ci2-android-6-12-rust/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-6-12-rust/syz-executor2349603544 <...> Warning: Permanently added '10.128.0.218' (ED25519) to the list of known hosts. execve("ci2-android-6-12-rust/syz-executor2349603544", ["ci2-android-6-12-rust/syz-executor2349603544"], 0x7fff8953dc40 /* 10 vars */) = 0 brk(NULL) = 0x55558b039000 brk(0x55558b039d40) = 0x55558b039d40 arch_prctl(ARCH_SET_FS, 0x55558b0393c0) = 0 set_tid_address(0x55558b039690) = 312 set_robust_list(0x55558b0396a0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-6-12-rust/syz-executor2349603544", 4096) = 50 getrandom("\x96\xa9\xe2\xa1\xbc\x3c\xb7\xc0", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55558b039d40 brk(0x55558b05ad40) = 0x55558b05ad40 brk(0x55558b05b000) = 0x55558b05b000 mprotect(0x7fdb47445000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 chmod("/dev/raw-gadget", 0666) = 0 getrandom("\x2e\xbc\xad\x0a\x61\x6f\xf7\x41", 8, GRND_NONBLOCK) = 8 mkdir("./syzkaller.Qa7nAF", 0700) = 0 chmod("./syzkaller.Qa7nAF", 0777) = 0 chdir("./syzkaller.Qa7nAF") = 0 unshare(CLONE_NEWPID) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55558b039690) = 313 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-12-rust/strace-static-x86_64: Process 313 attached [pid 313] set_robust_list(0x55558b0396a0, 24) = 0 [pid 313] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 313] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 313] getppid() = 0 [pid 313] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 313] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 313] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 313] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 313] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 313] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 313] unshare(CLONE_NEWNS) = 0 [pid 313] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 313] unshare(CLONE_NEWIPC) = -1 EINVAL (Invalid argument) [pid 313] unshare(CLONE_NEWCGROUP) = 0 [pid 313] unshare(CLONE_NEWUTS) = 0 [pid 313] unshare(CLONE_SYSVSEM) = 0 [pid 313] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 313] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 313] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 313] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 313] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 313] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 313] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 313] getpid() = 1 [pid 313] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<) = 0 [pid 313] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 313] fstat(3, {st_mode=S_IFDIR|0700, st_size=80, ...}) = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 4 entries */, 32768) = 112 [ 23.956386][ T36] audit: type=1400 audit(1786956408.570:66): avc: denied { mounton } for pid=313 comm="syz-executor234" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 23.978564][ T36] audit: type=1400 audit(1786956408.610:67): avc: denied { mounton } for pid=313 comm="syz-executor234" path="/root/syzkaller.Qa7nAF/syz-tmp" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [pid 313] umount2("./0/config", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 [pid 313] umount2("./0/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./0/config", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] umount2("./0/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./0/config", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 313] fstat(4, {st_mode=S_IFDIR|0700, st_size=40, ...}) = 0 [pid 313] getdents64(4, 0x55558b0427a0 /* 2 entries */, 32768) = 48 [pid 313] getdents64(4, 0x55558b0427a0 /* 0 entries */, 32768) = 0 [pid 313] close(4) = 0 [pid 313] rmdir("./0/config") = 0 [pid 313] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] unlink("./0/binderfs") = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 0 entries */, 32768) = 0 [pid 313] close(3) = 0 [pid 313] rmdir("./0") = 0 [pid 313] mkdir("./1", 0777) = 0 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 313] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-12-rust/strace-static-x86_64: Process 316 attached [pid 316] set_robust_list(0x55558b0396a0, 24) = 0 [pid 316] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 316] chdir("./1") = 0 [pid 313] <... clone resumed>, child_tidptr=0x55558b039690) = 3 [pid 316] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 313] rt_sigprocmask(SIG_SETMASK, [] [pid 316] <... prctl resumed>) = 0 [pid 313] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 316] setpgid(0, 0) = 0 [pid 316] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 316] write(3, "1000", 4) = 4 [pid 316] close(3) = 0 [pid 316] read(200, 0x7fff2b3a1cd0, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 316] symlink("/dev/binderfs", "./binderfs") = 0 [pid 316] write(1, "executing program\n", 18) = 18 executing program [pid 316] mkdirat(AT_FDCWD, "./config", 0777) = 0 [pid 316] mount(NULL, "./config", "configfs", 0, NULL) = 0 [pid 316] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 316] rmdir(NULL) = -1 EFAULT (Bad address) [pid 316] rmdir("./config/usb_gadget/g1") = 0 [pid 316] close(3) = -1 EBADF (Bad file descriptor) [pid 316] close(4) = -1 EBADF (Bad file descriptor) [pid 316] close(5) = -1 EBADF (Bad file descriptor) [pid 316] close(6) = -1 EBADF (Bad file descriptor) [pid 316] close(7) = -1 EBADF (Bad file descriptor) [pid 316] close(8) = -1 EBADF (Bad file descriptor) [pid 316] close(9) = -1 EBADF (Bad file descriptor) [pid 316] close(10) = -1 EBADF (Bad file descriptor) [pid 316] close(11) = -1 EBADF (Bad file descriptor) [pid 316] close(12) = -1 EBADF (Bad file descriptor) [pid 316] close(13) = -1 EBADF (Bad file descriptor) [pid 316] close(14) = -1 EBADF (Bad file descriptor) [pid 316] close(15) = -1 EBADF (Bad file descriptor) [pid 316] close(16) = -1 EBADF (Bad file descriptor) [pid 316] close(17) = -1 EBADF (Bad file descriptor) [pid 316] close(18) = -1 EBADF (Bad file descriptor) [pid 316] close(19) = -1 EBADF (Bad file descriptor) [pid 316] close(20) = -1 EBADF (Bad file descriptor) [pid 316] close(21) = -1 EBADF (Bad file descriptor) [pid 316] close(22) = -1 EBADF (Bad file descriptor) [pid 316] close(23) = -1 EBADF (Bad file descriptor) [pid 316] close(24) = -1 EBADF (Bad file descriptor) [pid 316] close(25) = -1 EBADF (Bad file descriptor) [pid 316] close(26) = -1 EBADF (Bad file descriptor) [pid 316] close(27) = -1 EBADF (Bad file descriptor) [pid 316] close(28) = -1 EBADF (Bad file descriptor) [pid 316] close(29) = -1 EBADF (Bad file descriptor) [pid 316] exit_group(0) = ? [pid 316] +++ exited with 0 +++ [pid 313] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 313] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 313] umount2("./1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 313] fstat(3, {st_mode=S_IFDIR|0700, st_size=80, ...}) = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 4 entries */, 32768) = 112 [pid 313] umount2("./1/config", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 [pid 313] umount2("./1/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./1/config", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] umount2("./1/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./1/config", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 313] fstat(4, {st_mode=S_IFDIR|0700, st_size=40, ...}) = 0 [pid 313] getdents64(4, 0x55558b0427a0 /* 2 entries */, 32768) = 48 [pid 313] getdents64(4, 0x55558b0427a0 /* 0 entries */, 32768) = 0 [pid 313] close(4) = 0 [pid 313] rmdir("./1/config") = 0 [pid 313] umount2("./1/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] unlink("./1/binderfs") = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 0 entries */, 32768) = 0 [pid 313] close(3) = 0 [pid 313] rmdir("./1") = 0 [pid 313] mkdir("./2", 0777) = 0 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 313] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-12-rust/strace-static-x86_64: Process 317 attached [pid 317] set_robust_list(0x55558b0396a0, 24) = 0 [pid 317] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 317] chdir("./2" [pid 313] <... clone resumed>, child_tidptr=0x55558b039690) = 4 [pid 313] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 317] <... chdir resumed>) = 0 [pid 317] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 317] setpgid(0, 0) = 0 [pid 317] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 317] write(3, "1000", 4) = 4 [pid 317] close(3) = 0 [pid 317] read(200, 0x7fff2b3a1cd0, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 317] symlink("/dev/binderfs", "./binderfs") = 0 [pid 317] write(1, "executing program\n", 18) = 18 executing program [pid 317] mkdirat(AT_FDCWD, "./config", 0777) = 0 [pid 317] mount(NULL, "./config", "configfs", 0, NULL) = 0 [pid 317] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 317] rmdir(NULL) = -1 EFAULT (Bad address) [pid 317] rmdir("./config/usb_gadget/g1") = 0 [pid 317] close(3) = -1 EBADF (Bad file descriptor) [pid 317] close(4) = -1 EBADF (Bad file descriptor) [pid 317] close(5) = -1 EBADF (Bad file descriptor) [pid 317] close(6) = -1 EBADF (Bad file descriptor) [pid 317] close(7) = -1 EBADF (Bad file descriptor) [pid 317] close(8) = -1 EBADF (Bad file descriptor) [pid 317] close(9) = -1 EBADF (Bad file descriptor) [ 24.003638][ T36] audit: type=1400 audit(1786956408.610:68): avc: denied { mount } for pid=313 comm="syz-executor234" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 24.025958][ T36] audit: type=1400 audit(1786956408.610:69): avc: denied { mounton } for pid=313 comm="syz-executor234" path="/root/syzkaller.Qa7nAF/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [pid 317] close(10) = -1 EBADF (Bad file descriptor) [pid 317] close(11) = -1 EBADF (Bad file descriptor) [pid 317] close(12) = -1 EBADF (Bad file descriptor) [pid 317] close(13) = -1 EBADF (Bad file descriptor) [pid 317] close(14) = -1 EBADF (Bad file descriptor) [pid 317] close(15) = -1 EBADF (Bad file descriptor) [pid 317] close(16) = -1 EBADF (Bad file descriptor) [pid 317] close(17) = -1 EBADF (Bad file descriptor) [pid 317] close(18) = -1 EBADF (Bad file descriptor) [pid 317] close(19) = -1 EBADF (Bad file descriptor) [pid 317] close(20) = -1 EBADF (Bad file descriptor) [pid 317] close(21) = -1 EBADF (Bad file descriptor) [pid 317] close(22) = -1 EBADF (Bad file descriptor) [pid 317] close(23) = -1 EBADF (Bad file descriptor) [pid 317] close(24) = -1 EBADF (Bad file descriptor) [pid 317] close(25) = -1 EBADF (Bad file descriptor) [pid 317] close(26) = -1 EBADF (Bad file descriptor) [pid 317] close(27) = -1 EBADF (Bad file descriptor) [pid 317] close(28) = -1 EBADF (Bad file descriptor) [pid 317] close(29) = -1 EBADF (Bad file descriptor) [pid 317] exit_group(0) = ? [pid 317] +++ exited with 0 +++ [pid 313] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 313] umount2("./2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 313] fstat(3, {st_mode=S_IFDIR|0700, st_size=80, ...}) = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 4 entries */, 32768) = 112 [pid 313] umount2("./2/config", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 [pid 313] umount2("./2/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./2/config", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] umount2("./2/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./2/config", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 313] fstat(4, {st_mode=S_IFDIR|0700, st_size=40, ...}) = 0 [pid 313] getdents64(4, 0x55558b0427a0 /* 2 entries */, 32768) = 48 [pid 313] getdents64(4, 0x55558b0427a0 /* 0 entries */, 32768) = 0 [pid 313] close(4) = 0 [pid 313] rmdir("./2/config") = 0 [pid 313] umount2("./2/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./2/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] unlink("./2/binderfs") = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 0 entries */, 32768) = 0 [pid 313] close(3) = 0 [pid 313] rmdir("./2") = 0 [pid 313] mkdir("./3", 0777) = 0 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 313] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55558b039690) = 5 [pid 313] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-12-rust/strace-static-x86_64: Process 318 attached [pid 318] set_robust_list(0x55558b0396a0, 24) = 0 [pid 318] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 318] chdir("./3") = 0 [pid 318] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 318] setpgid(0, 0) = 0 [pid 318] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 318] write(3, "1000", 4) = 4 [pid 318] close(3) = 0 [pid 318] read(200, 0x7fff2b3a1cd0, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 318] symlink("/dev/binderfs", "./binderfs") = 0 [pid 318] write(1, "executing program\n", 18) = 18 [pid 318] mkdirat(AT_FDCWD, "./config", 0777) = 0 executing program [pid 318] mount(NULL, "./config", "configfs", 0, NULL) = 0 [pid 318] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 318] rmdir(NULL) = -1 EFAULT (Bad address) [pid 318] rmdir("./config/usb_gadget/g1") = 0 [pid 318] close(3) = -1 EBADF (Bad file descriptor) [pid 318] close(4) = -1 EBADF (Bad file descriptor) [pid 318] close(5) = -1 EBADF (Bad file descriptor) [pid 318] close(6) = -1 EBADF (Bad file descriptor) [pid 318] close(7) = -1 EBADF (Bad file descriptor) [pid 318] close(8) = -1 EBADF (Bad file descriptor) [pid 318] close(9) = -1 EBADF (Bad file descriptor) [pid 318] close(10) = -1 EBADF (Bad file descriptor) [pid 318] close(11) = -1 EBADF (Bad file descriptor) [pid 318] close(12) = -1 EBADF (Bad file descriptor) [pid 318] close(13) = -1 EBADF (Bad file descriptor) [pid 318] close(14) = -1 EBADF (Bad file descriptor) [pid 318] close(15) = -1 EBADF (Bad file descriptor) [pid 318] close(16) = -1 EBADF (Bad file descriptor) [pid 318] close(17) = -1 EBADF (Bad file descriptor) [pid 318] close(18) = -1 EBADF (Bad file descriptor) [pid 318] close(19) = -1 EBADF (Bad file descriptor) [pid 318] close(20) = -1 EBADF (Bad file descriptor) [pid 318] close(21) = -1 EBADF (Bad file descriptor) [pid 318] close(22) = -1 EBADF (Bad file descriptor) [pid 318] close(23) = -1 EBADF (Bad file descriptor) [pid 318] close(24) = -1 EBADF (Bad file descriptor) [pid 318] close(25) = -1 EBADF (Bad file descriptor) [pid 318] close(26) = -1 EBADF (Bad file descriptor) [pid 318] close(27) = -1 EBADF (Bad file descriptor) [pid 318] close(28) = -1 EBADF (Bad file descriptor) [pid 318] close(29) = -1 EBADF (Bad file descriptor) [pid 318] exit_group(0) = ? [pid 318] +++ exited with 0 +++ [pid 313] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 313] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 313] umount2("./3", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 313] fstat(3, {st_mode=S_IFDIR|0700, st_size=80, ...}) = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 4 entries */, 32768) = 112 [pid 313] umount2("./3/config", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 [pid 313] umount2("./3/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./3/config", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] umount2("./3/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./3/config", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 313] fstat(4, {st_mode=S_IFDIR|0700, st_size=40, ...}) = 0 [pid 313] getdents64(4, 0x55558b0427a0 /* 2 entries */, 32768) = 48 [pid 313] getdents64(4, 0x55558b0427a0 /* 0 entries */, 32768) = 0 [pid 313] close(4) = 0 [pid 313] rmdir("./3/config") = 0 [pid 313] umount2("./3/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./3/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] unlink("./3/binderfs") = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 0 entries */, 32768) = 0 [pid 313] close(3) = 0 [pid 313] rmdir("./3") = 0 [pid 313] mkdir("./4", 0777) = 0 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 313] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-12-rust/strace-static-x86_64: Process 319 attached [pid 319] set_robust_list(0x55558b0396a0, 24) = 0 [pid 319] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 319] chdir("./4") = 0 [pid 313] <... clone resumed>, child_tidptr=0x55558b039690) = 6 [pid 319] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 313] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 319] <... prctl resumed>) = 0 [pid 319] setpgid(0, 0) = 0 [pid 319] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 319] write(3, "1000", 4) = 4 [pid 319] close(3) = 0 [pid 319] read(200, 0x7fff2b3a1cd0, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 319] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 319] write(1, "executing program\n", 18) = 18 [pid 319] mkdirat(AT_FDCWD, "./config", 0777) = 0 [pid 319] mount(NULL, "./config", "configfs", 0, NULL) = 0 [pid 319] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 319] rmdir(NULL) = -1 EFAULT (Bad address) [pid 319] rmdir("./config/usb_gadget/g1") = 0 [pid 319] close(3) = -1 EBADF (Bad file descriptor) [pid 319] close(4) = -1 EBADF (Bad file descriptor) [pid 319] close(5) = -1 EBADF (Bad file descriptor) [ 24.052346][ T36] audit: type=1400 audit(1786956408.610:70): avc: denied { mount } for pid=313 comm="syz-executor234" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 24.075472][ T36] audit: type=1400 audit(1786956408.610:71): avc: denied { mounton } for pid=313 comm="syz-executor234" path="/root/syzkaller.Qa7nAF/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [pid 319] close(6) = -1 EBADF (Bad file descriptor) [pid 319] close(7) = -1 EBADF (Bad file descriptor) [pid 319] close(8) = -1 EBADF (Bad file descriptor) [pid 319] close(9) = -1 EBADF (Bad file descriptor) [pid 319] close(10) = -1 EBADF (Bad file descriptor) [pid 319] close(11) = -1 EBADF (Bad file descriptor) [pid 319] close(12) = -1 EBADF (Bad file descriptor) [pid 319] close(13) = -1 EBADF (Bad file descriptor) [pid 319] close(14) = -1 EBADF (Bad file descriptor) [pid 319] close(15) = -1 EBADF (Bad file descriptor) [pid 319] close(16) = -1 EBADF (Bad file descriptor) [pid 319] close(17) = -1 EBADF (Bad file descriptor) [pid 319] close(18) = -1 EBADF (Bad file descriptor) [pid 319] close(19) = -1 EBADF (Bad file descriptor) [pid 319] close(20) = -1 EBADF (Bad file descriptor) [pid 319] close(21) = -1 EBADF (Bad file descriptor) [pid 319] close(22) = -1 EBADF (Bad file descriptor) [pid 319] close(23) = -1 EBADF (Bad file descriptor) [pid 319] close(24) = -1 EBADF (Bad file descriptor) [pid 319] close(25) = -1 EBADF (Bad file descriptor) [pid 319] close(26) = -1 EBADF (Bad file descriptor) [pid 319] close(27) = -1 EBADF (Bad file descriptor) [pid 319] close(28) = -1 EBADF (Bad file descriptor) [pid 319] close(29) = -1 EBADF (Bad file descriptor) [pid 319] exit_group(0) = ? [pid 319] +++ exited with 0 +++ [pid 313] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 313] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 313] umount2("./4", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 313] fstat(3, {st_mode=S_IFDIR|0700, st_size=80, ...}) = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 4 entries */, 32768) = 112 [pid 313] umount2("./4/config", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 [pid 313] umount2("./4/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./4/config", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] umount2("./4/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./4/config", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 313] fstat(4, {st_mode=S_IFDIR|0700, st_size=40, ...}) = 0 [pid 313] getdents64(4, 0x55558b0427a0 /* 2 entries */, 32768) = 48 [pid 313] getdents64(4, 0x55558b0427a0 /* 0 entries */, 32768) = 0 [pid 313] close(4) = 0 [pid 313] rmdir("./4/config") = 0 [pid 313] umount2("./4/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./4/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] unlink("./4/binderfs") = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 0 entries */, 32768) = 0 [pid 313] close(3) = 0 [pid 313] rmdir("./4") = 0 [pid 313] mkdir("./5", 0777) = 0 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 313] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-12-rust/strace-static-x86_64: Process 320 attached [pid 320] set_robust_list(0x55558b0396a0, 24) = 0 [pid 320] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 320] chdir("./5") = 0 [pid 313] <... clone resumed>, child_tidptr=0x55558b039690) = 7 [pid 313] rt_sigprocmask(SIG_SETMASK, [] [pid 320] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 313] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 320] <... prctl resumed>) = 0 [pid 320] setpgid(0, 0) = 0 [pid 320] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 320] write(3, "1000", 4) = 4 [pid 320] close(3) = 0 [pid 320] read(200, 0x7fff2b3a1cd0, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 320] symlink("/dev/binderfs", "./binderfs") = 0 [pid 320] write(1, "executing program\n", 18) = 18 executing program [pid 320] mkdirat(AT_FDCWD, "./config", 0777) = 0 [pid 320] mount(NULL, "./config", "configfs", 0, NULL) = 0 [pid 320] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 320] rmdir(NULL) = -1 EFAULT (Bad address) [pid 320] rmdir("./config/usb_gadget/g1") = 0 [pid 320] close(3) = -1 EBADF (Bad file descriptor) [pid 320] close(4) = -1 EBADF (Bad file descriptor) [pid 320] close(5) = -1 EBADF (Bad file descriptor) [pid 320] close(6) = -1 EBADF (Bad file descriptor) [pid 320] close(7) = -1 EBADF (Bad file descriptor) [pid 320] close(8) = -1 EBADF (Bad file descriptor) [pid 320] close(9) = -1 EBADF (Bad file descriptor) [pid 320] close(10) = -1 EBADF (Bad file descriptor) [pid 320] close(11) = -1 EBADF (Bad file descriptor) [pid 320] close(12) = -1 EBADF (Bad file descriptor) [pid 320] close(13) = -1 EBADF (Bad file descriptor) [pid 320] close(14) = -1 EBADF (Bad file descriptor) [pid 320] close(15) = -1 EBADF (Bad file descriptor) [pid 320] close(16) = -1 EBADF (Bad file descriptor) [pid 320] close(17) = -1 EBADF (Bad file descriptor) [pid 320] close(18) = -1 EBADF (Bad file descriptor) [pid 320] close(19) = -1 EBADF (Bad file descriptor) [pid 320] close(20) = -1 EBADF (Bad file descriptor) [pid 320] close(21) = -1 EBADF (Bad file descriptor) [pid 320] close(22) = -1 EBADF (Bad file descriptor) [pid 320] close(23) = -1 EBADF (Bad file descriptor) [pid 320] close(24) = -1 EBADF (Bad file descriptor) [pid 320] close(25) = -1 EBADF (Bad file descriptor) [pid 320] close(26) = -1 EBADF (Bad file descriptor) [pid 320] close(27) = -1 EBADF (Bad file descriptor) [pid 320] close(28) = -1 EBADF (Bad file descriptor) [pid 320] close(29) = -1 EBADF (Bad file descriptor) [pid 320] exit_group(0) = ? [pid 320] +++ exited with 0 +++ [pid 313] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=7, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 313] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 313] umount2("./5", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 313] fstat(3, {st_mode=S_IFDIR|0700, st_size=80, ...}) = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 4 entries */, 32768) = 112 [pid 313] umount2("./5/config", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 [pid 313] umount2("./5/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./5/config", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] umount2("./5/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./5/config", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 313] fstat(4, {st_mode=S_IFDIR|0700, st_size=40, ...}) = 0 [pid 313] getdents64(4, 0x55558b0427a0 /* 2 entries */, 32768) = 48 [pid 313] getdents64(4, 0x55558b0427a0 /* 0 entries */, 32768) = 0 [pid 313] close(4) = 0 [pid 313] rmdir("./5/config") = 0 [pid 313] umount2("./5/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./5/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] unlink("./5/binderfs") = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 0 entries */, 32768) = 0 [pid 313] close(3) = 0 [pid 313] rmdir("./5") = 0 [pid 313] mkdir("./6", 0777) = 0 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 313] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-12-rust/strace-static-x86_64: Process 321 attached , child_tidptr=0x55558b039690) = 8 [pid 313] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 321] set_robust_list(0x55558b0396a0, 24) = 0 [pid 321] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 321] chdir("./6") = 0 [pid 321] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 321] setpgid(0, 0) = 0 [pid 321] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 321] write(3, "1000", 4) = 4 [pid 321] close(3) = 0 [pid 321] read(200, 0x7fff2b3a1cd0, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 321] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 321] write(1, "executing program\n", 18) = 18 [pid 321] mkdirat(AT_FDCWD, "./config", 0777) = 0 [pid 321] mount(NULL, "./config", "configfs", 0, NULL) = 0 [pid 321] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 321] rmdir(NULL) = -1 EFAULT (Bad address) [pid 321] rmdir("./config/usb_gadget/g1") = 0 [pid 321] close(3) = -1 EBADF (Bad file descriptor) [pid 321] close(4) = -1 EBADF (Bad file descriptor) [pid 321] close(5) = -1 EBADF (Bad file descriptor) [pid 321] close(6) = -1 EBADF (Bad file descriptor) [pid 321] close(7) = -1 EBADF (Bad file descriptor) [pid 321] close(8) = -1 EBADF (Bad file descriptor) [pid 321] close(9) = -1 EBADF (Bad file descriptor) [pid 321] close(10) = -1 EBADF (Bad file descriptor) [pid 321] close(11) = -1 EBADF (Bad file descriptor) [pid 321] close(12) = -1 EBADF (Bad file descriptor) [pid 321] close(13) = -1 EBADF (Bad file descriptor) [pid 321] close(14) = -1 EBADF (Bad file descriptor) [pid 321] close(15) = -1 EBADF (Bad file descriptor) [pid 321] close(16) = -1 EBADF (Bad file descriptor) [pid 321] close(17) = -1 EBADF (Bad file descriptor) [pid 321] close(18) = -1 EBADF (Bad file descriptor) [pid 321] close(19) = -1 EBADF (Bad file descriptor) [pid 321] close(20) = -1 EBADF (Bad file descriptor) [pid 321] close(21) = -1 EBADF (Bad file descriptor) [pid 321] close(22) = -1 EBADF (Bad file descriptor) [pid 321] close(23) = -1 EBADF (Bad file descriptor) [pid 321] close(24) = -1 EBADF (Bad file descriptor) [pid 321] close(25) = -1 EBADF (Bad file descriptor) [pid 321] close(26) = -1 EBADF (Bad file descriptor) [pid 321] close(27) = -1 EBADF (Bad file descriptor) [pid 321] close(28) = -1 EBADF (Bad file descriptor) [pid 321] close(29) = -1 EBADF (Bad file descriptor) [pid 321] exit_group(0) = ? [pid 321] +++ exited with 0 +++ [pid 313] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=8, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 313] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 313] umount2("./6", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 313] fstat(3, {st_mode=S_IFDIR|0700, st_size=80, ...}) = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 4 entries */, 32768) = 112 [pid 313] umount2("./6/config", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 [pid 313] umount2("./6/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./6/config", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] umount2("./6/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./6/config", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 313] fstat(4, {st_mode=S_IFDIR|0700, st_size=40, ...}) = 0 [pid 313] getdents64(4, 0x55558b0427a0 /* 2 entries */, 32768) = 48 [pid 313] getdents64(4, 0x55558b0427a0 /* 0 entries */, 32768) = 0 [pid 313] close(4) = 0 [pid 313] rmdir("./6/config") = 0 [pid 313] umount2("./6/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./6/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] unlink("./6/binderfs") = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 0 entries */, 32768) = 0 [pid 313] close(3) = 0 [pid 313] rmdir("./6") = 0 [pid 313] mkdir("./7", 0777) = 0 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 313] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55558b039690) = 9 ci2-android-6-12-rust/strace-static-x86_64: Process 322 attached [pid 322] set_robust_list(0x55558b0396a0, 24 [pid 313] rt_sigprocmask(SIG_SETMASK, [] [pid 322] <... set_robust_list resumed>) = 0 [pid 322] rt_sigprocmask(SIG_SETMASK, [] [pid 313] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 322] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 322] chdir("./7") = 0 [pid 322] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 322] setpgid(0, 0) = 0 [pid 322] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 322] write(3, "1000", 4) = 4 [pid 322] close(3) = 0 [pid 322] read(200, 0x7fff2b3a1cd0, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 322] symlink("/dev/binderfs", "./binderfs") = 0 [pid 322] write(1, "executing program\n", 18) = 18 executing program [pid 322] mkdirat(AT_FDCWD, "./config", 0777) = 0 [pid 322] mount(NULL, "./config", "configfs", 0, NULL) = 0 [pid 322] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 322] rmdir(NULL) = -1 EFAULT (Bad address) [pid 322] rmdir("./config/usb_gadget/g1") = 0 [pid 322] close(3) = -1 EBADF (Bad file descriptor) [pid 322] close(4) = -1 EBADF (Bad file descriptor) [pid 322] close(5) = -1 EBADF (Bad file descriptor) [pid 322] close(6) = -1 EBADF (Bad file descriptor) [pid 322] close(7) = -1 EBADF (Bad file descriptor) [pid 322] close(8) = -1 EBADF (Bad file descriptor) [pid 322] close(9) = -1 EBADF (Bad file descriptor) [pid 322] close(10) = -1 EBADF (Bad file descriptor) [pid 322] close(11) = -1 EBADF (Bad file descriptor) [pid 322] close(12) = -1 EBADF (Bad file descriptor) [pid 322] close(13) = -1 EBADF (Bad file descriptor) [pid 322] close(14) = -1 EBADF (Bad file descriptor) [pid 322] close(15) = -1 EBADF (Bad file descriptor) [pid 322] close(16) = -1 EBADF (Bad file descriptor) [pid 322] close(17) = -1 EBADF (Bad file descriptor) [pid 322] close(18) = -1 EBADF (Bad file descriptor) [pid 322] close(19) = -1 EBADF (Bad file descriptor) [pid 322] close(20) = -1 EBADF (Bad file descriptor) [pid 322] close(21) = -1 EBADF (Bad file descriptor) [pid 322] close(22) = -1 EBADF (Bad file descriptor) [pid 322] close(23) = -1 EBADF (Bad file descriptor) [pid 322] close(24) = -1 EBADF (Bad file descriptor) [pid 322] close(25) = -1 EBADF (Bad file descriptor) [pid 322] close(26) = -1 EBADF (Bad file descriptor) [pid 322] close(27) = -1 EBADF (Bad file descriptor) [pid 322] close(28) = -1 EBADF (Bad file descriptor) [pid 322] close(29) = -1 EBADF (Bad file descriptor) [pid 322] exit_group(0) = ? [pid 322] +++ exited with 0 +++ [pid 313] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=9, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 313] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 313] umount2("./7", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 313] fstat(3, {st_mode=S_IFDIR|0700, st_size=80, ...}) = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 4 entries */, 32768) = 112 [pid 313] umount2("./7/config", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 [pid 313] umount2("./7/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 24.103505][ T36] audit: type=1400 audit(1786956408.610:72): avc: denied { mounton } for pid=313 comm="syz-executor234" path="/root/syzkaller.Qa7nAF/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=3297 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 24.132136][ T36] audit: type=1400 audit(1786956408.610:73): avc: denied { unmount } for pid=313 comm="syz-executor234" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [pid 313] newfstatat(AT_FDCWD, "./7/config", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] umount2("./7/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./7/config", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 313] fstat(4, {st_mode=S_IFDIR|0700, st_size=40, ...}) = 0 [pid 313] getdents64(4, 0x55558b0427a0 /* 2 entries */, 32768) = 48 [pid 313] getdents64(4, 0x55558b0427a0 /* 0 entries */, 32768) = 0 [pid 313] close(4) = 0 [pid 313] rmdir("./7/config") = 0 [pid 313] umount2("./7/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./7/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] unlink("./7/binderfs") = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 0 entries */, 32768) = 0 [pid 313] close(3) = 0 [pid 313] rmdir("./7") = 0 [pid 313] mkdir("./8", 0777) = 0 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 313] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-12-rust/strace-static-x86_64: Process 323 attached , child_tidptr=0x55558b039690) = 10 [pid 323] set_robust_list(0x55558b0396a0, 24 [pid 313] rt_sigprocmask(SIG_SETMASK, [] [pid 323] <... set_robust_list resumed>) = 0 [pid 313] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 323] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 323] chdir("./8") = 0 [pid 323] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 323] setpgid(0, 0) = 0 [pid 323] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 323] write(3, "1000", 4) = 4 [pid 323] close(3) = 0 [pid 323] read(200, "\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x38\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\xc2\x46\x00\x00\x00\x02\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\xaa\xaa\xaa\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00"..., 1000) = 110 [pid 323] read(200, 0x7fff2b3a1cd0, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 323] symlink("/dev/binderfs", "./binderfs") = 0 [pid 323] write(1, "executing program\n", 18) = 18 executing program [pid 323] mkdirat(AT_FDCWD, "./config", 0777) = 0 [pid 323] mount(NULL, "./config", "configfs", 0, NULL) = 0 [pid 323] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 323] rmdir(NULL) = -1 EFAULT (Bad address) [pid 323] rmdir("./config/usb_gadget/g1") = 0 [pid 323] close(3) = -1 EBADF (Bad file descriptor) [pid 323] close(4) = -1 EBADF (Bad file descriptor) [pid 323] close(5) = -1 EBADF (Bad file descriptor) [pid 323] close(6) = -1 EBADF (Bad file descriptor) [pid 323] close(7) = -1 EBADF (Bad file descriptor) [pid 323] close(8) = -1 EBADF (Bad file descriptor) [pid 323] close(9) = -1 EBADF (Bad file descriptor) [pid 323] close(10) = -1 EBADF (Bad file descriptor) [pid 323] close(11) = -1 EBADF (Bad file descriptor) [pid 323] close(12) = -1 EBADF (Bad file descriptor) [pid 323] close(13) = -1 EBADF (Bad file descriptor) [pid 323] close(14) = -1 EBADF (Bad file descriptor) [pid 323] close(15) = -1 EBADF (Bad file descriptor) [pid 323] close(16) = -1 EBADF (Bad file descriptor) [pid 323] close(17) = -1 EBADF (Bad file descriptor) [pid 323] close(18) = -1 EBADF (Bad file descriptor) [pid 323] close(19) = -1 EBADF (Bad file descriptor) [pid 323] close(20) = -1 EBADF (Bad file descriptor) [pid 323] close(21) = -1 EBADF (Bad file descriptor) [pid 323] close(22) = -1 EBADF (Bad file descriptor) [pid 323] close(23) = -1 EBADF (Bad file descriptor) [pid 323] close(24) = -1 EBADF (Bad file descriptor) [pid 323] close(25) = -1 EBADF (Bad file descriptor) [pid 323] close(26) = -1 EBADF (Bad file descriptor) [pid 323] close(27) = -1 EBADF (Bad file descriptor) [pid 323] close(28) = -1 EBADF (Bad file descriptor) [pid 323] close(29) = -1 EBADF (Bad file descriptor) [pid 323] exit_group(0) = ? [pid 323] +++ exited with 0 +++ [pid 313] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=10, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 313] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 313] umount2("./8", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 313] fstat(3, {st_mode=S_IFDIR|0700, st_size=80, ...}) = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 4 entries */, 32768) = 112 [pid 313] umount2("./8/config", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 [pid 313] umount2("./8/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./8/config", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] umount2("./8/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./8/config", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 313] fstat(4, {st_mode=S_IFDIR|0700, st_size=40, ...}) = 0 [pid 313] getdents64(4, 0x55558b0427a0 /* 2 entries */, 32768) = 48 [pid 313] getdents64(4, 0x55558b0427a0 /* 0 entries */, 32768) = 0 [pid 313] close(4) = 0 [pid 313] rmdir("./8/config") = 0 [pid 313] umount2("./8/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./8/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] unlink("./8/binderfs") = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 0 entries */, 32768) = 0 [pid 313] close(3) = 0 [pid 313] rmdir("./8") = 0 [pid 313] mkdir("./9", 0777) = 0 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 313] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-12-rust/strace-static-x86_64: Process 324 attached , child_tidptr=0x55558b039690) = 11 [pid 313] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 324] set_robust_list(0x55558b0396a0, 24) = 0 [pid 324] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 324] chdir("./9") = 0 [pid 324] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 324] setpgid(0, 0) = 0 [pid 324] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 324] write(3, "1000", 4) = 4 [pid 324] close(3) = 0 [pid 324] read(200, 0x7fff2b3a1cd0, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 324] symlink("/dev/binderfs", "./binderfs") = 0 [pid 324] write(1, "executing program\n", 18) = 18 [pid 324] mkdirat(AT_FDCWD, "./config", 0777) = 0 executing program [pid 324] mount(NULL, "./config", "configfs", 0, NULL) = 0 [pid 324] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 324] rmdir(NULL) = -1 EFAULT (Bad address) [ 24.217845][ T324] BUG: scheduling while atomic: syz-executor234/324/0x00000002 [ 24.225441][ T324] Modules linked in: [ 24.229378][ T324] CPU: 0 UID: 0 PID: 324 Comm: syz-executor234 Not tainted syzkaller #0 119f1c0cd44458c2ddc7f806e6d4d2dd11ae7dae [ 24.229404][ T324] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 24.229420][ T324] Call Trace: [ 24.229426][ T324] [ 24.229433][ T324] __dump_stack+0x21/0x30 [ 24.229467][ T324] dump_stack_lvl+0x140/0x1c0 [ 24.229493][ T324] ? __cfi_dump_stack_lvl+0x10/0x10 [ 24.229520][ T324] dump_stack+0x19/0x20 [ 24.229543][ T324] __schedule_bug+0x12b/0x200 [ 24.229562][ T324] ? find_proxy_task+0x2460/0x2460 [ 24.229580][ T324] ? is_bpf_text_address+0x17b/0x1a0 [ 24.229606][ T324] ? kernel_text_address+0xa9/0xe0 [ 24.229630][ T324] __schedule+0xb85/0x20b0 [ 24.229653][ T324] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 24.229677][ T324] ? arch_stack_walk+0x10a/0x170 [ 24.229697][ T324] ? __sched_text_start+0x10/0x10 [ 24.229721][ T324] ? __kasan_check_read+0x15/0x20 [ 24.229741][ T324] ? rwsem_spin_on_owner+0xa4/0x3b0 [ 24.229768][ T324] ? __kasan_check_write+0x18/0x20 [ 24.229786][ T324] ? _raw_spin_lock_irq+0x93/0x120 [ 24.229807][ T324] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 24.229829][ T324] schedule+0xc5/0x240 [ 24.229847][ T324] schedule_preempt_disabled+0x14/0x30 [ 24.229860][ T324] rwsem_down_write_slowpath+0x5c9/0x1b60 [ 24.229871][ T324] ? rwsem_down_read_slowpath+0x14c0/0x14c0 [ 24.229881][ T324] ? kernel_text_address+0xa9/0xe0 [ 24.229894][ T324] ? unwind_get_return_address+0x51/0x90 [ 24.229907][ T324] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 24.229919][ T324] ? rwsem_read_trylock+0x275/0x5a0 [ 24.229933][ T324] ? downgrade_write+0x470/0x470 [ 24.229947][ T324] down_write+0x163/0x2b0 [ 24.229956][ T324] ? __cfi_down_write+0x10/0x10 [ 24.229965][ T324] ? down_read+0x7f/0xe0 [ 24.229974][ T324] ? __cfi_down_read+0x10/0x10 [ 24.229983][ T324] kernfs_remove_by_name_ns+0x8c/0x180 [ 24.229997][ T324] sysfs_unmerge_group+0xd7/0x130 [ 24.230008][ T324] dpm_sysfs_remove+0x64/0xd0 [ 24.230022][ T324] device_del+0x241/0xcf0 [ 24.230036][ T324] ? __cfi_class_find_device+0x10/0x10 [ 24.230046][ T324] ? __cfi_device_del+0x10/0x10 [ 24.230059][ T324] ? __kasan_check_write+0x18/0x20 [ 24.230069][ T324] ? kobject_put+0x1cc/0x2a0 [ 24.230081][ T324] device_destroy+0xb0/0x100 [ 24.230089][ T324] ? __cfi_device_destroy+0x10/0x10 [ 24.230103][ T324] ? __kasan_check_write+0x18/0x20 [ 24.230113][ T324] android_device_destroy+0x118/0x180 [ 24.230127][ T324] gadgets_drop+0x1d/0x30 [ 24.230136][ T324] ? __cfi_gadgets_drop+0x10/0x10 [ 24.230145][ T324] configfs_rmdir+0x8b7/0x9b0 [ 24.230158][ T324] vfs_rmdir+0x3de/0x560 [ 24.230172][ T324] do_rmdir+0x29a/0x590 [ 24.230185][ T324] ? __cfi_do_rmdir+0x10/0x10 [ 24.230205][ T324] ? __kasan_check_write+0x18/0x20 [ 24.230215][ T324] __x64_sys_rmdir+0x4b/0x60 [ 24.230228][ T324] x64_sys_call+0xaf7/0x2ee0 [ 24.230237][ T324] do_syscall_64+0x57/0xf0 [ 24.230249][ T324] ? clear_bhb_loop+0x50/0xa0 [ 24.230264][ T324] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 24.230278][ T324] RIP: 0033:0x7fdb473ba219 [ 24.230291][ T324] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 24.230300][ T324] RSP: 002b:00007fff2b3a20c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 24.230312][ T324] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fdb473ba219 [ 24.230320][ T324] RDX: ffffffffffffffd8 RSI: 00007fdb473ba219 RDI: 0000200000000600 [ 24.230327][ T324] RBP: 0000000000000000 R08: 00007fff2b3a20e0 R09: 00007fff2b3a20e0 [ 24.230334][ T324] R10: 00007fff2b3a20e0 R11: 0000000000000246 R12: 00007fff2b3a20ec [ 24.230340][ T324] R13: 00007fff2b3a2120 R14: 00007fff2b3a2100 R15: 0000000000000009 [ 24.230348][ T324] [ 24.230885][ T324] BUG: scheduling while atomic: syz-executor234/324/0x00000000 [ 24.608228][ T324] Modules linked in: [ 24.612106][ T324] CPU: 0 UID: 0 PID: 324 Comm: syz-executor234 Tainted: G W syzkaller #0 119f1c0cd44458c2ddc7f806e6d4d2dd11ae7dae [ 24.612123][ T324] Tainted: [W]=WARN [ 24.612127][ T324] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 24.612133][ T324] Call Trace: [ 24.612139][ T324] [ 24.612144][ T324] __dump_stack+0x21/0x30 [ 24.612162][ T324] dump_stack_lvl+0x140/0x1c0 [ 24.612175][ T324] ? __cfi_dump_stack_lvl+0x10/0x10 [ 24.612192][ T324] dump_stack+0x19/0x20 [ 24.612206][ T324] __schedule_bug+0x12b/0x200 [ 24.612218][ T324] ? find_proxy_task+0x2460/0x2460 [ 24.612229][ T324] __schedule+0xb85/0x20b0 [ 24.612242][ T324] ? __wake_up_sync_key+0x1be/0x2c0 [ 24.612254][ T324] ? __cfi___wake_up_sync_key+0x10/0x10 [ 24.612266][ T324] ? __sched_text_start+0x10/0x10 [ 24.612279][ T324] ? __kasan_check_write+0x18/0x20 [ 24.612290][ T324] ? _raw_spin_lock_irq+0x93/0x120 [ 24.612301][ T324] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 24.612313][ T324] ? __kasan_check_read+0x15/0x20 [ 24.612323][ T324] ? cgroup_update_frozen+0x160/0x980 [ 24.612337][ T324] schedule+0xc5/0x240 [ 24.612349][ T324] ptrace_stop+0x528/0x8f0 [ 24.612361][ T324] ptrace_notify+0x1de/0x290 [ 24.612374][ T324] ? __cfi_ptrace_notify+0x10/0x10 [ 24.612387][ T324] ? __cfi_do_rmdir+0x10/0x10 [ 24.612402][ T324] ? __kasan_check_write+0x18/0x20 [ 24.612411][ T324] syscall_exit_work+0x84/0x150 [ 24.612421][ T324] syscall_exit_to_user_mode_prepare+0x21/0x40 [ 24.612431][ T324] syscall_exit_to_user_mode+0x15/0xb0 [ 24.612441][ T324] do_syscall_64+0x63/0xf0 [ 24.612453][ T324] ? clear_bhb_loop+0x50/0xa0 [ 24.612468][ T324] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 24.612481][ T324] RIP: 0033:0x7fdb473ba219 [ 24.612491][ T324] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 24.612499][ T324] RSP: 002b:00007fff2b3a20c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [pid 324] rmdir("./config/usb_gadget/g1") = 0 [pid 324] close(3) = -1 EBADF (Bad file descriptor) [pid 324] close(4) = -1 EBADF (Bad file descriptor) [pid 324] close(5) = -1 EBADF (Bad file descriptor) [pid 324] close(6) = -1 EBADF (Bad file descriptor) [pid 324] close(7) = -1 EBADF (Bad file descriptor) [pid 324] close(8) = -1 EBADF (Bad file descriptor) [pid 324] close(9) = -1 EBADF (Bad file descriptor) [pid 324] close(10) = -1 EBADF (Bad file descriptor) [pid 324] close(11) = -1 EBADF (Bad file descriptor) [pid 324] close(12) = -1 EBADF (Bad file descriptor) [pid 324] close(13) = -1 EBADF (Bad file descriptor) [pid 324] close(14) = -1 EBADF (Bad file descriptor) [pid 324] close(15) = -1 EBADF (Bad file descriptor) [pid 324] close(16) = -1 EBADF (Bad file descriptor) [pid 324] close(17) = -1 EBADF (Bad file descriptor) [pid 324] close(18) = -1 EBADF (Bad file descriptor) [pid 324] close(19) = -1 EBADF (Bad file descriptor) [pid 324] close(20) = -1 EBADF (Bad file descriptor) [pid 324] close(21) = -1 EBADF (Bad file descriptor) [pid 324] close(22) = -1 EBADF (Bad file descriptor) [pid 324] close(23) = -1 EBADF (Bad file descriptor) [pid 324] close(24) = -1 EBADF (Bad file descriptor) [pid 324] close(25) = -1 EBADF (Bad file descriptor) [pid 324] close(26) = -1 EBADF (Bad file descriptor) [pid 324] close(27) = -1 EBADF (Bad file descriptor) [pid 324] close(28) = -1 EBADF (Bad file descriptor) [pid 324] close(29) = -1 EBADF (Bad file descriptor) [pid 324] exit_group(0) = ? [pid 324] +++ exited with 0 +++ [pid 313] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=11, si_uid=0, si_status=0, si_utime=0, si_stime=38 /* 0.38 s */} --- [pid 313] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 313] umount2("./9", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 313] fstat(3, {st_mode=S_IFDIR|0700, st_size=80, ...}) = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 4 entries */, 32768) = 112 [pid 313] umount2("./9/config", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 [pid 313] umount2("./9/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./9/config", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] umount2("./9/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./9/config", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 313] fstat(4, {st_mode=S_IFDIR|0700, st_size=40, ...}) = 0 [pid 313] getdents64(4, 0x55558b0427a0 /* 2 entries */, 32768) = 48 [pid 313] getdents64(4, 0x55558b0427a0 /* 0 entries */, 32768) = 0 [pid 313] close(4) = 0 [pid 313] rmdir("./9/config") = 0 [pid 313] umount2("./9/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./9/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] unlink("./9/binderfs") = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 0 entries */, 32768) = 0 [pid 313] close(3) = 0 [pid 313] rmdir("./9") = 0 [pid 313] mkdir("./10", 0777) = 0 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 313] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55558b039690) = 12 ci2-android-6-12-rust/strace-static-x86_64: Process 325 attached [pid 313] rt_sigprocmask(SIG_SETMASK, [] [pid 325] set_robust_list(0x55558b0396a0, 24 [pid 313] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 325] <... set_robust_list resumed>) = 0 [pid 325] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 325] chdir("./10") = 0 [pid 325] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 325] setpgid(0, 0) = 0 [pid 325] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 325] write(3, "1000", 4) = 4 [pid 325] close(3) = 0 [pid 325] read(200, 0x7fff2b3a1cd0, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 325] symlink("/dev/binderfs", "./binderfs") = 0 [pid 325] write(1, "executing program\n", 18) = 18 executing program [pid 325] mkdirat(AT_FDCWD, "./config", 0777) = 0 [pid 325] mount(NULL, "./config", "configfs", 0, NULL) = 0 [pid 325] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 325] rmdir(NULL) = -1 EFAULT (Bad address) [pid 325] rmdir("./config/usb_gadget/g1") = 0 [pid 325] close(3) = -1 EBADF (Bad file descriptor) [pid 325] close(4) = -1 EBADF (Bad file descriptor) [pid 325] close(5) = -1 EBADF (Bad file descriptor) [pid 325] close(6) = -1 EBADF (Bad file descriptor) [pid 325] close(7) = -1 EBADF (Bad file descriptor) [pid 325] close(8) = -1 EBADF (Bad file descriptor) [pid 325] close(9) = -1 EBADF (Bad file descriptor) [pid 325] close(10) = -1 EBADF (Bad file descriptor) [pid 325] close(11) = -1 EBADF (Bad file descriptor) [pid 325] close(12) = -1 EBADF (Bad file descriptor) [pid 325] close(13) = -1 EBADF (Bad file descriptor) [pid 325] close(14) = -1 EBADF (Bad file descriptor) [pid 325] close(15) = -1 EBADF (Bad file descriptor) [pid 325] close(16) = -1 EBADF (Bad file descriptor) [pid 325] close(17) = -1 EBADF (Bad file descriptor) [pid 325] close(18) = -1 EBADF (Bad file descriptor) [pid 325] close(19) = -1 EBADF (Bad file descriptor) [pid 325] close(20) = -1 EBADF (Bad file descriptor) [pid 325] close(21) = -1 EBADF (Bad file descriptor) [pid 325] close(22) = -1 EBADF (Bad file descriptor) [pid 325] close(23) = -1 EBADF (Bad file descriptor) [pid 325] close(24) = -1 EBADF (Bad file descriptor) [pid 325] close(25) = -1 EBADF (Bad file descriptor) [pid 325] close(26) = -1 EBADF (Bad file descriptor) [pid 325] close(27) = -1 EBADF (Bad file descriptor) [pid 325] close(28) = -1 EBADF (Bad file descriptor) [pid 325] close(29) = -1 EBADF (Bad file descriptor) [pid 325] exit_group(0) = ? [pid 325] +++ exited with 0 +++ [pid 313] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=12, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 313] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 313] umount2("./10", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 313] fstat(3, {st_mode=S_IFDIR|0700, st_size=80, ...}) = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 4 entries */, 32768) = 112 [pid 313] umount2("./10/config", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 [pid 313] umount2("./10/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 24.612511][ T324] RAX: 0000000000000000 RBX: 0000000000000003 RCX: 00007fdb473ba219 [ 24.612517][ T324] RDX: ffffffffffffffd8 RSI: 00007fdb473ba219 RDI: 0000200000000600 [ 24.612525][ T324] RBP: 0000000000000000 R08: 00007fff2b3a20e0 R09: 00007fff2b3a20e0 [ 24.612531][ T324] R10: 00007fff2b3a20e0 R11: 0000000000000246 R12: 00007fff2b3a20ec [ 24.612538][ T324] R13: 00007fff2b3a2120 R14: 00007fff2b3a2100 R15: 0000000000000009 [ 24.612546][ T324] [pid 313] newfstatat(AT_FDCWD, "./10/config", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] umount2("./10/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./10/config", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 313] fstat(4, {st_mode=S_IFDIR|0700, st_size=40, ...}) = 0 [pid 313] getdents64(4, 0x55558b0427a0 /* 2 entries */, 32768) = 48 [pid 313] getdents64(4, 0x55558b0427a0 /* 0 entries */, 32768) = 0 [pid 313] close(4) = 0 [pid 313] rmdir("./10/config") = 0 [pid 313] umount2("./10/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./10/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] unlink("./10/binderfs") = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 0 entries */, 32768) = 0 [pid 313] close(3) = 0 [pid 313] rmdir("./10") = 0 [pid 313] mkdir("./11", 0777) = 0 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 313] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-12-rust/strace-static-x86_64: Process 326 attached , child_tidptr=0x55558b039690) = 13 [pid 326] set_robust_list(0x55558b0396a0, 24 [pid 313] rt_sigprocmask(SIG_SETMASK, [] [pid 326] <... set_robust_list resumed>) = 0 [pid 313] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 326] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 326] chdir("./11") = 0 [pid 326] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 326] setpgid(0, 0) = 0 [pid 326] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 326] write(3, "1000", 4) = 4 [pid 326] close(3) = 0 [pid 326] read(200, "\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x38\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\xc2\x46\x00\x00\x00\x02\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\xaa\xaa\xaa\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00"..., 1000) = 110 [pid 326] read(200, 0x7fff2b3a1cd0, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 326] symlink("/dev/binderfs", "./binderfs") = 0 [pid 326] write(1, "executing program\n", 18) = 18 executing program [pid 326] mkdirat(AT_FDCWD, "./config", 0777) = 0 [pid 326] mount(NULL, "./config", "configfs", 0, NULL) = 0 [pid 326] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 326] rmdir(NULL) = -1 EFAULT (Bad address) [pid 326] rmdir("./config/usb_gadget/g1") = 0 [pid 326] close(3) = -1 EBADF (Bad file descriptor) [pid 326] close(4) = -1 EBADF (Bad file descriptor) [pid 326] close(5) = -1 EBADF (Bad file descriptor) [pid 326] close(6) = -1 EBADF (Bad file descriptor) [pid 326] close(7) = -1 EBADF (Bad file descriptor) [pid 326] close(8) = -1 EBADF (Bad file descriptor) [pid 326] close(9) = -1 EBADF (Bad file descriptor) [pid 326] close(10) = -1 EBADF (Bad file descriptor) [pid 326] close(11) = -1 EBADF (Bad file descriptor) [pid 326] close(12) = -1 EBADF (Bad file descriptor) [pid 326] close(13) = -1 EBADF (Bad file descriptor) [pid 326] close(14) = -1 EBADF (Bad file descriptor) [pid 326] close(15) = -1 EBADF (Bad file descriptor) [pid 326] close(16) = -1 EBADF (Bad file descriptor) [pid 326] close(17) = -1 EBADF (Bad file descriptor) [pid 326] close(18) = -1 EBADF (Bad file descriptor) [pid 326] close(19) = -1 EBADF (Bad file descriptor) [pid 326] close(20) = -1 EBADF (Bad file descriptor) [pid 326] close(21) = -1 EBADF (Bad file descriptor) [pid 326] close(22) = -1 EBADF (Bad file descriptor) [pid 326] close(23) = -1 EBADF (Bad file descriptor) [pid 326] close(24) = -1 EBADF (Bad file descriptor) [pid 326] close(25) = -1 EBADF (Bad file descriptor) [pid 326] close(26) = -1 EBADF (Bad file descriptor) [pid 326] close(27) = -1 EBADF (Bad file descriptor) [pid 326] close(28) = -1 EBADF (Bad file descriptor) [pid 326] close(29) = -1 EBADF (Bad file descriptor) [pid 326] exit_group(0) = ? [pid 326] +++ exited with 0 +++ [pid 313] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=13, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 313] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 313] umount2("./11", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 313] fstat(3, {st_mode=S_IFDIR|0700, st_size=80, ...}) = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 4 entries */, 32768) = 112 [pid 313] umount2("./11/config", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 [pid 313] umount2("./11/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./11/config", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] umount2("./11/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./11/config", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 313] fstat(4, {st_mode=S_IFDIR|0700, st_size=40, ...}) = 0 [pid 313] getdents64(4, 0x55558b0427a0 /* 2 entries */, 32768) = 48 [pid 313] getdents64(4, 0x55558b0427a0 /* 0 entries */, 32768) = 0 [pid 313] close(4) = 0 [pid 313] rmdir("./11/config") = 0 [pid 313] umount2("./11/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./11/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] unlink("./11/binderfs") = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 0 entries */, 32768) = 0 [pid 313] close(3) = 0 [pid 313] rmdir("./11") = 0 [pid 313] mkdir("./12", 0777) = 0 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 313] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55558b039690) = 14 ci2-android-6-12-rust/strace-static-x86_64: Process 327 attached [pid 313] rt_sigprocmask(SIG_SETMASK, [] [pid 327] set_robust_list(0x55558b0396a0, 24 [pid 313] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 327] <... set_robust_list resumed>) = 0 [pid 327] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 327] chdir("./12") = 0 [pid 327] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 327] setpgid(0, 0) = 0 [pid 327] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 327] write(3, "1000", 4) = 4 [pid 327] close(3) = 0 [pid 327] read(200, 0x7fff2b3a1cd0, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 327] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 327] write(1, "executing program\n", 18) = 18 [pid 327] mkdirat(AT_FDCWD, "./config", 0777) = 0 [pid 327] mount(NULL, "./config", "configfs", 0, NULL) = 0 [pid 327] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 327] rmdir(NULL) = -1 EFAULT (Bad address) [ 24.943285][ T327] BUG: scheduling while atomic: syz-executor234/327/0x00000002 [ 24.950905][ T327] Modules linked in: [ 24.954796][ T327] CPU: 0 UID: 0 PID: 327 Comm: syz-executor234 Tainted: G W syzkaller #0 119f1c0cd44458c2ddc7f806e6d4d2dd11ae7dae [ 24.954815][ T327] Tainted: [W]=WARN [ 24.954819][ T327] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 24.954825][ T327] Call Trace: [ 24.954829][ T327] [ 24.954833][ T327] __dump_stack+0x21/0x30 [ 24.954851][ T327] dump_stack_lvl+0x140/0x1c0 [ 24.954864][ T327] ? __cfi_dump_stack_lvl+0x10/0x10 [ 24.954878][ T327] ? kernel_text_address+0xa9/0xe0 [ 24.954893][ T327] dump_stack+0x19/0x20 [ 24.954905][ T327] __schedule_bug+0x12b/0x200 [ 24.954916][ T327] ? find_proxy_task+0x2460/0x2460 [ 24.954927][ T327] __schedule+0xb85/0x20b0 [ 24.954942][ T327] ? is_bpf_text_address+0x17b/0x1a0 [ 24.954957][ T327] ? __sched_text_start+0x10/0x10 [ 24.954969][ T327] ? __kasan_check_read+0x15/0x20 [ 24.954980][ T327] ? rwsem_spin_on_owner+0xa4/0x3b0 [ 24.954996][ T327] ? __kasan_check_write+0x18/0x20 [ 24.955005][ T327] ? _raw_spin_lock_irq+0x93/0x120 [ 24.955017][ T327] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 24.955029][ T327] schedule+0xc5/0x240 [ 24.955041][ T327] schedule_preempt_disabled+0x14/0x30 [ 24.955054][ T327] rwsem_down_write_slowpath+0x5c9/0x1b60 [ 24.955065][ T327] ? rwsem_down_read_slowpath+0x14c0/0x14c0 [ 24.955075][ T327] ? do_syscall_64+0x57/0xf0 [ 24.955088][ T327] ? rwsem_read_trylock+0x275/0x5a0 [ 24.955102][ T327] ? __cfi__raw_spin_lock+0x10/0x10 [ 24.955114][ T327] ? downgrade_write+0x470/0x470 [ 24.955128][ T327] down_write+0x163/0x2b0 [ 24.955137][ T327] ? __cfi_down_write+0x10/0x10 [ 24.955146][ T327] ? down_read+0x7f/0xe0 [ 24.955155][ T327] ? __cfi_down_read+0x10/0x10 [ 24.955163][ T327] ? _raw_spin_lock+0x92/0x120 [ 24.955174][ T327] ? __cfi__raw_spin_lock+0x10/0x10 [ 24.955186][ T327] kernfs_remove+0x87/0xc0 [ 24.955199][ T327] sysfs_remove_dir+0xad/0xf0 [ 24.955209][ T327] __kobject_del+0xe2/0x2c0 [ 24.955221][ T327] kobject_del+0x49/0x80 [ 24.955232][ T327] device_del+0xba7/0xcf0 [ 24.955246][ T327] ? __cfi_device_del+0x10/0x10 [ 24.955259][ T327] ? __kasan_check_write+0x18/0x20 [ 24.955269][ T327] ? kobject_put+0x1cc/0x2a0 [ 24.955280][ T327] device_destroy+0xb0/0x100 [ 24.955289][ T327] ? __cfi_device_destroy+0x10/0x10 [ 24.955302][ T327] ? __kasan_check_write+0x18/0x20 [ 24.955313][ T327] android_device_destroy+0x118/0x180 [ 24.955327][ T327] gadgets_drop+0x1d/0x30 [ 24.955336][ T327] ? __cfi_gadgets_drop+0x10/0x10 [ 24.955345][ T327] configfs_rmdir+0x8b7/0x9b0 [ 24.955358][ T327] vfs_rmdir+0x3de/0x560 [ 24.955372][ T327] do_rmdir+0x29a/0x590 [ 24.955384][ T327] ? __cfi_do_rmdir+0x10/0x10 [ 24.955398][ T327] ? __kasan_check_write+0x18/0x20 [ 24.955408][ T327] __x64_sys_rmdir+0x4b/0x60 [ 24.955421][ T327] x64_sys_call+0xaf7/0x2ee0 [ 24.955430][ T327] do_syscall_64+0x57/0xf0 [ 24.955441][ T327] ? clear_bhb_loop+0x50/0xa0 [ 24.955456][ T327] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 24.955469][ T327] RIP: 0033:0x7fdb473ba219 [ 24.955478][ T327] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 24.955486][ T327] RSP: 002b:00007fff2b3a20c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 24.955498][ T327] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fdb473ba219 [ 24.955505][ T327] RDX: ffffffffffffffd8 RSI: 00007fdb473ba219 RDI: 0000200000000600 [pid 327] rmdir("./config/usb_gadget/g1") = 0 [pid 327] close(3) = -1 EBADF (Bad file descriptor) [pid 327] close(4) = -1 EBADF (Bad file descriptor) [pid 327] close(5) = -1 EBADF (Bad file descriptor) [pid 327] close(6) = -1 EBADF (Bad file descriptor) [ 24.955512][ T327] RBP: 0000000000000000 R08: 00007fff2b3a20e0 R09: 00007fff2b3a20e0 [ 24.955519][ T327] R10: 00007fff2b3a20e0 R11: 0000000000000246 R12: 00007fff2b3a20ec [ 24.955526][ T327] R13: 00007fff2b3a2120 R14: 00007fff2b3a2100 R15: 000000000000000c [ 24.955534][ T327] [ 24.955587][ T327] BUG: scheduling while atomic: syz-executor234/327/0x00000000 [ 25.326946][ T327] Modules linked in: [ 25.330858][ T327] CPU: 0 UID: 0 PID: 327 Comm: syz-executor234 Tainted: G W syzkaller #0 119f1c0cd44458c2ddc7f806e6d4d2dd11ae7dae [ 25.330887][ T327] Tainted: [W]=WARN [ 25.330893][ T327] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 25.330904][ T327] Call Trace: [ 25.330909][ T327] [ 25.330915][ T327] __dump_stack+0x21/0x30 [ 25.330939][ T327] dump_stack_lvl+0x140/0x1c0 [ 25.330960][ T327] ? __cfi_dump_stack_lvl+0x10/0x10 [ 25.330983][ T327] dump_stack+0x19/0x20 [ 25.331003][ T327] __schedule_bug+0x12b/0x200 [ 25.331020][ T327] ? find_proxy_task+0x2460/0x2460 [ 25.331039][ T327] __schedule+0xb85/0x20b0 [ 25.331060][ T327] ? __wake_up_sync_key+0x1be/0x2c0 [ 25.331081][ T327] ? __cfi___wake_up_sync_key+0x10/0x10 [ 25.331102][ T327] ? __sched_text_start+0x10/0x10 [ 25.331125][ T327] ? __kasan_check_write+0x18/0x20 [ 25.331143][ T327] ? _raw_spin_lock_irq+0x93/0x120 [ 25.331166][ T327] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 25.331188][ T327] ? __kasan_check_read+0x15/0x20 [ 25.331207][ T327] ? cgroup_update_frozen+0x160/0x980 [ 25.331232][ T327] schedule+0xc5/0x240 [ 25.331256][ T327] ptrace_stop+0x528/0x8f0 [ 25.331278][ T327] ptrace_notify+0x1de/0x290 [ 25.331300][ T327] ? __cfi_ptrace_notify+0x10/0x10 [ 25.331323][ T327] ? __cfi_do_rmdir+0x10/0x10 [ 25.331347][ T327] ? __kasan_check_write+0x18/0x20 [ 25.331365][ T327] syscall_exit_work+0x84/0x150 [ 25.331382][ T327] syscall_exit_to_user_mode_prepare+0x21/0x40 [ 25.331400][ T327] syscall_exit_to_user_mode+0x15/0xb0 [ 25.331418][ T327] do_syscall_64+0x63/0xf0 [ 25.331439][ T327] ? clear_bhb_loop+0x50/0xa0 [ 25.331463][ T327] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 25.331487][ T327] RIP: 0033:0x7fdb473ba219 [ 25.331503][ T327] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 25.331518][ T327] RSP: 002b:00007fff2b3a20c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 25.331537][ T327] RAX: 0000000000000000 RBX: 0000000000000003 RCX: 00007fdb473ba219 [pid 327] close(7) = -1 EBADF (Bad file descriptor) [pid 327] close(8) = -1 EBADF (Bad file descriptor) [pid 327] close(9) = -1 EBADF (Bad file descriptor) [pid 327] close(10) = -1 EBADF (Bad file descriptor) [pid 327] close(11) = -1 EBADF (Bad file descriptor) [pid 327] close(12) = -1 EBADF (Bad file descriptor) [pid 327] close(13) = -1 EBADF (Bad file descriptor) [pid 327] close(14) = -1 EBADF (Bad file descriptor) [pid 327] close(15) = -1 EBADF (Bad file descriptor) [pid 327] close(16) = -1 EBADF (Bad file descriptor) [pid 327] close(17) = -1 EBADF (Bad file descriptor) [pid 327] close(18) = -1 EBADF (Bad file descriptor) [pid 327] close(19) = -1 EBADF (Bad file descriptor) [pid 327] close(20) = -1 EBADF (Bad file descriptor) [pid 327] close(21) = -1 EBADF (Bad file descriptor) [pid 327] close(22) = -1 EBADF (Bad file descriptor) [pid 327] close(23) = -1 EBADF (Bad file descriptor) [pid 327] close(24) = -1 EBADF (Bad file descriptor) [pid 327] close(25) = -1 EBADF (Bad file descriptor) [pid 327] close(26) = -1 EBADF (Bad file descriptor) [pid 327] close(27) = -1 EBADF (Bad file descriptor) [pid 327] close(28) = -1 EBADF (Bad file descriptor) [pid 327] close(29) = -1 EBADF (Bad file descriptor) [pid 327] exit_group(0) = ? [pid 327] +++ exited with 0 +++ [pid 313] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=14, si_uid=0, si_status=0, si_utime=0, si_stime=36 /* 0.36 s */} --- [pid 313] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 313] umount2("./12", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 313] fstat(3, {st_mode=S_IFDIR|0700, st_size=80, ...}) = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 4 entries */, 32768) = 112 [pid 313] umount2("./12/config", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 [pid 313] umount2("./12/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./12/config", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] umount2("./12/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./12/config", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 313] fstat(4, {st_mode=S_IFDIR|0700, st_size=40, ...}) = 0 [pid 313] getdents64(4, 0x55558b0427a0 /* 2 entries */, 32768) = 48 [pid 313] getdents64(4, 0x55558b0427a0 /* 0 entries */, 32768) = 0 [pid 313] close(4) = 0 [pid 313] rmdir("./12/config") = 0 [pid 313] umount2("./12/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./12/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] unlink("./12/binderfs") = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 0 entries */, 32768) = 0 [pid 313] close(3) = 0 [pid 313] rmdir("./12") = 0 [pid 313] mkdir("./13", 0777) = 0 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 313] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-12-rust/strace-static-x86_64: Process 328 attached , child_tidptr=0x55558b039690) = 15 [pid 313] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 328] set_robust_list(0x55558b0396a0, 24) = 0 [pid 328] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 328] chdir("./13") = 0 [pid 328] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 328] setpgid(0, 0) = 0 [pid 328] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 328] write(3, "1000", 4) = 4 [pid 328] close(3) = 0 [pid 328] read(200, 0x7fff2b3a1cd0, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 328] symlink("/dev/binderfs", "./binderfs") = 0 [pid 328] write(1, "executing program\n", 18) = 18 executing program [pid 328] mkdirat(AT_FDCWD, "./config", 0777) = 0 [pid 328] mount(NULL, "./config", "configfs", 0, NULL) = 0 [pid 328] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 328] rmdir(NULL) = -1 EFAULT (Bad address) [ 25.331557][ T327] RDX: ffffffffffffffd8 RSI: 00007fdb473ba219 RDI: 0000200000000600 [ 25.331570][ T327] RBP: 0000000000000000 R08: 00007fff2b3a20e0 R09: 00007fff2b3a20e0 [ 25.331583][ T327] R10: 00007fff2b3a20e0 R11: 0000000000000246 R12: 00007fff2b3a20ec [ 25.331595][ T327] R13: 00007fff2b3a2120 R14: 00007fff2b3a2100 R15: 000000000000000c [ 25.331610][ T327] [ 25.598993][ T328] BUG: scheduling while atomic: syz-executor234/328/0x00000002 [ 25.606563][ T328] Modules linked in: [ 25.610472][ T328] CPU: 0 UID: 0 PID: 328 Comm: syz-executor234 Tainted: G W syzkaller #0 119f1c0cd44458c2ddc7f806e6d4d2dd11ae7dae [ 25.610506][ T328] Tainted: [W]=WARN [ 25.610518][ T328] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 25.610527][ T328] Call Trace: [ 25.610532][ T328] [ 25.610538][ T328] __dump_stack+0x21/0x30 [ 25.610565][ T328] dump_stack_lvl+0x140/0x1c0 [ 25.610588][ T328] ? __cfi_dump_stack_lvl+0x10/0x10 [ 25.610613][ T328] dump_stack+0x19/0x20 [ 25.610637][ T328] __schedule_bug+0x12b/0x200 [ 25.610657][ T328] ? find_proxy_task+0x2460/0x2460 [ 25.610679][ T328] ? __kasan_check_read+0x15/0x20 [ 25.610698][ T328] ? psi_group_change+0xab6/0x10a0 [ 25.610722][ T328] __schedule+0xb85/0x20b0 [ 25.610746][ T328] ? update_curr+0xf1/0x9c0 [ 25.610765][ T328] ? __sched_text_start+0x10/0x10 [ 25.610788][ T328] ? __kasan_check_read+0x15/0x20 [ 25.610806][ T328] ? rwsem_spin_on_owner+0xa4/0x3b0 [ 25.610832][ T328] ? __kasan_check_write+0x18/0x20 [ 25.610850][ T328] ? _raw_spin_lock_irq+0x93/0x120 [ 25.610865][ T328] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 25.610877][ T328] schedule+0xc5/0x240 [ 25.610889][ T328] schedule_preempt_disabled+0x14/0x30 [ 25.610902][ T328] rwsem_down_write_slowpath+0x5c9/0x1b60 [ 25.610912][ T328] ? activate_task+0x43b/0x480 [ 25.610923][ T328] ? rwsem_down_read_slowpath+0x14c0/0x14c0 [ 25.610933][ T328] ? try_to_wake_up+0x111a/0x1fd0 [ 25.610944][ T328] ? __kasan_check_write+0x18/0x20 [ 25.610953][ T328] ? wake_q_add_safe+0x29/0x100 [ 25.610962][ T328] ? cpus_share_resources+0xa0/0x130 [ 25.610973][ T328] ? rwsem_mark_wake+0x507/0x770 [ 25.610987][ T328] ? rwsem_read_trylock+0x275/0x5a0 [ 25.611001][ T328] ? wake_up_q+0x10a/0x1c0 [ 25.611011][ T328] ? downgrade_write+0x470/0x470 [ 25.611027][ T328] down_write+0x163/0x2b0 [ 25.611036][ T328] ? __cfi_down_write+0x10/0x10 [ 25.611044][ T328] ? down_read+0x7f/0xe0 [ 25.611053][ T328] ? __cfi_down_read+0x10/0x10 [ 25.611062][ T328] kernfs_remove_by_name_ns+0x8c/0x180 [ 25.611077][ T328] sysfs_unmerge_group+0xd7/0x130 [ 25.611088][ T328] dpm_sysfs_remove+0x7b/0xd0 [ 25.611101][ T328] device_del+0x241/0xcf0 [ 25.611116][ T328] ? __cfi_class_find_device+0x10/0x10 [ 25.611126][ T328] ? __cfi_device_del+0x10/0x10 [ 25.611139][ T328] ? __kasan_check_write+0x18/0x20 [ 25.611148][ T328] ? kobject_put+0x1cc/0x2a0 [ 25.611160][ T328] device_destroy+0xb0/0x100 [ 25.611169][ T328] ? __cfi_device_destroy+0x10/0x10 [ 25.611183][ T328] ? __kasan_check_write+0x18/0x20 [ 25.611193][ T328] android_device_destroy+0x118/0x180 [ 25.611206][ T328] gadgets_drop+0x1d/0x30 [ 25.611215][ T328] ? __cfi_gadgets_drop+0x10/0x10 [ 25.611224][ T328] configfs_rmdir+0x8b7/0x9b0 [ 25.611238][ T328] vfs_rmdir+0x3de/0x560 [ 25.611252][ T328] do_rmdir+0x29a/0x590 [ 25.611265][ T328] ? __cfi_do_rmdir+0x10/0x10 [ 25.611278][ T328] ? __kasan_check_write+0x18/0x20 [ 25.611288][ T328] __x64_sys_rmdir+0x4b/0x60 [ 25.611301][ T328] x64_sys_call+0xaf7/0x2ee0 [ 25.611310][ T328] do_syscall_64+0x57/0xf0 [ 25.611322][ T328] ? clear_bhb_loop+0x50/0xa0 [ 25.611336][ T328] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 25.611349][ T328] RIP: 0033:0x7fdb473ba219 [ 25.611359][ T328] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 25.611367][ T328] RSP: 002b:00007fff2b3a20c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 25.611379][ T328] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fdb473ba219 [ 25.611386][ T328] RDX: ffffffffffffffd8 RSI: 00007fdb473ba219 RDI: 0000200000000600 [ 25.611393][ T328] RBP: 0000000000000000 R08: 00007fff2b3a20e0 R09: 00007fff2b3a20e0 [ 25.611400][ T328] R10: 00007fff2b3a20e0 R11: 0000000000000246 R12: 00007fff2b3a20ec [ 25.611407][ T328] R13: 00007fff2b3a2120 R14: 00007fff2b3a2100 R15: 000000000000000d [ 25.611415][ T328] [pid 328] rmdir("./config/usb_gadget/g1") = 0 [pid 328] close(3) = -1 EBADF (Bad file descriptor) [pid 328] close(4) = -1 EBADF (Bad file descriptor) [pid 328] close(5) = -1 EBADF (Bad file descriptor) [pid 328] close(6) = -1 EBADF (Bad file descriptor) [pid 328] close(7) = -1 EBADF (Bad file descriptor) [pid 328] close(8) = -1 EBADF (Bad file descriptor) [pid 328] close(9) = -1 EBADF (Bad file descriptor) [pid 328] close(10) = -1 EBADF (Bad file descriptor) [pid 328] close(11) = -1 EBADF (Bad file descriptor) [pid 328] close(12) = -1 EBADF (Bad file descriptor) [pid 328] close(13) = -1 EBADF (Bad file descriptor) [pid 328] close(14) = -1 EBADF (Bad file descriptor) [pid 328] close(15) = -1 EBADF (Bad file descriptor) [pid 328] close(16) = -1 EBADF (Bad file descriptor) [pid 328] close(17) = -1 EBADF (Bad file descriptor) [pid 328] close(18) = -1 EBADF (Bad file descriptor) [pid 328] close(19) = -1 EBADF (Bad file descriptor) [pid 328] close(20) = -1 EBADF (Bad file descriptor) [pid 328] close(21) = -1 EBADF (Bad file descriptor) [pid 328] close(22) = -1 EBADF (Bad file descriptor) [pid 328] close(23) = -1 EBADF (Bad file descriptor) [pid 328] close(24) = -1 EBADF (Bad file descriptor) [pid 328] close(25) = -1 EBADF (Bad file descriptor) [pid 328] close(26) = -1 EBADF (Bad file descriptor) [pid 328] close(27) = -1 EBADF (Bad file descriptor) [pid 328] close(28) = -1 EBADF (Bad file descriptor) [pid 328] close(29) = -1 EBADF (Bad file descriptor) [pid 328] exit_group(0) = ? [pid 328] +++ exited with 0 +++ [pid 313] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=15, si_uid=0, si_status=0, si_utime=0, si_stime=39 /* 0.39 s */} --- [ 25.611614][ T328] BUG: scheduling while atomic: syz-executor234/328/0x00000000 [ 26.004584][ T328] Modules linked in: [ 26.008503][ T328] CPU: 0 UID: 0 PID: 328 Comm: syz-executor234 Tainted: G W syzkaller #0 119f1c0cd44458c2ddc7f806e6d4d2dd11ae7dae [ 26.008529][ T328] Tainted: [W]=WARN [ 26.008533][ T328] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 26.008542][ T328] Call Trace: [ 26.008548][ T328] [ 26.008554][ T328] __dump_stack+0x21/0x30 [ 26.008579][ T328] dump_stack_lvl+0x140/0x1c0 [ 26.008602][ T328] ? __cfi_dump_stack_lvl+0x10/0x10 [ 26.008629][ T328] dump_stack+0x19/0x20 [ 26.008653][ T328] __schedule_bug+0x12b/0x200 [ 26.008674][ T328] ? find_proxy_task+0x2460/0x2460 [ 26.008695][ T328] __schedule+0xb85/0x20b0 [ 26.008717][ T328] ? __wake_up_sync_key+0x1be/0x2c0 [ 26.008738][ T328] ? __cfi___wake_up_sync_key+0x10/0x10 [ 26.008760][ T328] ? __sched_text_start+0x10/0x10 [ 26.008783][ T328] ? __kasan_check_write+0x18/0x20 [ 26.008801][ T328] ? _raw_spin_lock_irq+0x93/0x120 [ 26.008823][ T328] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 26.008845][ T328] ? __kasan_check_read+0x15/0x20 [ 26.008864][ T328] ? cgroup_update_frozen+0x160/0x980 [ 26.008889][ T328] schedule+0xc5/0x240 [ 26.008912][ T328] ptrace_stop+0x528/0x8f0 [ 26.008933][ T328] ptrace_notify+0x1de/0x290 [ 26.008955][ T328] ? __cfi_ptrace_notify+0x10/0x10 [ 26.008976][ T328] ? __cfi_do_rmdir+0x10/0x10 [ 26.008995][ T328] ? __kasan_check_write+0x18/0x20 [ 26.009013][ T328] syscall_exit_work+0x84/0x150 [ 26.009030][ T328] syscall_exit_to_user_mode_prepare+0x21/0x40 [ 26.009049][ T328] syscall_exit_to_user_mode+0x15/0xb0 [ 26.009068][ T328] do_syscall_64+0x63/0xf0 [ 26.009088][ T328] ? clear_bhb_loop+0x50/0xa0 [ 26.009113][ T328] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 26.009137][ T328] RIP: 0033:0x7fdb473ba219 [ 26.009153][ T328] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 26.009168][ T328] RSP: 002b:00007fff2b3a20c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 26.009188][ T328] RAX: 0000000000000000 RBX: 0000000000000003 RCX: 00007fdb473ba219 [ 26.009200][ T328] RDX: ffffffffffffffd8 RSI: 00007fdb473ba219 RDI: 0000200000000600 [ 26.009214][ T328] RBP: 0000000000000000 R08: 00007fff2b3a20e0 R09: 00007fff2b3a20e0 [ 26.009227][ T328] R10: 00007fff2b3a20e0 R11: 0000000000000246 R12: 00007fff2b3a20ec [pid 313] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 313] umount2("./13", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 313] fstat(3, {st_mode=S_IFDIR|0700, st_size=80, ...}) = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 4 entries */, 32768) = 112 [pid 313] umount2("./13/config", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 [pid 313] umount2("./13/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./13/config", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] umount2("./13/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./13/config", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 313] fstat(4, {st_mode=S_IFDIR|0700, st_size=40, ...}) = 0 [pid 313] getdents64(4, 0x55558b0427a0 /* 2 entries */, 32768) = 48 [pid 313] getdents64(4, 0x55558b0427a0 /* 0 entries */, 32768) = 0 [pid 313] close(4) = 0 [pid 313] rmdir("./13/config") = 0 [pid 313] umount2("./13/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./13/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] unlink("./13/binderfs") = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 0 entries */, 32768) = 0 [pid 313] close(3) = 0 [pid 313] rmdir("./13") = 0 [pid 313] mkdir("./14", 0777) = 0 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 313] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-12-rust/strace-static-x86_64: Process 329 attached , child_tidptr=0x55558b039690) = 16 [pid 313] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 329] set_robust_list(0x55558b0396a0, 24) = 0 [pid 329] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 329] chdir("./14") = 0 [pid 329] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 329] setpgid(0, 0) = 0 [pid 329] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 329] write(3, "1000", 4) = 4 [pid 329] close(3) = 0 [pid 329] read(200, 0x7fff2b3a1cd0, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 329] symlink("/dev/binderfs", "./binderfs") = 0 [pid 329] write(1, "executing program\n", 18) = 18 executing program [pid 329] mkdirat(AT_FDCWD, "./config", 0777) = 0 [pid 329] mount(NULL, "./config", "configfs", 0, NULL) = 0 [pid 329] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 329] rmdir(NULL) = -1 EFAULT (Bad address) [pid 329] rmdir("./config/usb_gadget/g1") = 0 [pid 329] close(3) = -1 EBADF (Bad file descriptor) [pid 329] close(4) = -1 EBADF (Bad file descriptor) [pid 329] close(5) = -1 EBADF (Bad file descriptor) [pid 329] close(6) = -1 EBADF (Bad file descriptor) [pid 329] close(7) = -1 EBADF (Bad file descriptor) [pid 329] close(8) = -1 EBADF (Bad file descriptor) [pid 329] close(9) = -1 EBADF (Bad file descriptor) [pid 329] close(10) = -1 EBADF (Bad file descriptor) [pid 329] close(11) = -1 EBADF (Bad file descriptor) [pid 329] close(12) = -1 EBADF (Bad file descriptor) [pid 329] close(13) = -1 EBADF (Bad file descriptor) [pid 329] close(14) = -1 EBADF (Bad file descriptor) [pid 329] close(15) = -1 EBADF (Bad file descriptor) [pid 329] close(16) = -1 EBADF (Bad file descriptor) [pid 329] close(17) = -1 EBADF (Bad file descriptor) [pid 329] close(18) = -1 EBADF (Bad file descriptor) [pid 329] close(19) = -1 EBADF (Bad file descriptor) [pid 329] close(20) = -1 EBADF (Bad file descriptor) [pid 329] close(21) = -1 EBADF (Bad file descriptor) [pid 329] close(22) = -1 EBADF (Bad file descriptor) [pid 329] close(23) = -1 EBADF (Bad file descriptor) [pid 329] close(24) = -1 EBADF (Bad file descriptor) [pid 329] close(25) = -1 EBADF (Bad file descriptor) [pid 329] close(26) = -1 EBADF (Bad file descriptor) [pid 329] close(27) = -1 EBADF (Bad file descriptor) [pid 329] close(28) = -1 EBADF (Bad file descriptor) [pid 329] close(29) = -1 EBADF (Bad file descriptor) [pid 329] exit_group(0) = ? [pid 329] +++ exited with 0 +++ [pid 313] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=16, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 313] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 313] umount2("./14", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 313] fstat(3, {st_mode=S_IFDIR|0700, st_size=80, ...}) = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 4 entries */, 32768) = 112 [pid 313] umount2("./14/config", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 [pid 313] umount2("./14/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./14/config", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] umount2("./14/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./14/config", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 313] fstat(4, {st_mode=S_IFDIR|0700, st_size=40, ...}) = 0 [pid 313] getdents64(4, 0x55558b0427a0 /* 2 entries */, 32768) = 48 [pid 313] getdents64(4, 0x55558b0427a0 /* 0 entries */, 32768) = 0 [pid 313] close(4) = 0 [pid 313] rmdir("./14/config") = 0 [pid 313] umount2("./14/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./14/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] unlink("./14/binderfs") = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 0 entries */, 32768) = 0 [pid 313] close(3) = 0 [pid 313] rmdir("./14") = 0 [pid 313] mkdir("./15", 0777) = 0 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 313] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-12-rust/strace-static-x86_64: Process 330 attached , child_tidptr=0x55558b039690) = 17 [pid 313] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 330] set_robust_list(0x55558b0396a0, 24) = 0 [pid 330] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 330] chdir("./15") = 0 [pid 330] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 330] setpgid(0, 0) = 0 [pid 330] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 330] write(3, "1000", 4) = 4 [pid 330] close(3) = 0 [pid 330] read(200, 0x7fff2b3a1cd0, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 330] symlink("/dev/binderfs", "./binderfs") = 0 [pid 330] write(1, "executing program\n", 18) = 18 executing program [pid 330] mkdirat(AT_FDCWD, "./config", 0777) = 0 [pid 330] mount(NULL, "./config", "configfs", 0, NULL) = 0 [pid 330] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 330] rmdir(NULL) = -1 EFAULT (Bad address) [pid 330] rmdir("./config/usb_gadget/g1") = 0 [pid 330] close(3) = -1 EBADF (Bad file descriptor) [pid 330] close(4) = -1 EBADF (Bad file descriptor) [pid 330] close(5) = -1 EBADF (Bad file descriptor) [pid 330] close(6) = -1 EBADF (Bad file descriptor) [pid 330] close(7) = -1 EBADF (Bad file descriptor) [pid 330] close(8) = -1 EBADF (Bad file descriptor) [pid 330] close(9) = -1 EBADF (Bad file descriptor) [pid 330] close(10) = -1 EBADF (Bad file descriptor) [pid 330] close(11) = -1 EBADF (Bad file descriptor) [pid 330] close(12) = -1 EBADF (Bad file descriptor) [pid 330] close(13) = -1 EBADF (Bad file descriptor) [pid 330] close(14) = -1 EBADF (Bad file descriptor) [pid 330] close(15) = -1 EBADF (Bad file descriptor) [pid 330] close(16) = -1 EBADF (Bad file descriptor) [pid 330] close(17) = -1 EBADF (Bad file descriptor) [pid 330] close(18) = -1 EBADF (Bad file descriptor) [pid 330] close(19) = -1 EBADF (Bad file descriptor) [pid 330] close(20) = -1 EBADF (Bad file descriptor) [pid 330] close(21) = -1 EBADF (Bad file descriptor) [pid 330] close(22) = -1 EBADF (Bad file descriptor) [pid 330] close(23) = -1 EBADF (Bad file descriptor) [pid 330] close(24) = -1 EBADF (Bad file descriptor) [pid 330] close(25) = -1 EBADF (Bad file descriptor) [pid 330] close(26) = -1 EBADF (Bad file descriptor) [pid 330] close(27) = -1 EBADF (Bad file descriptor) [pid 330] close(28) = -1 EBADF (Bad file descriptor) [pid 330] close(29) = -1 EBADF (Bad file descriptor) [pid 330] exit_group(0) = ? [pid 330] +++ exited with 0 +++ [pid 313] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=17, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 313] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 313] umount2("./15", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 313] fstat(3, {st_mode=S_IFDIR|0700, st_size=80, ...}) = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 4 entries */, 32768) = 112 [pid 313] umount2("./15/config", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 [pid 313] umount2("./15/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./15/config", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] umount2("./15/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./15/config", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 313] fstat(4, {st_mode=S_IFDIR|0700, st_size=40, ...}) = 0 [pid 313] getdents64(4, 0x55558b0427a0 /* 2 entries */, 32768) = 48 [pid 313] getdents64(4, 0x55558b0427a0 /* 0 entries */, 32768) = 0 [pid 313] close(4) = 0 [pid 313] rmdir("./15/config") = 0 [pid 313] umount2("./15/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./15/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] unlink("./15/binderfs") = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 0 entries */, 32768) = 0 [pid 313] close(3) = 0 [pid 313] rmdir("./15") = 0 [pid 313] mkdir("./16", 0777) = 0 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 313] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-12-rust/strace-static-x86_64: Process 331 attached , child_tidptr=0x55558b039690) = 18 [pid 313] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 331] set_robust_list(0x55558b0396a0, 24) = 0 [pid 331] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 331] chdir("./16") = 0 [pid 331] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 331] setpgid(0, 0) = 0 [pid 331] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 331] write(3, "1000", 4) = 4 [pid 331] close(3) = 0 [pid 331] read(200, 0x7fff2b3a1cd0, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 331] symlink("/dev/binderfs", "./binderfs") = 0 [pid 331] write(1, "executing program\n", 18) = 18 executing program [pid 331] mkdirat(AT_FDCWD, "./config", 0777) = 0 [pid 331] mount(NULL, "./config", "configfs", 0, NULL) = 0 [pid 331] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 331] rmdir(NULL) = -1 EFAULT (Bad address) [pid 331] rmdir("./config/usb_gadget/g1") = 0 [pid 331] close(3) = -1 EBADF (Bad file descriptor) [pid 331] close(4) = -1 EBADF (Bad file descriptor) [pid 331] close(5) = -1 EBADF (Bad file descriptor) [pid 331] close(6) = -1 EBADF (Bad file descriptor) [pid 331] close(7) = -1 EBADF (Bad file descriptor) [ 26.009240][ T328] R13: 00007fff2b3a2120 R14: 00007fff2b3a2100 R15: 000000000000000d [ 26.009256][ T328] [pid 331] close(8) = -1 EBADF (Bad file descriptor) [pid 331] close(9) = -1 EBADF (Bad file descriptor) [pid 331] close(10) = -1 EBADF (Bad file descriptor) [pid 331] close(11) = -1 EBADF (Bad file descriptor) [pid 331] close(12) = -1 EBADF (Bad file descriptor) [pid 331] close(13) = -1 EBADF (Bad file descriptor) [pid 331] close(14) = -1 EBADF (Bad file descriptor) [pid 331] close(15) = -1 EBADF (Bad file descriptor) [pid 331] close(16) = -1 EBADF (Bad file descriptor) [pid 331] close(17) = -1 EBADF (Bad file descriptor) [pid 331] close(18) = -1 EBADF (Bad file descriptor) [pid 331] close(19) = -1 EBADF (Bad file descriptor) [pid 331] close(20) = -1 EBADF (Bad file descriptor) [pid 331] close(21) = -1 EBADF (Bad file descriptor) [pid 331] close(22) = -1 EBADF (Bad file descriptor) [pid 331] close(23) = -1 EBADF (Bad file descriptor) [pid 331] close(24) = -1 EBADF (Bad file descriptor) [pid 331] close(25) = -1 EBADF (Bad file descriptor) [pid 331] close(26) = -1 EBADF (Bad file descriptor) [pid 331] close(27) = -1 EBADF (Bad file descriptor) [pid 331] close(28) = -1 EBADF (Bad file descriptor) [pid 331] close(29) = -1 EBADF (Bad file descriptor) [pid 331] exit_group(0) = ? [pid 331] +++ exited with 0 +++ [pid 313] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=18, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 313] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 313] umount2("./16", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 313] fstat(3, {st_mode=S_IFDIR|0700, st_size=80, ...}) = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 4 entries */, 32768) = 112 [pid 313] umount2("./16/config", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 [pid 313] umount2("./16/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./16/config", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] umount2("./16/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./16/config", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 313] fstat(4, {st_mode=S_IFDIR|0700, st_size=40, ...}) = 0 [pid 313] getdents64(4, 0x55558b0427a0 /* 2 entries */, 32768) = 48 [pid 313] getdents64(4, 0x55558b0427a0 /* 0 entries */, 32768) = 0 [pid 313] close(4) = 0 [pid 313] rmdir("./16/config") = 0 [pid 313] umount2("./16/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./16/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] unlink("./16/binderfs") = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 0 entries */, 32768) = 0 [pid 313] close(3) = 0 [pid 313] rmdir("./16") = 0 [pid 313] mkdir("./17", 0777) = 0 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 313] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-12-rust/strace-static-x86_64: Process 332 attached , child_tidptr=0x55558b039690) = 19 [pid 332] set_robust_list(0x55558b0396a0, 24 [pid 313] rt_sigprocmask(SIG_SETMASK, [] [pid 332] <... set_robust_list resumed>) = 0 [pid 313] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 332] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 332] chdir("./17") = 0 [pid 332] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 332] setpgid(0, 0) = 0 [pid 332] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 332] write(3, "1000", 4) = 4 [pid 332] close(3) = 0 [pid 332] read(200, 0x7fff2b3a1cd0, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 332] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 332] write(1, "executing program\n", 18) = 18 [pid 332] mkdirat(AT_FDCWD, "./config", 0777) = 0 [pid 332] mount(NULL, "./config", "configfs", 0, NULL) = 0 [pid 332] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 332] rmdir(NULL) = -1 EFAULT (Bad address) [pid 332] rmdir("./config/usb_gadget/g1") = 0 [pid 332] close(3) = -1 EBADF (Bad file descriptor) [pid 332] close(4) = -1 EBADF (Bad file descriptor) [pid 332] close(5) = -1 EBADF (Bad file descriptor) [pid 332] close(6) = -1 EBADF (Bad file descriptor) [pid 332] close(7) = -1 EBADF (Bad file descriptor) [pid 332] close(8) = -1 EBADF (Bad file descriptor) [pid 332] close(9) = -1 EBADF (Bad file descriptor) [pid 332] close(10) = -1 EBADF (Bad file descriptor) [pid 332] close(11) = -1 EBADF (Bad file descriptor) [pid 332] close(12) = -1 EBADF (Bad file descriptor) [pid 332] close(13) = -1 EBADF (Bad file descriptor) [pid 332] close(14) = -1 EBADF (Bad file descriptor) [pid 332] close(15) = -1 EBADF (Bad file descriptor) [pid 332] close(16) = -1 EBADF (Bad file descriptor) [pid 332] close(17) = -1 EBADF (Bad file descriptor) [pid 332] close(18) = -1 EBADF (Bad file descriptor) [pid 332] close(19) = -1 EBADF (Bad file descriptor) [pid 332] close(20) = -1 EBADF (Bad file descriptor) [pid 332] close(21) = -1 EBADF (Bad file descriptor) [pid 332] close(22) = -1 EBADF (Bad file descriptor) [pid 332] close(23) = -1 EBADF (Bad file descriptor) [pid 332] close(24) = -1 EBADF (Bad file descriptor) [pid 332] close(25) = -1 EBADF (Bad file descriptor) [pid 332] close(26) = -1 EBADF (Bad file descriptor) [pid 332] close(27) = -1 EBADF (Bad file descriptor) [pid 332] close(28) = -1 EBADF (Bad file descriptor) [pid 332] close(29) = -1 EBADF (Bad file descriptor) [pid 332] exit_group(0) = ? [pid 332] +++ exited with 0 +++ [pid 313] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=19, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 313] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 313] umount2("./17", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 313] fstat(3, {st_mode=S_IFDIR|0700, st_size=80, ...}) = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 4 entries */, 32768) = 112 [pid 313] umount2("./17/config", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 [pid 313] umount2("./17/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./17/config", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] umount2("./17/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./17/config", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 313] fstat(4, {st_mode=S_IFDIR|0700, st_size=40, ...}) = 0 [pid 313] getdents64(4, 0x55558b0427a0 /* 2 entries */, 32768) = 48 [pid 313] getdents64(4, 0x55558b0427a0 /* 0 entries */, 32768) = 0 [pid 313] close(4) = 0 [pid 313] rmdir("./17/config") = 0 [pid 313] umount2("./17/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./17/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] unlink("./17/binderfs") = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 0 entries */, 32768) = 0 [pid 313] close(3) = 0 [pid 313] rmdir("./17") = 0 [pid 313] mkdir("./18", 0777) = 0 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 313] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-12-rust/strace-static-x86_64: Process 333 attached , child_tidptr=0x55558b039690) = 20 [pid 313] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 333] set_robust_list(0x55558b0396a0, 24) = 0 [pid 333] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 333] chdir("./18") = 0 [pid 333] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 333] setpgid(0, 0) = 0 [pid 333] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 333] write(3, "1000", 4) = 4 [pid 333] close(3) = 0 [pid 333] read(200, 0x7fff2b3a1cd0, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 333] symlink("/dev/binderfs", "./binderfs") = 0 [pid 333] write(1, "executing program\n", 18) = 18 executing program [pid 333] mkdirat(AT_FDCWD, "./config", 0777) = 0 [pid 333] mount(NULL, "./config", "configfs", 0, NULL) = 0 [pid 333] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 333] rmdir(NULL) = -1 EFAULT (Bad address) [pid 333] rmdir("./config/usb_gadget/g1") = 0 [pid 333] close(3) = -1 EBADF (Bad file descriptor) [pid 333] close(4) = -1 EBADF (Bad file descriptor) [pid 333] close(5) = -1 EBADF (Bad file descriptor) [pid 333] close(6) = -1 EBADF (Bad file descriptor) [pid 333] close(7) = -1 EBADF (Bad file descriptor) [pid 333] close(8) = -1 EBADF (Bad file descriptor) [pid 333] close(9) = -1 EBADF (Bad file descriptor) [pid 333] close(10) = -1 EBADF (Bad file descriptor) [pid 333] close(11) = -1 EBADF (Bad file descriptor) [pid 333] close(12) = -1 EBADF (Bad file descriptor) [pid 333] close(13) = -1 EBADF (Bad file descriptor) [pid 333] close(14) = -1 EBADF (Bad file descriptor) [pid 333] close(15) = -1 EBADF (Bad file descriptor) [pid 333] close(16) = -1 EBADF (Bad file descriptor) [pid 333] close(17) = -1 EBADF (Bad file descriptor) [pid 333] close(18) = -1 EBADF (Bad file descriptor) [pid 333] close(19) = -1 EBADF (Bad file descriptor) [pid 333] close(20) = -1 EBADF (Bad file descriptor) [pid 333] close(21) = -1 EBADF (Bad file descriptor) [pid 333] close(22) = -1 EBADF (Bad file descriptor) [pid 333] close(23) = -1 EBADF (Bad file descriptor) [pid 333] close(24) = -1 EBADF (Bad file descriptor) [pid 333] close(25) = -1 EBADF (Bad file descriptor) [pid 333] close(26) = -1 EBADF (Bad file descriptor) [pid 333] close(27) = -1 EBADF (Bad file descriptor) [pid 333] close(28) = -1 EBADF (Bad file descriptor) [pid 333] close(29) = -1 EBADF (Bad file descriptor) [pid 333] exit_group(0) = ? [pid 333] +++ exited with 0 +++ [pid 313] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=20, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 313] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 313] umount2("./18", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 313] fstat(3, {st_mode=S_IFDIR|0700, st_size=80, ...}) = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 4 entries */, 32768) = 112 [pid 313] umount2("./18/config", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 [pid 313] umount2("./18/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./18/config", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] umount2("./18/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./18/config", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 313] fstat(4, {st_mode=S_IFDIR|0700, st_size=40, ...}) = 0 [pid 313] getdents64(4, 0x55558b0427a0 /* 2 entries */, 32768) = 48 [pid 313] getdents64(4, 0x55558b0427a0 /* 0 entries */, 32768) = 0 [pid 313] close(4) = 0 [pid 313] rmdir("./18/config") = 0 [pid 313] umount2("./18/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./18/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] unlink("./18/binderfs") = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 0 entries */, 32768) = 0 [pid 313] close(3) = 0 [pid 313] rmdir("./18") = 0 [pid 313] mkdir("./19", 0777) = 0 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 313] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-12-rust/strace-static-x86_64: Process 334 attached , child_tidptr=0x55558b039690) = 21 [pid 313] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 334] set_robust_list(0x55558b0396a0, 24) = 0 [pid 334] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 334] chdir("./19") = 0 [pid 334] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 334] setpgid(0, 0) = 0 [pid 334] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 334] write(3, "1000", 4) = 4 [pid 334] close(3) = 0 [pid 334] read(200, 0x7fff2b3a1cd0, 1000) = -1 EAGAIN (Resource temporarily unavailable) executing program [pid 334] symlink("/dev/binderfs", "./binderfs") = 0 [pid 334] write(1, "executing program\n", 18) = 18 [pid 334] mkdirat(AT_FDCWD, "./config", 0777) = 0 [pid 334] mount(NULL, "./config", "configfs", 0, NULL) = 0 [pid 334] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 334] rmdir(NULL) = -1 EFAULT (Bad address) [pid 334] rmdir("./config/usb_gadget/g1") = 0 [pid 334] close(3) = -1 EBADF (Bad file descriptor) [pid 334] close(4) = -1 EBADF (Bad file descriptor) [pid 334] close(5) = -1 EBADF (Bad file descriptor) [pid 334] close(6) = -1 EBADF (Bad file descriptor) [pid 334] close(7) = -1 EBADF (Bad file descriptor) [pid 334] close(8) = -1 EBADF (Bad file descriptor) [pid 334] close(9) = -1 EBADF (Bad file descriptor) [pid 334] close(10) = -1 EBADF (Bad file descriptor) [pid 334] close(11) = -1 EBADF (Bad file descriptor) [pid 334] close(12) = -1 EBADF (Bad file descriptor) [pid 334] close(13) = -1 EBADF (Bad file descriptor) [pid 334] close(14) = -1 EBADF (Bad file descriptor) [pid 334] close(15) = -1 EBADF (Bad file descriptor) [pid 334] close(16) = -1 EBADF (Bad file descriptor) [pid 334] close(17) = -1 EBADF (Bad file descriptor) [pid 334] close(18) = -1 EBADF (Bad file descriptor) [pid 334] close(19) = -1 EBADF (Bad file descriptor) [pid 334] close(20) = -1 EBADF (Bad file descriptor) [pid 334] close(21) = -1 EBADF (Bad file descriptor) [pid 334] close(22) = -1 EBADF (Bad file descriptor) [pid 334] close(23) = -1 EBADF (Bad file descriptor) [pid 334] close(24) = -1 EBADF (Bad file descriptor) [pid 334] close(25) = -1 EBADF (Bad file descriptor) [pid 334] close(26) = -1 EBADF (Bad file descriptor) [pid 334] close(27) = -1 EBADF (Bad file descriptor) [pid 334] close(28) = -1 EBADF (Bad file descriptor) [pid 334] close(29) = -1 EBADF (Bad file descriptor) [pid 334] exit_group(0) = ? [pid 334] +++ exited with 0 +++ [pid 313] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=21, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 313] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 313] umount2("./19", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 313] fstat(3, {st_mode=S_IFDIR|0700, st_size=80, ...}) = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 4 entries */, 32768) = 112 [pid 313] umount2("./19/config", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 [pid 313] umount2("./19/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./19/config", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] umount2("./19/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./19/config", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 313] fstat(4, {st_mode=S_IFDIR|0700, st_size=40, ...}) = 0 [pid 313] getdents64(4, 0x55558b0427a0 /* 2 entries */, 32768) = 48 [pid 313] getdents64(4, 0x55558b0427a0 /* 0 entries */, 32768) = 0 [pid 313] close(4) = 0 [pid 313] rmdir("./19/config") = 0 [pid 313] umount2("./19/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./19/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] unlink("./19/binderfs") = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 0 entries */, 32768) = 0 [pid 313] close(3) = 0 [pid 313] rmdir("./19") = 0 [pid 313] mkdir("./20", 0777) = 0 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 313] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-12-rust/strace-static-x86_64: Process 335 attached , child_tidptr=0x55558b039690) = 22 [pid 313] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 335] set_robust_list(0x55558b0396a0, 24) = 0 [pid 335] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 335] chdir("./20") = 0 [pid 335] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 335] setpgid(0, 0) = 0 [pid 335] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 335] write(3, "1000", 4) = 4 [pid 335] close(3) = 0 [pid 335] read(200, 0x7fff2b3a1cd0, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 335] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 335] write(1, "executing program\n", 18) = 18 [pid 335] mkdirat(AT_FDCWD, "./config", 0777) = 0 [pid 335] mount(NULL, "./config", "configfs", 0, NULL) = 0 [pid 335] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 335] rmdir(NULL) = -1 EFAULT (Bad address) [pid 335] rmdir("./config/usb_gadget/g1") = 0 [pid 335] close(3) = -1 EBADF (Bad file descriptor) [pid 335] close(4) = -1 EBADF (Bad file descriptor) [pid 335] close(5) = -1 EBADF (Bad file descriptor) [pid 335] close(6) = -1 EBADF (Bad file descriptor) [pid 335] close(7) = -1 EBADF (Bad file descriptor) [pid 335] close(8) = -1 EBADF (Bad file descriptor) [pid 335] close(9) = -1 EBADF (Bad file descriptor) [pid 335] close(10) = -1 EBADF (Bad file descriptor) [pid 335] close(11) = -1 EBADF (Bad file descriptor) [pid 335] close(12) = -1 EBADF (Bad file descriptor) [pid 335] close(13) = -1 EBADF (Bad file descriptor) [pid 335] close(14) = -1 EBADF (Bad file descriptor) [pid 335] close(15) = -1 EBADF (Bad file descriptor) [pid 335] close(16) = -1 EBADF (Bad file descriptor) [pid 335] close(17) = -1 EBADF (Bad file descriptor) [pid 335] close(18) = -1 EBADF (Bad file descriptor) [pid 335] close(19) = -1 EBADF (Bad file descriptor) [pid 335] close(20) = -1 EBADF (Bad file descriptor) [pid 335] close(21) = -1 EBADF (Bad file descriptor) [pid 335] close(22) = -1 EBADF (Bad file descriptor) [pid 335] close(23) = -1 EBADF (Bad file descriptor) [pid 335] close(24) = -1 EBADF (Bad file descriptor) [pid 335] close(25) = -1 EBADF (Bad file descriptor) [pid 335] close(26) = -1 EBADF (Bad file descriptor) [pid 335] close(27) = -1 EBADF (Bad file descriptor) [pid 335] close(28) = -1 EBADF (Bad file descriptor) [pid 335] close(29) = -1 EBADF (Bad file descriptor) [pid 335] exit_group(0) = ? [pid 335] +++ exited with 0 +++ [pid 313] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=22, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 313] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 313] umount2("./20", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./20", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 313] fstat(3, {st_mode=S_IFDIR|0700, st_size=80, ...}) = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 4 entries */, 32768) = 112 [pid 313] umount2("./20/config", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 [pid 313] umount2("./20/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./20/config", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] umount2("./20/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./20/config", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 313] fstat(4, {st_mode=S_IFDIR|0700, st_size=40, ...}) = 0 [pid 313] getdents64(4, 0x55558b0427a0 /* 2 entries */, 32768) = 48 [pid 313] getdents64(4, 0x55558b0427a0 /* 0 entries */, 32768) = 0 [pid 313] close(4) = 0 [pid 313] rmdir("./20/config") = 0 [pid 313] umount2("./20/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./20/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] unlink("./20/binderfs") = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 0 entries */, 32768) = 0 [pid 313] close(3) = 0 [pid 313] rmdir("./20") = 0 [pid 313] mkdir("./21", 0777) = 0 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 313] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-12-rust/strace-static-x86_64: Process 336 attached , child_tidptr=0x55558b039690) = 23 [pid 336] set_robust_list(0x55558b0396a0, 24 [pid 313] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 336] <... set_robust_list resumed>) = 0 [pid 336] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 336] chdir("./21") = 0 [pid 336] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 336] setpgid(0, 0) = 0 [pid 336] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 336] write(3, "1000", 4) = 4 [pid 336] close(3) = 0 [pid 336] read(200, 0x7fff2b3a1cd0, 1000) = -1 EAGAIN (Resource temporarily unavailable) executing program [pid 336] symlink("/dev/binderfs", "./binderfs") = 0 [pid 336] write(1, "executing program\n", 18) = 18 [pid 336] mkdirat(AT_FDCWD, "./config", 0777) = 0 [pid 336] mount(NULL, "./config", "configfs", 0, NULL) = 0 [pid 336] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 336] rmdir(NULL) = -1 EFAULT (Bad address) [pid 336] rmdir("./config/usb_gadget/g1") = 0 [pid 336] close(3) = -1 EBADF (Bad file descriptor) [pid 336] close(4) = -1 EBADF (Bad file descriptor) [pid 336] close(5) = -1 EBADF (Bad file descriptor) [pid 336] close(6) = -1 EBADF (Bad file descriptor) [pid 336] close(7) = -1 EBADF (Bad file descriptor) [pid 336] close(8) = -1 EBADF (Bad file descriptor) [pid 336] close(9) = -1 EBADF (Bad file descriptor) [pid 336] close(10) = -1 EBADF (Bad file descriptor) [pid 336] close(11) = -1 EBADF (Bad file descriptor) [pid 336] close(12) = -1 EBADF (Bad file descriptor) [pid 336] close(13) = -1 EBADF (Bad file descriptor) [pid 336] close(14) = -1 EBADF (Bad file descriptor) [pid 336] close(15) = -1 EBADF (Bad file descriptor) [pid 336] close(16) = -1 EBADF (Bad file descriptor) [pid 336] close(17) = -1 EBADF (Bad file descriptor) [pid 336] close(18) = -1 EBADF (Bad file descriptor) [pid 336] close(19) = -1 EBADF (Bad file descriptor) [pid 336] close(20) = -1 EBADF (Bad file descriptor) [pid 336] close(21) = -1 EBADF (Bad file descriptor) [pid 336] close(22) = -1 EBADF (Bad file descriptor) [pid 336] close(23) = -1 EBADF (Bad file descriptor) [pid 336] close(24) = -1 EBADF (Bad file descriptor) [pid 336] close(25) = -1 EBADF (Bad file descriptor) [pid 336] close(26) = -1 EBADF (Bad file descriptor) [pid 336] close(27) = -1 EBADF (Bad file descriptor) [pid 336] close(28) = -1 EBADF (Bad file descriptor) [pid 336] close(29) = -1 EBADF (Bad file descriptor) [pid 336] exit_group(0) = ? [pid 336] +++ exited with 0 +++ [pid 313] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=23, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 313] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 313] umount2("./21", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./21", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 313] fstat(3, {st_mode=S_IFDIR|0700, st_size=80, ...}) = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 4 entries */, 32768) = 112 [pid 313] umount2("./21/config", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 [pid 313] umount2("./21/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./21/config", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] umount2("./21/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./21/config", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 313] fstat(4, {st_mode=S_IFDIR|0700, st_size=40, ...}) = 0 [pid 313] getdents64(4, 0x55558b0427a0 /* 2 entries */, 32768) = 48 [pid 313] getdents64(4, 0x55558b0427a0 /* 0 entries */, 32768) = 0 [pid 313] close(4) = 0 [pid 313] rmdir("./21/config") = 0 [pid 313] umount2("./21/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./21/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] unlink("./21/binderfs") = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 0 entries */, 32768) = 0 [pid 313] close(3) = 0 [pid 313] rmdir("./21") = 0 [pid 313] mkdir("./22", 0777) = 0 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 313] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-12-rust/strace-static-x86_64: Process 337 attached , child_tidptr=0x55558b039690) = 24 [pid 313] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 337] set_robust_list(0x55558b0396a0, 24) = 0 [pid 337] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 337] chdir("./22") = 0 [pid 337] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 337] setpgid(0, 0) = 0 [pid 337] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 337] write(3, "1000", 4) = 4 [pid 337] close(3) = 0 [pid 337] read(200, 0x7fff2b3a1cd0, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 337] symlink("/dev/binderfs", "./binderfs") = 0 [pid 337] write(1, "executing program\n", 18) = 18 executing program [pid 337] mkdirat(AT_FDCWD, "./config", 0777) = 0 [pid 337] mount(NULL, "./config", "configfs", 0, NULL) = 0 [pid 337] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 337] rmdir(NULL) = -1 EFAULT (Bad address) [pid 337] rmdir("./config/usb_gadget/g1") = 0 [pid 337] close(3) = -1 EBADF (Bad file descriptor) [pid 337] close(4) = -1 EBADF (Bad file descriptor) [pid 337] close(5) = -1 EBADF (Bad file descriptor) [pid 337] close(6) = -1 EBADF (Bad file descriptor) [pid 337] close(7) = -1 EBADF (Bad file descriptor) [pid 337] close(8) = -1 EBADF (Bad file descriptor) [pid 337] close(9) = -1 EBADF (Bad file descriptor) [pid 337] close(10) = -1 EBADF (Bad file descriptor) [pid 337] close(11) = -1 EBADF (Bad file descriptor) [pid 337] close(12) = -1 EBADF (Bad file descriptor) [pid 337] close(13) = -1 EBADF (Bad file descriptor) [pid 337] close(14) = -1 EBADF (Bad file descriptor) [pid 337] close(15) = -1 EBADF (Bad file descriptor) [pid 337] close(16) = -1 EBADF (Bad file descriptor) [pid 337] close(17) = -1 EBADF (Bad file descriptor) [pid 337] close(18) = -1 EBADF (Bad file descriptor) [pid 337] close(19) = -1 EBADF (Bad file descriptor) [pid 337] close(20) = -1 EBADF (Bad file descriptor) [pid 337] close(21) = -1 EBADF (Bad file descriptor) [pid 337] close(22) = -1 EBADF (Bad file descriptor) [pid 337] close(23) = -1 EBADF (Bad file descriptor) [pid 337] close(24) = -1 EBADF (Bad file descriptor) [pid 337] close(25) = -1 EBADF (Bad file descriptor) [pid 337] close(26) = -1 EBADF (Bad file descriptor) [pid 337] close(27) = -1 EBADF (Bad file descriptor) [pid 337] close(28) = -1 EBADF (Bad file descriptor) [pid 337] close(29) = -1 EBADF (Bad file descriptor) [pid 337] exit_group(0) = ? [pid 337] +++ exited with 0 +++ [pid 313] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=24, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 313] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 313] umount2("./22", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./22", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 313] fstat(3, {st_mode=S_IFDIR|0700, st_size=80, ...}) = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 4 entries */, 32768) = 112 [pid 313] umount2("./22/config", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 [pid 313] umount2("./22/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./22/config", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] umount2("./22/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./22/config", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 313] fstat(4, {st_mode=S_IFDIR|0700, st_size=40, ...}) = 0 [pid 313] getdents64(4, 0x55558b0427a0 /* 2 entries */, 32768) = 48 [pid 313] getdents64(4, 0x55558b0427a0 /* 0 entries */, 32768) = 0 [pid 313] close(4) = 0 [pid 313] rmdir("./22/config") = 0 [pid 313] umount2("./22/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./22/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] unlink("./22/binderfs") = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 0 entries */, 32768) = 0 [pid 313] close(3) = 0 [pid 313] rmdir("./22") = 0 [pid 313] mkdir("./23", 0777) = 0 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 313] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55558b039690) = 25 ci2-android-6-12-rust/strace-static-x86_64: Process 338 attached [pid 313] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 338] set_robust_list(0x55558b0396a0, 24) = 0 [pid 338] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 338] chdir("./23") = 0 [pid 338] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 338] setpgid(0, 0) = 0 [pid 338] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 338] write(3, "1000", 4) = 4 [pid 338] close(3) = 0 [pid 338] read(200, 0x7fff2b3a1cd0, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 338] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 338] write(1, "executing program\n", 18) = 18 [pid 338] mkdirat(AT_FDCWD, "./config", 0777) = 0 [pid 338] mount(NULL, "./config", "configfs", 0, NULL) = 0 [pid 338] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 338] rmdir(NULL) = -1 EFAULT (Bad address) [pid 338] rmdir("./config/usb_gadget/g1") = 0 [pid 338] close(3) = -1 EBADF (Bad file descriptor) [pid 338] close(4) = -1 EBADF (Bad file descriptor) [pid 338] close(5) = -1 EBADF (Bad file descriptor) [pid 338] close(6) = -1 EBADF (Bad file descriptor) [pid 338] close(7) = -1 EBADF (Bad file descriptor) [pid 338] close(8) = -1 EBADF (Bad file descriptor) [pid 338] close(9) = -1 EBADF (Bad file descriptor) [pid 338] close(10) = -1 EBADF (Bad file descriptor) [pid 338] close(11) = -1 EBADF (Bad file descriptor) [pid 338] close(12) = -1 EBADF (Bad file descriptor) [pid 338] close(13) = -1 EBADF (Bad file descriptor) [pid 338] close(14) = -1 EBADF (Bad file descriptor) [pid 338] close(15) = -1 EBADF (Bad file descriptor) [pid 338] close(16) = -1 EBADF (Bad file descriptor) [pid 338] close(17) = -1 EBADF (Bad file descriptor) [pid 338] close(18) = -1 EBADF (Bad file descriptor) [pid 338] close(19) = -1 EBADF (Bad file descriptor) [pid 338] close(20) = -1 EBADF (Bad file descriptor) [pid 338] close(21) = -1 EBADF (Bad file descriptor) [pid 338] close(22) = -1 EBADF (Bad file descriptor) [pid 338] close(23) = -1 EBADF (Bad file descriptor) [pid 338] close(24) = -1 EBADF (Bad file descriptor) [pid 338] close(25) = -1 EBADF (Bad file descriptor) [pid 338] close(26) = -1 EBADF (Bad file descriptor) [pid 338] close(27) = -1 EBADF (Bad file descriptor) [pid 338] close(28) = -1 EBADF (Bad file descriptor) [pid 338] close(29) = -1 EBADF (Bad file descriptor) [pid 338] exit_group(0) = ? [pid 338] +++ exited with 0 +++ [pid 313] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=25, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 313] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 313] umount2("./23", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./23", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 313] fstat(3, {st_mode=S_IFDIR|0700, st_size=80, ...}) = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 4 entries */, 32768) = 112 [pid 313] umount2("./23/config", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 [pid 313] umount2("./23/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./23/config", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] umount2("./23/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./23/config", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 313] fstat(4, {st_mode=S_IFDIR|0700, st_size=40, ...}) = 0 [pid 313] getdents64(4, 0x55558b0427a0 /* 2 entries */, 32768) = 48 [pid 313] getdents64(4, 0x55558b0427a0 /* 0 entries */, 32768) = 0 [pid 313] close(4) = 0 [pid 313] rmdir("./23/config") = 0 [pid 313] umount2("./23/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./23/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] unlink("./23/binderfs") = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 0 entries */, 32768) = 0 [pid 313] close(3) = 0 [pid 313] rmdir("./23") = 0 [pid 313] mkdir("./24", 0777) = 0 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 313] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-12-rust/strace-static-x86_64: Process 339 attached , child_tidptr=0x55558b039690) = 26 [pid 313] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 339] set_robust_list(0x55558b0396a0, 24) = 0 [pid 339] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 339] chdir("./24") = 0 [pid 339] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 339] setpgid(0, 0) = 0 [pid 339] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 339] write(3, "1000", 4) = 4 [pid 339] close(3) = 0 [pid 339] read(200, 0x7fff2b3a1cd0, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 339] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 339] write(1, "executing program\n", 18) = 18 [pid 339] mkdirat(AT_FDCWD, "./config", 0777) = 0 [pid 339] mount(NULL, "./config", "configfs", 0, NULL) = 0 [pid 339] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 339] rmdir(NULL) = -1 EFAULT (Bad address) [pid 339] rmdir("./config/usb_gadget/g1") = 0 [pid 339] close(3) = -1 EBADF (Bad file descriptor) [pid 339] close(4) = -1 EBADF (Bad file descriptor) [pid 339] close(5) = -1 EBADF (Bad file descriptor) [pid 339] close(6) = -1 EBADF (Bad file descriptor) [pid 339] close(7) = -1 EBADF (Bad file descriptor) [pid 339] close(8) = -1 EBADF (Bad file descriptor) [pid 339] close(9) = -1 EBADF (Bad file descriptor) [pid 339] close(10) = -1 EBADF (Bad file descriptor) [pid 339] close(11) = -1 EBADF (Bad file descriptor) [pid 339] close(12) = -1 EBADF (Bad file descriptor) [pid 339] close(13) = -1 EBADF (Bad file descriptor) [pid 339] close(14) = -1 EBADF (Bad file descriptor) [pid 339] close(15) = -1 EBADF (Bad file descriptor) [pid 339] close(16) = -1 EBADF (Bad file descriptor) [pid 339] close(17) = -1 EBADF (Bad file descriptor) [pid 339] close(18) = -1 EBADF (Bad file descriptor) [pid 339] close(19) = -1 EBADF (Bad file descriptor) [pid 339] close(20) = -1 EBADF (Bad file descriptor) [pid 339] close(21) = -1 EBADF (Bad file descriptor) [pid 339] close(22) = -1 EBADF (Bad file descriptor) [pid 339] close(23) = -1 EBADF (Bad file descriptor) [pid 339] close(24) = -1 EBADF (Bad file descriptor) [pid 339] close(25) = -1 EBADF (Bad file descriptor) [pid 339] close(26) = -1 EBADF (Bad file descriptor) [pid 339] close(27) = -1 EBADF (Bad file descriptor) [pid 339] close(28) = -1 EBADF (Bad file descriptor) [pid 339] close(29) = -1 EBADF (Bad file descriptor) [pid 339] exit_group(0) = ? [pid 339] +++ exited with 0 +++ [pid 313] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=26, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 313] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 313] umount2("./24", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./24", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 313] fstat(3, {st_mode=S_IFDIR|0700, st_size=80, ...}) = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 4 entries */, 32768) = 112 [pid 313] umount2("./24/config", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 [pid 313] umount2("./24/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./24/config", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] umount2("./24/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./24/config", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 313] fstat(4, {st_mode=S_IFDIR|0700, st_size=40, ...}) = 0 [pid 313] getdents64(4, 0x55558b0427a0 /* 2 entries */, 32768) = 48 [pid 313] getdents64(4, 0x55558b0427a0 /* 0 entries */, 32768) = 0 [pid 313] close(4) = 0 [pid 313] rmdir("./24/config") = 0 [pid 313] umount2("./24/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./24/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] unlink("./24/binderfs") = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 0 entries */, 32768) = 0 [pid 313] close(3) = 0 [pid 313] rmdir("./24") = 0 [pid 313] mkdir("./25", 0777) = 0 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 313] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-12-rust/strace-static-x86_64: Process 340 attached [pid 340] set_robust_list(0x55558b0396a0, 24) = 0 [pid 340] rt_sigprocmask(SIG_SETMASK, [] [pid 313] <... clone resumed>, child_tidptr=0x55558b039690) = 27 [pid 340] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 340] chdir("./25" [pid 313] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 340] <... chdir resumed>) = 0 [pid 340] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 340] setpgid(0, 0) = 0 [pid 340] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 340] write(3, "1000", 4) = 4 [pid 340] close(3) = 0 [pid 340] read(200, 0x7fff2b3a1cd0, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 340] symlink("/dev/binderfs", "./binderfs") = 0 [pid 340] write(1, "executing program\n", 18) = 18 [pid 340] mkdirat(AT_FDCWD, "./config", 0777) = 0 [pid 340] mount(NULL, "./config", "configfs", 0, NULL) = 0 executing program [pid 340] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 340] rmdir(NULL) = -1 EFAULT (Bad address) [ 26.513479][ T340] BUG: scheduling while atomic: syz-executor234/340/0x00000002 [ 26.521051][ T340] Modules linked in: [ 26.524923][ T340] CPU: 0 UID: 0 PID: 340 Comm: syz-executor234 Tainted: G W syzkaller #0 119f1c0cd44458c2ddc7f806e6d4d2dd11ae7dae [ 26.524941][ T340] Tainted: [W]=WARN [ 26.524945][ T340] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 26.524951][ T340] Call Trace: [ 26.524954][ T340] [ 26.524959][ T340] __dump_stack+0x21/0x30 [ 26.524977][ T340] dump_stack_lvl+0x140/0x1c0 [ 26.524990][ T340] ? __cfi_dump_stack_lvl+0x10/0x10 [ 26.525004][ T340] ? stack_trace_save+0xaa/0x100 [ 26.525016][ T340] dump_stack+0x19/0x20 [ 26.525029][ T340] __schedule_bug+0x12b/0x200 [ 26.525040][ T340] ? find_proxy_task+0x2460/0x2460 [ 26.525051][ T340] ? kasan_save_stack+0x4d/0x60 [ 26.525062][ T340] ? kasan_save_stack+0x3e/0x60 [ 26.525073][ T340] ? __kasan_record_aux_stack+0xb2/0xd0 [ 26.525087][ T340] ? kasan_record_aux_stack_noalloc+0xf/0x20 [ 26.525101][ T340] ? call_rcu+0x14/0x20 [ 26.525112][ T340] ? kernfs_put+0x1de/0x360 [ 26.525124][ T340] ? kernfs_remove_by_name_ns+0x108/0x180 [ 26.525138][ T340] ? sysfs_delete_link+0x10f/0x140 [ 26.525148][ T340] __schedule+0xb85/0x20b0 [ 26.525162][ T340] ? __kasan_check_write+0x18/0x20 [ 26.525172][ T340] ? _raw_spin_trylock+0xb5/0x140 [ 26.525183][ T340] ? __cfi__raw_spin_trylock+0x10/0x10 [ 26.525195][ T340] ? _raw_spin_unlock+0x45/0x60 [ 26.525207][ T340] ? __sched_text_start+0x10/0x10 [ 26.525219][ T340] ? __kasan_check_write+0x18/0x20 [ 26.525229][ T340] ? _raw_spin_lock_irqsave+0xc1/0x160 [ 26.525241][ T340] ? __cfi__raw_spin_lock_irqsave+0x10/0x10 [ 26.525253][ T340] ? _raw_spin_unlock_irqrestore+0x4a/0x70 [ 26.525265][ T340] schedule+0xc5/0x240 [ 26.525277][ T340] kernfs_drain+0x278/0x420 [ 26.525290][ T340] ? kernfs_show+0x280/0x280 [ 26.525303][ T340] ? __cfi_autoremove_wake_function+0x10/0x10 [ 26.525314][ T340] ? __cfi_down_write+0x10/0x10 [ 26.525324][ T340] __kernfs_remove+0x402/0x940 [ 26.525338][ T340] kernfs_remove_by_name_ns+0x100/0x180 [ 26.525351][ T340] sysfs_remove_file_ns+0x68/0x80 [ 26.525361][ T340] device_del+0x56c/0xcf0 [ 26.525375][ T340] ? __cfi_device_del+0x10/0x10 [ 26.525389][ T340] ? __kasan_check_write+0x18/0x20 [ 26.525398][ T340] ? kobject_put+0x1cc/0x2a0 [ 26.525410][ T340] device_destroy+0xb0/0x100 [ 26.525418][ T340] ? __cfi_device_destroy+0x10/0x10 [ 26.525437][ T340] ? __kasan_check_write+0x18/0x20 [ 26.525447][ T340] android_device_destroy+0x118/0x180 [ 26.525461][ T340] gadgets_drop+0x1d/0x30 [ 26.525470][ T340] ? __cfi_gadgets_drop+0x10/0x10 [ 26.525479][ T340] configfs_rmdir+0x8b7/0x9b0 [ 26.525493][ T340] vfs_rmdir+0x3de/0x560 [ 26.525507][ T340] do_rmdir+0x29a/0x590 [ 26.525520][ T340] ? __cfi_do_rmdir+0x10/0x10 [ 26.525533][ T340] ? __kasan_check_write+0x18/0x20 [ 26.525543][ T340] __x64_sys_rmdir+0x4b/0x60 [ 26.525556][ T340] x64_sys_call+0xaf7/0x2ee0 [ 26.525566][ T340] do_syscall_64+0x57/0xf0 [ 26.525577][ T340] ? clear_bhb_loop+0x50/0xa0 [ 26.525592][ T340] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 26.525605][ T340] RIP: 0033:0x7fdb473ba219 [ 26.525615][ T340] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 26.525623][ T340] RSP: 002b:00007fff2b3a20c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 26.525634][ T340] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fdb473ba219 [ 26.525642][ T340] RDX: ffffffffffffffd8 RSI: 00007fdb473ba219 RDI: 0000200000000600 [ 26.525649][ T340] RBP: 0000000000000000 R08: 00007fff2b3a20e0 R09: 00007fff2b3a20e0 [ 26.525656][ T340] R10: 00007fff2b3a20e0 R11: 0000000000000246 R12: 00007fff2b3a20ec [ 26.525662][ T340] R13: 00007fff2b3a2120 R14: 00007fff2b3a2100 R15: 0000000000000019 [ 26.525670][ T340] [ 26.893213][ T340] BUG: scheduling while atomic: syz-executor234/340/0x00000000 [ 26.900788][ T340] Modules linked in: [ 26.904704][ T340] CPU: 0 UID: 0 PID: 340 Comm: syz-executor234 Tainted: G W syzkaller #0 119f1c0cd44458c2ddc7f806e6d4d2dd11ae7dae [ 26.904732][ T340] Tainted: [W]=WARN [ 26.904736][ T340] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 26.904742][ T340] Call Trace: [ 26.904746][ T340] [ 26.904751][ T340] __dump_stack+0x21/0x30 [ 26.904769][ T340] dump_stack_lvl+0x140/0x1c0 [ 26.904783][ T340] ? __cfi_dump_stack_lvl+0x10/0x10 [ 26.904797][ T340] dump_stack+0x19/0x20 [ 26.904810][ T340] __schedule_bug+0x12b/0x200 [ 26.904822][ T340] ? find_proxy_task+0x2460/0x2460 [ 26.904833][ T340] __schedule+0xb85/0x20b0 [ 26.904846][ T340] ? preempt_schedule+0xc5/0xe0 [ 26.904859][ T340] ? __cfi_preempt_schedule+0x10/0x10 [ 26.904872][ T340] ? __cfi___wake_up_sync_key+0x10/0x10 [ 26.904889][ T340] ? preempt_schedule_thunk+0x1a/0x40 [ 26.904900][ T340] ? __sched_text_start+0x10/0x10 [ 26.904912][ T340] ? __kasan_check_write+0x18/0x20 [ 26.904923][ T340] ? _raw_spin_lock_irq+0x93/0x120 [ 26.904935][ T340] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 26.904947][ T340] ? __kasan_check_read+0x15/0x20 [ 26.904956][ T340] ? cgroup_update_frozen+0x160/0x980 [ 26.904970][ T340] schedule+0xc5/0x240 [ 26.904982][ T340] ptrace_stop+0x528/0x8f0 [ 26.904994][ T340] ptrace_notify+0x1de/0x290 [ 26.905007][ T340] ? __cfi_ptrace_notify+0x10/0x10 [ 26.905020][ T340] ? __cfi_do_rmdir+0x10/0x10 [ 26.905035][ T340] ? __kasan_check_write+0x18/0x20 [ 26.905045][ T340] syscall_exit_work+0x84/0x150 [ 26.905055][ T340] syscall_exit_to_user_mode_prepare+0x21/0x40 [ 26.905064][ T340] syscall_exit_to_user_mode+0x15/0xb0 [ 26.905074][ T340] do_syscall_64+0x63/0xf0 [ 26.905086][ T340] ? clear_bhb_loop+0x50/0xa0 [ 26.905101][ T340] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 26.905115][ T340] RIP: 0033:0x7fdb473ba219 [ 26.905124][ T340] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [pid 340] rmdir("./config/usb_gadget/g1") = 0 [pid 340] close(3) = -1 EBADF (Bad file descriptor) [pid 340] close(4) = -1 EBADF (Bad file descriptor) [pid 340] close(5) = -1 EBADF (Bad file descriptor) [pid 340] close(6) = -1 EBADF (Bad file descriptor) [pid 340] close(7) = -1 EBADF (Bad file descriptor) [pid 340] close(8) = -1 EBADF (Bad file descriptor) [pid 340] close(9) = -1 EBADF (Bad file descriptor) [pid 340] close(10) = -1 EBADF (Bad file descriptor) [pid 340] close(11) = -1 EBADF (Bad file descriptor) [pid 340] close(12) = -1 EBADF (Bad file descriptor) [pid 340] close(13) = -1 EBADF (Bad file descriptor) [pid 340] close(14) = -1 EBADF (Bad file descriptor) [pid 340] close(15) = -1 EBADF (Bad file descriptor) [pid 340] close(16) = -1 EBADF (Bad file descriptor) [pid 340] close(17) = -1 EBADF (Bad file descriptor) [pid 340] close(18) = -1 EBADF (Bad file descriptor) [pid 340] close(19) = -1 EBADF (Bad file descriptor) [pid 340] close(20) = -1 EBADF (Bad file descriptor) [pid 340] close(21) = -1 EBADF (Bad file descriptor) [pid 340] close(22) = -1 EBADF (Bad file descriptor) [pid 340] close(23) = -1 EBADF (Bad file descriptor) [pid 340] close(24) = -1 EBADF (Bad file descriptor) [pid 340] close(25) = -1 EBADF (Bad file descriptor) [pid 340] close(26) = -1 EBADF (Bad file descriptor) [pid 340] close(27) = -1 EBADF (Bad file descriptor) [pid 340] close(28) = -1 EBADF (Bad file descriptor) [pid 340] close(29) = -1 EBADF (Bad file descriptor) [pid 340] exit_group(0) = ? [pid 340] +++ exited with 0 +++ [pid 313] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=27, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 313] umount2("./25", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./25", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 313] fstat(3, {st_mode=S_IFDIR|0700, st_size=80, ...}) = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 4 entries */, 32768) = 112 [pid 313] umount2("./25/config", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 [pid 313] umount2("./25/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./25/config", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] umount2("./25/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./25/config", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 313] fstat(4, {st_mode=S_IFDIR|0700, st_size=40, ...}) = 0 [pid 313] getdents64(4, 0x55558b0427a0 /* 2 entries */, 32768) = 48 [pid 313] getdents64(4, 0x55558b0427a0 /* 0 entries */, 32768) = 0 [pid 313] close(4) = 0 [pid 313] rmdir("./25/config") = 0 [pid 313] umount2("./25/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./25/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] unlink("./25/binderfs") = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 0 entries */, 32768) = 0 [pid 313] close(3) = 0 [pid 313] rmdir("./25") = 0 [pid 313] mkdir("./26", 0777) = 0 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 313] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-12-rust/strace-static-x86_64: Process 341 attached , child_tidptr=0x55558b039690) = 28 [pid 313] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 341] set_robust_list(0x55558b0396a0, 24) = 0 [pid 341] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 341] chdir("./26") = 0 [pid 341] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 341] setpgid(0, 0) = 0 [pid 341] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 341] write(3, "1000", 4) = 4 [pid 341] close(3) = 0 [pid 341] read(200, 0x7fff2b3a1cd0, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 341] symlink("/dev/binderfs", "./binderfs") = 0 [pid 341] write(1, "executing program\n", 18) = 18 executing program [pid 341] mkdirat(AT_FDCWD, "./config", 0777) = 0 [pid 341] mount(NULL, "./config", "configfs", 0, NULL) = 0 [pid 341] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 341] rmdir(NULL) = -1 EFAULT (Bad address) [pid 341] rmdir("./config/usb_gadget/g1") = 0 [pid 341] close(3) = -1 EBADF (Bad file descriptor) [pid 341] close(4) = -1 EBADF (Bad file descriptor) [pid 341] close(5) = -1 EBADF (Bad file descriptor) [pid 341] close(6) = -1 EBADF (Bad file descriptor) [pid 341] close(7) = -1 EBADF (Bad file descriptor) [pid 341] close(8) = -1 EBADF (Bad file descriptor) [pid 341] close(9) = -1 EBADF (Bad file descriptor) [pid 341] close(10) = -1 EBADF (Bad file descriptor) [pid 341] close(11) = -1 EBADF (Bad file descriptor) [pid 341] close(12) = -1 EBADF (Bad file descriptor) [pid 341] close(13) = -1 EBADF (Bad file descriptor) [pid 341] close(14) = -1 EBADF (Bad file descriptor) [pid 341] close(15) = -1 EBADF (Bad file descriptor) [pid 341] close(16) = -1 EBADF (Bad file descriptor) [pid 341] close(17) = -1 EBADF (Bad file descriptor) [pid 341] close(18) = -1 EBADF (Bad file descriptor) [pid 341] close(19) = -1 EBADF (Bad file descriptor) [pid 341] close(20) = -1 EBADF (Bad file descriptor) [pid 341] close(21) = -1 EBADF (Bad file descriptor) [pid 341] close(22) = -1 EBADF (Bad file descriptor) [pid 341] close(23) = -1 EBADF (Bad file descriptor) [pid 341] close(24) = -1 EBADF (Bad file descriptor) [pid 341] close(25) = -1 EBADF (Bad file descriptor) [pid 341] close(26) = -1 EBADF (Bad file descriptor) [pid 341] close(27) = -1 EBADF (Bad file descriptor) [pid 341] close(28) = -1 EBADF (Bad file descriptor) [pid 341] close(29) = -1 EBADF (Bad file descriptor) [pid 341] exit_group(0) = ? [pid 341] +++ exited with 0 +++ [pid 313] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=28, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 313] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 313] umount2("./26", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./26", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 313] fstat(3, {st_mode=S_IFDIR|0700, st_size=80, ...}) = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 4 entries */, 32768) = 112 [pid 313] umount2("./26/config", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 [pid 313] umount2("./26/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./26/config", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] umount2("./26/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./26/config", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 313] fstat(4, {st_mode=S_IFDIR|0700, st_size=40, ...}) = 0 [pid 313] getdents64(4, 0x55558b0427a0 /* 2 entries */, 32768) = 48 [pid 313] getdents64(4, 0x55558b0427a0 /* 0 entries */, 32768) = 0 [pid 313] close(4) = 0 [pid 313] rmdir("./26/config") = 0 [pid 313] umount2("./26/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./26/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] unlink("./26/binderfs") = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 0 entries */, 32768) = 0 [pid 313] close(3) = 0 [pid 313] rmdir("./26") = 0 [pid 313] mkdir("./27", 0777) = 0 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 313] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-12-rust/strace-static-x86_64: Process 342 attached , child_tidptr=0x55558b039690) = 29 [pid 313] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 342] set_robust_list(0x55558b0396a0, 24) = 0 [pid 342] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 342] chdir("./27") = 0 [pid 342] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 342] setpgid(0, 0) = 0 [pid 342] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 342] write(3, "1000", 4) = 4 [pid 342] close(3) = 0 [pid 342] read(200, 0x7fff2b3a1cd0, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 342] symlink("/dev/binderfs", "./binderfs") = 0 [pid 342] write(1, "executing program\n", 18) = 18 executing program [pid 342] mkdirat(AT_FDCWD, "./config", 0777) = 0 [pid 342] mount(NULL, "./config", "configfs", 0, NULL) = 0 [pid 342] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 342] rmdir(NULL) = -1 EFAULT (Bad address) [pid 342] rmdir("./config/usb_gadget/g1") = 0 [pid 342] close(3) = -1 EBADF (Bad file descriptor) [pid 342] close(4) = -1 EBADF (Bad file descriptor) [pid 342] close(5) = -1 EBADF (Bad file descriptor) [ 26.905133][ T340] RSP: 002b:00007fff2b3a20c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 26.905144][ T340] RAX: 0000000000000000 RBX: 0000000000000003 RCX: 00007fdb473ba219 [ 26.905151][ T340] RDX: ffffffffffffffd8 RSI: 00007fdb473ba219 RDI: 0000200000000600 [ 26.905158][ T340] RBP: 0000000000000000 R08: 00007fff2b3a20e0 R09: 00007fff2b3a20e0 [ 26.905165][ T340] R10: 00007fff2b3a20e0 R11: 0000000000000246 R12: 00007fff2b3a20ec [ 26.905172][ T340] R13: 00007fff2b3a2120 R14: 00007fff2b3a2100 R15: 0000000000000019 [ 26.905180][ T340] [pid 342] close(6) = -1 EBADF (Bad file descriptor) [pid 342] close(7) = -1 EBADF (Bad file descriptor) [pid 342] close(8) = -1 EBADF (Bad file descriptor) [pid 342] close(9) = -1 EBADF (Bad file descriptor) [pid 342] close(10) = -1 EBADF (Bad file descriptor) [pid 342] close(11) = -1 EBADF (Bad file descriptor) [pid 342] close(12) = -1 EBADF (Bad file descriptor) [pid 342] close(13) = -1 EBADF (Bad file descriptor) [pid 342] close(14) = -1 EBADF (Bad file descriptor) [pid 342] close(15) = -1 EBADF (Bad file descriptor) [pid 342] close(16) = -1 EBADF (Bad file descriptor) [pid 342] close(17) = -1 EBADF (Bad file descriptor) [pid 342] close(18) = -1 EBADF (Bad file descriptor) [pid 342] close(19) = -1 EBADF (Bad file descriptor) [pid 342] close(20) = -1 EBADF (Bad file descriptor) [pid 342] close(21) = -1 EBADF (Bad file descriptor) [pid 342] close(22) = -1 EBADF (Bad file descriptor) [pid 342] close(23) = -1 EBADF (Bad file descriptor) [pid 342] close(24) = -1 EBADF (Bad file descriptor) [pid 342] close(25) = -1 EBADF (Bad file descriptor) [pid 342] close(26) = -1 EBADF (Bad file descriptor) [pid 342] close(27) = -1 EBADF (Bad file descriptor) [pid 342] close(28) = -1 EBADF (Bad file descriptor) [pid 342] close(29) = -1 EBADF (Bad file descriptor) [pid 342] exit_group(0) = ? [pid 342] +++ exited with 0 +++ [pid 313] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=29, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 313] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 313] umount2("./27", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./27", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 313] fstat(3, {st_mode=S_IFDIR|0700, st_size=80, ...}) = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 4 entries */, 32768) = 112 [pid 313] umount2("./27/config", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 [pid 313] umount2("./27/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./27/config", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] umount2("./27/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./27/config", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 313] fstat(4, {st_mode=S_IFDIR|0700, st_size=40, ...}) = 0 [pid 313] getdents64(4, 0x55558b0427a0 /* 2 entries */, 32768) = 48 [pid 313] getdents64(4, 0x55558b0427a0 /* 0 entries */, 32768) = 0 [pid 313] close(4) = 0 [pid 313] rmdir("./27/config") = 0 [pid 313] umount2("./27/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./27/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] unlink("./27/binderfs") = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 0 entries */, 32768) = 0 [pid 313] close(3) = 0 [pid 313] rmdir("./27") = 0 [pid 313] mkdir("./28", 0777) = 0 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 313] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-12-rust/strace-static-x86_64: Process 343 attached , child_tidptr=0x55558b039690) = 30 [pid 343] set_robust_list(0x55558b0396a0, 24) = 0 [pid 313] rt_sigprocmask(SIG_SETMASK, [] [pid 343] rt_sigprocmask(SIG_SETMASK, [] [pid 313] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 343] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 343] chdir("./28") = 0 [pid 343] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 343] setpgid(0, 0) = 0 [pid 343] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 343] write(3, "1000", 4) = 4 [pid 343] close(3) = 0 [pid 343] read(200, 0x7fff2b3a1cd0, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 343] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 343] write(1, "executing program\n", 18) = 18 [pid 343] mkdirat(AT_FDCWD, "./config", 0777) = 0 [pid 343] mount(NULL, "./config", "configfs", 0, NULL) = 0 [pid 343] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 343] rmdir(NULL) = -1 EFAULT (Bad address) [ 27.224867][ T343] BUG: scheduling while atomic: syz-executor234/343/0x00000002 [ 27.232466][ T343] Modules linked in: [ 27.236371][ T343] CPU: 0 UID: 0 PID: 343 Comm: syz-executor234 Tainted: G W syzkaller #0 119f1c0cd44458c2ddc7f806e6d4d2dd11ae7dae [ 27.236390][ T343] Tainted: [W]=WARN [ 27.236394][ T343] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 27.236400][ T343] Call Trace: [ 27.236404][ T343] [ 27.236408][ T343] __dump_stack+0x21/0x30 [ 27.236426][ T343] dump_stack_lvl+0x140/0x1c0 [ 27.236440][ T343] ? __cfi_dump_stack_lvl+0x10/0x10 [ 27.236454][ T343] dump_stack+0x19/0x20 [ 27.236467][ T343] __schedule_bug+0x12b/0x200 [ 27.236479][ T343] ? find_proxy_task+0x2460/0x2460 [ 27.236489][ T343] ? kernel_text_address+0xa9/0xe0 [ 27.236502][ T343] ? __kernel_text_address+0x11/0x40 [ 27.236515][ T343] ? unwind_get_return_address+0x51/0x90 [ 27.236528][ T343] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 27.236540][ T343] __schedule+0xb85/0x20b0 [ 27.236555][ T343] ? stack_trace_save+0xaa/0x100 [ 27.236566][ T343] ? __sched_text_start+0x10/0x10 [ 27.236579][ T343] ? __kasan_check_read+0x15/0x20 [ 27.236589][ T343] ? rwsem_spin_on_owner+0xa4/0x3b0 [ 27.236605][ T343] ? __kasan_check_write+0x18/0x20 [ 27.236615][ T343] ? _raw_spin_lock_irq+0x93/0x120 [ 27.236627][ T343] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 27.236638][ T343] schedule+0xc5/0x240 [ 27.236650][ T343] schedule_preempt_disabled+0x14/0x30 [ 27.236663][ T343] rwsem_down_write_slowpath+0x5c9/0x1b60 [ 27.236675][ T343] ? rwsem_down_read_slowpath+0x14c0/0x14c0 [ 27.236684][ T343] ? try_to_wake_up+0x111a/0x1fd0 [ 27.236696][ T343] ? __kasan_check_write+0x18/0x20 [ 27.236705][ T343] ? wake_q_add_safe+0x29/0x100 [ 27.236714][ T343] ? cpus_share_resources+0xa0/0x130 [ 27.236725][ T343] ? rwsem_mark_wake+0x507/0x770 [ 27.236740][ T343] ? __kasan_check_write+0x18/0x20 [ 27.236749][ T343] ? rwsem_read_trylock+0x275/0x5a0 [ 27.236763][ T343] ? downgrade_write+0x470/0x470 [ 27.236777][ T343] down_write+0x163/0x2b0 [ 27.236786][ T343] ? __cfi_down_write+0x10/0x10 [ 27.236796][ T343] ? __kasan_check_write+0x18/0x20 [ 27.236805][ T343] kernfs_remove_by_name_ns+0x8c/0x180 [ 27.236820][ T343] sysfs_remove_group+0x108/0x250 [ 27.236831][ T343] dpm_sysfs_remove+0x99/0xd0 [ 27.236850][ T343] device_del+0x241/0xcf0 [ 27.236864][ T343] ? __cfi_class_find_device+0x10/0x10 [ 27.236875][ T343] ? __cfi_device_del+0x10/0x10 [ 27.236888][ T343] ? __kasan_check_write+0x18/0x20 [ 27.236897][ T343] ? kobject_put+0x1cc/0x2a0 [ 27.236909][ T343] device_destroy+0xb0/0x100 [ 27.236918][ T343] ? __cfi_device_destroy+0x10/0x10 [ 27.236932][ T343] ? __kasan_check_write+0x18/0x20 [ 27.236942][ T343] android_device_destroy+0x118/0x180 [ 27.236956][ T343] gadgets_drop+0x1d/0x30 [ 27.236965][ T343] ? __cfi_gadgets_drop+0x10/0x10 [ 27.236974][ T343] configfs_rmdir+0x8b7/0x9b0 [ 27.236987][ T343] vfs_rmdir+0x3de/0x560 [ 27.237001][ T343] do_rmdir+0x29a/0x590 [ 27.237014][ T343] ? __cfi_do_rmdir+0x10/0x10 [ 27.237028][ T343] ? __kasan_check_write+0x18/0x20 [ 27.237038][ T343] __x64_sys_rmdir+0x4b/0x60 [ 27.237051][ T343] x64_sys_call+0xaf7/0x2ee0 [ 27.237060][ T343] do_syscall_64+0x57/0xf0 [ 27.237072][ T343] ? clear_bhb_loop+0x50/0xa0 [ 27.237086][ T343] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 27.237100][ T343] RIP: 0033:0x7fdb473ba219 [ 27.237109][ T343] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 27.237117][ T343] RSP: 002b:00007fff2b3a20c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 27.237128][ T343] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fdb473ba219 [ 27.237136][ T343] RDX: ffffffffffffffd8 RSI: 00007fdb473ba219 RDI: 0000200000000600 [ 27.237143][ T343] RBP: 0000000000000000 R08: 00007fff2b3a20e0 R09: 00007fff2b3a20e0 [ 27.237150][ T343] R10: 00007fff2b3a20e0 R11: 0000000000000246 R12: 00007fff2b3a20ec [ 27.237157][ T343] R13: 00007fff2b3a2120 R14: 00007fff2b3a2100 R15: 000000000000001c [pid 343] rmdir("./config/usb_gadget/g1") = 0 [pid 343] close(3) = -1 EBADF (Bad file descriptor) [pid 343] close(4) = -1 EBADF (Bad file descriptor) [pid 343] close(5) = -1 EBADF (Bad file descriptor) [pid 343] close(6) = -1 EBADF (Bad file descriptor) [pid 343] close(7) = -1 EBADF (Bad file descriptor) [pid 343] close(8) = -1 EBADF (Bad file descriptor) [pid 343] close(9) = -1 EBADF (Bad file descriptor) [pid 343] close(10) = -1 EBADF (Bad file descriptor) [pid 343] close(11) = -1 EBADF (Bad file descriptor) [pid 343] close(12) = -1 EBADF (Bad file descriptor) [pid 343] close(13) = -1 EBADF (Bad file descriptor) [pid 343] close(14) = -1 EBADF (Bad file descriptor) [pid 343] close(15) = -1 EBADF (Bad file descriptor) [pid 343] close(16) = -1 EBADF (Bad file descriptor) [pid 343] close(17) = -1 EBADF (Bad file descriptor) [ 27.237165][ T343] [ 27.237373][ T343] BUG: scheduling while atomic: syz-executor234/343/0x00000000 [ 27.635076][ T343] Modules linked in: [ 27.638987][ T343] CPU: 1 UID: 0 PID: 343 Comm: syz-executor234 Tainted: G W syzkaller #0 119f1c0cd44458c2ddc7f806e6d4d2dd11ae7dae [ 27.639019][ T343] Tainted: [W]=WARN [ 27.639025][ T343] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 27.639036][ T343] Call Trace: [ 27.639043][ T343] [ 27.639050][ T343] __dump_stack+0x21/0x30 [ 27.639068][ T343] dump_stack_lvl+0x140/0x1c0 [ 27.639082][ T343] ? __cfi_dump_stack_lvl+0x10/0x10 [ 27.639096][ T343] dump_stack+0x19/0x20 [ 27.639109][ T343] __schedule_bug+0x12b/0x200 [ 27.639120][ T343] ? find_proxy_task+0x2460/0x2460 [ 27.639132][ T343] __schedule+0xb85/0x20b0 [ 27.639145][ T343] ? __wake_up_sync_key+0x1be/0x2c0 [ 27.639157][ T343] ? __cfi___wake_up_sync_key+0x10/0x10 [ 27.639169][ T343] ? __sched_text_start+0x10/0x10 [ 27.639182][ T343] ? __kasan_check_write+0x18/0x20 [ 27.639192][ T343] ? _raw_spin_lock_irq+0x93/0x120 [ 27.639205][ T343] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 27.639217][ T343] ? __kasan_check_read+0x15/0x20 [ 27.639226][ T343] ? cgroup_update_frozen+0x160/0x980 [ 27.639240][ T343] schedule+0xc5/0x240 [ 27.639253][ T343] ptrace_stop+0x528/0x8f0 [ 27.639265][ T343] ptrace_notify+0x1de/0x290 [ 27.639278][ T343] ? __cfi_ptrace_notify+0x10/0x10 [ 27.639297][ T343] ? __cfi_do_rmdir+0x10/0x10 [ 27.639312][ T343] ? __kasan_check_write+0x18/0x20 [ 27.639322][ T343] syscall_exit_work+0x84/0x150 [ 27.639331][ T343] syscall_exit_to_user_mode_prepare+0x21/0x40 [ 27.639341][ T343] syscall_exit_to_user_mode+0x15/0xb0 [ 27.639351][ T343] do_syscall_64+0x63/0xf0 [ 27.639362][ T343] ? clear_bhb_loop+0x50/0xa0 [ 27.639376][ T343] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 27.639390][ T343] RIP: 0033:0x7fdb473ba219 [ 27.639399][ T343] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 27.639407][ T343] RSP: 002b:00007fff2b3a20c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 27.639419][ T343] RAX: 0000000000000000 RBX: 0000000000000003 RCX: 00007fdb473ba219 [ 27.639426][ T343] RDX: ffffffffffffffd8 RSI: 00007fdb473ba219 RDI: 0000200000000600 [ 27.639433][ T343] RBP: 0000000000000000 R08: 00007fff2b3a20e0 R09: 00007fff2b3a20e0 [pid 343] close(18) = -1 EBADF (Bad file descriptor) [pid 343] close(19) = -1 EBADF (Bad file descriptor) [pid 343] close(20) = -1 EBADF (Bad file descriptor) [pid 343] close(21) = -1 EBADF (Bad file descriptor) [pid 343] close(22) = -1 EBADF (Bad file descriptor) [pid 343] close(23) = -1 EBADF (Bad file descriptor) [pid 343] close(24) = -1 EBADF (Bad file descriptor) [pid 343] close(25) = -1 EBADF (Bad file descriptor) [pid 343] close(26) = -1 EBADF (Bad file descriptor) [pid 343] close(27) = -1 EBADF (Bad file descriptor) [pid 343] close(28) = -1 EBADF (Bad file descriptor) [pid 343] close(29) = -1 EBADF (Bad file descriptor) [pid 343] exit_group(0) = ? [pid 343] +++ exited with 0 +++ [pid 313] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=30, si_uid=0, si_status=0, si_utime=0, si_stime=39 /* 0.39 s */} --- [pid 313] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 313] umount2("./28", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./28", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 313] fstat(3, {st_mode=S_IFDIR|0700, st_size=80, ...}) = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 4 entries */, 32768) = 112 [pid 313] umount2("./28/config", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 [pid 313] umount2("./28/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./28/config", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] umount2("./28/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./28/config", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 313] fstat(4, {st_mode=S_IFDIR|0700, st_size=40, ...}) = 0 [pid 313] getdents64(4, 0x55558b0427a0 /* 2 entries */, 32768) = 48 [pid 313] getdents64(4, 0x55558b0427a0 /* 0 entries */, 32768) = 0 [pid 313] close(4) = 0 [pid 313] rmdir("./28/config") = 0 [pid 313] umount2("./28/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./28/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] unlink("./28/binderfs") = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 0 entries */, 32768) = 0 [pid 313] close(3) = 0 [pid 313] rmdir("./28") = 0 [pid 313] mkdir("./29", 0777) = 0 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 313] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-12-rust/strace-static-x86_64: Process 344 attached , child_tidptr=0x55558b039690) = 31 [pid 344] set_robust_list(0x55558b0396a0, 24) = 0 [pid 313] rt_sigprocmask(SIG_SETMASK, [] [pid 344] rt_sigprocmask(SIG_SETMASK, [] [pid 313] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 344] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 344] chdir("./29") = 0 [pid 344] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 344] setpgid(0, 0) = 0 [pid 344] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 344] write(3, "1000", 4) = 4 [pid 344] close(3) = 0 [pid 344] read(200, 0x7fff2b3a1cd0, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 344] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 344] write(1, "executing program\n", 18) = 18 [pid 344] mkdirat(AT_FDCWD, "./config", 0777) = 0 [pid 344] mount(NULL, "./config", "configfs", 0, NULL) = 0 [pid 344] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 344] rmdir(NULL) = -1 EFAULT (Bad address) [pid 344] rmdir("./config/usb_gadget/g1") = 0 [pid 344] close(3) = -1 EBADF (Bad file descriptor) [pid 344] close(4) = -1 EBADF (Bad file descriptor) [pid 344] close(5) = -1 EBADF (Bad file descriptor) [pid 344] close(6) = -1 EBADF (Bad file descriptor) [pid 344] close(7) = -1 EBADF (Bad file descriptor) [pid 344] close(8) = -1 EBADF (Bad file descriptor) [pid 344] close(9) = -1 EBADF (Bad file descriptor) [pid 344] close(10) = -1 EBADF (Bad file descriptor) [pid 344] close(11) = -1 EBADF (Bad file descriptor) [pid 344] close(12) = -1 EBADF (Bad file descriptor) [pid 344] close(13) = -1 EBADF (Bad file descriptor) [pid 344] close(14) = -1 EBADF (Bad file descriptor) [pid 344] close(15) = -1 EBADF (Bad file descriptor) [pid 344] close(16) = -1 EBADF (Bad file descriptor) [pid 344] close(17) = -1 EBADF (Bad file descriptor) [pid 344] close(18) = -1 EBADF (Bad file descriptor) [pid 344] close(19) = -1 EBADF (Bad file descriptor) [pid 344] close(20) = -1 EBADF (Bad file descriptor) [pid 344] close(21) = -1 EBADF (Bad file descriptor) [pid 344] close(22) = -1 EBADF (Bad file descriptor) [pid 344] close(23) = -1 EBADF (Bad file descriptor) [pid 344] close(24) = -1 EBADF (Bad file descriptor) [pid 344] close(25) = -1 EBADF (Bad file descriptor) [pid 344] close(26) = -1 EBADF (Bad file descriptor) [pid 344] close(27) = -1 EBADF (Bad file descriptor) [pid 344] close(28) = -1 EBADF (Bad file descriptor) [pid 344] close(29) = -1 EBADF (Bad file descriptor) [pid 344] exit_group(0) = ? [pid 344] +++ exited with 0 +++ [pid 313] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=31, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 313] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 313] umount2("./29", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./29", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 313] fstat(3, {st_mode=S_IFDIR|0700, st_size=80, ...}) = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 4 entries */, 32768) = 112 [pid 313] umount2("./29/config", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 [pid 313] umount2("./29/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./29/config", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] umount2("./29/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./29/config", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 313] fstat(4, {st_mode=S_IFDIR|0700, st_size=40, ...}) = 0 [pid 313] getdents64(4, 0x55558b0427a0 /* 2 entries */, 32768) = 48 [pid 313] getdents64(4, 0x55558b0427a0 /* 0 entries */, 32768) = 0 [pid 313] close(4) = 0 [pid 313] rmdir("./29/config") = 0 [pid 313] umount2("./29/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./29/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] unlink("./29/binderfs") = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 0 entries */, 32768) = 0 [pid 313] close(3) = 0 [pid 313] rmdir("./29") = 0 [pid 313] mkdir("./30", 0777) = 0 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 313] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55558b039690) = 32 ci2-android-6-12-rust/strace-static-x86_64: Process 345 attached [pid 313] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 345] set_robust_list(0x55558b0396a0, 24) = 0 [pid 345] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 345] chdir("./30") = 0 [pid 345] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 345] setpgid(0, 0) = 0 [pid 345] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 345] write(3, "1000", 4) = 4 [pid 345] close(3) = 0 [pid 345] read(200, 0x7fff2b3a1cd0, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 345] symlink("/dev/binderfs", "./binderfs") = 0 [pid 345] write(1, "executing program\n", 18) = 18 executing program [pid 345] mkdirat(AT_FDCWD, "./config", 0777) = 0 [pid 345] mount(NULL, "./config", "configfs", 0, NULL) = 0 [pid 345] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 345] rmdir(NULL) = -1 EFAULT (Bad address) [pid 345] rmdir("./config/usb_gadget/g1") = 0 [pid 345] close(3) = -1 EBADF (Bad file descriptor) [pid 345] close(4) = -1 EBADF (Bad file descriptor) [pid 345] close(5) = -1 EBADF (Bad file descriptor) [pid 345] close(6) = -1 EBADF (Bad file descriptor) [pid 345] close(7) = -1 EBADF (Bad file descriptor) [pid 345] close(8) = -1 EBADF (Bad file descriptor) [pid 345] close(9) = -1 EBADF (Bad file descriptor) [pid 345] close(10) = -1 EBADF (Bad file descriptor) [pid 345] close(11) = -1 EBADF (Bad file descriptor) [pid 345] close(12) = -1 EBADF (Bad file descriptor) [pid 345] close(13) = -1 EBADF (Bad file descriptor) [pid 345] close(14) = -1 EBADF (Bad file descriptor) [pid 345] close(15) = -1 EBADF (Bad file descriptor) [pid 345] close(16) = -1 EBADF (Bad file descriptor) [pid 345] close(17) = -1 EBADF (Bad file descriptor) [pid 345] close(18) = -1 EBADF (Bad file descriptor) [pid 345] close(19) = -1 EBADF (Bad file descriptor) [pid 345] close(20) = -1 EBADF (Bad file descriptor) [pid 345] close(21) = -1 EBADF (Bad file descriptor) [pid 345] close(22) = -1 EBADF (Bad file descriptor) [pid 345] close(23) = -1 EBADF (Bad file descriptor) [pid 345] close(24) = -1 EBADF (Bad file descriptor) [pid 345] close(25) = -1 EBADF (Bad file descriptor) [pid 345] close(26) = -1 EBADF (Bad file descriptor) [pid 345] close(27) = -1 EBADF (Bad file descriptor) [pid 345] close(28) = -1 EBADF (Bad file descriptor) [pid 345] close(29) = -1 EBADF (Bad file descriptor) [pid 345] exit_group(0) = ? [pid 345] +++ exited with 0 +++ [pid 313] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=32, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 313] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 313] umount2("./30", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./30", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 313] fstat(3, {st_mode=S_IFDIR|0700, st_size=80, ...}) = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 4 entries */, 32768) = 112 [pid 313] umount2("./30/config", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 [pid 313] umount2("./30/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./30/config", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] umount2("./30/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./30/config", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 313] fstat(4, {st_mode=S_IFDIR|0700, st_size=40, ...}) = 0 [pid 313] getdents64(4, 0x55558b0427a0 /* 2 entries */, 32768) = 48 [pid 313] getdents64(4, 0x55558b0427a0 /* 0 entries */, 32768) = 0 [pid 313] close(4) = 0 [pid 313] rmdir("./30/config") = 0 [pid 313] umount2("./30/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./30/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] unlink("./30/binderfs") = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 0 entries */, 32768) = 0 [pid 313] close(3) = 0 [pid 313] rmdir("./30") = 0 [pid 313] mkdir("./31", 0777) = 0 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 313] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-12-rust/strace-static-x86_64: Process 346 attached , child_tidptr=0x55558b039690) = 33 [pid 313] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 346] set_robust_list(0x55558b0396a0, 24) = 0 [pid 346] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 346] chdir("./31") = 0 [pid 346] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 346] setpgid(0, 0) = 0 [pid 346] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 346] write(3, "1000", 4) = 4 [pid 346] close(3) = 0 [pid 346] read(200, 0x7fff2b3a1cd0, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 346] symlink("/dev/binderfs", "./binderfs") = 0 [pid 346] write(1, "executing program\n", 18) = 18 executing program [pid 346] mkdirat(AT_FDCWD, "./config", 0777) = 0 [pid 346] mount(NULL, "./config", "configfs", 0, NULL) = 0 [ 27.639440][ T343] R10: 00007fff2b3a20e0 R11: 0000000000000246 R12: 00007fff2b3a20ec [ 27.639447][ T343] R13: 00007fff2b3a2120 R14: 00007fff2b3a2100 R15: 000000000000001c [ 27.639455][ T343] [pid 346] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 346] rmdir(NULL) = -1 EFAULT (Bad address) [pid 346] rmdir("./config/usb_gadget/g1") = 0 [pid 346] close(3) = -1 EBADF (Bad file descriptor) [pid 346] close(4) = -1 EBADF (Bad file descriptor) [pid 346] close(5) = -1 EBADF (Bad file descriptor) [pid 346] close(6) = -1 EBADF (Bad file descriptor) [pid 346] close(7) = -1 EBADF (Bad file descriptor) [pid 346] close(8) = -1 EBADF (Bad file descriptor) [pid 346] close(9) = -1 EBADF (Bad file descriptor) [pid 346] close(10) = -1 EBADF (Bad file descriptor) [pid 346] close(11) = -1 EBADF (Bad file descriptor) [pid 346] close(12) = -1 EBADF (Bad file descriptor) [pid 346] close(13) = -1 EBADF (Bad file descriptor) [pid 346] close(14) = -1 EBADF (Bad file descriptor) [pid 346] close(15) = -1 EBADF (Bad file descriptor) [pid 346] close(16) = -1 EBADF (Bad file descriptor) [pid 346] close(17) = -1 EBADF (Bad file descriptor) [pid 346] close(18) = -1 EBADF (Bad file descriptor) [pid 346] close(19) = -1 EBADF (Bad file descriptor) [pid 346] close(20) = -1 EBADF (Bad file descriptor) [pid 346] close(21) = -1 EBADF (Bad file descriptor) [pid 346] close(22) = -1 EBADF (Bad file descriptor) [pid 346] close(23) = -1 EBADF (Bad file descriptor) [pid 346] close(24) = -1 EBADF (Bad file descriptor) [pid 346] close(25) = -1 EBADF (Bad file descriptor) [pid 346] close(26) = -1 EBADF (Bad file descriptor) [pid 346] close(27) = -1 EBADF (Bad file descriptor) [pid 346] close(28) = -1 EBADF (Bad file descriptor) [pid 346] close(29) = -1 EBADF (Bad file descriptor) [pid 346] exit_group(0) = ? [pid 346] +++ exited with 0 +++ [pid 313] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=33, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 313] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 313] umount2("./31", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./31", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 313] fstat(3, {st_mode=S_IFDIR|0700, st_size=80, ...}) = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 4 entries */, 32768) = 112 [pid 313] umount2("./31/config", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 [pid 313] umount2("./31/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./31/config", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] umount2("./31/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./31/config", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 313] fstat(4, {st_mode=S_IFDIR|0700, st_size=40, ...}) = 0 [pid 313] getdents64(4, 0x55558b0427a0 /* 2 entries */, 32768) = 48 [pid 313] getdents64(4, 0x55558b0427a0 /* 0 entries */, 32768) = 0 [pid 313] close(4) = 0 [pid 313] rmdir("./31/config") = 0 [pid 313] umount2("./31/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./31/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] unlink("./31/binderfs") = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 0 entries */, 32768) = 0 [pid 313] close(3) = 0 [pid 313] rmdir("./31") = 0 [pid 313] mkdir("./32", 0777) = 0 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 313] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55558b039690) = 34 ci2-android-6-12-rust/strace-static-x86_64: Process 347 attached [pid 313] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 347] set_robust_list(0x55558b0396a0, 24) = 0 [pid 347] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 347] chdir("./32") = 0 [pid 347] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 347] setpgid(0, 0) = 0 [pid 347] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 347] write(3, "1000", 4) = 4 [pid 347] close(3) = 0 [pid 347] read(200, 0x7fff2b3a1cd0, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 347] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 347] write(1, "executing program\n", 18) = 18 [pid 347] mkdirat(AT_FDCWD, "./config", 0777) = 0 [pid 347] mount(NULL, "./config", "configfs", 0, NULL) = 0 [pid 347] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 347] rmdir(NULL) = -1 EFAULT (Bad address) [pid 347] rmdir("./config/usb_gadget/g1") = 0 [pid 347] close(3) = -1 EBADF (Bad file descriptor) [pid 347] close(4) = -1 EBADF (Bad file descriptor) [pid 347] close(5) = -1 EBADF (Bad file descriptor) [pid 347] close(6) = -1 EBADF (Bad file descriptor) [pid 347] close(7) = -1 EBADF (Bad file descriptor) [pid 347] close(8) = -1 EBADF (Bad file descriptor) [pid 347] close(9) = -1 EBADF (Bad file descriptor) [pid 347] close(10) = -1 EBADF (Bad file descriptor) [pid 347] close(11) = -1 EBADF (Bad file descriptor) [pid 347] close(12) = -1 EBADF (Bad file descriptor) [pid 347] close(13) = -1 EBADF (Bad file descriptor) [pid 347] close(14) = -1 EBADF (Bad file descriptor) [pid 347] close(15) = -1 EBADF (Bad file descriptor) [pid 347] close(16) = -1 EBADF (Bad file descriptor) [pid 347] close(17) = -1 EBADF (Bad file descriptor) [pid 347] close(18) = -1 EBADF (Bad file descriptor) [pid 347] close(19) = -1 EBADF (Bad file descriptor) [pid 347] close(20) = -1 EBADF (Bad file descriptor) [pid 347] close(21) = -1 EBADF (Bad file descriptor) [pid 347] close(22) = -1 EBADF (Bad file descriptor) [pid 347] close(23) = -1 EBADF (Bad file descriptor) [pid 347] close(24) = -1 EBADF (Bad file descriptor) [pid 347] close(25) = -1 EBADF (Bad file descriptor) [pid 347] close(26) = -1 EBADF (Bad file descriptor) [pid 347] close(27) = -1 EBADF (Bad file descriptor) [pid 347] close(28) = -1 EBADF (Bad file descriptor) [pid 347] close(29) = -1 EBADF (Bad file descriptor) [pid 347] exit_group(0) = ? [pid 347] +++ exited with 0 +++ [pid 313] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=34, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 313] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 313] umount2("./32", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./32", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 313] fstat(3, {st_mode=S_IFDIR|0700, st_size=80, ...}) = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 4 entries */, 32768) = 112 [pid 313] umount2("./32/config", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 [pid 313] umount2("./32/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./32/config", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] umount2("./32/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./32/config", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 313] fstat(4, {st_mode=S_IFDIR|0700, st_size=40, ...}) = 0 [pid 313] getdents64(4, 0x55558b0427a0 /* 2 entries */, 32768) = 48 [pid 313] getdents64(4, 0x55558b0427a0 /* 0 entries */, 32768) = 0 [pid 313] close(4) = 0 [pid 313] rmdir("./32/config") = 0 [pid 313] umount2("./32/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./32/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] unlink("./32/binderfs") = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 0 entries */, 32768) = 0 [pid 313] close(3) = 0 [pid 313] rmdir("./32") = 0 [pid 313] mkdir("./33", 0777) = 0 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 313] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-12-rust/strace-static-x86_64: Process 348 attached [pid 348] set_robust_list(0x55558b0396a0, 24) = 0 [pid 348] rt_sigprocmask(SIG_SETMASK, [] [pid 313] <... clone resumed>, child_tidptr=0x55558b039690) = 35 [pid 313] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 348] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 348] chdir("./33") = 0 [pid 348] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 348] setpgid(0, 0) = 0 [pid 348] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 348] write(3, "1000", 4) = 4 [pid 348] close(3) = 0 [pid 348] read(200, 0x7fff2b3a1cd0, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 348] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 348] write(1, "executing program\n", 18) = 18 [pid 348] mkdirat(AT_FDCWD, "./config", 0777) = 0 [pid 348] mount(NULL, "./config", "configfs", 0, NULL) = 0 [pid 348] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 348] rmdir(NULL) = -1 EFAULT (Bad address) [pid 348] rmdir("./config/usb_gadget/g1") = 0 [pid 348] close(3) = -1 EBADF (Bad file descriptor) [pid 348] close(4) = -1 EBADF (Bad file descriptor) [pid 348] close(5) = -1 EBADF (Bad file descriptor) [pid 348] close(6) = -1 EBADF (Bad file descriptor) [pid 348] close(7) = -1 EBADF (Bad file descriptor) [pid 348] close(8) = -1 EBADF (Bad file descriptor) [pid 348] close(9) = -1 EBADF (Bad file descriptor) [pid 348] close(10) = -1 EBADF (Bad file descriptor) [pid 348] close(11) = -1 EBADF (Bad file descriptor) [pid 348] close(12) = -1 EBADF (Bad file descriptor) [pid 348] close(13) = -1 EBADF (Bad file descriptor) [pid 348] close(14) = -1 EBADF (Bad file descriptor) [pid 348] close(15) = -1 EBADF (Bad file descriptor) [pid 348] close(16) = -1 EBADF (Bad file descriptor) [pid 348] close(17) = -1 EBADF (Bad file descriptor) [pid 348] close(18) = -1 EBADF (Bad file descriptor) [pid 348] close(19) = -1 EBADF (Bad file descriptor) [pid 348] close(20) = -1 EBADF (Bad file descriptor) [pid 348] close(21) = -1 EBADF (Bad file descriptor) [pid 348] close(22) = -1 EBADF (Bad file descriptor) [pid 348] close(23) = -1 EBADF (Bad file descriptor) [pid 348] close(24) = -1 EBADF (Bad file descriptor) [pid 348] close(25) = -1 EBADF (Bad file descriptor) [pid 348] close(26) = -1 EBADF (Bad file descriptor) [pid 348] close(27) = -1 EBADF (Bad file descriptor) [pid 348] close(28) = -1 EBADF (Bad file descriptor) [pid 348] close(29) = -1 EBADF (Bad file descriptor) [pid 348] exit_group(0) = ? [pid 348] +++ exited with 0 +++ [pid 313] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=35, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 313] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 313] umount2("./33", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./33", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 313] fstat(3, {st_mode=S_IFDIR|0700, st_size=80, ...}) = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 4 entries */, 32768) = 112 [pid 313] umount2("./33/config", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 [pid 313] umount2("./33/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./33/config", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] umount2("./33/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./33/config", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 313] fstat(4, {st_mode=S_IFDIR|0700, st_size=40, ...}) = 0 [pid 313] getdents64(4, 0x55558b0427a0 /* 2 entries */, 32768) = 48 [pid 313] getdents64(4, 0x55558b0427a0 /* 0 entries */, 32768) = 0 [pid 313] close(4) = 0 [pid 313] rmdir("./33/config") = 0 [pid 313] umount2("./33/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./33/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] unlink("./33/binderfs") = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 0 entries */, 32768) = 0 [pid 313] close(3) = 0 [pid 313] rmdir("./33") = 0 [pid 313] mkdir("./34", 0777) = 0 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 313] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-12-rust/strace-static-x86_64: Process 349 attached , child_tidptr=0x55558b039690) = 36 [pid 349] set_robust_list(0x55558b0396a0, 24 [pid 313] rt_sigprocmask(SIG_SETMASK, [] [pid 349] <... set_robust_list resumed>) = 0 [pid 349] rt_sigprocmask(SIG_SETMASK, [] [pid 313] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 349] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 349] chdir("./34") = 0 [pid 349] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 349] setpgid(0, 0) = 0 [pid 349] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 349] write(3, "1000", 4) = 4 [pid 349] close(3) = 0 [pid 349] read(200, 0x7fff2b3a1cd0, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 349] symlink("/dev/binderfs", "./binderfs") = 0 [pid 349] write(1, "executing program\n", 18) = 18 executing program [pid 349] mkdirat(AT_FDCWD, "./config", 0777) = 0 [pid 349] mount(NULL, "./config", "configfs", 0, NULL) = 0 [pid 349] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 349] rmdir(NULL) = -1 EFAULT (Bad address) [ 27.982475][ T349] BUG: scheduling while atomic: syz-executor234/349/0x00000002 [ 27.990042][ T349] Modules linked in: [ 27.993920][ T349] CPU: 0 UID: 0 PID: 349 Comm: syz-executor234 Tainted: G W syzkaller #0 119f1c0cd44458c2ddc7f806e6d4d2dd11ae7dae [ 27.993939][ T349] Tainted: [W]=WARN [ 27.993942][ T349] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 27.993949][ T349] Call Trace: [ 27.993952][ T349] [ 27.993957][ T349] __dump_stack+0x21/0x30 [ 27.993974][ T349] dump_stack_lvl+0x140/0x1c0 [ 27.993988][ T349] ? __cfi_dump_stack_lvl+0x10/0x10 [ 27.994002][ T349] ? stack_trace_save+0xaa/0x100 [ 27.994014][ T349] dump_stack+0x19/0x20 [ 27.994027][ T349] __schedule_bug+0x12b/0x200 [ 27.994038][ T349] ? find_proxy_task+0x2460/0x2460 [ 27.994049][ T349] ? kasan_save_stack+0x4d/0x60 [ 27.994060][ T349] ? kasan_save_stack+0x3e/0x60 [ 27.994070][ T349] ? __kasan_record_aux_stack+0xb2/0xd0 [ 27.994084][ T349] ? kasan_record_aux_stack_noalloc+0xf/0x20 [ 27.994099][ T349] ? call_rcu+0x14/0x20 [ 27.994110][ T349] ? kernfs_put+0x1de/0x360 [ 27.994122][ T349] ? kernfs_remove_by_name_ns+0x108/0x180 [ 27.994136][ T349] ? sysfs_delete_link+0x10f/0x140 [ 27.994146][ T349] __schedule+0xb85/0x20b0 [ 27.994160][ T349] ? __kasan_check_write+0x18/0x20 [ 27.994170][ T349] ? _raw_spin_trylock+0xb5/0x140 [ 27.994181][ T349] ? __cfi__raw_spin_trylock+0x10/0x10 [ 27.994193][ T349] ? _raw_spin_unlock+0x45/0x60 [ 27.994205][ T349] ? __sched_text_start+0x10/0x10 [ 27.994217][ T349] ? __kasan_check_write+0x18/0x20 [ 27.994227][ T349] ? _raw_spin_lock_irqsave+0xc1/0x160 [ 27.994238][ T349] ? __cfi__raw_spin_lock_irqsave+0x10/0x10 [ 27.994251][ T349] ? _raw_spin_unlock_irqrestore+0x4a/0x70 [ 27.994263][ T349] schedule+0xc5/0x240 [ 27.994275][ T349] kernfs_drain+0x278/0x420 [ 27.994288][ T349] ? kernfs_show+0x280/0x280 [ 27.994301][ T349] ? __cfi_autoremove_wake_function+0x10/0x10 [ 27.994312][ T349] ? __cfi_down_write+0x10/0x10 [ 27.994322][ T349] __kernfs_remove+0x402/0x940 [ 27.994336][ T349] kernfs_remove_by_name_ns+0x100/0x180 [ 27.994349][ T349] sysfs_remove_file_ns+0x68/0x80 [ 27.994359][ T349] device_del+0x56c/0xcf0 [ 27.994374][ T349] ? __cfi_device_del+0x10/0x10 [ 27.994387][ T349] ? __kasan_check_write+0x18/0x20 [ 27.994397][ T349] ? kobject_put+0x1cc/0x2a0 [ 27.994408][ T349] device_destroy+0xb0/0x100 [ 27.994417][ T349] ? __cfi_device_destroy+0x10/0x10 [ 27.994431][ T349] ? __kasan_check_write+0x18/0x20 [ 27.994441][ T349] android_device_destroy+0x118/0x180 [ 27.994455][ T349] gadgets_drop+0x1d/0x30 [ 27.994464][ T349] ? __cfi_gadgets_drop+0x10/0x10 [ 27.994473][ T349] configfs_rmdir+0x8b7/0x9b0 [ 27.994486][ T349] vfs_rmdir+0x3de/0x560 [ 27.994500][ T349] do_rmdir+0x29a/0x590 [ 27.994513][ T349] ? __cfi_do_rmdir+0x10/0x10 [ 27.994526][ T349] ? __kasan_check_write+0x18/0x20 [ 27.994536][ T349] __x64_sys_rmdir+0x4b/0x60 [ 27.994550][ T349] x64_sys_call+0xaf7/0x2ee0 [ 27.994559][ T349] do_syscall_64+0x57/0xf0 [ 27.994570][ T349] ? clear_bhb_loop+0x50/0xa0 [ 27.994584][ T349] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 27.994597][ T349] RIP: 0033:0x7fdb473ba219 [ 27.994607][ T349] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 27.994615][ T349] RSP: 002b:00007fff2b3a20c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 27.994627][ T349] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fdb473ba219 [pid 349] rmdir("./config/usb_gadget/g1") = 0 [pid 349] close(3) = -1 EBADF (Bad file descriptor) [pid 349] close(4) = -1 EBADF (Bad file descriptor) [pid 349] close(5) = -1 EBADF (Bad file descriptor) [pid 349] close(6) = -1 EBADF (Bad file descriptor) [pid 349] close(7) = -1 EBADF (Bad file descriptor) [pid 349] close(8) = -1 EBADF (Bad file descriptor) [pid 349] close(9) = -1 EBADF (Bad file descriptor) [pid 349] close(10) = -1 EBADF (Bad file descriptor) [pid 349] close(11) = -1 EBADF (Bad file descriptor) [pid 349] close(12) = -1 EBADF (Bad file descriptor) [pid 349] close(13) = -1 EBADF (Bad file descriptor) [pid 349] close(14) = -1 EBADF (Bad file descriptor) [pid 349] close(15) = -1 EBADF (Bad file descriptor) [pid 349] close(16) = -1 EBADF (Bad file descriptor) [pid 349] close(17) = -1 EBADF (Bad file descriptor) [pid 349] close(18) = -1 EBADF (Bad file descriptor) [pid 349] close(19) = -1 EBADF (Bad file descriptor) [pid 349] close(20) = -1 EBADF (Bad file descriptor) [pid 349] close(21) = -1 EBADF (Bad file descriptor) [pid 349] close(22) = -1 EBADF (Bad file descriptor) [pid 349] close(23) = -1 EBADF (Bad file descriptor) [pid 349] close(24) = -1 EBADF (Bad file descriptor) [pid 349] close(25) = -1 EBADF (Bad file descriptor) [pid 349] close(26) = -1 EBADF (Bad file descriptor) [pid 349] close(27) = -1 EBADF (Bad file descriptor) [pid 349] close(28) = -1 EBADF (Bad file descriptor) [pid 349] close(29) = -1 EBADF (Bad file descriptor) [pid 349] exit_group(0) = ? [pid 349] +++ exited with 0 +++ [ 27.994634][ T349] RDX: ffffffffffffffd8 RSI: 00007fdb473ba219 RDI: 0000200000000600 [ 27.994642][ T349] RBP: 0000000000000000 R08: 00007fff2b3a20e0 R09: 00007fff2b3a20e0 [ 27.994648][ T349] R10: 00007fff2b3a20e0 R11: 0000000000000246 R12: 00007fff2b3a20ec [ 27.994655][ T349] R13: 00007fff2b3a2120 R14: 00007fff2b3a2100 R15: 0000000000000022 [ 27.994663][ T349] [ 27.998166][ T349] BUG: scheduling while atomic: syz-executor234/349/0x00000000 [ 28.370339][ T349] Modules linked in: [ 28.374237][ T349] CPU: 1 UID: 0 PID: 349 Comm: syz-executor234 Tainted: G W syzkaller #0 119f1c0cd44458c2ddc7f806e6d4d2dd11ae7dae [ 28.374267][ T349] Tainted: [W]=WARN [ 28.374273][ T349] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 28.374284][ T349] Call Trace: [ 28.374291][ T349] [ 28.374299][ T349] __dump_stack+0x21/0x30 [ 28.374327][ T349] dump_stack_lvl+0x140/0x1c0 [ 28.374350][ T349] ? __cfi_dump_stack_lvl+0x10/0x10 [ 28.374375][ T349] dump_stack+0x19/0x20 [ 28.374397][ T349] __schedule_bug+0x12b/0x200 [ 28.374417][ T349] ? find_proxy_task+0x2460/0x2460 [ 28.374436][ T349] ? prepare_signal+0x13da/0x16b0 [ 28.374460][ T349] __schedule+0xb85/0x20b0 [ 28.374482][ T349] ? __wake_up_sync_key+0x1be/0x2c0 [ 28.374503][ T349] ? __cfi___wake_up_sync_key+0x10/0x10 [ 28.374524][ T349] ? __sched_text_start+0x10/0x10 [ 28.374547][ T349] ? __kasan_check_write+0x18/0x20 [ 28.374565][ T349] ? _raw_spin_lock_irq+0x93/0x120 [ 28.374586][ T349] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 28.374607][ T349] ? __kasan_check_read+0x15/0x20 [ 28.374624][ T349] ? cgroup_update_frozen+0x160/0x980 [ 28.374648][ T349] schedule+0xc5/0x240 [ 28.374670][ T349] ptrace_stop+0x528/0x8f0 [ 28.374690][ T349] ptrace_notify+0x1de/0x290 [ 28.374713][ T349] ? __cfi_ptrace_notify+0x10/0x10 [ 28.374736][ T349] ? __cfi_do_rmdir+0x10/0x10 [ 28.374760][ T349] ? __kasan_check_write+0x18/0x20 [ 28.374778][ T349] syscall_exit_work+0x84/0x150 [ 28.374795][ T349] syscall_exit_to_user_mode_prepare+0x21/0x40 [ 28.374813][ T349] syscall_exit_to_user_mode+0x15/0xb0 [ 28.374831][ T349] do_syscall_64+0x63/0xf0 [ 28.374851][ T349] ? clear_bhb_loop+0x50/0xa0 [ 28.374876][ T349] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 28.374899][ T349] RIP: 0033:0x7fdb473ba219 [ 28.374915][ T349] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 28.374930][ T349] RSP: 002b:00007fff2b3a20c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [pid 313] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=36, si_uid=0, si_status=0, si_utime=0, si_stime=35 /* 0.35 s */} --- [pid 313] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 313] umount2("./34", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./34", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 313] fstat(3, {st_mode=S_IFDIR|0700, st_size=80, ...}) = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 4 entries */, 32768) = 112 [pid 313] umount2("./34/config", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 [pid 313] umount2("./34/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./34/config", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] umount2("./34/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./34/config", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 313] fstat(4, {st_mode=S_IFDIR|0700, st_size=40, ...}) = 0 [pid 313] getdents64(4, 0x55558b0427a0 /* 2 entries */, 32768) = 48 [pid 313] getdents64(4, 0x55558b0427a0 /* 0 entries */, 32768) = 0 [pid 313] close(4) = 0 [pid 313] rmdir("./34/config") = 0 [pid 313] umount2("./34/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./34/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] unlink("./34/binderfs") = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 0 entries */, 32768) = 0 [pid 313] close(3) = 0 [pid 313] rmdir("./34") = 0 [pid 313] mkdir("./35", 0777) = 0 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 313] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55558b039690) = 37 ci2-android-6-12-rust/strace-static-x86_64: Process 350 attached [pid 313] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 350] set_robust_list(0x55558b0396a0, 24) = 0 [pid 350] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 350] chdir("./35") = 0 [pid 350] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 350] setpgid(0, 0) = 0 [pid 350] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 350] write(3, "1000", 4) = 4 [pid 350] close(3) = 0 [pid 350] read(200, 0x7fff2b3a1cd0, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 350] symlink("/dev/binderfs", "./binderfs") = 0 [pid 350] write(1, "executing program\n", 18) = 18 [pid 350] mkdirat(AT_FDCWD, "./config", 0777) = 0 executing program [pid 350] mount(NULL, "./config", "configfs", 0, NULL) = 0 [pid 350] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 350] rmdir(NULL) = -1 EFAULT (Bad address) [pid 350] rmdir("./config/usb_gadget/g1") = 0 [pid 350] close(3) = -1 EBADF (Bad file descriptor) [pid 350] close(4) = -1 EBADF (Bad file descriptor) [pid 350] close(5) = -1 EBADF (Bad file descriptor) [pid 350] close(6) = -1 EBADF (Bad file descriptor) [pid 350] close(7) = -1 EBADF (Bad file descriptor) [pid 350] close(8) = -1 EBADF (Bad file descriptor) [pid 350] close(9) = -1 EBADF (Bad file descriptor) [pid 350] close(10) = -1 EBADF (Bad file descriptor) [pid 350] close(11) = -1 EBADF (Bad file descriptor) [pid 350] close(12) = -1 EBADF (Bad file descriptor) [pid 350] close(13) = -1 EBADF (Bad file descriptor) [pid 350] close(14) = -1 EBADF (Bad file descriptor) [pid 350] close(15) = -1 EBADF (Bad file descriptor) [pid 350] close(16) = -1 EBADF (Bad file descriptor) [pid 350] close(17) = -1 EBADF (Bad file descriptor) [pid 350] close(18) = -1 EBADF (Bad file descriptor) [pid 350] close(19) = -1 EBADF (Bad file descriptor) [pid 350] close(20) = -1 EBADF (Bad file descriptor) [pid 350] close(21) = -1 EBADF (Bad file descriptor) [pid 350] close(22) = -1 EBADF (Bad file descriptor) [pid 350] close(23) = -1 EBADF (Bad file descriptor) [pid 350] close(24) = -1 EBADF (Bad file descriptor) [pid 350] close(25) = -1 EBADF (Bad file descriptor) [pid 350] close(26) = -1 EBADF (Bad file descriptor) [pid 350] close(27) = -1 EBADF (Bad file descriptor) [pid 350] close(28) = -1 EBADF (Bad file descriptor) [pid 350] close(29) = -1 EBADF (Bad file descriptor) [pid 350] exit_group(0) = ? [pid 350] +++ exited with 0 +++ [pid 313] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=37, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 313] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 313] umount2("./35", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./35", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 313] fstat(3, {st_mode=S_IFDIR|0700, st_size=80, ...}) = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 4 entries */, 32768) = 112 [pid 313] umount2("./35/config", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 [pid 313] umount2("./35/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./35/config", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] umount2("./35/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./35/config", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 313] fstat(4, {st_mode=S_IFDIR|0700, st_size=40, ...}) = 0 [ 28.374948][ T349] RAX: 0000000000000000 RBX: 0000000000000003 RCX: 00007fdb473ba219 [ 28.374960][ T349] RDX: ffffffffffffffd8 RSI: 00007fdb473ba219 RDI: 0000200000000600 [ 28.374974][ T349] RBP: 0000000000000000 R08: 00007fff2b3a20e0 R09: 00007fff2b3a20e0 [ 28.374986][ T349] R10: 00007fff2b3a20e0 R11: 0000000000000246 R12: 00007fff2b3a20ec [ 28.374999][ T349] R13: 00007fff2b3a2120 R14: 00007fff2b3a2100 R15: 0000000000000022 [ 28.375014][ T349] [pid 313] getdents64(4, 0x55558b0427a0 /* 2 entries */, 32768) = 48 [pid 313] getdents64(4, 0x55558b0427a0 /* 0 entries */, 32768) = 0 [pid 313] close(4) = 0 [pid 313] rmdir("./35/config") = 0 [pid 313] umount2("./35/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./35/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] unlink("./35/binderfs") = 0 [pid 313] getdents64(3, 0x55558b03a760 /* 0 entries */, 32768) = 0 [pid 313] close(3) = 0 [pid 313] rmdir("./35") = 0 [pid 313] mkdir("./36", 0777) = 0 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 313] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-12-rust/strace-static-x86_64: Process 351 attached , child_tidptr=0x55558b039690) = 38 [pid 313] rt_sigprocmask(SIG_SETMASK, [] [pid 351] set_robust_list(0x55558b0396a0, 24 [pid 313] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 351] <... set_robust_list resumed>) = 0 [pid 351] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 351] chdir("./36") = 0 [pid 351] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 351] setpgid(0, 0) = 0 [pid 351] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 351] write(3, "1000", 4) = 4 [pid 351] close(3) = 0 [pid 351] read(200, 0x7fff2b3a1cd0, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 351] symlink("/dev/binderfs", "./binderfs") = 0 [pid 351] write(1, "executing program\n", 18) = 18 [pid 351] mkdirat(AT_FDCWD, "./config", 0777) = 0 [pid 351] mount(NULL, "./config", "configfs", 0, NULL) = 0 [pid 351] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 executing program [pid 351] rmdir(NULL) = -1 EFAULT (Bad address) [ 28.648272][ T351] BUG: scheduling while atomic: syz-executor234/351/0x00000002 [ 28.655855][ T351] Modules linked in: [ 28.659776][ T351] CPU: 0 UID: 0 PID: 351 Comm: syz-executor234 Tainted: G W syzkaller #0 119f1c0cd44458c2ddc7f806e6d4d2dd11ae7dae [ 28.659807][ T351] Tainted: [W]=WARN [ 28.659812][ T351] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 28.659822][ T351] Call Trace: [ 28.659827][ T351] [ 28.659834][ T351] __dump_stack+0x21/0x30 [ 28.659861][ T351] dump_stack_lvl+0x140/0x1c0 [ 28.659883][ T351] ? __cfi_dump_stack_lvl+0x10/0x10 [ 28.659909][ T351] dump_stack+0x19/0x20 [ 28.659932][ T351] __schedule_bug+0x12b/0x200 [ 28.659952][ T351] ? find_proxy_task+0x2460/0x2460 [ 28.659973][ T351] ? kvm_sched_clock_read+0x15/0x30 [ 28.659992][ T351] ? sched_clock_noinstr+0xd/0x30 [ 28.660018][ T351] ? __kasan_check_read+0x15/0x20 [ 28.660038][ T351] __schedule+0xb85/0x20b0 [ 28.660062][ T351] ? __sched_text_start+0x10/0x10 [ 28.660085][ T351] ? __kasan_check_read+0x15/0x20 [ 28.660102][ T351] ? rwsem_spin_on_owner+0xa4/0x3b0 [ 28.660129][ T351] ? __kasan_check_write+0x18/0x20 [ 28.660147][ T351] ? _raw_spin_lock_irq+0x93/0x120 [ 28.660168][ T351] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 28.660189][ T351] schedule+0xc5/0x240 [ 28.660211][ T351] schedule_preempt_disabled+0x14/0x30 [ 28.660233][ T351] rwsem_down_write_slowpath+0x5c9/0x1b60 [ 28.660252][ T351] ? ttwu_do_activate+0x620/0x620 [ 28.660274][ T351] ? rwsem_down_read_slowpath+0x14c0/0x14c0 [ 28.660293][ T351] ? try_to_wake_up+0x111a/0x1fd0 [ 28.660313][ T351] ? __kasan_check_write+0x18/0x20 [ 28.660331][ T351] ? wake_q_add_safe+0x29/0x100 [ 28.660349][ T351] ? __kasan_check_write+0x18/0x20 [ 28.660366][ T351] ? rwsem_read_trylock+0x275/0x5a0 [ 28.660392][ T351] ? downgrade_write+0x470/0x470 [ 28.660416][ T351] ? __kasan_check_write+0x18/0x20 [ 28.660433][ T351] ? wake_up_q+0x10a/0x1c0 [ 28.660449][ T351] down_write+0x163/0x2b0 [ 28.660466][ T351] ? __cfi_down_write+0x10/0x10 [ 28.660482][ T351] ? _raw_spin_lock+0x92/0x120 [ 28.660503][ T351] ? __cfi__raw_spin_lock+0x10/0x10 [ 28.660524][ T351] kernfs_remove+0x87/0xc0 [ 28.660546][ T351] sysfs_remove_dir+0xad/0xf0 [ 28.660565][ T351] __kobject_del+0xe2/0x2c0 [ 28.660586][ T351] kobject_del+0x49/0x80 [ 28.660607][ T351] cleanup_glue_dir+0x1a6/0x220 [ 28.660632][ T351] device_del+0xbb2/0xcf0 [ 28.660665][ T351] ? __cfi_device_del+0x10/0x10 [ 28.660691][ T351] ? __kasan_check_write+0x18/0x20 [ 28.660709][ T351] ? kobject_put+0x1cc/0x2a0 [ 28.660731][ T351] device_destroy+0xb0/0x100 [ 28.660748][ T351] ? __cfi_device_destroy+0x10/0x10 [ 28.660774][ T351] ? __kasan_check_write+0x18/0x20 [ 28.660793][ T351] android_device_destroy+0x118/0x180 [ 28.660817][ T351] gadgets_drop+0x1d/0x30 [ 28.660834][ T351] ? __cfi_gadgets_drop+0x10/0x10 [ 28.660851][ T351] configfs_rmdir+0x8b7/0x9b0 [ 28.660875][ T351] vfs_rmdir+0x3de/0x560 [ 28.660900][ T351] do_rmdir+0x29a/0x590 [ 28.660923][ T351] ? __cfi_do_rmdir+0x10/0x10 [ 28.660947][ T351] ? __kasan_check_write+0x18/0x20 [ 28.660966][ T351] __x64_sys_rmdir+0x4b/0x60 [ 28.660990][ T351] x64_sys_call+0xaf7/0x2ee0 [ 28.661007][ T351] do_syscall_64+0x57/0xf0 [ 28.661027][ T351] ? clear_bhb_loop+0x50/0xa0 [ 28.661052][ T351] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 28.661076][ T351] RIP: 0033:0x7fdb473ba219 [ 28.661091][ T351] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 28.661106][ T351] RSP: 002b:00007fff2b3a20c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 28.661125][ T351] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fdb473ba219 [ 28.661139][ T351] RDX: ffffffffffffffd8 RSI: 00007fdb473ba219 RDI: 0000200000000600 [ 28.661152][ T351] RBP: 0000000000000000 R08: 00007fff2b3a20e0 R09: 00007fff2b3a20e0 [ 28.661164][ T351] R10: 00007fff2b3a20e0 R11: 0000000000000246 R12: 00007fff2b3a20ec [ 28.661177][ T351] R13: 00007fff2b3a2120 R14: 00007fff2b3a2100 R15: 0000000000000024 [ 28.661192][ T351] [ 28.661355][ T351] BUG: scheduling while atomic: syz-executor234/351/0x00000000 [ 29.058268][ T351] Modules linked in: [ 29.062162][ T351] CPU: 1 UID: 0 PID: 351 Comm: syz-executor234 Tainted: G W syzkaller #0 119f1c0cd44458c2ddc7f806e6d4d2dd11ae7dae [ 29.062181][ T351] Tainted: [W]=WARN [ 29.062185][ T351] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 29.062191][ T351] Call Trace: [ 29.062195][ T351] [ 29.062200][ T351] __dump_stack+0x21/0x30 [ 29.062218][ T351] dump_stack_lvl+0x140/0x1c0 [ 29.062232][ T351] ? __cfi_dump_stack_lvl+0x10/0x10 [ 29.062246][ T351] dump_stack+0x19/0x20 [ 29.062259][ T351] __schedule_bug+0x12b/0x200 [ 29.062271][ T351] ? find_proxy_task+0x2460/0x2460 [ 29.062281][ T351] ? preempt_schedule_irq+0xab/0x110 [ 29.062295][ T351] ? __cfi_preempt_schedule_irq+0x10/0x10 [ 29.062309][ T351] __schedule+0xb85/0x20b0 [ 29.062321][ T351] ? raw_irqentry_exit_cond_resched+0x32/0x40 [ 29.062332][ T351] ? irqentry_exit+0x4a/0x60 [ 29.062341][ T351] ? sysvec_reschedule_ipi+0x72/0x80 [ 29.062356][ T351] ? asm_sysvec_reschedule_ipi+0x1f/0x30 [ 29.062371][ T351] ? __sched_text_start+0x10/0x10 [ 29.062383][ T351] ? _raw_spin_unlock_irqrestore+0x5b/0x70 [ 29.062396][ T351] ? __kasan_check_write+0x18/0x20 [ 29.062406][ T351] ? _raw_spin_lock_irq+0x93/0x120 [ 29.062418][ T351] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 29.062430][ T351] ? __kasan_check_read+0x15/0x20 [ 29.062439][ T351] ? cgroup_update_frozen+0x160/0x980 [ 29.062452][ T351] schedule+0xc5/0x240 [ 29.062464][ T351] ptrace_stop+0x528/0x8f0 [ 29.062476][ T351] ptrace_notify+0x1de/0x290 [ 29.062489][ T351] ? __cfi_ptrace_notify+0x10/0x10 [ 29.062502][ T351] ? __cfi_do_rmdir+0x10/0x10 [ 29.062517][ T351] ? __kasan_check_write+0x18/0x20 [ 29.062527][ T351] syscall_exit_work+0x84/0x150 [ 29.062536][ T351] syscall_exit_to_user_mode_prepare+0x21/0x40 [ 29.062546][ T351] syscall_exit_to_user_mode+0x15/0xb0 [ 29.062556][ T351] do_syscall_64+0x63/0xf0 [ 29.062567][ T351] ? clear_bhb_loop+0x50/0xa0 [ 29.062581][ T351] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 29.062594][ T351] RIP: 0033:0x7fdb473ba219 [ 29.062604][ T351] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 29.062612][ T351] RSP: 002b:00007fff2b3a20c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 29.062624][ T351] RAX: 0000000000000000 RBX: 0000000000000003 RCX: 00007fdb473ba219 [ 29.062635][ T351] RDX: ffffffffffffffd8 RSI: 00007fdb473ba219 RDI: 0000200000000600 [ 29.062643][ T351] RBP: 0000000000000000 R08: 00007fff2b3a20e0 R09: 00007fff2b3a20e0 [ 29.062649][ T351] R10: 00007fff2b3a20e0 R11: 0000000000000246 R12: 00007fff2b3a20ec [ 29.062656][ T351] R13: 00007fff2b3a2120 R14: 00007fff2b3a2100 R15: 0000000000000024 [ 29.062664][ T351] [ 29.062720][ T0] Oops: general protection fault, probably for non-canonical address 0xdfff8481f6e50680: 0000 [#1] PREEMPT SMP KASAN PTI [ 29.343869][ T0] CPU: 1 UID: 0 PID: 0 Comm: swapper/0 Tainted: G W syzkaller #0 119f1c0cd44458c2ddc7f806e6d4d2dd11ae7dae [ 29.356515][ T0] Tainted: [W]=WARN [ 29.360292][ T0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 29.370319][ T0] RIP: 0010:__schedule+0x149e/0x20b0 [ 29.375586][ T0] Code: e8 97 20 3b fc 4c 8b 74 24 18 49 c7 06 00 00 00 00 48 8b 1c 24 48 89 df 48 8b 74 24 08 e8 9a 82 64 fb 48 89 c7 e8 82 90 b7 fb <43> c6 44 2c 10 f8 43 c6 44 2c 0c f8 48 c7 84 24 c0 00 00 00 0e 36 [ 29.395177][ T0] RSP: 0018:ffffffff87407be0 EFLAGS: 00010046 [ 29.401222][ T0] RAX: ffff88810bb2cc00 RBX: ffffffff87415c90 RCX: ffffffff874156c0 [ 29.409165][ T0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 29.417108][ T0] RBP: ffffffff87407da8 R08: ffffffff874156c7 R09: 1ffffffff0e82ad8 [ 29.425053][ T0] R10: dffffc0000000000 R11: fffffbfff0e82ad9 R12: ffff8881f6e50670 [ 29.432997][ T0] R13: dffffc0000000000 R14: 1ffffffff0e80f94 R15: ffffffff874156c0 [ 29.440941][ T0] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 29.449860][ T0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 29.456417][ T0] CR2: 0000200000000000 CR3: 000000010cf52000 CR4: 00000000003526b0 [ 29.464364][ T0] Call Trace: [ 29.467621][ T0] [ 29.470530][ T0] ? __kasan_check_read+0x15/0x20 [ 29.475530][ T0] ? ct_nmi_enter+0x9a/0xe0 [ 29.480009][ T0] ? ct_irq_enter+0xd/0x20 [ 29.484396][ T0] ? irqentry_enter+0x2c/0x40 [ 29.489042][ T0] ? sysvec_apic_timer_interrupt+0x13/0x90 [ 29.494818][ T0] ? asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 29.500948][ T0] ? ct_kernel_exit+0x7d/0xb0 [ 29.505595][ T0] ? pv_native_safe_halt+0x13/0x20 [ 29.510676][ T0] ? default_idle+0x17/0x30 [ 29.515150][ T0] ? arch_cpu_idle+0xd/0x20 [ 29.519624][ T0] ? default_idle_call+0x3e/0x80 [ 29.524535][ T0] ? do_idle+0x2fc/0x570 [ 29.528755][ T0] ? idle_inject_timer_fn+0x80/0x80 [ 29.533926][ T0] ? cpu_startup_entry+0x47/0x60 [ 29.538832][ T0] ? rest_init+0x10b/0x130 [ 29.543221][ T0] ? __cfi_x86_late_time_init+0x10/0x10 [ 29.548737][ T0] ? start_kernel+0x462/0x4bb [ 29.553389][ T0] ? x86_64_start_reservations+0x2e/0x30 [ 29.558990][ T0] ? x86_64_start_kernel+0x6a/0x7b [ 29.564075][ T0] ? common_startup_64+0x13b/0x157 [ 29.569160][ T0] [ 29.572153][ T0] Modules linked in: [ 29.576029][ T0] ---[ end trace 0000000000000000 ]--- [ 29.581461][ T0] RIP: 0010:__schedule+0x149e/0x20b0 [ 29.586722][ T0] Code: e8 97 20 3b fc 4c 8b 74 24 18 49 c7 06 00 00 00 00 48 8b 1c 24 48 89 df 48 8b 74 24 08 e8 9a 82 64 fb 48 89 c7 e8 82 90 b7 fb <43> c6 44 2c 10 f8 43 c6 44 2c 0c f8 48 c7 84 24 c0 00 00 00 0e 36 [ 29.606312][ T0] RSP: 0018:ffffffff87407be0 EFLAGS: 00010046 [ 29.612365][ T0] RAX: ffff88810bb2cc00 RBX: ffffffff87415c90 RCX: ffffffff874156c0 [ 29.620310][ T0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 29.628254][ T0] RBP: ffffffff87407da8 R08: ffffffff874156c7 R09: 1ffffffff0e82ad8 [ 29.636196][ T0] R10: dffffc0000000000 R11: fffffbfff0e82ad9 R12: ffff8881f6e50670 [ 29.644139][ T0] R13: dffffc0000000000 R14: 1ffffffff0e80f94 R15: ffffffff874156c0 [ 29.652083][ T0] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 29.660998][ T0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 29.667562][ T0] CR2: 0000200000000000 CR3: 000000010cf52000 CR4: 00000000003526b0 [ 29.675509][ T0] Kernel panic - not syncing: Fatal exception [ 30.742201][ T0] Shutting down cpus with NMI [ 30.747186][ T0] Kernel Offset: disabled [ 30.751491][ T0] Rebooting in 86400 seconds..