./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor181540740 <...> Warning: Permanently added '10.128.1.61' (ECDSA) to the list of known hosts. execve("./syz-executor181540740", ["./syz-executor181540740"], 0x7fff07675270 /* 10 vars */) = 0 brk(NULL) = 0x555555e66000 brk(0x555555e66c40) = 0x555555e66c40 arch_prctl(ARCH_SET_FS, 0x555555e66300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor181540740", 4096) = 27 brk(0x555555e87c40) = 0x555555e87c40 brk(0x555555e88000) = 0x555555e88000 mprotect(0x7fe3f8696000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe3f01dd000 write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 131072) = 131072 munmap(0x7fe3f01dd000, 131072) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 mkdir("./file0", 0777) = 0 mount("/dev/loop0", "./file0", "minix", MS_SYNCHRONOUS|MS_NOATIME|MS_I_VERSION, "minix") = 0 openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 chdir("./file0") = 0 ioctl(4, LOOP_CLR_FD) = 0 close(4) = 0 mkdir("./bus", 000) = 0 syzkaller login: [ 70.314731][ T4995] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=4995 'syz-executor181' [ 70.329927][ T4995] loop0: detected capacity change from 0 to 256 [ 70.360989][ T4995] ================================================================================ [ 70.370627][ T4995] UBSAN: shift-out-of-bounds in fs/minix/inode.c:380:57 [ 70.377699][ T4995] shift exponent 1792 is too large for 64-bit type 'unsigned long' [ 70.385975][ T4995] CPU: 0 PID: 4995 Comm: syz-executor181 Not tainted 6.4.0-rc1-syzkaller-00021-gad2fd53a7870 #0 [ 70.396399][ T4995] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023 [ 70.406454][ T4995] Call Trace: [ 70.409747][ T4995] [ 70.412672][ T4995] dump_stack_lvl+0x1e7/0x2d0 [ 70.417371][ T4995] ? nf_tcp_handle_invalid+0x650/0x650 [ 70.422832][ T4995] ? panic+0x770/0x770 [ 70.426911][ T4995] __ubsan_handle_shift_out_of_bounds+0x3c3/0x420 [ 70.433333][ T4995] minix_statfs+0x369/0x370 [ 70.437836][ T4995] vfs_statfs+0x137/0x2c0 [ 70.442168][ T4995] ovl_get_upper+0x13b/0x5f0 [ 70.446795][ T4995] ? ovl_fill_super+0x2bd0/0x2bd0 [ 70.451852][ T4995] ? ovl_fill_super+0x14ee/0x2bd0 [ 70.456880][ T4995] ? rcu_is_watching+0x15/0xb0 [ 70.461638][ T4995] ? __kmalloc+0xe6/0x230 [ 70.465974][ T4995] ovl_fill_super+0x1745/0x2bd0 [ 70.470840][ T4995] ? ovl_mount+0x30/0x30 [ 70.475200][ T4995] ? sget+0x4bc/0x4d0 [ 70.479182][ T4995] ? free_anon_bdev+0x30/0x30 [ 70.483859][ T4995] ? ovl_mount+0x30/0x30 [ 70.488107][ T4995] mount_nodev+0x56/0xe0 [ 70.492377][ T4995] legacy_get_tree+0xef/0x190 [ 70.497057][ T4995] ? virtio_fs_zero_page_range+0x180/0x180 [ 70.502878][ T4995] vfs_get_tree+0x8c/0x270 [ 70.507325][ T4995] do_new_mount+0x28f/0xae0 [ 70.512903][ T4995] ? path_mount+0x5f2/0xf80 [ 70.517414][ T4995] ? do_move_mount_old+0x170/0x170 [ 70.522557][ T4995] ? user_path_at_empty+0x12f/0x180 [ 70.527761][ T4995] __se_sys_mount+0x2d9/0x3c0 [ 70.532478][ T4995] ? __x64_sys_mount+0xc0/0xc0 [ 70.537256][ T4995] ? syscall_enter_from_user_mode+0x32/0x230 [ 70.543248][ T4995] ? __x64_sys_mount+0x20/0xc0 [ 70.548023][ T4995] do_syscall_64+0x41/0xc0 [ 70.552452][ T4995] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 70.558352][ T4995] RIP: 0033:0x7fe3f8629809 [ 70.562794][ T4995] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 70.582495][ T4995] RSP: 002b:00007fff7e6c9fd8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 70.590921][ T4995] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe3f8629809 [ 70.598898][ T4995] RDX: 0000000020000080 RSI: 0000000020000040 RDI: 0000000000000000 [ 70.606873][ T4995] RBP: 00007fe3f85e90a0 R08: 0000000020000340 R09: 0000000000000000 [ 70.614850][ T4995] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe3f85e9130 [ 70.622821][ T4995] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 70.630814][ T4995] [ 70.634994][ T4995] ================================================================================ [ 70.644391][ T4995] Kernel panic - not syncing: UBSAN: panic_on_warn set ... [ 70.651612][ T4995] CPU: 1 PID: 4995 Comm: syz-executor181 Not tainted 6.4.0-rc1-syzkaller-00021-gad2fd53a7870 #0 [ 70.662017][ T4995] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023 [ 70.672067][ T4995] Call Trace: [ 70.675350][ T4995] [ 70.678276][ T4995] dump_stack_lvl+0x1e7/0x2d0 [ 70.682965][ T4995] ? nf_tcp_handle_invalid+0x650/0x650 [ 70.688432][ T4995] ? panic+0x770/0x770 [ 70.692506][ T4995] ? vscnprintf+0x5d/0x80 [ 70.696847][ T4995] panic+0x30f/0x770 [ 70.700748][ T4995] ? check_panic_on_warn+0x21/0xa0 [ 70.705882][ T4995] ? __memcpy_flushcache+0x2b0/0x2b0 [ 70.711177][ T4995] ? dump_stack_lvl+0x253/0x2d0 [ 70.716054][ T4995] check_panic_on_warn+0x82/0xa0 [ 70.720995][ T4995] __ubsan_handle_shift_out_of_bounds+0x3e2/0x420 [ 70.727428][ T4995] minix_statfs+0x369/0x370 [ 70.731962][ T4995] vfs_statfs+0x137/0x2c0 [ 70.736299][ T4995] ovl_get_upper+0x13b/0x5f0 [ 70.740898][ T4995] ? ovl_fill_super+0x2bd0/0x2bd0 [ 70.745941][ T4995] ? ovl_fill_super+0x14ee/0x2bd0 [ 70.750968][ T4995] ? rcu_is_watching+0x15/0xb0 [ 70.755732][ T4995] ? __kmalloc+0xe6/0x230 [ 70.760063][ T4995] ovl_fill_super+0x1745/0x2bd0 [ 70.764937][ T4995] ? ovl_mount+0x30/0x30 [ 70.769203][ T4995] ? sget+0x4bc/0x4d0 [ 70.773185][ T4995] ? free_anon_bdev+0x30/0x30 [ 70.777865][ T4995] ? ovl_mount+0x30/0x30 [ 70.782112][ T4995] mount_nodev+0x56/0xe0 [ 70.786375][ T4995] legacy_get_tree+0xef/0x190 [ 70.791077][ T4995] ? virtio_fs_zero_page_range+0x180/0x180 [ 70.796887][ T4995] vfs_get_tree+0x8c/0x270 [ 70.801305][ T4995] do_new_mount+0x28f/0xae0 [ 70.805815][ T4995] ? path_mount+0x5f2/0xf80 [ 70.810321][ T4995] ? do_move_mount_old+0x170/0x170 [ 70.815434][ T4995] ? user_path_at_empty+0x12f/0x180 [ 70.820630][ T4995] __se_sys_mount+0x2d9/0x3c0 [ 70.825311][ T4995] ? __x64_sys_mount+0xc0/0xc0 [ 70.830087][ T4995] ? syscall_enter_from_user_mode+0x32/0x230 [ 70.836072][ T4995] ? __x64_sys_mount+0x20/0xc0 [ 70.840848][ T4995] do_syscall_64+0x41/0xc0 [ 70.845271][ T4995] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 70.851164][ T4995] RIP: 0033:0x7fe3f8629809 [ 70.855574][ T4995] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 70.875213][ T4995] RSP: 002b:00007fff7e6c9fd8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 70.883638][ T4995] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe3f8629809 [ 70.891605][ T4995] RDX: 0000000020000080 RSI: 0000000020000040 RDI: 0000000000000000 [ 70.899568][ T4995] RBP: 00007fe3f85e90a0 R08: 0000000020000340 R09: 0000000000000000 [ 70.907535][ T4995] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe3f85e9130 [ 70.915501][ T4995] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 70.923476][ T4995] [ 70.926827][ T4995] Kernel Offset: disabled [ 70.931322][ T4995] Rebooting in 86400 seconds..