./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2145088097 <...> Warning: Permanently added '10.128.0.247' (ED25519) to the list of known hosts. execve("./syz-executor2145088097", ["./syz-executor2145088097"], 0x7ffc7349e000 /* 10 vars */) = 0 brk(NULL) = 0x5555561bf000 brk(0x5555561bfd00) = 0x5555561bfd00 arch_prctl(ARCH_SET_FS, 0x5555561bf380) = 0 set_tid_address(0x5555561bf650) = 5067 set_robust_list(0x5555561bf660, 24) = 0 rseq(0x5555561bfca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor2145088097", 4096) = 28 getrandom("\x0f\x51\x7b\x81\xfb\x0d\x92\xc1", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x5555561bfd00 brk(0x5555561e0d00) = 0x5555561e0d00 brk(0x5555561e1000) = 0x5555561e1000 mprotect(0x7f86ee86d000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 mkdir("./syzkaller.1iM7dV", 0700) = 0 chmod("./syzkaller.1iM7dV", 0777) = 0 chdir("./syzkaller.1iM7dV") = 0 mkdir("./0", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5068 attached , child_tidptr=0x5555561bf650) = 5068 [pid 5068] set_robust_list(0x5555561bf660, 24) = 0 [pid 5068] chdir("./0") = 0 [pid 5068] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5068] setpgid(0, 0) = 0 [pid 5068] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5068] write(3, "1000", 4) = 4 [pid 5068] close(3) = 0 [pid 5068] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5068] memfd_create("syzkaller", 0) = 3 [pid 5068] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f86e6200000 [pid 5068] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576 [pid 5068] munmap(0x7f86e6200000, 138412032) = 0 [pid 5068] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5068] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5068] close(3) = 0 [pid 5068] mkdir("./bus", 0777) = 0 [pid 5068] mount("/dev/loop0", "./bus", "udf", MS_NOEXEC|MS_MANDLOCK|MS_DIRSYNC|MS_NODIRATIME|MS_SILENT|MS_POSIXACL|MS_LAZYTIME, "gid=forget,uid=00000000000000000000,nostrict,uid=forget,dmode=00000000000000000037050,mode=000000000"...) = 0 [pid 5068] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 5068] chdir("./bus") = 0 [pid 5068] ioctl(4, LOOP_CLR_FD) = 0 [pid 5068] close(4) = 0 [ 57.011464][ T5068] loop0: detected capacity change from 0 to 2048 [ 57.026038][ T5068] ======================================================= [ 57.026038][ T5068] WARNING: The mand mount option has been deprecated and [ 57.026038][ T5068] and is ignored by this kernel. Remove the mand [ 57.026038][ T5068] option from the mount to silence this warning. [ 57.026038][ T5068] ======================================================= [pid 5068] creat("./bus", 000) = 4 [pid 5068] mount("/dev/loop0", "./bus", NULL, MS_MANDLOCK|MS_NODIRATIME|MS_BIND, NULL) = 0 [pid 5068] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 5 [pid 5068] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0) = 0x20000000 [pid 5068] memfd_create("syzkaller", 0) = 6 [pid 5068] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f86e6200000 [pid 5068] write(6, "\xeb\x52\x90\x4e\x54\x46\x53\x20\x20\x20\x20\x00\x10\x01\x00\x00\x00\x00\x00\x00\x00\xf8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x80\x00\xff\x01\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x78\x5f\xaa\x3b\xd7\x0e\xce\x68\x00\x00\x00\x00\x0e\x1f\xbe\x71\x7c\xac\x22\xc0\x74\x0b\x56\xb4\x0e\xbb\x07\x00"..., 2097152) = 2097152 [pid 5068] munmap(0x7f86e6200000, 138412032) = 0 [pid 5068] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 5068] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 5068] ioctl(7, LOOP_CLR_FD) = 0 [pid 5068] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 5068] close(7) = 0 [pid 5068] close(6) = 0 [pid 5068] exit_group(0) = ? [pid 5068] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5068, si_uid=0, si_status=0, si_utime=0, si_stime=7 /* 0.07 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555561c06f0 /* 4 entries */, 32768) = 104 umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./0/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555561c8730 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555561c8730 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./0/bus") = 0 umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./0/binderfs") = 0 getdents64(3, 0x5555561c06f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./0") = 0 mkdir("./1", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5070 attached [pid 5070] set_robust_list(0x5555561bf660, 24) = 0 [pid 5070] chdir("./1") = 0 [pid 5070] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5070] setpgid(0, 0 [pid 5067] <... clone resumed>, child_tidptr=0x5555561bf650) = 5070 [pid 5070] <... setpgid resumed>) = 0 [pid 5070] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5070] write(3, "1000", 4) = 4 [pid 5070] close(3) = 0 [pid 5070] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5070] memfd_create("syzkaller", 0) = 3 [pid 5070] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f86e6200000 [pid 5070] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576 [pid 5070] munmap(0x7f86e6200000, 138412032) = 0 [pid 5070] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5070] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5070] close(3) = 0 [pid 5070] mkdir("./bus", 0777) = 0 [pid 5070] mount("/dev/loop0", "./bus", "udf", MS_NOEXEC|MS_MANDLOCK|MS_DIRSYNC|MS_NODIRATIME|MS_SILENT|MS_POSIXACL|MS_LAZYTIME, "gid=forget,uid=00000000000000000000,nostrict,uid=forget,dmode=00000000000000000037050,mode=000000000"...) = 0 [pid 5070] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 5070] chdir("./bus") = 0 [pid 5070] ioctl(4, LOOP_CLR_FD) = 0 [pid 5070] close(4) = 0 [pid 5070] creat("./bus", 000) = 4 [ 57.352560][ T5070] loop0: detected capacity change from 0 to 2048 [pid 5070] mount("/dev/loop0", "./bus", NULL, MS_MANDLOCK|MS_NODIRATIME|MS_BIND, NULL) = 0 [pid 5070] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 5 [pid 5070] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0) = 0x20000000 [pid 5070] memfd_create("syzkaller", 0) = 6 [pid 5070] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f86e6200000 [pid 5070] write(6, "\xeb\x52\x90\x4e\x54\x46\x53\x20\x20\x20\x20\x00\x10\x01\x00\x00\x00\x00\x00\x00\x00\xf8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x80\x00\xff\x01\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x78\x5f\xaa\x3b\xd7\x0e\xce\x68\x00\x00\x00\x00\x0e\x1f\xbe\x71\x7c\xac\x22\xc0\x74\x0b\x56\xb4\x0e\xbb\x07\x00"..., 2097152) = 2097152 [pid 5070] munmap(0x7f86e6200000, 138412032) = 0 [pid 5070] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 5070] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 5070] ioctl(7, LOOP_CLR_FD) = 0 [pid 5070] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 5070] close(7) = 0 [pid 5070] close(6) = 0 [pid 5070] exit_group(0) = ? [pid 5070] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5070, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555561c06f0 /* 4 entries */, 32768) = 104 [ 57.550125][ T5067] BUG: unable to handle page fault for address: ffffed10191862cb [ 57.557857][ T5067] #PF: supervisor read access in kernel mode [ 57.563815][ T5067] #PF: error_code(0x0000) - not-present page [ 57.569793][ T5067] PGD 23ffee067 P4D 23ffee067 PUD 13fff5067 PMD 0 [ 57.576279][ T5067] Oops: 0000 [#1] PREEMPT SMP KASAN [ 57.581454][ T5067] CPU: 1 PID: 5067 Comm: syz-executor214 Not tainted 6.7.0-rc8-syzkaller-00174-g95c8a35f1c01 #0 [ 57.591841][ T5067] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 57.601873][ T5067] RIP: 0010:udf_close_lvid+0x13b/0x5c0 [ 57.607367][ T5067] Code: 84 24 c0 00 00 00 31 f6 48 89 c7 48 89 44 24 08 e8 aa 3c 8f 07 48 8d 7b 18 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 48 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 b2 03 00 00 [ 57.626955][ T5067] RSP: 0018:ffffc90003987cf8 EFLAGS: 00010212 [ 57.633000][ T5067] RAX: dffffc0000000000 RBX: ffff8880c8c31640 RCX: 0000000000000000 [ 57.640950][ T5067] RDX: 1ffff110191862cb RSI: ffffffff8b2f01a0 RDI: ffff8880c8c31658 [ 57.648903][ T5067] RBP: ffff88806ca94570 R08: 0000000000000000 R09: fffffbfff1e3278a [ 57.656852][ T5067] R10: ffffc90003987cf8 R11: 0000000000000001 R12: ffff888027616400 [ 57.664802][ T5067] R13: ffff888018bc2000 R14: ffff888077c5d000 R15: ffff888018e6a640 [ 57.672755][ T5067] FS: 00005555561bf380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 [ 57.681664][ T5067] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 57.688223][ T5067] CR2: ffffed10191862cb CR3: 000000001f701000 CR4: 0000000000350ef0 [ 57.696175][ T5067] Call Trace: [ 57.699432][ T5067] [ 57.702383][ T5067] ? show_regs+0x8f/0xa0 [ 57.706608][ T5067] ? __die+0x2c/0x80 [ 57.710481][ T5067] ? page_fault_oops+0x398/0xab0 [ 57.715398][ T5067] ? reacquire_held_locks+0x4c0/0x4c0 [ 57.720750][ T5067] ? dump_pagetable+0x530/0x530 [ 57.725578][ T5067] ? search_extable+0x83/0xb0 [ 57.730237][ T5067] ? is_prefetch.constprop.0+0xb6/0x550 [ 57.735758][ T5067] ? __module_address+0x55/0x3b0 [ 57.740679][ T5067] ? bpf_ksym_find+0x124/0x1b0 [ 57.745418][ T5067] ? pgtable_bad+0x80/0x80 [ 57.749813][ T5067] ? fixup_exception+0x110/0xc90 [ 57.754730][ T5067] ? kernelmode_fixup_or_oops+0x23c/0x2b0 [ 57.760426][ T5067] ? __bad_area_nosemaphore+0x390/0x6a0 [ 57.765950][ T5067] ? trace_contention_end+0xd6/0x100 [ 57.771216][ T5067] ? spurious_kernel_fault+0x2f4/0x3c0 [ 57.776651][ T5067] ? __mutex_lock+0x1a6/0x9d0 [ 57.781304][ T5067] ? do_kern_addr_fault+0x5b/0x80 [ 57.786310][ T5067] ? exc_page_fault+0xae/0xc0 [ 57.790974][ T5067] ? asm_exc_page_fault+0x26/0x30 [ 57.795978][ T5067] ? udf_close_lvid+0x13b/0x5c0 [ 57.800808][ T5067] ? udf_close_lvid+0x126/0x5c0 [ 57.805634][ T5067] ? fscrypt_destroy_keyring+0x1e/0x3d0 [ 57.811164][ T5067] udf_put_super+0x19c/0x200 [ 57.815732][ T5067] ? udf_close_lvid+0x5c0/0x5c0 [ 57.820558][ T5067] generic_shutdown_super+0x161/0x3d0 [ 57.825909][ T5067] kill_block_super+0x3b/0x90 [ 57.830566][ T5067] deactivate_locked_super+0xbc/0x1a0 [ 57.835919][ T5067] deactivate_super+0xde/0x100 [ 57.840662][ T5067] cleanup_mnt+0x222/0x450 [ 57.845058][ T5067] task_work_run+0x14d/0x240 [ 57.849630][ T5067] ? task_work_cancel+0x30/0x30 [ 57.854465][ T5067] ptrace_notify+0x10d/0x130 [ 57.859035][ T5067] syscall_exit_to_user_mode_prepare+0x126/0x230 [ 57.865350][ T5067] syscall_exit_to_user_mode+0xe/0x60 [ 57.870701][ T5067] do_syscall_64+0x4d/0x110 [ 57.875183][ T5067] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 57.881052][ T5067] RIP: 0033:0x7f86ee7da5c7 [ 57.885530][ T5067] Code: 09 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 [ 57.905133][ T5067] RSP: 002b:00007ffeb5fa4008 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [ 57.913524][ T5067] RAX: 0000000000000000 RBX: 000000000000dfc1 RCX: 00007f86ee7da5c7 [ 57.921471][ T5067] RDX: 0000000000000000 RSI: 000000000000000a RDI: 00007ffeb5fa40c0 [ 57.929418][ T5067] RBP: 00007ffeb5fa40c0 R08: 0000000000000000 R09: 0000000000000000 [ 57.937364][ T5067] R10: 00000000ffffffff R11: 0000000000000202 R12: 00007ffeb5fa5130 [ 57.945313][ T5067] R13: 00005555561c06c0 R14: 431bde82d7b634db R15: 00007ffeb5fa5150 [ 57.953270][ T5067] [ 57.956269][ T5067] Modules linked in: [ 57.960139][ T5067] CR2: ffffed10191862cb [ 57.964267][ T5067] ---[ end trace 0000000000000000 ]--- [ 57.969704][ T5067] RIP: 0010:udf_close_lvid+0x13b/0x5c0 [ 57.975149][ T5067] Code: 84 24 c0 00 00 00 31 f6 48 89 c7 48 89 44 24 08 e8 aa 3c 8f 07 48 8d 7b 18 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 48 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 b2 03 00 00 [ 57.994734][ T5067] RSP: 0018:ffffc90003987cf8 EFLAGS: 00010212 [ 58.000776][ T5067] RAX: dffffc0000000000 RBX: ffff8880c8c31640 RCX: 0000000000000000 [ 58.008726][ T5067] RDX: 1ffff110191862cb RSI: ffffffff8b2f01a0 RDI: ffff8880c8c31658 [ 58.016677][ T5067] RBP: ffff88806ca94570 R08: 0000000000000000 R09: fffffbfff1e3278a [ 58.024633][ T5067] R10: ffffc90003987cf8 R11: 0000000000000001 R12: ffff888027616400 [ 58.032589][ T5067] R13: ffff888018bc2000 R14: ffff888077c5d000 R15: ffff888018e6a640 [ 58.040542][ T5067] FS: 00005555561bf380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 [ 58.049450][ T5067] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 58.056018][ T5067] CR2: ffffed10191862cb CR3: 000000001f701000 CR4: 0000000000350ef0 [ 58.063981][ T5067] Kernel panic - not syncing: Fatal exception [ 58.070263][ T5067] Kernel Offset: disabled [ 58.074570][ T5067] Rebooting in 86400 seconds..