./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor964951719

<...>
Warning: Permanently added '10.128.0.168' (ED25519) to the list of known hosts.
execve("./syz-executor964951719", ["./syz-executor964951719"], 0x7fffde8f69d0 /* 10 vars */) = 0
brk(NULL)                               = 0x55557e3a3000
brk(0x55557e3a3d00)                     = 0x55557e3a3d00
arch_prctl(ARCH_SET_FS, 0x55557e3a3380) = 0
set_tid_address(0x55557e3a3650)         = 5227
set_robust_list(0x55557e3a3660, 24)     = 0
rseq(0x55557e3a3ca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor964951719", 4096) = 27
getrandom("\x04\x40\x5e\xd2\x45\xee\x6f\xfe", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x55557e3a3d00
brk(0x55557e3c4d00)                     = 0x55557e3c4d00
brk(0x55557e3c5000)                     = 0x55557e3c5000
mprotect(0x7f3eb1475000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
mkdir("./syzkaller.ubgdV8", 0700)       = 0
chmod("./syzkaller.ubgdV8", 0777)       = 0
chdir("./syzkaller.ubgdV8")             = 0
unshare(CLONE_NEWPID)                   = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55557e3a3650) = 5228
./strace-static-x86_64: Process 5228 attached
[pid  5228] set_robust_list(0x55557e3a3660, 24) = 0
[pid  5228] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy)
[pid  5228] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5228] setsid()                    = 1
[pid  5228] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0
[pid  5228] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0
[pid  5228] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0
[pid  5228] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0
[pid  5228] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0
[pid  5228] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0
[pid  5228] unshare(CLONE_NEWNS)        = 0
[pid  5228] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0
[pid  5228] unshare(CLONE_NEWIPC)       = 0
[pid  5228] unshare(CLONE_NEWCGROUP)    = 0
[pid  5228] unshare(CLONE_NEWUTS)       = 0
[pid  5228] unshare(CLONE_SYSVSEM)      = 0
[pid  5228] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3
[pid  5228] write(3, "16777216", 8)     = 8
[pid  5228] close(3)                    = 0
[pid  5228] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3
[pid  5228] write(3, "536870912", 9)    = 9
[pid  5228] close(3)                    = 0
[pid  5228] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3
[pid  5228] write(3, "1024", 4)         = 4
[pid  5228] close(3)                    = 0
[pid  5228] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3
[pid  5228] write(3, "8192", 4)         = 4
[pid  5228] close(3)                    = 0
[pid  5228] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3
[pid  5228] write(3, "1024", 4)         = 4
[pid  5228] close(3)                    = 0
[pid  5228] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3
[pid  5228] write(3, "1024", 4)         = 4
[pid  5228] close(3)                    = 0
[pid  5228] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3
[pid  5228] write(3, "1024 1048576 500 1024", 21) = 21
[pid  5228] close(3)                    = 0
[pid  5228] getpid()                    = 1
[pid  5228] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  5228] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  5228] unshare(CLONE_NEWNET)       = 0
[pid  5228] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC) = 3
[pid  5228] write(3, "0 65535", 7)      = 7
[pid  5228] close(3)                    = 0
[pid  5228] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC) = 3
[pid  5228] write(3, "100000", 6)       = 6
[pid  5228] close(3)                    = 0
[pid  5228] mkdir("./syz-tmp", 0777)    = 0
[pid  5228] mount("", "./syz-tmp", "tmpfs", 0, NULL) = 0
[pid  5228] mkdir("./syz-tmp/newroot", 0777) = 0
[pid  5228] mkdir("./syz-tmp/newroot/dev", 0700) = 0
[pid  5228] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0
[pid  5228] mkdir("./syz-tmp/newroot/proc", 0700) = 0
[pid  5228] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL) = 0
[pid  5228] mkdir("./syz-tmp/newroot/selinux", 0700) = 0
[pid  5228] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = -1 ENOENT (No such file or directory)
[pid  5228] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = -1 ENOENT (No such file or directory)
[pid  5228] mkdir("./syz-tmp/newroot/sys", 0700) = 0
[pid  5228] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0
[pid  5228] mkdir("./syz-tmp/pivot", 0777) = 0
[pid  5228] pivot_root("./syz-tmp", "./syz-tmp/pivot") = 0
[pid  5228] chdir("/")                  = 0
[pid  5228] umount2("./pivot", MNT_DETACH) = 0
[pid  5228] chroot("./newroot")         = 0
[pid  5228] chdir("/")                  = 0
[pid  5228] mkdir("/dev/binderfs", 0777) = 0
[pid  5228] mount("binder", "/dev/binderfs", "binder", 0, NULL) = 0
[pid  5228] mkdir("./0", 0777)          = 0
[pid  5228] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
[pid  5228] ioctl(3, LOOP_CLR_FD)       = -1 ENXIO (No such device or address)
[pid  5228] close(3)                    = 0
[pid  5228] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5231 attached
 <unfinished ...>
[pid  5231] set_robust_list(0x55557e3a3660, 24) = 0
[pid  5231] chdir("./0" <unfinished ...>
[pid  5228] <... clone resumed>, child_tidptr=0x55557e3a3650) = 2
[pid  5231] <... chdir resumed>)        = 0
[pid  5231] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5231] setpgid(0, 0)               = 0
[pid  5231] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5231] write(3, "1000", 4)         = 4
[pid  5231] close(3)                    = 0
[pid  5231] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5231] write(1, "executing program\n", 18executing program
) = 18
[pid  5231] memfd_create("syzkaller", 0) = 3
[pid  5231] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3ea8e00000
[pid  5231] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216
[pid  5231] munmap(0x7f3ea8e00000, 138412032) = 0
[pid  5231] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5231] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5231] close(3)                    = 0
[pid  5231] close(4)                    = 0
[pid  5231] mkdir("./bus", 0777)        = 0
syzkaller login: [   80.010723][ T5231] loop0: detected capacity change from 0 to 32768
[   80.040059][ T5231] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop0 (7:0) scanned by syz-executor964 (5231)
[   80.087482][ T5231] BTRFS info (device loop0): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d
[   80.098589][ T5231] BTRFS info (device loop0): using sha256 (sha256-avx2) checksum algorithm
[   80.151955][ T5231] BTRFS info (device loop0): rebuilding free space tree
[pid  5231] mount("/dev/loop0", "./bus", "btrfs", MS_NOEXEC, "autodefrag,autodefrag,ref_verify,max_inline=T,clear_cache,discard,noenospc_debug,barrier,nospace_cac"...) = 0
[pid  5231] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3
[pid  5231] chdir("./bus")              = 0
[pid  5231] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   80.194256][ T5231] BTRFS info (device loop0): disabling free space tree
[   80.201555][ T5231] BTRFS info (device loop0): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1)
[   80.211687][ T5231] BTRFS info (device loop0): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2)
[pid  5231] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5231] close(4)                    = 0
[pid  5231] open("./bus", O_WRONLY|O_CREAT|O_EXCL|O_NONBLOCK|O_SYNC|O_NOFOLLOW|O_CLOEXEC|0x3c, 000) = 4
[pid  5231] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid  5231] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_SYNC|O_NOATIME|FASYNC, 000) = 5
[pid  5231] pwritev2(5, [{iov_base="\xff\x2c\x6e\x6f\x65\x6e\x6f\x73\x70\x63\x5f\x64\x65\x62\x75\x67\x2c\x62\x61\x72\x72\x69\x65\x72\x2c\x6e\x6f\x73\x70\x61\x63\x65\x5f\x63\x61\x63\x68\x65\x2c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x2e\x2f\x62\x75\x73\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=44027}], 1, 21522, 0) = 44027
[pid  5231] open("./bus", O_RDONLY)     = 6
[pid  5231] memfd_create("syzkaller", 0) = 7
[pid  5231] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3ea8e00000
[pid  5231] write(7, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288
[pid  5231] munmap(0x7f3ea8e00000, 138412032) = 0
[pid  5231] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 8
[pid  5231] ioctl(8, LOOP_SET_FD, 7)    = -1 EBUSY (Device or resource busy)
[pid  5231] ioctl(8, LOOP_CLR_FD)       = 0
[pid  5231] ioctl(8, LOOP_SET_FD, 7)    = -1 EBUSY (Device or resource busy)
[pid  5231] close(8)                    = 0
[pid  5231] close(7)                    = 0
[pid  5231] ioctl(6, LOOP_SET_STATUS, {lo_number=0, lo_offset=0x691f3f6d, lo_encrypt_type=0x9bedef3c /* LO_CRYPT_??? */, lo_encrypt_key_size=2121260791, lo_flags=LO_FLAGS_READ_ONLY|LO_FLAGS_AUTOCLEAR|LO_FLAGS_PARTSCAN|LO_FLAGS_DIRECT_IO|0xb3bb3f80, lo_name="\x8d\x36\xc0\x67\xd6\xf9\xd7\x73\xb0\x97\x22\xe7\x4f\x5c\xb8\x55\xd6\x57\xee\x76\xba\x2b\x77\x3b\xd7\x07\xe5\x24\x53\x49\x1a\x49\xb3\xbf\x4a\xd1\x4e\x8a\x8f\x93\x73\xe9\x2f\xf9\x7c\xf9\x62\x3d\x5c\xf1\xa0\x79\x5e\xbd\xf7\x51\xd1\x7c\xff\xc3\x4e\xbf\xd6"..., lo_encrypt_key="\x97\x6a\xfb\xc6\x56\xfd\x36\x19\xbb\x65\x2f\x39\x34\xac\x1c\x48\x32\xd3\x2f\xfe\x67\xdb\xc3\x6e\x1a\xaf\x5a\xaa\x71\x2e\xad\x8d", ...}) = 0
[pid  5231] mkdir(".", 0777)            = -1 EEXIST (File exists)
[   80.545991][ T5231] loop0: detected capacity change from 32768 to 0
[   80.570136][   T53] kworker/u8:3: attempt to access beyond end of device
[   80.570136][   T53] loop0: rw=67112961, sector=10488, nr_sectors = 8 limit=0
[   80.585460][   T53] BTRFS error (device loop0): bdev /dev/loop0 errs: wr 1, rd 0, flush 0, corrupt 0, gen 0
[   80.596925][   T53] kworker/u8:3: attempt to access beyond end of device
[   80.596925][   T53] loop0: rw=67112961, sector=10496, nr_sectors = 8 limit=0
[   80.611414][   T53] BTRFS error (device loop0): bdev /dev/loop0 errs: wr 2, rd 0, flush 0, corrupt 0, gen 0
[   80.622118][   T53] kworker/u8:3: attempt to access beyond end of device
[   80.622118][   T53] loop0: rw=67112961, sector=10504, nr_sectors = 8 limit=0
[   80.636103][   T53] BTRFS error (device loop0): bdev /dev/loop0 errs: wr 3, rd 0, flush 0, corrupt 0, gen 0
[   80.646193][   T53] kworker/u8:3: attempt to access beyond end of device
[   80.646193][   T53] loop0: rw=67112961, sector=10616, nr_sectors = 8 limit=0
[   80.660255][   T53] BTRFS error (device loop0): bdev /dev/loop0 errs: wr 4, rd 0, flush 0, corrupt 0, gen 0
[   80.674604][ T5231] BTRFS error (device loop0 state A): Transaction aborted (error -5)
[   80.683246][ T5231] BTRFS: error (device loop0 state A) in __btrfs_run_delayed_items:1174: errno=-5 IO failure
[pid  5231] mount(NULL, ".", 0x20000f40, MS_NOEXEC|MS_SYNCHRONOUS|MS_REMOUNT|MS_NOATIME|MS_MOVE|MS_SILENT|MS_PRIVATE|MS_RELATIME|MS_I_VERSION|MS_STRICTATIME, "") = -1 EINVAL (Invalid argument)
[pid  5231] close(3)                    = 0
[pid  5231] close(4)                    = 0
[pid  5231] close(5)                    = 0
[pid  5231] close(6)                    = 0
[pid  5231] close(7)                    = -1 EBADF (Bad file descriptor)
[pid  5231] close(8)                    = -1 EBADF (Bad file descriptor)
[pid  5231] close(9)                    = -1 EBADF (Bad file descriptor)
[pid  5231] close(10)                   = -1 EBADF (Bad file descriptor)
[pid  5231] close(11)                   = -1 EBADF (Bad file descriptor)
[pid  5231] close(12)                   = -1 EBADF (Bad file descriptor)
[pid  5231] close(13)                   = -1 EBADF (Bad file descriptor)
[pid  5231] close(14)                   = -1 EBADF (Bad file descriptor)
[pid  5231] close(15)                   = -1 EBADF (Bad file descriptor)
[pid  5231] close(16)                   = -1 EBADF (Bad file descriptor)
[pid  5231] close(17)                   = -1 EBADF (Bad file descriptor)
[   80.693617][ T5231] BTRFS info (device loop0 state EA): forced readonly
[   80.700689][ T5231] BTRFS warning (device loop0 state EA): Skipping commit of aborted transaction.
[   80.710619][ T5231] BTRFS: error (device loop0 state EA) in cleanup_transaction:2017: errno=-5 IO failure
[   80.721799][ T5231] BTRFS error (device loop0 state EMA): remounting read-write after error is not allowed
[pid  5231] close(18)                   = -1 EBADF (Bad file descriptor)
[pid  5231] close(19)                   = -1 EBADF (Bad file descriptor)
[pid  5231] close(20)                   = -1 EBADF (Bad file descriptor)
[pid  5231] close(21)                   = -1 EBADF (Bad file descriptor)
[pid  5231] close(22)                   = -1 EBADF (Bad file descriptor)
[pid  5231] close(23)                   = -1 EBADF (Bad file descriptor)
[pid  5231] close(24)                   = -1 EBADF (Bad file descriptor)
[pid  5231] close(25)                   = -1 EBADF (Bad file descriptor)
[pid  5231] close(26)                   = -1 EBADF (Bad file descriptor)
[pid  5231] close(27)                   = -1 EBADF (Bad file descriptor)
[pid  5231] close(28)                   = -1 EBADF (Bad file descriptor)
[pid  5231] close(29)                   = -1 EBADF (Bad file descriptor)
[pid  5231] exit_group(0)               = ?
[pid  5231] +++ exited with 0 +++
[pid  5228] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=2 /* 0.02 s */, si_stime=46 /* 0.46 s */} ---
[pid  5228] restart_syscall(<... resuming interrupted clone ...>) = 0
[pid  5228] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[pid  5228] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
[pid  5228] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=80, ...}, AT_EMPTY_PATH) = 0
[pid  5228] getdents64(3, 0x55557e3a46f0 /* 4 entries */, 32768) = 104
[pid  5228] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[pid  5228] newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  5228] unlink("./0/binderfs")      = 0
[pid  5228] umount2("./0/bus", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EBUSY (Device or resource busy)
[pid  5228] newfstatat(AT_FDCWD, "./0/bus", {st_mode=S_IFDIR|0755, st_size=64, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid  5228] umount2("./0/bus", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EBUSY (Device or resource busy)
[   80.818208][ T5231] syz-executor964 (5231) used greatest stack depth: 19376 bytes left
[pid  5228] openat(AT_FDCWD, "./0/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
[pid  5228] newfstatat(4, "", {st_mode=S_IFDIR|0755, st_size=64, ...}, AT_EMPTY_PATH) = 0
[pid  5228] getdents64(4, 0x55557e3ac730 /* 2 entries */, 32768) = 48
[pid  5228] getdents64(4, 0x55557e3ac730, 32768) = -1 EIO (Input/output error)
[pid  5228] close(4)                    = 0
[pid  5228] rmdir("./0/bus")            = -1 EBUSY (Device or resource busy)
[pid  5228] umount2("./0/bus", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EBUSY (Device or resource busy)
[pid  5228] exit_group(1)               = ?
[   80.910126][ T5228] BTRFS info (device loop0 state EA): last unmount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d
[   80.923896][ T5228] ==================================================================
[   80.932804][ T5228] BUG: KASAN: slab-use-after-free in rb_first_postorder+0x69/0x90
[   80.940679][ T5228] Read of size 8 at addr ffff88807421d010 by task syz-executor964/5228
[   80.948954][ T5228] 
[   80.951333][ T5228] CPU: 1 UID: 0 PID: 5228 Comm: syz-executor964 Not tainted 6.11.0-syzkaller-02520-gadfc3ded5c33 #0
[   80.962138][ T5228] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
[   80.972332][ T5228] Call Trace:
[   80.975644][ T5228]  <TASK>
[   80.978601][ T5228]  dump_stack_lvl+0x241/0x360
[   80.983835][ T5228]  ? __pfx_dump_stack_lvl+0x10/0x10
[   80.989060][ T5228]  ? __pfx__printk+0x10/0x10
[   80.993669][ T5228]  ? _printk+0xd5/0x120
[   80.997840][ T5228]  ? __virt_addr_valid+0x183/0x530
[   81.002947][ T5228]  ? __virt_addr_valid+0x183/0x530
[   81.008148][ T5228]  print_report+0x169/0x550
[   81.012661][ T5228]  ? __virt_addr_valid+0x183/0x530
[   81.017810][ T5228]  ? __virt_addr_valid+0x183/0x530
[   81.022931][ T5228]  ? __virt_addr_valid+0x45f/0x530
[   81.028054][ T5228]  ? __phys_addr+0xba/0x170
[   81.032555][ T5228]  ? rb_first_postorder+0x69/0x90
[   81.037616][ T5228]  kasan_report+0x143/0x180
[   81.042162][ T5228]  ? rb_first_postorder+0x69/0x90
[   81.047217][ T5228]  rb_first_postorder+0x69/0x90
[   81.052070][ T5228]  btrfs_cleanup_defrag_inodes+0x2f/0x80
[   81.057737][ T5228]  close_ctree+0x2af/0xd20
[   81.062154][ T5228]  ? hook_sb_delete+0x867/0xbb0
[   81.067033][ T5228]  ? __pfx_close_ctree+0x10/0x10
[   81.071989][ T5228]  ? hook_sb_delete+0x1a3/0xbb0
[   81.076861][ T5228]  ? __pfx_fsnotify_sb_delete+0x10/0x10
[   81.082410][ T5228]  ? __pfx_evict_inodes+0x10/0x10
[   81.087436][ T5228]  ? __pfx_btrfs_put_super+0x10/0x10
[   81.092738][ T5228]  generic_shutdown_super+0x139/0x2d0
[   81.098116][ T5228]  kill_anon_super+0x3b/0x70
[   81.102709][ T5228]  btrfs_kill_super+0x41/0x50
[   81.107389][ T5228]  deactivate_locked_super+0xc4/0x130
[   81.112761][ T5228]  cleanup_mnt+0x41f/0x4b0
[   81.117175][ T5228]  ? lockdep_hardirqs_on+0x99/0x150
[   81.122371][ T5228]  task_work_run+0x24f/0x310
[   81.126965][ T5228]  ? __pfx_task_work_run+0x10/0x10
[   81.132072][ T5228]  ? do_exit+0xa2a/0x27f0
[   81.136395][ T5228]  ? kmem_cache_free+0x145/0x350
[   81.141337][ T5228]  do_exit+0xa2f/0x27f0
[   81.145493][ T5228]  ? __pfx_do_exit+0x10/0x10
[   81.150076][ T5228]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[   81.156059][ T5228]  ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[   81.162394][ T5228]  ? _raw_spin_unlock_irq+0x23/0x50
[   81.167599][ T5228]  ? lockdep_hardirqs_on+0x99/0x150
[   81.172795][ T5228]  do_group_exit+0x207/0x2c0
[   81.177388][ T5228]  __x64_sys_exit_group+0x3f/0x40
[   81.182409][ T5228]  x64_sys_call+0x2634/0x2640
[   81.187091][ T5228]  do_syscall_64+0xf3/0x230
[   81.191681][ T5228]  ? clear_bhb_loop+0x35/0x90
[   81.196366][ T5228]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   81.202356][ T5228] RIP: 0033:0x7f3eb13f89c9
[   81.206781][ T5228] Code: Unable to access opcode bytes at 0x7f3eb13f899f.
[   81.213791][ T5228] RSP: 002b:00007fffd166e788 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   81.222567][ T5228] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f3eb13f89c9
[   81.230551][ T5228] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001
[   81.238530][ T5228] RBP: 00007f3eb147b390 R08: ffffffffffffffb8 R09: 0000000000000000
[   81.246511][ T5228] R10: 0000000000001000 R11: 0000000000000246 R12: 00007f3eb147b390
[   81.254498][ T5228] R13: 0000000000000000 R14: 00007f3eb147c100 R15: 00007f3eb13c6980
[   81.262479][ T5228]  </TASK>
[   81.265491][ T5228] 
[   81.267808][ T5228] Allocated by task 5231:
[   81.272144][ T5228]  kasan_save_track+0x3f/0x80
[   81.276842][ T5228]  __kasan_slab_alloc+0x66/0x80
[   81.281708][ T5228]  kmem_cache_alloc_noprof+0x135/0x2a0
[   81.287181][ T5228]  btrfs_add_inode_defrag+0x15c/0x790
[   81.292571][ T5228]  cow_file_range+0x380/0x11f0
[   81.297334][ T5228]  btrfs_run_delalloc_range+0x33d/0xf70
[   81.302962][ T5228]  writepage_delalloc+0x482/0x7d0
[   81.308011][ T5228]  btrfs_writepages+0x1157/0x2370
[   81.313121][ T5228]  do_writepages+0x35d/0x870
[   81.317735][ T5228]  filemap_fdatawrite_wbc+0x125/0x180
[   81.323118][ T5228]  filemap_fdatawrite_range+0x120/0x180
[   81.328670][ T5228]  btrfs_sync_file+0x3ac/0x1230
[   81.333539][ T5228]  btrfs_do_write_iter+0x5e0/0x760
[   81.338644][ T5228]  do_iter_readv_writev+0x608/0x890
[   81.343842][ T5228]  vfs_writev+0x376/0xba0
[   81.348174][ T5228]  __se_sys_pwritev2+0x1ca/0x2d0
[   81.353105][ T5228]  do_syscall_64+0xf3/0x230
[   81.357603][ T5228]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   81.363494][ T5228] 
[   81.365818][ T5228] Freed by task 5231:
[   81.369808][ T5228]  kasan_save_track+0x3f/0x80
[   81.374608][ T5228]  kasan_save_free_info+0x40/0x50
[   81.379651][ T5228]  poison_slab_object+0xe0/0x150
[   81.384594][ T5228]  __kasan_slab_free+0x37/0x60
[   81.389470][ T5228]  kmem_cache_free+0x145/0x350
[   81.394349][ T5228]  btrfs_cleanup_defrag_inodes+0x51/0x80
[   81.400012][ T5228]  btrfs_reconfigure+0x269c/0x2d40
[   81.405129][ T5228]  reconfigure_super+0x445/0x880
[   81.410152][ T5228]  path_mount+0xc22/0xfa0
[   81.414495][ T5228]  __se_sys_mount+0x2d6/0x3c0
[   81.419176][ T5228]  do_syscall_64+0xf3/0x230
[   81.423679][ T5228]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   81.429587][ T5228] 
[   81.431919][ T5228] The buggy address belongs to the object at ffff88807421d000
[   81.431919][ T5228]  which belongs to the cache btrfs_inode_defrag of size 56
[   81.446488][ T5228] The buggy address is located 16 bytes inside of
[   81.446488][ T5228]  freed 56-byte region [ffff88807421d000, ffff88807421d038)
[   81.460108][ T5228] 
[   81.462473][ T5228] The buggy address belongs to the physical page:
[   81.468896][ T5228] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7421d
[   81.477663][ T5228] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[   81.484814][ T5228] page_type: 0xfdffffff(slab)
[   81.489491][ T5228] raw: 00fff00000000000 ffff8880349ec640 dead000000000122 0000000000000000
[   81.498259][ T5228] raw: 0000000000000000 00000000802e002e 00000001fdffffff 0000000000000000
[   81.506857][ T5228] page dumped because: kasan: bad access detected
[   81.513266][ T5228] page_owner tracks the page as allocated
[   81.518969][ T5228] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5231, tgid 5231 (syz-executor964), ts 80342887902, free_ts 72799362737
[   81.538689][ T5228]  post_alloc_hook+0x1f3/0x230
[   81.543618][ T5228]  get_page_from_freelist+0x2e4c/0x2f10
[   81.549357][ T5228]  __alloc_pages_noprof+0x256/0x6c0
[   81.554754][ T5228]  alloc_slab_page+0x5f/0x120
[   81.559546][ T5228]  allocate_slab+0x5a/0x2f0
[   81.564064][ T5228]  ___slab_alloc+0xcd1/0x14b0
[   81.568772][ T5228]  __slab_alloc+0x58/0xa0
[   81.573117][ T5228]  kmem_cache_alloc_noprof+0x1c1/0x2a0
[   81.578947][ T5228]  btrfs_add_inode_defrag+0x15c/0x790
[   81.584421][ T5228]  cow_file_range+0x380/0x11f0
[   81.589202][ T5228]  btrfs_run_delalloc_range+0x33d/0xf70
[   81.594758][ T5228]  writepage_delalloc+0x482/0x7d0
[   81.599781][ T5228]  btrfs_writepages+0x1157/0x2370
[   81.604826][ T5228]  do_writepages+0x35d/0x870
[   81.609443][ T5228]  filemap_fdatawrite_wbc+0x125/0x180
[   81.614913][ T5228]  filemap_fdatawrite_range+0x120/0x180
[   81.620464][ T5228] page last free pid 5218 tgid 5218 stack trace:
[   81.626814][ T5228]  free_unref_page+0xd19/0xea0
[   81.631600][ T5228]  __folio_put+0x2c8/0x440
[   81.636023][ T5228]  pipe_read+0x6ed/0x13e0
[   81.640443][ T5228]  vfs_read+0x9bb/0xbc0
[   81.644751][ T5228]  ksys_read+0x1a0/0x2c0
[   81.649013][ T5228]  do_syscall_64+0xf3/0x230
[   81.653526][ T5228]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   81.659426][ T5228] 
[   81.661829][ T5228] Memory state around the buggy address:
[   81.667484][ T5228]  ffff88807421cf00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   81.675554][ T5228]  ffff88807421cf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   81.683726][ T5228] >ffff88807421d000: fa fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc
[   81.691807][ T5228]                          ^
[   81.696405][ T5228]  ffff88807421d080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   81.704472][ T5228]  ffff88807421d100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   81.712551][ T5228] ==================================================================
[   81.721086][ T5228] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   81.728319][ T5228] CPU: 1 UID: 0 PID: 5228 Comm: syz-executor964 Not tainted 6.11.0-syzkaller-02520-gadfc3ded5c33 #0
[   81.739456][ T5228] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
[   81.749516][ T5228] Call Trace:
[   81.752800][ T5228]  <TASK>
[   81.755823][ T5228]  dump_stack_lvl+0x241/0x360
[   81.760515][ T5228]  ? __pfx_dump_stack_lvl+0x10/0x10
[   81.765725][ T5228]  ? __pfx__printk+0x10/0x10
[   81.770334][ T5228]  ? vscnprintf+0x5d/0x90
[   81.774682][ T5228]  panic+0x349/0x860
[   81.778585][ T5228]  ? check_panic_on_warn+0x21/0xb0
[   81.783701][ T5228]  ? __pfx_panic+0x10/0x10
[   81.788131][ T5228]  ? mark_lock+0x9a/0x350
[   81.792494][ T5228]  ? _raw_spin_unlock_irqrestore+0xd8/0x140
[   81.798407][ T5228]  ? _raw_spin_unlock_irqrestore+0xdd/0x140
[   81.804340][ T5228]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   81.810855][ T5228]  ? print_report+0x502/0x550
[   81.815541][ T5228]  check_panic_on_warn+0x86/0xb0
[   81.820489][ T5228]  ? rb_first_postorder+0x69/0x90
[   81.825538][ T5228]  end_report+0x77/0x160
[   81.829799][ T5228]  kasan_report+0x154/0x180
[   81.834317][ T5228]  ? rb_first_postorder+0x69/0x90
[   81.839352][ T5228]  rb_first_postorder+0x69/0x90
[   81.844323][ T5228]  btrfs_cleanup_defrag_inodes+0x2f/0x80
[   81.850053][ T5228]  close_ctree+0x2af/0xd20
[   81.854482][ T5228]  ? hook_sb_delete+0x867/0xbb0
[   81.859342][ T5228]  ? __pfx_close_ctree+0x10/0x10
[   81.864309][ T5228]  ? hook_sb_delete+0x1a3/0xbb0
[   81.869185][ T5228]  ? __pfx_fsnotify_sb_delete+0x10/0x10
[   81.874756][ T5228]  ? __pfx_evict_inodes+0x10/0x10
[   81.879789][ T5228]  ? __pfx_btrfs_put_super+0x10/0x10
[   81.885168][ T5228]  generic_shutdown_super+0x139/0x2d0
[   81.890552][ T5228]  kill_anon_super+0x3b/0x70
[   81.895154][ T5228]  btrfs_kill_super+0x41/0x50
[   81.899837][ T5228]  deactivate_locked_super+0xc4/0x130
[   81.905219][ T5228]  cleanup_mnt+0x41f/0x4b0
[   81.909645][ T5228]  ? lockdep_hardirqs_on+0x99/0x150
[   81.914858][ T5228]  task_work_run+0x24f/0x310
[   81.919545][ T5228]  ? __pfx_task_work_run+0x10/0x10
[   81.924659][ T5228]  ? do_exit+0xa2a/0x27f0
[   81.928999][ T5228]  ? kmem_cache_free+0x145/0x350
[   81.933946][ T5228]  do_exit+0xa2f/0x27f0
[   81.938123][ T5228]  ? __pfx_do_exit+0x10/0x10
[   81.942802][ T5228]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[   81.948796][ T5228]  ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[   81.955137][ T5228]  ? _raw_spin_unlock_irq+0x23/0x50
[   81.960353][ T5228]  ? lockdep_hardirqs_on+0x99/0x150
[   81.965557][ T5228]  do_group_exit+0x207/0x2c0
[   81.970150][ T5228]  __x64_sys_exit_group+0x3f/0x40
[   81.975177][ T5228]  x64_sys_call+0x2634/0x2640
[   81.979883][ T5228]  do_syscall_64+0xf3/0x230
[   81.984916][ T5228]  ? clear_bhb_loop+0x35/0x90
[   81.989691][ T5228]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   81.995591][ T5228] RIP: 0033:0x7f3eb13f89c9
[   82.000007][ T5228] Code: Unable to access opcode bytes at 0x7f3eb13f899f.
[   82.007022][ T5228] RSP: 002b:00007fffd166e788 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   82.015440][ T5228] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f3eb13f89c9
[   82.023438][ T5228] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001
[   82.031412][ T5228] RBP: 00007f3eb147b390 R08: ffffffffffffffb8 R09: 0000000000000000
[   82.039408][ T5228] R10: 0000000000001000 R11: 0000000000000246 R12: 00007f3eb147b390
[   82.047383][ T5228] R13: 0000000000000000 R14: 00007f3eb147c100 R15: 00007f3eb13c6980
[   82.055400][ T5228]  </TASK>
[   82.058656][ T5228] Kernel Offset: disabled
[   82.063008][ T5228] Rebooting in 86400 seconds..