./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1735113716
<...>
Warning: Permanently added '10.128.0.106' (ED25519) to the list of known hosts.
execve("./syz-executor1735113716", ["./syz-executor1735113716"], 0x7ffd057ca610 /* 10 vars */) = 0
brk(NULL) = 0x555568d92000
brk(0x555568d92d00) = 0x555568d92d00
arch_prctl(ARCH_SET_FS, 0x555568d92380) = 0
set_tid_address(0x555568d92650) = 5823
set_robust_list(0x555568d92660, 24) = 0
rseq(0x555568d92ca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor1735113716", 4096) = 28
getrandom("\x08\x30\x1a\x1a\x40\x12\xcd\x75", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x555568d92d00
brk(0x555568db3d00) = 0x555568db3d00
brk(0x555568db4000) = 0x555568db4000
mprotect(0x7f8154dd2000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
mkdir("./syzkaller.M7OPMd", 0700) = 0
chmod("./syzkaller.M7OPMd", 0777) = 0
chdir("./syzkaller.M7OPMd") = 0
mkdir("./0", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5825 attached
, child_tidptr=0x555568d92650) = 5825
[pid 5825] set_robust_list(0x555568d92660, 24) = 0
[pid 5825] chdir("./0") = 0
[pid 5825] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5825] setpgid(0, 0) = 0
[pid 5825] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5825] write(3, "1000", 4) = 4
[pid 5825] close(3) = 0
[pid 5825] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 5825] write(1, "executing program\n", 18) = 18
[pid 5825] memfd_create("syzkaller", 0) = 3
[pid 5825] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f814c800000
[pid 5825] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216
[pid 5825] munmap(0x7f814c800000, 138412032) = 0
[pid 5825] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 5825] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 5825] close(3) = 0
[pid 5825] close(4) = 0
[pid 5825] mkdir("./bus", 0777) = 0
[pid 5825] mount("/dev/loop0", "./bus", "jfs", MS_NOSUID|MS_LAZYTIME, "") = 0
[pid 5825] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3
[ 86.649583][ T5825] loop0: detected capacity change from 0 to 32768
[pid 5825] chdir("./bus") = 0
[pid 5825] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy)
[pid 5825] openat(AT_FDCWD, "./file2", O_ACCMODE|O_CREAT|O_NOCTTY|O_SYNC|O_CLOEXEC|FASYNC, 0165) = 4
[pid 5825] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_LARGEFILE|O_NOATIME, 0450) = 5
[pid 5825] link("./file1", "./bus") = 0
[pid 5825] openat(AT_FDCWD, ".", O_RDONLY) = 6
[ 86.772607][ T5825] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 1
[ 86.772607][ T5825]
[ 86.785251][ T5825] ERROR: (device loop0): remounting filesystem as read-only
[ 86.792993][ T5825] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 3
[ 86.792993][ T5825]
[ 86.804313][ T5825] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 4
[ 86.804313][ T5825]
[pid 5825] getdents64(6, 0x20000f80 /* 4 entries */, 4096) = 112
[pid 5825] exit_group(0) = ?
[pid 5825] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5825, si_uid=0, si_status=0, si_utime=4 /* 0.04 s */, si_stime=21 /* 0.21 s */} ---
umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[ 86.815686][ T5825] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 5
[ 86.815686][ T5825]
[ 86.827187][ T5825] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 6
[ 86.827187][ T5825]
[ 86.838998][ T5825] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 7
[ 86.838998][ T5825]
openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x555568d936f0 /* 4 entries */, 32768) = 104
umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./0/binderfs") = 0
[ 86.991251][ T5823] ==================================================================
[ 86.999369][ T5823] BUG: KASAN: user-memory-access in __destroy_inode+0x47c/0x670
[ 87.007029][ T5823] Write of size 4 at addr 0000000b00000000 by task syz-executor173/5823
[ 87.015373][ T5823]
[ 87.017735][ T5823] CPU: 1 UID: 0 PID: 5823 Comm: syz-executor173 Not tainted 6.13.0-rc5-syzkaller-00012-g0bc21e701a6f #0
[ 87.028885][ T5823] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
[ 87.039043][ T5823] Call Trace:
[ 87.042468][ T5823]
[ 87.045407][ T5823] dump_stack_lvl+0x241/0x360
[ 87.050109][ T5823] ? __pfx_dump_stack_lvl+0x10/0x10
[ 87.055362][ T5823] ? __pfx__printk+0x10/0x10
[ 87.059979][ T5823] ? _printk+0xd5/0x120
[ 87.064175][ T5823] print_report+0xe8/0x550
[ 87.068628][ T5823] ? __virt_addr_valid+0x58/0x530
[ 87.074393][ T5823] ? __destroy_inode+0x47c/0x670
[ 87.079420][ T5823] kasan_report+0x143/0x180
[ 87.083964][ T5823] ? __destroy_inode+0x47c/0x670
[ 87.088950][ T5823] kasan_check_range+0x282/0x290
[ 87.093937][ T5823] __destroy_inode+0x47c/0x670
[ 87.098743][ T5823] evict+0x785/0x9a0
[ 87.102667][ T5823] ? __pfx_evict+0x10/0x10
[ 87.107202][ T5823] ? do_raw_spin_unlock+0x13c/0x8b0
[ 87.112424][ T5823] ? list_lru_del_obj+0xa8/0x250
[ 87.117374][ T5823] evict_inodes+0x6f6/0x790
[ 87.121912][ T5823] ? __pfx_evict_inodes+0x10/0x10
[ 87.126954][ T5823] ? dput+0x37/0x2b0
[ 87.130871][ T5823] generic_shutdown_super+0xa0/0x2d0
[ 87.136169][ T5823] kill_block_super+0x44/0x90
[ 87.140860][ T5823] deactivate_locked_super+0xc4/0x130
[ 87.146262][ T5823] cleanup_mnt+0x41f/0x4b0
[ 87.150710][ T5823] ? lockdep_hardirqs_on+0x99/0x150
[ 87.155959][ T5823] task_work_run+0x24f/0x310
[ 87.160569][ T5823] ? __pfx_task_work_run+0x10/0x10
[ 87.165710][ T5823] ? path_umount+0x284/0xf70
[ 87.170317][ T5823] ptrace_notify+0x2d2/0x380
[ 87.174923][ T5823] ? __pfx_ptrace_notify+0x10/0x10
[ 87.180045][ T5823] ? kmem_cache_free+0x195/0x410
[ 87.184993][ T5823] ? __x64_sys_umount+0x123/0x170
[ 87.190031][ T5823] syscall_exit_work+0xc7/0x1d0
[ 87.194918][ T5823] syscall_exit_to_user_mode+0x24a/0x340
[ 87.200586][ T5823] do_syscall_64+0x100/0x230
[ 87.205211][ T5823] ? clear_bhb_loop+0x35/0x90
[ 87.209902][ T5823] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.215831][ T5823] RIP: 0033:0x7f8154d59447
[ 87.220281][ T5823] Code: 07 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8
[ 87.239923][ T5823] RSP: 002b:00007fffcf1c8c58 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6
[ 87.248364][ T5823] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f8154d59447
[ 87.256359][ T5823] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fffcf1c8d10
[ 87.264340][ T5823] RBP: 00007fffcf1c8d10 R08: 0000000000000000 R09: 0000000000000000
[ 87.272366][ T5823] R10: 00000000ffffffff R11: 0000000000000202 R12: 00007fffcf1c9d80
[ 87.280520][ T5823] R13: 0000555568d936c0 R14: 431bde82d7b634db R15: 00007fffcf1c9da0
[ 87.288530][ T5823]
[ 87.291572][ T5823] ==================================================================
[ 87.299827][ T5823] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 87.307148][ T5823] CPU: 0 UID: 0 PID: 5823 Comm: syz-executor173 Not tainted 6.13.0-rc5-syzkaller-00012-g0bc21e701a6f #0
[ 87.318276][ T5823] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
[ 87.328357][ T5823] Call Trace:
[ 87.331660][ T5823]
[ 87.334604][ T5823] dump_stack_lvl+0x241/0x360
[ 87.339326][ T5823] ? __pfx_dump_stack_lvl+0x10/0x10
[ 87.344558][ T5823] ? __pfx__printk+0x10/0x10
[ 87.349225][ T5823] ? preempt_schedule+0xe1/0xf0
[ 87.354120][ T5823] ? vscnprintf+0x5d/0x90
[ 87.358466][ T5823] panic+0x349/0x880
[ 87.362371][ T5823] ? check_panic_on_warn+0x21/0xb0
[ 87.367496][ T5823] ? __pfx_panic+0x10/0x10
[ 87.371932][ T5823] ? _raw_spin_unlock_irqrestore+0x130/0x140
[ 87.377940][ T5823] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 87.384304][ T5823] ? print_report+0xe8/0x550
[ 87.388910][ T5823] check_panic_on_warn+0x86/0xb0
[ 87.393872][ T5823] ? __destroy_inode+0x47c/0x670
[ 87.398841][ T5823] end_report+0x77/0x160
[ 87.403138][ T5823] kasan_report+0x154/0x180
[ 87.407687][ T5823] ? __destroy_inode+0x47c/0x670
[ 87.412658][ T5823] kasan_check_range+0x282/0x290
[ 87.417616][ T5823] __destroy_inode+0x47c/0x670
[ 87.422404][ T5823] evict+0x785/0x9a0
[ 87.426328][ T5823] ? __pfx_evict+0x10/0x10
[ 87.430844][ T5823] ? do_raw_spin_unlock+0x13c/0x8b0
[ 87.436061][ T5823] ? list_lru_del_obj+0xa8/0x250
[ 87.441011][ T5823] evict_inodes+0x6f6/0x790
[ 87.445532][ T5823] ? __pfx_evict_inodes+0x10/0x10
[ 87.450562][ T5823] ? dput+0x37/0x2b0
[ 87.454466][ T5823] generic_shutdown_super+0xa0/0x2d0
[ 87.459769][ T5823] kill_block_super+0x44/0x90
[ 87.464575][ T5823] deactivate_locked_super+0xc4/0x130
[ 87.469982][ T5823] cleanup_mnt+0x41f/0x4b0
[ 87.474433][ T5823] ? lockdep_hardirqs_on+0x99/0x150
[ 87.479656][ T5823] task_work_run+0x24f/0x310
[ 87.484274][ T5823] ? __pfx_task_work_run+0x10/0x10
[ 87.489395][ T5823] ? path_umount+0x284/0xf70
[ 87.494002][ T5823] ptrace_notify+0x2d2/0x380
[ 87.498625][ T5823] ? __pfx_ptrace_notify+0x10/0x10
[ 87.503748][ T5823] ? kmem_cache_free+0x195/0x410
[ 87.508694][ T5823] ? __x64_sys_umount+0x123/0x170
[ 87.513733][ T5823] syscall_exit_work+0xc7/0x1d0
[ 87.518594][ T5823] syscall_exit_to_user_mode+0x24a/0x340
[ 87.524250][ T5823] do_syscall_64+0x100/0x230
[ 87.528855][ T5823] ? clear_bhb_loop+0x35/0x90
[ 87.533546][ T5823] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.539464][ T5823] RIP: 0033:0x7f8154d59447
[ 87.543887][ T5823] Code: 07 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8
[ 87.563854][ T5823] RSP: 002b:00007fffcf1c8c58 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6
[ 87.572278][ T5823] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f8154d59447
[ 87.580253][ T5823] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fffcf1c8d10
[ 87.588248][ T5823] RBP: 00007fffcf1c8d10 R08: 0000000000000000 R09: 0000000000000000
[ 87.596250][ T5823] R10: 00000000ffffffff R11: 0000000000000202 R12: 00007fffcf1c9d80
[ 87.604237][ T5823] R13: 0000555568d936c0 R14: 431bde82d7b634db R15: 00007fffcf1c9da0
[ 87.612487][ T5823]
[ 87.615803][ T5823] Kernel Offset: disabled
[ 87.620342][ T5823] Rebooting in 86400 seconds..