./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1206100135

<...>
Warning: Permanently added '10.128.0.154' (ED25519) to the list of known hosts.
execve("./syz-executor1206100135", ["./syz-executor1206100135"], 0x7ffd1fb14800 /* 10 vars */) = 0
brk(NULL)                               = 0x555555d83000
brk(0x555555d83d00)                     = 0x555555d83d00
arch_prctl(ARCH_SET_FS, 0x555555d83380) = 0
set_tid_address(0x555555d83650)         = 5006
set_robust_list(0x555555d83660, 24)     = 0
rseq(0x555555d83ca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor1206100135", 4096) = 28
getrandom("\x75\x21\x56\xdc\x89\xa2\x5c\xd9", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x555555d83d00
brk(0x555555da4d00)                     = 0x555555da4d00
brk(0x555555da5000)                     = 0x555555da5000
mprotect(0x7f9093178000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
unshare(CLONE_NEWPID)                   = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555d83650) = 5007
./strace-static-x86_64: Process 5007 attached
[pid  5007] set_robust_list(0x555555d83660, 24) = 0
[pid  5007] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy)
[pid  5007] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5007] setsid()                    = 1
[pid  5007] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0
[pid  5007] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0
[pid  5007] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0
[pid  5007] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0
[pid  5007] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0
[pid  5007] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0
[pid  5007] unshare(CLONE_NEWNS)        = 0
[pid  5007] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0
[pid  5007] unshare(CLONE_NEWIPC)       = 0
[pid  5007] unshare(CLONE_NEWCGROUP)    = 0
[pid  5007] unshare(CLONE_NEWUTS)       = 0
[pid  5007] unshare(CLONE_SYSVSEM)      = 0
[pid  5007] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3
[pid  5007] write(3, "16777216", 8)     = 8
[pid  5007] close(3)                    = 0
[pid  5007] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3
[pid  5007] write(3, "536870912", 9)    = 9
[pid  5007] close(3)                    = 0
[pid  5007] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3
[pid  5007] write(3, "1024", 4)         = 4
[pid  5007] close(3)                    = 0
[pid  5007] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3
[pid  5007] write(3, "8192", 4)         = 4
[pid  5007] close(3)                    = 0
[pid  5007] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3
[pid  5007] write(3, "1024", 4)         = 4
[pid  5007] close(3)                    = 0
[pid  5007] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3
[pid  5007] write(3, "1024", 4)         = 4
[pid  5007] close(3)                    = 0
[pid  5007] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3
[pid  5007] write(3, "1024 1048576 500 1024", 21) = 21
[pid  5007] close(3)                    = 0
[pid  5007] getpid()                    = 1
[pid  5007] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  5007] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  5007] unshare(CLONE_NEWNET)       = 0
[pid  5007] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC) = 3
[pid  5007] write(3, "0 65535", 7)      = 7
[pid  5007] close(3)                    = 0
[pid  5007] mkdir("/dev/binderfs", 0777) = 0
[pid  5007] mount("binder", "/dev/binderfs", "binder", 0, NULL) = 0
[pid  5007] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5007] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
[pid  5007] ioctl(3, LOOP_CLR_FD)       = -1 ENXIO (No such device or address)
[pid  5007] close(3)                    = 0
[pid  5007] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555d83650) = 2
./strace-static-x86_64: Process 5010 attached
[pid  5010] set_robust_list(0x555555d83660, 24) = 0
[pid  5010] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5010] setpgid(0, 0)               = 0
[pid  5010] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5010] write(3, "1000", 4)         = 4
[pid  5010] close(3)                    = 0
[pid  5010] memfd_create("syzkaller", 0) = 3
[pid  5010] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f908ac00000
[pid  5010] write(3, "\xeb\x58\x90\x6d\x6b\x66\x73\x2e\x66\x61\x74\x00\x02\x08\x20\x00\x02\x00\x00\x80\x00\xf8\x00\x00\x10\x00\x69\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x01\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3d\x32\x00\x80\x00\x29\x30\x76\xf2\x8a\x53\x59\x5a\x4b\x41\x4c\x4c\x45\x52\x20\x20\x46\x41\x54\x33\x32\x20\x20\x20\x0e\x1f\xbe\x77\x7c\xac\x22\xc0\x74\x0b"..., 65536) = 65536
[pid  5010] munmap(0x7f908ac00000, 138412032) = 0
[pid  5010] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5010] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5010] close(3)                    = 0
[pid  5010] close(4)                    = 0
[pid  5010] mkdir("./file1", 0777)      = 0
[pid  5010] mount("/dev/loop0", "./file1", "msdos", MS_NOSUID|MS_NODEV|MS_NOATIME|MS_REC|MS_SILENT|MS_I_VERSION, "dots,dots,dmask=000000000200000,nodots,discard,nfs=nostale_ro,gid=0x0000000000000000,dos1xfloppy") = 0
[pid  5010] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid  5010] chdir("./file1")            = 0
[  162.484096][ T5010] loop0: detected capacity change from 0 to 128
[pid  5010] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5010] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5010] close(4)                    = 0
[pid  5010] openat(AT_FDCWD, ".", O_RDONLY) = 4
[pid  5010] fanotify_init(FAN_CLASS_NOTIF|FAN_REPORT_FID, O_RDONLY) = 5
[pid  5010] fanotify_mark(5, FAN_MARK_ADD, FAN_MODIFY|FAN_ATTRIB|FAN_CLOSE_WRITE|FAN_CLOSE_NOWRITE|FAN_OPEN|FAN_ONDIR|FAN_EVENT_ON_CHILD, 4, NULL) = 0
[pid  5010] close(3)                    = 0
[  162.565309][ T5010] =====================================================
[  162.572745][ T5010] BUG: KMSAN: uninit-value in bcmp+0x186/0x1c0
[  162.579113][ T5010]  bcmp+0x186/0x1c0
[  162.583303][ T5010]  fanotify_merge+0x15f5/0x27e0
[  162.588400][ T5010]  fsnotify_insert_event+0x1d0/0x600
[  162.594076][ T5010]  fanotify_handle_event+0x47f7/0x6140
[  162.599793][ T5010]  fsnotify+0x2510/0x3530
[  162.604509][ T5010]  __fput+0x578/0x10c0
[  162.608773][ T5010]  __fput_sync+0x74/0x90
[  162.613333][ T5010]  __se_sys_close+0x28a/0x4c0
[  162.618253][ T5010]  __x64_sys_close+0x48/0x60
[  162.623245][ T5010]  do_syscall_64+0x6d/0x140
[  162.627940][ T5010]  entry_SYSCALL_64_after_hwframe+0x63/0x6b
[  162.634176][ T5010] 
[  162.636614][ T5010] Uninit was created at:
[  162.641137][ T5010]  slab_post_alloc_hook+0x129/0xa70
[  162.646690][ T5010]  kmem_cache_alloc+0x579/0xa90
[  162.651713][ T5010]  fanotify_handle_event+0x2ff6/0x6140
[  162.657490][ T5010]  fsnotify+0x2510/0x3530
[  162.662315][ T5010]  __fput+0x578/0x10c0
[  162.666577][ T5010]  __fput_sync+0x74/0x90
[  162.671018][ T5010]  __se_sys_close+0x28a/0x4c0
[  162.676067][ T5010]  __x64_sys_close+0x48/0x60
[  162.680899][ T5010]  do_syscall_64+0x6d/0x140
[  162.685817][ T5010]  entry_SYSCALL_64_after_hwframe+0x63/0x6b
[  162.692044][ T5010] 
[  162.694474][ T5010] CPU: 0 PID: 5010 Comm: syz-executor120 Not tainted 6.7.0-syzkaller-00562-g9f8413c4a66f #0
[  162.704908][ T5010] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
[  162.715209][ T5010] =====================================================
[  162.722462][ T5010] Disabling lock debugging due to kernel taint
[  162.728715][ T5010] Kernel panic - not syncing: kmsan.panic set ...
[  162.735229][ T5010] CPU: 0 PID: 5010 Comm: syz-executor120 Tainted: G    B              6.7.0-syzkaller-00562-g9f8413c4a66f #0
[  162.746969][ T5010] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
[  162.757173][ T5010] Call Trace:
[  162.760567][ T5010]  <TASK>
[  162.763646][ T5010]  dump_stack_lvl+0x1bf/0x240
[  162.768568][ T5010]  dump_stack+0x1e/0x20
[  162.772934][ T5010]  panic+0x4de/0xc90
[  162.777044][ T5010]  ? add_taint+0x108/0x1a0
[  162.781671][ T5010]  kmsan_report+0x2d0/0x2d0
[  162.786408][ T5010]  ? __module_address+0xef/0x7e0
[  162.791526][ T5010]  ? kmsan_get_shadow_origin_ptr+0x4d/0xa0
[  162.797577][ T5010]  ? __msan_warning+0x96/0x110
[  162.802506][ T5010]  ? bcmp+0x186/0x1c0
[  162.806631][ T5010]  ? fanotify_merge+0x15f5/0x27e0
[  162.811907][ T5010]  ? fsnotify_insert_event+0x1d0/0x600
[  162.817555][ T5010]  ? fanotify_handle_event+0x47f7/0x6140
[  162.823443][ T5010]  ? fsnotify+0x2510/0x3530
[  162.828107][ T5010]  ? __fput+0x578/0x10c0
[  162.832512][ T5010]  ? __fput_sync+0x74/0x90
[  162.837160][ T5010]  ? __se_sys_close+0x28a/0x4c0
[  162.842268][ T5010]  ? __x64_sys_close+0x48/0x60
[  162.847280][ T5010]  ? do_syscall_64+0x6d/0x140
[  162.852203][ T5010]  ? entry_SYSCALL_64_after_hwframe+0x63/0x6b
[  162.858553][ T5010]  ? kernel_text_address+0x125/0x1b0
[  162.864096][ T5010]  ? __kernel_text_address+0x2a/0x90
[  162.869628][ T5010]  ? kmsan_get_shadow_origin_ptr+0x4d/0xa0
[  162.875668][ T5010]  ? filter_irq_stacks+0x60/0x1a0
[  162.880921][ T5010]  ? kmsan_get_shadow_origin_ptr+0x4d/0xa0
[  162.886970][ T5010]  __msan_warning+0x96/0x110
[  162.891795][ T5010]  bcmp+0x186/0x1c0
[  162.895771][ T5010]  fanotify_merge+0x15f5/0x27e0
[  162.900792][ T5010]  ? kmsan_internal_set_shadow_origin+0x66/0xe0
[  162.907237][ T5010]  ? fanotify_free_mark+0x50/0x50
[  162.912564][ T5010]  fsnotify_insert_event+0x1d0/0x600
[  162.918074][ T5010]  ? fanotify_merge+0x27e0/0x27e0
[  162.923255][ T5010]  ? fanotify_free_mark+0x50/0x50
[  162.928468][ T5010]  fanotify_handle_event+0x47f7/0x6140
[  162.934254][ T5010]  ? inotify_release+0x70/0x70
[  162.939261][ T5010]  fsnotify+0x2510/0x3530
[  162.943821][ T5010]  __fput+0x578/0x10c0
[  162.948146][ T5010]  __fput_sync+0x74/0x90
[  162.952617][ T5010]  __se_sys_close+0x28a/0x4c0
[  162.957582][ T5010]  __x64_sys_close+0x48/0x60
[  162.962425][ T5010]  do_syscall_64+0x6d/0x140
[  162.967167][ T5010]  entry_SYSCALL_64_after_hwframe+0x63/0x6b
[  162.973289][ T5010] RIP: 0033:0x7f9093103260
[  162.977819][ T5010] Code: ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 80 3d 41 9e 07 00 00 74 17 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 48 c3 0f 1f 80 00 00 00 00 48 83 ec 18 89 7c
[  162.997594][ T5010] RSP: 002b:00007ffeab675c48 EFLAGS: 00000202 ORIG_RAX: 0000000000000003
[  163.006263][ T5010] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007f9093103260
[  163.014414][ T5010] RDX: 000000004800003e RSI: 0000000000000001 RDI: 0000000000000004
[  163.022551][ T5010] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000555500000000
[  163.030686][ T5010] R10: 0000000000000004 R11: 0000000000000202 R12: 00000000000f4240
[  163.038837][ T5010] R13: 00007ffeab675eb8 R14: 0000000000000001 R15: 00007ffeab675c80
[  163.047011][ T5010]  </TASK>
[  163.050458][ T5010] Kernel Offset: disabled
[  163.054854][ T5010] Rebooting in 86400 seconds..