./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2516944261

<...>
Warning: Permanently added '10.128.0.167' (ECDSA) to the list of known hosts.
execve("./syz-executor2516944261", ["./syz-executor2516944261"], 0x7fff5a60ced0 /* 10 vars */) = 0
brk(NULL)                               = 0x555556770000
brk(0x555556770c40)                     = 0x555556770c40
arch_prctl(ARCH_SET_FS, 0x555556770300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor2516944261", 4096) = 28
brk(0x555556791c40)                     = 0x555556791c40
brk(0x555556792000)                     = 0x555556792000
mprotect(0x7f862aa75000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5077 attached
, child_tidptr=0x5555567705d0) = 5077
[pid  5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5077] getpid(./strace-static-x86_64: Process 5078 attached
)                    = 5077
[pid  5076] <... clone resumed>, child_tidptr=0x5555567705d0) = 5078
[pid  5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555567705d0) = 5079
[pid  5078] getpid( <unfinished ...>
[pid  5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5079 attached
./strace-static-x86_64: Process 5080 attached
 <unfinished ...>
[pid  5078] <... getpid resumed>)       = 5078
[pid  5077] mkdir("./syzkaller.v93zO7", 0700 <unfinished ...>
[pid  5076] <... clone resumed>, child_tidptr=0x5555567705d0) = 5080
[pid  5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5079] getpid( <unfinished ...>
[pid  5078] mkdir("./syzkaller.bcUiBa", 0700 <unfinished ...>
[pid  5076] <... clone resumed>, child_tidptr=0x5555567705d0) = 5081
[pid  5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5079] <... getpid resumed>)       = 5079
[pid  5076] <... clone resumed>, child_tidptr=0x5555567705d0) = 5082
./strace-static-x86_64: Process 5081 attached
./strace-static-x86_64: Process 5082 attached
[pid  5082] getpid( <unfinished ...>
[pid  5081] getpid( <unfinished ...>
[pid  5082] <... getpid resumed>)       = 5082
[pid  5079] mkdir("./syzkaller.Zw9pKh", 0700 <unfinished ...>
[pid  5078] <... mkdir resumed>)        = 0
[pid  5077] <... mkdir resumed>)        = 0
[pid  5081] <... getpid resumed>)       = 5081
[pid  5081] mkdir("./syzkaller.HSIX3p", 0700 <unfinished ...>
[pid  5079] <... mkdir resumed>)        = 0
[pid  5078] chmod("./syzkaller.bcUiBa", 0777 <unfinished ...>
[pid  5079] chmod("./syzkaller.Zw9pKh", 0777 <unfinished ...>
[pid  5077] chmod("./syzkaller.v93zO7", 0777 <unfinished ...>
[pid  5078] <... chmod resumed>)        = 0
[pid  5079] <... chmod resumed>)        = 0
[pid  5078] chdir("./syzkaller.bcUiBa" <unfinished ...>
[pid  5079] chdir("./syzkaller.Zw9pKh" <unfinished ...>
[pid  5078] <... chdir resumed>)        = 0
[pid  5078] mkdir("./0", 0777 <unfinished ...>
[pid  5079] <... chdir resumed>)        = 0
[pid  5077] <... chmod resumed>)        = 0
[pid  5079] mkdir("./0", 0777 <unfinished ...>
[pid  5078] <... mkdir resumed>)        = 0
[pid  5077] chdir("./syzkaller.v93zO7" <unfinished ...>
[pid  5082] mkdir("./syzkaller.sGzuNs", 0700 <unfinished ...>
[pid  5079] <... mkdir resumed>)        = 0
[pid  5078] openat(AT_FDCWD, "/dev/loop1", O_RDWR <unfinished ...>
[pid  5079] openat(AT_FDCWD, "/dev/loop2", O_RDWR <unfinished ...>
[pid  5077] <... chdir resumed>)        = 0
[pid  5081] <... mkdir resumed>)        = 0
[pid  5078] <... openat resumed>)       = 3
[pid  5078] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  5077] mkdir("./0", 0777 <unfinished ...>
[pid  5079] <... openat resumed>)       = 3
[pid  5078] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  5082] <... mkdir resumed>)        = 0
[pid  5081] chmod("./syzkaller.HSIX3p", 0777 <unfinished ...>
[pid  5077] <... mkdir resumed>)        = 0
[pid  5079] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  5078] close(3 <unfinished ...>
[pid  5080] getpid( <unfinished ...>
[pid  5082] chmod("./syzkaller.sGzuNs", 0777 <unfinished ...>
[pid  5081] <... chmod resumed>)        = 0
[pid  5082] <... chmod resumed>)        = 0
[pid  5082] chdir("./syzkaller.sGzuNs" <unfinished ...>
[pid  5081] chdir("./syzkaller.HSIX3p" <unfinished ...>
[pid  5082] <... chdir resumed>)        = 0
[pid  5081] <... chdir resumed>)        = 0
[pid  5082] mkdir("./0", 0777 <unfinished ...>
[pid  5081] mkdir("./0", 0777 <unfinished ...>
[pid  5082] <... mkdir resumed>)        = 0
[pid  5081] <... mkdir resumed>)        = 0
[pid  5081] openat(AT_FDCWD, "/dev/loop4", O_RDWR <unfinished ...>
[pid  5082] openat(AT_FDCWD, "/dev/loop5", O_RDWR <unfinished ...>
[pid  5081] <... openat resumed>)       = 3
[pid  5078] <... close resumed>)        = 0
[pid  5080] <... getpid resumed>)       = 5080
[pid  5079] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  5078] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5077] openat(AT_FDCWD, "/dev/loop0", O_RDWR <unfinished ...>
[pid  5082] <... openat resumed>)       = 3
[pid  5079] close(3 <unfinished ...>
[pid  5082] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  5081] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  5077] <... openat resumed>)       = 3
[pid  5079] <... close resumed>)        = 0
[pid  5078] <... clone resumed>, child_tidptr=0x5555567705d0) = 5083
[pid  5080] mkdir("./syzkaller.rcBE6k", 0700 <unfinished ...>
[pid  5079] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5077] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  5082] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  5081] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  5082] close(3 <unfinished ...>
[pid  5081] close(3 <unfinished ...>
[pid  5082] <... close resumed>)        = 0
[pid  5081] <... close resumed>)        = 0
[pid  5081] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5082] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5081] <... clone resumed>, child_tidptr=0x5555567705d0) = 5084
[pid  5080] <... mkdir resumed>)        = 0
[pid  5077] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  5080] chmod("./syzkaller.rcBE6k", 0777 <unfinished ...>
[pid  5079] <... clone resumed>, child_tidptr=0x5555567705d0) = 5085
./strace-static-x86_64: Process 5085 attached
[pid  5077] close(3./strace-static-x86_64: Process 5083 attached
 <unfinished ...>
[pid  5082] <... clone resumed>, child_tidptr=0x5555567705d0) = 5086
[pid  5080] <... chmod resumed>)        = 0
[pid  5077] <... close resumed>)        = 0
[pid  5080] chdir("./syzkaller.rcBE6k" <unfinished ...>
[pid  5077] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5083] chdir("./0" <unfinished ...>
[pid  5085] chdir("./0" <unfinished ...>
[pid  5080] <... chdir resumed>)        = 0
[pid  5083] <... chdir resumed>)        = 0
[pid  5080] mkdir("./0", 0777 <unfinished ...>
[pid  5085] <... chdir resumed>)        = 0
[pid  5077] <... clone resumed>, child_tidptr=0x5555567705d0) = 5087
[pid  5083] prctl(PR_SET_PDEATHSIG, SIGKILL./strace-static-x86_64: Process 5086 attached
 <unfinished ...>
[pid  5085] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  5083] <... prctl resumed>)        = 0
[pid  5080] <... mkdir resumed>)        = 0
[pid  5080] openat(AT_FDCWD, "/dev/loop3", O_RDWR <unfinished ...>
[pid  5085] <... prctl resumed>)        = 0
./strace-static-x86_64: Process 5084 attached
[pid  5086] chdir("./0" <unfinished ...>
[pid  5085] setpgid(0, 0 <unfinished ...>
[pid  5083] setpgid(0, 0 <unfinished ...>
[pid  5080] <... openat resumed>)       = 3
[pid  5086] <... chdir resumed>)        = 0
[pid  5085] <... setpgid resumed>)      = 0
[pid  5084] chdir("./0" <unfinished ...>
[pid  5083] <... setpgid resumed>)      = 0
[pid  5080] ioctl(3, LOOP_CLR_FD./strace-static-x86_64: Process 5087 attached
 <unfinished ...>
[pid  5086] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  5085] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  5084] <... chdir resumed>)        = 0
[pid  5083] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  5087] chdir("./0" <unfinished ...>
[pid  5086] <... prctl resumed>)        = 0
[pid  5085] <... openat resumed>)       = 3
[pid  5084] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  5083] <... openat resumed>)       = 3
[pid  5080] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  5087] <... chdir resumed>)        = 0
[pid  5086] setpgid(0, 0 <unfinished ...>
[pid  5085] write(3, "1000", 4 <unfinished ...>
[pid  5084] <... prctl resumed>)        = 0
[pid  5083] write(3, "1000", 4 <unfinished ...>
[pid  5080] close(3 <unfinished ...>
[pid  5087] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  5086] <... setpgid resumed>)      = 0
[pid  5085] <... write resumed>)        = 4
[pid  5084] setpgid(0, 0 <unfinished ...>
[pid  5083] <... write resumed>)        = 4
[pid  5080] <... close resumed>)        = 0
[pid  5087] <... prctl resumed>)        = 0
[pid  5086] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  5085] close(3 <unfinished ...>
[pid  5084] <... setpgid resumed>)      = 0
[pid  5083] close(3 <unfinished ...>
[pid  5080] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5087] setpgid(0, 0 <unfinished ...>
[pid  5086] <... openat resumed>)       = 3
[pid  5085] <... close resumed>)        = 0
[pid  5084] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  5083] <... close resumed>)        = 0
[pid  5087] <... setpgid resumed>)      = 0
[pid  5086] write(3, "1000", 4 <unfinished ...>
[pid  5085] symlink("/dev/binderfs", "./binderfs" <unfinished ...>
[pid  5084] <... openat resumed>)       = 3
[pid  5083] symlink("/dev/binderfs", "./binderfs" <unfinished ...>
[pid  5087] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  5086] <... write resumed>)        = 4
[pid  5085] <... symlink resumed>)      = 0
[pid  5084] write(3, "1000", 4 <unfinished ...>
[pid  5083] <... symlink resumed>)      = 0
[pid  5080] <... clone resumed>, child_tidptr=0x5555567705d0) = 5089
./strace-static-x86_64: Process 5089 attached
[pid  5087] <... openat resumed>)       = 3
[pid  5086] close(3 <unfinished ...>
[pid  5085] memfd_create("syzkaller", 0 <unfinished ...>
[pid  5084] <... write resumed>)        = 4
[pid  5083] memfd_create("syzkaller", 0 <unfinished ...>
[pid  5089] chdir("./0" <unfinished ...>
[pid  5087] write(3, "1000", 4 <unfinished ...>
[pid  5086] <... close resumed>)        = 0
[pid  5084] close(3 <unfinished ...>
[pid  5083] <... memfd_create resumed>) = 3
[pid  5089] <... chdir resumed>)        = 0
[pid  5086] symlink("/dev/binderfs", "./binderfs" <unfinished ...>
[pid  5084] <... close resumed>)        = 0
[pid  5083] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  5089] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  5086] <... symlink resumed>)      = 0
[pid  5084] symlink("/dev/binderfs", "./binderfs" <unfinished ...>
[pid  5083] <... mmap resumed>)         = 0x7f86225b9000
[pid  5089] <... prctl resumed>)        = 0
[pid  5086] memfd_create("syzkaller", 0 <unfinished ...>
[pid  5084] <... symlink resumed>)      = 0
[pid  5083] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 <unfinished ...>
[pid  5087] <... write resumed>)        = 4
[pid  5089] setpgid(0, 0 <unfinished ...>
[pid  5087] close(3 <unfinished ...>
[pid  5086] <... memfd_create resumed>) = 3
[pid  5084] memfd_create("syzkaller", 0 <unfinished ...>
[pid  5083] <... write resumed>)        = 524288
[pid  5089] <... setpgid resumed>)      = 0
[pid  5087] <... close resumed>)        = 0
[pid  5086] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  5084] <... memfd_create resumed>) = 3
[pid  5089] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  5087] symlink("/dev/binderfs", "./binderfs" <unfinished ...>
[pid  5086] <... mmap resumed>)         = 0x7f86225b9000
[pid  5084] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  5089] <... openat resumed>)       = 3
[pid  5087] <... symlink resumed>)      = 0
[pid  5086] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 <unfinished ...>
[pid  5085] <... memfd_create resumed>) = 3
[pid  5084] <... mmap resumed>)         = 0x7f86225b9000
[pid  5083] munmap(0x7f86225b9000, 524288 <unfinished ...>
[pid  5089] write(3, "1000", 4 <unfinished ...>
[pid  5087] memfd_create("syzkaller", 0 <unfinished ...>
[pid  5086] <... write resumed>)        = 524288
[pid  5085] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  5084] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 <unfinished ...>
[pid  5083] <... munmap resumed>)       = 0
[pid  5089] <... write resumed>)        = 4
[pid  5087] <... memfd_create resumed>) = 3
[pid  5085] <... mmap resumed>)         = 0x7f86225b9000
[pid  5084] <... write resumed>)        = 524288
[pid  5083] openat(AT_FDCWD, "/dev/loop1", O_RDWR <unfinished ...>
[pid  5089] close(3 <unfinished ...>
[pid  5087] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  5086] munmap(0x7f86225b9000, 524288 <unfinished ...>
[pid  5083] <... openat resumed>)       = 4
[pid  5089] <... close resumed>)        = 0
syzkaller login: [   56.208957][ T5085] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=5085 'syz-executor251'
[pid  5086] <... munmap resumed>)       = 0
[pid  5083] ioctl(4, LOOP_SET_FD, 3 <unfinished ...>
[pid  5089] symlink("/dev/binderfs", "./binderfs" <unfinished ...>
[pid  5087] <... mmap resumed>)         = 0x7f86225b9000
[pid  5086] openat(AT_FDCWD, "/dev/loop5", O_RDWR <unfinished ...>
[pid  5085] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 <unfinished ...>
[pid  5084] munmap(0x7f86225b9000, 524288 <unfinished ...>
[pid  5083] <... ioctl resumed>)        = 0
[pid  5089] <... symlink resumed>)      = 0
[pid  5086] <... openat resumed>)       = 4
[pid  5084] <... munmap resumed>)       = 0
[pid  5089] memfd_create("syzkaller", 0 <unfinished ...>
[pid  5086] ioctl(4, LOOP_SET_FD, 3 <unfinished ...>
[pid  5084] openat(AT_FDCWD, "/dev/loop4", O_RDWR <unfinished ...>
[pid  5089] <... memfd_create resumed>) = 3
[pid  5087] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 <unfinished ...>
[pid  5085] <... write resumed>)        = 524288
[pid  5084] <... openat resumed>)       = 4
[pid  5089] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  5084] ioctl(4, LOOP_SET_FD, 3 <unfinished ...>
[pid  5089] <... mmap resumed>)         = 0x7f86225b9000
[pid  5089] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 <unfinished ...>
[pid  5087] <... write resumed>)        = 524288
[pid  5085] munmap(0x7f86225b9000, 524288 <unfinished ...>
[pid  5089] <... write resumed>)        = 524288
[pid  5087] munmap(0x7f86225b9000, 524288 <unfinished ...>
[pid  5085] <... munmap resumed>)       = 0
[pid  5089] munmap(0x7f86225b9000, 524288 <unfinished ...>
[pid  5087] <... munmap resumed>)       = 0
[pid  5085] openat(AT_FDCWD, "/dev/loop2", O_RDWR <unfinished ...>
[pid  5087] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5085] <... openat resumed>)       = 4
[pid  5087] ioctl(4, LOOP_SET_FD, 3 <unfinished ...>
[pid  5085] ioctl(4, LOOP_SET_FD, 3 <unfinished ...>
[pid  5089] <... munmap resumed>)       = 0
[pid  5083] close(3)                    = 0
[pid  5083] mkdir("./file0", 0777 <unfinished ...>
[pid  5089] openat(AT_FDCWD, "/dev/loop3", O_RDWR <unfinished ...>
[pid  5083] <... mkdir resumed>)        = 0
[pid  5089] <... openat resumed>)       = 4
[   56.260215][ T5083] loop1: detected capacity change from 0 to 1024
[   56.273212][ T5086] loop5: detected capacity change from 0 to 1024
[   56.286852][ T5084] loop4: detected capacity change from 0 to 1024
[   56.303497][ T5087] loop0: detected capacity change from 0 to 1024
[pid  5089] ioctl(4, LOOP_SET_FD, 3 <unfinished ...>
[pid  5083] mount("/dev/loop1", "./file0", "hfsplus", 0, "" <unfinished ...>
[pid  5086] <... ioctl resumed>)        = 0
[pid  5086] close(3 <unfinished ...>
[pid  5089] <... ioctl resumed>)        = 0
[pid  5086] <... close resumed>)        = 0
[pid  5089] close(3 <unfinished ...>
[pid  5086] mkdir("./file0", 0777 <unfinished ...>
[pid  5089] <... close resumed>)        = 0
[pid  5086] <... mkdir resumed>)        = 0
[pid  5089] mkdir("./file0", 0777 <unfinished ...>
[pid  5086] mount("/dev/loop5", "./file0", "hfsplus", 0, "" <unfinished ...>
[pid  5084] <... ioctl resumed>)        = 0
[pid  5087] <... ioctl resumed>)        = 0
[pid  5089] <... mkdir resumed>)        = 0
[pid  5087] close(3 <unfinished ...>
[pid  5084] close(3 <unfinished ...>
[pid  5089] mount("/dev/loop3", "./file0", "hfsplus", 0, "" <unfinished ...>
[pid  5087] <... close resumed>)        = 0
[pid  5084] <... close resumed>)        = 0
[pid  5087] mkdir("./file0", 0777 <unfinished ...>
[pid  5085] <... ioctl resumed>)        = 0
[pid  5084] mkdir("./file0", 0777)      = 0
[pid  5087] <... mkdir resumed>)        = 0
[pid  5084] mount("/dev/loop4", "./file0", "hfsplus", 0, "" <unfinished ...>
[pid  5089] <... mount resumed>)        = 0
[pid  5087] mount("/dev/loop0", "./file0", "hfsplus", 0, "" <unfinished ...>
[pid  5086] <... mount resumed>)        = 0
[pid  5083] <... mount resumed>)        = 0
[pid  5089] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY <unfinished ...>
[pid  5086] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY <unfinished ...>
[pid  5083] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY <unfinished ...>
[pid  5089] <... openat resumed>)       = 3
[pid  5086] <... openat resumed>)       = 3
[pid  5083] <... openat resumed>)       = 3
[pid  5089] ioctl(4, LOOP_CLR_FD <unfinished ...>
[pid  5086] ioctl(4, LOOP_CLR_FD <unfinished ...>
[pid  5083] ioctl(4, LOOP_CLR_FD <unfinished ...>
[pid  5089] <... ioctl resumed>)        = 0
[pid  5086] <... ioctl resumed>)        = 0
[pid  5083] <... ioctl resumed>)        = 0
[pid  5089] close(4 <unfinished ...>
[pid  5087] <... mount resumed>)        = 0
[pid  5086] close(4 <unfinished ...>
[pid  5083] close(4 <unfinished ...>
[pid  5089] <... close resumed>)        = 0
[pid  5087] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY <unfinished ...>
[pid  5086] <... close resumed>)        = 0
[pid  5085] close(3 <unfinished ...>
[pid  5083] <... close resumed>)        = 0
[pid  5089] openat(AT_FDCWD, "/dev/loop5", O_RDONLY <unfinished ...>
[pid  5087] <... openat resumed>)       = 3
[pid  5086] openat(AT_FDCWD, "/dev/loop5", O_RDONLY <unfinished ...>
[pid  5085] <... close resumed>)        = 0
[pid  5083] openat(AT_FDCWD, "/dev/loop5", O_RDONLY <unfinished ...>
[pid  5089] <... openat resumed>)       = 4
[pid  5087] ioctl(4, LOOP_CLR_FD <unfinished ...>
[pid  5086] <... openat resumed>)       = 4
[pid  5085] mkdir("./file0", 0777 <unfinished ...>
[pid  5084] <... mount resumed>)        = 0
[pid  5083] <... openat resumed>)       = 4
[pid  5089] ioctl(4, LOOP_SET_BLOCK_SIZE, 2048 <unfinished ...>
[pid  5087] <... ioctl resumed>)        = 0
[pid  5086] ioctl(4, LOOP_SET_BLOCK_SIZE, 2048 <unfinished ...>
[pid  5083] ioctl(4, LOOP_SET_BLOCK_SIZE, 2048 <unfinished ...>
[pid  5087] close(4 <unfinished ...>
[pid  5085] <... mkdir resumed>)        = 0
[pid  5084] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY <unfinished ...>
[pid  5087] <... close resumed>)        = 0
[pid  5085] mount("/dev/loop2", "./file0", "hfsplus", 0, "" <unfinished ...>
[pid  5084] <... openat resumed>)       = 3
[pid  5087] openat(AT_FDCWD, "/dev/loop5", O_RDONLY) = 4
[pid  5084] ioctl(4, LOOP_CLR_FD <unfinished ...>
[pid  5087] ioctl(4, LOOP_SET_BLOCK_SIZE, 2048 <unfinished ...>
[pid  5084] <... ioctl resumed>)        = 0
[   56.308967][ T5089] loop3: detected capacity change from 0 to 1024
[   56.311604][ T5085] loop2: detected capacity change from 0 to 1024
[pid  5084] close(4)                    = 0
[pid  5084] openat(AT_FDCWD, "/dev/loop5", O_RDONLY) = 4
[pid  5085] <... mount resumed>)        = 0
[pid  5084] ioctl(4, LOOP_SET_BLOCK_SIZE, 2048 <unfinished ...>
[pid  5085] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid  5085] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5085] close(4)                    = 0
[pid  5085] openat(AT_FDCWD, "/dev/loop5", O_RDONLY) = 4
[pid  5085] ioctl(4, LOOP_SET_BLOCK_SIZE, 2048 <unfinished ...>
[pid  5089] <... ioctl resumed>)        = 0
[pid  5087] <... ioctl resumed>)        = 0
[pid  5086] <... ioctl resumed>)        = 0
[pid  5085] <... ioctl resumed>)        = 0
[pid  5084] <... ioctl resumed>)        = 0
[pid  5083] <... ioctl resumed>)        = 0
[pid  5089] exit_group(0 <unfinished ...>
[pid  5087] exit_group(0 <unfinished ...>
[pid  5086] exit_group(0 <unfinished ...>
[pid  5085] exit_group(0 <unfinished ...>
[pid  5084] exit_group(0 <unfinished ...>
[pid  5083] exit_group(0 <unfinished ...>
[pid  5089] <... exit_group resumed>)   = ?
[pid  5087] <... exit_group resumed>)   = ?
[pid  5086] <... exit_group resumed>)   = ?
[pid  5085] <... exit_group resumed>)   = ?
[pid  5084] <... exit_group resumed>)   = ?
[pid  5083] <... exit_group resumed>)   = ?
[pid  5089] +++ exited with 0 +++
[pid  5087] +++ exited with 0 +++
[pid  5086] +++ exited with 0 +++
[pid  5085] +++ exited with 0 +++
[pid  5083] +++ exited with 0 +++
[pid  5084] +++ exited with 0 +++
[pid  5080] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5089, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
[pid  5079] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5085, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
[pid  5082] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5086, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
[pid  5081] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5084, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
[pid  5082] restart_syscall(<... resuming interrupted clone ...> <unfinished ...>
[pid  5081] restart_syscall(<... resuming interrupted clone ...> <unfinished ...>
[pid  5082] <... restart_syscall resumed>) = 0
[pid  5081] <... restart_syscall resumed>) = 0
[pid  5078] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5083, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---
[pid  5077] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5087, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
[pid  5078] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW <unfinished ...>
[pid  5077] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW <unfinished ...>
[pid  5082] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW <unfinished ...>
[pid  5081] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW <unfinished ...>
[pid  5082] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  5081] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  5078] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  5077] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  5082] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY <unfinished ...>
[pid  5081] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY <unfinished ...>
[pid  5082] <... openat resumed>)       = 3
[pid  5081] <... openat resumed>)       = 3
[pid  5080] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW <unfinished ...>
[pid  5079] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW <unfinished ...>
[pid  5078] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY <unfinished ...>
[pid  5077] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY <unfinished ...>
[pid  5082] fstat(3,  <unfinished ...>
[pid  5081] fstat(3,  <unfinished ...>
[pid  5080] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  5079] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  5078] <... openat resumed>)       = 3
[pid  5082] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
[pid  5081] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
[pid  5080] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY <unfinished ...>
[pid  5079] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY <unfinished ...>
[pid  5077] <... openat resumed>)       = 3
[pid  5082] getdents64(3,  <unfinished ...>
[pid  5081] getdents64(3,  <unfinished ...>
[pid  5080] <... openat resumed>)       = 3
[pid  5078] fstat(3,  <unfinished ...>
[pid  5082] <... getdents64 resumed>0x555556771620 /* 4 entries */, 32768) = 112
[pid  5081] <... getdents64 resumed>0x555556771620 /* 4 entries */, 32768) = 112
[pid  5079] <... openat resumed>)       = 3
[pid  5080] fstat(3,  <unfinished ...>
[pid  5077] fstat(3,  <unfinished ...>
[pid  5082] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW <unfinished ...>
[pid  5081] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW <unfinished ...>
[pid  5079] fstat(3,  <unfinished ...>
[pid  5078] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
[pid  5082] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  5081] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid  5080] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
[pid  5077] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
[pid  5082] lstat("./0/binderfs",  <unfinished ...>
[pid  5081] lstat("./0/binderfs",  <unfinished ...>
[pid  5079] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
[pid  5078] getdents64(3,  <unfinished ...>
[pid  5082] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
[pid  5081] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
[pid  5080] getdents64(3,  <unfinished ...>
[pid  5077] getdents64(3,  <unfinished ...>
[pid  5082] unlink("./0/binderfs" <unfinished ...>
[pid  5081] unlink("./0/binderfs" <unfinished ...>
[pid  5079] getdents64(3,  <unfinished ...>
[pid  5078] <... getdents64 resumed>0x555556771620 /* 4 entries */, 32768) = 112
[pid  5082] <... unlink resumed>)       = 0
[pid  5081] <... unlink resumed>)       = 0
[pid  5080] <... getdents64 resumed>0x555556771620 /* 4 entries */, 32768) = 112
[pid  5077] <... getdents64 resumed>0x555556771620 /* 4 entries */, 32768) = 112
[pid  5082] umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW <unfinished ...>
[pid  5081] umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW <unfinished ...>
[pid  5079] <... getdents64 resumed>0x555556771620 /* 4 entries */, 32768) = 112
[pid  5078] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW <unfinished ...>
[pid  5080] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW <unfinished ...>
[   56.461784][   T11] ==================================================================
[   56.469905][   T11] BUG: KASAN: slab-out-of-bounds in copy_page_from_iter_atomic+0xa9b/0x1080
[   56.478624][   T11] Read of size 2048 at addr ffff88802acb8000 by task kworker/u4:1/11
[   56.486693][   T11] 
[   56.489015][   T11] CPU: 0 PID: 11 Comm: kworker/u4:1 Not tainted 6.2.0-rc2-next-20230105-syzkaller #0
[   56.498476][   T11] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[   56.508544][   T11] Workqueue: loop5 loop_rootcg_workfn
[   56.513933][   T11] Call Trace:
[   56.517213][   T11]  <TASK>
[   56.520153][   T11]  dump_stack_lvl+0xd1/0x138
[   56.524776][   T11]  print_report+0x15e/0x45d
[   56.529296][   T11]  ? __phys_addr+0xc8/0x140
[   56.533829][   T11]  ? copy_page_from_iter_atomic+0xa9b/0x1080
[   56.539844][   T11]  kasan_report+0xc0/0xf0
[   56.544202][   T11]  ? copy_page_from_iter_atomic+0xa9b/0x1080
[   56.550196][   T11]  kasan_check_range+0x141/0x190
[   56.555147][   T11]  memcpy+0x24/0x60
[   56.558971][   T11]  copy_page_from_iter_atomic+0xa9b/0x1080
[   56.564792][   T11]  ? copy_page_from_iter+0x110/0x110
[   56.570086][   T11]  ? shmem_write_begin+0x162/0x380
[   56.575211][   T11]  ? shmem_file_read_iter+0xa40/0xa40
[   56.580603][   T11]  generic_perform_write+0x2ca/0x570
[   56.585902][   T11]  ? folio_add_wait_queue+0x1c0/0x1c0
[   56.591283][   T11]  ? new_inode+0x280/0x280
[   56.595718][   T11]  ? generic_write_checks+0x2c0/0x400
[   56.601107][   T11]  __generic_file_write_iter+0x2ae/0x500
[   56.606775][   T11]  generic_file_write_iter+0xe3/0x350
[   56.612180][   T11]  do_iter_readv_writev+0x20b/0x3b0
[   56.617409][   T11]  ? generic_copy_file_range+0x1d0/0x1d0
[   56.623069][   T11]  ? bpf_lsm_file_permission+0x9/0x10
[   56.628458][   T11]  ? security_file_permission+0xaf/0xd0
[   56.634033][   T11]  do_iter_write+0x182/0x700
[   56.638641][   T11]  ? rcu_read_lock_sched_held+0x3e/0x70
[   56.644209][   T11]  ? trace_lock_acquire+0x1f1/0x290
[   56.649434][   T11]  vfs_iter_write+0x74/0xa0
[   56.653967][   T11]  loop_process_work+0xdac/0x20e0
[   56.659015][   T11]  ? loop_queue_rq+0x1260/0x1260
[   56.663964][   T11]  ? lock_release+0x810/0x810
[   56.668651][   T11]  ? process_one_work+0x8a1/0x1750
[   56.673774][   T11]  ? rcu_read_lock_sched_held+0x3e/0x70
[   56.679335][   T11]  process_one_work+0x9bf/0x1750
[   56.684291][   T11]  ? pwq_dec_nr_in_flight+0x2a0/0x2a0
[   56.689676][   T11]  ? rcu_read_lock_sched_held+0x3e/0x70
[   56.695229][   T11]  ? rwlock_bug.part.0+0x90/0x90
[   56.700176][   T11]  ? lock_acquire+0x32/0xc0
[   56.704683][   T11]  ? worker_thread+0x16d/0x1090
[   56.709547][   T11]  worker_thread+0x669/0x1090
[   56.714242][   T11]  ? process_one_work+0x1750/0x1750
[   56.719451][   T11]  kthread+0x2e8/0x3a0
[   56.723528][   T11]  ? kthread_complete_and_exit+0x40/0x40
[   56.729171][   T11]  ret_from_fork+0x1f/0x30
[   56.733618][   T11]  </TASK>
[   56.736636][   T11] 
[   56.738955][   T11] Allocated by task 5086:
[   56.743280][   T11]  kasan_save_stack+0x22/0x40
[   56.747962][   T11]  kasan_set_track+0x25/0x30
[   56.752559][   T11]  __kasan_kmalloc+0xa5/0xb0
[   56.757156][   T11]  __kmalloc+0x5a/0xd0
[   56.761238][   T11]  hfsplus_read_wrapper+0x324/0xfd0
[   56.766440][   T11]  hfsplus_fill_super+0x31a/0x1a30
[   56.771563][   T11]  mount_bdev+0x351/0x410
[   56.775907][   T11]  legacy_get_tree+0x109/0x220
[   56.780691][   T11]  vfs_get_tree+0x8d/0x2f0
[   56.785123][   T11]  path_mount+0x132a/0x1e20
[   56.789642][   T11]  __x64_sys_mount+0x283/0x300
[   56.794421][   T11]  do_syscall_64+0x39/0xb0
[   56.798852][   T11]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   56.804751][   T11] 
[   56.807068][   T11] The buggy address belongs to the object at ffff88802acb8000
[   56.807068][   T11]  which belongs to the cache kmalloc-512 of size 512
[   56.821125][   T11] The buggy address is located 0 bytes inside of
[   56.821125][   T11]  512-byte region [ffff88802acb8000, ffff88802acb8200)
[   56.834224][   T11] 
[   56.836541][   T11] The buggy address belongs to the physical page:
[   56.842942][   T11] page:ffffea0000ab2e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2acb8
[   56.853097][   T11] head:ffffea0000ab2e00 order:2 compound_mapcount:0 subpages_mapcount:0 compound_pincount:0
[   56.863160][   T11] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[   56.871150][   T11] raw: 00fff00000010200 ffff888012441c80 ffffea00009c2000 dead000000000002
[   56.879735][   T11] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
[   56.888314][   T11] page dumped because: kasan: bad access detected
[   56.894720][   T11] page_owner tracks the page as allocated
[   56.900427][   T11] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4030, tgid 4030 (kworker/u4:2), ts 12547283531, free_ts 0
[   56.920927][   T11]  get_page_from_freelist+0x119e/0x2a80
[   56.926487][   T11]  __alloc_pages+0x1cb/0x5c0
[   56.931091][   T11]  alloc_pages+0x1aa/0x270
[   56.935515][   T11]  allocate_slab+0x25f/0x350
[   56.940107][   T11]  ___slab_alloc+0xa91/0x1400
[   56.944789][   T11]  __slab_alloc.constprop.0+0x56/0xa0
[   56.950166][   T11]  __kmem_cache_alloc_node+0x136/0x330
[   56.955632][   T11]  kmalloc_trace+0x26/0x60
[   56.960059][   T11]  alloc_bprm+0x51/0x900
[   56.964312][   T11]  kernel_execve+0xaf/0x500
[   56.968823][   T11]  call_usermodehelper_exec_async+0x2e7/0x580
[   56.974896][   T11]  ret_from_fork+0x1f/0x30
[   56.979325][   T11] page_owner free stack trace missing
[   56.984684][   T11] 
[   56.987003][   T11] Memory state around the buggy address:
[   56.992628][   T11]  ffff88802acb8100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   57.000687][   T11]  ffff88802acb8180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   57.008747][   T11] >ffff88802acb8200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   57.016815][   T11]                    ^
[   57.020895][   T11]  ffff88802acb8280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   57.028969][   T11]  ffff88802acb8300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   57.037032][   T11] ==================================================================
[   57.045294][   T11] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   57.052491][   T11] CPU: 0 PID: 11 Comm: kworker/u4:1 Not tainted 6.2.0-rc2-next-20230105-syzkaller #0
[   57.061952][   T11] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[   57.072005][   T11] Workqueue: loop5 loop_rootcg_workfn
[   57.077404][   T11] Call Trace:
[   57.080769][   T11]  <TASK>
[   57.083700][   T11]  dump_stack_lvl+0xd1/0x138
[   57.088311][   T11]  panic+0x2cc/0x626
[   57.092239][   T11]  ? panic_print_sys_info.part.0+0x110/0x110
[   57.098254][   T11]  ? asm_sysvec_apic_timer_interrupt+0x1a/0x20
[   57.104445][   T11]  check_panic_on_warn.cold+0x19/0x35
[   57.109845][   T11]  end_report.part.0+0x36/0x73
[   57.114632][   T11]  ? copy_page_from_iter_atomic+0xa9b/0x1080
[   57.120625][   T11]  kasan_report.cold+0xa/0xf
[   57.125235][   T11]  ? copy_page_from_iter_atomic+0xa9b/0x1080
[   57.131231][   T11]  kasan_check_range+0x141/0x190
[   57.136269][   T11]  memcpy+0x24/0x60
[   57.140089][   T11]  copy_page_from_iter_atomic+0xa9b/0x1080
[   57.145906][   T11]  ? copy_page_from_iter+0x110/0x110
[   57.151206][   T11]  ? shmem_write_begin+0x162/0x380
[   57.156328][   T11]  ? shmem_file_read_iter+0xa40/0xa40
[   57.161715][   T11]  generic_perform_write+0x2ca/0x570
[   57.167012][   T11]  ? folio_add_wait_queue+0x1c0/0x1c0
[   57.172393][   T11]  ? new_inode+0x280/0x280
[   57.176828][   T11]  ? generic_write_checks+0x2c0/0x400
[   57.182217][   T11]  __generic_file_write_iter+0x2ae/0x500
[   57.187863][   T11]  generic_file_write_iter+0xe3/0x350
[   57.193252][   T11]  do_iter_readv_writev+0x20b/0x3b0
[   57.198461][   T11]  ? generic_copy_file_range+0x1d0/0x1d0
[   57.204107][   T11]  ? bpf_lsm_file_permission+0x9/0x10
[   57.209492][   T11]  ? security_file_permission+0xaf/0xd0
[   57.215051][   T11]  do_iter_write+0x182/0x700
[   57.219649][   T11]  ? rcu_read_lock_sched_held+0x3e/0x70
[   57.225203][   T11]  ? trace_lock_acquire+0x1f1/0x290
[   57.230408][   T11]  vfs_iter_write+0x74/0xa0
[   57.234921][   T11]  loop_process_work+0xdac/0x20e0
[   57.239971][   T11]  ? loop_queue_rq+0x1260/0x1260
[   57.244932][   T11]  ? lock_release+0x810/0x810
[   57.249630][   T11]  ? process_one_work+0x8a1/0x1750
[   57.254775][   T11]  ? rcu_read_lock_sched_held+0x3e/0x70
[   57.260339][   T11]  process_one_work+0x9bf/0x1750
[   57.265294][   T11]  ? pwq_dec_nr_in_flight+0x2a0/0x2a0
[   57.270674][   T11]  ? rcu_read_lock_sched_held+0x3e/0x70
[   57.276229][   T11]  ? rwlock_bug.part.0+0x90/0x90
[   57.281171][   T11]  ? lock_acquire+0x32/0xc0
[   57.285679][   T11]  ? worker_thread+0x16d/0x1090
[   57.290549][   T11]  worker_thread+0x669/0x1090
[   57.295239][   T11]  ? process_one_work+0x1750/0x1750
[   57.300446][   T11]  kthread+0x2e8/0x3a0
[   57.304517][   T11]  ? kthread_complete_and_exit+0x40/0x40
[   57.310162][   T11]  ret_from_fork+0x1f/0x30
[   57.314601][   T11]  </TASK>
[   57.317674][   T11] Kernel Offset: disabled
[   57.321992][   T11] Rebooting in 86400 seconds..