <... mprotect resumed>) = 0 ./strace-static-x86_64: Process 5623 attached [pid 5622] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5621] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5620] +++ exited with 0 +++ [pid 5618] +++ exited with 0 +++ [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5623] set_robust_list(0x55555d6c46a0, 24 [pid 5622] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5621] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5075] newfstatat(AT_FDCWD, "./54/binderfs", [pid 5623] <... set_robust_list resumed>) = 0 [pid 5622] <... mprotect resumed>) = 0 [pid 5621] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5623] chdir("./52" [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5623 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5618, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- ./strace-static-x86_64: Process 5624 attached [pid 5623] <... chdir resumed>) = 0 [pid 5622] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5621] <... clone3 resumed> => {parent_tid=[5624]}, 88) = 5624 [pid 5078] restart_syscall(<... resuming interrupted clone ...> [pid 5075] unlink("./54/binderfs" [pid 5624] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5623] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5622] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5621] rt_sigprocmask(SIG_SETMASK, [], [pid 5078] <... restart_syscall resumed>) = 0 [pid 5075] <... unlink resumed>) = 0 [pid 5624] <... rseq resumed>) = 0 [pid 5078] umount2("./56", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5623] <... prctl resumed>) = 0 [pid 5622] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5621] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5624] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5623] setpgid(0, 0 [pid 5621] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] openat(AT_FDCWD, "./56", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY./strace-static-x86_64: Process 5625 attached [pid 5624] <... set_robust_list resumed>) = 0 [pid 5623] <... setpgid resumed>) = 0 [pid 5621] <... futex resumed>) = 0 [pid 5078] <... openat resumed>) = 3 [pid 5075] getdents64(3, [pid 5625] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5624] rt_sigprocmask(SIG_SETMASK, [], [pid 5078] newfstatat(3, "", [pid 5625] <... rseq resumed>) = 0 [pid 5624] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5623] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5622] <... clone3 resumed> => {parent_tid=[5625]}, 88) = 5625 [pid 5621] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5625] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5624] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5622] rt_sigprocmask(SIG_SETMASK, [], [pid 5075] close(3 [pid 5625] <... set_robust_list resumed>) = 0 [pid 5624] <... bpf resumed>) = 3 [pid 5623] <... openat resumed>) = 3 [pid 5622] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] getdents64(3, [pid 5625] rt_sigprocmask(SIG_SETMASK, [], [pid 5624] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5623] write(3, "1000", 4 [pid 5622] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5075] <... close resumed>) = 0 [pid 5625] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5624] <... futex resumed>) = 1 [pid 5623] <... write resumed>) = 4 [pid 5622] <... futex resumed>) = 0 [pid 5621] <... futex resumed>) = 0 [pid 5078] umount2("./56/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] rmdir("./54" [pid 5625] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5624] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5623] close(3 [pid 5622] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5621] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5625] <... bpf resumed>) = 3 [pid 5624] <... bpf resumed>) = 4 [pid 5623] <... close resumed>) = 0 [pid 5621] <... futex resumed>) = 0 [pid 5078] newfstatat(AT_FDCWD, "./56/binderfs", [pid 5075] <... rmdir resumed>) = 0 [pid 5625] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5624] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5623] symlink("/dev/binderfs", "./binderfs" [pid 5621] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5075] mkdir("./55", 0777 [pid 5625] <... futex resumed>) = 1 [pid 5624] <... futex resumed>) = 0 [pid 5623] <... symlink resumed>) = 0 [pid 5622] <... futex resumed>) = 0 [pid 5621] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5078] unlink("./56/binderfs" [pid 5625] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5624] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5623] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5622] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5621] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... unlink resumed>) = 0 [pid 5075] <... mkdir resumed>) = 0 [pid 5625] <... bpf resumed>) = 4 [pid 5624] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5623] <... futex resumed>) = 0 [pid 5622] <... futex resumed>) = 0 [pid 5621] <... futex resumed>) = 0 [pid 5078] getdents64(3, [pid 5625] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5624] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5623] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5622] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5621] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5625] <... futex resumed>) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5625] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5624] <... bpf resumed>) = 5 [pid 5623] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5622] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5078] close(3) = 0 [pid 5078] rmdir("./56" [pid 5623] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], ./strace-static-x86_64: Process 5626 attached [pid 5624] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5622] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... rmdir resumed>) = 0 [pid 5623] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5626] set_robust_list(0x55555d6c46a0, 24 [pid 5625] <... futex resumed>) = 0 [pid 5624] <... futex resumed>) = 1 [pid 5622] <... futex resumed>) = 1 [pid 5621] <... futex resumed>) = 0 [pid 5623] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5626 [pid 5626] <... set_robust_list resumed>) = 0 [pid 5625] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5624] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5623] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5622] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5621] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] mkdir("./57", 0777 [pid 5626] chdir("./55" [pid 5625] <... bpf resumed>) = 5 [pid 5624] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5623] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5621] <... futex resumed>) = 0 [pid 5078] <... mkdir resumed>) = 0 [pid 5626] <... chdir resumed>) = 0 [pid 5625] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5624] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5623] <... mprotect resumed>) = 0 [pid 5621] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5626] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5625] <... futex resumed>) = 1 [pid 5624] <... bpf resumed>) = 6 [pid 5622] <... futex resumed>) = 0 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5626] <... prctl resumed>) = 0 [pid 5625] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5624] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5623] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5622] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5627 attached [pid 5626] setpgid(0, 0 [pid 5625] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5624] <... futex resumed>) = 1 [pid 5623] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5622] <... futex resumed>) = 0 [pid 5621] <... futex resumed>) = 0 [pid 5627] set_robust_list(0x55555d6c46a0, 24 [pid 5626] <... setpgid resumed>) = 0 [pid 5625] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5624] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5623] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5622] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5621] exit_group(0 [pid 5627] <... set_robust_list resumed>) = 0 [pid 5626] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC./strace-static-x86_64: Process 5628 attached [pid 5627] chdir("./57" [pid 5625] <... bpf resumed>) = 6 [pid 5624] <... futex resumed>) = ? [pid 5623] <... clone3 resumed> => {parent_tid=[5628]}, 88) = 5628 [pid 5621] <... exit_group resumed>) = ? [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5627 [pid 5626] <... openat resumed>) = 3 [pid 5628] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5627] <... chdir resumed>) = 0 [pid 5625] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5623] rt_sigprocmask(SIG_SETMASK, [], [pid 5625] <... futex resumed>) = 1 [pid 5622] <... futex resumed>) = 0 [pid 5625] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5622] exit_group(0 [pid 5628] <... rseq resumed>) = 0 [pid 5627] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5626] write(3, "1000", 4 [pid 5623] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5628] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5627] <... prctl resumed>) = 0 [pid 5626] <... write resumed>) = 4 [pid 5625] <... futex resumed>) = ? [pid 5623] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5622] <... exit_group resumed>) = ? [pid 5628] <... set_robust_list resumed>) = 0 [pid 5627] setpgid(0, 0 [pid 5626] close(3 [pid 5625] +++ exited with 0 +++ [pid 5623] <... futex resumed>) = 0 [pid 5628] rt_sigprocmask(SIG_SETMASK, [], [pid 5627] <... setpgid resumed>) = 0 [pid 5626] <... close resumed>) = 0 [pid 5623] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5628] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5628] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5627] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5626] symlink("/dev/binderfs", "./binderfs" [pid 5628] <... bpf resumed>) = 3 [pid 5628] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5627] <... openat resumed>) = 3 [pid 5626] <... symlink resumed>) = 0 [pid 5623] <... futex resumed>) = 0 [pid 5628] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5627] write(3, "1000", 4 [pid 5626] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5623] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5628] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5627] <... write resumed>) = 4 [pid 5626] <... futex resumed>) = 0 [pid 5623] <... futex resumed>) = 0 [pid 5628] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5627] close(3 [pid 5626] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5623] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5628] <... bpf resumed>) = 4 [pid 5627] <... close resumed>) = 0 [pid 5626] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5627] symlink("/dev/binderfs", "./binderfs" [pid 5624] +++ exited with 0 +++ [pid 5626] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5621] +++ exited with 0 +++ [pid 5628] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5626] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5628] <... futex resumed>) = 1 [pid 5626] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5628] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5623] <... futex resumed>) = 0 [pid 5627] <... symlink resumed>) = 0 [pid 5626] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5623] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5627] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5626] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5628] <... futex resumed>) = 0 [pid 5627] <... futex resumed>) = 0 [pid 5623] <... futex resumed>) = 1 [pid 5626] <... mprotect resumed>) = 0 [pid 5628] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5627] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5623] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5627] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5626] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5622] +++ exited with 0 +++ [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5621, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5628] <... bpf resumed>) = 5 [pid 5627] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5077] umount2("./54", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5626] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5628] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5627] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5622, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5628] <... futex resumed>) = 1 [pid 5627] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5626] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5623] <... futex resumed>) = 0 [pid 5077] openat(AT_FDCWD, "./54", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5076] restart_syscall(<... resuming interrupted clone ...>./strace-static-x86_64: Process 5629 attached [pid 5628] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5627] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5623] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... openat resumed>) = 3 [pid 5076] <... restart_syscall resumed>) = 0 [pid 5629] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5628] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5627] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5626] <... clone3 resumed> => {parent_tid=[5629]}, 88) = 5629 [pid 5623] <... futex resumed>) = 0 [pid 5077] newfstatat(3, "", [pid 5629] <... rseq resumed>) = 0 [pid 5628] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5627] <... mprotect resumed>) = 0 [pid 5626] rt_sigprocmask(SIG_SETMASK, [], [pid 5623] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5629] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5628] <... bpf resumed>) = 6 [pid 5627] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5626] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] getdents64(3, [pid 5076] umount2("./53", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5629] <... set_robust_list resumed>) = 0 [pid 5628] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5627] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5626] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5629] rt_sigprocmask(SIG_SETMASK, [], [pid 5628] <... futex resumed>) = 1 [pid 5627] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5626] <... futex resumed>) = 0 [pid 5623] <... futex resumed>) = 0 [pid 5077] umount2("./54/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5630 attached [pid 5629] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5628] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5626] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5623] exit_group(0 [pid 5076] openat(AT_FDCWD, "./53", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5630] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5629] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5627] <... clone3 resumed> => {parent_tid=[5630]}, 88) = 5630 [pid 5623] <... exit_group resumed>) = ? [pid 5630] <... rseq resumed>) = 0 [pid 5629] <... bpf resumed>) = 3 [pid 5627] rt_sigprocmask(SIG_SETMASK, [], [pid 5630] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5629] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5630] <... set_robust_list resumed>) = 0 [pid 5627] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5630] rt_sigprocmask(SIG_SETMASK, [], [pid 5629] <... futex resumed>) = 1 [pid 5626] <... futex resumed>) = 0 [pid 5630] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5629] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5627] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5626] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5630] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5629] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5628] <... futex resumed>) = ? [pid 5627] <... futex resumed>) = 0 [pid 5626] <... futex resumed>) = 0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] <... openat resumed>) = 3 [pid 5630] <... bpf resumed>) = 3 [pid 5629] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5628] +++ exited with 0 +++ [pid 5627] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5626] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5623] +++ exited with 0 +++ [pid 5077] newfstatat(AT_FDCWD, "./54/binderfs", [pid 5076] newfstatat(3, "", [pid 5630] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5629] <... bpf resumed>) = 4 [pid 5627] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5623, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5630] <... futex resumed>) = 0 [pid 5629] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5627] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] unlink("./54/binderfs" [pid 5076] getdents64(3, [pid 5630] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5629] <... futex resumed>) = 1 [pid 5627] <... futex resumed>) = 0 [pid 5626] <... futex resumed>) = 0 [pid 5077] <... unlink resumed>) = 0 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5630] <... bpf resumed>) = 4 [pid 5629] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5627] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5626] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] getdents64(3, [pid 5076] umount2("./53/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] umount2("./52", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5630] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5629] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5627] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5626] <... futex resumed>) = 0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5630] <... futex resumed>) = 0 [pid 5629] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5627] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5626] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] close(3 [pid 5076] newfstatat(AT_FDCWD, "./53/binderfs", [pid 5074] openat(AT_FDCWD, "./52", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5630] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5629] <... bpf resumed>) = 5 [pid 5627] <... futex resumed>) = 0 [pid 5077] <... close resumed>) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] <... openat resumed>) = 3 [pid 5077] rmdir("./54" [pid 5076] unlink("./53/binderfs" [pid 5074] newfstatat(3, "", [pid 5630] <... bpf resumed>) = 5 [pid 5629] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5627] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... rmdir resumed>) = 0 [pid 5076] <... unlink resumed>) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5629] <... futex resumed>) = 1 [pid 5630] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5626] <... futex resumed>) = 0 [pid 5077] mkdir("./55", 0777 [pid 5076] getdents64(3, [pid 5074] getdents64(3, [pid 5630] <... futex resumed>) = 1 [pid 5629] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5627] <... futex resumed>) = 0 [pid 5626] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... mkdir resumed>) = 0 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5630] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5629] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5627] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5626] <... futex resumed>) = 0 [pid 5630] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5629] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5627] <... futex resumed>) = 0 [pid 5626] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5630] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5627] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5630] <... bpf resumed>) = 6 [pid 5629] <... bpf resumed>) = 6 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5076] close(3 [pid 5074] umount2("./52/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5631 attached [pid 5630] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5629] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... close resumed>) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] rmdir("./53" [pid 5074] newfstatat(AT_FDCWD, "./52/binderfs", [pid 5631] set_robust_list(0x55555d6c46a0, 24 [pid 5630] <... futex resumed>) = 1 [pid 5629] <... futex resumed>) = 1 [pid 5627] <... futex resumed>) = 0 [pid 5626] <... futex resumed>) = 0 [pid 5076] <... rmdir resumed>) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5627] exit_group(0 [pid 5626] exit_group(0 [pid 5631] <... set_robust_list resumed>) = 0 [pid 5630] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5629] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5627] <... exit_group resumed>) = ? [pid 5631] chdir("./55" [pid 5630] <... futex resumed>) = ? [pid 5629] <... futex resumed>) = ? [pid 5626] <... exit_group resumed>) = ? [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5631 [pid 5076] mkdir("./54", 0777 [pid 5074] unlink("./52/binderfs" [pid 5631] <... chdir resumed>) = 0 [pid 5629] +++ exited with 0 +++ [pid 5631] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5630] +++ exited with 0 +++ [pid 5627] +++ exited with 0 +++ [pid 5626] +++ exited with 0 +++ [pid 5076] <... mkdir resumed>) = 0 [pid 5074] <... unlink resumed>) = 0 [pid 5631] setpgid(0, 0 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5627, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5631] <... setpgid resumed>) = 0 [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] getdents64(3, ./strace-static-x86_64: Process 5632 attached [pid 5631] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5626, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5632] set_robust_list(0x55555d6c46a0, 24 [pid 5631] <... openat resumed>) = 3 [pid 5075] umount2("./55", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5632] <... set_robust_list resumed>) = 0 [pid 5631] write(3, "1000", 4 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5632] chdir("./54" [pid 5631] <... write resumed>) = 4 [pid 5075] openat(AT_FDCWD, "./55", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5632] <... chdir resumed>) = 0 [pid 5631] close(3 [pid 5632] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5631] <... close resumed>) = 0 [pid 5078] umount2("./57", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] <... openat resumed>) = 3 [pid 5074] close(3 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5632 [pid 5074] <... close resumed>) = 0 [pid 5078] openat(AT_FDCWD, "./57", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5074] rmdir("./52" [pid 5632] <... prctl resumed>) = 0 [pid 5631] symlink("/dev/binderfs", "./binderfs" [pid 5078] <... openat resumed>) = 3 [pid 5075] newfstatat(3, "", [pid 5074] <... rmdir resumed>) = 0 [pid 5632] setpgid(0, 0 [pid 5078] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5074] mkdir("./53", 0777 [pid 5078] getdents64(3, [pid 5074] <... mkdir resumed>) = 0 [pid 5631] <... symlink resumed>) = 0 [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5632] <... setpgid resumed>) = 0 [pid 5631] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] getdents64(3, [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5632] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5631] <... futex resumed>) = 0 [pid 5078] umount2("./57/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5631] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] umount2("./55/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5633 attached [pid 5632] <... openat resumed>) = 3 [pid 5631] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5078] newfstatat(AT_FDCWD, "./57/binderfs", [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5633] set_robust_list(0x55555d6c46a0, 24 [pid 5632] write(3, "1000", 4 [pid 5631] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5075] newfstatat(AT_FDCWD, "./55/binderfs", [pid 5633] <... set_robust_list resumed>) = 0 [pid 5631] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5631] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5633] chdir("./53" [pid 5632] <... write resumed>) = 4 [pid 5631] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5078] unlink("./57/binderfs" [pid 5075] unlink("./55/binderfs" [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5633 [pid 5633] <... chdir resumed>) = 0 [pid 5632] close(3 [pid 5631] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5078] <... unlink resumed>) = 0 [pid 5633] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5632] <... close resumed>) = 0 [pid 5075] <... unlink resumed>) = 0 [pid 5633] <... prctl resumed>) = 0 [pid 5631] <... mprotect resumed>) = 0 [pid 5075] getdents64(3, [pid 5633] setpgid(0, 0 [pid 5632] symlink("/dev/binderfs", "./binderfs" [pid 5078] getdents64(3, [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5633] <... setpgid resumed>) = 0 [pid 5632] <... symlink resumed>) = 0 [pid 5631] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5075] close(3 [pid 5633] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5632] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5631] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5078] close(3 [pid 5075] <... close resumed>) = 0 [pid 5633] <... openat resumed>) = 3 [pid 5632] <... futex resumed>) = 0 [pid 5631] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5078] <... close resumed>) = 0 [pid 5075] rmdir("./55"./strace-static-x86_64: Process 5634 attached [pid 5633] write(3, "1000", 4 [pid 5632] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5078] rmdir("./57" [pid 5634] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5633] <... write resumed>) = 4 [pid 5632] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5631] <... clone3 resumed> => {parent_tid=[5634]}, 88) = 5634 [pid 5078] <... rmdir resumed>) = 0 [pid 5075] <... rmdir resumed>) = 0 [pid 5634] <... rseq resumed>) = 0 [pid 5633] close(3 [pid 5632] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5631] rt_sigprocmask(SIG_SETMASK, [], [pid 5075] mkdir("./56", 0777 [pid 5634] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5633] <... close resumed>) = 0 [pid 5632] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5631] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] mkdir("./58", 0777 [pid 5634] <... set_robust_list resumed>) = 0 [pid 5633] symlink("/dev/binderfs", "./binderfs" [pid 5632] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5631] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... mkdir resumed>) = 0 [pid 5075] <... mkdir resumed>) = 0 [pid 5634] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5633] <... symlink resumed>) = 0 [pid 5632] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5631] <... futex resumed>) = 0 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5631] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5634] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5632] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5633] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5636 attached ./strace-static-x86_64: Process 5635 attached ) = 0 [pid 5632] <... mprotect resumed>) = 0 [pid 5636] set_robust_list(0x55555d6c46a0, 24 [pid 5635] set_robust_list(0x55555d6c46a0, 24 [pid 5634] <... bpf resumed>) = 3 [pid 5633] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5636 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5635 [pid 5636] <... set_robust_list resumed>) = 0 [pid 5635] <... set_robust_list resumed>) = 0 [pid 5634] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5633] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5632] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5636] chdir("./58" [pid 5635] chdir("./56" [pid 5636] <... chdir resumed>) = 0 [pid 5634] <... futex resumed>) = 1 [pid 5633] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5632] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5631] <... futex resumed>) = 0 [pid 5636] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5635] <... chdir resumed>) = 0 [pid 5634] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5633] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5632] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5631] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5637 attached [pid 5636] <... prctl resumed>) = 0 [pid 5635] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5634] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5633] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5631] <... futex resumed>) = 0 [pid 5637] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5636] setpgid(0, 0 [pid 5635] <... prctl resumed>) = 0 [pid 5633] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5634] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5632] <... clone3 resumed> => {parent_tid=[5637]}, 88) = 5637 [pid 5631] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5637] <... rseq resumed>) = 0 [pid 5636] <... setpgid resumed>) = 0 [pid 5635] setpgid(0, 0 [pid 5633] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5632] rt_sigprocmask(SIG_SETMASK, [], [pid 5637] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5636] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5635] <... setpgid resumed>) = 0 [pid 5634] <... bpf resumed>) = 4 [pid 5632] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5637] <... set_robust_list resumed>) = 0 [pid 5635] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5634] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5633] <... mprotect resumed>) = 0 [pid 5632] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5637] rt_sigprocmask(SIG_SETMASK, [], [pid 5636] <... openat resumed>) = 3 [pid 5634] <... futex resumed>) = 1 [pid 5632] <... futex resumed>) = 0 [pid 5631] <... futex resumed>) = 0 [pid 5637] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5636] write(3, "1000", 4 [pid 5635] <... openat resumed>) = 3 [pid 5634] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5633] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5632] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5631] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5637] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5636] <... write resumed>) = 4 [pid 5635] write(3, "1000", 4 [pid 5631] <... futex resumed>) = 0 [pid 5637] <... bpf resumed>) = 3 [pid 5636] close(3 [pid 5635] <... write resumed>) = 4 [pid 5634] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5633] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5631] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5637] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5636] <... close resumed>) = 0 [pid 5635] close(3 [pid 5634] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5637] <... futex resumed>) = 1 [pid 5636] symlink("/dev/binderfs", "./binderfs" [pid 5635] <... close resumed>) = 0 [pid 5633] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5632] <... futex resumed>) = 0 [pid 5637] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5636] <... symlink resumed>) = 0 [pid 5635] symlink("/dev/binderfs", "./binderfs" [pid 5632] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5637] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5632] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5638 attached [pid 5637] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5636] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5635] <... symlink resumed>) = 0 [pid 5634] <... bpf resumed>) = 5 [pid 5633] <... clone3 resumed> => {parent_tid=[5638]}, 88) = 5638 [pid 5632] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5638] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053) = 0 [pid 5637] <... bpf resumed>) = 4 [pid 5636] <... futex resumed>) = 0 [pid 5635] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5634] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5633] rt_sigprocmask(SIG_SETMASK, [], [pid 5638] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5634] <... futex resumed>) = 1 [pid 5633] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5631] <... futex resumed>) = 0 [pid 5638] <... set_robust_list resumed>) = 0 [pid 5634] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5631] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5638] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5634] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5631] <... futex resumed>) = 0 [pid 5638] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5634] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5633] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5631] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5638] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5637] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5636] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5635] <... futex resumed>) = 0 [pid 5634] <... bpf resumed>) = 6 [pid 5633] <... futex resumed>) = 0 [pid 5638] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5634] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5633] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5638] <... bpf resumed>) = 3 [pid 5634] <... futex resumed>) = 1 [pid 5638] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5634] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5631] <... futex resumed>) = 0 [pid 5638] <... futex resumed>) = 1 [pid 5633] <... futex resumed>) = 0 [pid 5631] exit_group(0 [pid 5633] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5638] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5634] <... futex resumed>) = ? [pid 5633] <... futex resumed>) = 0 [pid 5631] <... exit_group resumed>) = ? [pid 5638] <... bpf resumed>) = 4 [pid 5637] <... futex resumed>) = 1 [pid 5636] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5635] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5634] +++ exited with 0 +++ [pid 5633] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5632] <... futex resumed>) = 0 [pid 5637] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5636] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5635] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5636] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5635] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5638] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5636] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5635] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5633] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5632] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5631] +++ exited with 0 +++ [pid 5638] <... futex resumed>) = 0 [pid 5637] <... futex resumed>) = 0 [pid 5636] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5635] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5633] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5632] <... futex resumed>) = 1 [pid 5638] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5637] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5636] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5635] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5633] <... futex resumed>) = 0 [pid 5632] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5638] <... bpf resumed>) = 5 [pid 5636] <... mprotect resumed>) = 0 [pid 5635] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5638] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5637] <... bpf resumed>) = 5 [pid 5636] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5635] <... mprotect resumed>) = 0 [pid 5633] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5631, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5638] <... futex resumed>) = 0 [pid 5637] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5636] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5635] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5633] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5077] umount2("./55", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5638] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5637] <... futex resumed>) = 1 [pid 5636] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5635] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5633] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5632] <... futex resumed>) = 0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5639 attached [pid 5638] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5637] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5635] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5633] <... futex resumed>) = 0 [pid 5632] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5640 attached [pid 5639] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5638] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5637] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5636] <... clone3 resumed> => {parent_tid=[5639]}, 88) = 5639 [pid 5077] openat(AT_FDCWD, "./55", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5640] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5639] <... rseq resumed>) = 0 [pid 5637] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5636] rt_sigprocmask(SIG_SETMASK, [], [pid 5633] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5632] <... futex resumed>) = 0 [pid 5640] <... rseq resumed>) = 0 [pid 5639] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5636] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5635] <... clone3 resumed> => {parent_tid=[5640]}, 88) = 5640 [pid 5632] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] <... openat resumed>) = 3 [pid 5640] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5639] <... set_robust_list resumed>) = 0 [pid 5638] <... bpf resumed>) = 6 [pid 5637] <... bpf resumed>) = 6 [pid 5636] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5635] rt_sigprocmask(SIG_SETMASK, [], [pid 5077] newfstatat(3, "", [pid 5638] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5637] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5640] <... set_robust_list resumed>) = 0 [pid 5639] rt_sigprocmask(SIG_SETMASK, [], [pid 5638] <... futex resumed>) = 1 [pid 5637] <... futex resumed>) = 1 [pid 5636] <... futex resumed>) = 0 [pid 5635] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5633] <... futex resumed>) = 0 [pid 5632] <... futex resumed>) = 0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5640] rt_sigprocmask(SIG_SETMASK, [], [pid 5639] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5638] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5637] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5636] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5635] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5633] exit_group(0 [pid 5632] exit_group(0 [pid 5077] getdents64(3, [pid 5640] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5639] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5638] <... futex resumed>) = ? [pid 5637] <... futex resumed>) = ? [pid 5635] <... futex resumed>) = 0 [pid 5633] <... exit_group resumed>) = ? [pid 5632] <... exit_group resumed>) = ? [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5640] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5638] +++ exited with 0 +++ [pid 5637] +++ exited with 0 +++ [pid 5635] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5640] <... bpf resumed>) = 3 [pid 5077] umount2("./55/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5640] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5640] <... futex resumed>) = 1 [pid 5635] <... futex resumed>) = 0 [pid 5077] newfstatat(AT_FDCWD, "./55/binderfs", [pid 5640] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5639] <... bpf resumed>) = 3 [pid 5635] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5632] +++ exited with 0 +++ [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5640] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5635] <... futex resumed>) = 0 [pid 5077] unlink("./55/binderfs" [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5632, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5640] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5635] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... unlink resumed>) = 0 [pid 5076] restart_syscall(<... resuming interrupted clone ...> [pid 5640] <... bpf resumed>) = 4 [pid 5076] <... restart_syscall resumed>) = 0 [pid 5640] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] getdents64(3, [pid 5640] <... futex resumed>) = 1 [pid 5635] <... futex resumed>) = 0 [pid 5633] +++ exited with 0 +++ [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5076] umount2("./54", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5640] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5639] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5635] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] close(3 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5633, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5640] <... bpf resumed>) = 5 [pid 5639] <... futex resumed>) = 1 [pid 5636] <... futex resumed>) = 0 [pid 5635] <... futex resumed>) = 0 [pid 5077] <... close resumed>) = 0 [pid 5076] openat(AT_FDCWD, "./54", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5639] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5636] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5639] <... futex resumed>) = 0 [pid 5636] <... futex resumed>) = 1 [pid 5635] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] rmdir("./55" [pid 5076] <... openat resumed>) = 3 [pid 5640] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5639] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5636] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... rmdir resumed>) = 0 [pid 5076] newfstatat(3, "", [pid 5640] <... futex resumed>) = 1 [pid 5635] <... futex resumed>) = 0 [pid 5635] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5640] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5635] <... futex resumed>) = 0 [pid 5076] getdents64(3, [pid 5639] <... bpf resumed>) = 4 [pid 5635] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] mkdir("./56", 0777 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5074] umount2("./53", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5639] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... mkdir resumed>) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5639] <... futex resumed>) = 1 [pid 5639] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5074] openat(AT_FDCWD, "./53", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5636] <... futex resumed>) = 0 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5636] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5639] <... futex resumed>) = 0 [pid 5076] umount2("./54/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... openat resumed>) = 3 [pid 5640] <... bpf resumed>) = 6 [pid 5639] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5636] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] newfstatat(3, "", [pid 5640] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] newfstatat(AT_FDCWD, "./54/binderfs", [pid 5640] <... futex resumed>) = 1 [pid 5635] <... futex resumed>) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5640] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5635] exit_group(0 [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5641 [pid 5076] unlink("./54/binderfs" [pid 5640] <... futex resumed>) = ? [pid 5635] <... exit_group resumed>) = ? [pid 5076] <... unlink resumed>) = 0 ./strace-static-x86_64: Process 5641 attached [pid 5640] +++ exited with 0 +++ [pid 5639] <... bpf resumed>) = 5 [pid 5635] +++ exited with 0 +++ [pid 5074] getdents64(3, [pid 5641] set_robust_list(0x55555d6c46a0, 24 [pid 5639] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] getdents64(3, [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5635, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5641] <... set_robust_list resumed>) = 0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5641] chdir("./56" [pid 5639] <... futex resumed>) = 1 [pid 5636] <... futex resumed>) = 0 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5636] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5636] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5076] close(3) = 0 [pid 5076] rmdir("./54" [pid 5074] umount2("./53/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5639] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5641] <... chdir resumed>) = 0 [pid 5639] <... bpf resumed>) = 6 [pid 5074] newfstatat(AT_FDCWD, "./53/binderfs", [pid 5641] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5639] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5641] <... prctl resumed>) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5639] <... futex resumed>) = 1 [pid 5636] <... futex resumed>) = 0 [pid 5641] setpgid(0, 0 [pid 5639] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5636] exit_group(0 [pid 5074] unlink("./53/binderfs" [pid 5641] <... setpgid resumed>) = 0 [pid 5639] <... futex resumed>) = ? [pid 5636] <... exit_group resumed>) = ? [pid 5641] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5076] <... rmdir resumed>) = 0 [pid 5074] <... unlink resumed>) = 0 [pid 5074] getdents64(3, [pid 5075] umount2("./56", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5641] <... openat resumed>) = 3 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5076] mkdir("./55", 0777 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] close(3 [pid 5641] write(3, "1000", 4 [pid 5075] openat(AT_FDCWD, "./56", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5641] <... write resumed>) = 4 [pid 5074] <... close resumed>) = 0 [pid 5641] close(3 [pid 5076] <... mkdir resumed>) = 0 [pid 5075] <... openat resumed>) = 3 [pid 5641] <... close resumed>) = 0 [pid 5075] newfstatat(3, "", [pid 5074] rmdir("./53" [pid 5641] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5639] +++ exited with 0 +++ [pid 5636] +++ exited with 0 +++ [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5074] <... rmdir resumed>) = 0 [pid 5641] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5636, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5075] getdents64(3, ./strace-static-x86_64: Process 5642 attached [pid 5641] <... futex resumed>) = 0 [pid 5074] mkdir("./54", 0777 [pid 5642] set_robust_list(0x55555d6c46a0, 24 [pid 5641] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5642] <... set_robust_list resumed>) = 0 [pid 5641] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5078] umount2("./58", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] umount2("./56/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... mkdir resumed>) = 0 [pid 5642] chdir("./55" [pid 5641] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5642] <... chdir resumed>) = 0 [pid 5641] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] openat(AT_FDCWD, "./58", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5642 [pid 5075] newfstatat(AT_FDCWD, "./56/binderfs", [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5642] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5641] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5078] <... openat resumed>) = 3 [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5641] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5078] newfstatat(3, "", ./strace-static-x86_64: Process 5643 attached [pid 5642] <... prctl resumed>) = 0 [pid 5641] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5075] unlink("./56/binderfs" [pid 5643] set_robust_list(0x55555d6c46a0, 24 [pid 5642] setpgid(0, 0 [pid 5641] <... mprotect resumed>) = 0 [pid 5078] getdents64(3, [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5643 [pid 5643] <... set_robust_list resumed>) = 0 [pid 5642] <... setpgid resumed>) = 0 [pid 5641] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5075] <... unlink resumed>) = 0 [pid 5643] chdir("./54" [pid 5642] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5641] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5078] umount2("./58/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5643] <... chdir resumed>) = 0 [pid 5642] <... openat resumed>) = 3 [pid 5641] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] getdents64(3, ./strace-static-x86_64: Process 5644 attached [pid 5643] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5642] write(3, "1000", 4 [pid 5078] newfstatat(AT_FDCWD, "./58/binderfs", [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5644] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5642] <... write resumed>) = 4 [pid 5644] <... rseq resumed>) = 0 [pid 5642] close(3 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5644] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5642] <... close resumed>) = 0 [pid 5078] unlink("./58/binderfs" [pid 5644] <... set_robust_list resumed>) = 0 [pid 5642] symlink("/dev/binderfs", "./binderfs" [pid 5644] rt_sigprocmask(SIG_SETMASK, [], [pid 5643] <... prctl resumed>) = 0 [pid 5641] <... clone3 resumed> => {parent_tid=[5644]}, 88) = 5644 [pid 5078] <... unlink resumed>) = 0 [pid 5075] close(3 [pid 5644] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5643] setpgid(0, 0 [pid 5642] <... symlink resumed>) = 0 [pid 5641] rt_sigprocmask(SIG_SETMASK, [], [pid 5078] getdents64(3, [pid 5075] <... close resumed>) = 0 [pid 5644] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5643] <... setpgid resumed>) = 0 [pid 5641] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] rmdir("./56" [pid 5641] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5644] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5642] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5644] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5642] <... futex resumed>) = 0 [pid 5641] <... futex resumed>) = 0 [pid 5078] close(3 [pid 5075] <... rmdir resumed>) = 0 [pid 5644] <... bpf resumed>) = 3 [pid 5643] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5642] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5641] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... close resumed>) = 0 [pid 5644] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5643] <... openat resumed>) = 3 [pid 5642] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5641] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5078] rmdir("./58" [pid 5644] <... futex resumed>) = 0 [pid 5643] write(3, "1000", 4 [pid 5642] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5641] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] mkdir("./57", 0777 [pid 5644] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5643] <... write resumed>) = 4 [pid 5642] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5641] <... futex resumed>) = 0 [pid 5078] <... rmdir resumed>) = 0 [pid 5075] <... mkdir resumed>) = 0 [pid 5644] <... bpf resumed>) = 4 [pid 5642] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5078] mkdir("./59", 0777 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5645 attached [pid 5644] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5643] close(3 [pid 5642] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5641] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... mkdir resumed>) = 0 [pid 5645] set_robust_list(0x55555d6c46a0, 24 [pid 5644] <... futex resumed>) = 0 [pid 5643] <... close resumed>) = 0 [pid 5642] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5641] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5645] <... set_robust_list resumed>) = 0 [pid 5644] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5643] symlink("/dev/binderfs", "./binderfs" [pid 5641] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5646 attached [pid 5645] chdir("./57" [pid 5644] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5643] <... symlink resumed>) = 0 [pid 5642] <... mprotect resumed>) = 0 [pid 5641] <... futex resumed>) = 0 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5645 [pid 5646] set_robust_list(0x55555d6c46a0, 24 [pid 5641] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5646] <... set_robust_list resumed>) = 0 [pid 5644] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5646] chdir("./59" [pid 5645] <... chdir resumed>) = 0 [pid 5643] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5646 [pid 5644] <... bpf resumed>) = 5 [pid 5642] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5645] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5643] <... futex resumed>) = 0 [pid 5646] <... chdir resumed>) = 0 [pid 5645] <... prctl resumed>) = 0 [pid 5644] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5642] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5643] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5646] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5645] setpgid(0, 0 [pid 5644] <... futex resumed>) = 1 [pid 5643] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5641] <... futex resumed>) = 0 [pid 5642] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5646] <... prctl resumed>) = 0 [pid 5645] <... setpgid resumed>) = 0 [pid 5644] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5643] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5641] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5645] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC./strace-static-x86_64: Process 5647 attached [pid 5646] setpgid(0, 0 [pid 5644] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5643] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5641] <... futex resumed>) = 0 [pid 5645] <... openat resumed>) = 3 [pid 5647] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5646] <... setpgid resumed>) = 0 [pid 5644] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5643] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5642] <... clone3 resumed> => {parent_tid=[5647]}, 88) = 5647 [pid 5641] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5647] <... rseq resumed>) = 0 [pid 5645] write(3, "1000", 4 [pid 5644] <... bpf resumed>) = 6 [pid 5643] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5642] rt_sigprocmask(SIG_SETMASK, [], [pid 5647] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5646] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5645] <... write resumed>) = 4 [pid 5644] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5643] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5642] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5647] <... set_robust_list resumed>) = 0 [pid 5645] close(3 [pid 5644] <... futex resumed>) = 1 [pid 5643] <... mprotect resumed>) = 0 [pid 5642] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5641] <... futex resumed>) = 0 [pid 5647] rt_sigprocmask(SIG_SETMASK, [], [pid 5645] <... close resumed>) = 0 [pid 5644] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5642] <... futex resumed>) = 0 [pid 5641] exit_group(0 [pid 5647] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5646] <... openat resumed>) = 3 [pid 5645] symlink("/dev/binderfs", "./binderfs" [pid 5644] <... futex resumed>) = ? [pid 5643] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5642] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5641] <... exit_group resumed>) = ? [pid 5647] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5646] write(3, "1000", 4 [pid 5647] <... bpf resumed>) = 3 [pid 5645] <... symlink resumed>) = 0 [pid 5644] +++ exited with 0 +++ [pid 5647] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5646] <... write resumed>) = 4 [pid 5645] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5643] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5647] <... futex resumed>) = 1 [pid 5646] close(3 [pid 5645] <... futex resumed>) = 0 [pid 5643] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5642] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5648 attached [pid 5647] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5646] <... close resumed>) = 0 [pid 5645] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5642] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5641] +++ exited with 0 +++ [pid 5648] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5647] <... bpf resumed>) = 4 [pid 5646] symlink("/dev/binderfs", "./binderfs" [pid 5645] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5643] <... clone3 resumed> => {parent_tid=[5648]}, 88) = 5648 [pid 5642] <... futex resumed>) = 0 [pid 5648] <... rseq resumed>) = 0 [pid 5647] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5645] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5643] rt_sigprocmask(SIG_SETMASK, [], [pid 5642] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5646] <... symlink resumed>) = 0 [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5641, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5648] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5647] <... futex resumed>) = 0 [pid 5646] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5645] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5643] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5642] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5077] umount2("./56", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5648] <... set_robust_list resumed>) = 0 [pid 5647] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5646] <... futex resumed>) = 0 [pid 5645] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5643] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5642] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5648] rt_sigprocmask(SIG_SETMASK, [], [pid 5647] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5646] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5645] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5643] <... futex resumed>) = 0 [pid 5642] <... futex resumed>) = 0 [pid 5077] openat(AT_FDCWD, "./56", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5648] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5647] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5646] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5645] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5643] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5642] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5648] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5647] <... bpf resumed>) = 5 [pid 5646] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5645] <... mprotect resumed>) = 0 [pid 5077] <... openat resumed>) = 3 [pid 5646] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5648] <... bpf resumed>) = 3 [pid 5647] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5645] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5646] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5648] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5647] <... futex resumed>) = 1 [pid 5645] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5642] <... futex resumed>) = 0 [pid 5077] newfstatat(3, "", [pid 5648] <... futex resumed>) = 1 [pid 5647] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5646] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5645] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5643] <... futex resumed>) = 0 [pid 5642] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 ./strace-static-x86_64: Process 5649 attached [pid 5648] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5647] <... bpf resumed>) = 6 [pid 5646] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5643] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5642] <... futex resumed>) = 0 [pid 5077] getdents64(3, [pid 5649] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5648] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5647] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5646] <... mprotect resumed>) = 0 [pid 5645] <... clone3 resumed> => {parent_tid=[5649]}, 88) = 5649 [pid 5643] <... futex resumed>) = 0 [pid 5642] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5649] <... rseq resumed>) = 0 [pid 5648] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5647] <... futex resumed>) = 0 [pid 5646] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5645] rt_sigprocmask(SIG_SETMASK, [], [pid 5643] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5642] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5649] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5648] <... bpf resumed>) = 4 [pid 5647] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5646] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5645] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5642] exit_group(0 [pid 5077] umount2("./56/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5648] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5647] <... futex resumed>) = ? [pid 5642] <... exit_group resumed>) = ? [pid 5648] <... futex resumed>) = 1 [pid 5647] +++ exited with 0 +++ [pid 5649] <... set_robust_list resumed>) = 0 [pid 5646] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5643] <... futex resumed>) = 0 [pid 5645] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5650 attached [pid 5649] rt_sigprocmask(SIG_SETMASK, [], [pid 5648] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5645] <... futex resumed>) = 0 [pid 5643] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5642] +++ exited with 0 +++ [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5650] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5649] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5648] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5643] <... futex resumed>) = 0 [pid 5077] newfstatat(AT_FDCWD, "./56/binderfs", [pid 5648] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5643] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5650] <... rseq resumed>) = 0 [pid 5649] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5648] <... bpf resumed>) = 5 [pid 5646] <... clone3 resumed> => {parent_tid=[5650]}, 88) = 5650 [pid 5645] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5642, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5650] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5649] <... bpf resumed>) = 3 [pid 5646] rt_sigprocmask(SIG_SETMASK, [], [pid 5077] unlink("./56/binderfs" [pid 5650] <... set_robust_list resumed>) = 0 [pid 5649] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5646] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5650] rt_sigprocmask(SIG_SETMASK, [], [pid 5649] <... futex resumed>) = 1 [pid 5648] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5646] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5645] <... futex resumed>) = 0 [pid 5650] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5649] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5648] <... futex resumed>) = 1 [pid 5646] <... futex resumed>) = 0 [pid 5645] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5643] <... futex resumed>) = 0 [pid 5077] <... unlink resumed>) = 0 [pid 5076] umount2("./55", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5650] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5649] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5648] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5646] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5645] <... futex resumed>) = 0 [pid 5643] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] getdents64(3, [pid 5650] <... bpf resumed>) = 3 [pid 5649] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5645] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5650] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] openat(AT_FDCWD, "./55", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5077] close(3 [pid 5650] <... futex resumed>) = 0 [pid 5648] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5646] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5643] <... futex resumed>) = 0 [pid 5077] <... close resumed>) = 0 [pid 5076] <... openat resumed>) = 3 [pid 5650] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5649] <... bpf resumed>) = 4 [pid 5648] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5646] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5643] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] rmdir("./56" [pid 5076] newfstatat(3, "", [pid 5650] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5649] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5648] <... bpf resumed>) = 6 [pid 5646] <... futex resumed>) = 0 [pid 5077] <... rmdir resumed>) = 0 [pid 5650] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5649] <... futex resumed>) = 1 [pid 5648] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5646] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5645] <... futex resumed>) = 0 [pid 5077] mkdir("./57", 0777 [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5650] <... bpf resumed>) = 4 [pid 5649] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5648] <... futex resumed>) = 1 [pid 5645] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5643] <... futex resumed>) = 0 [pid 5650] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5649] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5648] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5645] <... futex resumed>) = 0 [pid 5643] exit_group(0 [pid 5077] <... mkdir resumed>) = 0 [pid 5076] getdents64(3, [pid 5650] <... futex resumed>) = 1 [pid 5649] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5648] <... futex resumed>) = ? [pid 5646] <... futex resumed>) = 0 [pid 5645] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5643] <... exit_group resumed>) = ? [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5650] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5649] <... bpf resumed>) = 5 [pid 5648] +++ exited with 0 +++ [pid 5646] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5646] <... futex resumed>) = 0 [pid 5646] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5643] +++ exited with 0 +++ ./strace-static-x86_64: Process 5651 attached [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5651 [pid 5651] set_robust_list(0x55555d6c46a0, 24 [pid 5650] <... bpf resumed>) = 5 [pid 5649] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] umount2("./55/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5643, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5651] <... set_robust_list resumed>) = 0 [pid 5650] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5649] <... futex resumed>) = 1 [pid 5645] <... futex resumed>) = 0 [pid 5645] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5651] chdir("./57" [pid 5650] <... futex resumed>) = 1 [pid 5649] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5646] <... futex resumed>) = 0 [pid 5645] <... futex resumed>) = 0 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5651] <... chdir resumed>) = 0 [pid 5650] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5646] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5645] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5076] newfstatat(AT_FDCWD, "./55/binderfs", [pid 5651] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5650] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5646] <... futex resumed>) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] umount2("./54", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5651] <... prctl resumed>) = 0 [pid 5650] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5646] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5076] unlink("./55/binderfs" [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5651] setpgid(0, 0 [pid 5649] <... bpf resumed>) = 6 [pid 5076] <... unlink resumed>) = 0 [pid 5074] openat(AT_FDCWD, "./54", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5651] <... setpgid resumed>) = 0 [pid 5650] <... bpf resumed>) = 6 [pid 5649] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... openat resumed>) = 3 [pid 5651] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5650] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5649] <... futex resumed>) = 1 [pid 5645] <... futex resumed>) = 0 [pid 5076] getdents64(3, [pid 5649] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5074] newfstatat(3, "", [pid 5651] <... openat resumed>) = 3 [pid 5650] <... futex resumed>) = 1 [pid 5646] <... futex resumed>) = 0 [pid 5645] exit_group(0 [pid 5076] close(3 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5650] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5649] <... futex resumed>) = ? [pid 5646] exit_group(0 [pid 5645] <... exit_group resumed>) = ? [pid 5651] write(3, "1000", 4 [pid 5649] +++ exited with 0 +++ [pid 5076] <... close resumed>) = 0 [pid 5074] getdents64(3, [pid 5651] <... write resumed>) = 4 [pid 5650] <... futex resumed>) = ? [pid 5646] <... exit_group resumed>) = ? [pid 5076] rmdir("./55" [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5651] close(3 [pid 5650] +++ exited with 0 +++ [pid 5076] <... rmdir resumed>) = 0 [pid 5651] <... close resumed>) = 0 [pid 5074] umount2("./54/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5651] symlink("/dev/binderfs", "./binderfs" [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5651] <... symlink resumed>) = 0 [pid 5076] mkdir("./56", 0777 [pid 5074] newfstatat(AT_FDCWD, "./54/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5076] <... mkdir resumed>) = 0 [pid 5074] unlink("./54/binderfs" [pid 5651] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... unlink resumed>) = 0 [pid 5651] <... futex resumed>) = 0 [pid 5651] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, NULL, 8) = 0 [pid 5651] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5651] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5074] getdents64(3, [pid 5651] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5651] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5074] close(3./strace-static-x86_64: Process 5652 attached [pid 5651] <... mprotect resumed>) = 0 [pid 5074] <... close resumed>) = 0 [pid 5652] set_robust_list(0x55555d6c46a0, 24 [pid 5651] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5074] rmdir("./54" [pid 5652] <... set_robust_list resumed>) = 0 [pid 5651] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5652 [pid 5074] <... rmdir resumed>) = 0 [pid 5652] chdir("./56" [pid 5651] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0}./strace-static-x86_64: Process 5653 attached [pid 5652] <... chdir resumed>) = 0 [pid 5074] mkdir("./55", 0777 [pid 5653] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5652] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5651] <... clone3 resumed> => {parent_tid=[5653]}, 88) = 5653 [pid 5074] <... mkdir resumed>) = 0 [pid 5653] <... rseq resumed>) = 0 [pid 5651] rt_sigprocmask(SIG_SETMASK, [], [pid 5653] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5651] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5653] <... set_robust_list resumed>) = 0 [pid 5651] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5652] <... prctl resumed>) = 0 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5654 attached [pid 5653] rt_sigprocmask(SIG_SETMASK, [], [pid 5652] setpgid(0, 0 [pid 5651] <... futex resumed>) = 0 [pid 5654] set_robust_list(0x55555d6c46a0, 24 [pid 5653] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5651] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5645] +++ exited with 0 +++ [pid 5654] <... set_robust_list resumed>) = 0 [pid 5653] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5654] chdir("./55" [pid 5652] <... setpgid resumed>) = 0 [pid 5653] <... bpf resumed>) = 3 [pid 5653] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5651] <... futex resumed>) = 0 [pid 5654] <... chdir resumed>) = 0 [pid 5653] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5652] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5651] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5645, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5654 [pid 5654] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5653] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5651] <... futex resumed>) = 0 [pid 5653] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5651] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5654] <... prctl resumed>) = 0 [pid 5653] <... bpf resumed>) = 4 [pid 5646] +++ exited with 0 +++ [pid 5654] setpgid(0, 0 [pid 5652] <... openat resumed>) = 3 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5646, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5654] <... setpgid resumed>) = 0 [pid 5652] write(3, "1000", 4 [pid 5078] restart_syscall(<... resuming interrupted clone ...> [pid 5075] umount2("./57", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5653] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5654] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5653] <... futex resumed>) = 1 [pid 5652] <... write resumed>) = 4 [pid 5651] <... futex resumed>) = 0 [pid 5078] <... restart_syscall resumed>) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5653] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5652] close(3 [pid 5651] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5653] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5651] <... futex resumed>) = 0 [pid 5653] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5651] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5654] <... openat resumed>) = 3 [pid 5653] <... bpf resumed>) = 5 [pid 5652] <... close resumed>) = 0 [pid 5075] openat(AT_FDCWD, "./57", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5078] umount2("./59", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] <... openat resumed>) = 3 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5654] write(3, "1000", 4 [pid 5652] symlink("/dev/binderfs", "./binderfs" [pid 5078] openat(AT_FDCWD, "./59", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5075] newfstatat(3, "", [pid 5654] <... write resumed>) = 4 [pid 5653] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5652] <... symlink resumed>) = 0 [pid 5651] <... futex resumed>) = 0 [pid 5653] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5651] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5653] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5651] <... futex resumed>) = 0 [pid 5653] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5651] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5654] close(3 [pid 5078] <... openat resumed>) = 3 [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5652] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5654] <... close resumed>) = 0 [pid 5654] symlink("/dev/binderfs", "./binderfs" [pid 5078] newfstatat(3, "", [pid 5652] <... futex resumed>) = 0 [pid 5075] getdents64(3, [pid 5654] <... symlink resumed>) = 0 [pid 5652] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5654] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5652] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5654] <... futex resumed>) = 0 [pid 5652] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5078] getdents64(3, [pid 5075] umount2("./57/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5654] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5652] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5654] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5652] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5078] umount2("./59/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] newfstatat(AT_FDCWD, "./57/binderfs", [pid 5654] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5652] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5654] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5652] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5652] <... mprotect resumed>) = 0 [pid 5078] newfstatat(AT_FDCWD, "./59/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5654] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5078] unlink("./59/binderfs" [pid 5654] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5652] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5078] <... unlink resumed>) = 0 [pid 5075] unlink("./57/binderfs" [pid 5654] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5078] getdents64(3, 0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5078] close(3 [pid 5654] <... mprotect resumed>) = 0 [pid 5653] <... bpf resumed>) = 6 [pid 5652] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5075] <... unlink resumed>) = 0 [pid 5654] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5653] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... close resumed>) = 0 [pid 5654] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5653] <... futex resumed>) = 1 [pid 5652] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5651] <... futex resumed>) = 0 [pid 5078] rmdir("./59" [pid 5075] getdents64(3, ./strace-static-x86_64: Process 5655 attached [pid 5654] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5653] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5651] exit_group(0 [pid 5078] <... rmdir resumed>) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5651] <... exit_group resumed>) = ? [pid 5654] <... clone3 resumed> => {parent_tid=[5656]}, 88) = 5656 [pid 5653] <... futex resumed>) = ? [pid 5652] <... clone3 resumed> => {parent_tid=[5655]}, 88) = 5655 ./strace-static-x86_64: Process 5656 attached [pid 5655] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5654] rt_sigprocmask(SIG_SETMASK, [], [pid 5653] +++ exited with 0 +++ [pid 5652] rt_sigprocmask(SIG_SETMASK, [], [pid 5651] +++ exited with 0 +++ [pid 5078] mkdir("./60", 0777 [pid 5075] close(3 [pid 5656] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5655] <... rseq resumed>) = 0 [pid 5654] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5652] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] <... mkdir resumed>) = 0 [pid 5656] <... rseq resumed>) = 0 [pid 5655] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5654] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5652] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... close resumed>) = 0 [pid 5656] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5655] <... set_robust_list resumed>) = 0 [pid 5075] rmdir("./57" [pid 5656] <... set_robust_list resumed>) = 0 [pid 5655] rt_sigprocmask(SIG_SETMASK, [], [pid 5654] <... futex resumed>) = 0 [pid 5652] <... futex resumed>) = 0 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5651, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- ./strace-static-x86_64: Process 5657 attached [pid 5656] rt_sigprocmask(SIG_SETMASK, [], [pid 5655] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5654] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5652] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] umount2("./57", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] <... rmdir resumed>) = 0 [pid 5657] set_robust_list(0x55555d6c46a0, 24 [pid 5656] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5655] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5657 [pid 5077] openat(AT_FDCWD, "./57", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5077] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5657] <... set_robust_list resumed>) = 0 [pid 5656] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5077] getdents64(3, [pid 5657] chdir("./60" [pid 5656] <... bpf resumed>) = 3 [pid 5655] <... bpf resumed>) = 3 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5075] mkdir("./58", 0777 [pid 5657] <... chdir resumed>) = 0 [pid 5656] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5655] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] umount2("./57/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5656] <... futex resumed>) = 1 [pid 5655] <... futex resumed>) = 1 [pid 5654] <... futex resumed>) = 0 [pid 5652] <... futex resumed>) = 0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5657] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5656] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5655] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5654] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5652] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] newfstatat(AT_FDCWD, "./57/binderfs", [pid 5657] <... prctl resumed>) = 0 [pid 5656] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5655] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5654] <... futex resumed>) = 0 [pid 5652] <... futex resumed>) = 0 [pid 5075] <... mkdir resumed>) = 0 [pid 5657] setpgid(0, 0 [pid 5656] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5655] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5654] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5652] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5657] <... setpgid resumed>) = 0 [pid 5656] <... bpf resumed>) = 4 [pid 5077] unlink("./57/binderfs" [pid 5655] <... bpf resumed>) = 4 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5657] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5656] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5655] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... unlink resumed>) = 0 [pid 5077] getdents64(3, 0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5077] close(3./strace-static-x86_64: Process 5658 attached [pid 5657] <... openat resumed>) = 3 [pid 5656] <... futex resumed>) = 1 [pid 5655] <... futex resumed>) = 1 [pid 5654] <... futex resumed>) = 0 [pid 5652] <... futex resumed>) = 0 [pid 5658] set_robust_list(0x55555d6c46a0, 24 [pid 5657] write(3, "1000", 4 [pid 5656] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5655] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5654] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5652] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... close resumed>) = 0 [pid 5658] <... set_robust_list resumed>) = 0 [pid 5657] <... write resumed>) = 4 [pid 5654] <... futex resumed>) = 0 [pid 5652] <... futex resumed>) = 0 [pid 5077] rmdir("./57" [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5658 [pid 5658] chdir("./58" [pid 5657] close(3 [pid 5656] <... bpf resumed>) = 5 [pid 5655] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5654] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5652] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... rmdir resumed>) = 0 [pid 5658] <... chdir resumed>) = 0 [pid 5657] <... close resumed>) = 0 [pid 5657] symlink("/dev/binderfs", "./binderfs" [pid 5658] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5657] <... symlink resumed>) = 0 [pid 5656] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5655] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5656] <... futex resumed>) = 1 [pid 5658] <... prctl resumed>) = 0 [pid 5657] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5656] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5654] <... futex resumed>) = 0 [pid 5077] mkdir("./58", 0777 [pid 5658] setpgid(0, 0 [pid 5657] <... futex resumed>) = 0 [pid 5656] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5655] <... bpf resumed>) = 5 [pid 5654] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... mkdir resumed>) = 0 [pid 5658] <... setpgid resumed>) = 0 [pid 5657] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5656] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5654] <... futex resumed>) = 0 [pid 5658] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5657] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5654] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5658] <... openat resumed>) = 3 [pid 5657] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5656] <... bpf resumed>) = 6 [pid 5656] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5655] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5659 attached [pid 5658] write(3, "1000", 4 [pid 5657] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5656] <... futex resumed>) = 1 [pid 5655] <... futex resumed>) = 1 [pid 5654] <... futex resumed>) = 0 [pid 5652] <... futex resumed>) = 0 [pid 5658] <... write resumed>) = 4 [pid 5657] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5656] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5654] exit_group(0 [pid 5652] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5659] set_robust_list(0x55555d6c46a0, 24) = 0 [pid 5655] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5652] <... futex resumed>) = 0 [pid 5658] close(3 [pid 5657] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5656] <... futex resumed>) = ? [pid 5654] <... exit_group resumed>) = ? [pid 5652] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5659] chdir("./58" [pid 5656] +++ exited with 0 +++ [pid 5655] <... bpf resumed>) = 6 [pid 5655] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5659] <... chdir resumed>) = 0 [pid 5658] <... close resumed>) = 0 [pid 5657] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5654] +++ exited with 0 +++ [pid 5652] <... futex resumed>) = 0 [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5659 [pid 5655] <... futex resumed>) = 1 [pid 5659] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5658] symlink("/dev/binderfs", "./binderfs" [pid 5657] <... mprotect resumed>) = 0 [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5654, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5659] <... prctl resumed>) = 0 [pid 5658] <... symlink resumed>) = 0 [pid 5657] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5655] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5652] exit_group(0 [pid 5658] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5657] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5659] setpgid(0, 0 [pid 5658] <... futex resumed>) = 0 [pid 5657] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5655] <... futex resumed>) = ? [pid 5652] <... exit_group resumed>) = ? [pid 5659] <... setpgid resumed>) = 0 ./strace-static-x86_64: Process 5660 attached [pid 5658] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5655] +++ exited with 0 +++ [pid 5074] umount2("./55", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5660] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5659] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5658] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5657] <... clone3 resumed> => {parent_tid=[5660]}, 88) = 5660 [pid 5652] +++ exited with 0 +++ [pid 5660] <... rseq resumed>) = 0 [pid 5659] <... openat resumed>) = 3 [pid 5658] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5657] rt_sigprocmask(SIG_SETMASK, [], [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5660] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5659] write(3, "1000", 4 [pid 5658] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5657] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5652, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5074] openat(AT_FDCWD, "./55", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5660] <... set_robust_list resumed>) = 0 [pid 5658] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5657] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5660] rt_sigprocmask(SIG_SETMASK, [], [pid 5659] <... write resumed>) = 4 [pid 5658] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5657] <... futex resumed>) = 0 [pid 5076] restart_syscall(<... resuming interrupted clone ...> [pid 5074] <... openat resumed>) = 3 [pid 5660] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5659] close(3 [pid 5658] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5657] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] <... restart_syscall resumed>) = 0 [pid 5074] newfstatat(3, "", [pid 5660] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5659] <... close resumed>) = 0 [pid 5658] <... mprotect resumed>) = 0 [pid 5660] <... bpf resumed>) = 3 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5660] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5659] symlink("/dev/binderfs", "./binderfs" [pid 5658] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5074] getdents64(3, [pid 5660] <... futex resumed>) = 1 [pid 5657] <... futex resumed>) = 0 [pid 5660] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5658] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5657] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5660] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5658] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5657] <... futex resumed>) = 0 [pid 5660] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5657] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5661 attached [pid 5660] <... bpf resumed>) = 4 [pid 5659] <... symlink resumed>) = 0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5661] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5660] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5659] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5658] <... clone3 resumed> => {parent_tid=[5661]}, 88) = 5661 [pid 5076] umount2("./56", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] umount2("./55/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5661] <... rseq resumed>) = 0 [pid 5660] <... futex resumed>) = 1 [pid 5659] <... futex resumed>) = 0 [pid 5658] rt_sigprocmask(SIG_SETMASK, [], [pid 5657] <... futex resumed>) = 0 [pid 5661] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5660] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5659] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5658] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5657] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5661] <... set_robust_list resumed>) = 0 [pid 5660] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5659] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5658] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5657] <... futex resumed>) = 0 [pid 5076] openat(AT_FDCWD, "./56", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5074] newfstatat(AT_FDCWD, "./55/binderfs", [pid 5661] rt_sigprocmask(SIG_SETMASK, [], [pid 5660] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5659] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5658] <... futex resumed>) = 0 [pid 5657] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5661] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5659] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5659] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5661] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5660] <... bpf resumed>) = 5 [pid 5659] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5658] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] <... openat resumed>) = 3 [pid 5074] unlink("./55/binderfs" [pid 5661] <... bpf resumed>) = 3 [pid 5659] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5076] newfstatat(3, "", [pid 5659] <... mprotect resumed>) = 0 [pid 5660] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5661] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5659] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5074] <... unlink resumed>) = 0 [pid 5661] <... futex resumed>) = 1 [pid 5660] <... futex resumed>) = 1 [pid 5659] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5658] <... futex resumed>) = 0 [pid 5657] <... futex resumed>) = 0 [pid 5076] getdents64(3, [pid 5074] getdents64(3, [pid 5661] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5660] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5658] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5660] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5659] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5658] <... futex resumed>) = 0 [pid 5657] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5660] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5658] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5660] <... bpf resumed>) = 6 [pid 5660] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5661] <... bpf resumed>) = 4 ./strace-static-x86_64: Process 5662 attached [pid 5661] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5657] <... futex resumed>) = 0 [pid 5076] umount2("./56/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] close(3 [pid 5662] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5661] <... futex resumed>) = 1 [pid 5660] <... futex resumed>) = 0 [pid 5659] <... clone3 resumed> => {parent_tid=[5662]}, 88) = 5662 [pid 5658] <... futex resumed>) = 0 [pid 5657] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] <... close resumed>) = 0 [pid 5662] <... rseq resumed>) = 0 [pid 5661] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5660] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5659] rt_sigprocmask(SIG_SETMASK, [], [pid 5658] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5657] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5662] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5661] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5659] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5658] <... futex resumed>) = 0 [pid 5076] newfstatat(AT_FDCWD, "./56/binderfs", [pid 5074] rmdir("./55" [pid 5662] <... set_robust_list resumed>) = 0 [pid 5661] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5659] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5658] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5657] exit_group(0 [pid 5662] rt_sigprocmask(SIG_SETMASK, [], [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5662] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5660] <... futex resumed>) = ? [pid 5659] <... futex resumed>) = 0 [pid 5657] <... exit_group resumed>) = ? [pid 5074] <... rmdir resumed>) = 0 [pid 5662] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5660] +++ exited with 0 +++ [pid 5662] <... bpf resumed>) = 3 [pid 5661] <... bpf resumed>) = 5 [pid 5662] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] unlink("./56/binderfs" [pid 5662] <... futex resumed>) = 0 [pid 5659] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5662] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5074] mkdir("./56", 0777) = 0 [pid 5657] +++ exited with 0 +++ [pid 5659] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5661] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5659] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5657, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5076] <... unlink resumed>) = 0 [pid 5661] <... futex resumed>) = 1 [pid 5659] <... futex resumed>) = 1 [pid 5658] <... futex resumed>) = 0 [pid 5662] <... futex resumed>) = 0 [pid 5659] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5658] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] restart_syscall(<... resuming interrupted clone ...> [pid 5661] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5658] <... futex resumed>) = 0 [pid 5076] getdents64(3, ./strace-static-x86_64: Process 5663 attached [pid 5662] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5658] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] <... restart_syscall resumed>) = 0 [pid 5663] set_robust_list(0x55555d6c46a0, 24 [pid 5662] <... bpf resumed>) = 4 [pid 5661] <... bpf resumed>) = 6 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5663] <... set_robust_list resumed>) = 0 [pid 5662] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5661] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] close(3 [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5663 [pid 5663] chdir("./56" [pid 5661] <... futex resumed>) = 1 [pid 5658] <... futex resumed>) = 0 [pid 5078] umount2("./60", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5663] <... chdir resumed>) = 0 [pid 5662] <... futex resumed>) = 1 [pid 5661] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5659] <... futex resumed>) = 0 [pid 5658] exit_group(0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] <... close resumed>) = 0 [pid 5663] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5662] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5661] <... futex resumed>) = ? [pid 5659] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5658] <... exit_group resumed>) = ? [pid 5078] openat(AT_FDCWD, "./60", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5076] rmdir("./56" [pid 5663] <... prctl resumed>) = 0 [pid 5662] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5661] +++ exited with 0 +++ [pid 5659] <... futex resumed>) = 0 [pid 5658] +++ exited with 0 +++ [pid 5078] <... openat resumed>) = 3 [pid 5663] setpgid(0, 0 [pid 5659] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5658, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5663] <... setpgid resumed>) = 0 [pid 5663] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5662] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5078] newfstatat(3, "", [pid 5663] <... openat resumed>) = 3 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5075] umount2("./58", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5663] write(3, "1000", 4 [pid 5662] <... bpf resumed>) = 5 [pid 5078] getdents64(3, [pid 5076] <... rmdir resumed>) = 0 [pid 5663] <... write resumed>) = 4 [pid 5662] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5663] close(3 [pid 5662] <... futex resumed>) = 1 [pid 5659] <... futex resumed>) = 0 [pid 5078] umount2("./60/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] mkdir("./57", 0777 [pid 5663] <... close resumed>) = 0 [pid 5662] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5659] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] openat(AT_FDCWD, "./58", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5663] symlink("/dev/binderfs", "./binderfs" [pid 5659] <... futex resumed>) = 0 [pid 5078] newfstatat(AT_FDCWD, "./60/binderfs", [pid 5663] <... symlink resumed>) = 0 [pid 5659] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5076] <... mkdir resumed>) = 0 [pid 5075] <... openat resumed>) = 3 [pid 5662] <... bpf resumed>) = 6 [pid 5078] unlink("./60/binderfs" [pid 5662] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... unlink resumed>) = 0 [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5662] <... futex resumed>) = 1 [pid 5663] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5662] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5659] <... futex resumed>) = 0 [pid 5075] newfstatat(3, "", [pid 5663] <... futex resumed>) = 0 [pid 5659] exit_group(0 [pid 5663] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5662] <... futex resumed>) = ? [pid 5659] <... exit_group resumed>) = ? [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5663] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5662] +++ exited with 0 +++ [pid 5078] getdents64(3, ./strace-static-x86_64: Process 5664 attached 0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5078] close(3) = 0 [pid 5078] rmdir("./60" [pid 5664] set_robust_list(0x55555d6c46a0, 24 [pid 5659] +++ exited with 0 +++ [pid 5664] <... set_robust_list resumed>) = 0 [pid 5663] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5078] <... rmdir resumed>) = 0 [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5659, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5664 [pid 5664] chdir("./57" [pid 5663] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] getdents64(3, [pid 5664] <... chdir resumed>) = 0 [pid 5663] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5078] mkdir("./61", 0777 [pid 5664] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5663] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5664] <... prctl resumed>) = 0 [pid 5663] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5078] <... mkdir resumed>) = 0 [pid 5075] umount2("./58/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5664] setpgid(0, 0 [pid 5663] <... mprotect resumed>) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5664] <... setpgid resumed>) = 0 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5077] umount2("./58", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5664] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5663] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] newfstatat(AT_FDCWD, "./58/binderfs", [pid 5664] <... openat resumed>) = 3 [pid 5663] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5077] openat(AT_FDCWD, "./58", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5664] write(3, "1000", 4 [pid 5663] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5077] <... openat resumed>) = 3 [pid 5075] unlink("./58/binderfs" [pid 5664] <... write resumed>) = 4 [pid 5077] newfstatat(3, "", ./strace-static-x86_64: Process 5666 attached ./strace-static-x86_64: Process 5665 attached [pid 5664] close(3 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5665 [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5666] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5664] <... close resumed>) = 0 [pid 5077] getdents64(3, [pid 5075] <... unlink resumed>) = 0 [pid 5666] <... rseq resumed>) = 0 [pid 5665] set_robust_list(0x55555d6c46a0, 24 [pid 5664] symlink("/dev/binderfs", "./binderfs" [pid 5663] <... clone3 resumed> => {parent_tid=[5666]}, 88) = 5666 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5666] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5664] <... symlink resumed>) = 0 [pid 5077] umount2("./58/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5666] <... set_robust_list resumed>) = 0 [pid 5665] <... set_robust_list resumed>) = 0 [pid 5663] rt_sigprocmask(SIG_SETMASK, [], [pid 5075] getdents64(3, [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5666] rt_sigprocmask(SIG_SETMASK, [], [pid 5665] chdir("./61" [pid 5664] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5663] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5666] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5665] <... chdir resumed>) = 0 [pid 5664] <... futex resumed>) = 0 [pid 5663] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] newfstatat(AT_FDCWD, "./58/binderfs", [pid 5075] close(3 [pid 5666] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5665] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5664] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5663] <... futex resumed>) = 0 [pid 5666] <... bpf resumed>) = 3 [pid 5665] <... prctl resumed>) = 0 [pid 5664] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5663] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5075] <... close resumed>) = 0 [pid 5666] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5665] setpgid(0, 0 [pid 5664] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5663] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5077] unlink("./58/binderfs" [pid 5075] rmdir("./58" [pid 5666] <... futex resumed>) = 0 [pid 5665] <... setpgid resumed>) = 0 [pid 5664] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5666] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5665] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5664] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5663] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... unlink resumed>) = 0 [pid 5075] <... rmdir resumed>) = 0 [pid 5666] <... bpf resumed>) = 4 [pid 5664] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5665] <... openat resumed>) = 3 [pid 5664] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5663] <... futex resumed>) = 0 [pid 5666] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5664] <... mprotect resumed>) = 0 [pid 5077] getdents64(3, [pid 5666] <... futex resumed>) = 0 [pid 5664] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5663] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5665] write(3, "1000", 4 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5075] mkdir("./59", 0777 [pid 5666] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5665] <... write resumed>) = 4 [pid 5664] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5663] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5077] close(3 [pid 5075] <... mkdir resumed>) = 0 [pid 5665] close(3 [pid 5664] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5077] <... close resumed>) = 0 [pid 5665] <... close resumed>) = 0 [pid 5663] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5666] <... futex resumed>) = 0 [pid 5665] symlink("/dev/binderfs", "./binderfs" [pid 5663] <... futex resumed>) = 1 [pid 5077] rmdir("./58" [pid 5666] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5667 attached [pid 5665] <... symlink resumed>) = 0 [pid 5663] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5667] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053./strace-static-x86_64: Process 5668 attached ) = 0 [pid 5666] <... bpf resumed>) = 5 [pid 5665] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5664] <... clone3 resumed> => {parent_tid=[5667]}, 88) = 5667 [pid 5077] <... rmdir resumed>) = 0 [pid 5668] set_robust_list(0x55555d6c46a0, 24 [pid 5667] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5665] <... futex resumed>) = 0 [pid 5664] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5077] mkdir("./59", 0777 [pid 5664] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5668] <... set_robust_list resumed>) = 0 [pid 5667] <... set_robust_list resumed>) = 0 [pid 5665] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5664] <... futex resumed>) = 0 [pid 5077] <... mkdir resumed>) = 0 [pid 5667] rt_sigprocmask(SIG_SETMASK, [], [pid 5666] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5665] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5664] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5668 [pid 5666] <... futex resumed>) = 1 [pid 5663] <... futex resumed>) = 0 [pid 5667] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5666] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5665] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5663] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5668] chdir("./59" [pid 5667] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5666] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5665] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5663] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5669 attached [pid 5668] <... chdir resumed>) = 0 [pid 5666] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5663] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5667] <... bpf resumed>) = 3 [pid 5665] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5666] <... bpf resumed>) = 6 [pid 5669] set_robust_list(0x55555d6c46a0, 24 [pid 5668] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5666] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5665] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5667] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5669] <... set_robust_list resumed>) = 0 [pid 5668] setpgid(0, 0 [pid 5667] <... futex resumed>) = 1 [pid 5666] <... futex resumed>) = 1 [pid 5664] <... futex resumed>) = 0 [pid 5663] <... futex resumed>) = 0 [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5669 [pid 5669] chdir("./59" [pid 5668] <... setpgid resumed>) = 0 [pid 5667] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5666] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5665] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5664] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5663] exit_group(0 [pid 5666] <... futex resumed>) = ? [pid 5664] <... futex resumed>) = 0 [pid 5663] <... exit_group resumed>) = ? [pid 5669] <... chdir resumed>) = 0 [pid 5668] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5667] <... bpf resumed>) = 4 [pid 5666] +++ exited with 0 +++ [pid 5665] <... mprotect resumed>) = 0 [pid 5664] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5663] +++ exited with 0 +++ [pid 5669] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5663, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5669] <... prctl resumed>) = 0 [pid 5668] <... openat resumed>) = 3 [pid 5668] write(3, "1000", 4 [pid 5665] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5669] setpgid(0, 0 [pid 5668] <... write resumed>) = 4 [pid 5667] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5665] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5669] <... setpgid resumed>) = 0 [pid 5668] close(3 [pid 5667] <... futex resumed>) = 1 [pid 5665] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5664] <... futex resumed>) = 0 [pid 5668] <... close resumed>) = 0 [pid 5667] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5664] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5670 attached [pid 5669] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5668] symlink("/dev/binderfs", "./binderfs" [pid 5664] <... futex resumed>) = 0 [pid 5670] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5668] <... symlink resumed>) = 0 [pid 5667] <... bpf resumed>) = 5 [pid 5664] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5669] <... openat resumed>) = 3 [pid 5670] <... rseq resumed>) = 0 [pid 5667] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5669] write(3, "1000", 4 [pid 5665] <... clone3 resumed> => {parent_tid=[5670]}, 88) = 5670 [pid 5664] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5074] umount2("./56", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5670] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5669] <... write resumed>) = 4 [pid 5667] <... futex resumed>) = 0 [pid 5665] rt_sigprocmask(SIG_SETMASK, [], [pid 5664] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5668] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5668] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, NULL, 8) = 0 [pid 5670] <... set_robust_list resumed>) = 0 [pid 5669] close(3 [pid 5668] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5667] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5665] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5664] <... futex resumed>) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5670] rt_sigprocmask(SIG_SETMASK, [], [pid 5669] <... close resumed>) = 0 [pid 5668] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5665] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5667] <... bpf resumed>) = 6 [pid 5664] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5074] openat(AT_FDCWD, "./56", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5670] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5669] symlink("/dev/binderfs", "./binderfs" [pid 5668] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5667] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5665] <... futex resumed>) = 0 [pid 5664] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5074] <... openat resumed>) = 3 [pid 5670] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5669] <... symlink resumed>) = 0 [pid 5668] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5667] <... futex resumed>) = 0 [pid 5665] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] newfstatat(3, "", [pid 5670] <... bpf resumed>) = 3 [pid 5668] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5667] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5664] exit_group(0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5670] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5669] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5668] <... mprotect resumed>) = 0 [pid 5667] <... futex resumed>) = ? [pid 5664] <... exit_group resumed>) = ? [pid 5074] getdents64(3, [pid 5667] +++ exited with 0 +++ [pid 5670] <... futex resumed>) = 1 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5665] <... futex resumed>) = 0 [pid 5669] <... futex resumed>) = 0 [pid 5665] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5074] umount2("./56/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5670] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5669] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5665] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] newfstatat(AT_FDCWD, "./56/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] unlink("./56/binderfs") = 0 [pid 5074] getdents64(3, [pid 5670] <... bpf resumed>) = 4 [pid 5669] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5668] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5664] +++ exited with 0 +++ [pid 5670] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5669] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5670] <... futex resumed>) = 1 [pid 5669] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5665] <... futex resumed>) = 0 [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5664, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5670] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5669] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5665] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5670] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5665] <... futex resumed>) = 0 [pid 5668] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5665] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5670] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5669] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5668] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5074] close(3./strace-static-x86_64: Process 5671 attached ) = 0 [pid 5671] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5670] <... bpf resumed>) = 5 [pid 5668] <... clone3 resumed> => {parent_tid=[5671]}, 88) = 5671 [pid 5074] rmdir("./56" [pid 5671] <... rseq resumed>) = 0 [pid 5670] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5669] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5668] rt_sigprocmask(SIG_SETMASK, [], [pid 5076] umount2("./57", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... rmdir resumed>) = 0 [pid 5671] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5669] <... mprotect resumed>) = 0 [pid 5668] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5671] <... set_robust_list resumed>) = 0 [pid 5668] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5671] rt_sigprocmask(SIG_SETMASK, [], [pid 5670] <... futex resumed>) = 1 [pid 5669] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5668] <... futex resumed>) = 0 [pid 5665] <... futex resumed>) = 0 [pid 5076] openat(AT_FDCWD, "./57", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5074] mkdir("./57", 0777 [pid 5671] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5670] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5668] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5665] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... openat resumed>) = 3 [pid 5074] <... mkdir resumed>) = 0 [pid 5671] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5669] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5665] <... futex resumed>) = 0 [pid 5076] newfstatat(3, "", [pid 5670] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5671] <... bpf resumed>) = 3 [pid 5670] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5669] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5665] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5671] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] getdents64(3, [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5672 attached ./strace-static-x86_64: Process 5673 attached [pid 5671] <... futex resumed>) = 1 [pid 5670] <... bpf resumed>) = 6 [pid 5669] <... clone3 resumed> => {parent_tid=[5672]}, 88) = 5672 [pid 5668] <... futex resumed>) = 0 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5672] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5671] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5670] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5668] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] umount2("./57/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5673] set_robust_list(0x55555d6c46a0, 24 [pid 5672] <... rseq resumed>) = 0 [pid 5671] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5670] <... futex resumed>) = 1 [pid 5669] rt_sigprocmask(SIG_SETMASK, [], [pid 5668] <... futex resumed>) = 0 [pid 5665] <... futex resumed>) = 0 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5673 [pid 5673] <... set_robust_list resumed>) = 0 [pid 5672] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5671] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5670] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5669] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5668] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5673] chdir("./57" [pid 5672] <... set_robust_list resumed>) = 0 [pid 5671] <... bpf resumed>) = 4 [pid 5669] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5665] exit_group(0 [pid 5076] newfstatat(AT_FDCWD, "./57/binderfs", [pid 5673] <... chdir resumed>) = 0 [pid 5672] rt_sigprocmask(SIG_SETMASK, [], [pid 5671] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5670] <... futex resumed>) = ? [pid 5669] <... futex resumed>) = 0 [pid 5665] <... exit_group resumed>) = ? [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5672] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5671] <... futex resumed>) = 1 [pid 5670] +++ exited with 0 +++ [pid 5669] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5668] <... futex resumed>) = 0 [pid 5671] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5668] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5673] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5672] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5671] <... bpf resumed>) = 5 [pid 5668] <... futex resumed>) = 0 [pid 5665] +++ exited with 0 +++ [pid 5076] unlink("./57/binderfs" [pid 5673] <... prctl resumed>) = 0 [pid 5672] <... bpf resumed>) = 3 [pid 5671] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5668] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5673] setpgid(0, 0 [pid 5672] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5671] <... futex resumed>) = 0 [pid 5668] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5665, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5076] <... unlink resumed>) = 0 [pid 5673] <... setpgid resumed>) = 0 [pid 5672] <... futex resumed>) = 1 [pid 5671] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5669] <... futex resumed>) = 0 [pid 5668] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] restart_syscall(<... resuming interrupted clone ...> [pid 5076] getdents64(3, [pid 5673] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5672] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5671] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5669] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5668] <... futex resumed>) = 0 [pid 5078] <... restart_syscall resumed>) = 0 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5673] <... openat resumed>) = 3 [pid 5672] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5671] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5669] <... futex resumed>) = 0 [pid 5668] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5076] close(3 [pid 5673] write(3, "1000", 4 [pid 5672] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5673] <... write resumed>) = 4 [pid 5673] close(3) = 0 [pid 5673] symlink("/dev/binderfs", "./binderfs" [pid 5672] <... bpf resumed>) = 4 [pid 5671] <... bpf resumed>) = 6 [pid 5669] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] <... close resumed>) = 0 [pid 5673] <... symlink resumed>) = 0 [pid 5672] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5671] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5669] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5078] umount2("./61", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5671] <... futex resumed>) = 1 [pid 5668] <... futex resumed>) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] rmdir("./57" [pid 5671] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5668] exit_group(0 [pid 5673] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5672] <... futex resumed>) = 0 [pid 5669] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] openat(AT_FDCWD, "./61", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5076] <... rmdir resumed>) = 0 [pid 5673] <... futex resumed>) = 0 [pid 5672] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5671] <... futex resumed>) = ? [pid 5669] <... futex resumed>) = 0 [pid 5668] <... exit_group resumed>) = ? [pid 5078] <... openat resumed>) = 3 [pid 5076] mkdir("./58", 0777 [pid 5673] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5672] <... bpf resumed>) = 5 [pid 5671] +++ exited with 0 +++ [pid 5669] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] newfstatat(3, "", [pid 5673] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5673] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5672] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] getdents64(3, [pid 5673] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5076] <... mkdir resumed>) = 0 [pid 5673] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5672] <... futex resumed>) = 1 [pid 5669] <... futex resumed>) = 0 [pid 5668] +++ exited with 0 +++ [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5673] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5672] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5669] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] umount2("./61/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5673] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5668, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- ./strace-static-x86_64: Process 5674 attached [pid 5673] <... mprotect resumed>) = 0 [pid 5669] <... futex resumed>) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5674] set_robust_list(0x55555d6c46a0, 24 [pid 5673] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5669] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5674 [pid 5674] <... set_robust_list resumed>) = 0 [pid 5674] chdir("./58" [pid 5078] newfstatat(AT_FDCWD, "./61/binderfs", [pid 5674] <... chdir resumed>) = 0 [pid 5673] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5674] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5673] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5078] unlink("./61/binderfs"./strace-static-x86_64: Process 5675 attached [pid 5674] <... prctl resumed>) = 0 [pid 5078] <... unlink resumed>) = 0 [pid 5675] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5674] setpgid(0, 0 [pid 5673] <... clone3 resumed> => {parent_tid=[5675]}, 88) = 5675 [pid 5078] getdents64(3, [pid 5075] umount2("./59", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5675] <... rseq resumed>) = 0 [pid 5674] <... setpgid resumed>) = 0 [pid 5673] rt_sigprocmask(SIG_SETMASK, [], [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5675] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5674] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5673] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] close(3 [pid 5075] openat(AT_FDCWD, "./59", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5675] <... set_robust_list resumed>) = 0 [pid 5674] <... openat resumed>) = 3 [pid 5673] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... close resumed>) = 0 [pid 5075] <... openat resumed>) = 3 [pid 5675] rt_sigprocmask(SIG_SETMASK, [], [pid 5674] write(3, "1000", 4 [pid 5673] <... futex resumed>) = 0 [pid 5078] rmdir("./61" [pid 5075] newfstatat(3, "", [pid 5675] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5674] <... write resumed>) = 4 [pid 5675] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5674] close(3 [pid 5673] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... rmdir resumed>) = 0 [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5675] <... bpf resumed>) = 3 [pid 5674] <... close resumed>) = 0 [pid 5675] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5674] symlink("/dev/binderfs", "./binderfs" [pid 5675] <... futex resumed>) = 0 [pid 5673] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5078] mkdir("./62", 0777 [pid 5075] getdents64(3, [pid 5674] <... symlink resumed>) = 0 [pid 5675] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5673] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5672] <... bpf resumed>) = 6 [pid 5078] <... mkdir resumed>) = 0 [pid 5674] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5675] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5674] <... futex resumed>) = 0 [pid 5673] <... futex resumed>) = 0 [pid 5672] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] umount2("./59/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5675] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5674] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5673] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5672] <... futex resumed>) = 1 [pid 5669] <... futex resumed>) = 0 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5676 attached [pid 5675] <... bpf resumed>) = 4 [pid 5674] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5672] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5669] exit_group(0 [pid 5075] newfstatat(AT_FDCWD, "./59/binderfs", [pid 5676] set_robust_list(0x55555d6c46a0, 24 [pid 5675] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5674] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5672] <... futex resumed>) = ? [pid 5669] <... exit_group resumed>) = ? [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5676] <... set_robust_list resumed>) = 0 [pid 5675] <... futex resumed>) = 1 [pid 5674] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5673] <... futex resumed>) = 0 [pid 5672] +++ exited with 0 +++ [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5676 [pid 5075] unlink("./59/binderfs" [pid 5673] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... unlink resumed>) = 0 [pid 5673] <... futex resumed>) = 0 [pid 5673] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5669] +++ exited with 0 +++ [pid 5075] getdents64(3, [pid 5676] chdir("./62" [pid 5675] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5674] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5676] <... chdir resumed>) = 0 [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5669, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5077] restart_syscall(<... resuming interrupted clone ...> [pid 5075] close(3 [pid 5675] <... bpf resumed>) = 5 [pid 5077] <... restart_syscall resumed>) = 0 [pid 5676] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5675] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5674] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5075] <... close resumed>) = 0 [pid 5676] <... prctl resumed>) = 0 [pid 5675] <... futex resumed>) = 1 [pid 5674] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5673] <... futex resumed>) = 0 [pid 5075] rmdir("./59" [pid 5676] setpgid(0, 0 [pid 5675] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5674] <... mprotect resumed>) = 0 [pid 5673] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] umount2("./59", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5676] <... setpgid resumed>) = 0 [pid 5674] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5075] <... rmdir resumed>) = 0 [pid 5676] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5674] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5673] <... futex resumed>) = 0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5676] <... openat resumed>) = 3 [pid 5674] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5673] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] openat(AT_FDCWD, "./59", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5075] mkdir("./60", 0777./strace-static-x86_64: Process 5677 attached [pid 5676] write(3, "1000", 4 [pid 5077] <... openat resumed>) = 3 [pid 5075] <... mkdir resumed>) = 0 [pid 5677] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5676] <... write resumed>) = 4 [pid 5674] <... clone3 resumed> => {parent_tid=[5677]}, 88) = 5677 [pid 5677] <... rseq resumed>) = 0 [pid 5676] close(3 [pid 5677] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5674] rt_sigprocmask(SIG_SETMASK, [], [pid 5677] <... set_robust_list resumed>) = 0 [pid 5676] <... close resumed>) = 0 [pid 5674] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] newfstatat(3, "", [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5677] rt_sigprocmask(SIG_SETMASK, [], [pid 5676] symlink("/dev/binderfs", "./binderfs" [pid 5674] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5677] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5677] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5676] <... symlink resumed>) = 0 [pid 5674] <... futex resumed>) = 0 [pid 5077] getdents64(3, [pid 5675] <... bpf resumed>) = 6 [pid 5677] <... bpf resumed>) = 3 [pid 5674] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5677] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5676] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5675] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5677] <... futex resumed>) = 0 [pid 5676] <... futex resumed>) = 0 [pid 5674] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5677] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5676] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5675] <... futex resumed>) = 1 [pid 5674] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5677] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5676] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5675] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5674] <... futex resumed>) = 0 [pid 5677] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5676] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5674] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5677] <... bpf resumed>) = 4 [pid 5676] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5673] <... futex resumed>) = 0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 ./strace-static-x86_64: Process 5678 attached [pid 5677] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5676] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5673] exit_group(0 [pid 5077] umount2("./59/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5678 [pid 5678] set_robust_list(0x55555d6c46a0, 24 [pid 5677] <... futex resumed>) = 1 [pid 5676] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5675] <... futex resumed>) = ? [pid 5674] <... futex resumed>) = 0 [pid 5673] <... exit_group resumed>) = ? [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5678] <... set_robust_list resumed>) = 0 [pid 5677] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5676] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5675] +++ exited with 0 +++ [pid 5674] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5673] +++ exited with 0 +++ [pid 5077] newfstatat(AT_FDCWD, "./59/binderfs", [pid 5678] chdir("./60" [pid 5677] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5676] <... mprotect resumed>) = 0 [pid 5674] <... futex resumed>) = 0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5673, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5678] <... chdir resumed>) = 0 [pid 5677] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5676] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5674] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] unlink("./59/binderfs" [pid 5678] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5677] <... bpf resumed>) = 5 [pid 5676] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5077] <... unlink resumed>) = 0 [pid 5678] <... prctl resumed>) = 0 [pid 5677] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5676] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5077] getdents64(3, [pid 5074] umount2("./57", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5678] setpgid(0, 0 [pid 5677] <... futex resumed>) = 1 [pid 5674] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5679 attached [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5074] openat(AT_FDCWD, "./57", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5679] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053) = 0 [pid 5678] <... setpgid resumed>) = 0 [pid 5677] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5676] <... clone3 resumed> => {parent_tid=[5679]}, 88) = 5679 [pid 5674] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... openat resumed>) = 3 [pid 5679] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5678] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5677] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5676] rt_sigprocmask(SIG_SETMASK, [], [pid 5674] <... futex resumed>) = 0 [pid 5077] close(3 [pid 5074] newfstatat(3, "", [pid 5679] <... set_robust_list resumed>) = 0 [pid 5678] <... openat resumed>) = 3 [pid 5677] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5676] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5674] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] <... close resumed>) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5679] rt_sigprocmask(SIG_SETMASK, [], [pid 5678] write(3, "1000", 4 [pid 5676] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] rmdir("./59" [pid 5679] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5678] <... write resumed>) = 4 [pid 5676] <... futex resumed>) = 0 [pid 5074] getdents64(3, [pid 5679] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5678] close(3 [pid 5676] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5678] <... close resumed>) = 0 [pid 5678] symlink("/dev/binderfs", "./binderfs" [pid 5679] <... bpf resumed>) = 3 [pid 5678] <... symlink resumed>) = 0 [pid 5077] <... rmdir resumed>) = 0 [pid 5074] umount2("./57/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5679] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5679] <... futex resumed>) = 1 [pid 5677] <... bpf resumed>) = 6 [pid 5676] <... futex resumed>) = 0 [pid 5077] mkdir("./60", 0777 [pid 5074] newfstatat(AT_FDCWD, "./57/binderfs", [pid 5679] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5678] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5677] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5676] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5679] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5678] <... futex resumed>) = 0 [pid 5677] <... futex resumed>) = 1 [pid 5676] <... futex resumed>) = 0 [pid 5674] <... futex resumed>) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5678] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5676] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5674] exit_group(0 [pid 5679] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5678] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5674] <... exit_group resumed>) = ? [pid 5077] <... mkdir resumed>) = 0 [pid 5074] unlink("./57/binderfs" [pid 5678] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5678] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f3e2f5ed000 [pid 5678] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5679] <... bpf resumed>) = 4 [pid 5678] <... mprotect resumed>) = 0 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5678] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 ./strace-static-x86_64: Process 5680 attached [pid 5679] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5677] +++ exited with 0 +++ [pid 5674] +++ exited with 0 +++ [pid 5074] <... unlink resumed>) = 0 [pid 5679] <... futex resumed>) = 1 [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5680 [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5674, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5679] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5074] getdents64(3, [pid 5678] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5676] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5681 attached [pid 5676] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5681] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5678] <... clone3 resumed> => {parent_tid=[5681]}, 88) = 5681 [pid 5676] <... futex resumed>) = 0 [pid 5681] <... rseq resumed>) = 0 [pid 5678] rt_sigprocmask(SIG_SETMASK, [], [pid 5676] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5681] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5680] set_robust_list(0x55555d6c46a0, 24 [pid 5678] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5681] <... set_robust_list resumed>) = 0 [pid 5680] <... set_robust_list resumed>) = 0 [pid 5679] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5678] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] umount2("./58", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] close(3 [pid 5681] rt_sigprocmask(SIG_SETMASK, [], [pid 5679] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5678] <... futex resumed>) = 0 [pid 5681] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5680] chdir("./60" [pid 5678] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] <... close resumed>) = 0 [pid 5681] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5076] openat(AT_FDCWD, "./58", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5074] rmdir("./57" [pid 5680] <... chdir resumed>) = 0 [pid 5680] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5681] <... bpf resumed>) = 3 [pid 5681] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5678] <... futex resumed>) = 0 [pid 5681] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5678] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5681] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5680] <... prctl resumed>) = 0 [pid 5678] <... futex resumed>) = 0 [pid 5074] <... rmdir resumed>) = 0 [pid 5681] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5680] setpgid(0, 0 [pid 5678] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] <... openat resumed>) = 3 [pid 5681] <... bpf resumed>) = 4 [pid 5679] <... bpf resumed>) = 5 [pid 5076] newfstatat(3, "", [pid 5074] mkdir("./58", 0777 [pid 5681] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5680] <... setpgid resumed>) = 0 [pid 5679] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5681] <... futex resumed>) = 1 [pid 5680] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5678] <... futex resumed>) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5074] <... mkdir resumed>) = 0 [pid 5681] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5679] <... futex resumed>) = 1 [pid 5678] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5676] <... futex resumed>) = 0 [pid 5681] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5680] <... openat resumed>) = 3 [pid 5679] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5678] <... futex resumed>) = 0 [pid 5676] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] getdents64(3, [pid 5681] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5680] write(3, "1000", 4 [pid 5679] <... bpf resumed>) = 6 [pid 5678] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5676] <... futex resumed>) = 0 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5681] <... bpf resumed>) = 5 [pid 5680] <... write resumed>) = 4 [pid 5679] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5676] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000}./strace-static-x86_64: Process 5682 attached [pid 5681] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5680] close(3 [pid 5679] <... futex resumed>) = 0 [pid 5676] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5076] umount2("./58/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5682] set_robust_list(0x55555d6c46a0, 24 [pid 5681] <... futex resumed>) = 1 [pid 5680] <... close resumed>) = 0 [pid 5679] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5678] <... futex resumed>) = 0 [pid 5676] exit_group(0 [pid 5682] <... set_robust_list resumed>) = 0 [pid 5681] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5680] symlink("/dev/binderfs", "./binderfs" [pid 5679] <... futex resumed>) = ? [pid 5678] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5676] <... exit_group resumed>) = ? [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5682 [pid 5682] chdir("./58" [pid 5681] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5680] <... symlink resumed>) = 0 [pid 5679] +++ exited with 0 +++ [pid 5678] <... futex resumed>) = 0 [pid 5676] +++ exited with 0 +++ [pid 5076] newfstatat(AT_FDCWD, "./58/binderfs", [pid 5682] <... chdir resumed>) = 0 [pid 5681] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5680] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5678] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5676, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5682] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5680] <... futex resumed>) = 0 [pid 5076] unlink("./58/binderfs" [pid 5682] <... prctl resumed>) = 0 [pid 5680] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5682] setpgid(0, 0) = 0 [pid 5078] umount2("./62", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5682] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5680] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5681] <... bpf resumed>) = 6 [pid 5680] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5682] <... openat resumed>) = 3 [pid 5681] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5680] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] <... unlink resumed>) = 0 [pid 5078] openat(AT_FDCWD, "./62", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5680] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5078] <... openat resumed>) = 3 [pid 5682] write(3, "1000", 4 [pid 5681] <... futex resumed>) = 1 [pid 5678] <... futex resumed>) = 0 [pid 5682] <... write resumed>) = 4 [pid 5681] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5680] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5678] exit_group(0 [pid 5078] newfstatat(3, "", [pid 5076] getdents64(3, [pid 5682] close(3 [pid 5681] <... futex resumed>) = ? [pid 5680] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5678] <... exit_group resumed>) = ? [pid 5682] <... close resumed>) = 0 [pid 5681] +++ exited with 0 +++ [pid 5680] <... mprotect resumed>) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5680] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5078] getdents64(3, [pid 5076] close(3 [pid 5682] symlink("/dev/binderfs", "./binderfs" [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5076] <... close resumed>) = 0 [pid 5680] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5078] umount2("./62/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] rmdir("./58" [pid 5682] <... symlink resumed>) = 0 [pid 5682] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5680] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5678] +++ exited with 0 +++ [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] <... rmdir resumed>) = 0 [pid 5682] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5683 attached [pid 5682] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5078] newfstatat(AT_FDCWD, "./62/binderfs", [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5678, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5683] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5682] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5680] <... clone3 resumed> => {parent_tid=[5683]}, 88) = 5683 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5076] mkdir("./59", 0777 [pid 5683] <... rseq resumed>) = 0 [pid 5682] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5683] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5682] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5683] <... set_robust_list resumed>) = 0 [pid 5682] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5683] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5682] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5680] rt_sigprocmask(SIG_SETMASK, [], [pid 5078] unlink("./62/binderfs" [pid 5076] <... mkdir resumed>) = 0 [pid 5683] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5682] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5680] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] <... unlink resumed>) = 0 [pid 5683] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5682] <... mprotect resumed>) = 0 [pid 5680] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5078] getdents64(3, [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5075] umount2("./60", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5684 attached [pid 5683] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5682] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5680] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5684] set_robust_list(0x55555d6c46a0, 24 [pid 5683] <... bpf resumed>) = 3 [pid 5684] <... set_robust_list resumed>) = 0 [pid 5682] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5683] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5684] chdir("./59" [pid 5683] <... futex resumed>) = 0 [pid 5682] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5680] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5078] close(3 [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5684 [pid 5075] openat(AT_FDCWD, "./60", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY./strace-static-x86_64: Process 5685 attached [pid 5680] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... close resumed>) = 0 [pid 5075] <... openat resumed>) = 3 [pid 5685] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5680] <... futex resumed>) = 0 [pid 5078] rmdir("./62" [pid 5075] newfstatat(3, "", [pid 5685] <... rseq resumed>) = 0 [pid 5684] <... chdir resumed>) = 0 [pid 5683] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5682] <... clone3 resumed> => {parent_tid=[5685]}, 88) = 5685 [pid 5680] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... rmdir resumed>) = 0 [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5685] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5684] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5683] <... bpf resumed>) = 4 [pid 5682] rt_sigprocmask(SIG_SETMASK, [], [pid 5078] mkdir("./63", 0777 [pid 5075] getdents64(3, [pid 5685] <... set_robust_list resumed>) = 0 [pid 5684] <... prctl resumed>) = 0 [pid 5683] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5682] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5685] rt_sigprocmask(SIG_SETMASK, [], [pid 5684] setpgid(0, 0 [pid 5683] <... futex resumed>) = 1 [pid 5682] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5680] <... futex resumed>) = 0 [pid 5078] <... mkdir resumed>) = 0 [pid 5075] umount2("./60/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5685] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5680] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5682] <... futex resumed>) = 0 [pid 5684] <... setpgid resumed>) = 0 [pid 5683] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5682] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5680] <... futex resumed>) = 0 [pid 5685] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5684] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5680] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5685] <... bpf resumed>) = 3 [pid 5684] <... openat resumed>) = 3 [pid 5683] <... bpf resumed>) = 5 [pid 5685] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] newfstatat(AT_FDCWD, "./60/binderfs", [pid 5685] <... futex resumed>) = 1 [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5685] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5075] unlink("./60/binderfs"./strace-static-x86_64: Process 5686 attached [pid 5684] write(3, "1000", 4 [pid 5683] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5682] <... futex resumed>) = 0 [pid 5075] <... unlink resumed>) = 0 [pid 5686] set_robust_list(0x55555d6c46a0, 24 [pid 5684] <... write resumed>) = 4 [pid 5683] <... futex resumed>) = 1 [pid 5682] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5680] <... futex resumed>) = 0 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5686 [pid 5075] getdents64(3, [pid 5686] <... set_robust_list resumed>) = 0 [pid 5685] <... futex resumed>) = 0 [pid 5684] close(3 [pid 5683] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5682] <... futex resumed>) = 1 [pid 5680] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5686] chdir("./63" [pid 5685] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5684] <... close resumed>) = 0 [pid 5683] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5682] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5680] <... futex resumed>) = 0 [pid 5075] close(3 [pid 5686] <... chdir resumed>) = 0 [pid 5685] <... bpf resumed>) = 4 [pid 5684] symlink("/dev/binderfs", "./binderfs" [pid 5683] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5680] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5075] <... close resumed>) = 0 [pid 5686] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5685] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5683] <... bpf resumed>) = 6 [pid 5686] <... prctl resumed>) = 0 [pid 5685] <... futex resumed>) = 1 [pid 5684] <... symlink resumed>) = 0 [pid 5683] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5682] <... futex resumed>) = 0 [pid 5075] rmdir("./60" [pid 5686] setpgid(0, 0 [pid 5685] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5683] <... futex resumed>) = 1 [pid 5682] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5680] <... futex resumed>) = 0 [pid 5686] <... setpgid resumed>) = 0 [pid 5685] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5684] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5683] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5682] <... futex resumed>) = 0 [pid 5680] exit_group(0 [pid 5075] <... rmdir resumed>) = 0 [pid 5686] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5685] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5684] <... futex resumed>) = 0 [pid 5683] <... futex resumed>) = ? [pid 5682] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5680] <... exit_group resumed>) = ? [pid 5686] <... openat resumed>) = 3 [pid 5685] <... bpf resumed>) = 5 [pid 5684] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5683] +++ exited with 0 +++ [pid 5075] mkdir("./61", 0777 [pid 5686] write(3, "1000", 4) = 4 [pid 5686] close(3 [pid 5075] <... mkdir resumed>) = 0 [pid 5686] <... close resumed>) = 0 [pid 5680] +++ exited with 0 +++ [pid 5684] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5686] symlink("/dev/binderfs", "./binderfs" [pid 5684] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5680, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5686] <... symlink resumed>) = 0 [pid 5685] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5684] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] restart_syscall(<... resuming interrupted clone ...> [pid 5686] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5685] <... futex resumed>) = 1 [pid 5684] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5682] <... futex resumed>) = 0 [pid 5077] <... restart_syscall resumed>) = 0 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5687 attached [pid 5686] <... futex resumed>) = 0 [pid 5685] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5684] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5682] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5687] set_robust_list(0x55555d6c46a0, 24 [pid 5686] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5685] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5684] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5682] <... futex resumed>) = 0 [pid 5687] <... set_robust_list resumed>) = 0 [pid 5682] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5686] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5685] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5077] umount2("./60", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5686] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5686] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] openat(AT_FDCWD, "./60", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5687 [pid 5686] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5077] <... openat resumed>) = 3 [pid 5686] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5077] newfstatat(3, "", [pid 5686] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5687] chdir("./61" [pid 5686] <... mprotect resumed>) = 0 [pid 5687] <... chdir resumed>) = 0 [pid 5686] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5684] <... mprotect resumed>) = 0 [pid 5077] getdents64(3, [pid 5687] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5685] <... bpf resumed>) = 6 [pid 5685] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5687] <... prctl resumed>) = 0 [pid 5686] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5685] <... futex resumed>) = 1 [pid 5684] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5682] <... futex resumed>) = 0 [pid 5687] setpgid(0, 0 [pid 5686] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5685] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5684] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5682] exit_group(0 [pid 5077] umount2("./60/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5688 attached [pid 5687] <... setpgid resumed>) = 0 [pid 5685] <... futex resumed>) = ? [pid 5684] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5682] <... exit_group resumed>) = ? [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5687] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5685] +++ exited with 0 +++ [pid 5686] <... clone3 resumed> => {parent_tid=[5688]}, 88) = 5688 [pid 5077] newfstatat(AT_FDCWD, "./60/binderfs", [pid 5686] rt_sigprocmask(SIG_SETMASK, [], [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5686] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] unlink("./60/binderfs" [pid 5686] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5682] +++ exited with 0 +++ [pid 5077] <... unlink resumed>) = 0 ./strace-static-x86_64: Process 5689 attached [pid 5686] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5689] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5688] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5687] <... openat resumed>) = 3 [pid 5684] <... clone3 resumed> => {parent_tid=[5689]}, 88) = 5689 [pid 5077] getdents64(3, [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5682, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5689] <... rseq resumed>) = 0 [pid 5688] <... rseq resumed>) = 0 [pid 5687] write(3, "1000", 4 [pid 5684] rt_sigprocmask(SIG_SETMASK, [], [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5689] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5688] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5687] <... write resumed>) = 4 [pid 5684] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5689] <... set_robust_list resumed>) = 0 [pid 5688] <... set_robust_list resumed>) = 0 [pid 5687] close(3 [pid 5684] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] close(3 [pid 5689] rt_sigprocmask(SIG_SETMASK, [], [pid 5688] rt_sigprocmask(SIG_SETMASK, [], [pid 5684] <... futex resumed>) = 0 [pid 5687] <... close resumed>) = 0 [pid 5077] <... close resumed>) = 0 [pid 5074] umount2("./58", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5689] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5688] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5687] symlink("/dev/binderfs", "./binderfs" [pid 5684] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] rmdir("./60" [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5689] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5688] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5687] <... symlink resumed>) = 0 [pid 5077] <... rmdir resumed>) = 0 [pid 5689] <... bpf resumed>) = 3 [pid 5074] openat(AT_FDCWD, "./58", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5689] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5688] <... bpf resumed>) = 3 [pid 5687] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... openat resumed>) = 3 [pid 5689] <... futex resumed>) = 1 [pid 5688] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5684] <... futex resumed>) = 0 [pid 5077] mkdir("./61", 0777 [pid 5074] newfstatat(3, "", [pid 5689] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5688] <... futex resumed>) = 1 [pid 5687] <... futex resumed>) = 0 [pid 5686] <... futex resumed>) = 0 [pid 5684] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5689] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5688] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5687] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5686] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5684] <... futex resumed>) = 0 [pid 5077] <... mkdir resumed>) = 0 [pid 5074] getdents64(3, [pid 5689] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5688] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5687] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5686] <... futex resumed>) = 0 [pid 5684] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5689] <... bpf resumed>) = 4 [pid 5688] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5687] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5686] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] umount2("./58/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5690 attached [pid 5689] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5688] <... bpf resumed>) = 4 [pid 5687] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5689] <... futex resumed>) = 1 [pid 5687] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5684] <... futex resumed>) = 0 [pid 5690] set_robust_list(0x55555d6c46a0, 24 [pid 5684] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5687] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5689] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5684] <... futex resumed>) = 0 [pid 5074] newfstatat(AT_FDCWD, "./58/binderfs", [pid 5690] <... set_robust_list resumed>) = 0 [pid 5689] <... bpf resumed>) = 5 [pid 5688] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5687] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5684] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5690] chdir("./61" [pid 5687] <... mprotect resumed>) = 0 [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5690 [pid 5074] unlink("./58/binderfs" [pid 5690] <... chdir resumed>) = 0 [pid 5689] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5688] <... futex resumed>) = 1 [pid 5686] <... futex resumed>) = 0 [pid 5074] <... unlink resumed>) = 0 [pid 5690] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5689] <... futex resumed>) = 1 [pid 5688] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5687] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5686] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5684] <... futex resumed>) = 0 [pid 5690] <... prctl resumed>) = 0 [pid 5689] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5688] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5687] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5686] <... futex resumed>) = 0 [pid 5684] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] getdents64(3, [pid 5690] setpgid(0, 0 [pid 5689] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5688] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5687] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5686] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5684] <... futex resumed>) = 0 [pid 5690] <... setpgid resumed>) = 0 [pid 5689] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5684] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5689] <... bpf resumed>) = 6 [pid 5074] close(3./strace-static-x86_64: Process 5691 attached [pid 5689] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5688] <... bpf resumed>) = 5 [pid 5074] <... close resumed>) = 0 [pid 5691] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5689] <... futex resumed>) = 1 [pid 5684] <... futex resumed>) = 0 [pid 5074] rmdir("./58" [pid 5691] <... rseq resumed>) = 0 [pid 5690] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5689] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5688] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5687] <... clone3 resumed> => {parent_tid=[5691]}, 88) = 5691 [pid 5684] exit_group(0 [pid 5691] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5690] <... openat resumed>) = 3 [pid 5689] <... futex resumed>) = ? [pid 5688] <... futex resumed>) = 1 [pid 5687] rt_sigprocmask(SIG_SETMASK, [], [pid 5686] <... futex resumed>) = 0 [pid 5684] <... exit_group resumed>) = ? [pid 5074] <... rmdir resumed>) = 0 [pid 5691] <... set_robust_list resumed>) = 0 [pid 5690] write(3, "1000", 4 [pid 5689] +++ exited with 0 +++ [pid 5688] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5687] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5686] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5684] +++ exited with 0 +++ [pid 5691] rt_sigprocmask(SIG_SETMASK, [], [pid 5690] <... write resumed>) = 4 [pid 5688] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5687] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5686] <... futex resumed>) = 0 [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5684, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5074] mkdir("./59", 0777 [pid 5691] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5690] close(3 [pid 5688] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5687] <... futex resumed>) = 0 [pid 5686] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5691] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5687] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5691] <... bpf resumed>) = 3 [pid 5690] <... close resumed>) = 0 [pid 5074] <... mkdir resumed>) = 0 [pid 5691] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5690] symlink("/dev/binderfs", "./binderfs" [pid 5687] <... futex resumed>) = 0 [pid 5687] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5691] <... futex resumed>) = 1 [pid 5690] <... symlink resumed>) = 0 [pid 5687] <... futex resumed>) = 0 [pid 5691] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5687] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5690] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] umount2("./59", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5692 attached [pid 5691] <... bpf resumed>) = 4 [pid 5690] <... futex resumed>) = 0 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] openat(AT_FDCWD, "./59", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5692] set_robust_list(0x55555d6c46a0, 24 [pid 5691] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5690] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5076] <... openat resumed>) = 3 [pid 5690] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5076] newfstatat(3, "", [pid 5692] <... set_robust_list resumed>) = 0 [pid 5691] <... futex resumed>) = 1 [pid 5690] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5688] <... bpf resumed>) = 6 [pid 5687] <... futex resumed>) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5692 [pid 5691] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5688] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5687] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] getdents64(3, [pid 5692] chdir("./59" [pid 5690] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5688] <... futex resumed>) = 1 [pid 5687] <... futex resumed>) = 0 [pid 5686] <... futex resumed>) = 0 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5688] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5686] exit_group(0 [pid 5688] <... futex resumed>) = ? [pid 5686] <... exit_group resumed>) = ? [pid 5076] umount2("./59/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5692] <... chdir resumed>) = 0 [pid 5691] <... bpf resumed>) = 5 [pid 5690] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5688] +++ exited with 0 +++ [pid 5687] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5686] +++ exited with 0 +++ [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5686, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5692] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5076] newfstatat(AT_FDCWD, "./59/binderfs", [pid 5692] <... prctl resumed>) = 0 [pid 5691] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5690] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5690] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5692] setpgid(0, 0) = 0 [pid 5691] <... futex resumed>) = 1 [pid 5690] <... mprotect resumed>) = 0 [pid 5687] <... futex resumed>) = 0 [pid 5078] umount2("./63", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] unlink("./59/binderfs" [pid 5692] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5691] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5690] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5687] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] <... unlink resumed>) = 0 [pid 5687] <... futex resumed>) = 0 [pid 5078] openat(AT_FDCWD, "./63", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5687] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] <... openat resumed>) = 3 [pid 5690] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5076] getdents64(3, [pid 5692] <... openat resumed>) = 3 [pid 5690] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5692] write(3, "1000", 4./strace-static-x86_64: Process 5693 attached ) = 4 [pid 5078] newfstatat(3, "", [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5693] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5692] close(3 [pid 5690] <... clone3 resumed> => {parent_tid=[5693]}, 88) = 5693 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5076] close(3 [pid 5693] <... rseq resumed>) = 0 [pid 5692] <... close resumed>) = 0 [pid 5690] rt_sigprocmask(SIG_SETMASK, [], [pid 5078] getdents64(3, [pid 5076] <... close resumed>) = 0 [pid 5693] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5692] symlink("/dev/binderfs", "./binderfs" [pid 5690] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5076] rmdir("./59" [pid 5693] <... set_robust_list resumed>) = 0 [pid 5692] <... symlink resumed>) = 0 [pid 5690] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] umount2("./63/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5693] rt_sigprocmask(SIG_SETMASK, [], [pid 5692] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5690] <... futex resumed>) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] <... rmdir resumed>) = 0 [pid 5691] <... bpf resumed>) = 6 [pid 5693] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5692] <... futex resumed>) = 0 [pid 5690] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] newfstatat(AT_FDCWD, "./63/binderfs", [pid 5076] mkdir("./60", 0777 [pid 5693] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5692] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5691] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5692] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5691] <... futex resumed>) = 1 [pid 5687] <... futex resumed>) = 0 [pid 5076] <... mkdir resumed>) = 0 [pid 5693] <... bpf resumed>) = 3 [pid 5692] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5691] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5693] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5692] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5687] exit_group(0 [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5693] <... futex resumed>) = 1 [pid 5692] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5690] <... futex resumed>) = 0 [pid 5687] <... exit_group resumed>) = ? [pid 5078] unlink("./63/binderfs"./strace-static-x86_64: Process 5694 attached [pid 5693] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5692] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5691] <... futex resumed>) = ? [pid 5690] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... unlink resumed>) = 0 [pid 5693] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5078] getdents64(3, 0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5078] close(3) = 0 [pid 5078] rmdir("./63" [pid 5694] set_robust_list(0x55555d6c46a0, 24 [pid 5693] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5692] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5691] +++ exited with 0 +++ [pid 5690] <... futex resumed>) = 0 [pid 5687] +++ exited with 0 +++ [pid 5078] <... rmdir resumed>) = 0 [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5694 [pid 5694] <... set_robust_list resumed>) = 0 [pid 5693] <... bpf resumed>) = 4 [pid 5692] <... mprotect resumed>) = 0 [pid 5690] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5692] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5078] mkdir("./64", 0777 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5687, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5693] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5694] chdir("./60" [pid 5692] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5078] <... mkdir resumed>) = 0 [pid 5075] restart_syscall(<... resuming interrupted clone ...> [pid 5690] <... futex resumed>) = 0 [pid 5693] <... futex resumed>) = 1 [pid 5694] <... chdir resumed>) = 0 [pid 5692] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5690] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... restart_syscall resumed>) = 0 ./strace-static-x86_64: Process 5695 attached [pid 5694] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5693] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5690] <... futex resumed>) = 0 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5696 attached [pid 5695] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5694] <... prctl resumed>) = 0 [pid 5693] <... bpf resumed>) = 5 [pid 5692] <... clone3 resumed> => {parent_tid=[5695]}, 88) = 5695 [pid 5690] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5696] set_robust_list(0x55555d6c46a0, 24 [pid 5695] <... rseq resumed>) = 0 [pid 5694] setpgid(0, 0 [pid 5693] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5692] rt_sigprocmask(SIG_SETMASK, [], [pid 5690] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5696] <... set_robust_list resumed>) = 0 [pid 5694] <... setpgid resumed>) = 0 [pid 5693] <... futex resumed>) = 0 [pid 5692] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5690] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5695] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5694] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5693] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5692] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5690] <... futex resumed>) = 0 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5696 [pid 5075] umount2("./61", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5696] chdir("./64" [pid 5695] <... set_robust_list resumed>) = 0 [pid 5694] <... openat resumed>) = 3 [pid 5692] <... futex resumed>) = 0 [pid 5690] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5696] <... chdir resumed>) = 0 [pid 5696] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5695] rt_sigprocmask(SIG_SETMASK, [], [pid 5694] write(3, "1000", 4 [pid 5692] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] openat(AT_FDCWD, "./61", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5696] <... prctl resumed>) = 0 [pid 5695] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5694] <... write resumed>) = 4 [pid 5075] <... openat resumed>) = 3 [pid 5696] setpgid(0, 0 [pid 5695] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5075] newfstatat(3, "", [pid 5695] <... bpf resumed>) = 3 [pid 5696] <... setpgid resumed>) = 0 [pid 5695] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5694] close(3 [pid 5696] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5695] <... futex resumed>) = 1 [pid 5694] <... close resumed>) = 0 [pid 5693] <... bpf resumed>) = 6 [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5696] <... openat resumed>) = 3 [pid 5695] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5694] symlink("/dev/binderfs", "./binderfs" [pid 5693] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5692] <... futex resumed>) = 0 [pid 5696] write(3, "1000", 4 [pid 5694] <... symlink resumed>) = 0 [pid 5693] <... futex resumed>) = 1 [pid 5692] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5690] <... futex resumed>) = 0 [pid 5075] getdents64(3, [pid 5696] <... write resumed>) = 4 [pid 5695] <... futex resumed>) = 0 [pid 5694] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5693] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5692] <... futex resumed>) = 1 [pid 5690] exit_group(0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5696] close(3 [pid 5695] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5694] <... futex resumed>) = 0 [pid 5693] <... futex resumed>) = ? [pid 5692] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5690] <... exit_group resumed>) = ? [pid 5696] <... close resumed>) = 0 [pid 5695] <... bpf resumed>) = 4 [pid 5694] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5075] umount2("./61/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5696] symlink("/dev/binderfs", "./binderfs" [pid 5695] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5694] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5696] <... symlink resumed>) = 0 [pid 5694] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5075] newfstatat(AT_FDCWD, "./61/binderfs", [pid 5694] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5696] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5695] <... futex resumed>) = 1 [pid 5694] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5692] <... futex resumed>) = 0 [pid 5075] unlink("./61/binderfs" [pid 5696] <... futex resumed>) = 0 [pid 5695] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5694] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5693] +++ exited with 0 +++ [pid 5692] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5690] +++ exited with 0 +++ [pid 5075] <... unlink resumed>) = 0 [pid 5696] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5695] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5694] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5692] <... futex resumed>) = 0 [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5690, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5075] getdents64(3, [pid 5696] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5695] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5694] <... mprotect resumed>) = 0 [pid 5692] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] restart_syscall(<... resuming interrupted clone ...> [pid 5696] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5695] <... bpf resumed>) = 5 [pid 5077] <... restart_syscall resumed>) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5696] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5694] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5075] close(3 [pid 5696] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5695] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5694] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5696] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5695] <... futex resumed>) = 1 [pid 5694] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5692] <... futex resumed>) = 0 [pid 5075] <... close resumed>) = 0 [pid 5696] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5695] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 5697 attached [pid 5696] <... mprotect resumed>) = 0 [pid 5695] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5692] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] umount2("./61", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] rmdir("./61" [pid 5697] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053) = 0 [pid 5695] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5692] <... futex resumed>) = 0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5697] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5696] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5694] <... clone3 resumed> => {parent_tid=[5697]}, 88) = 5697 [pid 5692] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] openat(AT_FDCWD, "./61", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5075] <... rmdir resumed>) = 0 [pid 5697] <... set_robust_list resumed>) = 0 [pid 5696] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5694] rt_sigprocmask(SIG_SETMASK, [], [pid 5077] <... openat resumed>) = 3 [pid 5075] mkdir("./62", 0777 [pid 5697] rt_sigprocmask(SIG_SETMASK, [], [pid 5696] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5077] newfstatat(3, "", [pid 5697] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5695] <... bpf resumed>) = 6 [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 ./strace-static-x86_64: Process 5698 attached [pid 5697] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5695] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5694] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5698] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5696] <... clone3 resumed> => {parent_tid=[5698]}, 88) = 5698 [pid 5695] <... futex resumed>) = 1 [pid 5694] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5692] <... futex resumed>) = 0 [pid 5077] getdents64(3, [pid 5075] <... mkdir resumed>) = 0 [pid 5698] <... rseq resumed>) = 0 [pid 5697] <... futex resumed>) = 0 [pid 5696] rt_sigprocmask(SIG_SETMASK, [], [pid 5695] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5694] <... futex resumed>) = 1 [pid 5692] exit_group(0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5698] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5697] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5696] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5694] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5695] <... futex resumed>) = ? [pid 5692] <... exit_group resumed>) = ? [pid 5698] <... set_robust_list resumed>) = 0 [pid 5077] umount2("./61/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5699 attached [pid 5698] rt_sigprocmask(SIG_SETMASK, [], [pid 5697] <... bpf resumed>) = 3 [pid 5696] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5695] +++ exited with 0 +++ [pid 5692] +++ exited with 0 +++ [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5699] set_robust_list(0x55555d6c46a0, 24 [pid 5698] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5697] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5696] <... futex resumed>) = 0 [pid 5077] newfstatat(AT_FDCWD, "./61/binderfs", [pid 5699] <... set_robust_list resumed>) = 0 [pid 5698] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5697] <... futex resumed>) = 1 [pid 5696] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5694] <... futex resumed>) = 0 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5699 [pid 5699] chdir("./62" [pid 5697] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5694] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5698] <... bpf resumed>) = 3 [pid 5699] <... chdir resumed>) = 0 [pid 5697] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5694] <... futex resumed>) = 0 [pid 5698] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] unlink("./61/binderfs" [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5692, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5699] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5698] <... futex resumed>) = 1 [pid 5697] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5696] <... futex resumed>) = 0 [pid 5694] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... unlink resumed>) = 0 [pid 5074] umount2("./59", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5699] <... prctl resumed>) = 0 [pid 5698] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5697] <... bpf resumed>) = 4 [pid 5696] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5699] setpgid(0, 0 [pid 5698] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5697] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5696] <... futex resumed>) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5699] <... setpgid resumed>) = 0 [pid 5698] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5697] <... futex resumed>) = 1 [pid 5696] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5694] <... futex resumed>) = 0 [pid 5077] getdents64(3, [pid 5074] openat(AT_FDCWD, "./59", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5699] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5697] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5694] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5074] <... openat resumed>) = 3 [pid 5697] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5694] <... futex resumed>) = 0 [pid 5077] close(3 [pid 5699] <... openat resumed>) = 3 [pid 5694] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] newfstatat(3, "", [pid 5699] write(3, "1000", 4 [pid 5698] <... bpf resumed>) = 4 [pid 5697] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5077] <... close resumed>) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5699] <... write resumed>) = 4 [pid 5698] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] rmdir("./61" [pid 5074] getdents64(3, [pid 5699] close(3 [pid 5698] <... futex resumed>) = 1 [pid 5697] <... bpf resumed>) = 5 [pid 5696] <... futex resumed>) = 0 [pid 5077] <... rmdir resumed>) = 0 [pid 5699] <... close resumed>) = 0 [pid 5698] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5697] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5696] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5699] symlink("/dev/binderfs", "./binderfs" [pid 5698] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5697] <... futex resumed>) = 1 [pid 5696] <... futex resumed>) = 0 [pid 5694] <... futex resumed>) = 0 [pid 5698] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5697] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5696] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5699] <... symlink resumed>) = 0 [pid 5694] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] mkdir("./62", 0777 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5699] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5698] <... bpf resumed>) = 5 [pid 5697] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5694] <... futex resumed>) = 0 [pid 5077] <... mkdir resumed>) = 0 [pid 5074] umount2("./59/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5699] <... futex resumed>) = 0 [pid 5698] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5697] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5694] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5700 attached [pid 5699] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5698] <... futex resumed>) = 1 [pid 5697] <... bpf resumed>) = 6 [pid 5696] <... futex resumed>) = 0 [pid 5074] newfstatat(AT_FDCWD, "./59/binderfs", [pid 5700] set_robust_list(0x55555d6c46a0, 24 [pid 5699] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5698] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5697] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5696] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5700] <... set_robust_list resumed>) = 0 [pid 5699] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5698] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5697] <... futex resumed>) = 1 [pid 5696] <... futex resumed>) = 0 [pid 5694] <... futex resumed>) = 0 [pid 5699] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5698] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5697] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5696] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5700] chdir("./62" [pid 5699] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5694] exit_group(0 [pid 5700] <... chdir resumed>) = 0 [pid 5699] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5698] <... bpf resumed>) = 6 [pid 5697] <... futex resumed>) = ? [pid 5694] <... exit_group resumed>) = ? [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5700 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5700] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5699] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5698] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5697] +++ exited with 0 +++ [pid 5074] unlink("./59/binderfs") = 0 [pid 5074] getdents64(3, [pid 5700] <... prctl resumed>) = 0 [pid 5699] <... mprotect resumed>) = 0 [pid 5696] <... futex resumed>) = 0 [pid 5700] setpgid(0, 0 [pid 5696] exit_group(0 [pid 5698] <... futex resumed>) = 1 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5700] <... setpgid resumed>) = 0 [pid 5699] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5698] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5696] <... exit_group resumed>) = ? [pid 5700] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5699] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5698] +++ exited with 0 +++ [pid 5074] close(3) = 0 [pid 5700] <... openat resumed>) = 3 [pid 5699] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5074] rmdir("./59"./strace-static-x86_64: Process 5701 attached [pid 5700] write(3, "1000", 4 [pid 5074] <... rmdir resumed>) = 0 [pid 5701] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5700] <... write resumed>) = 4 [pid 5699] <... clone3 resumed> => {parent_tid=[5701]}, 88) = 5701 [pid 5694] +++ exited with 0 +++ [pid 5701] <... rseq resumed>) = 0 [pid 5700] close(3 [pid 5699] rt_sigprocmask(SIG_SETMASK, [], [pid 5696] +++ exited with 0 +++ [pid 5074] mkdir("./60", 0777 [pid 5701] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5700] <... close resumed>) = 0 [pid 5699] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5696, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5694, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5701] <... set_robust_list resumed>) = 0 [pid 5700] symlink("/dev/binderfs", "./binderfs" [pid 5699] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] umount2("./60", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... mkdir resumed>) = 0 [pid 5701] rt_sigprocmask(SIG_SETMASK, [], [pid 5700] <... symlink resumed>) = 0 [pid 5699] <... futex resumed>) = 0 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5701] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5700] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5699] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] umount2("./64", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] openat(AT_FDCWD, "./60", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5701] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5700] <... futex resumed>) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] <... openat resumed>) = 3 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5701] <... bpf resumed>) = 3 [pid 5700] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5078] openat(AT_FDCWD, "./64", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5701] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5700] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5078] <... openat resumed>) = 3 [pid 5701] <... futex resumed>) = 1 [pid 5700] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5699] <... futex resumed>) = 0 [pid 5078] newfstatat(3, "", [pid 5701] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5700] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5699] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 ./strace-static-x86_64: Process 5702 attached [pid 5076] newfstatat(3, "", [pid 5701] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5700] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5699] <... futex resumed>) = 0 [pid 5078] getdents64(3, [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5702] set_robust_list(0x55555d6c46a0, 24 [pid 5701] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5700] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5699] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5702 [pid 5702] <... set_robust_list resumed>) = 0 [pid 5701] <... bpf resumed>) = 4 [pid 5700] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5076] getdents64(3, [pid 5702] chdir("./60" [pid 5701] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5700] <... mprotect resumed>) = 0 [pid 5078] umount2("./64/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5702] <... chdir resumed>) = 0 [pid 5701] <... futex resumed>) = 1 [pid 5700] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5699] <... futex resumed>) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5702] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5701] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5700] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5699] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] newfstatat(AT_FDCWD, "./64/binderfs", [pid 5076] umount2("./60/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5702] <... prctl resumed>) = 0 [pid 5701] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5700] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5699] <... futex resumed>) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5703 attached [pid 5702] setpgid(0, 0 [pid 5701] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5699] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] unlink("./64/binderfs" [pid 5703] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5702] <... setpgid resumed>) = 0 [pid 5076] newfstatat(AT_FDCWD, "./60/binderfs", [pid 5702] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5701] <... bpf resumed>) = 5 [pid 5703] <... rseq resumed>) = 0 [pid 5702] <... openat resumed>) = 3 [pid 5701] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5700] <... clone3 resumed> => {parent_tid=[5703]}, 88) = 5703 [pid 5078] <... unlink resumed>) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5703] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5702] write(3, "1000", 4 [pid 5701] <... futex resumed>) = 1 [pid 5700] rt_sigprocmask(SIG_SETMASK, [], [pid 5699] <... futex resumed>) = 0 [pid 5078] getdents64(3, [pid 5076] unlink("./60/binderfs" [pid 5703] <... set_robust_list resumed>) = 0 [pid 5702] <... write resumed>) = 4 [pid 5701] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5700] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5699] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5076] <... unlink resumed>) = 0 [pid 5703] rt_sigprocmask(SIG_SETMASK, [], [pid 5702] close(3 [pid 5701] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5700] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5699] <... futex resumed>) = 0 [pid 5078] close(3 [pid 5703] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5701] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5700] <... futex resumed>) = 0 [pid 5699] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] <... close resumed>) = 0 [pid 5703] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5700] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5702] <... close resumed>) = 0 [pid 5701] <... bpf resumed>) = 6 [pid 5078] rmdir("./64" [pid 5703] <... bpf resumed>) = 3 [pid 5076] getdents64(3, [pid 5703] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5702] symlink("/dev/binderfs", "./binderfs" [pid 5701] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5703] <... futex resumed>) = 1 [pid 5702] <... symlink resumed>) = 0 [pid 5701] <... futex resumed>) = 1 [pid 5700] <... futex resumed>) = 0 [pid 5699] <... futex resumed>) = 0 [pid 5078] <... rmdir resumed>) = 0 [pid 5076] close(3 [pid 5703] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5702] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5701] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5700] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5699] exit_group(0 [pid 5078] mkdir("./65", 0777 [pid 5076] <... close resumed>) = 0 [pid 5703] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5702] <... futex resumed>) = 0 [pid 5701] <... futex resumed>) = ? [pid 5700] <... futex resumed>) = 0 [pid 5699] <... exit_group resumed>) = ? [pid 5076] rmdir("./60" [pid 5703] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5702] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5701] +++ exited with 0 +++ [pid 5700] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... mkdir resumed>) = 0 [pid 5076] <... rmdir resumed>) = 0 [pid 5702] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5076] mkdir("./61", 0777 [pid 5703] <... bpf resumed>) = 4 [pid 5702] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5703] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5699] +++ exited with 0 +++ [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5702] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5076] <... mkdir resumed>) = 0 [pid 5702] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f3e2f5ed000 [pid 5702] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5703] <... futex resumed>) = 1 [pid 5700] <... futex resumed>) = 0 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5699, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- ./strace-static-x86_64: Process 5704 attached [pid 5703] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5702] <... mprotect resumed>) = 0 [pid 5700] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5704 [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5075] restart_syscall(<... resuming interrupted clone ...>./strace-static-x86_64: Process 5705 attached [pid 5704] set_robust_list(0x55555d6c46a0, 24 [pid 5703] <... bpf resumed>) = 5 [pid 5702] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5700] <... futex resumed>) = 0 [pid 5075] <... restart_syscall resumed>) = 0 [pid 5705] set_robust_list(0x55555d6c46a0, 24 [pid 5704] <... set_robust_list resumed>) = 0 [pid 5703] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5702] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5700] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5705] <... set_robust_list resumed>) = 0 [pid 5703] <... futex resumed>) = 0 [pid 5702] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5700] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) ./strace-static-x86_64: Process 5706 attached [pid 5705] chdir("./61" [pid 5704] chdir("./65" [pid 5703] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5700] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] umount2("./62", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5706] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5705] <... chdir resumed>) = 0 [pid 5704] <... chdir resumed>) = 0 [pid 5703] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5702] <... clone3 resumed> => {parent_tid=[5706]}, 88) = 5706 [pid 5700] <... futex resumed>) = 0 [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5705 [pid 5706] <... rseq resumed>) = 0 [pid 5705] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5704] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5703] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5702] rt_sigprocmask(SIG_SETMASK, [], [pid 5700] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5706] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5705] <... prctl resumed>) = 0 [pid 5704] <... prctl resumed>) = 0 [pid 5702] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] openat(AT_FDCWD, "./62", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5706] <... set_robust_list resumed>) = 0 [pid 5705] setpgid(0, 0 [pid 5704] setpgid(0, 0 [pid 5702] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5706] rt_sigprocmask(SIG_SETMASK, [], [pid 5705] <... setpgid resumed>) = 0 [pid 5704] <... setpgid resumed>) = 0 [pid 5703] <... bpf resumed>) = 6 [pid 5702] <... futex resumed>) = 0 [pid 5075] <... openat resumed>) = 3 [pid 5706] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5705] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5702] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5704] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5703] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] newfstatat(3, "", [pid 5706] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5703] <... futex resumed>) = 1 [pid 5705] <... openat resumed>) = 3 [pid 5700] <... futex resumed>) = 0 [pid 5706] <... bpf resumed>) = 3 [pid 5705] write(3, "1000", 4 [pid 5704] <... openat resumed>) = 3 [pid 5703] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5706] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5705] <... write resumed>) = 4 [pid 5704] write(3, "1000", 4 [pid 5700] exit_group(0 [pid 5075] getdents64(3, [pid 5706] <... futex resumed>) = 1 [pid 5705] close(3 [pid 5704] <... write resumed>) = 4 [pid 5703] <... futex resumed>) = ? [pid 5702] <... futex resumed>) = 0 [pid 5700] <... exit_group resumed>) = ? [pid 5706] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5705] <... close resumed>) = 0 [pid 5704] close(3 [pid 5703] +++ exited with 0 +++ [pid 5702] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5702] <... futex resumed>) = 0 [pid 5702] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5706] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5705] symlink("/dev/binderfs", "./binderfs" [pid 5704] <... close resumed>) = 0 [pid 5075] umount2("./62/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5706] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5705] <... symlink resumed>) = 0 [pid 5704] symlink("/dev/binderfs", "./binderfs" [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5700] +++ exited with 0 +++ [pid 5075] newfstatat(AT_FDCWD, "./62/binderfs", [pid 5706] <... bpf resumed>) = 4 [pid 5705] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5704] <... symlink resumed>) = 0 [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5700, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5706] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5705] <... futex resumed>) = 0 [pid 5704] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5705] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5075] unlink("./62/binderfs" [pid 5706] <... futex resumed>) = 1 [pid 5705] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5704] <... futex resumed>) = 0 [pid 5702] <... futex resumed>) = 0 [pid 5706] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5705] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5704] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5702] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... unlink resumed>) = 0 [pid 5702] <... futex resumed>) = 0 [pid 5706] <... bpf resumed>) = 5 [pid 5705] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5704] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5702] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] getdents64(3, [pid 5706] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5705] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5704] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5702] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5702] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] umount2("./62", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5702] <... futex resumed>) = 0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5077] openat(AT_FDCWD, "./62", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5702] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5706] <... futex resumed>) = 1 [pid 5705] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5704] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5702] <... futex resumed>) = 0 [pid 5077] <... openat resumed>) = 3 [pid 5075] close(3 [pid 5706] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5705] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5704] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5075] <... close resumed>) = 0 [pid 5702] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=548000000} [pid 5077] newfstatat(3, "", [pid 5705] <... mprotect resumed>) = 0 [pid 5704] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5075] rmdir("./62" [pid 5705] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5704] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5705] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5704] <... mprotect resumed>) = 0 [pid 5077] getdents64(3, [pid 5705] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5704] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5075] <... rmdir resumed>) = 0 ./strace-static-x86_64: Process 5707 attached [pid 5704] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5075] mkdir("./63", 0777 [pid 5707] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5705] <... clone3 resumed> => {parent_tid=[5707]}, 88) = 5707 [pid 5704] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5077] umount2("./62/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5708 attached [pid 5707] <... rseq resumed>) = 0 [pid 5705] rt_sigprocmask(SIG_SETMASK, [], [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5708] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5707] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5706] <... bpf resumed>) = 6 [pid 5705] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5704] <... clone3 resumed> => {parent_tid=[5708]}, 88) = 5708 [pid 5707] <... set_robust_list resumed>) = 0 [pid 5705] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5706] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5704] rt_sigprocmask(SIG_SETMASK, [], [pid 5075] <... mkdir resumed>) = 0 [pid 5707] rt_sigprocmask(SIG_SETMASK, [], [pid 5706] <... futex resumed>) = 1 [pid 5705] <... futex resumed>) = 0 [pid 5704] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5708] <... rseq resumed>) = 0 [pid 5707] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5706] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5705] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5704] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5702] <... futex resumed>) = 0 [pid 5077] newfstatat(AT_FDCWD, "./62/binderfs", [pid 5708] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5702] exit_group(0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 ./strace-static-x86_64: Process 5709 attached [pid 5708] <... set_robust_list resumed>) = 0 [pid 5707] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5706] <... futex resumed>) = ? [pid 5704] <... futex resumed>) = 0 [pid 5702] <... exit_group resumed>) = ? [pid 5077] unlink("./62/binderfs" [pid 5709] set_robust_list(0x55555d6c46a0, 24 [pid 5708] rt_sigprocmask(SIG_SETMASK, [], [pid 5707] <... bpf resumed>) = 3 [pid 5706] +++ exited with 0 +++ [pid 5704] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5709] <... set_robust_list resumed>) = 0 [pid 5708] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5707] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5709 [pid 5709] chdir("./63" [pid 5707] <... futex resumed>) = 1 [pid 5705] <... futex resumed>) = 0 [pid 5709] <... chdir resumed>) = 0 [pid 5707] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5705] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5709] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5707] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5705] <... futex resumed>) = 0 [pid 5709] <... prctl resumed>) = 0 [pid 5707] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5705] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... unlink resumed>) = 0 [pid 5708] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5709] setpgid(0, 0 [pid 5702] +++ exited with 0 +++ [pid 5077] getdents64(3, [pid 5709] <... setpgid resumed>) = 0 [pid 5708] <... bpf resumed>) = 3 [pid 5707] <... bpf resumed>) = 4 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5702, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5709] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5708] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5707] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] close(3 [pid 5709] <... openat resumed>) = 3 [pid 5708] <... futex resumed>) = 1 [pid 5707] <... futex resumed>) = 1 [pid 5705] <... futex resumed>) = 0 [pid 5704] <... futex resumed>) = 0 [pid 5077] <... close resumed>) = 0 [pid 5709] write(3, "1000", 4 [pid 5708] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5707] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5705] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5704] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] rmdir("./62" [pid 5074] umount2("./60", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5709] <... write resumed>) = 4 [pid 5708] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5707] <... bpf resumed>) = 5 [pid 5705] <... futex resumed>) = 0 [pid 5704] <... futex resumed>) = 0 [pid 5077] <... rmdir resumed>) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5709] close(3 [pid 5708] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5707] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5705] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5704] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] openat(AT_FDCWD, "./60", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5709] <... close resumed>) = 0 [pid 5708] <... bpf resumed>) = 4 [pid 5707] <... futex resumed>) = 0 [pid 5705] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5077] mkdir("./63", 0777 [pid 5074] <... openat resumed>) = 3 [pid 5709] symlink("/dev/binderfs", "./binderfs" [pid 5708] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5707] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5705] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... mkdir resumed>) = 0 [pid 5074] newfstatat(3, "", [pid 5709] <... symlink resumed>) = 0 [pid 5708] <... futex resumed>) = 1 [pid 5707] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5705] <... futex resumed>) = 0 [pid 5704] <... futex resumed>) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5709] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5708] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5707] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5705] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5704] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] getdents64(3, ./strace-static-x86_64: Process 5710 attached [pid 5709] <... futex resumed>) = 0 [pid 5708] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5707] <... bpf resumed>) = 6 [pid 5704] <... futex resumed>) = 0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5710] set_robust_list(0x55555d6c46a0, 24 [pid 5709] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5708] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5707] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5704] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5710] <... set_robust_list resumed>) = 0 [pid 5709] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5708] <... bpf resumed>) = 5 [pid 5707] <... futex resumed>) = 1 [pid 5705] <... futex resumed>) = 0 [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5710 [pid 5074] umount2("./60/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5710] chdir("./63" [pid 5709] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5707] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5705] exit_group(0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5710] <... chdir resumed>) = 0 [pid 5709] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5708] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5707] <... futex resumed>) = ? [pid 5705] <... exit_group resumed>) = ? [pid 5074] newfstatat(AT_FDCWD, "./60/binderfs", [pid 5710] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5709] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5708] <... futex resumed>) = 1 [pid 5707] +++ exited with 0 +++ [pid 5704] <... futex resumed>) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5710] <... prctl resumed>) = 0 [pid 5708] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5074] unlink("./60/binderfs" [pid 5710] setpgid(0, 0 [pid 5709] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5704] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... unlink resumed>) = 0 [pid 5710] <... setpgid resumed>) = 0 [pid 5709] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5708] <... futex resumed>) = 0 [pid 5704] <... futex resumed>) = 1 [pid 5710] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5709] <... mprotect resumed>) = 0 [pid 5708] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5704] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5074] getdents64(3, [pid 5710] <... openat resumed>) = 3 [pid 5709] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5705] +++ exited with 0 +++ [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5710] write(3, "1000", 4 [pid 5709] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5705, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5710] <... write resumed>) = 4 [pid 5709] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5074] close(3./strace-static-x86_64: Process 5711 attached [pid 5710] close(3 [pid 5711] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5710] <... close resumed>) = 0 [pid 5709] <... clone3 resumed> => {parent_tid=[5711]}, 88) = 5711 [pid 5076] umount2("./61", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... close resumed>) = 0 [pid 5711] <... rseq resumed>) = 0 [pid 5710] symlink("/dev/binderfs", "./binderfs" [pid 5709] rt_sigprocmask(SIG_SETMASK, [], [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] rmdir("./60" [pid 5711] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5710] <... symlink resumed>) = 0 [pid 5709] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5076] openat(AT_FDCWD, "./61", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5074] <... rmdir resumed>) = 0 [pid 5711] <... set_robust_list resumed>) = 0 [pid 5710] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5709] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... openat resumed>) = 3 [pid 5711] rt_sigprocmask(SIG_SETMASK, [], [pid 5710] <... futex resumed>) = 0 [pid 5709] <... futex resumed>) = 0 [pid 5711] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5710] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5709] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5708] <... bpf resumed>) = 6 [pid 5076] newfstatat(3, "", [pid 5074] mkdir("./61", 0777 [pid 5711] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5710] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5711] <... bpf resumed>) = 3 [pid 5710] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5708] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5074] <... mkdir resumed>) = 0 [pid 5711] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5710] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5708] <... futex resumed>) = 1 [pid 5704] <... futex resumed>) = 0 [pid 5711] <... futex resumed>) = 1 [pid 5710] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5709] <... futex resumed>) = 0 [pid 5711] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5704] exit_group(0 [pid 5711] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5710] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5709] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5704] <... exit_group resumed>) = ? [pid 5076] getdents64(3, [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5711] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5710] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5709] <... futex resumed>) = 0 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 ./strace-static-x86_64: Process 5712 attached [pid 5711] <... bpf resumed>) = 4 [pid 5710] <... mprotect resumed>) = 0 [pid 5709] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5708] +++ exited with 0 +++ [pid 5704] +++ exited with 0 +++ [pid 5076] umount2("./61/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5712] set_robust_list(0x55555d6c46a0, 24) = 0 [pid 5711] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5704, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5711] <... futex resumed>) = 1 [pid 5710] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5709] <... futex resumed>) = 0 [pid 5076] newfstatat(AT_FDCWD, "./61/binderfs", [pid 5712] chdir("./61" [pid 5711] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5710] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5709] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5712] <... chdir resumed>) = 0 [pid 5711] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5710] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5709] <... futex resumed>) = 0 [pid 5712] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5711] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144./strace-static-x86_64: Process 5713 attached [pid 5712] <... prctl resumed>) = 0 [pid 5709] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5712 [pid 5713] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5712] setpgid(0, 0 [pid 5711] <... bpf resumed>) = 5 [pid 5710] <... clone3 resumed> => {parent_tid=[5713]}, 88) = 5713 [pid 5076] unlink("./61/binderfs" [pid 5713] <... rseq resumed>) = 0 [pid 5712] <... setpgid resumed>) = 0 [pid 5711] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5710] rt_sigprocmask(SIG_SETMASK, [], [pid 5078] umount2("./65", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] <... unlink resumed>) = 0 [pid 5713] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5712] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5711] <... futex resumed>) = 1 [pid 5710] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5709] <... futex resumed>) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] getdents64(3, [pid 5713] <... set_robust_list resumed>) = 0 [pid 5712] <... openat resumed>) = 3 [pid 5711] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5710] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5709] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] openat(AT_FDCWD, "./65", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5713] rt_sigprocmask(SIG_SETMASK, [], [pid 5712] write(3, "1000", 4 [pid 5711] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5710] <... futex resumed>) = 0 [pid 5709] <... futex resumed>) = 0 [pid 5078] <... openat resumed>) = 3 [pid 5076] close(3 [pid 5713] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5712] <... write resumed>) = 4 [pid 5711] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5710] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5709] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] newfstatat(3, "", [pid 5076] <... close resumed>) = 0 [pid 5713] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5712] close(3 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5076] rmdir("./61" [pid 5713] <... bpf resumed>) = 3 [pid 5712] <... close resumed>) = 0 [pid 5711] <... bpf resumed>) = 6 [pid 5078] getdents64(3, [pid 5076] <... rmdir resumed>) = 0 [pid 5713] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5712] symlink("/dev/binderfs", "./binderfs" [pid 5711] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5713] <... futex resumed>) = 1 [pid 5712] <... symlink resumed>) = 0 [pid 5711] <... futex resumed>) = 1 [pid 5710] <... futex resumed>) = 0 [pid 5709] <... futex resumed>) = 0 [pid 5078] umount2("./65/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] mkdir("./62", 0777 [pid 5713] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5712] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5711] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5710] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5709] exit_group(0 [pid 5713] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5712] <... futex resumed>) = 0 [pid 5711] <... futex resumed>) = ? [pid 5710] <... futex resumed>) = 0 [pid 5709] <... exit_group resumed>) = ? [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] <... mkdir resumed>) = 0 [pid 5713] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5712] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5710] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] newfstatat(AT_FDCWD, "./65/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5713] <... bpf resumed>) = 4 [pid 5712] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5711] +++ exited with 0 +++ [pid 5709] +++ exited with 0 +++ [pid 5078] unlink("./65/binderfs" [pid 5713] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5712] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5709, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- ./strace-static-x86_64: Process 5714 attached [pid 5713] <... futex resumed>) = 1 [pid 5712] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5710] <... futex resumed>) = 0 [pid 5078] <... unlink resumed>) = 0 [pid 5714] set_robust_list(0x55555d6c46a0, 24 [pid 5713] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5712] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5710] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5714] <... set_robust_list resumed>) = 0 [pid 5713] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5712] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5710] <... futex resumed>) = 0 [pid 5078] getdents64(3, [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5714 [pid 5714] chdir("./62" [pid 5713] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5712] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5710] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5714] <... chdir resumed>) = 0 [pid 5078] close(3 [pid 5714] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5713] <... bpf resumed>) = 5 [pid 5712] <... mprotect resumed>) = 0 [pid 5078] <... close resumed>) = 0 [pid 5714] <... prctl resumed>) = 0 [pid 5712] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5078] rmdir("./65" [pid 5714] setpgid(0, 0 [pid 5712] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5714] <... setpgid resumed>) = 0 [pid 5713] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5712] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5078] <... rmdir resumed>) = 0 [pid 5713] <... futex resumed>) = 1 [pid 5710] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5715 attached [pid 5714] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5713] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5712] <... clone3 resumed> => {parent_tid=[5715]}, 88) = 5715 [pid 5710] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] umount2("./63", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5715] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5714] <... openat resumed>) = 3 [pid 5712] rt_sigprocmask(SIG_SETMASK, [], [pid 5710] <... futex resumed>) = 0 [pid 5078] mkdir("./66", 0777 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5715] <... rseq resumed>) = 0 [pid 5714] write(3, "1000", 4 [pid 5713] <... bpf resumed>) = 6 [pid 5712] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5710] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] <... mkdir resumed>) = 0 [pid 5715] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5714] <... write resumed>) = 4 [pid 5713] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5712] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5710] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5075] openat(AT_FDCWD, "./63", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5714] close(3 [pid 5713] <... futex resumed>) = 0 [pid 5712] <... futex resumed>) = 0 [pid 5710] exit_group(0 [pid 5714] <... close resumed>) = 0 [pid 5075] <... openat resumed>) = 3 [pid 5712] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5710] <... exit_group resumed>) = ? [pid 5714] symlink("/dev/binderfs", "./binderfs" [pid 5075] newfstatat(3, "", [pid 5715] <... set_robust_list resumed>) = 0 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5715] rt_sigprocmask(SIG_SETMASK, [], [pid 5714] <... symlink resumed>) = 0 [pid 5713] +++ exited with 0 +++ [pid 5710] +++ exited with 0 +++ [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5715] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5714] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5710, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5715] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5714] <... futex resumed>) = 0 [pid 5075] getdents64(3, ./strace-static-x86_64: Process 5716 attached [pid 5715] <... bpf resumed>) = 3 [pid 5714] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5716] set_robust_list(0x55555d6c46a0, 24 [pid 5715] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5714] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5716 [pid 5077] umount2("./63", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5716] <... set_robust_list resumed>) = 0 [pid 5715] <... futex resumed>) = 1 [pid 5714] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5712] <... futex resumed>) = 0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] umount2("./63/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5716] chdir("./66" [pid 5715] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5714] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5712] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] openat(AT_FDCWD, "./63", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5716] <... chdir resumed>) = 0 [pid 5715] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5714] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5712] <... futex resumed>) = 0 [pid 5077] <... openat resumed>) = 3 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5716] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5715] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5714] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5712] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] newfstatat(3, "", [pid 5716] <... prctl resumed>) = 0 [pid 5715] <... bpf resumed>) = 4 [pid 5714] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5075] newfstatat(AT_FDCWD, "./63/binderfs", [pid 5716] setpgid(0, 0 [pid 5715] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5714] <... mprotect resumed>) = 0 [pid 5077] getdents64(3, [pid 5716] <... setpgid resumed>) = 0 [pid 5715] <... futex resumed>) = 1 [pid 5712] <... futex resumed>) = 0 [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5716] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5715] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5714] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5712] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5075] unlink("./63/binderfs" [pid 5716] <... openat resumed>) = 3 [pid 5715] <... bpf resumed>) = 5 [pid 5714] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5712] <... futex resumed>) = 0 [pid 5077] umount2("./63/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5716] write(3, "1000", 4 [pid 5715] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5716] <... write resumed>) = 4 [pid 5715] <... futex resumed>) = 0 [pid 5714] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5712] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] newfstatat(AT_FDCWD, "./63/binderfs", [pid 5075] <... unlink resumed>) = 0 ./strace-static-x86_64: Process 5717 attached [pid 5716] close(3 [pid 5715] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5712] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5075] getdents64(3, [pid 5717] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5716] <... close resumed>) = 0 [pid 5714] <... clone3 resumed> => {parent_tid=[5717]}, 88) = 5717 [pid 5712] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] unlink("./63/binderfs" [pid 5717] <... rseq resumed>) = 0 [pid 5716] symlink("/dev/binderfs", "./binderfs" [pid 5715] <... futex resumed>) = 0 [pid 5714] rt_sigprocmask(SIG_SETMASK, [], [pid 5712] <... futex resumed>) = 1 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5717] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5716] <... symlink resumed>) = 0 [pid 5715] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5714] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5712] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] <... unlink resumed>) = 0 [pid 5075] close(3 [pid 5717] <... set_robust_list resumed>) = 0 [pid 5716] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5715] <... bpf resumed>) = 6 [pid 5714] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] getdents64(3, [pid 5717] rt_sigprocmask(SIG_SETMASK, [], [pid 5716] <... futex resumed>) = 0 [pid 5714] <... futex resumed>) = 0 [pid 5075] <... close resumed>) = 0 [pid 5717] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5716] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5715] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5717] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5716] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5715] <... futex resumed>) = 1 [pid 5714] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5712] <... futex resumed>) = 0 [pid 5077] close(3 [pid 5075] rmdir("./63" [pid 5717] <... bpf resumed>) = 3 [pid 5716] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5077] <... close resumed>) = 0 [pid 5715] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5712] exit_group(0 [pid 5717] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5716] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5715] <... futex resumed>) = ? [pid 5712] <... exit_group resumed>) = ? [pid 5077] rmdir("./63" [pid 5075] <... rmdir resumed>) = 0 [pid 5717] <... futex resumed>) = 1 [pid 5716] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5715] +++ exited with 0 +++ [pid 5714] <... futex resumed>) = 0 [pid 5712] +++ exited with 0 +++ [pid 5077] <... rmdir resumed>) = 0 [pid 5075] mkdir("./64", 0777 [pid 5717] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5716] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5714] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5712, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5717] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5716] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5714] <... futex resumed>) = 0 [pid 5077] mkdir("./64", 0777 [pid 5075] <... mkdir resumed>) = 0 [pid 5717] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5714] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5717] <... bpf resumed>) = 4 [pid 5716] <... mprotect resumed>) = 0 [pid 5077] <... mkdir resumed>) = 0 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5717] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5716] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5717] <... futex resumed>) = 1 [pid 5714] <... futex resumed>) = 0 [pid 5717] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5714] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] umount2("./61", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5718 attached [pid 5716] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5714] <... futex resumed>) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5718] set_robust_list(0x55555d6c46a0, 24 [pid 5074] openat(AT_FDCWD, "./61", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5718] <... set_robust_list resumed>) = 0 ./strace-static-x86_64: Process 5719 attached [pid 5718] chdir("./64" [pid 5717] <... bpf resumed>) = 5 [pid 5716] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5714] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] <... openat resumed>) = 3 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5718 [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5719 [pid 5717] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5720 attached [pid 5719] set_robust_list(0x55555d6c46a0, 24 [pid 5718] <... chdir resumed>) = 0 [pid 5714] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5074] newfstatat(3, "", [pid 5720] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5719] <... set_robust_list resumed>) = 0 [pid 5718] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5717] <... futex resumed>) = 0 [pid 5716] <... clone3 resumed> => {parent_tid=[5720]}, 88) = 5720 [pid 5714] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5720] <... rseq resumed>) = 0 [pid 5719] chdir("./64" [pid 5718] <... prctl resumed>) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5720] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5719] <... chdir resumed>) = 0 [pid 5718] setpgid(0, 0 [pid 5717] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5716] rt_sigprocmask(SIG_SETMASK, [], [pid 5714] <... futex resumed>) = 0 [pid 5074] getdents64(3, [pid 5720] <... set_robust_list resumed>) = 0 [pid 5719] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5718] <... setpgid resumed>) = 0 [pid 5717] <... bpf resumed>) = 6 [pid 5716] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5714] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5720] rt_sigprocmask(SIG_SETMASK, [], [pid 5719] <... prctl resumed>) = 0 [pid 5718] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5717] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5716] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] umount2("./61/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5720] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5719] setpgid(0, 0 [pid 5716] <... futex resumed>) = 0 [pid 5720] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5719] <... setpgid resumed>) = 0 [pid 5718] <... openat resumed>) = 3 [pid 5717] <... futex resumed>) = 1 [pid 5716] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5714] <... futex resumed>) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5720] <... bpf resumed>) = 3 [pid 5719] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5718] write(3, "1000", 4 [pid 5717] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5714] exit_group(0 [pid 5074] newfstatat(AT_FDCWD, "./61/binderfs", [pid 5720] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5719] <... openat resumed>) = 3 [pid 5718] <... write resumed>) = 4 [pid 5717] <... futex resumed>) = ? [pid 5714] <... exit_group resumed>) = ? [pid 5720] <... futex resumed>) = 1 [pid 5718] close(3 [pid 5716] <... futex resumed>) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5720] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5718] <... close resumed>) = 0 [pid 5717] +++ exited with 0 +++ [pid 5716] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] unlink("./61/binderfs" [pid 5720] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5718] symlink("/dev/binderfs", "./binderfs" [pid 5720] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5718] <... symlink resumed>) = 0 [pid 5714] +++ exited with 0 +++ [pid 5074] <... unlink resumed>) = 0 [pid 5719] write(3, "1000", 4 [pid 5720] <... bpf resumed>) = 4 [pid 5716] <... futex resumed>) = 0 [pid 5719] <... write resumed>) = 4 [pid 5716] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5719] close(3) = 0 [pid 5719] symlink("/dev/binderfs", "./binderfs" [pid 5720] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5719] <... symlink resumed>) = 0 [pid 5718] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5714, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5074] getdents64(3, [pid 5719] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5718] <... futex resumed>) = 0 [pid 5076] umount2("./62", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5719] <... futex resumed>) = 0 [pid 5719] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5720] <... futex resumed>) = 1 [pid 5719] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5718] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5716] <... futex resumed>) = 0 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] close(3 [pid 5720] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5719] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5718] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5716] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] openat(AT_FDCWD, "./62", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5074] <... close resumed>) = 0 [pid 5720] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5719] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5718] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5716] <... futex resumed>) = 0 [pid 5076] <... openat resumed>) = 3 [pid 5074] rmdir("./61" [pid 5720] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5719] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5718] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5716] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] newfstatat(3, "", [pid 5074] <... rmdir resumed>) = 0 [pid 5720] <... bpf resumed>) = 5 [pid 5718] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5718] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5718] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5076] getdents64(3, [pid 5074] mkdir("./62", 0777 [pid 5719] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5718] <... mprotect resumed>) = 0 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5074] <... mkdir resumed>) = 0 [pid 5720] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5719] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5718] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5076] umount2("./62/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5720] <... futex resumed>) = 1 [pid 5720] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] newfstatat(AT_FDCWD, "./62/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5719] <... mprotect resumed>) = 0 [pid 5718] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5716] <... futex resumed>) = 0 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5716] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5721 attached [pid 5720] <... futex resumed>) = 0 [pid 5719] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5718] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5716] <... futex resumed>) = 1 [pid 5076] unlink("./62/binderfs" [pid 5721] set_robust_list(0x55555d6c46a0, 24 [pid 5720] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5716] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000}./strace-static-x86_64: Process 5722 attached [pid 5721] <... set_robust_list resumed>) = 0 [pid 5720] <... bpf resumed>) = 6 [pid 5719] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5076] <... unlink resumed>) = 0 [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5721 [pid 5722] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5719] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5718] <... clone3 resumed> => {parent_tid=[5722]}, 88) = 5722 ./strace-static-x86_64: Process 5723 attached [pid 5722] <... rseq resumed>) = 0 [pid 5721] chdir("./62" [pid 5720] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5718] rt_sigprocmask(SIG_SETMASK, [], [pid 5076] getdents64(3, [pid 5723] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5722] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5721] <... chdir resumed>) = 0 [pid 5720] <... futex resumed>) = 1 [pid 5716] <... futex resumed>) = 0 [pid 5723] <... rseq resumed>) = 0 [pid 5722] <... set_robust_list resumed>) = 0 [pid 5721] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5720] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5719] <... clone3 resumed> => {parent_tid=[5723]}, 88) = 5723 [pid 5718] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5716] exit_group(0 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5723] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5722] rt_sigprocmask(SIG_SETMASK, [], [pid 5721] <... prctl resumed>) = 0 [pid 5720] <... futex resumed>) = ? [pid 5719] rt_sigprocmask(SIG_SETMASK, [], [pid 5718] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5716] <... exit_group resumed>) = ? [pid 5076] close(3 [pid 5723] <... set_robust_list resumed>) = 0 [pid 5722] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5720] +++ exited with 0 +++ [pid 5719] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5718] <... futex resumed>) = 0 [pid 5076] <... close resumed>) = 0 [pid 5722] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5719] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5718] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] rmdir("./62" [pid 5722] <... bpf resumed>) = 3 [pid 5719] <... futex resumed>) = 0 [pid 5076] <... rmdir resumed>) = 0 [pid 5722] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5719] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5722] <... futex resumed>) = 1 [pid 5716] +++ exited with 0 +++ [pid 5723] rt_sigprocmask(SIG_SETMASK, [], [pid 5722] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5721] setpgid(0, 0 [pid 5718] <... futex resumed>) = 0 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5716, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5076] mkdir("./63", 0777 [pid 5723] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5721] <... setpgid resumed>) = 0 [pid 5718] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... mkdir resumed>) = 0 [pid 5722] <... futex resumed>) = 0 [pid 5718] <... futex resumed>) = 1 [pid 5723] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5721] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5723] <... bpf resumed>) = 3 [pid 5722] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5718] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5723] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5722] <... bpf resumed>) = 4 [pid 5721] <... openat resumed>) = 3 [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5723] <... futex resumed>) = 1 [pid 5722] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5721] write(3, "1000", 4 [pid 5719] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5724 attached [pid 5723] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5722] <... futex resumed>) = 1 [pid 5721] <... write resumed>) = 4 [pid 5719] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5718] <... futex resumed>) = 0 [pid 5724] set_robust_list(0x55555d6c46a0, 24 [pid 5723] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5722] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5721] close(3 [pid 5719] <... futex resumed>) = 0 [pid 5718] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] umount2("./66", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5724 [pid 5724] <... set_robust_list resumed>) = 0 [pid 5723] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5722] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5721] <... close resumed>) = 0 [pid 5718] <... futex resumed>) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5724] chdir("./63" [pid 5722] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5721] symlink("/dev/binderfs", "./binderfs" [pid 5719] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5718] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] openat(AT_FDCWD, "./66", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5723] <... bpf resumed>) = 4 [pid 5724] <... chdir resumed>) = 0 [pid 5723] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5722] <... bpf resumed>) = 5 [pid 5721] <... symlink resumed>) = 0 [pid 5078] <... openat resumed>) = 3 [pid 5724] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5723] <... futex resumed>) = 1 [pid 5721] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5719] <... futex resumed>) = 0 [pid 5724] <... prctl resumed>) = 0 [pid 5723] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5722] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5721] <... futex resumed>) = 0 [pid 5719] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] newfstatat(3, "", [pid 5724] setpgid(0, 0 [pid 5723] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5722] <... futex resumed>) = 1 [pid 5721] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5719] <... futex resumed>) = 0 [pid 5718] <... futex resumed>) = 0 [pid 5723] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5721] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5719] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5718] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5724] <... setpgid resumed>) = 0 [pid 5722] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5724] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5723] <... bpf resumed>) = 5 [pid 5722] <... bpf resumed>) = 6 [pid 5721] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5718] <... futex resumed>) = 0 [pid 5078] getdents64(3, [pid 5724] <... openat resumed>) = 3 [pid 5723] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5722] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5721] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5718] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5724] write(3, "1000", 4 [pid 5723] <... futex resumed>) = 1 [pid 5722] <... futex resumed>) = 0 [pid 5721] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5719] <... futex resumed>) = 0 [pid 5718] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5078] umount2("./66/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5724] <... write resumed>) = 4 [pid 5723] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5722] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5721] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5719] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5718] exit_group(0 [pid 5724] close(3 [pid 5723] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5722] <... futex resumed>) = ? [pid 5721] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5719] <... futex resumed>) = 0 [pid 5718] <... exit_group resumed>) = ? [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5724] <... close resumed>) = 0 [pid 5723] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5722] +++ exited with 0 +++ [pid 5719] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] newfstatat(AT_FDCWD, "./66/binderfs", [pid 5724] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5718] +++ exited with 0 +++ [pid 5721] <... mprotect resumed>) = 0 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5718, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5724] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5721] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5078] unlink("./66/binderfs" [pid 5721] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5724] <... futex resumed>) = 0 [pid 5721] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5078] <... unlink resumed>) = 0 [pid 5075] umount2("./64", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5724] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, ./strace-static-x86_64: Process 5725 attached NULL, 8) = 0 [pid 5078] getdents64(3, [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5725] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5724] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5721] <... clone3 resumed> => {parent_tid=[5725]}, 88) = 5725 [pid 5075] openat(AT_FDCWD, "./64", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5724] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5724] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f3e2f5ed000 [pid 5724] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5725] <... rseq resumed>) = 0 [pid 5721] rt_sigprocmask(SIG_SETMASK, [], [pid 5725] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5724] <... mprotect resumed>) = 0 [pid 5078] close(3 [pid 5075] <... openat resumed>) = 3 [pid 5725] <... set_robust_list resumed>) = 0 [pid 5724] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5721] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] <... close resumed>) = 0 [pid 5075] newfstatat(3, "", [pid 5725] rt_sigprocmask(SIG_SETMASK, [], [pid 5721] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5725] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5725] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5724] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5724] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5721] <... futex resumed>) = 0 [pid 5075] getdents64(3, [pid 5725] <... bpf resumed>) = 3 [pid 5721] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5726 attached [pid 5725] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5724] <... clone3 resumed> => {parent_tid=[5726]}, 88) = 5726 [pid 5721] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5078] rmdir("./66" [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5726] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5725] <... futex resumed>) = 0 [pid 5724] rt_sigprocmask(SIG_SETMASK, [], [pid 5721] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] umount2("./64/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5726] <... rseq resumed>) = 0 [pid 5725] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5724] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5723] <... bpf resumed>) = 6 [pid 5721] <... futex resumed>) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5726] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5724] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5723] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... rmdir resumed>) = 0 [pid 5726] <... set_robust_list resumed>) = 0 [pid 5725] <... bpf resumed>) = 4 [pid 5724] <... futex resumed>) = 0 [pid 5723] <... futex resumed>) = 1 [pid 5721] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5719] <... futex resumed>) = 0 [pid 5075] newfstatat(AT_FDCWD, "./64/binderfs", [pid 5726] rt_sigprocmask(SIG_SETMASK, [], [pid 5724] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5723] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5078] mkdir("./67", 0777 [pid 5726] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5725] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5719] exit_group(0 [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5726] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5075] unlink("./64/binderfs" [pid 5725] <... futex resumed>) = 1 [pid 5723] <... futex resumed>) = ? [pid 5721] <... futex resumed>) = 0 [pid 5719] <... exit_group resumed>) = ? [pid 5726] <... bpf resumed>) = 3 [pid 5723] +++ exited with 0 +++ [pid 5725] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5721] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... mkdir resumed>) = 0 [pid 5075] <... unlink resumed>) = 0 [pid 5726] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5725] <... bpf resumed>) = 5 [pid 5721] <... futex resumed>) = 0 [pid 5719] +++ exited with 0 +++ [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5075] getdents64(3, [pid 5726] <... futex resumed>) = 1 [pid 5724] <... futex resumed>) = 0 [pid 5726] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5724] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5719, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5726] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5724] <... futex resumed>) = 0 [pid 5075] close(3 [pid 5726] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5724] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5721] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5725] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5727 attached [pid 5726] <... bpf resumed>) = 4 [pid 5725] <... futex resumed>) = 1 [pid 5721] <... futex resumed>) = 0 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5727 [pid 5077] umount2("./64", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] <... close resumed>) = 0 [pid 5727] set_robust_list(0x55555d6c46a0, 24 [pid 5726] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5725] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5721] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] rmdir("./64" [pid 5727] <... set_robust_list resumed>) = 0 [pid 5726] <... futex resumed>) = 1 [pid 5725] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5724] <... futex resumed>) = 0 [pid 5721] <... futex resumed>) = 0 [pid 5077] openat(AT_FDCWD, "./64", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5075] <... rmdir resumed>) = 0 [pid 5727] chdir("./67" [pid 5726] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5725] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5724] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5721] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] <... openat resumed>) = 3 [pid 5727] <... chdir resumed>) = 0 [pid 5726] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5724] <... futex resumed>) = 0 [pid 5077] newfstatat(3, "", [pid 5075] mkdir("./65", 0777 [pid 5727] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5726] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5724] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5727] <... prctl resumed>) = 0 [pid 5727] setpgid(0, 0 [pid 5726] <... bpf resumed>) = 5 [pid 5725] <... bpf resumed>) = 6 [pid 5077] getdents64(3, [pid 5075] <... mkdir resumed>) = 0 [pid 5727] <... setpgid resumed>) = 0 [pid 5725] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5727] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5725] <... futex resumed>) = 1 [pid 5721] <... futex resumed>) = 0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5725] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5721] exit_group(0 [pid 5727] <... openat resumed>) = 3 [pid 5726] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5725] <... futex resumed>) = ? [pid 5721] <... exit_group resumed>) = ? [pid 5077] umount2("./64/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5727] write(3, "1000", 4 [pid 5726] <... futex resumed>) = 1 [pid 5725] +++ exited with 0 +++ [pid 5724] <... futex resumed>) = 0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5728 attached [pid 5727] <... write resumed>) = 4 [pid 5726] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5724] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] newfstatat(AT_FDCWD, "./64/binderfs", [pid 5728] set_robust_list(0x55555d6c46a0, 24) = 0 [pid 5724] <... futex resumed>) = 0 [pid 5727] close(3 [pid 5726] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5724] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5727] <... close resumed>) = 0 [pid 5726] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5728] chdir("./65" [pid 5727] symlink("/dev/binderfs", "./binderfs" [pid 5077] unlink("./64/binderfs" [pid 5728] <... chdir resumed>) = 0 [pid 5727] <... symlink resumed>) = 0 [pid 5721] +++ exited with 0 +++ [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5728 [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5721, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5728] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5727] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... unlink resumed>) = 0 [pid 5728] <... prctl resumed>) = 0 [pid 5727] <... futex resumed>) = 0 [pid 5077] getdents64(3, [pid 5728] setpgid(0, 0 [pid 5727] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5728] <... setpgid resumed>) = 0 [pid 5074] umount2("./62", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5727] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5077] close(3 [pid 5727] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5077] <... close resumed>) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5727] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] rmdir("./64" [pid 5728] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5727] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5077] <... rmdir resumed>) = 0 [pid 5074] openat(AT_FDCWD, "./62", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5727] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5727] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5728] <... openat resumed>) = 3 [pid 5727] <... mprotect resumed>) = 0 [pid 5726] <... bpf resumed>) = 6 [pid 5077] mkdir("./65", 0777 [pid 5728] write(3, "1000", 4 [pid 5727] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5726] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... mkdir resumed>) = 0 [pid 5074] <... openat resumed>) = 3 [pid 5728] <... write resumed>) = 4 [pid 5074] newfstatat(3, "", [pid 5728] close(3) = 0 [pid 5727] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5726] <... futex resumed>) = 1 [pid 5724] <... futex resumed>) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5728] symlink("/dev/binderfs", "./binderfs" [pid 5727] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5726] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5724] exit_group(0 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5729 attached ./strace-static-x86_64: Process 5730 attached [pid 5728] <... symlink resumed>) = 0 [pid 5726] <... futex resumed>) = ? [pid 5724] <... exit_group resumed>) = ? [pid 5074] getdents64(3, [pid 5730] set_robust_list(0x55555d6c46a0, 24) = 0 [pid 5729] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5728] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5727] <... clone3 resumed> => {parent_tid=[5729]}, 88) = 5729 [pid 5726] +++ exited with 0 +++ [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5727] rt_sigprocmask(SIG_SETMASK, [], [pid 5729] <... rseq resumed>) = 0 [pid 5727] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5727] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5729] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5727] <... futex resumed>) = 0 [pid 5727] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5729] <... set_robust_list resumed>) = 0 [pid 5729] rt_sigprocmask(SIG_SETMASK, [], [pid 5074] umount2("./62/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5730] chdir("./65" [pid 5729] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5728] <... futex resumed>) = 0 [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5730 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5730] <... chdir resumed>) = 0 [pid 5729] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5728] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5074] newfstatat(AT_FDCWD, "./62/binderfs", [pid 5730] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5728] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5730] <... prctl resumed>) = 0 [pid 5729] <... bpf resumed>) = 3 [pid 5728] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5724] +++ exited with 0 +++ [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5730] setpgid(0, 0 [pid 5729] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5728] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5724, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5074] unlink("./62/binderfs" [pid 5728] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5727] <... futex resumed>) = 0 [pid 5730] <... setpgid resumed>) = 0 [pid 5730] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5729] <... futex resumed>) = 1 [pid 5727] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5730] <... openat resumed>) = 3 [pid 5728] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5729] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5728] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5727] <... futex resumed>) = 0 [pid 5076] umount2("./63", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... unlink resumed>) = 0 [pid 5730] write(3, "1000", 4 [pid 5729] <... bpf resumed>) = 4 [pid 5727] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5730] <... write resumed>) = 4 [pid 5729] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5728] <... mprotect resumed>) = 0 [pid 5727] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5076] openat(AT_FDCWD, "./63", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5074] getdents64(3, [pid 5730] close(3 [pid 5729] <... futex resumed>) = 0 [pid 5727] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... openat resumed>) = 3 [pid 5730] <... close resumed>) = 0 [pid 5729] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5727] <... futex resumed>) = 0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5730] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5728] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5727] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] newfstatat(3, "", [pid 5074] close(3 [pid 5730] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5730] <... futex resumed>) = 0 [pid 5728] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5076] getdents64(3, [pid 5730] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5729] <... bpf resumed>) = 5 [pid 5728] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5074] <... close resumed>) = 0 ./strace-static-x86_64: Process 5731 attached [pid 5730] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5729] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] umount2("./63/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] rmdir("./62" [pid 5731] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5730] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5731] <... rseq resumed>) = 0 [pid 5730] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5729] <... futex resumed>) = 1 [pid 5727] <... futex resumed>) = 0 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] <... rmdir resumed>) = 0 [pid 5731] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5730] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5729] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5728] <... clone3 resumed> => {parent_tid=[5731]}, 88) = 5731 [pid 5727] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] newfstatat(AT_FDCWD, "./63/binderfs", [pid 5731] <... set_robust_list resumed>) = 0 [pid 5730] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5729] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5728] rt_sigprocmask(SIG_SETMASK, [], [pid 5727] <... futex resumed>) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5731] rt_sigprocmask(SIG_SETMASK, [], [pid 5730] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5729] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5728] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5727] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5076] unlink("./63/binderfs" [pid 5074] mkdir("./63", 0777 [pid 5731] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5730] <... mprotect resumed>) = 0 [pid 5729] <... bpf resumed>) = 6 [pid 5728] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... unlink resumed>) = 0 [pid 5731] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5730] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5074] <... mkdir resumed>) = 0 [pid 5731] <... bpf resumed>) = 3 [pid 5730] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5076] getdents64(3, [pid 5731] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5730] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5731] <... futex resumed>) = 0 [pid 5076] close(3./strace-static-x86_64: Process 5732 attached [pid 5731] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5732] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5730] <... clone3 resumed> => {parent_tid=[5732]}, 88) = 5732 [pid 5728] <... futex resumed>) = 0 [pid 5076] <... close resumed>) = 0 [pid 5732] <... rseq resumed>) = 0 [pid 5730] rt_sigprocmask(SIG_SETMASK, [], [pid 5729] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5728] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] rmdir("./63" [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5732] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5730] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5729] <... futex resumed>) = 1 [pid 5728] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5727] <... futex resumed>) = 0 [pid 5076] <... rmdir resumed>) = 0 [pid 5732] <... set_robust_list resumed>) = 0 [pid 5730] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5729] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5727] exit_group(0 [pid 5732] rt_sigprocmask(SIG_SETMASK, [], [pid 5730] <... futex resumed>) = 0 [pid 5728] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5727] <... exit_group resumed>) = ? [pid 5732] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5730] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] mkdir("./64", 0777 [pid 5732] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5731] <... futex resumed>) = 0 [pid 5729] <... futex resumed>) = ? [pid 5728] <... futex resumed>) = 1 ./strace-static-x86_64: Process 5733 attached [pid 5732] <... bpf resumed>) = 3 [pid 5731] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5728] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] <... mkdir resumed>) = 0 [pid 5733] set_robust_list(0x55555d6c46a0, 24 [pid 5732] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5731] <... bpf resumed>) = 4 [pid 5729] +++ exited with 0 +++ [pid 5727] +++ exited with 0 +++ [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5733 [pid 5733] <... set_robust_list resumed>) = 0 [pid 5732] <... futex resumed>) = 1 [pid 5730] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5734 attached [pid 5733] chdir("./63" [pid 5732] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5731] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5730] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5727, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5734] set_robust_list(0x55555d6c46a0, 24 [pid 5733] <... chdir resumed>) = 0 [pid 5732] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5731] <... futex resumed>) = 1 [pid 5730] <... futex resumed>) = 0 [pid 5728] <... futex resumed>) = 0 [pid 5078] restart_syscall(<... resuming interrupted clone ...> [pid 5734] <... set_robust_list resumed>) = 0 [pid 5733] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5732] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5728] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5734] chdir("./64" [pid 5733] <... prctl resumed>) = 0 [pid 5732] <... bpf resumed>) = 4 [pid 5731] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5730] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5728] <... futex resumed>) = 0 [pid 5078] <... restart_syscall resumed>) = 0 [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5734 [pid 5734] <... chdir resumed>) = 0 [pid 5733] setpgid(0, 0 [pid 5732] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5731] <... bpf resumed>) = 5 [pid 5730] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5728] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5734] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5733] <... setpgid resumed>) = 0 [pid 5732] <... futex resumed>) = 0 [pid 5730] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5734] <... prctl resumed>) = 0 [pid 5733] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5732] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5731] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5730] <... futex resumed>) = 0 [pid 5078] umount2("./67", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5734] setpgid(0, 0 [pid 5733] <... openat resumed>) = 3 [pid 5732] <... bpf resumed>) = 5 [pid 5731] <... futex resumed>) = 1 [pid 5730] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5728] <... futex resumed>) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5734] <... setpgid resumed>) = 0 [pid 5733] write(3, "1000", 4 [pid 5732] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5731] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5728] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] openat(AT_FDCWD, "./67", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5734] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5733] <... write resumed>) = 4 [pid 5732] <... futex resumed>) = 1 [pid 5731] <... bpf resumed>) = 6 [pid 5730] <... futex resumed>) = 0 [pid 5728] <... futex resumed>) = 0 [pid 5078] <... openat resumed>) = 3 [pid 5734] <... openat resumed>) = 3 [pid 5733] close(3 [pid 5732] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5731] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5730] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5728] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] newfstatat(3, "", [pid 5732] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5731] <... futex resumed>) = 0 [pid 5730] <... futex resumed>) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5734] write(3, "1000", 4 [pid 5733] <... close resumed>) = 0 [pid 5732] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5731] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5730] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5728] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5078] getdents64(3, [pid 5734] <... write resumed>) = 4 [pid 5733] symlink("/dev/binderfs", "./binderfs" [pid 5732] <... bpf resumed>) = 6 [pid 5728] exit_group(0 [pid 5734] close(3 [pid 5732] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5734] <... close resumed>) = 0 [pid 5733] <... symlink resumed>) = 0 [pid 5732] <... futex resumed>) = 1 [pid 5731] <... futex resumed>) = ? [pid 5730] <... futex resumed>) = 0 [pid 5728] <... exit_group resumed>) = ? [pid 5078] umount2("./67/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5734] symlink("/dev/binderfs", "./binderfs" [pid 5733] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5732] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5731] +++ exited with 0 +++ [pid 5730] exit_group(0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5734] <... symlink resumed>) = 0 [pid 5733] <... futex resumed>) = 0 [pid 5732] <... futex resumed>) = ? [pid 5730] <... exit_group resumed>) = ? [pid 5078] newfstatat(AT_FDCWD, "./67/binderfs", [pid 5734] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5733] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5732] +++ exited with 0 +++ [pid 5734] <... futex resumed>) = 0 [pid 5733] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5734] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5733] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5728] +++ exited with 0 +++ [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5734] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5734] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5733] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5734] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5733] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5730] +++ exited with 0 +++ [pid 5078] unlink("./67/binderfs" [pid 5734] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5733] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5730, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5728, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5734] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5078] <... unlink resumed>) = 0 [pid 5075] restart_syscall(<... resuming interrupted clone ...> [pid 5078] getdents64(3, [pid 5075] <... restart_syscall resumed>) = 0 [pid 5734] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5733] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5077] restart_syscall(<... resuming interrupted clone ...> [pid 5734] <... mprotect resumed>) = 0 [pid 5733] <... mprotect resumed>) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5077] <... restart_syscall resumed>) = 0 [pid 5078] close(3 [pid 5075] umount2("./65", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5733] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5734] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5733] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5078] <... close resumed>) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5734] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5733] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5078] rmdir("./67" [pid 5077] umount2("./65", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5735 attached [pid 5734] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5078] <... rmdir resumed>) = 0 [pid 5075] openat(AT_FDCWD, "./65", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5735] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5733] <... clone3 resumed> => {parent_tid=[5735]}, 88) = 5735 [pid 5077] openat(AT_FDCWD, "./65", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5735] <... rseq resumed>) = 0 [pid 5734] <... clone3 resumed> => {parent_tid=[5736]}, 88) = 5736 [pid 5733] rt_sigprocmask(SIG_SETMASK, [], [pid 5735] set_robust_list(0x7f3e2f60d9a0, 24) = 0 [pid 5734] rt_sigprocmask(SIG_SETMASK, [], [pid 5077] <... openat resumed>) = 3 [pid 5733] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5735] rt_sigprocmask(SIG_SETMASK, [], [pid 5734] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5733] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] newfstatat(3, "", [pid 5735] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5734] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5733] <... futex resumed>) = 0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 ./strace-static-x86_64: Process 5736 attached [pid 5735] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5734] <... futex resumed>) = 0 [pid 5733] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] mkdir("./68", 0777 [pid 5077] getdents64(3, [pid 5075] <... openat resumed>) = 3 [pid 5736] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5735] <... bpf resumed>) = 3 [pid 5734] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... mkdir resumed>) = 0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5075] newfstatat(3, "", [pid 5736] <... rseq resumed>) = 0 [pid 5735] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5077] umount2("./65/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5736] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5735] <... futex resumed>) = 1 [pid 5733] <... futex resumed>) = 0 [pid 5736] <... set_robust_list resumed>) = 0 [pid 5075] getdents64(3, ./strace-static-x86_64: Process 5737 attached [pid 5736] rt_sigprocmask(SIG_SETMASK, [], [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5737 [pid 5736] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5735] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5733] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5737] set_robust_list(0x55555d6c46a0, 24 [pid 5736] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5735] <... bpf resumed>) = 4 [pid 5733] <... futex resumed>) = 0 [pid 5077] newfstatat(AT_FDCWD, "./65/binderfs", [pid 5737] <... set_robust_list resumed>) = 0 [pid 5736] <... bpf resumed>) = 3 [pid 5735] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5733] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] umount2("./65/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5737] chdir("./68" [pid 5736] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5735] <... futex resumed>) = 0 [pid 5733] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5737] <... chdir resumed>) = 0 [pid 5736] <... futex resumed>) = 1 [pid 5735] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5734] <... futex resumed>) = 0 [pid 5733] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] unlink("./65/binderfs" [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5737] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5736] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5735] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5734] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5733] <... futex resumed>) = 0 [pid 5737] <... prctl resumed>) = 0 [pid 5736] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5735] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5734] <... futex resumed>) = 0 [pid 5733] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... unlink resumed>) = 0 [pid 5075] newfstatat(AT_FDCWD, "./65/binderfs", [pid 5737] setpgid(0, 0 [pid 5736] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5734] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5737] <... setpgid resumed>) = 0 [pid 5736] <... bpf resumed>) = 4 [pid 5735] <... bpf resumed>) = 5 [pid 5077] getdents64(3, [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5737] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5736] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5737] <... openat resumed>) = 3 [pid 5736] <... futex resumed>) = 1 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5075] unlink("./65/binderfs" [pid 5736] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5737] write(3, "1000", 4 [pid 5735] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5734] <... futex resumed>) = 0 [pid 5077] close(3 [pid 5075] <... unlink resumed>) = 0 [pid 5737] <... write resumed>) = 4 [pid 5735] <... futex resumed>) = 1 [pid 5734] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5733] <... futex resumed>) = 0 [pid 5077] <... close resumed>) = 0 [pid 5075] getdents64(3, [pid 5737] close(3 [pid 5736] <... futex resumed>) = 0 [pid 5735] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5734] <... futex resumed>) = 1 [pid 5733] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] rmdir("./65" [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5737] <... close resumed>) = 0 [pid 5736] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5735] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5734] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5733] <... futex resumed>) = 0 [pid 5077] <... rmdir resumed>) = 0 [pid 5075] close(3 [pid 5737] symlink("/dev/binderfs", "./binderfs" [pid 5733] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5737] <... symlink resumed>) = 0 [pid 5736] <... bpf resumed>) = 5 [pid 5735] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5077] mkdir("./66", 0777 [pid 5075] <... close resumed>) = 0 [pid 5737] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5735] <... bpf resumed>) = 6 [pid 5077] <... mkdir resumed>) = 0 [pid 5075] rmdir("./65" [pid 5737] <... futex resumed>) = 0 [pid 5075] <... rmdir resumed>) = 0 [pid 5737] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, NULL, 8) = 0 [pid 5737] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5736] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5737] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5736] <... futex resumed>) = 1 [pid 5735] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5734] <... futex resumed>) = 0 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5075] mkdir("./66", 0777./strace-static-x86_64: Process 5738 attached [pid 5737] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5736] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5735] <... futex resumed>) = 1 [pid 5734] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5733] <... futex resumed>) = 0 [pid 5737] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5736] <... bpf resumed>) = 6 [pid 5735] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5734] <... futex resumed>) = 0 [pid 5075] <... mkdir resumed>) = 0 [pid 5738] set_robust_list(0x55555d6c46a0, 24) = 0 [pid 5737] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5734] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5733] exit_group(0 [pid 5738] chdir("./66" [pid 5737] <... mprotect resumed>) = 0 [pid 5736] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5735] <... futex resumed>) = ? [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5739 attached [pid 5738] <... chdir resumed>) = 0 [pid 5737] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5736] <... futex resumed>) = 1 [pid 5735] +++ exited with 0 +++ [pid 5734] <... futex resumed>) = 0 [pid 5733] <... exit_group resumed>) = ? [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5738 [pid 5738] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5734] exit_group(0 [pid 5739] set_robust_list(0x55555d6c46a0, 24 [pid 5738] <... prctl resumed>) = 0 [pid 5738] setpgid(0, 0 [pid 5737] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5734] <... exit_group resumed>) = ? [pid 5737] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5736] +++ exited with 0 +++ [pid 5738] <... setpgid resumed>) = 0 ./strace-static-x86_64: Process 5740 attached [pid 5739] <... set_robust_list resumed>) = 0 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5739 [pid 5740] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5739] chdir("./66" [pid 5738] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5737] <... clone3 resumed> => {parent_tid=[5740]}, 88) = 5740 [pid 5740] <... rseq resumed>) = 0 [pid 5739] <... chdir resumed>) = 0 [pid 5738] <... openat resumed>) = 3 [pid 5737] rt_sigprocmask(SIG_SETMASK, [], [pid 5740] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5739] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5738] write(3, "1000", 4 [pid 5737] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5740] <... set_robust_list resumed>) = 0 [pid 5739] <... prctl resumed>) = 0 [pid 5738] <... write resumed>) = 4 [pid 5737] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5740] rt_sigprocmask(SIG_SETMASK, [], [pid 5739] setpgid(0, 0 [pid 5738] close(3 [pid 5737] <... futex resumed>) = 0 [pid 5740] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5739] <... setpgid resumed>) = 0 [pid 5738] <... close resumed>) = 0 [pid 5733] +++ exited with 0 +++ [pid 5740] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5739] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5738] symlink("/dev/binderfs", "./binderfs" [pid 5740] <... bpf resumed>) = 3 [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5733, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5740] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] umount2("./63", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5740] <... futex resumed>) = 0 [pid 5740] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5737] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5739] <... openat resumed>) = 3 [pid 5738] <... symlink resumed>) = 0 [pid 5737] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5739] write(3, "1000", 4 [pid 5738] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5737] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] openat(AT_FDCWD, "./63", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5740] <... futex resumed>) = 0 [pid 5739] <... write resumed>) = 4 [pid 5738] <... futex resumed>) = 0 [pid 5737] <... futex resumed>) = 1 [pid 5740] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5739] close(3 [pid 5738] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5737] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5734] +++ exited with 0 +++ [pid 5074] <... openat resumed>) = 3 [pid 5740] <... bpf resumed>) = 4 [pid 5739] <... close resumed>) = 0 [pid 5738] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5074] newfstatat(3, "", [pid 5740] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5739] symlink("/dev/binderfs", "./binderfs" [pid 5738] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5734, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5740] <... futex resumed>) = 1 [pid 5737] <... futex resumed>) = 0 [pid 5076] restart_syscall(<... resuming interrupted clone ...> [pid 5740] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5739] <... symlink resumed>) = 0 [pid 5738] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5737] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... restart_syscall resumed>) = 0 [pid 5074] getdents64(3, [pid 5737] <... futex resumed>) = 0 [pid 5740] <... bpf resumed>) = 5 [pid 5739] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5738] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5737] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5740] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5739] <... futex resumed>) = 0 [pid 5738] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5737] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5076] umount2("./64", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] umount2("./63/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5740] <... futex resumed>) = 0 [pid 5739] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5738] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5737] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5740] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5739] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5738] <... mprotect resumed>) = 0 [pid 5737] <... futex resumed>) = 0 [pid 5074] newfstatat(AT_FDCWD, "./63/binderfs", [pid 5739] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5738] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5737] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5076] openat(AT_FDCWD, "./64", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5740] <... bpf resumed>) = 6 [pid 5739] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5738] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5076] <... openat resumed>) = 3 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5740] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5739] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5738] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5076] newfstatat(3, "", ./strace-static-x86_64: Process 5741 attached [pid 5740] <... futex resumed>) = 1 [pid 5739] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5737] <... futex resumed>) = 0 [pid 5074] unlink("./63/binderfs" [pid 5741] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5740] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5739] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5738] <... clone3 resumed> => {parent_tid=[5741]}, 88) = 5741 [pid 5737] exit_group(0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5741] <... rseq resumed>) = 0 [pid 5740] <... futex resumed>) = ? [pid 5739] <... mprotect resumed>) = 0 [pid 5738] rt_sigprocmask(SIG_SETMASK, [], [pid 5737] <... exit_group resumed>) = ? [pid 5076] getdents64(3, [pid 5074] <... unlink resumed>) = 0 [pid 5741] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5740] +++ exited with 0 +++ [pid 5739] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5738] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5737] +++ exited with 0 +++ [pid 5741] <... set_robust_list resumed>) = 0 [pid 5739] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5738] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5074] getdents64(3, [pid 5741] rt_sigprocmask(SIG_SETMASK, [], [pid 5739] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5738] <... futex resumed>) = 0 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5737, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5076] umount2("./64/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5742 attached [pid 5741] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5738] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] restart_syscall(<... resuming interrupted clone ...> [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5742] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5741] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5739] <... clone3 resumed> => {parent_tid=[5742]}, 88) = 5742 [pid 5078] <... restart_syscall resumed>) = 0 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5742] <... rseq resumed>) = 0 [pid 5741] <... bpf resumed>) = 3 [pid 5739] rt_sigprocmask(SIG_SETMASK, [], [pid 5076] newfstatat(AT_FDCWD, "./64/binderfs", [pid 5074] close(3 [pid 5742] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5741] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5739] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] <... close resumed>) = 0 [pid 5742] <... set_robust_list resumed>) = 0 [pid 5741] <... futex resumed>) = 1 [pid 5739] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5738] <... futex resumed>) = 0 [pid 5078] umount2("./68", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] rmdir("./63" [pid 5742] rt_sigprocmask(SIG_SETMASK, [], [pid 5741] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5739] <... futex resumed>) = 0 [pid 5738] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] unlink("./64/binderfs" [pid 5742] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5741] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5739] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5738] <... futex resumed>) = 0 [pid 5078] openat(AT_FDCWD, "./68", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5076] <... unlink resumed>) = 0 [pid 5074] <... rmdir resumed>) = 0 [pid 5742] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5741] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5738] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... openat resumed>) = 3 [pid 5742] <... bpf resumed>) = 3 [pid 5076] getdents64(3, [pid 5074] mkdir("./64", 0777 [pid 5742] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5741] <... bpf resumed>) = 4 [pid 5078] newfstatat(3, "", [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5074] <... mkdir resumed>) = 0 [pid 5742] <... futex resumed>) = 1 [pid 5741] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5739] <... futex resumed>) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5741] <... futex resumed>) = 1 [pid 5739] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5738] <... futex resumed>) = 0 [pid 5741] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5739] <... futex resumed>) = 0 [pid 5738] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5741] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5739] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5738] <... futex resumed>) = 0 [pid 5741] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5738] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5742] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5078] getdents64(3, [pid 5076] close(3 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5743 attached [pid 5742] <... bpf resumed>) = 4 [pid 5741] <... bpf resumed>) = 5 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5076] <... close resumed>) = 0 [pid 5743] set_robust_list(0x55555d6c46a0, 24 [pid 5742] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5741] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] umount2("./68/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] rmdir("./64" [pid 5743] <... set_robust_list resumed>) = 0 [pid 5742] <... futex resumed>) = 1 [pid 5741] <... futex resumed>) = 1 [pid 5739] <... futex resumed>) = 0 [pid 5738] <... futex resumed>) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5743] chdir("./64" [pid 5742] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5741] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5739] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5738] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] newfstatat(AT_FDCWD, "./68/binderfs", [pid 5076] <... rmdir resumed>) = 0 [pid 5743] <... chdir resumed>) = 0 [pid 5742] <... bpf resumed>) = 5 [pid 5741] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5739] <... futex resumed>) = 0 [pid 5738] <... futex resumed>) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5743 [pid 5743] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5741] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5739] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5738] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5743] <... prctl resumed>) = 0 [pid 5743] setpgid(0, 0 [pid 5742] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5741] <... bpf resumed>) = 6 [pid 5078] unlink("./68/binderfs" [pid 5076] mkdir("./65", 0777 [pid 5743] <... setpgid resumed>) = 0 [pid 5742] <... futex resumed>) = 1 [pid 5741] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5739] <... futex resumed>) = 0 [pid 5078] <... unlink resumed>) = 0 [pid 5076] <... mkdir resumed>) = 0 [pid 5742] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5078] getdents64(3, [pid 5743] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5741] <... futex resumed>) = 1 [pid 5739] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5738] <... futex resumed>) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5078] close(3 [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5744 attached [pid 5742] <... futex resumed>) = 0 [pid 5743] <... openat resumed>) = 3 [pid 5741] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5739] <... futex resumed>) = 1 [pid 5738] exit_group(0 [pid 5078] <... close resumed>) = 0 [pid 5742] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5078] rmdir("./68" [pid 5744] set_robust_list(0x55555d6c46a0, 24 [pid 5743] write(3, "1000", 4 [pid 5742] <... bpf resumed>) = 6 [pid 5741] <... futex resumed>) = ? [pid 5739] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5738] <... exit_group resumed>) = ? [pid 5078] <... rmdir resumed>) = 0 [pid 5741] +++ exited with 0 +++ [pid 5744] <... set_robust_list resumed>) = 0 [pid 5742] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5739] <... futex resumed>) = 0 [pid 5078] mkdir("./69", 0777 [pid 5742] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5739] exit_group(0 [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5744 [pid 5742] <... futex resumed>) = ? [pid 5739] <... exit_group resumed>) = ? [pid 5744] chdir("./65" [pid 5743] <... write resumed>) = 4 [pid 5742] +++ exited with 0 +++ [pid 5078] <... mkdir resumed>) = 0 [pid 5744] <... chdir resumed>) = 0 [pid 5743] close(3 [pid 5744] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5743] <... close resumed>) = 0 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5744] <... prctl resumed>) = 0 [pid 5743] symlink("/dev/binderfs", "./binderfs"./strace-static-x86_64: Process 5745 attached [pid 5744] setpgid(0, 0 [pid 5743] <... symlink resumed>) = 0 [pid 5743] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5744] <... setpgid resumed>) = 0 [pid 5743] <... futex resumed>) = 0 [pid 5745] set_robust_list(0x55555d6c46a0, 24 [pid 5744] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5743] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5738] +++ exited with 0 +++ [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5745 [pid 5745] <... set_robust_list resumed>) = 0 [pid 5743] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5738, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5745] chdir("./69") = 0 [pid 5744] <... openat resumed>) = 3 [pid 5743] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5739] +++ exited with 0 +++ [pid 5745] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5744] write(3, "1000", 4 [pid 5743] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] umount2("./66", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5739, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5745] <... prctl resumed>) = 0 [pid 5744] <... write resumed>) = 4 [pid 5743] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] restart_syscall(<... resuming interrupted clone ...> [pid 5745] setpgid(0, 0 [pid 5744] close(3 [pid 5743] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5077] openat(AT_FDCWD, "./66", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5075] <... restart_syscall resumed>) = 0 [pid 5745] <... setpgid resumed>) = 0 [pid 5744] <... close resumed>) = 0 [pid 5743] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5077] <... openat resumed>) = 3 [pid 5744] symlink("/dev/binderfs", "./binderfs" [pid 5743] <... mprotect resumed>) = 0 [pid 5077] newfstatat(3, "", [pid 5744] <... symlink resumed>) = 0 [pid 5745] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5075] umount2("./66", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5077] getdents64(3, [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5744] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5743] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5075] openat(AT_FDCWD, "./66", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5744] <... futex resumed>) = 0 [pid 5743] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5744] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5743] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5745] <... openat resumed>) = 3 [pid 5744] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5077] umount2("./66/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] <... openat resumed>) = 3 ./strace-static-x86_64: Process 5746 attached [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] newfstatat(3, "", [pid 5746] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5077] newfstatat(AT_FDCWD, "./66/binderfs", [pid 5746] <... rseq resumed>) = 0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5744] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5746] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5745] write(3, "1000", 4 [pid 5744] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5743] <... clone3 resumed> => {parent_tid=[5746]}, 88) = 5746 [pid 5745] <... write resumed>) = 4 [pid 5744] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5743] rt_sigprocmask(SIG_SETMASK, [], [pid 5746] <... set_robust_list resumed>) = 0 [pid 5745] close(3 [pid 5744] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5743] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] unlink("./66/binderfs" [pid 5075] getdents64(3, [pid 5746] rt_sigprocmask(SIG_SETMASK, [], [pid 5745] <... close resumed>) = 0 [pid 5744] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5743] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... unlink resumed>) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5746] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5745] symlink("/dev/binderfs", "./binderfs" [pid 5744] <... mprotect resumed>) = 0 [pid 5743] <... futex resumed>) = 0 [pid 5075] umount2("./66/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5746] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5743] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] getdents64(3, [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5746] <... bpf resumed>) = 3 [pid 5745] <... symlink resumed>) = 0 [pid 5744] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5075] newfstatat(AT_FDCWD, "./66/binderfs", [pid 5746] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] close(3 [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5746] <... futex resumed>) = 1 [pid 5745] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5743] <... futex resumed>) = 0 [pid 5077] <... close resumed>) = 0 [pid 5746] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5745] <... futex resumed>) = 0 [pid 5744] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5743] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] rmdir("./66" [pid 5075] unlink("./66/binderfs" [pid 5746] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5745] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5744] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5743] <... futex resumed>) = 0 [pid 5077] <... rmdir resumed>) = 0 [pid 5075] <... unlink resumed>) = 0 [pid 5746] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5745] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5743] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5745] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], ./strace-static-x86_64: Process 5747 attached [pid 5746] <... bpf resumed>) = 4 [pid 5745] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5744] <... clone3 resumed> => {parent_tid=[5747]}, 88) = 5747 [pid 5077] mkdir("./67", 0777 [pid 5075] getdents64(3, [pid 5747] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5746] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5745] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5744] rt_sigprocmask(SIG_SETMASK, [], [pid 5077] <... mkdir resumed>) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5747] <... rseq resumed>) = 0 [pid 5746] <... futex resumed>) = 1 [pid 5743] <... futex resumed>) = 0 [pid 5747] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5746] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5745] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5744] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5743] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5075] close(3./strace-static-x86_64: Process 5748 attached [pid 5747] <... set_robust_list resumed>) = 0 [pid 5746] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5745] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5744] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5743] <... futex resumed>) = 0 [pid 5075] <... close resumed>) = 0 [pid 5747] rt_sigprocmask(SIG_SETMASK, [], [pid 5746] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5744] <... futex resumed>) = 0 [pid 5743] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5748] set_robust_list(0x55555d6c46a0, 24 [pid 5745] <... mprotect resumed>) = 0 [pid 5744] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5748] <... set_robust_list resumed>) = 0 [pid 5748] chdir("./67" [pid 5747] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5746] <... bpf resumed>) = 5 [pid 5745] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5748 [pid 5075] rmdir("./66" [pid 5748] <... chdir resumed>) = 0 [pid 5747] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5745] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5748] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5747] <... bpf resumed>) = 3 [pid 5746] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5745] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5075] <... rmdir resumed>) = 0 [pid 5748] <... prctl resumed>) = 0 [pid 5747] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5746] <... futex resumed>) = 1 [pid 5743] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5749 attached [pid 5748] setpgid(0, 0 [pid 5747] <... futex resumed>) = 1 [pid 5746] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5744] <... futex resumed>) = 0 [pid 5743] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] mkdir("./67", 0777 [pid 5749] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5748] <... setpgid resumed>) = 0 [pid 5747] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5746] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5745] <... clone3 resumed> => {parent_tid=[5749]}, 88) = 5749 [pid 5744] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5743] <... futex resumed>) = 0 [pid 5075] <... mkdir resumed>) = 0 [pid 5749] <... rseq resumed>) = 0 [pid 5747] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5746] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5744] <... futex resumed>) = 0 [pid 5743] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5749] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5748] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5747] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5746] <... bpf resumed>) = 6 [pid 5745] rt_sigprocmask(SIG_SETMASK, [], [pid 5744] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5749] <... set_robust_list resumed>) = 0 [pid 5748] <... openat resumed>) = 3 [pid 5747] <... bpf resumed>) = 4 [pid 5746] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5745] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5749] rt_sigprocmask(SIG_SETMASK, [], [pid 5748] write(3, "1000", 4 [pid 5747] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5746] <... futex resumed>) = 1 [pid 5745] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5743] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5750 attached [pid 5749] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5748] <... write resumed>) = 4 [pid 5747] <... futex resumed>) = 1 [pid 5746] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5745] <... futex resumed>) = 0 [pid 5744] <... futex resumed>) = 0 [pid 5743] exit_group(0 [pid 5749] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5748] close(3 [pid 5750] set_robust_list(0x55555d6c46a0, 24 [pid 5747] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5746] <... futex resumed>) = ? [pid 5745] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5744] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5743] <... exit_group resumed>) = ? [pid 5750] <... set_robust_list resumed>) = 0 [pid 5749] <... bpf resumed>) = 3 [pid 5748] <... close resumed>) = 0 [pid 5750] chdir("./67" [pid 5749] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5748] symlink("/dev/binderfs", "./binderfs" [pid 5747] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5746] +++ exited with 0 +++ [pid 5744] <... futex resumed>) = 0 [pid 5743] +++ exited with 0 +++ [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5750 [pid 5747] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5744] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5743, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5750] <... chdir resumed>) = 0 [pid 5749] <... futex resumed>) = 1 [pid 5748] <... symlink resumed>) = 0 [pid 5747] <... bpf resumed>) = 5 [pid 5745] <... futex resumed>) = 0 [pid 5750] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5749] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5750] <... prctl resumed>) = 0 [pid 5745] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5748] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5750] setpgid(0, 0 [pid 5749] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5747] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5745] <... futex resumed>) = 0 [pid 5748] <... futex resumed>) = 0 [pid 5750] <... setpgid resumed>) = 0 [pid 5749] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5748] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5747] <... futex resumed>) = 1 [pid 5745] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5744] <... futex resumed>) = 0 [pid 5750] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5749] <... bpf resumed>) = 4 [pid 5747] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5748] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5744] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5750] <... openat resumed>) = 3 [pid 5749] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5748] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5747] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5744] <... futex resumed>) = 0 [pid 5750] write(3, "1000", 4 [pid 5749] <... futex resumed>) = 1 [pid 5748] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5747] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5745] <... futex resumed>) = 0 [pid 5744] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5074] umount2("./64", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5750] <... write resumed>) = 4 [pid 5749] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5748] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5747] <... bpf resumed>) = 6 [pid 5745] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5750] close(3 [pid 5749] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5748] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5747] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5745] <... futex resumed>) = 0 [pid 5074] openat(AT_FDCWD, "./64", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5750] <... close resumed>) = 0 [pid 5749] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5748] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5747] <... futex resumed>) = 1 [pid 5745] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5744] <... futex resumed>) = 0 [pid 5750] symlink("/dev/binderfs", "./binderfs" [pid 5749] <... bpf resumed>) = 5 [pid 5747] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5744] exit_group(0 [pid 5074] <... openat resumed>) = 3 [pid 5750] <... symlink resumed>) = 0 [pid 5749] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5748] <... mprotect resumed>) = 0 [pid 5747] <... futex resumed>) = ? [pid 5744] <... exit_group resumed>) = ? [pid 5747] +++ exited with 0 +++ [pid 5074] newfstatat(3, "", [pid 5750] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5749] <... futex resumed>) = 1 [pid 5748] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5745] <... futex resumed>) = 0 [pid 5750] <... futex resumed>) = 0 [pid 5749] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5750] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5749] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5748] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5745] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5750] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5749] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5748] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5745] <... futex resumed>) = 0 [pid 5750] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], ./strace-static-x86_64: Process 5751 attached [pid 5074] getdents64(3, [pid 5751] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5750] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5748] <... clone3 resumed> => {parent_tid=[5751]}, 88) = 5751 [pid 5745] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5744] +++ exited with 0 +++ [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5751] <... rseq resumed>) = 0 [pid 5750] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5748] rt_sigprocmask(SIG_SETMASK, [], [pid 5074] umount2("./64/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5751] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5750] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5748] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5744, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5751] <... set_robust_list resumed>) = 0 [pid 5750] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5748] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] umount2("./65", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] newfstatat(AT_FDCWD, "./64/binderfs", [pid 5751] rt_sigprocmask(SIG_SETMASK, [], [pid 5750] <... mprotect resumed>) = 0 [pid 5748] <... futex resumed>) = 0 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5751] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5748] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] openat(AT_FDCWD, "./65", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5074] unlink("./64/binderfs" [pid 5751] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5750] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5749] <... bpf resumed>) = 6 [pid 5076] <... openat resumed>) = 3 [pid 5074] <... unlink resumed>) = 0 [pid 5751] <... bpf resumed>) = 3 [pid 5076] newfstatat(3, "", [pid 5750] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5749] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5751] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5750] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5749] <... futex resumed>) = 1 [pid 5745] <... futex resumed>) = 0 [pid 5076] getdents64(3, [pid 5074] getdents64(3, [pid 5751] <... futex resumed>) = 1 [pid 5749] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5748] <... futex resumed>) = 0 [pid 5745] exit_group(0 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 ./strace-static-x86_64: Process 5752 attached [pid 5751] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5750] <... clone3 resumed> => {parent_tid=[5752]}, 88) = 5752 [pid 5749] <... futex resumed>) = ? [pid 5748] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5745] <... exit_group resumed>) = ? [pid 5074] close(3 [pid 5752] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5751] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5749] +++ exited with 0 +++ [pid 5076] umount2("./65/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... close resumed>) = 0 [pid 5752] <... rseq resumed>) = 0 [pid 5751] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] rmdir("./64" [pid 5752] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5751] <... bpf resumed>) = 4 [pid 5750] rt_sigprocmask(SIG_SETMASK, [], [pid 5748] <... futex resumed>) = 0 [pid 5745] +++ exited with 0 +++ [pid 5076] newfstatat(AT_FDCWD, "./65/binderfs", [pid 5752] <... set_robust_list resumed>) = 0 [pid 5752] rt_sigprocmask(SIG_SETMASK, [], [pid 5751] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5750] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5748] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5745, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] <... rmdir resumed>) = 0 [pid 5752] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5751] <... futex resumed>) = 0 [pid 5750] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5748] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5076] unlink("./65/binderfs" [pid 5752] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5751] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5750] <... futex resumed>) = 0 [pid 5748] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] <... unlink resumed>) = 0 [pid 5752] <... bpf resumed>) = 3 [pid 5751] <... bpf resumed>) = 5 [pid 5750] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5748] <... futex resumed>) = 0 [pid 5078] umount2("./69", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] getdents64(3, [pid 5074] mkdir("./65", 0777 [pid 5752] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5750] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5748] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] <... mkdir resumed>) = 0 [pid 5750] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5752] <... futex resumed>) = 0 [pid 5750] <... futex resumed>) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5753 attached [pid 5752] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5751] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5750] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] openat(AT_FDCWD, "./69", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5076] close(3 [pid 5752] <... bpf resumed>) = 4 [pid 5751] <... futex resumed>) = 1 [pid 5748] <... futex resumed>) = 0 [pid 5078] <... openat resumed>) = 3 [pid 5076] <... close resumed>) = 0 [pid 5753] set_robust_list(0x55555d6c46a0, 24 [pid 5078] newfstatat(3, "", [pid 5076] rmdir("./65" [pid 5753] <... set_robust_list resumed>) = 0 [pid 5748] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5076] <... rmdir resumed>) = 0 [pid 5748] <... futex resumed>) = 0 [pid 5753] chdir("./65" [pid 5752] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5751] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5078] getdents64(3, [pid 5753] <... chdir resumed>) = 0 [pid 5752] <... futex resumed>) = 1 [pid 5751] <... bpf resumed>) = 6 [pid 5750] <... futex resumed>) = 0 [pid 5748] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5076] mkdir("./66", 0777 [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5753 [pid 5753] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5752] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5751] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5750] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5748] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5078] umount2("./69/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] <... mkdir resumed>) = 0 [pid 5752] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5753] <... prctl resumed>) = 0 [pid 5751] <... futex resumed>) = 0 [pid 5748] exit_group(0 [pid 5750] <... futex resumed>) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5753] setpgid(0, 0 [pid 5752] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5750] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5748] <... exit_group resumed>) = ? [pid 5078] newfstatat(AT_FDCWD, "./69/binderfs", [pid 5753] <... setpgid resumed>) = 0 [pid 5752] <... bpf resumed>) = 5 [pid 5751] +++ exited with 0 +++ [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5078] unlink("./69/binderfs" [pid 5748] +++ exited with 0 +++ [pid 5078] <... unlink resumed>) = 0 ./strace-static-x86_64: Process 5754 attached [pid 5753] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5754] set_robust_list(0x55555d6c46a0, 24 [pid 5752] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] getdents64(3, [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5748, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5754] <... set_robust_list resumed>) = 0 [pid 5753] <... openat resumed>) = 3 [pid 5752] <... futex resumed>) = 1 [pid 5750] <... futex resumed>) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5077] umount2("./67", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5754 [pid 5754] chdir("./66" [pid 5752] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5078] close(3 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5754] <... chdir resumed>) = 0 [pid 5750] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... close resumed>) = 0 [pid 5077] openat(AT_FDCWD, "./67", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5754] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5753] write(3, "1000", 4 [pid 5752] <... futex resumed>) = 0 [pid 5750] <... futex resumed>) = 1 [pid 5078] rmdir("./69" [pid 5077] <... openat resumed>) = 3 [pid 5754] <... prctl resumed>) = 0 [pid 5753] <... write resumed>) = 4 [pid 5752] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5750] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] <... rmdir resumed>) = 0 [pid 5077] newfstatat(3, "", [pid 5754] setpgid(0, 0 [pid 5753] close(3) = 0 [pid 5753] symlink("/dev/binderfs", "./binderfs" [pid 5754] <... setpgid resumed>) = 0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5754] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5753] <... symlink resumed>) = 0 [pid 5078] mkdir("./70", 0777 [pid 5077] getdents64(3, [pid 5753] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5754] <... openat resumed>) = 3 [pid 5753] <... futex resumed>) = 0 [pid 5078] <... mkdir resumed>) = 0 [pid 5077] umount2("./67/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5754] write(3, "1000", 4 [pid 5753] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5752] <... bpf resumed>) = 6 [pid 5754] <... write resumed>) = 4 [pid 5753] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5752] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5755 attached [pid 5754] close(3 [pid 5753] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5752] <... futex resumed>) = 1 [pid 5750] <... futex resumed>) = 0 [pid 5077] newfstatat(AT_FDCWD, "./67/binderfs", [pid 5754] <... close resumed>) = 0 [pid 5752] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5755] set_robust_list(0x55555d6c46a0, 24 [pid 5754] symlink("/dev/binderfs", "./binderfs" [pid 5753] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5750] exit_group(0 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5755 [pid 5077] unlink("./67/binderfs" [pid 5755] <... set_robust_list resumed>) = 0 [pid 5754] <... symlink resumed>) = 0 [pid 5753] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5752] <... futex resumed>) = ? [pid 5750] <... exit_group resumed>) = ? [pid 5077] <... unlink resumed>) = 0 [pid 5755] chdir("./70") = 0 [pid 5754] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5753] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5752] +++ exited with 0 +++ [pid 5077] getdents64(3, [pid 5754] <... futex resumed>) = 0 [pid 5753] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5755] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5754] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5753] <... mprotect resumed>) = 0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5755] <... prctl resumed>) = 0 [pid 5754] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5077] close(3 [pid 5755] setpgid(0, 0 [pid 5754] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5753] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5750] +++ exited with 0 +++ [pid 5077] <... close resumed>) = 0 [pid 5755] <... setpgid resumed>) = 0 [pid 5077] rmdir("./67" [pid 5755] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5754] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5753] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5077] <... rmdir resumed>) = 0 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5750, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5755] <... openat resumed>) = 3 [pid 5754] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5753] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5075] restart_syscall(<... resuming interrupted clone ...>./strace-static-x86_64: Process 5756 attached [pid 5755] write(3, "1000", 4 [pid 5754] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5077] mkdir("./68", 0777 [pid 5075] <... restart_syscall resumed>) = 0 [pid 5756] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5755] <... write resumed>) = 4 [pid 5754] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5753] <... clone3 resumed> => {parent_tid=[5756]}, 88) = 5756 [pid 5756] <... rseq resumed>) = 0 [pid 5755] close(3 [pid 5753] rt_sigprocmask(SIG_SETMASK, [], [pid 5756] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5755] <... close resumed>) = 0 [pid 5753] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] <... mkdir resumed>) = 0 [pid 5075] umount2("./67", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5756] <... set_robust_list resumed>) = 0 [pid 5755] symlink("/dev/binderfs", "./binderfs" [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5757 attached [pid 5756] rt_sigprocmask(SIG_SETMASK, [], [pid 5755] <... symlink resumed>) = 0 [pid 5754] <... mprotect resumed>) = 0 [pid 5753] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5756] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5755] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] openat(AT_FDCWD, "./67", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5757] set_robust_list(0x55555d6c46a0, 24 [pid 5756] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5755] <... futex resumed>) = 0 [pid 5754] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5753] <... futex resumed>) = 0 [pid 5075] <... openat resumed>) = 3 [pid 5757] <... set_robust_list resumed>) = 0 [pid 5756] <... bpf resumed>) = 3 [pid 5755] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5753] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5757 [pid 5075] newfstatat(3, "", [pid 5757] chdir("./68" [pid 5756] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5755] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5754] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5753] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5756] <... futex resumed>) = 0 [pid 5755] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5754] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5753] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] getdents64(3, [pid 5757] <... chdir resumed>) = 0 [pid 5756] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5755] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5753] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5758 attached [pid 5757] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5756] <... bpf resumed>) = 4 [pid 5755] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5754] <... clone3 resumed> => {parent_tid=[5758]}, 88) = 5758 [pid 5753] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5758] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5757] <... prctl resumed>) = 0 [pid 5756] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5755] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5754] rt_sigprocmask(SIG_SETMASK, [], [pid 5753] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5075] umount2("./67/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5758] <... rseq resumed>) = 0 [pid 5757] setpgid(0, 0 [pid 5756] <... futex resumed>) = 0 [pid 5755] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5754] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5753] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5758] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5757] <... setpgid resumed>) = 0 [pid 5756] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5755] <... mprotect resumed>) = 0 [pid 5754] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5753] <... futex resumed>) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5758] <... set_robust_list resumed>) = 0 [pid 5757] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5756] <... bpf resumed>) = 5 [pid 5755] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5754] <... futex resumed>) = 0 [pid 5753] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5758] rt_sigprocmask(SIG_SETMASK, [], [pid 5756] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5755] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5075] newfstatat(AT_FDCWD, "./67/binderfs", [pid 5758] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5756] <... futex resumed>) = 0 [pid 5755] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5758] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5756] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 5759 attached [pid 5758] <... bpf resumed>) = 3 [pid 5757] <... openat resumed>) = 3 [pid 5754] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5753] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5075] unlink("./67/binderfs" [pid 5759] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5758] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5757] write(3, "1000", 4 [pid 5755] <... clone3 resumed> => {parent_tid=[5759]}, 88) = 5759 [pid 5754] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5753] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... unlink resumed>) = 0 [pid 5759] <... rseq resumed>) = 0 [pid 5758] <... futex resumed>) = 0 [pid 5757] <... write resumed>) = 4 [pid 5756] <... futex resumed>) = 0 [pid 5755] rt_sigprocmask(SIG_SETMASK, [], [pid 5754] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5753] <... futex resumed>) = 1 [pid 5759] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5754] <... futex resumed>) = 0 [pid 5753] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5759] <... set_robust_list resumed>) = 0 [pid 5757] close(3 [pid 5754] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5759] rt_sigprocmask(SIG_SETMASK, [], [pid 5757] <... close resumed>) = 0 [pid 5759] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5757] symlink("/dev/binderfs", "./binderfs" [pid 5759] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5758] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5757] <... symlink resumed>) = 0 [pid 5756] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5755] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] getdents64(3, [pid 5758] <... bpf resumed>) = 4 [pid 5757] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5756] <... bpf resumed>) = 6 [pid 5755] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5759] <... futex resumed>) = 0 [pid 5758] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5757] <... futex resumed>) = 0 [pid 5756] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5755] <... futex resumed>) = 1 [pid 5075] close(3 [pid 5759] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5758] <... futex resumed>) = 1 [pid 5756] <... futex resumed>) = 1 [pid 5755] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5754] <... futex resumed>) = 0 [pid 5753] <... futex resumed>) = 0 [pid 5075] <... close resumed>) = 0 [pid 5759] <... bpf resumed>) = 3 [pid 5758] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5757] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5756] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5754] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5753] exit_group(0 [pid 5075] rmdir("./67" [pid 5759] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5758] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5757] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5756] <... futex resumed>) = ? [pid 5754] <... futex resumed>) = 0 [pid 5753] <... exit_group resumed>) = ? [pid 5075] <... rmdir resumed>) = 0 [pid 5759] <... futex resumed>) = 1 [pid 5758] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5757] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5756] +++ exited with 0 +++ [pid 5755] <... futex resumed>) = 0 [pid 5754] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5759] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5757] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5755] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] mkdir("./68", 0777 [pid 5759] <... bpf resumed>) = 4 [pid 5758] <... bpf resumed>) = 5 [pid 5757] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5755] <... futex resumed>) = 0 [pid 5075] <... mkdir resumed>) = 0 [pid 5755] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5753] +++ exited with 0 +++ [pid 5759] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5757] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5755] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5759] <... futex resumed>) = 0 [pid 5757] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5755] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5753, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5759] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5758] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5757] <... mprotect resumed>) = 0 [pid 5755] <... futex resumed>) = 0 [pid 5758] <... futex resumed>) = 1 [pid 5755] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] umount2("./65", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5758] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5757] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5754] <... futex resumed>) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5758] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5754] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5760 [pid 5074] openat(AT_FDCWD, "./65", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY./strace-static-x86_64: Process 5760 attached [pid 5759] <... bpf resumed>) = 5 [pid 5758] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5757] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5754] <... futex resumed>) = 0 [pid 5074] <... openat resumed>) = 3 [pid 5760] set_robust_list(0x55555d6c46a0, 24 [pid 5759] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5758] <... bpf resumed>) = 6 [pid 5757] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5754] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000}./strace-static-x86_64: Process 5761 attached [pid 5760] <... set_robust_list resumed>) = 0 [pid 5759] <... futex resumed>) = 1 [pid 5758] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5755] <... futex resumed>) = 0 [pid 5754] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5074] newfstatat(3, "", [pid 5761] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5760] chdir("./68" [pid 5759] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5758] <... futex resumed>) = 0 [pid 5757] <... clone3 resumed> => {parent_tid=[5761]}, 88) = 5761 [pid 5755] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5754] exit_group(0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5761] <... rseq resumed>) = 0 [pid 5760] <... chdir resumed>) = 0 [pid 5759] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5757] rt_sigprocmask(SIG_SETMASK, [], [pid 5755] <... futex resumed>) = 0 [pid 5754] <... exit_group resumed>) = ? [pid 5074] getdents64(3, [pid 5761] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5760] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5759] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5758] +++ exited with 0 +++ [pid 5757] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5755] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5761] <... set_robust_list resumed>) = 0 [pid 5760] <... prctl resumed>) = 0 [pid 5759] <... bpf resumed>) = 6 [pid 5757] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5761] rt_sigprocmask(SIG_SETMASK, [], [pid 5759] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5757] <... futex resumed>) = 0 [pid 5074] umount2("./65/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5761] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5760] setpgid(0, 0 [pid 5759] <... futex resumed>) = 1 [pid 5757] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5755] <... futex resumed>) = 0 [pid 5761] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5760] <... setpgid resumed>) = 0 [pid 5759] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5755] exit_group(0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5761] <... bpf resumed>) = 3 [pid 5760] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5759] <... futex resumed>) = ? [pid 5755] <... exit_group resumed>) = ? [pid 5074] newfstatat(AT_FDCWD, "./65/binderfs", [pid 5761] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5760] <... openat resumed>) = 3 [pid 5759] +++ exited with 0 +++ [pid 5761] <... futex resumed>) = 1 [pid 5760] write(3, "1000", 4 [pid 5757] <... futex resumed>) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5757] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] unlink("./65/binderfs" [pid 5761] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5760] <... write resumed>) = 4 [pid 5757] <... futex resumed>) = 0 [pid 5760] close(3 [pid 5757] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5760] <... close resumed>) = 0 [pid 5761] <... bpf resumed>) = 4 [pid 5760] symlink("/dev/binderfs", "./binderfs" [pid 5074] <... unlink resumed>) = 0 [pid 5761] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5760] <... symlink resumed>) = 0 [pid 5761] <... futex resumed>) = 1 [pid 5760] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5757] <... futex resumed>) = 0 [pid 5074] getdents64(3, [pid 5761] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5760] <... futex resumed>) = 0 [pid 5757] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5761] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5760] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5757] <... futex resumed>) = 0 [pid 5761] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5760] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5757] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5754] +++ exited with 0 +++ [pid 5074] close(3) = 0 [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5754, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5761] <... bpf resumed>) = 5 [pid 5076] umount2("./66", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] rmdir("./65" [pid 5760] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5761] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5755] +++ exited with 0 +++ [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] <... rmdir resumed>) = 0 [pid 5761] <... futex resumed>) = 1 [pid 5760] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5757] <... futex resumed>) = 0 [pid 5076] openat(AT_FDCWD, "./66", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5761] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5760] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5757] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5755, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5076] <... openat resumed>) = 3 [pid 5074] mkdir("./66", 0777 [pid 5761] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5760] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5757] <... futex resumed>) = 0 [pid 5078] umount2("./70", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] newfstatat(3, "", [pid 5761] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5760] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5757] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5074] <... mkdir resumed>) = 0 [pid 5760] <... mprotect resumed>) = 0 [pid 5078] openat(AT_FDCWD, "./70", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5076] getdents64(3, [pid 5760] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5078] newfstatat(3, "", [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5076] umount2("./66/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5076] newfstatat(AT_FDCWD, "./66/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5076] unlink("./66/binderfs" [pid 5760] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5078] getdents64(3, [pid 5761] <... bpf resumed>) = 6 [pid 5760] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 ./strace-static-x86_64: Process 5762 attached ./strace-static-x86_64: Process 5763 attached [pid 5761] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] umount2("./70/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] <... unlink resumed>) = 0 [pid 5762] set_robust_list(0x55555d6c46a0, 24 [pid 5763] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5760] <... clone3 resumed> => {parent_tid=[5763]}, 88) = 5763 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5762] <... set_robust_list resumed>) = 0 [pid 5763] <... rseq resumed>) = 0 [pid 5761] <... futex resumed>) = 1 [pid 5760] rt_sigprocmask(SIG_SETMASK, [], [pid 5757] <... futex resumed>) = 0 [pid 5078] newfstatat(AT_FDCWD, "./70/binderfs", [pid 5076] getdents64(3, [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5762 [pid 5762] chdir("./66" [pid 5763] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5761] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5760] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5757] exit_group(0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5762] <... chdir resumed>) = 0 [pid 5763] <... set_robust_list resumed>) = 0 [pid 5761] <... futex resumed>) = ? [pid 5760] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5757] <... exit_group resumed>) = ? [pid 5078] unlink("./70/binderfs" [pid 5762] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5763] rt_sigprocmask(SIG_SETMASK, [], [pid 5761] +++ exited with 0 +++ [pid 5760] <... futex resumed>) = 0 [pid 5078] <... unlink resumed>) = 0 [pid 5076] close(3 [pid 5762] <... prctl resumed>) = 0 [pid 5760] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] getdents64(3, [pid 5762] setpgid(0, 0 [pid 5763] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5076] <... close resumed>) = 0 [pid 5762] <... setpgid resumed>) = 0 [pid 5078] close(3 [pid 5762] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5763] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5757] +++ exited with 0 +++ [pid 5078] <... close resumed>) = 0 [pid 5076] rmdir("./66" [pid 5762] <... openat resumed>) = 3 [pid 5763] <... bpf resumed>) = 3 [pid 5078] rmdir("./70" [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5757, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5076] <... rmdir resumed>) = 0 [pid 5763] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... rmdir resumed>) = 0 [pid 5077] restart_syscall(<... resuming interrupted clone ...> [pid 5763] <... futex resumed>) = 1 [pid 5760] <... futex resumed>) = 0 [pid 5077] <... restart_syscall resumed>) = 0 [pid 5762] write(3, "1000", 4 [pid 5760] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5762] <... write resumed>) = 4 [pid 5763] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5760] <... futex resumed>) = 0 [pid 5078] mkdir("./71", 0777 [pid 5076] mkdir("./67", 0777 [pid 5762] close(3 [pid 5760] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] umount2("./68", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5762] <... close resumed>) = 0 [pid 5763] <... bpf resumed>) = 4 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5762] symlink("/dev/binderfs", "./binderfs" [pid 5077] openat(AT_FDCWD, "./68", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5762] <... symlink resumed>) = 0 [pid 5763] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... openat resumed>) = 3 [pid 5076] <... mkdir resumed>) = 0 [pid 5762] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5763] <... futex resumed>) = 1 [pid 5760] <... futex resumed>) = 0 [pid 5078] <... mkdir resumed>) = 0 [pid 5077] newfstatat(3, "", [pid 5763] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5760] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5762] <... futex resumed>) = 0 [pid 5763] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5760] <... futex resumed>) = 0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5762] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5760] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] getdents64(3, [pid 5762] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5762] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5077] umount2("./68/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5762] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f3e2f5ed000 [pid 5763] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5765 attached ./strace-static-x86_64: Process 5764 attached [pid 5762] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5765] set_robust_list(0x55555d6c46a0, 24 [pid 5762] <... mprotect resumed>) = 0 [pid 5077] newfstatat(AT_FDCWD, "./68/binderfs", [pid 5765] <... set_robust_list resumed>) = 0 [pid 5762] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5763] <... bpf resumed>) = 5 [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5765] chdir("./71" [pid 5764] set_robust_list(0x55555d6c46a0, 24 [pid 5763] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5765 [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5764 [pid 5764] <... set_robust_list resumed>) = 0 [pid 5760] <... futex resumed>) = 0 [pid 5765] <... chdir resumed>) = 0 [pid 5764] chdir("./67" [pid 5762] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5763] <... futex resumed>) = 1 [pid 5760] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] unlink("./68/binderfs" [pid 5765] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5764] <... chdir resumed>) = 0 [pid 5762] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5763] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5760] <... futex resumed>) = 0 [pid 5077] <... unlink resumed>) = 0 [pid 5765] <... prctl resumed>) = 0 [pid 5760] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000}./strace-static-x86_64: Process 5766 attached [pid 5765] setpgid(0, 0 [pid 5764] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5762] <... clone3 resumed> => {parent_tid=[5766]}, 88) = 5766 [pid 5763] <... bpf resumed>) = 6 [pid 5077] getdents64(3, [pid 5766] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5765] <... setpgid resumed>) = 0 [pid 5764] <... prctl resumed>) = 0 [pid 5762] rt_sigprocmask(SIG_SETMASK, [], [pid 5763] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5766] <... rseq resumed>) = 0 [pid 5765] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5764] setpgid(0, 0 [pid 5762] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5763] <... futex resumed>) = 1 [pid 5760] <... futex resumed>) = 0 [pid 5077] close(3 [pid 5766] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5764] <... setpgid resumed>) = 0 [pid 5763] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5760] exit_group(0 [pid 5766] <... set_robust_list resumed>) = 0 [pid 5765] <... openat resumed>) = 3 [pid 5762] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5763] <... futex resumed>) = ? [pid 5760] <... exit_group resumed>) = ? [pid 5077] <... close resumed>) = 0 [pid 5766] rt_sigprocmask(SIG_SETMASK, [], [pid 5765] write(3, "1000", 4 [pid 5764] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5762] <... futex resumed>) = 0 [pid 5763] +++ exited with 0 +++ [pid 5077] rmdir("./68" [pid 5766] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5765] <... write resumed>) = 4 [pid 5762] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5766] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5765] close(3 [pid 5766] <... bpf resumed>) = 3 [pid 5765] <... close resumed>) = 0 [pid 5760] +++ exited with 0 +++ [pid 5766] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5765] symlink("/dev/binderfs", "./binderfs" [pid 5077] <... rmdir resumed>) = 0 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5760, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5766] <... futex resumed>) = 1 [pid 5765] <... symlink resumed>) = 0 [pid 5762] <... futex resumed>) = 0 [pid 5766] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5764] <... openat resumed>) = 3 [pid 5762] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] mkdir("./69", 0777 [pid 5766] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5765] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5764] write(3, "1000", 4 [pid 5762] <... futex resumed>) = 0 [pid 5766] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5765] <... futex resumed>) = 0 [pid 5762] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5766] <... bpf resumed>) = 4 [pid 5765] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5766] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5765] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5766] <... futex resumed>) = 1 [pid 5765] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5762] <... futex resumed>) = 0 [pid 5075] umount2("./68", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5766] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5765] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5762] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5766] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5765] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5762] <... futex resumed>) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5766] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5765] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5762] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] openat(AT_FDCWD, "./68", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5766] <... bpf resumed>) = 5 [pid 5765] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5077] <... mkdir resumed>) = 0 [pid 5075] <... openat resumed>) = 3 [pid 5764] <... write resumed>) = 4 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5764] close(3 [pid 5765] <... mprotect resumed>) = 0 [pid 5075] newfstatat(3, "", [pid 5766] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5765] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5764] <... close resumed>) = 0 [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 ./strace-static-x86_64: Process 5767 attached [pid 5766] <... futex resumed>) = 1 [pid 5764] symlink("/dev/binderfs", "./binderfs" [pid 5762] <... futex resumed>) = 0 [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5767 [pid 5075] getdents64(3, [pid 5767] set_robust_list(0x55555d6c46a0, 24 [pid 5766] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5765] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5764] <... symlink resumed>) = 0 [pid 5762] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5767] <... set_robust_list resumed>) = 0 [pid 5766] <... bpf resumed>) = 6 [pid 5765] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5762] <... futex resumed>) = 0 [pid 5767] chdir("./69" [pid 5762] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5075] umount2("./68/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5768 attached [pid 5767] <... chdir resumed>) = 0 [pid 5766] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5765] <... clone3 resumed> => {parent_tid=[5768]}, 88) = 5768 [pid 5764] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5768] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5767] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5766] <... futex resumed>) = 1 [pid 5765] rt_sigprocmask(SIG_SETMASK, [], [pid 5764] <... futex resumed>) = 0 [pid 5762] <... futex resumed>) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5768] <... rseq resumed>) = 0 [pid 5767] <... prctl resumed>) = 0 [pid 5766] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5765] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5762] exit_group(0 [pid 5075] newfstatat(AT_FDCWD, "./68/binderfs", [pid 5768] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5767] setpgid(0, 0 [pid 5766] <... futex resumed>) = ? [pid 5765] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5762] <... exit_group resumed>) = ? [pid 5764] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5768] <... set_robust_list resumed>) = 0 [pid 5768] rt_sigprocmask(SIG_SETMASK, [], [pid 5764] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5768] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5764] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5768] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5767] <... setpgid resumed>) = 0 [pid 5766] +++ exited with 0 +++ [pid 5765] <... futex resumed>) = 0 [pid 5762] +++ exited with 0 +++ [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5768] <... bpf resumed>) = 3 [pid 5767] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5765] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5764] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] unlink("./68/binderfs" [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5762, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5768] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5767] <... openat resumed>) = 3 [pid 5764] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5768] <... futex resumed>) = 1 [pid 5767] write(3, "1000", 4 [pid 5765] <... futex resumed>) = 0 [pid 5764] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5075] <... unlink resumed>) = 0 [pid 5768] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5767] <... write resumed>) = 4 [pid 5765] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5768] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5767] close(3 [pid 5074] umount2("./66", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5764] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5768] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5764] <... mprotect resumed>) = 0 [pid 5768] <... bpf resumed>) = 4 [pid 5767] <... close resumed>) = 0 [pid 5765] <... futex resumed>) = 0 [pid 5075] getdents64(3, [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5767] symlink("/dev/binderfs", "./binderfs" [pid 5765] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5764] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5074] openat(AT_FDCWD, "./66", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5767] <... symlink resumed>) = 0 [pid 5075] close(3 [pid 5074] <... openat resumed>) = 3 [pid 5768] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5767] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5764] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5075] <... close resumed>) = 0 [pid 5074] newfstatat(3, "", [pid 5768] <... futex resumed>) = 1 [pid 5767] <... futex resumed>) = 0 [pid 5765] <... futex resumed>) = 0 [pid 5764] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5075] rmdir("./68"./strace-static-x86_64: Process 5769 attached [pid 5768] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5767] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5765] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... rmdir resumed>) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5769] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5767] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5765] <... futex resumed>) = 0 [pid 5767] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5765] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] getdents64(3, [pid 5769] <... rseq resumed>) = 0 [pid 5768] <... bpf resumed>) = 5 [pid 5767] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5764] <... clone3 resumed> => {parent_tid=[5769]}, 88) = 5769 [pid 5075] mkdir("./69", 0777 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5769] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5767] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5764] rt_sigprocmask(SIG_SETMASK, [], [pid 5075] <... mkdir resumed>) = 0 [pid 5768] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5764] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5768] <... futex resumed>) = 1 [pid 5764] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5768] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5764] <... futex resumed>) = 0 [pid 5769] <... set_robust_list resumed>) = 0 [pid 5767] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5765] <... futex resumed>) = 0 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] umount2("./66/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5769] rt_sigprocmask(SIG_SETMASK, [], [pid 5767] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5765] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5764] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5769] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5765] <... futex resumed>) = 1 [pid 5769] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5768] <... futex resumed>) = 0 [pid 5767] <... mprotect resumed>) = 0 [pid 5765] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5770 attached [pid 5769] <... bpf resumed>) = 3 [pid 5767] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5074] newfstatat(AT_FDCWD, "./66/binderfs", [pid 5770] set_robust_list(0x55555d6c46a0, 24 [pid 5769] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5770 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5770] <... set_robust_list resumed>) = 0 [pid 5769] <... futex resumed>) = 1 [pid 5768] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5767] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5764] <... futex resumed>) = 0 [pid 5770] chdir("./69" [pid 5769] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5768] <... bpf resumed>) = 6 [pid 5767] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5764] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] unlink("./66/binderfs"./strace-static-x86_64: Process 5771 attached [pid 5770] <... chdir resumed>) = 0 [pid 5769] <... bpf resumed>) = 4 [pid 5768] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5764] <... futex resumed>) = 0 [pid 5074] <... unlink resumed>) = 0 [pid 5771] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5770] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5768] <... futex resumed>) = 1 [pid 5765] <... futex resumed>) = 0 [pid 5764] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5771] <... rseq resumed>) = 0 [pid 5770] <... prctl resumed>) = 0 [pid 5769] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5768] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5767] <... clone3 resumed> => {parent_tid=[5771]}, 88) = 5771 [pid 5765] exit_group(0 [pid 5074] getdents64(3, [pid 5771] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5770] setpgid(0, 0 [pid 5769] <... futex resumed>) = 0 [pid 5768] <... futex resumed>) = ? [pid 5767] rt_sigprocmask(SIG_SETMASK, [], [pid 5765] <... exit_group resumed>) = ? [pid 5764] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5771] <... set_robust_list resumed>) = 0 [pid 5770] <... setpgid resumed>) = 0 [pid 5769] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5768] +++ exited with 0 +++ [pid 5767] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5764] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5771] rt_sigprocmask(SIG_SETMASK, [], [pid 5770] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5769] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5767] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5764] <... futex resumed>) = 0 [pid 5771] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5771] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5770] <... openat resumed>) = 3 [pid 5769] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5767] <... futex resumed>) = 0 [pid 5764] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] close(3 [pid 5771] <... bpf resumed>) = 3 [pid 5770] write(3, "1000", 4 [pid 5769] <... bpf resumed>) = 5 [pid 5767] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5765] +++ exited with 0 +++ [pid 5074] <... close resumed>) = 0 [pid 5770] <... write resumed>) = 4 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5765, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5771] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5771] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5770] close(3 [pid 5767] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5074] rmdir("./66" [pid 5770] <... close resumed>) = 0 [pid 5769] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5767] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... rmdir resumed>) = 0 [pid 5771] <... futex resumed>) = 0 [pid 5770] symlink("/dev/binderfs", "./binderfs" [pid 5769] <... futex resumed>) = 1 [pid 5767] <... futex resumed>) = 1 [pid 5764] <... futex resumed>) = 0 [pid 5771] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5770] <... symlink resumed>) = 0 [pid 5769] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5767] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5764] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] mkdir("./67", 0777 [pid 5771] <... bpf resumed>) = 4 [pid 5770] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5764] <... futex resumed>) = 0 [pid 5771] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5770] <... futex resumed>) = 0 [pid 5769] <... bpf resumed>) = 6 [pid 5764] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] umount2("./71", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... mkdir resumed>) = 0 [pid 5771] <... futex resumed>) = 1 [pid 5770] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5769] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5767] <... futex resumed>) = 0 [pid 5771] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5767] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5764] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5771] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5767] <... futex resumed>) = 0 [pid 5771] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5767] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5764] exit_group(0 [pid 5078] openat(AT_FDCWD, "./71", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5770] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5769] <... futex resumed>) = 0 [pid 5770] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5769] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5078] <... openat resumed>) = 3 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5771] <... bpf resumed>) = 5 [pid 5770] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5769] <... futex resumed>) = ? [pid 5764] <... exit_group resumed>) = ? [pid 5078] newfstatat(3, "", [pid 5770] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5771] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5772 attached ) = 1 [pid 5770] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5769] +++ exited with 0 +++ [pid 5767] <... futex resumed>) = 0 [pid 5764] +++ exited with 0 +++ [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5772] set_robust_list(0x55555d6c46a0, 24 [pid 5771] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5770] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5767] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] getdents64(3, [pid 5772] <... set_robust_list resumed>) = 0 [pid 5771] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5770] <... mprotect resumed>) = 0 [pid 5767] <... futex resumed>) = 0 [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5772 [pid 5772] chdir("./67" [pid 5771] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5770] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5767] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5764, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5772] <... chdir resumed>) = 0 [pid 5770] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5076] restart_syscall(<... resuming interrupted clone ...> [pid 5772] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5771] <... bpf resumed>) = 6 [pid 5770] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5078] umount2("./71/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] <... restart_syscall resumed>) = 0 ./strace-static-x86_64: Process 5773 attached [pid 5772] <... prctl resumed>) = 0 [pid 5771] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5773] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5772] setpgid(0, 0 [pid 5771] <... futex resumed>) = 1 [pid 5770] <... clone3 resumed> => {parent_tid=[5773]}, 88) = 5773 [pid 5767] <... futex resumed>) = 0 [pid 5773] <... rseq resumed>) = 0 [pid 5772] <... setpgid resumed>) = 0 [pid 5771] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5770] rt_sigprocmask(SIG_SETMASK, [], [pid 5767] exit_group(0 [pid 5078] newfstatat(AT_FDCWD, "./71/binderfs", [pid 5773] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5772] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5771] <... futex resumed>) = ? [pid 5770] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5767] <... exit_group resumed>) = ? [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5076] umount2("./67", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5773] <... set_robust_list resumed>) = 0 [pid 5772] <... openat resumed>) = 3 [pid 5771] +++ exited with 0 +++ [pid 5770] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] unlink("./71/binderfs" [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5773] rt_sigprocmask(SIG_SETMASK, [], [pid 5770] <... futex resumed>) = 0 [pid 5076] openat(AT_FDCWD, "./67", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5772] write(3, "1000", 4 [pid 5770] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... unlink resumed>) = 0 [pid 5773] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5772] <... write resumed>) = 4 [pid 5078] getdents64(3, [pid 5076] <... openat resumed>) = 3 [pid 5772] close(3 [pid 5076] newfstatat(3, "", [pid 5772] <... close resumed>) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5773] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5772] symlink("/dev/binderfs", "./binderfs" [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5076] getdents64(3, [pid 5772] <... symlink resumed>) = 0 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5078] close(3 [pid 5773] <... bpf resumed>) = 3 [pid 5772] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... close resumed>) = 0 [pid 5076] umount2("./67/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5773] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5772] <... futex resumed>) = 0 [pid 5767] +++ exited with 0 +++ [pid 5078] rmdir("./71" [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5773] <... futex resumed>) = 1 [pid 5772] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5770] <... futex resumed>) = 0 [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5767, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5076] newfstatat(AT_FDCWD, "./67/binderfs", [pid 5773] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5772] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5770] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... rmdir resumed>) = 0 [pid 5077] restart_syscall(<... resuming interrupted clone ...> [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5773] <... bpf resumed>) = 4 [pid 5772] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5077] <... restart_syscall resumed>) = 0 [pid 5076] unlink("./67/binderfs" [pid 5773] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5772] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5770] <... futex resumed>) = 0 [pid 5078] mkdir("./72", 0777 [pid 5773] <... futex resumed>) = 0 [pid 5772] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5076] <... unlink resumed>) = 0 [pid 5772] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5770] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5772] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5773] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5772] <... mprotect resumed>) = 0 [pid 5770] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5078] <... mkdir resumed>) = 0 [pid 5077] umount2("./69", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] getdents64(3, [pid 5772] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5770] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5773] <... futex resumed>) = 0 [pid 5770] <... futex resumed>) = 1 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5077] openat(AT_FDCWD, "./69", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5076] close(3 [pid 5773] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5770] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... openat resumed>) = 3 [pid 5076] <... close resumed>) = 0 [pid 5772] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5076] rmdir("./67" [pid 5772] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0}./strace-static-x86_64: Process 5775 attached [pid 5077] newfstatat(3, "", [pid 5775] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5772] <... clone3 resumed> => {parent_tid=[5775]}, 88) = 5775 [pid 5775] <... rseq resumed>) = 0 [pid 5772] rt_sigprocmask(SIG_SETMASK, [], [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5076] <... rmdir resumed>) = 0 ./strace-static-x86_64: Process 5774 attached [pid 5775] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5773] <... bpf resumed>) = 5 [pid 5772] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5077] getdents64(3, [pid 5774] set_robust_list(0x55555d6c46a0, 24 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5774] <... set_robust_list resumed>) = 0 [pid 5773] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5774 [pid 5077] umount2("./69/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] mkdir("./68", 0777 [pid 5773] <... futex resumed>) = 1 [pid 5770] <... futex resumed>) = 0 [pid 5770] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5773] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5770] <... futex resumed>) = 0 [pid 5077] newfstatat(AT_FDCWD, "./69/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5772] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5775] <... set_robust_list resumed>) = 0 [pid 5772] <... futex resumed>) = 0 [pid 5775] rt_sigprocmask(SIG_SETMASK, [], [pid 5772] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5775] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5775] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5076] <... mkdir resumed>) = 0 [pid 5770] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5077] unlink("./69/binderfs" [pid 5775] <... bpf resumed>) = 3 [pid 5774] chdir("./72" [pid 5773] <... bpf resumed>) = 6 [pid 5775] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5774] <... chdir resumed>) = 0 [pid 5773] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5775] <... futex resumed>) = 1 [pid 5774] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5773] <... futex resumed>) = 0 [pid 5772] <... futex resumed>) = 0 [pid 5770] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5077] <... unlink resumed>) = 0 [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5775] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5774] <... prctl resumed>) = 0 [pid 5773] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5772] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5770] exit_group(0 [pid 5077] getdents64(3, ./strace-static-x86_64: Process 5776 attached [pid 5775] <... bpf resumed>) = 4 [pid 5774] setpgid(0, 0 [pid 5773] <... futex resumed>) = ? [pid 5772] <... futex resumed>) = 0 [pid 5770] <... exit_group resumed>) = ? [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5776] set_robust_list(0x55555d6c46a0, 24 [pid 5775] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5774] <... setpgid resumed>) = 0 [pid 5773] +++ exited with 0 +++ [pid 5772] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5776] <... set_robust_list resumed>) = 0 [pid 5775] <... futex resumed>) = 0 [pid 5774] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5772] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5770] +++ exited with 0 +++ [pid 5077] close(3 [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5776 [pid 5776] chdir("./68" [pid 5775] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5774] <... openat resumed>) = 3 [pid 5772] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... close resumed>) = 0 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5770, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5776] <... chdir resumed>) = 0 [pid 5774] write(3, "1000", 4 [pid 5077] rmdir("./69" [pid 5776] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5775] <... bpf resumed>) = 5 [pid 5774] <... write resumed>) = 4 [pid 5772] <... futex resumed>) = 0 [pid 5077] <... rmdir resumed>) = 0 [pid 5776] <... prctl resumed>) = 0 [pid 5774] close(3 [pid 5772] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5776] setpgid(0, 0) = 0 [pid 5774] <... close resumed>) = 0 [pid 5776] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5774] symlink("/dev/binderfs", "./binderfs" [pid 5077] mkdir("./70", 0777 [pid 5775] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5774] <... symlink resumed>) = 0 [pid 5075] umount2("./69", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5776] <... openat resumed>) = 3 [pid 5775] <... futex resumed>) = 1 [pid 5772] <... futex resumed>) = 0 [pid 5077] <... mkdir resumed>) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5776] write(3, "1000", 4 [pid 5775] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5774] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5772] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5775] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5772] <... futex resumed>) = 0 [pid 5075] openat(AT_FDCWD, "./69", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5776] <... write resumed>) = 4 [pid 5775] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5774] <... futex resumed>) = 0 [pid 5772] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5776] close(3 [pid 5774] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5075] <... openat resumed>) = 3 [pid 5776] <... close resumed>) = 0 [pid 5774] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5776] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5775] <... bpf resumed>) = 6 [pid 5075] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5774] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5776] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5774] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] getdents64(3, ./strace-static-x86_64: Process 5777 attached [pid 5776] <... futex resumed>) = 0 [pid 5775] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5774] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5777] set_robust_list(0x55555d6c46a0, 24 [pid 5776] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5775] <... futex resumed>) = 1 [pid 5774] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5772] <... futex resumed>) = 0 [pid 5075] umount2("./69/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5777] <... set_robust_list resumed>) = 0 [pid 5776] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5775] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5772] exit_group(0 [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5777 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5777] chdir("./70" [pid 5776] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5775] <... futex resumed>) = ? [pid 5772] <... exit_group resumed>) = ? [pid 5075] newfstatat(AT_FDCWD, "./69/binderfs", [pid 5777] <... chdir resumed>) = 0 [pid 5776] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5775] +++ exited with 0 +++ [pid 5774] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5772] +++ exited with 0 +++ [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5777] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5772, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5777] <... prctl resumed>) = 0 [pid 5075] unlink("./69/binderfs" [pid 5074] restart_syscall(<... resuming interrupted clone ...> [pid 5777] setpgid(0, 0 [pid 5075] <... unlink resumed>) = 0 [pid 5074] <... restart_syscall resumed>) = 0 [pid 5777] <... setpgid resumed>) = 0 [pid 5777] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5776] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5074] umount2("./67", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5774] <... mprotect resumed>) = 0 [pid 5777] <... openat resumed>) = 3 [pid 5075] getdents64(3, [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] openat(AT_FDCWD, "./67", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5776] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5774] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5074] <... openat resumed>) = 3 [pid 5777] write(3, "1000", 4 [pid 5776] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5774] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5075] close(3 [pid 5074] newfstatat(3, "", [pid 5777] <... write resumed>) = 4 [pid 5776] <... mprotect resumed>) = 0 [pid 5774] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5075] <... close resumed>) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 ./strace-static-x86_64: Process 5778 attached [pid 5777] close(3 [pid 5075] rmdir("./69" [pid 5074] getdents64(3, [pid 5778] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5777] <... close resumed>) = 0 [pid 5776] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5774] <... clone3 resumed> => {parent_tid=[5778]}, 88) = 5778 [pid 5075] <... rmdir resumed>) = 0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5778] <... rseq resumed>) = 0 [pid 5777] symlink("/dev/binderfs", "./binderfs" [pid 5774] rt_sigprocmask(SIG_SETMASK, [], [pid 5777] <... symlink resumed>) = 0 [pid 5776] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5774] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5778] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5777] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] mkdir("./70", 0777 [pid 5074] umount2("./67/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5778] <... set_robust_list resumed>) = 0 [pid 5776] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5774] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5778] rt_sigprocmask(SIG_SETMASK, [], [pid 5777] <... futex resumed>) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5779 attached [pid 5778] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5777] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5774] <... futex resumed>) = 0 [pid 5074] newfstatat(AT_FDCWD, "./67/binderfs", [pid 5779] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5778] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5777] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5776] <... clone3 resumed> => {parent_tid=[5779]}, 88) = 5779 [pid 5774] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] <... mkdir resumed>) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5779] <... rseq resumed>) = 0 [pid 5778] <... bpf resumed>) = 3 [pid 5777] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5776] rt_sigprocmask(SIG_SETMASK, [], [pid 5074] unlink("./67/binderfs" [pid 5779] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5778] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5777] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5776] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5779] <... set_robust_list resumed>) = 0 [pid 5778] <... futex resumed>) = 1 [pid 5777] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5776] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5774] <... futex resumed>) = 0 [pid 5074] <... unlink resumed>) = 0 [pid 5779] rt_sigprocmask(SIG_SETMASK, [], [pid 5778] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5777] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5776] <... futex resumed>) = 0 [pid 5774] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5780 attached [pid 5779] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5778] <... bpf resumed>) = 4 [pid 5777] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5776] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] getdents64(3, [pid 5780] set_robust_list(0x55555d6c46a0, 24 [pid 5778] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5777] <... mprotect resumed>) = 0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5780] <... set_robust_list resumed>) = 0 [pid 5778] <... futex resumed>) = 0 [pid 5780] chdir("./70" [pid 5779] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5778] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5777] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5774] <... futex resumed>) = 0 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5780 [pid 5074] close(3 [pid 5780] <... chdir resumed>) = 0 [pid 5779] <... bpf resumed>) = 3 [pid 5774] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5780] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5779] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5777] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5774] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5074] <... close resumed>) = 0 [pid 5780] <... prctl resumed>) = 0 [pid 5779] <... futex resumed>) = 1 [pid 5777] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5776] <... futex resumed>) = 0 [pid 5774] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] rmdir("./67"./strace-static-x86_64: Process 5781 attached [pid 5780] setpgid(0, 0 [pid 5776] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5781] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5780] <... setpgid resumed>) = 0 [pid 5779] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5778] <... futex resumed>) = 0 [pid 5777] <... clone3 resumed> => {parent_tid=[5781]}, 88) = 5781 [pid 5776] <... futex resumed>) = 0 [pid 5774] <... futex resumed>) = 1 [pid 5074] <... rmdir resumed>) = 0 [pid 5781] <... rseq resumed>) = 0 [pid 5780] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5778] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5777] rt_sigprocmask(SIG_SETMASK, [], [pid 5781] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5780] <... openat resumed>) = 3 [pid 5779] <... bpf resumed>) = 4 [pid 5778] <... bpf resumed>) = 5 [pid 5777] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5776] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5774] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] mkdir("./68", 0777 [pid 5781] <... set_robust_list resumed>) = 0 [pid 5781] rt_sigprocmask(SIG_SETMASK, [], [pid 5780] write(3, "1000", 4 [pid 5777] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5779] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] <... mkdir resumed>) = 0 [pid 5781] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5780] <... write resumed>) = 4 [pid 5777] <... futex resumed>) = 0 [pid 5781] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5780] close(3 [pid 5778] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5777] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5781] <... bpf resumed>) = 3 [pid 5780] <... close resumed>) = 0 [pid 5779] <... futex resumed>) = 1 [pid 5778] <... futex resumed>) = 1 [pid 5776] <... futex resumed>) = 0 [pid 5774] <... futex resumed>) = 0 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5781] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5780] symlink("/dev/binderfs", "./binderfs" [pid 5779] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5778] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5776] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5774] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5781] <... futex resumed>) = 1 [pid 5780] <... symlink resumed>) = 0 [pid 5778] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5777] <... futex resumed>) = 0 [pid 5776] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5782 attached [pid 5781] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5780] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5778] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5777] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5776] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5774] <... futex resumed>) = 0 [pid 5781] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5780] <... futex resumed>) = 0 [pid 5779] <... bpf resumed>) = 5 [pid 5778] <... bpf resumed>) = 6 [pid 5777] <... futex resumed>) = 0 [pid 5774] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5782 [pid 5782] set_robust_list(0x55555d6c46a0, 24 [pid 5781] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5782] <... set_robust_list resumed>) = 0 [pid 5780] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5779] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5778] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5777] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5774] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5782] chdir("./68" [pid 5781] <... bpf resumed>) = 4 [pid 5780] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5778] <... futex resumed>) = 0 [pid 5774] exit_group(0 [pid 5782] <... chdir resumed>) = 0 [pid 5779] <... futex resumed>) = 1 [pid 5776] <... futex resumed>) = 0 [pid 5776] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5778] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5780] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5780] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5781] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5780] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5781] <... futex resumed>) = 1 [pid 5781] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5780] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5776] <... futex resumed>) = 0 [pid 5782] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5779] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5782] <... prctl resumed>) = 0 [pid 5776] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5774] <... exit_group resumed>) = ? [pid 5782] setpgid(0, 0 [pid 5780] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5778] <... futex resumed>) = ? [pid 5777] <... futex resumed>) = 0 [pid 5782] <... setpgid resumed>) = 0 [pid 5779] <... bpf resumed>) = 6 [pid 5777] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5781] <... futex resumed>) = 0 [pid 5779] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5777] <... futex resumed>) = 1 [pid 5782] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5781] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5782] <... openat resumed>) = 3 [pid 5781] <... bpf resumed>) = 5 [pid 5780] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5779] <... futex resumed>) = 1 [pid 5777] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5776] <... futex resumed>) = 0 [pid 5782] write(3, "1000", 4 [pid 5781] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5780] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5779] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5777] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5776] exit_group(0./strace-static-x86_64: Process 5783 attached [pid 5782] <... write resumed>) = 4 [pid 5781] <... futex resumed>) = 0 [pid 5779] <... futex resumed>) = ? [pid 5777] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5776] <... exit_group resumed>) = ? [pid 5781] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5780] <... clone3 resumed> => {parent_tid=[5783]}, 88) = 5783 [pid 5779] +++ exited with 0 +++ [pid 5777] <... futex resumed>) = 0 [pid 5780] rt_sigprocmask(SIG_SETMASK, [], [pid 5777] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5783] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5782] close(3 [pid 5780] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5783] <... rseq resumed>) = 0 [pid 5782] <... close resumed>) = 0 [pid 5780] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5780] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5783] set_robust_list(0x7f3e2f60d9a0, 24) = 0 [pid 5783] rt_sigprocmask(SIG_SETMASK, [], [pid 5782] symlink("/dev/binderfs", "./binderfs" [pid 5781] <... bpf resumed>) = 6 [pid 5778] +++ exited with 0 +++ [pid 5774] +++ exited with 0 +++ [pid 5783] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5781] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5783] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5782] <... symlink resumed>) = 0 [pid 5781] <... futex resumed>) = 1 [pid 5777] <... futex resumed>) = 0 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5774, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5783] <... bpf resumed>) = 3 [pid 5782] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5781] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5777] exit_group(0 [pid 5078] restart_syscall(<... resuming interrupted clone ...> [pid 5783] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5782] <... futex resumed>) = 0 [pid 5781] <... futex resumed>) = ? [pid 5777] <... exit_group resumed>) = ? [pid 5078] <... restart_syscall resumed>) = 0 [pid 5782] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5783] <... futex resumed>) = 1 [pid 5780] <... futex resumed>) = 0 [pid 5783] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5780] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5783] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5782] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5780] <... futex resumed>) = 0 [pid 5078] umount2("./72", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5783] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5782] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5780] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5783] <... bpf resumed>) = 4 [pid 5782] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5776] +++ exited with 0 +++ [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5776, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5782] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5078] openat(AT_FDCWD, "./72", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5783] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5782] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5781] +++ exited with 0 +++ [pid 5777] +++ exited with 0 +++ [pid 5078] <... openat resumed>) = 3 [pid 5783] <... futex resumed>) = 1 [pid 5780] <... futex resumed>) = 0 [pid 5782] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5783] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5078] newfstatat(3, "", [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5777, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5780] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] umount2("./70", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5783] <... futex resumed>) = 0 [pid 5782] <... mprotect resumed>) = 0 [pid 5780] <... futex resumed>) = 1 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5078] getdents64(3, [pid 5783] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5780] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] openat(AT_FDCWD, "./70", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5783] <... bpf resumed>) = 5 [pid 5782] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5077] <... openat resumed>) = 3 [pid 5077] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5078] umount2("./72/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] umount2("./68", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5782] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5782] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] openat(AT_FDCWD, "./68", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY./strace-static-x86_64: Process 5784 attached [pid 5783] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] newfstatat(AT_FDCWD, "./72/binderfs", [pid 5077] getdents64(3, [pid 5784] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5783] <... futex resumed>) = 1 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5784] <... rseq resumed>) = 0 [pid 5783] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5782] <... clone3 resumed> => {parent_tid=[5784]}, 88) = 5784 [pid 5780] <... futex resumed>) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5077] umount2("./70/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5076] <... openat resumed>) = 3 [pid 5784] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5782] rt_sigprocmask(SIG_SETMASK, [], [pid 5780] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] unlink("./72/binderfs" [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5076] newfstatat(3, "", [pid 5784] <... set_robust_list resumed>) = 0 [pid 5783] <... futex resumed>) = 0 [pid 5782] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5780] <... futex resumed>) = 1 [pid 5077] newfstatat(AT_FDCWD, "./70/binderfs", [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5784] rt_sigprocmask(SIG_SETMASK, [], [pid 5783] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5782] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5780] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] <... unlink resumed>) = 0 [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5076] getdents64(3, [pid 5784] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5782] <... futex resumed>) = 0 [pid 5784] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5782] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] getdents64(3, [pid 5077] unlink("./70/binderfs" [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5784] <... bpf resumed>) = 3 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5077] <... unlink resumed>) = 0 [pid 5076] umount2("./68/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5784] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] close(3 [pid 5784] <... futex resumed>) = 1 [pid 5078] <... close resumed>) = 0 [pid 5784] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5782] <... futex resumed>) = 0 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5782] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] rmdir("./72" [pid 5077] getdents64(3, [pid 5076] newfstatat(AT_FDCWD, "./68/binderfs", [pid 5784] <... futex resumed>) = 0 [pid 5782] <... futex resumed>) = 1 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5784] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5077] close(3 [pid 5784] <... bpf resumed>) = 4 [pid 5783] <... bpf resumed>) = 6 [pid 5782] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... rmdir resumed>) = 0 [pid 5077] <... close resumed>) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5783] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5784] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5783] <... futex resumed>) = 1 [pid 5077] rmdir("./70" [pid 5784] <... futex resumed>) = 0 [pid 5783] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5782] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5780] <... futex resumed>) = 0 [pid 5077] <... rmdir resumed>) = 0 [pid 5078] mkdir("./73", 0777 [pid 5076] unlink("./68/binderfs" [pid 5784] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5782] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5780] exit_group(0 [pid 5782] <... futex resumed>) = 0 [pid 5783] <... futex resumed>) = ? [pid 5780] <... exit_group resumed>) = ? [pid 5782] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5783] +++ exited with 0 +++ [pid 5784] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5077] mkdir("./71", 0777 [pid 5784] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5077] <... mkdir resumed>) = 0 [pid 5784] <... bpf resumed>) = 5 [pid 5780] +++ exited with 0 +++ [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5078] <... mkdir resumed>) = 0 [pid 5784] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5785 attached ) = 1 [pid 5782] <... futex resumed>) = 0 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5076] <... unlink resumed>) = 0 [pid 5785] set_robust_list(0x55555d6c46a0, 24 [pid 5784] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5782] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5785 [pid 5076] getdents64(3, [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5780, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5785] <... set_robust_list resumed>) = 0 [pid 5784] <... bpf resumed>) = 6 [pid 5782] <... futex resumed>) = 0 [pid 5785] chdir("./71") = 0 [pid 5784] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5785] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5784] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5785] <... prctl resumed>) = 0 [pid 5785] setpgid(0, 0 [pid 5782] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000}./strace-static-x86_64: Process 5786 attached [pid 5785] <... setpgid resumed>) = 0 [pid 5782] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5075] umount2("./70", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5786] set_robust_list(0x55555d6c46a0, 24 [pid 5785] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5782] exit_group(0 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5786 [pid 5786] <... set_robust_list resumed>) = 0 [pid 5782] <... exit_group resumed>) = ? [pid 5076] close(3 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5784] <... futex resumed>) = ? [pid 5786] chdir("./73" [pid 5785] <... openat resumed>) = 3 [pid 5784] +++ exited with 0 +++ [pid 5076] <... close resumed>) = 0 [pid 5786] <... chdir resumed>) = 0 [pid 5786] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5785] write(3, "1000", 4 [pid 5786] <... prctl resumed>) = 0 [pid 5785] <... write resumed>) = 4 [pid 5786] setpgid(0, 0 [pid 5785] close(3 [pid 5786] <... setpgid resumed>) = 0 [pid 5785] <... close resumed>) = 0 [pid 5786] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5782] +++ exited with 0 +++ [pid 5075] openat(AT_FDCWD, "./70", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5785] symlink("/dev/binderfs", "./binderfs" [pid 5786] <... openat resumed>) = 3 [pid 5785] <... symlink resumed>) = 0 [pid 5076] rmdir("./68" [pid 5075] <... openat resumed>) = 3 [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5782, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5786] write(3, "1000", 4 [pid 5785] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5786] <... write resumed>) = 4 [pid 5785] <... futex resumed>) = 0 [pid 5076] <... rmdir resumed>) = 0 [pid 5075] newfstatat(3, "", [pid 5786] close(3 [pid 5785] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5074] umount2("./68", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5786] <... close resumed>) = 0 [pid 5785] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5786] symlink("/dev/binderfs", "./binderfs" [pid 5785] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5786] <... symlink resumed>) = 0 [pid 5785] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5076] mkdir("./69", 0777 [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5074] openat(AT_FDCWD, "./68", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5785] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5074] <... openat resumed>) = 3 [pid 5786] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5785] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5076] <... mkdir resumed>) = 0 [pid 5075] getdents64(3, [pid 5786] <... futex resumed>) = 0 [pid 5074] newfstatat(3, "", [pid 5786] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5785] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5786] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5785] <... mprotect resumed>) = 0 [pid 5075] umount2("./70/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5786] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5785] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] getdents64(3, [pid 5786] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5786] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5786] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5785] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5075] newfstatat(AT_FDCWD, "./70/binderfs", ./strace-static-x86_64: Process 5787 attached [pid 5786] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5785] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5074] umount2("./68/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5787] set_robust_list(0x55555d6c46a0, 24 [pid 5786] <... mprotect resumed>) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 ./strace-static-x86_64: Process 5788 attached [pid 5787] <... set_robust_list resumed>) = 0 [pid 5786] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5785] <... clone3 resumed> => {parent_tid=[5788]}, 88) = 5788 [pid 5075] unlink("./70/binderfs" [pid 5074] newfstatat(AT_FDCWD, "./68/binderfs", [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5787 [pid 5787] chdir("./69" [pid 5788] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5785] rt_sigprocmask(SIG_SETMASK, [], [pid 5075] <... unlink resumed>) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5788] <... rseq resumed>) = 0 [pid 5787] <... chdir resumed>) = 0 [pid 5786] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5785] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5788] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5787] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5786] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5785] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] getdents64(3, [pid 5074] unlink("./68/binderfs"./strace-static-x86_64: Process 5789 attached [pid 5788] <... set_robust_list resumed>) = 0 [pid 5787] <... prctl resumed>) = 0 [pid 5785] <... futex resumed>) = 0 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5789] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5788] rt_sigprocmask(SIG_SETMASK, [], [pid 5789] <... rseq resumed>) = 0 [pid 5788] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] close(3 [pid 5789] set_robust_list(0x7f3e2f60d9a0, 24) = 0 [pid 5788] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5787] setpgid(0, 0 [pid 5786] <... clone3 resumed> => {parent_tid=[5789]}, 88) = 5789 [pid 5785] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] <... close resumed>) = 0 [pid 5074] <... unlink resumed>) = 0 [pid 5789] rt_sigprocmask(SIG_SETMASK, [], [pid 5788] <... bpf resumed>) = 3 [pid 5787] <... setpgid resumed>) = 0 [pid 5789] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5788] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] rmdir("./70" [pid 5789] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5788] <... futex resumed>) = 0 [pid 5075] <... rmdir resumed>) = 0 [pid 5788] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5787] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5786] rt_sigprocmask(SIG_SETMASK, [], [pid 5785] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5074] getdents64(3, [pid 5787] <... openat resumed>) = 3 [pid 5786] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5785] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] mkdir("./71", 0777 [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5788] <... futex resumed>) = 0 [pid 5787] write(3, "1000", 4 [pid 5786] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5785] <... futex resumed>) = 1 [pid 5074] close(3 [pid 5789] <... futex resumed>) = 0 [pid 5788] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5787] <... write resumed>) = 4 [pid 5786] <... futex resumed>) = 1 [pid 5785] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] <... close resumed>) = 0 [pid 5789] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5787] close(3 [pid 5786] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5788] <... bpf resumed>) = 4 [pid 5074] rmdir("./68" [pid 5787] <... close resumed>) = 0 [pid 5075] <... mkdir resumed>) = 0 [pid 5074] <... rmdir resumed>) = 0 [pid 5789] <... bpf resumed>) = 3 [pid 5788] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5787] symlink("/dev/binderfs", "./binderfs" [pid 5074] mkdir("./69", 0777 [pid 5789] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5788] <... futex resumed>) = 1 [pid 5787] <... symlink resumed>) = 0 [pid 5785] <... futex resumed>) = 0 [pid 5074] <... mkdir resumed>) = 0 [pid 5789] <... futex resumed>) = 1 [pid 5788] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5787] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5786] <... futex resumed>) = 0 [pid 5785] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5787] <... futex resumed>) = 0 [pid 5786] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5785] <... futex resumed>) = 0 [pid 5787] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5786] <... futex resumed>) = 0 [pid 5785] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5792 attached ./strace-static-x86_64: Process 5793 attached [pid 5789] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5788] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5787] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5786] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5792] set_robust_list(0x55555d6c46a0, 24 [pid 5793] set_robust_list(0x55555d6c46a0, 24 [pid 5789] <... bpf resumed>) = 4 [pid 5788] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5787] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5792] <... set_robust_list resumed>) = 0 [pid 5793] <... set_robust_list resumed>) = 0 [pid 5789] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5787] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5793 [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5792 [pid 5792] chdir("./69" [pid 5793] chdir("./71" [pid 5789] <... futex resumed>) = 1 [pid 5788] <... bpf resumed>) = 5 [pid 5787] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5786] <... futex resumed>) = 0 [pid 5792] <... chdir resumed>) = 0 [pid 5789] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5788] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5787] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5786] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5792] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5793] <... chdir resumed>) = 0 [pid 5789] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5788] <... futex resumed>) = 1 [pid 5787] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5786] <... futex resumed>) = 0 [pid 5785] <... futex resumed>) = 0 [pid 5792] <... prctl resumed>) = 0 [pid 5793] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5789] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5788] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5787] <... mprotect resumed>) = 0 [pid 5786] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5785] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5792] setpgid(0, 0 [pid 5793] <... prctl resumed>) = 0 [pid 5787] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5785] <... futex resumed>) = 0 [pid 5792] <... setpgid resumed>) = 0 [pid 5793] setpgid(0, 0 [pid 5788] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5785] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5793] <... setpgid resumed>) = 0 [pid 5788] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5787] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5792] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5793] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5789] <... bpf resumed>) = 5 [pid 5787] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5788] <... bpf resumed>) = 6 [pid 5792] <... openat resumed>) = 3 [pid 5793] <... openat resumed>) = 3 ./strace-static-x86_64: Process 5794 attached [pid 5792] write(3, "1000", 4 [pid 5793] write(3, "1000", 4 [pid 5789] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5788] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5794] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5792] <... write resumed>) = 4 [pid 5793] <... write resumed>) = 4 [pid 5789] <... futex resumed>) = 1 [pid 5788] <... futex resumed>) = 1 [pid 5787] <... clone3 resumed> => {parent_tid=[5794]}, 88) = 5794 [pid 5786] <... futex resumed>) = 0 [pid 5785] <... futex resumed>) = 0 [pid 5794] <... rseq resumed>) = 0 [pid 5792] close(3 [pid 5793] close(3 [pid 5789] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [ 92.794738][ T8] cfg80211: failed to load regulatory.db [pid 5788] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5787] rt_sigprocmask(SIG_SETMASK, [], [pid 5786] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5785] exit_group(0 [pid 5794] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5792] <... close resumed>) = 0 [pid 5793] <... close resumed>) = 0 [pid 5789] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5788] <... futex resumed>) = ? [pid 5787] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5786] <... futex resumed>) = 0 [pid 5785] <... exit_group resumed>) = ? [pid 5794] <... set_robust_list resumed>) = 0 [pid 5792] symlink("/dev/binderfs", "./binderfs" [pid 5793] symlink("/dev/binderfs", "./binderfs" [pid 5789] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5788] +++ exited with 0 +++ [pid 5787] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5794] rt_sigprocmask(SIG_SETMASK, [], [pid 5793] <... symlink resumed>) = 0 [pid 5787] <... futex resumed>) = 0 [pid 5794] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5792] <... symlink resumed>) = 0 [pid 5786] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5794] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5793] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5787] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5794] <... bpf resumed>) = 3 [pid 5792] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5793] <... futex resumed>) = 0 [pid 5789] <... bpf resumed>) = 6 [pid 5794] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5792] <... futex resumed>) = 0 [pid 5793] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5789] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5794] <... futex resumed>) = 1 [pid 5792] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5793] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5787] <... futex resumed>) = 0 [pid 5794] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5792] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5793] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5789] <... futex resumed>) = 1 [pid 5787] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5786] <... futex resumed>) = 0 [pid 5794] <... bpf resumed>) = 4 [pid 5792] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5793] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5789] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5787] <... futex resumed>) = 0 [pid 5786] exit_group(0 [pid 5794] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5792] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5793] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5789] <... futex resumed>) = ? [pid 5787] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5786] <... exit_group resumed>) = ? [pid 5794] <... futex resumed>) = 0 [pid 5792] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5793] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5789] +++ exited with 0 +++ [pid 5787] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5794] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5793] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5787] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5794] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5787] <... futex resumed>) = 0 [pid 5794] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5793] <... mprotect resumed>) = 0 [pid 5787] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5794] <... bpf resumed>) = 5 [pid 5792] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5793] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5792] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5794] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5792] <... mprotect resumed>) = 0 [pid 5793] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5787] <... futex resumed>) = 0 [pid 5794] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5793] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5787] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5792] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5794] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5787] <... futex resumed>) = 0 [pid 5792] <... rt_sigprocmask resumed>[], 8) = 0 ./strace-static-x86_64: Process 5795 attached [pid 5794] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5787] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5792] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5793] <... clone3 resumed> => {parent_tid=[5795]}, 88) = 5795 [pid 5793] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5793] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5793] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5796 attached [pid 5795] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5786] +++ exited with 0 +++ [pid 5785] +++ exited with 0 +++ [pid 5796] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5795] <... rseq resumed>) = 0 [pid 5792] <... clone3 resumed> => {parent_tid=[5796]}, 88) = 5796 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5786, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5785, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5795] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5792] rt_sigprocmask(SIG_SETMASK, [], [pid 5796] <... rseq resumed>) = 0 [pid 5795] <... set_robust_list resumed>) = 0 [pid 5792] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5796] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5795] rt_sigprocmask(SIG_SETMASK, [], [pid 5792] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] umount2("./73", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5077] umount2("./71", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5796] <... set_robust_list resumed>) = 0 [pid 5795] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5792] <... futex resumed>) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5796] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5795] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5792] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] openat(AT_FDCWD, "./73", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5796] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5795] <... bpf resumed>) = 3 [pid 5078] <... openat resumed>) = 3 [pid 5077] openat(AT_FDCWD, "./71", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5796] <... bpf resumed>) = 3 [pid 5795] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] newfstatat(3, "", [pid 5077] <... openat resumed>) = 3 [pid 5796] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5795] <... futex resumed>) = 1 [pid 5793] <... futex resumed>) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5077] newfstatat(3, "", [pid 5796] <... futex resumed>) = 1 [pid 5795] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5792] <... futex resumed>) = 0 [pid 5793] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] getdents64(3, [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5796] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5795] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5792] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5793] <... futex resumed>) = 0 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5077] getdents64(3, [pid 5796] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5795] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5792] <... futex resumed>) = 0 [pid 5793] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] umount2("./73/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5796] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5795] <... bpf resumed>) = 4 [pid 5792] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5796] <... bpf resumed>) = 4 [pid 5795] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] newfstatat(AT_FDCWD, "./73/binderfs", [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5796] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5795] <... futex resumed>) = 1 [pid 5793] <... futex resumed>) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5077] umount2("./71/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5796] <... futex resumed>) = 1 [pid 5795] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5792] <... futex resumed>) = 0 [pid 5793] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] unlink("./73/binderfs" [pid 5796] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5795] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5792] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5793] <... futex resumed>) = 0 [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5796] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5795] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5792] <... futex resumed>) = 0 [pid 5793] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... unlink resumed>) = 0 [pid 5077] newfstatat(AT_FDCWD, "./71/binderfs", [pid 5796] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5794] <... bpf resumed>) = 6 [pid 5792] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5795] <... bpf resumed>) = 5 [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5078] getdents64(3, 0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5078] close(3 [pid 5796] <... bpf resumed>) = 5 [pid 5795] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5794] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... close resumed>) = 0 [pid 5077] unlink("./71/binderfs" [pid 5078] rmdir("./73" [pid 5796] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5795] <... futex resumed>) = 1 [pid 5794] <... futex resumed>) = 1 [pid 5793] <... futex resumed>) = 0 [pid 5077] <... unlink resumed>) = 0 [pid 5795] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5794] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5792] <... futex resumed>) = 0 [pid 5793] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5787] <... futex resumed>) = 0 [pid 5077] getdents64(3, [pid 5796] <... futex resumed>) = 1 [pid 5796] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5795] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5792] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5795] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5792] <... futex resumed>) = 0 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5795] <... bpf resumed>) = 6 [pid 5792] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5793] <... futex resumed>) = 0 [pid 5787] exit_group(0 [pid 5078] <... rmdir resumed>) = 0 [pid 5077] close(3 [pid 5796] <... bpf resumed>) = 6 [pid 5795] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5794] <... futex resumed>) = ? [pid 5793] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5787] <... exit_group resumed>) = ? [pid 5078] mkdir("./74", 0777 [pid 5077] <... close resumed>) = 0 [pid 5796] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5795] <... futex resumed>) = 0 [pid 5794] +++ exited with 0 +++ [pid 5793] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5787] +++ exited with 0 +++ [pid 5078] <... mkdir resumed>) = 0 [pid 5796] <... futex resumed>) = 1 [pid 5795] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5792] <... futex resumed>) = 0 [pid 5793] exit_group(0 [pid 5077] rmdir("./71" [pid 5796] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5795] <... futex resumed>) = ? [pid 5792] exit_group(0 [pid 5793] <... exit_group resumed>) = ? [pid 5796] <... futex resumed>) = ? [pid 5795] +++ exited with 0 +++ [pid 5792] <... exit_group resumed>) = ? [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5077] <... rmdir resumed>) = 0 [pid 5077] mkdir("./72", 0777 [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5787, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- ./strace-static-x86_64: Process 5797 attached [pid 5077] <... mkdir resumed>) = 0 [pid 5076] umount2("./69", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5076] openat(AT_FDCWD, "./69", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5797] set_robust_list(0x55555d6c46a0, 24) = 0 [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5076] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5076] getdents64(3, 0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5078] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5797 ./strace-static-x86_64: Process 5798 attached [pid 5797] chdir("./74" [pid 5796] +++ exited with 0 +++ [pid 5792] +++ exited with 0 +++ [pid 5793] +++ exited with 0 +++ [pid 5076] umount2("./69/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5798] set_robust_list(0x55555d6c46a0, 24 [pid 5075] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5793, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5798] <... set_robust_list resumed>) = 0 [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5792, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5798] chdir("./72" [pid 5797] <... chdir resumed>) = 0 [pid 5077] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5798 [pid 5076] newfstatat(AT_FDCWD, "./69/binderfs", [pid 5798] <... chdir resumed>) = 0 [pid 5797] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5798] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5797] <... prctl resumed>) = 0 [pid 5076] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5798] <... prctl resumed>) = 0 [pid 5797] setpgid(0, 0 [pid 5076] unlink("./69/binderfs" [pid 5798] setpgid(0, 0 [pid 5797] <... setpgid resumed>) = 0 [pid 5798] <... setpgid resumed>) = 0 [pid 5797] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5076] <... unlink resumed>) = 0 [pid 5075] umount2("./71", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5798] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5797] <... openat resumed>) = 3 [pid 5076] getdents64(3, [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] umount2("./69", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5075] openat(AT_FDCWD, "./71", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5798] write(3, "1000", 4 [pid 5076] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5798] <... write resumed>) = 4 [pid 5797] write(3, "1000", 4 [pid 5076] close(3 [pid 5075] <... openat resumed>) = 3 [pid 5074] openat(AT_FDCWD, "./69", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5798] close(3 [pid 5797] <... write resumed>) = 4 [pid 5076] <... close resumed>) = 0 [pid 5798] <... close resumed>) = 0 [pid 5797] close(3 [pid 5076] rmdir("./69" [pid 5075] newfstatat(3, "", [pid 5074] <... openat resumed>) = 3 [pid 5798] symlink("/dev/binderfs", "./binderfs" [pid 5075] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5797] <... close resumed>) = 0 [pid 5076] <... rmdir resumed>) = 0 [pid 5074] newfstatat(3, "", [pid 5797] symlink("/dev/binderfs", "./binderfs" [pid 5798] <... symlink resumed>) = 0 [pid 5074] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5797] <... symlink resumed>) = 0 [pid 5075] getdents64(3, [pid 5798] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5797] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5076] mkdir("./70", 0777 [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5074] getdents64(3, [pid 5798] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5797] <... futex resumed>) = 0 [pid 5076] <... mkdir resumed>) = 0 [pid 5075] umount2("./71/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5798] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5797] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5798] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5074] umount2("./69/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5798] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5797] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5074] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5798] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5797] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5074] newfstatat(AT_FDCWD, "./69/binderfs", [pid 5798] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5797] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5074] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 ./strace-static-x86_64: Process 5799 attached [pid 5798] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5797] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5798] <... mprotect resumed>) = 0 [pid 5799] set_robust_list(0x55555d6c46a0, 24 [pid 5798] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5797] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5076] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5799 [pid 5075] newfstatat(AT_FDCWD, "./71/binderfs", [pid 5074] unlink("./69/binderfs" [pid 5799] <... set_robust_list resumed>) = 0 [pid 5797] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5075] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] <... unlink resumed>) = 0 [pid 5799] chdir("./70" [pid 5798] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5797] <... mprotect resumed>) = 0 [pid 5075] unlink("./71/binderfs" [pid 5799] <... chdir resumed>) = 0 [pid 5797] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5075] <... unlink resumed>) = 0 [pid 5799] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5798] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5074] getdents64(3, [pid 5799] <... prctl resumed>) = 0 [pid 5797] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5075] getdents64(3, [pid 5074] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5799] setpgid(0, 0 [pid 5798] <... clone3 resumed> => {parent_tid=[5800]}, 88) = 5800 [pid 5797] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5075] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5074] close(3./strace-static-x86_64: Process 5800 attached [pid 5799] <... setpgid resumed>) = 0 [pid 5798] rt_sigprocmask(SIG_SETMASK, [], ./strace-static-x86_64: Process 5801 attached [pid 5800] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5799] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5075] close(3 [pid 5074] <... close resumed>) = 0 [pid 5801] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5800] <... rseq resumed>) = 0 [pid 5801] <... rseq resumed>) = 0 [pid 5800] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5799] <... openat resumed>) = 3 [pid 5798] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5797] <... clone3 resumed> => {parent_tid=[5801]}, 88) = 5801 [pid 5075] <... close resumed>) = 0 [pid 5074] rmdir("./69" [pid 5801] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5800] <... set_robust_list resumed>) = 0 [pid 5799] write(3, "1000", 4 [pid 5798] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5797] rt_sigprocmask(SIG_SETMASK, [], [pid 5075] rmdir("./71" [pid 5074] <... rmdir resumed>) = 0 [pid 5801] <... set_robust_list resumed>) = 0 [pid 5800] rt_sigprocmask(SIG_SETMASK, [], [pid 5799] <... write resumed>) = 4 [pid 5798] <... futex resumed>) = 0 [pid 5797] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] <... rmdir resumed>) = 0 [pid 5801] rt_sigprocmask(SIG_SETMASK, [], [pid 5800] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5799] close(3 [pid 5798] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5797] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5074] mkdir("./70", 0777 [pid 5801] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5800] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5797] <... futex resumed>) = 0 [pid 5799] <... close resumed>) = 0 [pid 5075] mkdir("./72", 0777 [pid 5074] <... mkdir resumed>) = 0 [pid 5801] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5800] <... bpf resumed>) = 3 [pid 5799] symlink("/dev/binderfs", "./binderfs" [pid 5797] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] <... mkdir resumed>) = 0 [pid 5801] <... bpf resumed>) = 3 [pid 5800] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5799] <... symlink resumed>) = 0 [pid 5074] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5800] <... futex resumed>) = 1 [pid 5801] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5800] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5798] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5802 attached [pid 5801] <... futex resumed>) = 1 [pid 5798] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5797] <... futex resumed>) = 0 [pid 5802] set_robust_list(0x55555d6c46a0, 24 [pid 5801] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5800] <... futex resumed>) = 0 [pid 5799] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5798] <... futex resumed>) = 1 [pid 5797] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5802] <... set_robust_list resumed>) = 0 [pid 5800] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5802] chdir("./70" [pid 5801] <... bpf resumed>) = 4 ./strace-static-x86_64: Process 5803 attached [pid 5802] <... chdir resumed>) = 0 [pid 5801] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5800] <... bpf resumed>) = 4 [pid 5799] <... futex resumed>) = 0 [pid 5798] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5797] <... futex resumed>) = 0 [pid 5799] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5797] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5799] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5797] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5074] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5802 [pid 5799] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5797] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... clone resumed>, child_tidptr=0x55555d6c4690) = 5803 [pid 5799] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5797] <... futex resumed>) = 0 [pid 5803] set_robust_list(0x55555d6c46a0, 24 [pid 5802] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5801] <... futex resumed>) = 0 [pid 5800] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5799] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5797] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5803] <... set_robust_list resumed>) = 0 [pid 5802] <... prctl resumed>) = 0 [pid 5801] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5800] <... futex resumed>) = 1 [pid 5799] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5798] <... futex resumed>) = 0 [pid 5803] chdir("./72" [pid 5802] setpgid(0, 0 [pid 5799] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5798] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5799] <... mprotect resumed>) = 0 [pid 5798] <... futex resumed>) = 0 [pid 5803] <... chdir resumed>) = 0 [pid 5802] <... setpgid resumed>) = 0 [pid 5801] <... bpf resumed>) = 5 [pid 5800] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5799] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5798] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5802] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5799] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5800] <... bpf resumed>) = 5 [pid 5799] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0}./strace-static-x86_64: Process 5804 attached [pid 5803] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5802] <... openat resumed>) = 3 [pid 5801] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5800] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5804] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5803] <... prctl resumed>) = 0 [pid 5802] write(3, "1000", 4 [pid 5801] <... futex resumed>) = 1 [pid 5800] <... futex resumed>) = 1 [pid 5798] <... futex resumed>) = 0 [pid 5803] setpgid(0, 0 [pid 5800] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5804] <... rseq resumed>) = 0 [pid 5803] <... setpgid resumed>) = 0 [pid 5802] <... write resumed>) = 4 [pid 5801] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5804] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5799] <... clone3 resumed> => {parent_tid=[5804]}, 88) = 5804 [pid 5803] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5798] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5797] <... futex resumed>) = 0 [pid 5802] close(3 [pid 5804] <... set_robust_list resumed>) = 0 [pid 5802] <... close resumed>) = 0 [pid 5800] <... futex resumed>) = 0 [pid 5804] rt_sigprocmask(SIG_SETMASK, [], [pid 5799] rt_sigprocmask(SIG_SETMASK, [], [pid 5798] <... futex resumed>) = 1 [pid 5797] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5804] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5803] <... openat resumed>) = 3 [pid 5802] symlink("/dev/binderfs", "./binderfs" [pid 5801] <... futex resumed>) = 0 [pid 5800] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5799] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5798] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5797] <... futex resumed>) = 1 [pid 5804] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5802] <... symlink resumed>) = 0 [pid 5801] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5800] <... bpf resumed>) = 6 [pid 5799] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5797] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5804] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5803] write(3, "1000", 4 [pid 5801] <... bpf resumed>) = 6 [pid 5800] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5799] <... futex resumed>) = 0 [pid 5803] <... write resumed>) = 4 [pid 5800] <... futex resumed>) = 1 [pid 5799] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5798] <... futex resumed>) = 0 [pid 5804] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5803] close(3 [pid 5802] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5801] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5800] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5798] exit_group(0 [pid 5800] <... futex resumed>) = ? [pid 5798] <... exit_group resumed>) = ? [pid 5804] <... bpf resumed>) = 3 [pid 5803] <... close resumed>) = 0 [pid 5802] <... futex resumed>) = 0 [pid 5801] <... futex resumed>) = 1 [pid 5800] +++ exited with 0 +++ [pid 5797] <... futex resumed>) = 0 [pid 5804] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5803] symlink("/dev/binderfs", "./binderfs" [pid 5802] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5801] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5797] exit_group(0 [pid 5801] <... futex resumed>) = ? [pid 5797] <... exit_group resumed>) = ? [pid 5804] <... futex resumed>) = 1 [pid 5803] <... symlink resumed>) = 0 [pid 5802] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5804] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5799] <... futex resumed>) = 0 [pid 5799] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5799] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5802] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5804] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5803] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5802] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5804] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5803] <... futex resumed>) = 0 [pid 5802] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5803] rt_sigaction(SIGRT_1, {sa_handler=0x7f3e2f679370, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3e2f66a4f0}, [pid 5804] <... bpf resumed>) = 4 [pid 5803] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5802] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5803] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5803] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5804] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5803] <... mmap resumed>) = 0x7f3e2f5ed000 [pid 5802] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5804] <... futex resumed>) = 1 [pid 5803] mprotect(0x7f3e2f5ee000, 131072, PROT_READ|PROT_WRITE [pid 5799] <... futex resumed>) = 0 [pid 5802] <... mprotect resumed>) = 0 [pid 5804] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5803] <... mprotect resumed>) = 0 [pid 5799] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5803] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5799] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5804] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5803] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5804] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5803] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5802] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5802] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f3e2f60d990, parent_tid=0x7f3e2f60d990, exit_signal=0, stack=0x7f3e2f5ed000, stack_size=0x20300, tls=0x7f3e2f60d6c0} [pid 5804] <... bpf resumed>) = 5 ./strace-static-x86_64: Process 5806 attached ./strace-static-x86_64: Process 5805 attached [pid 5806] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5802] <... clone3 resumed> => {parent_tid=[5806]}, 88) = 5806 [pid 5804] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5803] <... clone3 resumed> => {parent_tid=[5805]}, 88) = 5805 [pid 5806] <... rseq resumed>) = 0 [pid 5805] rseq(0x7f3e2f60dfe0, 0x20, 0, 0x53053053 [pid 5803] rt_sigprocmask(SIG_SETMASK, [], [pid 5798] +++ exited with 0 +++ [pid 5799] <... futex resumed>) = 0 [pid 5804] <... futex resumed>) = 1 [pid 5805] <... rseq resumed>) = 0 [pid 5804] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5803] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5799] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5806] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5805] set_robust_list(0x7f3e2f60d9a0, 24 [pid 5803] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5802] rt_sigprocmask(SIG_SETMASK, [], [pid 5801] +++ exited with 0 +++ [pid 5799] <... futex resumed>) = 0 [pid 5797] +++ exited with 0 +++ [pid 5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5798, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5806] <... set_robust_list resumed>) = 0 [pid 5805] <... set_robust_list resumed>) = 0 [pid 5803] <... futex resumed>) = 0 [pid 5802] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5799] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5806] rt_sigprocmask(SIG_SETMASK, [], [pid 5805] rt_sigprocmask(SIG_SETMASK, [], [pid 5803] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5802] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5797, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5806] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5805] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5802] <... futex resumed>) = 0 [pid 5078] umount2("./74", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5077] umount2("./72", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5806] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5805] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKHASH, key_size=5, value_size=8, max_entries=12, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5802] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5806] <... bpf resumed>) = 3 [pid 5805] <... bpf resumed>) = 3 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5077] openat(AT_FDCWD, "./72", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5806] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] openat(AT_FDCWD, "./74", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5806] <... futex resumed>) = 1 [pid 5805] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5804] <... bpf resumed>) = 6 [pid 5802] <... futex resumed>) = 0 [pid 5078] <... openat resumed>) = 3 [pid 5077] <... openat resumed>) = 3 [pid 5806] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5805] <... futex resumed>) = 1 [pid 5804] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5803] <... futex resumed>) = 0 [pid 5802] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] newfstatat(3, "", [pid 5806] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5805] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5804] <... futex resumed>) = 1 [pid 5803] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5802] <... futex resumed>) = 0 [pid 5799] <... futex resumed>) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5077] newfstatat(3, "", [pid 5806] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5805] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5804] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5803] <... futex resumed>) = 0 [pid 5802] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5799] exit_group(0 [pid 5078] getdents64(3, [pid 5077] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5806] <... bpf resumed>) = 4 [pid 5805] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=32768, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 5804] <... futex resumed>) = ? [pid 5803] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5799] <... exit_group resumed>) = ? [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5077] getdents64(3, [pid 5804] +++ exited with 0 +++ [pid 5806] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] umount2("./74/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 3 entries */, 32768) = 80 [pid 5806] <... futex resumed>) = 1 [pid 5802] <... futex resumed>) = 0 [pid 5078] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5077] umount2("./72/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5806] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5802] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] newfstatat(AT_FDCWD, "./74/binderfs", [pid 5077] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5806] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5802] <... futex resumed>) = 0 [pid 5078] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5806] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5802] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] newfstatat(AT_FDCWD, "./72/binderfs", [pid 5805] <... bpf resumed>) = 4 [pid 5806] <... bpf resumed>) = 5 [pid 5805] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5799] +++ exited with 0 +++ [pid 5078] unlink("./74/binderfs" [pid 5077] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5805] <... futex resumed>) = 1 [pid 5803] <... futex resumed>) = 0 [pid 5805] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5803] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... unlink resumed>) = 0 [pid 5077] unlink("./72/binderfs" [pid 5805] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5803] <... futex resumed>) = 0 [pid 5805] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=16, insns=0x20000280, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5803] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] getdents64(3, [pid 5077] <... unlink resumed>) = 0 [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5799, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5806] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5077] getdents64(3, [pid 5076] umount2("./70", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5806] <... futex resumed>) = 1 [pid 5802] <... futex resumed>) = 0 [pid 5078] close(3 [pid 5805] <... bpf resumed>) = 5 [pid 5077] <... getdents64 resumed>0x55555d6c5730 /* 0 entries */, 32768) = 0 [pid 5076] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5806] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5802] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... close resumed>) = 0 [pid 5077] close(3 [pid 5076] openat(AT_FDCWD, "./70", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5806] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5805] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5802] <... futex resumed>) = 0 [pid 5078] rmdir("./74" [pid 5077] <... close resumed>) = 0 [pid 5076] <... openat resumed>) = 3 [pid 5806] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5805] <... futex resumed>) = 1 [pid 5803] <... futex resumed>) = 0 [pid 5802] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5806] <... bpf resumed>) = 6 [pid 5805] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=5}}, 16 [pid 5803] futex(0x7f3e2f6dd3e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] rmdir("./72" [pid 5076] newfstatat(3, "", [pid 5806] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5805] <... bpf resumed>) = 6 [pid 5803] <... futex resumed>) = 0 [pid 5078] <... rmdir resumed>) = 0 [pid 5077] <... rmdir resumed>) = 0 [pid 5803] futex(0x7f3e2f6dd3ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=550000000} [pid 5078] mkdir("./75", 0777 [pid 5805] futex(0x7f3e2f6dd3ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5803] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5806] <... futex resumed>) = 1 [pid 5802] <... futex resumed>) = 0 [pid 5077] mkdir("./73", 0777 [pid 5076] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5078] <... mkdir resumed>) = 0 [pid 5806] futex(0x7f3e2f6dd3e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5805] <... futex resumed>) = 0 [pid 5803] exit_group(0 [pid 5802] exit_group(0 [pid 5077] <... mkdir resumed>) = 0 [pid 5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5076] getdents64(3, [pid 5806] <... futex resumed>) = ? [pid 5803] <... exit_group resumed>) = ? [pid 5802] <... exit_group resumed>) = ? [pid 5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [ 93.115689][ T5070] ================================================================== [ 93.124475][ T5070] BUG: KASAN: slab-use-after-free in bpf_trace_run2+0xfa/0x530 [ 93.132097][ T5070] Read of size 8 at addr ffff88807d7fa018 by task strace-static-x/5070 [ 93.140346][ T5070] [ 93.142675][ T5070] CPU: 0 PID: 5070 Comm: strace-static-x Not tainted 6.8.0-syzkaller-05243-g14bb1e8c8d4a #0 [ 93.152746][ T5070] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 93.162801][ T5070] Call Trace: [ 93.166086][ T5070] [ 93.169020][ T5070] dump_stack_lvl+0x1e7/0x2e0 [ 93.173726][ T5070] ? __pfx_dump_stack_lvl+0x10/0x10 [ 93.178937][ T5070] ? __pfx__printk+0x10/0x10 [ 93.183547][ T5070] ? _printk+0xd5/0x120 [ 93.187736][ T5070] ? __virt_addr_valid+0x183/0x520 [ 93.192858][ T5070] ? __virt_addr_valid+0x183/0x520 [ 93.198416][ T5070] print_report+0x169/0x550 [ 93.202945][ T5070] ? __virt_addr_valid+0x183/0x520 [ 93.208287][ T5070] ? __virt_addr_valid+0x183/0x520 [ 93.213582][ T5070] ? __virt_addr_valid+0x44e/0x520 [ 93.218882][ T5070] ? __phys_addr+0xba/0x170 [ 93.223578][ T5070] ? bpf_trace_run2+0xfa/0x530 [ 93.228349][ T5070] kasan_report+0x143/0x180 [ 93.232867][ T5070] ? bpf_trace_run2+0xfa/0x530 [ 93.237650][ T5070] bpf_trace_run2+0xfa/0x530 [ 93.242250][ T5070] ? __pfx_bpf_trace_run2+0x10/0x10 [ 93.247453][ T5070] ? __pfx___might_resched+0x10/0x10 [ 93.252830][ T5070] ? process_vm_rw+0xc3b/0xcf0 [ 93.257729][ T5070] ? process_vm_rw+0xc3b/0xcf0 [ 93.262541][ T5070] __traceiter_kfree+0x2b/0x50 [ 93.267322][ T5070] ? process_vm_rw+0xc3b/0xcf0 [ 93.272094][ T5070] kfree+0x291/0x380 [ 93.276086][ T5070] process_vm_rw+0xc3b/0xcf0 [ 93.280866][ T5070] ? __pfx_process_vm_rw+0x10/0x10 [ 93.285988][ T5070] ? bpf_lsm_file_permission+0x9/0x10 [ 93.291396][ T5070] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 93.297487][ T5070] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 93.304080][ T5070] __x64_sys_process_vm_readv+0xe0/0x100 [ 93.309733][ T5070] do_syscall_64+0xfb/0x240 [ 93.314348][ T5070] entry_SYSCALL_64_after_hwframe+0x6d/0x75 [ 93.320418][ T5070] RIP: 0033:0x4eacda [ 93.324459][ T5070] Code: 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 38 12 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 36 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 06 c3 0f 1f 44 00 00 48 c7 c2 a8 ff ff ff f7 [ 93.344565][ T5070] RSP: 002b:00007ffe3d124548 EFLAGS: 00000246 ORIG_RAX: 0000000000000136 [ 93.353128][ T5070] RAX: ffffffffffffffda RBX: 000055555d6c5000 RCX: 00000000004eacda [ 93.361169][ T5070] RDX: 0000000000000001 RSI: 00007ffe3d124570 RDI: 00000000000013d4 [ 93.369624][ T5070] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 [ 93.377991][ T5070] R10: 00007ffe3d124580 R11: 0000000000000246 R12: 000055555d6c5730 [ 93.386170][ T5070] R13: 00007ffe3d124640 R14: 0000000000001000 R15: 0000000000000013 [ 93.394347][ T5070] [ 93.397543][ T5070] [ 93.399866][ T5070] Allocated by task 5805: [ 93.404365][ T5070] kasan_save_track+0x3f/0x80 [ 93.409314][ T5070] __kasan_kmalloc+0x98/0xb0 [ 93.413996][ T5070] kmalloc_trace+0x1d9/0x360 [ 93.418777][ T5070] bpf_raw_tp_link_attach+0x2a0/0x6e0 [ 93.424165][ T5070] bpf_raw_tracepoint_open+0x1c2/0x240 [ 93.429708][ T5070] __sys_bpf+0x3c0/0x810 [ 93.434151][ T5070] __x64_sys_bpf+0x7c/0x90 [ 93.439655][ T5070] do_syscall_64+0xfb/0x240 [ 93.444345][ T5070] entry_SYSCALL_64_after_hwframe+0x6d/0x75 [ 93.450282][ T5070] [ 93.452781][ T5070] Freed by task 5803: [ 93.456854][ T5070] kasan_save_track+0x3f/0x80 [ 93.462420][ T5070] kasan_save_free_info+0x40/0x50 [ 93.467551][ T5070] poison_slab_object+0xa6/0xe0 [ 93.472441][ T5070] __kasan_slab_free+0x37/0x60 [ 93.477588][ T5070] kfree+0x14a/0x380 [ 93.481560][ T5070] bpf_link_release+0x3b/0x50 [ 93.487174][ T5070] __fput+0x429/0x8a0 [ 93.491610][ T5070] task_work_run+0x24f/0x310 [ 93.497202][ T5070] do_exit+0xa1b/0x27e0 [ 93.502853][ T5070] do_group_exit+0x207/0x2c0 [ 93.509045][ T5070] __x64_sys_exit_group+0x3f/0x40 [ 93.514195][ T5070] do_syscall_64+0xfb/0x240 [ 93.518813][ T5070] entry_SYSCALL_64_after_hwframe+0x6d/0x75 [ 93.525954][ T5070] [ 93.528285][ T5070] The buggy address belongs to the object at ffff88807d7fa000 [ 93.528285][ T5070] which belongs to the cache kmalloc-128 of size 128 [ 93.543845][ T5070] The buggy address is located 24 bytes inside of [ 93.543845][ T5070] freed 128-byte region [ffff88807d7fa000, ffff88807d7fa080) [ 93.558607][ T5070] [ 93.560955][ T5070] The buggy address belongs to the physical page: [ 93.567778][ T5070] page:ffffea0001f5fe80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7d7fa [ 93.579295][ T5070] flags: 0xfff00000000800(slab|node=0|zone=1|lastcpupid=0x7ff) [ 93.587449][ T5070] page_type: 0xffffffff() [ 93.592361][ T5070] raw: 00fff00000000800 ffff888014c418c0 dead000000000122 0000000000000000 [ 93.602001][ T5070] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 93.611548][ T5070] page dumped because: kasan: bad access detected [ 93.618764][ T5070] page_owner tracks the page as allocated [ 93.624874][ T5070] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 5805, tgid 5803 (syz-executor166), ts 93106037824, free_ts 93100401947 [ 93.644102][ T5070] post_alloc_hook+0x1ea/0x210 [ 93.649088][ T5070] get_page_from_freelist+0x33ea/0x3580 [ 93.654654][ T5070] __alloc_pages+0x256/0x680 [ 93.659535][ T5070] alloc_slab_page+0x5f/0x160 [ 93.664222][ T5070] new_slab+0x84/0x2f0 [ 93.668815][ T5070] ___slab_alloc+0xd1b/0x13e0 [ 93.673614][ T5070] kmalloc_trace+0x267/0x360 [ 93.678597][ T5070] bpf_raw_tp_link_attach+0x2a0/0x6e0 [ 93.684114][ T5070] bpf_raw_tracepoint_open+0x1c2/0x240 [ 93.689864][ T5070] __sys_bpf+0x3c0/0x810 [ 93.694316][ T5070] __x64_sys_bpf+0x7c/0x90 [ 93.698845][ T5070] do_syscall_64+0xfb/0x240 [ 93.703555][ T5070] entry_SYSCALL_64_after_hwframe+0x6d/0x75 [ 93.709590][ T5070] page last free pid 5805 tgid 5803 stack trace: [ 93.716197][ T5070] free_unref_page_prepare+0x968/0xa90 [ 93.722908][ T5070] free_unref_page+0x37/0x3f0 [ 93.727635][ T5070] vfree+0x186/0x2e0 [ 93.731617][ T5070] bpf_prog_calc_tag+0x663/0x900 [ 93.736561][ T5070] resolve_pseudo_ldimm64+0xe2/0x1650 [ 93.741966][ T5070] bpf_check+0x6175/0x190c0 [ 93.746480][ T5070] bpf_prog_load+0x1667/0x20f0 [ 93.751423][ T5070] __sys_bpf+0x4ee/0x810 [ 93.755671][ T5070] __x64_sys_bpf+0x7c/0x90 [ 93.760088][ T5070] do_syscall_64+0xfb/0x240 [ 93.764596][ T5070] entry_SYSCALL_64_after_hwframe+0x6d/0x75 [ 93.770937][ T5070] [ 93.773263][ T5070] Memory state around the buggy address: [ 93.778949][ T5070] ffff88807d7f9f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 93.787058][ T5070] ffff88807d7f9f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 93.795270][ T5070] >ffff88807d7fa000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 93.803341][ T5070] ^ [ 93.808202][ T5070] ffff88807d7fa080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 93.816284][ T5070] ffff88807d7fa100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 93.824346][ T5070] ================================================================== [ 93.832644][ T5070] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 93.840374][ T5070] CPU: 0 PID: 5070 Comm: strace-static-x Not tainted 6.8.0-syzkaller-05243-g14bb1e8c8d4a #0 [ 93.850647][ T5070] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 93.860828][ T5070] Call Trace: [ 93.864146][ T5070] [ 93.867091][ T5070] dump_stack_lvl+0x1e7/0x2e0 [ 93.871975][ T5070] ? __pfx_dump_stack_lvl+0x10/0x10 [ 93.877461][ T5070] ? __pfx__printk+0x10/0x10 [ 93.882417][ T5070] ? vscnprintf+0x5d/0x90 [ 93.887144][ T5070] panic+0x349/0x860 [ 93.891639][ T5070] ? check_panic_on_warn+0x21/0xb0 [ 93.897287][ T5070] ? __pfx_panic+0x10/0x10 [ 93.902169][ T5070] ? _raw_spin_unlock_irqrestore+0xd8/0x140 [ 93.908239][ T5070] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 93.914929][ T5070] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 93.921544][ T5070] ? print_report+0x502/0x550 [ 93.926262][ T5070] check_panic_on_warn+0x86/0xb0 [ 93.931305][ T5070] ? bpf_trace_run2+0xfa/0x530 [ 93.936081][ T5070] end_report+0x6e/0x140 [ 93.940337][ T5070] kasan_report+0x154/0x180 [ 93.945069][ T5070] ? bpf_trace_run2+0xfa/0x530 [ 93.950215][ T5070] bpf_trace_run2+0xfa/0x530 [ 93.954843][ T5070] ? __pfx_bpf_trace_run2+0x10/0x10 [ 93.960056][ T5070] ? __pfx___might_resched+0x10/0x10 [ 93.965528][ T5070] ? process_vm_rw+0xc3b/0xcf0 [ 93.970655][ T5070] ? process_vm_rw+0xc3b/0xcf0 [ 93.975448][ T5070] __traceiter_kfree+0x2b/0x50 [ 93.980231][ T5070] ? process_vm_rw+0xc3b/0xcf0 [ 93.985295][ T5070] kfree+0x291/0x380 [ 93.989229][ T5070] process_vm_rw+0xc3b/0xcf0 [ 93.994621][ T5070] ? __pfx_process_vm_rw+0x10/0x10 [ 94.000305][ T5070] ? bpf_lsm_file_permission+0x9/0x10 [ 94.005985][ T5070] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 94.012409][ T5070] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 94.019231][ T5070] __x64_sys_process_vm_readv+0xe0/0x100 [ 94.024968][ T5070] do_syscall_64+0xfb/0x240 [ 94.029485][ T5070] entry_SYSCALL_64_after_hwframe+0x6d/0x75 [ 94.035393][ T5070] RIP: 0033:0x4eacda [ 94.039295][ T5070] Code: 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 38 12 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 36 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 06 c3 0f 1f 44 00 00 48 c7 c2 a8 ff ff ff f7 [ 94.059426][ T5070] RSP: 002b:00007ffe3d124548 EFLAGS: 00000246 ORIG_RAX: 0000000000000136 [ 94.067977][ T5070] RAX: ffffffffffffffda RBX: 000055555d6c5000 RCX: 00000000004eacda [ 94.076391][ T5070] RDX: 0000000000000001 RSI: 00007ffe3d124570 RDI: 00000000000013d4 [ 94.084544][ T5070] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 [ 94.092651][ T5070] R10: 00007ffe3d124580 R11: 0000000000000246 R12: 000055555d6c5730 [ 94.100819][ T5070] R13: 00007ffe3d124640 R14: 0000000000001000 R15: 0000000000000013 [ 94.108984][ T5070] [ 94.112585][ T5070] Kernel Offset: disabled [ 94.117191][ T5070] Rebooting in 86400 seconds..