./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor4175138152 <...> forked to background, child pid 3186 no interfaces have a carrier [ 25.697629][ T3187] 8021q: adding VLAN 0 to HW filter on device bond0 [ 25.707362][ T3187] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: OK syzkaller Warning: Permanently added '10.128.0.131' (ECDSA) to the list of known hosts. execve("./syz-executor4175138152", ["./syz-executor4175138152"], 0x7ffda96e2420 /* 10 vars */) = 0 brk(NULL) = 0x555555d51000 brk(0x555555d51c40) = 0x555555d51c40 arch_prctl(ARCH_SET_FS, 0x555555d51300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor4175138152", 4096) = 28 brk(0x555555d72c40) = 0x555555d72c40 brk(0x555555d73000) = 0x555555d73000 mprotect(0x7f647bc42000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 mkdir("/syzcgroup", 0777) = 0 mkdir("/syzcgroup/unified", 0777) = 0 mount("none", "/syzcgroup/unified", "cgroup2", 0, NULL) = 0 chmod("/syzcgroup/unified", 0777) = 0 openat(AT_FDCWD, "/syzcgroup/unified/cgroup.subtree_control", O_WRONLY) = 3 write(3, "+cpu", 4) = 4 write(3, "+memory", 7) = 7 write(3, "+io", 3) = 3 write(3, "+pids", 5) = 5 close(3) = 0 mkdir("/syzcgroup/net", 0777) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "net") = -1 EINVAL (Invalid argument) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio") = 0 umount2("/syzcgroup/net", 0) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "devices") = 0 umount2("/syzcgroup/net", 0) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "blkio") = 0 umount2("/syzcgroup/net", 0) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "freezer") = 0 umount2("/syzcgroup/net", 0) = 0 syzkaller login: [ 48.395438][ T3614] cgroup: Unknown subsys name 'net' mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = 0 chmod("/syzcgroup/net", 0777) = 0 mkdir("/syzcgroup/cpu", 0777) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset") = 0 umount2("/syzcgroup/cpu", 0) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct") = 0 umount2("/syzcgroup/cpu", 0) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "hugetlb") = 0 umount2("/syzcgroup/cpu", 0) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "rlimit") = -1 EINVAL (Invalid argument) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset,cpuacct,hugetlb") = ? ERESTARTNOINTR (To be restarted) [ 48.518884][ T3614] cgroup: Unknown subsys name 'rlimit' mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset,cpuacct,hugetlb") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset,cpuacct,hugetlb") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset,cpuacct,hugetlb") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset,cpuacct,hugetlb") = 0 chmod("/syzcgroup/cpu", 0777) = 0 openat(AT_FDCWD, "/syzcgroup/cpu/cgroup.clone_children", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/syzcgroup/cpu/cpuset.memory_pressure_enabled", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3615 attached , child_tidptr=0x555555d515d0) = 3615 [pid 3614] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 3615] getpid() = 3615 ./strace-static-x86_64: Process 3616 attached [pid 3614] <... clone resumed>, child_tidptr=0x555555d515d0) = 3616 [pid 3614] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 3615] mkdir("./syzkaller.grmrhy", 0700 [pid 3616] getpid() = 3616 [pid 3614] <... clone resumed>, child_tidptr=0x555555d515d0) = 3617 [pid 3616] mkdir("./syzkaller.YphdkC", 0700 [pid 3614] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3617 attached , child_tidptr=0x555555d515d0) = 3618 [pid 3614] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 3617] getpid() = 3617 [pid 3614] <... clone resumed>, child_tidptr=0x555555d515d0) = 3619 [pid 3614] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 3615] <... mkdir resumed>) = 0 [pid 3615] chmod("./syzkaller.grmrhy", 0777./strace-static-x86_64: Process 3619 attached ./strace-static-x86_64: Process 3618 attached [pid 3614] <... clone resumed>, child_tidptr=0x555555d515d0) = 3620 [pid 3615] <... chmod resumed>) = 0 [pid 3615] chdir("./syzkaller.grmrhy" [pid 3619] getpid( [pid 3615] <... chdir resumed>) = 0 [pid 3619] <... getpid resumed>) = 3619 [pid 3615] unshare(CLONE_NEWPID [pid 3616] <... mkdir resumed>) = 0 [pid 3616] chmod("./syzkaller.YphdkC", 0777) = 0 [pid 3615] <... unshare resumed>) = 0 [pid 3619] mkdir("./syzkaller.yfArXO", 0700 [pid 3618] getpid( [pid 3617] mkdir("./syzkaller.SmlshJ", 0700 [pid 3615] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 3616] chdir("./syzkaller.YphdkC" [pid 3619] <... mkdir resumed>) = 0 [pid 3616] <... chdir resumed>) = 0 [pid 3616] unshare(CLONE_NEWPID) = 0 [pid 3616] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 3618] <... getpid resumed>) = 3618 [pid 3619] chmod("./syzkaller.yfArXO", 0777 [pid 3617] <... mkdir resumed>) = 0 ./strace-static-x86_64: Process 3620 attached [pid 3618] mkdir("./syzkaller.IpT2wL", 0700 [pid 3615] <... clone resumed>, child_tidptr=0x555555d515d0) = 3621 [pid 3619] <... chmod resumed>) = 0 [pid 3616] <... clone resumed>, child_tidptr=0x555555d515d0) = 3622 ./strace-static-x86_64: Process 3621 attached [pid 3619] chdir("./syzkaller.yfArXO" [pid 3618] <... mkdir resumed>) = 0 [pid 3617] chmod("./syzkaller.SmlshJ", 0777 [pid 3620] getpid( [pid 3619] <... chdir resumed>) = 0 [pid 3617] <... chmod resumed>) = 0 [pid 3619] unshare(CLONE_NEWPID [pid 3618] chmod("./syzkaller.IpT2wL", 0777 [pid 3617] chdir("./syzkaller.SmlshJ"./strace-static-x86_64: Process 3622 attached [pid 3620] <... getpid resumed>) = 3620 [pid 3619] <... unshare resumed>) = 0 [pid 3621] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL [pid 3618] <... chmod resumed>) = 0 [pid 3619] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 3617] <... chdir resumed>) = 0 [pid 3622] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL [pid 3620] mkdir("./syzkaller.t7Xq2U", 0700 [pid 3618] chdir("./syzkaller.IpT2wL" [pid 3617] unshare(CLONE_NEWPID [pid 3619] <... clone resumed>, child_tidptr=0x555555d515d0) = 3623 [pid 3618] <... chdir resumed>) = 0 [pid 3617] <... unshare resumed>) = 0 [pid 3620] <... mkdir resumed>) = 0 [pid 3618] unshare(CLONE_NEWPID [pid 3617] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 3618] <... unshare resumed>) = 0 [pid 3621] <... mount resumed>) = -1 EBUSY (Device or resource busy) [pid 3618] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 3621] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3617] <... clone resumed>, child_tidptr=0x555555d515d0) = 3624 [pid 3620] chmod("./syzkaller.t7Xq2U", 0777 [pid 3622] <... mount resumed>) = -1 EBUSY (Device or resource busy) [pid 3618] <... clone resumed>, child_tidptr=0x555555d515d0) = 3625 [pid 3622] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 3620] <... chmod resumed>) = 0 ./strace-static-x86_64: Process 3624 attached ./strace-static-x86_64: Process 3623 attached [pid 3622] <... prctl resumed>) = 0 [pid 3621] setsid( [pid 3620] chdir("./syzkaller.t7Xq2U" [pid 3622] setsid( [pid 3623] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL [pid 3622] <... setsid resumed>) = 1 [pid 3620] <... chdir resumed>) = 0 [pid 3624] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL [pid 3622] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, [pid 3620] unshare(CLONE_NEWPID./strace-static-x86_64: Process 3625 attached [pid 3623] <... mount resumed>) = -1 EBUSY (Device or resource busy) [pid 3622] <... prlimit64 resumed>NULL) = 0 [pid 3621] <... setsid resumed>) = 1 [pid 3620] <... unshare resumed>) = 0 [pid 3623] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 3622] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, [pid 3621] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, [pid 3620] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 3624] <... mount resumed>) = -1 EBUSY (Device or resource busy) [pid 3623] <... prctl resumed>) = 0 [pid 3622] <... prlimit64 resumed>NULL) = 0 [pid 3621] <... prlimit64 resumed>NULL) = 0 [pid 3625] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 3624] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 3623] setsid( [pid 3622] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, [pid 3621] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, [pid 3624] <... prctl resumed>) = 0 [pid 3623] <... setsid resumed>) = 1 [pid 3622] <... prlimit64 resumed>NULL) = 0 [pid 3621] <... prlimit64 resumed>NULL) = 0 [pid 3620] <... clone resumed>, child_tidptr=0x555555d515d0) = 3626 [pid 3624] setsid( [pid 3623] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, [pid 3622] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, [pid 3625] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 3622] <... prlimit64 resumed>NULL) = 0 [pid 3621] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, [pid 3624] <... setsid resumed>) = 1 [pid 3623] <... prlimit64 resumed>NULL) = 0 [pid 3622] prlimit64(0, RLIMIT_CORE, {rlim_cur=0, rlim_max=0}, [pid 3621] <... prlimit64 resumed>NULL) = 0 [pid 3624] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, [pid 3623] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, [pid 3622] <... prlimit64 resumed>NULL) = 0 [pid 3624] <... prlimit64 resumed>NULL) = 0 [pid 3623] <... prlimit64 resumed>NULL) = 0 [pid 3621] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, [pid 3624] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, [pid 3623] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, [pid 3622] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, [pid 3621] <... prlimit64 resumed>NULL) = 0 [pid 3624] <... prlimit64 resumed>NULL) = 0 [pid 3623] <... prlimit64 resumed>NULL) = 0 [pid 3622] <... prlimit64 resumed>NULL) = 0 [pid 3621] prlimit64(0, RLIMIT_CORE, {rlim_cur=0, rlim_max=0}, [pid 3623] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, [pid 3624] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, [pid 3622] unshare(CLONE_NEWNS [pid 3624] <... prlimit64 resumed>NULL) = 0 [pid 3623] <... prlimit64 resumed>NULL) = 0 [pid 3621] <... prlimit64 resumed>NULL) = 0 ./strace-static-x86_64: Process 3626 attached [pid 3625] <... prctl resumed>) = 0 [pid 3626] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL [pid 3625] setsid( [pid 3624] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, [pid 3623] prlimit64(0, RLIMIT_CORE, {rlim_cur=0, rlim_max=0}, [pid 3622] <... unshare resumed>) = 0 [pid 3621] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, [pid 3626] <... mount resumed>) = -1 EBUSY (Device or resource busy) [pid 3625] <... setsid resumed>) = 1 [pid 3624] <... prlimit64 resumed>NULL) = 0 [pid 3623] <... prlimit64 resumed>NULL) = 0 [pid 3622] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL [pid 3621] <... prlimit64 resumed>NULL) = 0 [pid 3626] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 3625] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, [pid 3624] prlimit64(0, RLIMIT_CORE, {rlim_cur=0, rlim_max=0}, [pid 3623] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, [pid 3626] <... prctl resumed>) = 0 [pid 3625] <... prlimit64 resumed>NULL) = 0 [pid 3624] <... prlimit64 resumed>NULL) = 0 [pid 3623] <... prlimit64 resumed>NULL) = 0 [pid 3622] <... mount resumed>) = 0 [pid 3621] unshare(CLONE_NEWNS [pid 3626] setsid( [pid 3625] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, [pid 3622] unshare(CLONE_NEWIPC [pid 3626] <... setsid resumed>) = 1 [pid 3625] <... prlimit64 resumed>NULL) = 0 [pid 3624] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, [pid 3623] unshare(CLONE_NEWNS [pid 3626] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, [pid 3625] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, [pid 3621] <... unshare resumed>) = 0 [pid 3626] <... prlimit64 resumed>NULL) = 0 [pid 3625] <... prlimit64 resumed>NULL) = 0 [pid 3626] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, [pid 3625] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, [pid 3622] <... unshare resumed>) = 0 [pid 3626] <... prlimit64 resumed>NULL) = 0 [pid 3625] <... prlimit64 resumed>NULL) = 0 [pid 3626] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, [pid 3625] prlimit64(0, RLIMIT_CORE, {rlim_cur=0, rlim_max=0}, [pid 3624] <... prlimit64 resumed>NULL) = 0 [pid 3623] <... unshare resumed>) = 0 [pid 3622] unshare(CLONE_NEWCGROUP [pid 3621] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL [pid 3626] <... prlimit64 resumed>NULL) = 0 [pid 3625] <... prlimit64 resumed>NULL) = 0 [pid 3624] unshare(CLONE_NEWNS [pid 3623] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL [pid 3622] <... unshare resumed>) = 0 [pid 3626] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, [pid 3625] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, [pid 3621] <... mount resumed>) = 0 [pid 3626] <... prlimit64 resumed>NULL) = 0 [pid 3625] <... prlimit64 resumed>NULL) = 0 [pid 3626] prlimit64(0, RLIMIT_CORE, {rlim_cur=0, rlim_max=0}, [pid 3625] unshare(CLONE_NEWNS [pid 3626] <... prlimit64 resumed>NULL) = 0 [pid 3625] <... unshare resumed>) = 0 [pid 3624] <... unshare resumed>) = 0 [pid 3623] <... mount resumed>) = 0 [pid 3622] unshare(CLONE_NEWUTS [pid 3621] unshare(CLONE_NEWIPC [pid 3626] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, [pid 3625] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL [pid 3624] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL [pid 3623] unshare(CLONE_NEWIPC [pid 3622] <... unshare resumed>) = 0 [pid 3626] <... prlimit64 resumed>NULL) = 0 [pid 3625] <... mount resumed>) = 0 [pid 3621] <... unshare resumed>) = 0 [pid 3624] <... mount resumed>) = 0 [pid 3626] unshare(CLONE_NEWNS [pid 3625] unshare(CLONE_NEWIPC [pid 3622] unshare(CLONE_SYSVSEM [pid 3626] <... unshare resumed>) = 0 [pid 3625] <... unshare resumed>) = 0 [pid 3624] unshare(CLONE_NEWIPC [pid 3623] <... unshare resumed>) = 0 [pid 3622] <... unshare resumed>) = 0 [pid 3621] unshare(CLONE_NEWCGROUP [pid 3626] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL [pid 3625] unshare(CLONE_NEWCGROUP [pid 3626] <... mount resumed>) = 0 [pid 3625] <... unshare resumed>) = 0 [pid 3624] <... unshare resumed>) = 0 [pid 3623] unshare(CLONE_NEWCGROUP [pid 3622] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC [pid 3621] <... unshare resumed>) = 0 [pid 3626] unshare(CLONE_NEWIPC [pid 3625] unshare(CLONE_NEWUTS [pid 3624] unshare(CLONE_NEWCGROUP [pid 3623] <... unshare resumed>) = 0 [pid 3626] <... unshare resumed>) = 0 [pid 3625] <... unshare resumed>) = 0 [pid 3624] <... unshare resumed>) = 0 [pid 3622] <... openat resumed>) = 3 [pid 3621] unshare(CLONE_NEWUTS [pid 3626] unshare(CLONE_NEWCGROUP [pid 3625] unshare(CLONE_SYSVSEM [pid 3624] unshare(CLONE_NEWUTS [pid 3623] unshare(CLONE_NEWUTS [pid 3622] write(3, "16777216", 8 [pid 3621] <... unshare resumed>) = 0 [pid 3626] <... unshare resumed>) = 0 [pid 3625] <... unshare resumed>) = 0 [pid 3624] <... unshare resumed>) = 0 [pid 3623] <... unshare resumed>) = 0 [pid 3622] <... write resumed>) = 8 [pid 3621] unshare(CLONE_SYSVSEM [pid 3626] unshare(CLONE_NEWUTS [pid 3625] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC [pid 3624] unshare(CLONE_SYSVSEM [pid 3623] unshare(CLONE_SYSVSEM [pid 3622] close(3 [pid 3621] <... unshare resumed>) = 0 [pid 3626] <... unshare resumed>) = 0 [pid 3625] <... openat resumed>) = 3 [pid 3624] <... unshare resumed>) = 0 [pid 3623] <... unshare resumed>) = 0 [pid 3622] <... close resumed>) = 0 [pid 3626] unshare(CLONE_SYSVSEM [pid 3625] write(3, "16777216", 8 [pid 3621] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC [pid 3626] <... unshare resumed>) = 0 [pid 3625] <... write resumed>) = 8 [pid 3624] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC [pid 3623] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC [pid 3622] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC [pid 3626] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC [pid 3625] close(3 [pid 3621] <... openat resumed>) = 3 [pid 3626] <... openat resumed>) = 3 [pid 3625] <... close resumed>) = 0 [pid 3624] <... openat resumed>) = 3 [pid 3623] <... openat resumed>) = 3 [pid 3626] write(3, "16777216", 8 [pid 3625] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC [pid 3624] write(3, "16777216", 8 [pid 3623] write(3, "16777216", 8 [pid 3622] <... openat resumed>) = 3 [pid 3621] write(3, "16777216", 8 [pid 3626] <... write resumed>) = 8 [pid 3625] <... openat resumed>) = 3 [pid 3626] close(3 [pid 3625] write(3, "536870912", 9 [pid 3624] <... write resumed>) = 8 [pid 3623] <... write resumed>) = 8 [pid 3622] write(3, "536870912", 9 [pid 3621] <... write resumed>) = 8 [pid 3626] <... close resumed>) = 0 [pid 3625] <... write resumed>) = 9 [pid 3624] close(3 [pid 3623] close(3 [pid 3626] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC [pid 3625] close(3 [pid 3624] <... close resumed>) = 0 [pid 3622] <... write resumed>) = 9 [pid 3621] close(3 [pid 3626] <... openat resumed>) = 3 [pid 3625] <... close resumed>) = 0 [pid 3624] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC [pid 3623] <... close resumed>) = 0 [pid 3626] write(3, "536870912", 9 [pid 3625] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC [pid 3622] close(3 [pid 3621] <... close resumed>) = 0 [pid 3626] <... write resumed>) = 9 [pid 3625] <... openat resumed>) = 3 [pid 3624] <... openat resumed>) = 3 [pid 3623] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC [pid 3626] close(3 [pid 3625] write(3, "1024", 4 [pid 3624] write(3, "536870912", 9 [pid 3622] <... close resumed>) = 0 [pid 3621] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC [pid 3626] <... close resumed>) = 0 [pid 3625] <... write resumed>) = 4 [pid 3624] <... write resumed>) = 9 [pid 3623] <... openat resumed>) = 3 [pid 3622] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC [pid 3626] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC [pid 3625] close(3 [pid 3624] close(3 [pid 3623] write(3, "536870912", 9 [pid 3621] <... openat resumed>) = 3 [pid 3626] <... openat resumed>) = 3 [pid 3625] <... close resumed>) = 0 [pid 3624] <... close resumed>) = 0 [pid 3623] <... write resumed>) = 9 [pid 3622] <... openat resumed>) = 3 [pid 3621] write(3, "536870912", 9 [pid 3626] write(3, "1024", 4 [pid 3625] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC [pid 3624] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC [pid 3623] close(3 [pid 3622] write(3, "1024", 4 [pid 3621] <... write resumed>) = 9 [pid 3626] <... write resumed>) = 4 [pid 3625] <... openat resumed>) = 3 [pid 3626] close(3 [pid 3625] write(3, "8192", 4 [pid 3624] <... openat resumed>) = 3 [pid 3623] <... close resumed>) = 0 [pid 3622] <... write resumed>) = 4 [pid 3621] close(3 [pid 3626] <... close resumed>) = 0 [pid 3625] <... write resumed>) = 4 [pid 3624] write(3, "1024", 4 [pid 3623] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC [pid 3622] close(3 [pid 3621] <... close resumed>) = 0 [pid 3626] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC [pid 3625] close(3 [pid 3624] <... write resumed>) = 4 [pid 3626] <... openat resumed>) = 3 [pid 3625] <... close resumed>) = 0 [pid 3624] close(3 [pid 3623] <... openat resumed>) = 3 [pid 3622] <... close resumed>) = 0 [pid 3621] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC [pid 3626] write(3, "8192", 4 [pid 3625] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC [pid 3626] <... write resumed>) = 4 [pid 3625] <... openat resumed>) = 3 [pid 3624] <... close resumed>) = 0 [pid 3623] write(3, "1024", 4 [pid 3622] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC [pid 3621] <... openat resumed>) = 3 [pid 3626] close(3 [pid 3625] write(3, "1024", 4 [pid 3624] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC [pid 3623] <... write resumed>) = 4 [pid 3626] <... close resumed>) = 0 [pid 3625] <... write resumed>) = 4 [pid 3622] <... openat resumed>) = 3 [pid 3621] write(3, "1024", 4 [pid 3626] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC [pid 3625] close(3 [pid 3624] <... openat resumed>) = 3 [pid 3623] close(3 [pid 3622] write(3, "8192", 4 [pid 3626] <... openat resumed>) = 3 [pid 3625] <... close resumed>) = 0 [pid 3624] write(3, "8192", 4 [pid 3623] <... close resumed>) = 0 [pid 3621] <... write resumed>) = 4 [pid 3626] write(3, "1024", 4 [pid 3625] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC [pid 3624] <... write resumed>) = 4 [pid 3623] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC [pid 3622] <... write resumed>) = 4 [pid 3621] close(3 [pid 3626] <... write resumed>) = 4 [pid 3625] <... openat resumed>) = 3 [pid 3624] close(3 [pid 3626] close(3 [pid 3625] write(3, "1024", 4 [pid 3623] <... openat resumed>) = 3 [pid 3624] <... close resumed>) = 0 [pid 3622] close(3 [pid 3621] <... close resumed>) = 0 [pid 3626] <... close resumed>) = 0 [pid 3625] <... write resumed>) = 4 [pid 3624] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC [pid 3623] write(3, "8192", 4 [pid 3622] <... close resumed>) = 0 [pid 3621] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC [pid 3626] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC [pid 3625] close(3 [pid 3626] <... openat resumed>) = 3 [pid 3625] <... close resumed>) = 0 [pid 3624] <... openat resumed>) = 3 [pid 3623] <... write resumed>) = 4 [pid 3622] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC [pid 3621] <... openat resumed>) = 3 [pid 3626] write(3, "1024", 4 [pid 3625] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC [pid 3624] write(3, "1024", 4 [pid 3623] close(3 [pid 3626] <... write resumed>) = 4 [pid 3625] <... openat resumed>) = 3 [pid 3624] <... write resumed>) = 4 [pid 3622] <... openat resumed>) = 3 [pid 3623] <... close resumed>) = 0 [pid 3621] write(3, "8192", 4 [pid 3626] close(3 [pid 3625] write(3, "1024 1048576 500 1024", 21 [pid 3624] close(3 [pid 3623] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC [pid 3622] write(3, "1024", 4 [pid 3621] <... write resumed>) = 4 [pid 3626] <... close resumed>) = 0 [pid 3625] <... write resumed>) = 21 [pid 3624] <... close resumed>) = 0 [pid 3626] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC [pid 3625] close(3 [pid 3624] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC [pid 3623] <... openat resumed>) = 3 [pid 3622] <... write resumed>) = 4 [pid 3621] close(3 [pid 3626] <... openat resumed>) = 3 [pid 3625] <... close resumed>) = 0 [pid 3626] write(3, "1024 1048576 500 1024", 21 [pid 3625] getpid( [pid 3624] <... openat resumed>) = 3 [pid 3623] write(3, "1024", 4 [pid 3622] close(3 [pid 3621] <... close resumed>) = 0 [pid 3626] <... write resumed>) = 21 [pid 3625] <... getpid resumed>) = 1 [pid 3624] write(3, "1024", 4 [pid 3623] <... write resumed>) = 4 [pid 3622] <... close resumed>) = 0 [pid 3626] close(3 [pid 3625] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, [pid 3624] <... write resumed>) = 4 [pid 3623] close(3 [pid 3621] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC [pid 3626] <... close resumed>) = 0 [pid 3625] <... capget resumed>{effective=1< [pid 3623] <... close resumed>) = 0 [pid 3622] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC [pid 3626] getpid( [pid 3625] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 3624] <... close resumed>) = 0 [pid 3621] <... openat resumed>) = 3 [pid 3626] <... getpid resumed>) = 1 [pid 3625] <... capset resumed>) = 0 [pid 3624] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC [pid 3623] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC [pid 3622] <... openat resumed>) = 3 [pid 3621] write(3, "1024", 4 [pid 3626] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, [pid 3625] unshare(CLONE_NEWNET [pid 3624] <... openat resumed>) = 3 [pid 3626] <... capget resumed>{effective=1< [pid 3623] <... openat resumed>) = 3 [pid 3622] write(3, "1024", 4 [pid 3621] <... write resumed>) = 4 [pid 3624] <... write resumed>) = 21 [pid 3623] write(3, "1024", 4 [pid 3622] <... write resumed>) = 4 [pid 3621] close(3 [pid 3624] close(3 [pid 3623] <... write resumed>) = 4 [pid 3622] close(3 [pid 3621] <... close resumed>) = 0 [pid 3624] <... close resumed>) = 0 [pid 3623] close(3 [pid 3622] <... close resumed>) = 0 [pid 3621] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC [pid 3626] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 3624] getpid( [pid 3623] <... close resumed>) = 0 [pid 3622] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC [pid 3621] <... openat resumed>) = 3 [pid 3626] <... capset resumed>) = 0 [pid 3624] <... getpid resumed>) = 1 [pid 3623] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC [pid 3622] <... openat resumed>) = 3 [pid 3621] write(3, "1024", 4 [pid 3626] unshare(CLONE_NEWNET [pid 3624] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, [pid 3623] <... openat resumed>) = 3 [pid 3622] write(3, "1024 1048576 500 1024", 21 [pid 3621] <... write resumed>) = 4 [pid 3624] <... capget resumed>{effective=1< [pid 3622] <... write resumed>) = 21 [pid 3621] close(3 [pid 3624] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 3623] <... write resumed>) = 21 [pid 3622] close(3 [pid 3621] <... close resumed>) = 0 [pid 3624] <... capset resumed>) = 0 [pid 3623] close(3 [pid 3622] <... close resumed>) = 0 [pid 3621] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC [pid 3624] unshare(CLONE_NEWNET [pid 3623] <... close resumed>) = 0 [pid 3622] getpid( [pid 3621] <... openat resumed>) = 3 [pid 3623] getpid( [pid 3622] <... getpid resumed>) = 1 [pid 3621] write(3, "1024 1048576 500 1024", 21 [pid 3623] <... getpid resumed>) = 1 [pid 3622] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, [pid 3621] <... write resumed>) = 21 [pid 3623] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, [pid 3622] <... capget resumed>{effective=1< [pid 3623] <... capget resumed>{effective=1< [pid 3621] <... close resumed>) = 0 [pid 3623] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 3622] <... capset resumed>) = 0 [pid 3621] getpid( [pid 3623] <... capset resumed>) = 0 [pid 3622] unshare(CLONE_NEWNET [pid 3621] <... getpid resumed>) = 1 [pid 3623] unshare(CLONE_NEWNET [pid 3621] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 3626] <... unshare resumed>) = 0 [pid 3626] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC) = 3 [pid 3626] write(3, "0 65535", 7) = 7 [pid 3626] close(3) = 0 [pid 3626] openat(AT_FDCWD, "/dev/rfkill", O_RDWR) = 3 [pid 3626] write(3, "\x00\x00\x00\x00\x00\x03\x00\x00", 8) = 8 [pid 3625] <... unshare resumed>) = 0 [pid 3626] close(3) = 0 [pid 3626] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 3626] sendto(3, [{nlmsg_len=40, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x13\x00\x02\x00\x4d\x41\x43\x38\x30\x32\x31\x31\x5f\x48\x57\x53\x49\x4d\x00\x00"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3625] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC [pid 3626] <... sendto resumed>) = 40 [pid 3625] <... openat resumed>) = 3 [pid 3625] write(3, "0 65535", 7) = 7 [pid 3626] recvfrom(3, [{nlmsg_len=224, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, "\x01\x02\x00\x00\x13\x00\x02\x00\x4d\x41\x43\x38\x30\x32\x31\x31\x5f\x48\x57\x53\x49\x4d\x00\x00\x06\x00\x01\x00\x29\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x18\x00\x00\x00\x7c\x00\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x0a\x00\x00\x00"...], 4096, 0, NULL, NULL) = 224 [pid 3626] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=40, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 3625] close(3 [pid 3626] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 3625] <... close resumed>) = 0 [pid 3626] recvfrom(3, [{nlmsg_len=2376, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x22\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x37\x01\x00\x00\x74\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2376 [pid 3625] openat(AT_FDCWD, "/dev/rfkill", O_RDWR [pid 3626] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 3625] <... openat resumed>) = 3 [pid 3626] sendto(3, [{nlmsg_len=36, nlmsg_type=0x29 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x04\x00\x00\x00\x04\x00\x0e\x00\x0a\x00\x16\x00\x08\x02\x11\x00\x00\x00\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3625] write(3, "\x00\x00\x00\x00\x00\x03\x00\x00", 8) = 8 [pid 3625] close(3) = 0 [pid 3625] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 3625] sendto(3, [{nlmsg_len=40, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x13\x00\x02\x00\x4d\x41\x43\x38\x30\x32\x31\x31\x5f\x48\x57\x53\x49\x4d\x00\x00"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3621] <... unshare resumed>) = 0 [pid 3621] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC) = 3 [pid 3621] write(3, "0 65535", 7) = 7 [pid 3621] close(3) = 0 [pid 3621] openat(AT_FDCWD, "/dev/rfkill", O_RDWR) = 3 [pid 3626] <... sendto resumed>) = 36 [pid 3625] <... sendto resumed>) = 40 [pid 3621] write(3, "\x00\x00\x00\x00\x00\x03\x00\x00", 8 [pid 3625] recvfrom(3, [{nlmsg_len=224, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, "\x01\x02\x00\x00\x13\x00\x02\x00\x4d\x41\x43\x38\x30\x32\x31\x31\x5f\x48\x57\x53\x49\x4d\x00\x00\x06\x00\x01\x00\x29\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x18\x00\x00\x00\x7c\x00\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x0a\x00\x00\x00"...], 4096, 0, NULL, NULL) = 224 [pid 3625] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=40, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 3625] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 3625] recvfrom(3, [{nlmsg_len=2376, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x22\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x37\x01\x00\x00\x74\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2376 [pid 3626] recvfrom(3, [pid 3625] recvfrom(3, [pid 3621] <... write resumed>) = 8 [pid 3626] <... recvfrom resumed>[{nlmsg_len=56, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=2, msg=[{nlmsg_len=36, nlmsg_type=0x29 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x04\x00\x00\x00\x04\x00\x0e\x00\x0a\x00\x16\x00\x08\x02\x11\x00\x00\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 56 [pid 3625] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 3626] access("/proc/net", R_OK [pid 3625] sendto(3, [{nlmsg_len=36, nlmsg_type=0x29 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x04\x00\x00\x00\x04\x00\x0e\x00\x0a\x00\x16\x00\x08\x02\x11\x00\x00\x00\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3621] close(3 [pid 3626] <... access resumed>) = 0 [pid 3622] <... unshare resumed>) = 0 [pid 3622] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC [pid 3626] access("/proc/net/unix", R_OK [pid 3622] <... openat resumed>) = 3 [pid 3622] write(3, "0 65535", 7) = 7 [pid 3622] close(3) = 0 [pid 3622] openat(AT_FDCWD, "/dev/rfkill", O_RDWR [pid 3626] <... access resumed>) = 0 [pid 3622] <... openat resumed>) = 3 [pid 3621] <... close resumed>) = 0 [pid 3622] write(3, "\x00\x00\x00\x00\x00\x03\x00\x00", 8 [pid 3626] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 3622] <... write resumed>) = 8 [pid 3621] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC [pid 3622] close(3 [pid 3626] <... socket resumed>) = 4 [pid 3622] <... close resumed>) = 0 [pid 3621] <... socket resumed>) = 3 [pid 3622] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 3622] sendto(3, [{nlmsg_len=40, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x13\x00\x02\x00\x4d\x41\x43\x38\x30\x32\x31\x31\x5f\x48\x57\x53\x49\x4d\x00\x00"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3626] ioctl(4, SIOCGIFINDEX, {ifr_name="wlan0" [pid 3625] <... sendto resumed>) = 36 [pid 3622] <... sendto resumed>) = 40 [pid 3621] sendto(3, [{nlmsg_len=40, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x13\x00\x02\x00\x4d\x41\x43\x38\x30\x32\x31\x31\x5f\x48\x57\x53\x49\x4d\x00\x00"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3626] <... ioctl resumed>, ifr_ifindex=11}) = 0 [pid 3625] recvfrom(3, [pid 3622] recvfrom(3, [pid 3626] close(4 [pid 3625] <... recvfrom resumed>[{nlmsg_len=56, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=3, msg=[{nlmsg_len=36, nlmsg_type=0x29 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x04\x00\x00\x00\x04\x00\x0e\x00\x0a\x00\x16\x00\x08\x02\x11\x00\x00\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 56 [pid 3623] <... unshare resumed>) = 0 [pid 3622] <... recvfrom resumed>[{nlmsg_len=224, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, "\x01\x02\x00\x00\x13\x00\x02\x00\x4d\x41\x43\x38\x30\x32\x31\x31\x5f\x48\x57\x53\x49\x4d\x00\x00\x06\x00\x01\x00\x29\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x18\x00\x00\x00\x7c\x00\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x0a\x00\x00\x00"...], 4096, 0, NULL, NULL) = 224 [pid 3621] <... sendto resumed>) = 40 [pid 3626] <... close resumed>) = 0 [pid 3625] access("/proc/net", R_OK [pid 3623] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC [pid 3622] recvfrom(3, [pid 3626] sendto(3, [{nlmsg_len=36, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x06\x00\x00\x00\x08\x00\x03\x00\x0b\x00\x00\x00\x08\x00\x05\x00\x01\x00\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3625] <... access resumed>) = 0 [pid 3623] <... openat resumed>) = 3 [pid 3622] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=40, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 3621] recvfrom(3, [pid 3624] <... unshare resumed>) = 0 [pid 3623] write(3, "0 65535", 7 [pid 3622] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3623] <... write resumed>) = 7 [pid 3622] <... sendto resumed>) = 32 [pid 3623] close(3 [pid 3622] recvfrom(3, [pid 3623] <... close resumed>) = 0 [pid 3622] <... recvfrom resumed>[{nlmsg_len=2376, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x22\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x37\x01\x00\x00\x74\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2376 [pid 3626] <... sendto resumed>) = 36 [pid 3625] access("/proc/net/unix", R_OK [pid 3624] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC [pid 3623] openat(AT_FDCWD, "/dev/rfkill", O_RDWR [pid 3622] recvfrom(3, [pid 3621] <... recvfrom resumed>[{nlmsg_len=224, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, "\x01\x02\x00\x00\x13\x00\x02\x00\x4d\x41\x43\x38\x30\x32\x31\x31\x5f\x48\x57\x53\x49\x4d\x00\x00\x06\x00\x01\x00\x29\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x18\x00\x00\x00\x7c\x00\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x0a\x00\x00\x00"...], 4096, 0, NULL, NULL) = 224 [pid 3626] recvfrom(3, [pid 3625] <... access resumed>) = 0 [pid 3624] <... openat resumed>) = 3 [pid 3623] <... openat resumed>) = 3 [pid 3622] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 3621] recvfrom(3, [pid 3626] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=36, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 3625] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 3624] write(3, "0 65535", 7 [pid 3623] write(3, "\x00\x00\x00\x00\x00\x03\x00\x00", 8 [pid 3622] sendto(3, [{nlmsg_len=36, nlmsg_type=0x29 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x04\x00\x00\x00\x04\x00\x0e\x00\x0a\x00\x16\x00\x08\x02\x11\x00\x00\x00\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3621] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=40, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 3626] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP [pid 3625] <... socket resumed>) = 4 [pid 3624] <... write resumed>) = 7 [pid 3623] <... write resumed>) = 8 [pid 3622] <... sendto resumed>) = 36 [pid 3621] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3626] <... socket resumed>) = 4 [pid 3625] ioctl(4, SIOCGIFINDEX, {ifr_name="wlan0" [pid 3624] close(3 [pid 3623] close(3) = 0 [pid 3621] <... sendto resumed>) = 32 [pid 3626] ioctl(4, SIOCGIFFLAGS, {ifr_name="wlan0" [pid 3625] <... ioctl resumed>, ifr_ifindex=11}) = 0 [pid 3623] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC [pid 3621] recvfrom(3, [pid 3626] <... ioctl resumed>, ifr_flags=IFF_BROADCAST|IFF_MULTICAST}) = 0 [pid 3625] close(4 [pid 3623] <... socket resumed>) = 3 [pid 3622] recvfrom(3, [pid 3621] <... recvfrom resumed>[{nlmsg_len=2376, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x22\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x37\x01\x00\x00\x74\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2376 [pid 3626] ioctl(4, SIOCSIFFLAGS, {ifr_name="wlan0", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_MULTICAST} [pid 3625] <... close resumed>) = 0 [pid 3624] <... close resumed>) = 0 [pid 3623] sendto(3, [{nlmsg_len=40, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x13\x00\x02\x00\x4d\x41\x43\x38\x30\x32\x31\x31\x5f\x48\x57\x53\x49\x4d\x00\x00"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3621] recvfrom(3, [pid 3625] sendto(3, [{nlmsg_len=36, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x06\x00\x00\x00\x08\x00\x03\x00\x0b\x00\x00\x00\x08\x00\x05\x00\x01\x00\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3623] <... sendto resumed>) = 40 [pid 3622] <... recvfrom resumed>[{nlmsg_len=56, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=4, msg=[{nlmsg_len=36, nlmsg_type=0x29 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x04\x00\x00\x00\x04\x00\x0e\x00\x0a\x00\x16\x00\x08\x02\x11\x00\x00\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 56 [pid 3626] <... ioctl resumed>) = 0 [pid 3624] openat(AT_FDCWD, "/dev/rfkill", O_RDWR [pid 3623] recvfrom(3, [pid 3622] access("/proc/net", R_OK [pid 3621] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 3623] <... recvfrom resumed>[{nlmsg_len=224, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, "\x01\x02\x00\x00\x13\x00\x02\x00\x4d\x41\x43\x38\x30\x32\x31\x31\x5f\x48\x57\x53\x49\x4d\x00\x00\x06\x00\x01\x00\x29\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x18\x00\x00\x00\x7c\x00\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x0a\x00\x00\x00"...], 4096, 0, NULL, NULL) = 224 [pid 3622] <... access resumed>) = 0 [pid 3626] close(4 [pid 3625] <... sendto resumed>) = 36 [pid 3624] <... openat resumed>) = 3 [pid 3623] recvfrom(3, [pid 3622] access("/proc/net/unix", R_OK [pid 3621] sendto(3, [{nlmsg_len=36, nlmsg_type=0x29 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x04\x00\x00\x00\x04\x00\x0e\x00\x0a\x00\x16\x00\x08\x02\x11\x00\x00\x00\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3626] <... close resumed>) = 0 [pid 3625] recvfrom(3, [pid 3624] write(3, "\x00\x00\x00\x00\x00\x03\x00\x00", 8 [pid 3623] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=40, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 3622] <... access resumed>) = 0 [pid 3623] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3622] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4 [pid 3622] ioctl(4, SIOCGIFINDEX, {ifr_name="wlan0", ifr_ifindex=11}) = 0 [pid 3626] sendto(3, [{nlmsg_len=64, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x2b\x00\x00\x00\x08\x00\x03\x00\x0b\x00\x00\x00\x0a\x00\x34\x00\x10\x10\x10\x10\x10\x10\x00\x00\x08\x00\x26\x00\x6c\x09\x00\x00\x0a\x00\x06\x00\x50\x50\x50\x50\x50\x50\x00\x00\x04\x00\x3c\x00"], 64, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3625] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=36, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 3624] <... write resumed>) = 8 [pid 3622] close(4 [pid 3625] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP [pid 3624] close(3 [pid 3622] <... close resumed>) = 0 [pid 3625] <... socket resumed>) = 4 [pid 3622] sendto(3, [{nlmsg_len=36, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x06\x00\x00\x00\x08\x00\x03\x00\x0b\x00\x00\x00\x08\x00\x05\x00\x01\x00\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3625] ioctl(4, SIOCGIFFLAGS, {ifr_name="wlan0" [pid 3624] <... close resumed>) = 0 [pid 3625] <... ioctl resumed>, ifr_flags=IFF_BROADCAST|IFF_MULTICAST}) = 0 [pid 3623] <... sendto resumed>) = 32 [pid 3626] <... sendto resumed>) = 64 [pid 3623] recvfrom(3, [{nlmsg_len=2376, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x22\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x37\x01\x00\x00\x74\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2376 [pid 3623] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 3621] <... sendto resumed>) = 36 [pid 3623] sendto(3, [{nlmsg_len=36, nlmsg_type=0x29 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x04\x00\x00\x00\x04\x00\x0e\x00\x0a\x00\x16\x00\x08\x02\x11\x00\x00\x00\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3622] <... sendto resumed>) = 36 [pid 3626] recvfrom(3, [pid 3625] ioctl(4, SIOCSIFFLAGS, {ifr_name="wlan0", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_MULTICAST} [pid 3624] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC [pid 3621] recvfrom(3, [{nlmsg_len=56, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=5, msg=[{nlmsg_len=36, nlmsg_type=0x29 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x04\x00\x00\x00\x04\x00\x0e\x00\x0a\x00\x16\x00\x08\x02\x11\x00\x00\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 56 [pid 3626] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=64, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 3624] <... socket resumed>) = 3 [pid 3622] recvfrom(3, [pid 3621] access("/proc/net", R_OK [pid 3625] <... ioctl resumed>) = 0 [pid 3621] <... access resumed>) = 0 [pid 3621] access("/proc/net/unix", R_OK) = 0 [pid 3621] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4 [pid 3621] ioctl(4, SIOCGIFINDEX, {ifr_name="wlan0", ifr_ifindex=11}) = 0 [pid 3621] close(4) = 0 [pid 3621] sendto(3, [{nlmsg_len=36, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x06\x00\x00\x00\x08\x00\x03\x00\x0b\x00\x00\x00\x08\x00\x05\x00\x01\x00\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3626] sendto(3, [{nlmsg_len=36, nlmsg_type=0x29 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x04\x00\x00\x00\x04\x00\x0e\x00\x0a\x00\x16\x00\x08\x02\x11\x00\x00\x01\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3625] close(4 [pid 3624] sendto(3, [{nlmsg_len=40, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x13\x00\x02\x00\x4d\x41\x43\x38\x30\x32\x31\x31\x5f\x48\x57\x53\x49\x4d\x00\x00"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3622] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=36, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 3625] <... close resumed>) = 0 [pid 3623] <... sendto resumed>) = 36 [pid 3621] <... sendto resumed>) = 36 [pid 3623] recvfrom(3, [pid 3621] recvfrom(3, [pid 3623] <... recvfrom resumed>[{nlmsg_len=56, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=6, msg=[{nlmsg_len=36, nlmsg_type=0x29 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x04\x00\x00\x00\x04\x00\x0e\x00\x0a\x00\x16\x00\x08\x02\x11\x00\x00\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 56 [pid 3621] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=36, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 3625] sendto(3, [{nlmsg_len=64, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x2b\x00\x00\x00\x08\x00\x03\x00\x0b\x00\x00\x00\x0a\x00\x34\x00\x10\x10\x10\x10\x10\x10\x00\x00\x08\x00\x26\x00\x6c\x09\x00\x00\x0a\x00\x06\x00\x50\x50\x50\x50\x50\x50\x00\x00\x04\x00\x3c\x00"], 64, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3623] access("/proc/net", R_OK [pid 3622] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP [ 49.050583][ T46] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.059122][ T46] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.071396][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [pid 3621] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP [pid 3626] <... sendto resumed>) = 36 [pid 3624] <... sendto resumed>) = 40 [pid 3623] <... access resumed>) = 0 [pid 3625] <... sendto resumed>) = 64 [pid 3621] <... socket resumed>) = 4 [pid 3623] access("/proc/net/unix", R_OK [pid 3622] <... socket resumed>) = 4 [pid 3621] ioctl(4, SIOCGIFFLAGS, {ifr_name="wlan0" [pid 3623] <... access resumed>) = 0 [pid 3621] <... ioctl resumed>, ifr_flags=IFF_BROADCAST|IFF_MULTICAST}) = 0 [pid 3623] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 3621] ioctl(4, SIOCSIFFLAGS, {ifr_name="wlan0", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_MULTICAST} [pid 3623] <... socket resumed>) = 4 [pid 3621] <... ioctl resumed>) = 0 [pid 3623] ioctl(4, SIOCGIFINDEX, {ifr_name="wlan0" [pid 3621] close(4 [pid 3623] <... ioctl resumed>, ifr_ifindex=11}) = 0 [pid 3621] <... close resumed>) = 0 [pid 3623] close(4 [pid 3621] sendto(3, [{nlmsg_len=64, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x2b\x00\x00\x00\x08\x00\x03\x00\x0b\x00\x00\x00\x0a\x00\x34\x00\x10\x10\x10\x10\x10\x10\x00\x00\x08\x00\x26\x00\x6c\x09\x00\x00\x0a\x00\x06\x00\x50\x50\x50\x50\x50\x50\x00\x00\x04\x00\x3c\x00"], 64, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3626] recvfrom(3, [pid 3625] recvfrom(3, [pid 3624] recvfrom(3, [pid 3623] <... close resumed>) = 0 [pid 3622] ioctl(4, SIOCGIFFLAGS, {ifr_name="wlan0" [pid 3621] <... sendto resumed>) = 64 [pid 3623] sendto(3, [{nlmsg_len=36, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x06\x00\x00\x00\x08\x00\x03\x00\x0b\x00\x00\x00\x08\x00\x05\x00\x01\x00\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3621] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=64, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 3626] <... recvfrom resumed>[{nlmsg_len=56, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=7, msg=[{nlmsg_len=36, nlmsg_type=0x29 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x04\x00\x00\x00\x04\x00\x0e\x00\x0a\x00\x16\x00\x08\x02\x11\x00\x00\x01\x00\x00"]}], 4096, 0, NULL, NULL) = 56 [pid 3625] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=64, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 3624] <... recvfrom resumed>[{nlmsg_len=224, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, "\x01\x02\x00\x00\x13\x00\x02\x00\x4d\x41\x43\x38\x30\x32\x31\x31\x5f\x48\x57\x53\x49\x4d\x00\x00\x06\x00\x01\x00\x29\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x18\x00\x00\x00\x7c\x00\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x0a\x00\x00\x00"...], 4096, 0, NULL, NULL) = 224 [pid 3622] <... ioctl resumed>, ifr_flags=IFF_BROADCAST|IFF_MULTICAST}) = 0 [ 49.105961][ T46] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.111774][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.114467][ T46] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.130847][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 49.144844][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [pid 3621] sendto(3, [{nlmsg_len=36, nlmsg_type=0x29 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x04\x00\x00\x00\x04\x00\x0e\x00\x0a\x00\x16\x00\x08\x02\x11\x00\x00\x01\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3626] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 3625] sendto(3, [{nlmsg_len=36, nlmsg_type=0x29 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x04\x00\x00\x00\x04\x00\x0e\x00\x0a\x00\x16\x00\x08\x02\x11\x00\x00\x01\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3624] recvfrom(3, [pid 3623] <... sendto resumed>) = 36 [pid 3622] ioctl(4, SIOCSIFFLAGS, {ifr_name="wlan0", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_MULTICAST} [pid 3621] <... sendto resumed>) = 36 [pid 3626] <... socket resumed>) = 4 [pid 3623] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=36, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 3623] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 4 [pid 3623] ioctl(4, SIOCGIFFLAGS, {ifr_name="wlan0", ifr_flags=IFF_BROADCAST|IFF_MULTICAST}) = 0 [pid 3623] ioctl(4, SIOCSIFFLAGS, {ifr_name="wlan0", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_MULTICAST} [pid 3626] ioctl(4, SIOCGIFINDEX, {ifr_name="wlan1" [pid 3624] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=40, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 3626] <... ioctl resumed>, ifr_ifindex=12}) = 0 [pid 3621] recvfrom(3, [{nlmsg_len=56, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=8, msg=[{nlmsg_len=36, nlmsg_type=0x29 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x04\x00\x00\x00\x04\x00\x0e\x00\x0a\x00\x16\x00\x08\x02\x11\x00\x00\x01\x00\x00"]}], 4096, 0, NULL, NULL) = 56 [pid 3626] close(4 [pid 3625] <... sendto resumed>) = 36 [pid 3624] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3623] <... ioctl resumed>) = 0 [pid 3622] <... ioctl resumed>) = 0 [pid 3626] <... close resumed>) = 0 [pid 3625] recvfrom(3, [pid 3624] <... sendto resumed>) = 32 [pid 3623] close(4 [pid 3622] close(4 [pid 3621] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 3626] sendto(3, [{nlmsg_len=36, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x06\x00\x00\x00\x08\x00\x03\x00\x0c\x00\x00\x00\x08\x00\x05\x00\x01\x00\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3625] <... recvfrom resumed>[{nlmsg_len=56, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=9, msg=[{nlmsg_len=36, nlmsg_type=0x29 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x04\x00\x00\x00\x04\x00\x0e\x00\x0a\x00\x16\x00\x08\x02\x11\x00\x00\x01\x00\x00"]}], 4096, 0, NULL, NULL) = 56 [pid 3624] recvfrom(3, [pid 3623] <... close resumed>) = 0 [pid 3622] <... close resumed>) = 0 [pid 3621] <... socket resumed>) = 4 [ 49.160491][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [pid 3623] sendto(3, [{nlmsg_len=64, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x2b\x00\x00\x00\x08\x00\x03\x00\x0b\x00\x00\x00\x0a\x00\x34\x00\x10\x10\x10\x10\x10\x10\x00\x00\x08\x00\x26\x00\x6c\x09\x00\x00\x0a\x00\x06\x00\x50\x50\x50\x50\x50\x50\x00\x00\x04\x00\x3c\x00"], 64, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3621] ioctl(4, SIOCGIFINDEX, {ifr_name="wlan1" [pid 3626] <... sendto resumed>) = 36 [pid 3625] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 3624] <... recvfrom resumed>[{nlmsg_len=2376, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x22\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x37\x01\x00\x00\x74\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2376 [pid 3623] <... sendto resumed>) = 64 [pid 3622] sendto(3, [{nlmsg_len=64, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x2b\x00\x00\x00\x08\x00\x03\x00\x0b\x00\x00\x00\x0a\x00\x34\x00\x10\x10\x10\x10\x10\x10\x00\x00\x08\x00\x26\x00\x6c\x09\x00\x00\x0a\x00\x06\x00\x50\x50\x50\x50\x50\x50\x00\x00\x04\x00\x3c\x00"], 64, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3626] recvfrom(3, [pid 3625] <... socket resumed>) = 4 [pid 3624] recvfrom(3, [pid 3623] recvfrom(3, [pid 3622] <... sendto resumed>) = 64 [pid 3621] <... ioctl resumed>, ifr_ifindex=12}) = 0 [pid 3623] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=64, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 3621] close(4 [pid 3623] sendto(3, [{nlmsg_len=36, nlmsg_type=0x29 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x04\x00\x00\x00\x04\x00\x0e\x00\x0a\x00\x16\x00\x08\x02\x11\x00\x00\x01\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3621] <... close resumed>) = 0 [pid 3626] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=36, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 3625] ioctl(4, SIOCGIFINDEX, {ifr_name="wlan1" [pid 3624] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 3623] <... sendto resumed>) = 36 [pid 3622] recvfrom(3, [pid 3621] sendto(3, [{nlmsg_len=36, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x06\x00\x00\x00\x08\x00\x03\x00\x0c\x00\x00\x00\x08\x00\x05\x00\x01\x00\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3626] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP [pid 3625] <... ioctl resumed>, ifr_ifindex=12}) = 0 [pid 3624] sendto(3, [{nlmsg_len=36, nlmsg_type=0x29 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x04\x00\x00\x00\x04\x00\x0e\x00\x0a\x00\x16\x00\x08\x02\x11\x00\x00\x00\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3622] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=64, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 3621] <... sendto resumed>) = 36 [pid 3626] <... socket resumed>) = 4 [pid 3625] close(4 [pid 3623] recvfrom(3, [pid 3621] recvfrom(3, [pid 3623] <... recvfrom resumed>[{nlmsg_len=56, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=10, msg=[{nlmsg_len=36, nlmsg_type=0x29 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x04\x00\x00\x00\x04\x00\x0e\x00\x0a\x00\x16\x00\x08\x02\x11\x00\x00\x01\x00\x00"]}], 4096, 0, NULL, NULL) = 56 [pid 3621] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=36, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 3623] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 3621] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP [pid 3626] ioctl(4, SIOCGIFFLAGS, {ifr_name="wlan1" [pid 3625] <... close resumed>) = 0 [pid 3623] <... socket resumed>) = 4 [pid 3622] sendto(3, [{nlmsg_len=36, nlmsg_type=0x29 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x04\x00\x00\x00\x04\x00\x0e\x00\x0a\x00\x16\x00\x08\x02\x11\x00\x00\x01\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3621] <... socket resumed>) = 4 [pid 3626] <... ioctl resumed>, ifr_flags=IFF_BROADCAST|IFF_MULTICAST}) = 0 [pid 3625] sendto(3, [{nlmsg_len=36, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x06\x00\x00\x00\x08\x00\x03\x00\x0c\x00\x00\x00\x08\x00\x05\x00\x01\x00\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3623] ioctl(4, SIOCGIFINDEX, {ifr_name="wlan1" [pid 3621] ioctl(4, SIOCGIFFLAGS, {ifr_name="wlan1" [pid 3626] ioctl(4, SIOCSIFFLAGS, {ifr_name="wlan1", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_MULTICAST} [pid 3623] <... ioctl resumed>, ifr_ifindex=12}) = 0 [pid 3621] <... ioctl resumed>, ifr_flags=IFF_BROADCAST|IFF_MULTICAST}) = 0 [ 49.200782][ T8] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.209817][ T8] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.212152][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.218634][ T3627] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 49.225429][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.243244][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [pid 3623] close(4 [pid 3621] ioctl(4, SIOCSIFFLAGS, {ifr_name="wlan1", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_MULTICAST} [pid 3623] <... close resumed>) = 0 [pid 3621] <... ioctl resumed>) = 0 [pid 3623] sendto(3, [{nlmsg_len=36, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x06\x00\x00\x00\x08\x00\x03\x00\x0c\x00\x00\x00\x08\x00\x05\x00\x01\x00\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3621] close(4 [pid 3623] <... sendto resumed>) = 36 [pid 3621] <... close resumed>) = 0 [pid 3623] recvfrom(3, [pid 3621] sendto(3, [{nlmsg_len=64, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x2b\x00\x00\x00\x08\x00\x03\x00\x0c\x00\x00\x00\x0a\x00\x34\x00\x10\x10\x10\x10\x10\x10\x00\x00\x08\x00\x26\x00\x6c\x09\x00\x00\x0a\x00\x06\x00\x50\x50\x50\x50\x50\x50\x00\x00\x04\x00\x3c\x00"], 64, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3626] <... ioctl resumed>) = 0 [pid 3625] <... sendto resumed>) = 36 [pid 3623] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=36, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 3626] close(4 [pid 3625] recvfrom(3, [pid 3623] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP [pid 3626] <... close resumed>) = 0 [pid 3625] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=36, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 3623] <... socket resumed>) = 4 [pid 3626] sendto(3, [{nlmsg_len=64, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x2b\x00\x00\x00\x08\x00\x03\x00\x0c\x00\x00\x00\x0a\x00\x34\x00\x10\x10\x10\x10\x10\x10\x00\x00\x08\x00\x26\x00\x6c\x09\x00\x00\x0a\x00\x06\x00\x50\x50\x50\x50\x50\x50\x00\x00\x04\x00\x3c\x00"], 64, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [ 49.296048][ T46] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.296051][ T8] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.296092][ T46] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.304335][ T8] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.327028][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.332007][ T6] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [pid 3623] ioctl(4, SIOCGIFFLAGS, {ifr_name="wlan1" [pid 3626] <... sendto resumed>) = 64 [pid 3625] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP [pid 3623] <... ioctl resumed>, ifr_flags=IFF_BROADCAST|IFF_MULTICAST}) = 0 [pid 3621] <... sendto resumed>) = 64 [pid 3623] ioctl(4, SIOCSIFFLAGS, {ifr_name="wlan1", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_MULTICAST} [pid 3621] recvfrom(3, [pid 3623] <... ioctl resumed>) = 0 [pid 3621] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=64, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 3624] <... sendto resumed>) = 36 [pid 3623] close(4 [pid 3621] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 3624] recvfrom(3, [pid 3623] <... close resumed>) = 0 [pid 3621] <... socket resumed>) = 4 [pid 3624] <... recvfrom resumed>[{nlmsg_len=56, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=11, msg=[{nlmsg_len=36, nlmsg_type=0x29 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x04\x00\x00\x00\x04\x00\x0e\x00\x0a\x00\x16\x00\x08\x02\x11\x00\x00\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 56 [pid 3623] sendto(3, [{nlmsg_len=64, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x2b\x00\x00\x00\x08\x00\x03\x00\x0c\x00\x00\x00\x0a\x00\x34\x00\x10\x10\x10\x10\x10\x10\x00\x00\x08\x00\x26\x00\x6c\x09\x00\x00\x0a\x00\x06\x00\x50\x50\x50\x50\x50\x50\x00\x00\x04\x00\x3c\x00"], 64, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3621] ioctl(4, SIOCGIFINDEX, {ifr_name="wlan0" [pid 3624] access("/proc/net", R_OK [pid 3623] <... sendto resumed>) = 64 [pid 3621] <... ioctl resumed>, ifr_ifindex=11}) = 0 [pid 3624] <... access resumed>) = 0 [pid 3623] recvfrom(3, [pid 3621] close(4 [pid 3624] access("/proc/net/unix", R_OK [pid 3623] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=64, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 3621] <... close resumed>) = 0 [pid 3624] <... access resumed>) = 0 [pid 3623] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 3624] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 3623] <... socket resumed>) = 4 [pid 3624] <... socket resumed>) = 4 [pid 3623] ioctl(4, SIOCGIFINDEX, {ifr_name="wlan0" [pid 3624] ioctl(4, SIOCGIFINDEX, {ifr_name="wlan0" [pid 3623] <... ioctl resumed>, ifr_ifindex=11}) = 0 [pid 3624] <... ioctl resumed>, ifr_ifindex=11}) = 0 [pid 3623] close(4 [pid 3624] close(4 [pid 3623] <... close resumed>) = 0 [pid 3624] <... close resumed>) = 0 [pid 3621] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE [pid 3624] sendto(3, [{nlmsg_len=36, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x06\x00\x00\x00\x08\x00\x03\x00\x0b\x00\x00\x00\x08\x00\x05\x00\x01\x00\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3621] <... socket resumed>) = 4 [pid 3624] <... sendto resumed>) = 36 [pid 3621] sendto(4, [{nlmsg_len=32, nlmsg_type=0x12 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3624] recvfrom(3, [pid 3623] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE [pid 3624] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=36, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 3623] <... socket resumed>) = 4 [pid 3624] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP [pid 3623] sendto(4, [{nlmsg_len=32, nlmsg_type=0x12 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3624] <... socket resumed>) = 4 [pid 3623] <... sendto resumed>) = 32 [pid 3621] <... sendto resumed>) = 32 [pid 3624] ioctl(4, SIOCGIFFLAGS, {ifr_name="wlan0" [pid 3623] recvfrom(4, [pid 3621] recvfrom(4, [pid 3624] <... ioctl resumed>, ifr_flags=IFF_BROADCAST|IFF_MULTICAST}) = 0 [pid 3623] <... recvfrom resumed>[{nlmsg_len=1404, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, "\x00\x00\x01\x00\x0b\x00\x00\x00\x43\x10\x01\x00\x00\x00\x00\x00\x0a\x00\x03\x00\x77\x6c\x61\x6e\x30\x00\x00\x00\x08\x00\x0d\x00\xe8\x03\x00\x00\x05\x00\x10\x00\x06\x00\x00\x00\x05\x00\x11\x00\x00\x00\x00\x00\x08\x00\x04\x00\xdc\x05\x00\x00\x08\x00\x32\x00\x00\x01\x00\x00\x08\x00\x33\x00\x00\x09\x00\x00\x08\x00\x1b\x00\x00\x00\x00\x00\x08\x00\x1e\x00\x00\x00\x00\x00\x08\x00\x1f\x00\x04\x00\x00\x00"...], 4096, 0, NULL, NULL) = 1404 [pid 3621] <... recvfrom resumed>[{nlmsg_len=1404, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, "\x00\x00\x01\x00\x0b\x00\x00\x00\x43\x10\x01\x00\x00\x00\x00\x00\x0a\x00\x03\x00\x77\x6c\x61\x6e\x30\x00\x00\x00\x08\x00\x0d\x00\xe8\x03\x00\x00\x05\x00\x10\x00\x06\x00\x00\x00\x05\x00\x11\x00\x00\x00\x00\x00\x08\x00\x04\x00\xdc\x05\x00\x00\x08\x00\x32\x00\x00\x01\x00\x00\x08\x00\x33\x00\x00\x09\x00\x00\x08\x00\x1b\x00\x00\x00\x00\x00\x08\x00\x1e\x00\x00\x00\x00\x00\x08\x00\x1f\x00\x04\x00\x00\x00"...], 4096, 0, NULL, NULL) = 1404 [pid 3626] recvfrom(3, [pid 3625] <... socket resumed>) = 4 [pid 3624] ioctl(4, SIOCSIFFLAGS, {ifr_name="wlan0", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_MULTICAST} [pid 3623] close(4 [pid 3621] close(4 [pid 3626] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=64, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 3623] <... close resumed>) = 0 [pid 3621] <... close resumed>) = 0 [pid 3623] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 3621] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 3623] <... socket resumed>) = 4 [pid 3621] <... socket resumed>) = 4 [pid 3623] ioctl(4, SIOCGIFINDEX, {ifr_name="wlan1" [pid 3621] ioctl(4, SIOCGIFINDEX, {ifr_name="wlan1" [pid 3626] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 3625] ioctl(4, SIOCGIFFLAGS, {ifr_name="wlan1" [pid 3623] <... ioctl resumed>, ifr_ifindex=12}) = 0 [pid 3621] <... ioctl resumed>, ifr_ifindex=12}) = 0 [pid 3626] <... socket resumed>) = 4 [pid 3625] <... ioctl resumed>, ifr_flags=IFF_BROADCAST|IFF_MULTICAST}) = 0 [pid 3623] close(4 [pid 3621] close(4 [pid 3626] ioctl(4, SIOCGIFINDEX, {ifr_name="wlan0" [pid 3625] ioctl(4, SIOCSIFFLAGS, {ifr_name="wlan1", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_MULTICAST} [pid 3623] <... close resumed>) = 0 [pid 3621] <... close resumed>) = 0 [pid 3626] <... ioctl resumed>, ifr_ifindex=11}) = 0 [pid 3623] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE [pid 3626] close(4 [pid 3623] <... socket resumed>) = 4 [pid 3621] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE [pid 3626] <... close resumed>) = 0 [pid 3623] sendto(4, [{nlmsg_len=32, nlmsg_type=0x12 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3621] <... socket resumed>) = 4 [pid 3621] sendto(4, [{nlmsg_len=32, nlmsg_type=0x12 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3624] <... ioctl resumed>) = 0 [pid 3621] <... sendto resumed>) = 32 [pid 3624] close(4 [pid 3621] recvfrom(4, [pid 3626] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE [pid 3625] <... ioctl resumed>) = 0 [pid 3624] <... close resumed>) = 0 [pid 3623] <... sendto resumed>) = 32 [ 49.334914][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [pid 3621] <... recvfrom resumed>[{nlmsg_len=1404, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, "\x00\x00\x01\x00\x0c\x00\x00\x00\x43\x10\x01\x00\x00\x00\x00\x00\x0a\x00\x03\x00\x77\x6c\x61\x6e\x31\x00\x00\x00\x08\x00\x0d\x00\xe8\x03\x00\x00\x05\x00\x10\x00\x06\x00\x00\x00\x05\x00\x11\x00\x00\x00\x00\x00\x08\x00\x04\x00\xdc\x05\x00\x00\x08\x00\x32\x00\x00\x01\x00\x00\x08\x00\x33\x00\x00\x09\x00\x00\x08\x00\x1b\x00\x00\x00\x00\x00\x08\x00\x1e\x00\x00\x00\x00\x00\x08\x00\x1f\x00\x04\x00\x00\x00"...], 4096, 0, NULL, NULL) = 1404 [pid 3626] <... socket resumed>) = 4 [pid 3625] close(4 [pid 3624] sendto(3, [{nlmsg_len=64, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x2b\x00\x00\x00\x08\x00\x03\x00\x0b\x00\x00\x00\x0a\x00\x34\x00\x10\x10\x10\x10\x10\x10\x00\x00\x08\x00\x26\x00\x6c\x09\x00\x00\x0a\x00\x06\x00\x50\x50\x50\x50\x50\x50\x00\x00\x04\x00\x3c\x00"], 64, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3623] recvfrom(4, [pid 3621] close(4 [pid 3626] sendto(4, [{nlmsg_len=32, nlmsg_type=0x12 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3625] <... close resumed>) = 0 [pid 3623] <... recvfrom resumed>[{nlmsg_len=1404, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, "\x00\x00\x01\x00\x0c\x00\x00\x00\x43\x10\x00\x00\x00\x00\x00\x00\x0a\x00\x03\x00\x77\x6c\x61\x6e\x31\x00\x00\x00\x08\x00\x0d\x00\xe8\x03\x00\x00\x05\x00\x10\x00\x00\x00\x00\x00\x05\x00\x11\x00\x00\x00\x00\x00\x08\x00\x04\x00\xdc\x05\x00\x00\x08\x00\x32\x00\x00\x01\x00\x00\x08\x00\x33\x00\x00\x09\x00\x00\x08\x00\x1b\x00\x00\x00\x00\x00\x08\x00\x1e\x00\x00\x00\x00\x00\x08\x00\x1f\x00\x04\x00\x00\x00"...], 4096, 0, NULL, NULL) = 1404 [pid 3621] <... close resumed>) = 0 [pid 3625] sendto(3, [{nlmsg_len=64, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x2b\x00\x00\x00\x08\x00\x03\x00\x0c\x00\x00\x00\x0a\x00\x34\x00\x10\x10\x10\x10\x10\x10\x00\x00\x08\x00\x26\x00\x6c\x09\x00\x00\x0a\x00\x06\x00\x50\x50\x50\x50\x50\x50\x00\x00\x04\x00\x3c\x00"], 64, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3623] close(4 [pid 3621] close(3 [pid 3623] <... close resumed>) = 0 [pid 3621] <... close resumed>) = 0 [pid 3621] mkdir("/dev/binderfs", 0777) = 0 [pid 3621] mount("binder", "/dev/binderfs", "binder", 0, NULL) = 0 [pid 3623] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE [pid 3621] getpid( [pid 3623] <... socket resumed>) = 4 [pid 3621] <... getpid resumed>) = 1 [pid 3623] sendto(4, [{nlmsg_len=32, nlmsg_type=0x12 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3621] mkdir("/syzcgroup/unified/syz0", 0777) = 0 [pid 3621] openat(AT_FDCWD, "/syzcgroup/unified/syz0/pids.max", O_WRONLY|O_CLOEXEC) = 3 [pid 3621] write(3, "32", 2) = 2 [pid 3621] close(3) = 0 [pid 3621] openat(AT_FDCWD, "/syzcgroup/unified/syz0/memory.low", O_WRONLY|O_CLOEXEC) = 3 [pid 3621] write(3, "312475648", 9) = 9 [pid 3621] close(3) = 0 [pid 3621] openat(AT_FDCWD, "/syzcgroup/unified/syz0/memory.high", O_WRONLY|O_CLOEXEC) = 3 [pid 3621] write(3, "313524224", 9) = 9 [pid 3621] close(3) = 0 [pid 3621] openat(AT_FDCWD, "/syzcgroup/unified/syz0/memory.max", O_WRONLY|O_CLOEXEC) = 3 [pid 3621] write(3, "314572800", 9) = 9 [pid 3621] close(3) = 0 [pid 3621] openat(AT_FDCWD, "/syzcgroup/unified/syz0/cgroup.procs", O_WRONLY|O_CLOEXEC) = 3 [pid 3621] write(3, "1", 1) = 1 [pid 3621] close(3) = 0 [ 49.371616][ T6] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 49.384953][ T6] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [pid 3621] mkdir("/syzcgroup/cpu/syz0", 0777 [pid 3626] <... sendto resumed>) = 32 [pid 3625] <... sendto resumed>) = 64 [pid 3624] <... sendto resumed>) = 64 [pid 3623] <... sendto resumed>) = 32 [pid 3622] <... sendto resumed>) = 36 [pid 3626] recvfrom(4, [pid 3625] recvfrom(3, [pid 3623] recvfrom(4, [pid 3626] <... recvfrom resumed>[{nlmsg_len=1404, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, "\x00\x00\x01\x00\x0b\x00\x00\x00\x43\x10\x01\x00\x00\x00\x00\x00\x0a\x00\x03\x00\x77\x6c\x61\x6e\x30\x00\x00\x00\x08\x00\x0d\x00\xe8\x03\x00\x00\x05\x00\x10\x00\x06\x00\x00\x00\x05\x00\x11\x00\x00\x00\x00\x00\x08\x00\x04\x00\xdc\x05\x00\x00\x08\x00\x32\x00\x00\x01\x00\x00\x08\x00\x33\x00\x00\x09\x00\x00\x08\x00\x1b\x00\x00\x00\x00\x00\x08\x00\x1e\x00\x00\x00\x00\x00\x08\x00\x1f\x00\x04\x00\x00\x00"...], 4096, 0, NULL, NULL) = 1404 [pid 3625] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=64, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 3623] <... recvfrom resumed>[{nlmsg_len=1404, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, "\x00\x00\x01\x00\x0c\x00\x00\x00\x43\x10\x01\x00\x00\x00\x00\x00\x0a\x00\x03\x00\x77\x6c\x61\x6e\x31\x00\x00\x00\x08\x00\x0d\x00\xe8\x03\x00\x00\x05\x00\x10\x00\x06\x00\x00\x00\x05\x00\x11\x00\x00\x00\x00\x00\x08\x00\x04\x00\xdc\x05\x00\x00\x08\x00\x32\x00\x00\x01\x00\x00\x08\x00\x33\x00\x00\x09\x00\x00\x08\x00\x1b\x00\x00\x00\x00\x00\x08\x00\x1e\x00\x00\x00\x00\x00\x08\x00\x1f\x00\x04\x00\x00\x00"...], 4096, 0, NULL, NULL) = 1404 [pid 3626] close(4 [pid 3625] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 3623] close(4 [pid 3626] <... close resumed>) = 0 [pid 3625] <... socket resumed>) = 4 [pid 3623] <... close resumed>) = 0 [pid 3626] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 3625] ioctl(4, SIOCGIFINDEX, {ifr_name="wlan0" [pid 3623] close(3 [pid 3626] <... socket resumed>) = 4 [pid 3625] <... ioctl resumed>, ifr_ifindex=11}) = 0 [pid 3624] recvfrom(3, [pid 3623] <... close resumed>) = 0 [pid 3626] ioctl(4, SIOCGIFINDEX, {ifr_name="wlan1" [pid 3625] close(4 [pid 3623] mkdir("/dev/binderfs", 0777 [pid 3626] <... ioctl resumed>, ifr_ifindex=12}) = 0 [pid 3625] <... close resumed>) = 0 [pid 3623] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 3626] close(4 [pid 3623] mount("binder", "/dev/binderfs", "binder", 0, NULL [pid 3626] <... close resumed>) = 0 [pid 3623] <... mount resumed>) = 0 [pid 3625] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE [pid 3623] getpid( [pid 3625] <... socket resumed>) = 4 [pid 3623] <... getpid resumed>) = 1 [pid 3625] sendto(4, [{nlmsg_len=32, nlmsg_type=0x12 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3623] mkdir("/syzcgroup/unified/syz4", 0777 [pid 3625] <... sendto resumed>) = 32 [pid 3626] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE [pid 3625] recvfrom(4, [pid 3624] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=64, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 3622] recvfrom(3, [pid 3626] <... socket resumed>) = 4 [pid 3625] <... recvfrom resumed>[{nlmsg_len=1404, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, "\x00\x00\x01\x00\x0b\x00\x00\x00\x43\x10\x01\x00\x00\x00\x00\x00\x0a\x00\x03\x00\x77\x6c\x61\x6e\x30\x00\x00\x00\x08\x00\x0d\x00\xe8\x03\x00\x00\x05\x00\x10\x00\x06\x00\x00\x00\x05\x00\x11\x00\x00\x00\x00\x00\x08\x00\x04\x00\xdc\x05\x00\x00\x08\x00\x32\x00\x00\x01\x00\x00\x08\x00\x33\x00\x00\x09\x00\x00\x08\x00\x1b\x00\x00\x00\x00\x00\x08\x00\x1e\x00\x00\x00\x00\x00\x08\x00\x1f\x00\x04\x00\x00\x00"...], 4096, 0, NULL, NULL) = 1404 [pid 3624] sendto(3, [{nlmsg_len=36, nlmsg_type=0x29 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x04\x00\x00\x00\x04\x00\x0e\x00\x0a\x00\x16\x00\x08\x02\x11\x00\x00\x01\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3623] <... mkdir resumed>) = 0 [pid 3622] <... recvfrom resumed>[{nlmsg_len=56, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=12, msg=[{nlmsg_len=36, nlmsg_type=0x29 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x04\x00\x00\x00\x04\x00\x0e\x00\x0a\x00\x16\x00\x08\x02\x11\x00\x00\x01\x00\x00"]}], 4096, 0, NULL, NULL) = 56 [pid 3621] <... mkdir resumed>) = 0 [pid 3626] sendto(4, [{nlmsg_len=32, nlmsg_type=0x12 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3625] close(4 [pid 3623] openat(AT_FDCWD, "/syzcgroup/unified/syz4/pids.max", O_WRONLY|O_CLOEXEC [pid 3625] <... close resumed>) = 0 [pid 3623] <... openat resumed>) = 3 [pid 3622] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 3621] openat(AT_FDCWD, "/syzcgroup/cpu/syz0/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 3625] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 3623] write(3, "32", 2 [pid 3622] <... socket resumed>) = 4 [ 49.427640][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.435566][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.443317][ T46] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.455933][ T46] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.466850][ T3629] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [pid 3625] <... socket resumed>) = 4 [pid 3623] <... write resumed>) = 2 [pid 3621] <... openat resumed>) = 3 [pid 3625] ioctl(4, SIOCGIFINDEX, {ifr_name="wlan1" [pid 3623] close(3 [pid 3625] <... ioctl resumed>, ifr_ifindex=12}) = 0 [pid 3623] <... close resumed>) = 0 [pid 3625] close(4 [pid 3623] openat(AT_FDCWD, "/syzcgroup/unified/syz4/memory.low", O_WRONLY|O_CLOEXEC [pid 3625] <... close resumed>) = 0 [pid 3623] <... openat resumed>) = 3 [pid 3623] write(3, "312475648", 9) = 9 [pid 3623] close(3) = 0 [pid 3623] openat(AT_FDCWD, "/syzcgroup/unified/syz4/memory.high", O_WRONLY|O_CLOEXEC [pid 3625] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE [pid 3623] <... openat resumed>) = 3 [pid 3625] <... socket resumed>) = 4 [pid 3623] write(3, "313524224", 9 [pid 3625] sendto(4, [{nlmsg_len=32, nlmsg_type=0x12 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3623] <... write resumed>) = 9 [pid 3622] ioctl(4, SIOCGIFINDEX, {ifr_name="wlan1" [pid 3621] write(3, "1", 1 [pid 3626] <... sendto resumed>) = 32 [pid 3623] close(3 [pid 3626] recvfrom(4, [pid 3623] <... close resumed>) = 0 [pid 3626] <... recvfrom resumed>[{nlmsg_len=1404, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, "\x00\x00\x01\x00\x0c\x00\x00\x00\x43\x10\x01\x00\x00\x00\x00\x00\x0a\x00\x03\x00\x77\x6c\x61\x6e\x31\x00\x00\x00\x08\x00\x0d\x00\xe8\x03\x00\x00\x05\x00\x10\x00\x06\x00\x00\x00\x05\x00\x11\x00\x00\x00\x00\x00\x08\x00\x04\x00\xdc\x05\x00\x00\x08\x00\x32\x00\x00\x01\x00\x00\x08\x00\x33\x00\x00\x09\x00\x00\x08\x00\x1b\x00\x00\x00\x00\x00\x08\x00\x1e\x00\x00\x00\x00\x00\x08\x00\x1f\x00\x04\x00\x00\x00"...], 4096, 0, NULL, NULL) = 1404 [pid 3623] openat(AT_FDCWD, "/syzcgroup/unified/syz4/memory.max", O_WRONLY|O_CLOEXEC [pid 3626] close(4 [pid 3623] <... openat resumed>) = 3 [pid 3622] <... ioctl resumed>, ifr_ifindex=12}) = 0 [pid 3626] <... close resumed>) = 0 [pid 3623] write(3, "314572800", 9 [pid 3621] <... write resumed>) = 1 [pid 3626] close(3 [pid 3623] <... write resumed>) = 9 [pid 3622] close(4 [pid 3626] <... close resumed>) = 0 [pid 3623] close(3 [pid 3626] mkdir("/dev/binderfs", 0777 [pid 3623] <... close resumed>) = 0 [pid 3622] <... close resumed>) = 0 [pid 3621] close(3 [pid 3626] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 3623] openat(AT_FDCWD, "/syzcgroup/unified/syz4/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 3622] sendto(3, [{nlmsg_len=36, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x06\x00\x00\x00\x08\x00\x03\x00\x0c\x00\x00\x00\x08\x00\x05\x00\x01\x00\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3626] mount("binder", "/dev/binderfs", "binder", 0, NULL [pid 3623] <... openat resumed>) = 3 [pid 3621] <... close resumed>) = 0 [pid 3626] <... mount resumed>) = 0 [pid 3623] write(3, "1", 1 [pid 3626] getpid( [pid 3623] <... write resumed>) = 1 [pid 3621] mkdir("/syzcgroup/net/syz0", 0777 [pid 3626] <... getpid resumed>) = 1 [pid 3623] close(3 [pid 3626] mkdir("/syzcgroup/unified/syz5", 0777 [pid 3623] <... close resumed>) = 0 [pid 3623] mkdir("/syzcgroup/cpu/syz4", 0777 [pid 3625] <... sendto resumed>) = 32 [pid 3625] recvfrom(4, [{nlmsg_len=1404, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, "\x00\x00\x01\x00\x0c\x00\x00\x00\x43\x10\x01\x00\x00\x00\x00\x00\x0a\x00\x03\x00\x77\x6c\x61\x6e\x31\x00\x00\x00\x08\x00\x0d\x00\xe8\x03\x00\x00\x05\x00\x10\x00\x06\x00\x00\x00\x05\x00\x11\x00\x00\x00\x00\x00\x08\x00\x04\x00\xdc\x05\x00\x00\x08\x00\x32\x00\x00\x01\x00\x00\x08\x00\x33\x00\x00\x09\x00\x00\x08\x00\x1b\x00\x00\x00\x00\x00\x08\x00\x1e\x00\x00\x00\x00\x00\x08\x00\x1f\x00\x04\x00\x00\x00"...], 4096, 0, NULL, NULL) = 1404 [pid 3625] close(4) = 0 [pid 3625] close(3) = 0 [pid 3625] mkdir("/dev/binderfs", 0777) = -1 EEXIST (File exists) [pid 3622] <... sendto resumed>) = 36 [pid 3624] <... sendto resumed>) = 36 [pid 3622] recvfrom(3, [pid 3621] <... mkdir resumed>) = 0 [pid 3626] <... mkdir resumed>) = 0 [pid 3624] recvfrom(3, [pid 3622] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=36, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 3621] openat(AT_FDCWD, "/syzcgroup/net/syz0/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 3626] openat(AT_FDCWD, "/syzcgroup/unified/syz5/pids.max", O_WRONLY|O_CLOEXEC [pid 3625] mount("binder", "/dev/binderfs", "binder", 0, NULL [pid 3624] <... recvfrom resumed>[{nlmsg_len=56, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=13, msg=[{nlmsg_len=36, nlmsg_type=0x29 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x04\x00\x00\x00\x04\x00\x0e\x00\x0a\x00\x16\x00\x08\x02\x11\x00\x00\x01\x00\x00"]}], 4096, 0, NULL, NULL) = 56 [pid 3623] <... mkdir resumed>) = 0 [pid 3622] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP [pid 3621] <... openat resumed>) = 3 [pid 3626] <... openat resumed>) = 3 [pid 3625] <... mount resumed>) = 0 [pid 3624] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 3623] openat(AT_FDCWD, "/syzcgroup/cpu/syz4/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 3622] <... socket resumed>) = 4 [pid 3621] write(3, "1", 1 [pid 3626] write(3, "32", 2 [pid 3625] getpid( [pid 3624] <... socket resumed>) = 4 [pid 3623] <... openat resumed>) = 3 [pid 3622] ioctl(4, SIOCGIFFLAGS, {ifr_name="wlan1" [pid 3621] <... write resumed>) = 1 [pid 3626] <... write resumed>) = 2 [pid 3625] <... getpid resumed>) = 1 [pid 3624] ioctl(4, SIOCGIFINDEX, {ifr_name="wlan1" [pid 3623] write(3, "1", 1 [pid 3622] <... ioctl resumed>, ifr_flags=IFF_BROADCAST|IFF_MULTICAST}) = 0 [pid 3621] close(3 [pid 3626] close(3 [pid 3625] mkdir("/syzcgroup/unified/syz3", 0777 [pid 3624] <... ioctl resumed>, ifr_ifindex=12}) = 0 [pid 3623] <... write resumed>) = 1 [pid 3622] ioctl(4, SIOCSIFFLAGS, {ifr_name="wlan1", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_MULTICAST} [pid 3621] <... close resumed>) = 0 [pid 3626] <... close resumed>) = 0 [pid 3625] <... mkdir resumed>) = 0 [pid 3624] close(4 [pid 3623] close(3 [pid 3622] <... ioctl resumed>) = 0 [pid 3621] mkdir("./0", 0777 [pid 3626] openat(AT_FDCWD, "/syzcgroup/unified/syz5/memory.low", O_WRONLY|O_CLOEXEC [pid 3625] openat(AT_FDCWD, "/syzcgroup/unified/syz3/pids.max", O_WRONLY|O_CLOEXEC [pid 3624] <... close resumed>) = 0 [pid 3623] <... close resumed>) = 0 [pid 3622] close(4 [pid 3621] <... mkdir resumed>) = 0 [ 49.478320][ T3629] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [pid 3626] <... openat resumed>) = 3 [pid 3625] <... openat resumed>) = 3 [pid 3624] sendto(3, [{nlmsg_len=36, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x06\x00\x00\x00\x08\x00\x03\x00\x0c\x00\x00\x00\x08\x00\x05\x00\x01\x00\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3623] mkdir("/syzcgroup/net/syz4", 0777 [pid 3622] <... close resumed>) = 0 [pid 3621] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 3626] write(3, "312475648", 9 [pid 3625] write(3, "32", 2 [pid 3622] sendto(3, [{nlmsg_len=64, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x2b\x00\x00\x00\x08\x00\x03\x00\x0c\x00\x00\x00\x0a\x00\x34\x00\x10\x10\x10\x10\x10\x10\x00\x00\x08\x00\x26\x00\x6c\x09\x00\x00\x0a\x00\x06\x00\x50\x50\x50\x50\x50\x50\x00\x00\x04\x00\x3c\x00"], 64, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12./strace-static-x86_64: Process 3630 attached [pid 3626] <... write resumed>) = 9 [pid 3625] <... write resumed>) = 2 [pid 3624] <... sendto resumed>) = 36 [pid 3623] <... mkdir resumed>) = 0 [pid 3622] <... sendto resumed>) = 64 [pid 3621] <... clone resumed>, child_tidptr=0x555555d515d0) = 2 [pid 3622] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=64, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 3622] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4 [pid 3622] ioctl(4, SIOCGIFINDEX, {ifr_name="wlan0", ifr_ifindex=11}) = 0 [pid 3630] chdir("./0" [pid 3626] close(3 [pid 3622] close(4 [pid 3625] close(3 [pid 3624] recvfrom(3, [pid 3623] openat(AT_FDCWD, "/syzcgroup/net/syz4/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 3622] <... close resumed>) = 0 [pid 3630] <... chdir resumed>) = 0 [pid 3630] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 3622] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE [pid 3630] <... prctl resumed>) = 0 [pid 3622] <... socket resumed>) = 4 [pid 3630] setpgid(0, 0 [pid 3622] sendto(4, [{nlmsg_len=32, nlmsg_type=0x12 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3630] <... setpgid resumed>) = 0 [pid 3626] <... close resumed>) = 0 [pid 3625] <... close resumed>) = 0 [pid 3624] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=36, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 3623] <... openat resumed>) = 3 [pid 3622] <... sendto resumed>) = 32 [pid 3630] symlink("/syzcgroup/unified/syz0", "./cgroup" [pid 3622] recvfrom(4, [pid 3630] <... symlink resumed>) = 0 [pid 3622] <... recvfrom resumed>[{nlmsg_len=1404, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, "\x00\x00\x01\x00\x0b\x00\x00\x00\x43\x10\x01\x00\x00\x00\x00\x00\x0a\x00\x03\x00\x77\x6c\x61\x6e\x30\x00\x00\x00\x08\x00\x0d\x00\xe8\x03\x00\x00\x05\x00\x10\x00\x06\x00\x00\x00\x05\x00\x11\x00\x00\x00\x00\x00\x08\x00\x04\x00\xdc\x05\x00\x00\x08\x00\x32\x00\x00\x01\x00\x00\x08\x00\x33\x00\x00\x09\x00\x00\x08\x00\x1b\x00\x00\x00\x00\x00\x08\x00\x1e\x00\x00\x00\x00\x00\x08\x00\x1f\x00\x04\x00\x00\x00"...], 4096, 0, NULL, NULL) = 1404 [pid 3630] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu" [pid 3626] openat(AT_FDCWD, "/syzcgroup/unified/syz5/memory.high", O_WRONLY|O_CLOEXEC [pid 3625] openat(AT_FDCWD, "/syzcgroup/unified/syz3/memory.low", O_WRONLY|O_CLOEXEC [pid 3624] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP [pid 3623] write(3, "1", 1 [pid 3622] close(4 [pid 3630] <... symlink resumed>) = 0 [pid 3626] <... openat resumed>) = 3 [pid 3625] <... openat resumed>) = 3 [pid 3624] <... socket resumed>) = 4 [pid 3623] <... write resumed>) = 1 [pid 3622] <... close resumed>) = 0 [pid 3630] symlink("/syzcgroup/net/syz0", "./cgroup.net" [pid 3626] write(3, "313524224", 9 [pid 3625] write(3, "312475648", 9 [pid 3624] ioctl(4, SIOCGIFFLAGS, {ifr_name="wlan1" [pid 3623] close(3 [pid 3622] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 3630] <... symlink resumed>) = 0 [pid 3626] <... write resumed>) = 9 [pid 3625] <... write resumed>) = 9 [pid 3624] <... ioctl resumed>, ifr_flags=IFF_BROADCAST|IFF_MULTICAST}) = 0 [pid 3623] <... close resumed>) = 0 [pid 3622] <... socket resumed>) = 4 [pid 3630] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 3626] close(3 [pid 3625] close(3 [pid 3624] ioctl(4, SIOCSIFFLAGS, {ifr_name="wlan1", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_MULTICAST} [pid 3623] mkdir("./0", 0777 [pid 3622] ioctl(4, SIOCGIFINDEX, {ifr_name="wlan1" [pid 3630] <... openat resumed>) = 3 [pid 3626] <... close resumed>) = 0 [pid 3625] <... close resumed>) = 0 [pid 3622] <... ioctl resumed>, ifr_ifindex=12}) = 0 [pid 3630] write(3, "1000", 4 [pid 3626] openat(AT_FDCWD, "/syzcgroup/unified/syz5/memory.max", O_WRONLY|O_CLOEXEC [pid 3625] openat(AT_FDCWD, "/syzcgroup/unified/syz3/memory.high", O_WRONLY|O_CLOEXEC [pid 3624] <... ioctl resumed>) = 0 [pid 3623] <... mkdir resumed>) = 0 [pid 3622] close(4 [pid 3630] <... write resumed>) = 4 [pid 3626] <... openat resumed>) = 3 [pid 3625] <... openat resumed>) = 3 [pid 3624] close(4 [pid 3623] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 3622] <... close resumed>) = 0 [pid 3630] close(3 [pid 3626] write(3, "314572800", 9 [pid 3625] write(3, "313524224", 9 [pid 3624] <... close resumed>) = 0 ./strace-static-x86_64: Process 3631 attached [pid 3630] <... close resumed>) = 0 [pid 3626] <... write resumed>) = 9 [ 49.544876][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.553469][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.563550][ T145] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [pid 3625] <... write resumed>) = 9 [pid 3624] sendto(3, [{nlmsg_len=64, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x2b\x00\x00\x00\x08\x00\x03\x00\x0c\x00\x00\x00\x0a\x00\x34\x00\x10\x10\x10\x10\x10\x10\x00\x00\x08\x00\x26\x00\x6c\x09\x00\x00\x0a\x00\x06\x00\x50\x50\x50\x50\x50\x50\x00\x00\x04\x00\x3c\x00"], 64, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3631] chdir("./0" [pid 3630] symlink("/dev/binderfs", "./binderfs" [pid 3626] close(3 [pid 3625] close(3 [pid 3630] <... symlink resumed>) = 0 [pid 3622] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE [pid 3630] mkdir("./file0", 000 [pid 3622] <... socket resumed>) = 4 [pid 3630] <... mkdir resumed>) = 0 [pid 3626] <... close resumed>) = 0 [pid 3625] <... close resumed>) = 0 [pid 3624] <... sendto resumed>) = 64 [pid 3622] sendto(4, [{nlmsg_len=32, nlmsg_type=0x12 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3631] <... chdir resumed>) = 0 [pid 3630] open("./file0", O_RDONLY [pid 3626] openat(AT_FDCWD, "/syzcgroup/unified/syz5/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 3625] openat(AT_FDCWD, "/syzcgroup/unified/syz3/memory.max", O_WRONLY|O_CLOEXEC [pid 3624] recvfrom(3, [pid 3623] <... clone resumed>, child_tidptr=0x555555d515d0) = 2 [pid 3622] <... sendto resumed>) = 32 [pid 3630] <... open resumed>) = 3 [pid 3622] recvfrom(4, [pid 3630] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 3622] <... recvfrom resumed>[{nlmsg_len=1404, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, "\x00\x00\x01\x00\x0c\x00\x00\x00\x43\x10\x01\x00\x00\x00\x00\x00\x0a\x00\x03\x00\x77\x6c\x61\x6e\x31\x00\x00\x00\x08\x00\x0d\x00\xe8\x03\x00\x00\x05\x00\x10\x00\x06\x00\x00\x00\x05\x00\x11\x00\x00\x00\x00\x00\x08\x00\x04\x00\xdc\x05\x00\x00\x08\x00\x32\x00\x00\x01\x00\x00\x08\x00\x33\x00\x00\x09\x00\x00\x08\x00\x1b\x00\x00\x00\x00\x00\x08\x00\x1e\x00\x00\x00\x00\x00\x08\x00\x1f\x00\x04\x00\x00\x00"...], 4096, 0, NULL, NULL) = 1404 [pid 3630] <... mount resumed>) = 0 [pid 3622] close(4 [pid 3630] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 3622] <... close resumed>) = 0 [pid 3630] <... openat resumed>) = 4 [pid 3622] close(3 [pid 3630] openat(4, "syz0", O_RDWR|O_PATH [pid 3622] <... close resumed>) = 0 [pid 3630] <... openat resumed>) = 5 [pid 3622] mkdir("/dev/binderfs", 0777 [pid 3630] openat(5, "memory.max", O_RDWR [pid 3622] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 3630] <... openat resumed>) = 6 [pid 3622] mount("binder", "/dev/binderfs", "binder", 0, NULL [pid 3630] sendfile(6, 6, NULL, 2 [pid 3622] <... mount resumed>) = 0 [pid 3626] <... openat resumed>) = 3 [pid 3631] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 3625] <... openat resumed>) = 3 [pid 3624] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=64, nlmsg_type=0x22 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 3622] getpid() = 1 [pid 3622] mkdir("/syzcgroup/unified/syz1", 0777) = 0 [pid 3622] openat(AT_FDCWD, "/syzcgroup/unified/syz1/pids.max", O_WRONLY|O_CLOEXEC) = 3 [pid 3622] write(3, "32", 2) = 2 [pid 3622] close(3) = 0 [pid 3622] openat(AT_FDCWD, "/syzcgroup/unified/syz1/memory.low", O_WRONLY|O_CLOEXEC) = 3 [pid 3622] write(3, "312475648", 9) = 9 [pid 3622] close(3) = 0 [pid 3622] openat(AT_FDCWD, "/syzcgroup/unified/syz1/memory.high", O_WRONLY|O_CLOEXEC) = 3 [pid 3631] <... prctl resumed>) = 0 [pid 3626] write(3, "1", 1 [pid 3625] write(3, "314572800", 9 [pid 3624] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 [pid 3622] write(3, "313524224", 9) = 9 [pid 3622] close(3 [pid 3631] setpgid(0, 0 [pid 3622] <... close resumed>) = 0 [pid 3631] <... setpgid resumed>) = 0 [pid 3626] <... write resumed>) = 1 [pid 3625] <... write resumed>) = 9 [pid 3622] openat(AT_FDCWD, "/syzcgroup/unified/syz1/memory.max", O_WRONLY|O_CLOEXEC [pid 3631] symlink("/syzcgroup/unified/syz4", "./cgroup" [pid 3626] close(3 [pid 3625] close(3 [pid 3624] <... socket resumed>) = 4 [pid 3622] <... openat resumed>) = 3 [pid 3622] write(3, "314572800", 9 [pid 3626] <... close resumed>) = 0 [pid 3625] <... close resumed>) = 0 [pid 3622] <... write resumed>) = 9 [pid 3622] close(3) = 0 [pid 3631] <... symlink resumed>) = 0 [pid 3626] mkdir("/syzcgroup/cpu/syz5", 0777 [pid 3625] openat(AT_FDCWD, "/syzcgroup/unified/syz3/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 3622] openat(AT_FDCWD, "/syzcgroup/unified/syz1/cgroup.procs", O_WRONLY|O_CLOEXEC) = 3 [pid 3622] write(3, "1", 1 [pid 3625] <... openat resumed>) = 3 [pid 3631] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu" [ 49.598991][ T46] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.608724][ T46] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.617528][ T145] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 49.624925][ T3630] syz-executor417 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 3625] write(3, "1", 1 [pid 3631] <... symlink resumed>) = 0 [pid 3624] ioctl(4, SIOCGIFINDEX, {ifr_name="wlan0" [pid 3631] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [pid 3631] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3631] write(3, "1000", 4) = 4 [pid 3631] close(3) = 0 [pid 3631] symlink("/dev/binderfs", "./binderfs") = 0 [pid 3631] mkdir("./file0", 000 [pid 3624] <... ioctl resumed>, ifr_ifindex=11}) = 0 [pid 3631] <... mkdir resumed>) = 0 [pid 3624] close(4) = 0 [pid 3631] open("./file0", O_RDONLY) = 3 [pid 3624] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 3624] sendto(4, [{nlmsg_len=32, nlmsg_type=0x12 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 [pid 3631] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 3624] <... sendto resumed>) = 32 [pid 3624] recvfrom(4, [{nlmsg_len=1404, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, "\x00\x00\x01\x00\x0b\x00\x00\x00\x43\x10\x01\x00\x00\x00\x00\x00\x0a\x00\x03\x00\x77\x6c\x61\x6e\x30\x00\x00\x00\x08\x00\x0d\x00\xe8\x03\x00\x00\x05\x00\x10\x00\x06\x00\x00\x00\x05\x00\x11\x00\x00\x00\x00\x00\x08\x00\x04\x00\xdc\x05\x00\x00\x08\x00\x32\x00\x00\x01\x00\x00\x08\x00\x33\x00\x00\x09\x00\x00\x08\x00\x1b\x00\x00\x00\x00\x00\x08\x00\x1e\x00\x00\x00\x00\x00\x08\x00\x1f\x00\x04\x00\x00\x00"...], 4096, 0, NULL, NULL) = 1404 [pid 3624] close(4) = 0 [pid 3624] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4 [pid 3624] ioctl(4, SIOCGIFINDEX, {ifr_name="wlan1", ifr_ifindex=12}) = 0 [pid 3624] close(4) = 0 [pid 3624] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 3624] sendto(4, [{nlmsg_len=32, nlmsg_type=0x12 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 3624] recvfrom(4, [{nlmsg_len=1404, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, "\x00\x00\x01\x00\x0c\x00\x00\x00\x43\x10\x01\x00\x00\x00\x00\x00\x0a\x00\x03\x00\x77\x6c\x61\x6e\x31\x00\x00\x00\x08\x00\x0d\x00\xe8\x03\x00\x00\x05\x00\x10\x00\x06\x00\x00\x00\x05\x00\x11\x00\x00\x00\x00\x00\x08\x00\x04\x00\xdc\x05\x00\x00\x08\x00\x32\x00\x00\x01\x00\x00\x08\x00\x33\x00\x00\x09\x00\x00\x08\x00\x1b\x00\x00\x00\x00\x00\x08\x00\x1e\x00\x00\x00\x00\x00\x08\x00\x1f\x00\x04\x00\x00\x00"...], 4096, 0, NULL, NULL) = 1404 [pid 3624] close(4) = 0 [ 49.644341][ T3630] CPU: 0 PID: 3630 Comm: syz-executor417 Not tainted 5.19.0-rc7-syzkaller-00007-g353f7988dd84 #0 [ 49.654874][ T3630] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 [ 49.664931][ T3630] Call Trace: [ 49.668226][ T3630] [ 49.671175][ T3630] dump_stack_lvl+0x1e3/0x2cb [ 49.675906][ T3630] ? bfq_pos_tree_add_move+0x436/0x436 [ 49.681394][ T3630] ? panic+0x76e/0x76e [ 49.685485][ T3630] ? do_raw_spin_lock+0x148/0x360 [ 49.690538][ T3630] ? local_lock_release+0x170/0x170 [pid 3624] close(3) = 0 [pid 3624] mkdir("/dev/binderfs", 0777) = -1 EEXIST (File exists) [pid 3624] mount("binder", "/dev/binderfs", "binder", 0, NULL) = 0 [pid 3624] getpid() = 1 [ 49.695766][ T3630] dump_header+0xdb/0x970 [ 49.700124][ T3630] oom_kill_process+0x1ec/0x660 [ 49.704986][ T3630] out_of_memory+0x876/0xb30 [ 49.709583][ T3630] ? unregister_oom_notifier+0x20/0x20 [ 49.715060][ T3630] ? lockdep_hardirqs_on_prepare+0x448/0x7b0 [ 49.721053][ T3630] mem_cgroup_out_of_memory+0x25d/0x3b0 [ 49.726657][ T3630] ? preempt_schedule_thunk+0x16/0x18 [ 49.732051][ T3630] ? mem_cgroup_oom_trylock+0x220/0x220 [ 49.737617][ T3630] ? cgroup_file_notify+0x123/0x190 [ 49.742825][ T3630] memory_max_write+0x364/0x4f0 [ 49.747687][ T3630] ? memory_max_show+0xa0/0xa0 [ 49.752468][ T3630] ? read_lock_is_recursive+0x10/0x10 [ 49.757844][ T3630] ? memory_max_show+0xa0/0xa0 [ 49.762625][ T3630] cgroup_file_write+0x2ab/0x780 [ 49.767576][ T3630] ? cgroup_seqfile_stop+0xd0/0xd0 [ 49.772688][ T3630] ? check_heap_object+0x23e/0x820 [ 49.777811][ T3630] ? cgroup_seqfile_stop+0xd0/0xd0 [ 49.782923][ T3630] kernfs_fop_write_iter+0x3ac/0x500 [ 49.788215][ T3630] do_iter_readv_writev+0x499/0x650 [ 49.793427][ T3630] ? generic_file_rw_checks+0x250/0x250 [ 49.798981][ T3630] ? bpf_lsm_file_permission+0x5/0x10 [ 49.804353][ T3630] ? security_file_permission+0xe0/0x5c0 [ 49.809978][ T3630] ? do_iter_write+0x147/0x7a0 [ 49.814742][ T3630] do_iter_write+0x1f1/0x7a0 [ 49.819335][ T3630] ? vfs_iter_write+0x69/0xa0 [ 49.824030][ T3630] iter_file_splice_write+0x830/0xff0 [ 49.829440][ T3630] ? splice_from_pipe+0x220/0x220 [ 49.834458][ T3630] ? generic_file_splice_read+0x46b/0x660 [ 49.840180][ T3630] ? splice_shrink_spd+0xb0/0xb0 [ 49.845121][ T3630] ? splice_from_pipe+0x220/0x220 [ 49.850144][ T3630] direct_splice_actor+0xe6/0x1c0 [ 49.855168][ T3630] splice_direct_to_actor+0x514/0xc20 [ 49.860551][ T3630] ? __lock_acquire+0x129a/0x1f80 [ 49.865580][ T3630] ? do_splice_direct+0x3f0/0x3f0 [ 49.870601][ T3630] ? pipe_to_sendpage+0x340/0x340 [ 49.875623][ T3630] ? bpf_lsm_file_permission+0x5/0x10 [ 49.880990][ T3630] ? security_file_permission+0xe0/0x5c0 [ 49.886638][ T3630] do_splice_direct+0x2a0/0x3f0 [ 49.891488][ T3630] ? splice_direct_to_actor+0xc20/0xc20 [ 49.897029][ T3630] ? rcu_read_lock_any_held+0xb3/0x150 [ 49.902506][ T3630] ? _raw_spin_lock_irqsave+0x120/0x120 [ 49.908057][ T3630] do_sendfile+0x623/0xf90 [ 49.912478][ T3630] ? do_pwritev+0x360/0x360 [ 49.916991][ T3630] ? _raw_spin_unlock_irq+0x2a/0x40 [ 49.922195][ T3630] ? ptrace_notify+0x245/0x340 [ 49.926957][ T3630] ? do_notify_parent+0xeb0/0xeb0 [ 49.931972][ T3630] ? lockdep_hardirqs_on_prepare+0x448/0x7b0 [ 49.937953][ T3630] __se_sys_sendfile64+0x178/0x1e0 [ 49.943065][ T3630] ? __x64_sys_sendfile64+0xa0/0xa0 [ 49.948258][ T3630] ? syscall_enter_from_user_mode+0x2e/0x1a0 [ 49.954239][ T3630] ? syscall_enter_from_user_mode+0x86/0x1a0 [ 49.960214][ T3630] do_syscall_64+0x2b/0x70 [ 49.964627][ T3630] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 49.970516][ T3630] RIP: 0033:0x7f647bbcde19 [ 49.974927][ T3630] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 49.994524][ T3630] RSP: 002b:00007ffd4087ce08 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 50.002931][ T3630] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f647bbcde19 [ 50.010895][ T3630] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000006 [ 50.018856][ T3630] RBP: 0000000000000000 R08: 00007ffd4087ce30 R09: 00007ffd4087ce30 [ 50.026822][ T3630] R10: 0000000000000002 R11: 0000000000000246 R12: 00007ffd4087ce2c [ 50.034802][ T3630] R13: 00007ffd4087ce40 R14: 00007ffd4087ce80 R15: 0000000000000000 [ 50.042783][ T3630] [pid 3624] mkdir("/syzcgroup/unified/syz2", 0777 [pid 3631] <... mount resumed>) = 0 [pid 3626] <... mkdir resumed>) = 0 [pid 3625] <... write resumed>) = 1 [pid 3624] <... mkdir resumed>) = 0 [pid 3622] <... write resumed>) = 1 [pid 3631] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 3626] openat(AT_FDCWD, "/syzcgroup/cpu/syz5/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 3625] close(3 [pid 3624] openat(AT_FDCWD, "/syzcgroup/unified/syz2/pids.max", O_WRONLY|O_CLOEXEC [pid 3622] close(3 [pid 3631] <... openat resumed>) = 4 [pid 3626] <... openat resumed>) = 3 [pid 3625] <... close resumed>) = 0 [pid 3624] <... openat resumed>) = 3 [pid 3622] <... close resumed>) = 0 [pid 3631] openat(4, "syz0", O_RDWR|O_PATH [pid 3626] write(3, "1", 1 [pid 3625] mkdir("/syzcgroup/cpu/syz3", 0777 [pid 3624] write(3, "32", 2 [pid 3622] mkdir("/syzcgroup/cpu/syz1", 0777 [pid 3631] <... openat resumed>) = 5 [pid 3626] <... write resumed>) = 1 [pid 3625] <... mkdir resumed>) = 0 [pid 3624] <... write resumed>) = 2 [pid 3622] <... mkdir resumed>) = 0 [pid 3631] openat(5, "memory.max", O_RDWR [pid 3626] close(3 [pid 3625] openat(AT_FDCWD, "/syzcgroup/cpu/syz3/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 3624] close(3 [pid 3622] openat(AT_FDCWD, "/syzcgroup/cpu/syz1/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 3631] <... openat resumed>) = 6 [pid 3626] <... close resumed>) = 0 [pid 3625] <... openat resumed>) = 3 [pid 3624] <... close resumed>) = 0 [pid 3622] <... openat resumed>) = 3 [pid 3631] sendfile(6, 6, NULL, 2 [pid 3626] mkdir("/syzcgroup/net/syz5", 0777 [pid 3625] write(3, "1", 1 [pid 3624] openat(AT_FDCWD, "/syzcgroup/unified/syz2/memory.low", O_WRONLY|O_CLOEXEC [pid 3622] write(3, "1", 1 [pid 3626] <... mkdir resumed>) = 0 [pid 3625] <... write resumed>) = 1 [pid 3624] <... openat resumed>) = 3 [ 50.056490][ T3630] memory: usage 192kB, limit 0kB, failcnt 0 [ 50.062433][ T3630] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 50.069704][ T3630] Memory cgroup stats for /syz0: [ 50.070590][ T3630] anon 20480 [ 50.070590][ T3630] file 12288 [ 50.070590][ T3630] kernel 163840 [ 50.070590][ T3630] kernel_stack 32768 [ 50.070590][ T3630] pagetables 36864 [ 50.070590][ T3630] percpu 0 [ 50.070590][ T3630] sock 0 [ 50.070590][ T3630] vmalloc 0 [ 50.070590][ T3630] shmem 0 [ 50.070590][ T3630] zswap 0 [ 50.070590][ T3630] zswapped 0 [ 50.070590][ T3630] file_mapped 0 [ 50.070590][ T3630] file_dirty 0 [ 50.070590][ T3630] file_writeback 0 [ 50.070590][ T3630] swapcached 0 [ 50.070590][ T3630] anon_thp 0 [ 50.070590][ T3630] file_thp 0 [ 50.070590][ T3630] shmem_thp 0 [ 50.070590][ T3630] inactive_anon 8192 [ 50.070590][ T3630] active_anon 0 [ 50.070590][ T3630] inactive_file 0 [ 50.070590][ T3630] active_file 0 [ 50.070590][ T3630] unevictable 0 [ 50.070590][ T3630] slab_reclaimable 29520 [pid 3622] <... write resumed>) = 1 [pid 3626] openat(AT_FDCWD, "/syzcgroup/net/syz5/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 3625] close(3 [pid 3624] write(3, "312475648", 9 [pid 3622] close(3 [pid 3626] <... openat resumed>) = 3 [pid 3625] <... close resumed>) = 0 [pid 3624] <... write resumed>) = 9 [pid 3622] <... close resumed>) = 0 [pid 3626] write(3, "1", 1 [pid 3625] mkdir("/syzcgroup/net/syz3", 0777 [pid 3624] close(3 [pid 3622] mkdir("/syzcgroup/net/syz1", 0777 [pid 3626] <... write resumed>) = 1 [pid 3625] <... mkdir resumed>) = 0 [pid 3624] <... close resumed>) = 0 [pid 3622] <... mkdir resumed>) = 0 [pid 3626] close(3 [pid 3625] openat(AT_FDCWD, "/syzcgroup/net/syz3/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 3624] openat(AT_FDCWD, "/syzcgroup/unified/syz2/memory.high", O_WRONLY|O_CLOEXEC [pid 3622] openat(AT_FDCWD, "/syzcgroup/net/syz1/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 3626] <... close resumed>) = 0 [pid 3625] <... openat resumed>) = 3 [pid 3624] <... openat resumed>) = 3 [pid 3622] <... openat resumed>) = 3 [pid 3626] mkdir("./0", 0777 [pid 3625] write(3, "1", 1 [pid 3624] write(3, "313524224", 9 [pid 3622] write(3, "1", 1 [pid 3626] <... mkdir resumed>) = 0 [pid 3625] <... write resumed>) = 1 [pid 3624] <... write resumed>) = 9 [pid 3622] <... write resumed>) = 1 [pid 3626] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 3625] close(3 [pid 3624] close(3 [pid 3622] close(3 [pid 3625] <... close resumed>) = 0 [pid 3624] <... close resumed>) = 0 [pid 3622] <... close resumed>) = 0 [pid 3626] <... clone resumed>, child_tidptr=0x555555d515d0) = 2 [pid 3625] mkdir("./0", 0777 [pid 3624] openat(AT_FDCWD, "/syzcgroup/unified/syz2/memory.max", O_WRONLY|O_CLOEXEC [pid 3622] mkdir("./0", 0777 [pid 3625] <... mkdir resumed>) = 0 [pid 3624] <... openat resumed>) = 3 [pid 3622] <... mkdir resumed>) = 0 [pid 3625] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 3624] write(3, "314572800", 9 [pid 3622] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3634 attached ./strace-static-x86_64: Process 3633 attached [pid 3624] <... write resumed>) = 9 [pid 3634] chdir("./0" [pid 3633] chdir("./0" [pid 3625] <... clone resumed>, child_tidptr=0x555555d515d0) = 2 [pid 3624] close(3 [pid 3622] <... clone resumed>, child_tidptr=0x555555d515d0) = 2 [pid 3634] <... chdir resumed>) = 0 [pid 3633] <... chdir resumed>) = 0 [pid 3624] <... close resumed>) = 0 [pid 3634] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 3633] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 3624] openat(AT_FDCWD, "/syzcgroup/unified/syz2/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 3634] <... prctl resumed>) = 0 [pid 3633] <... prctl resumed>) = 0 [pid 3624] <... openat resumed>) = 3 [pid 3634] setpgid(0, 0 [pid 3633] setpgid(0, 0 [pid 3624] write(3, "1", 1 [pid 3634] <... setpgid resumed>) = 0 [pid 3633] <... setpgid resumed>) = 0 [pid 3624] <... write resumed>) = 1 [pid 3634] symlink("/syzcgroup/unified/syz1", "./cgroup" [pid 3633] symlink("/syzcgroup/unified/syz3", "./cgroup" [pid 3624] close(3 [pid 3634] <... symlink resumed>) = 0 [pid 3633] <... symlink resumed>) = 0 [pid 3624] <... close resumed>) = 0 [pid 3634] symlink("/syzcgroup/cpu/syz1", "./cgroup.cpu" [pid 3633] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu" [pid 3624] mkdir("/syzcgroup/cpu/syz2", 0777 [pid 3634] <... symlink resumed>) = 0 [pid 3633] <... symlink resumed>) = 0 [pid 3624] <... mkdir resumed>) = 0 [pid 3634] symlink("/syzcgroup/net/syz1", "./cgroup.net" [pid 3633] symlink("/syzcgroup/net/syz3", "./cgroup.net" [pid 3624] openat(AT_FDCWD, "/syzcgroup/cpu/syz2/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 3634] <... symlink resumed>) = 0 [pid 3633] <... symlink resumed>) = 0 [pid 3624] <... openat resumed>) = 3 [pid 3634] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 3633] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 3624] write(3, "1", 1 [pid 3634] <... openat resumed>) = 3 [pid 3633] <... openat resumed>) = 3 [pid 3624] <... write resumed>) = 1 [pid 3634] write(3, "1000", 4 [pid 3633] write(3, "1000", 4 [pid 3624] close(3 [pid 3634] <... write resumed>) = 4 [pid 3633] <... write resumed>) = 4 [pid 3624] <... close resumed>) = 0 [pid 3634] close(3 [pid 3633] close(3 [pid 3624] mkdir("/syzcgroup/net/syz2", 0777 [pid 3634] <... close resumed>) = 0 [pid 3633] <... close resumed>) = 0 [pid 3624] <... mkdir resumed>) = 0 [pid 3634] symlink("/dev/binderfs", "./binderfs" [pid 3633] symlink("/dev/binderfs", "./binderfs" [pid 3624] openat(AT_FDCWD, "/syzcgroup/net/syz2/cgroup.procs", O_WRONLY|O_CLOEXEC./strace-static-x86_64: Process 3632 attached [pid 3634] <... symlink resumed>) = 0 [pid 3633] <... symlink resumed>) = 0 [pid 3624] <... openat resumed>) = 3 [pid 3634] mkdir("./file0", 000 [pid 3633] mkdir("./file0", 000 [pid 3624] write(3, "1", 1 [pid 3634] <... mkdir resumed>) = 0 [pid 3633] <... mkdir resumed>) = 0 [pid 3632] chdir("./0" [pid 3624] <... write resumed>) = 1 [pid 3634] open("./file0", O_RDONLY [pid 3633] open("./file0", O_RDONLY [pid 3624] close(3 [pid 3634] <... open resumed>) = 3 [pid 3633] <... open resumed>) = 3 [pid 3624] <... close resumed>) = 0 [pid 3634] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 3633] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 3624] mkdir("./0", 0777 [pid 3634] <... mount resumed>) = 0 [pid 3633] <... mount resumed>) = 0 [pid 3632] <... chdir resumed>) = 0 [pid 3624] <... mkdir resumed>) = 0 [pid 3634] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 3633] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 3624] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3635 attached [pid 3634] <... openat resumed>) = 4 [pid 3633] <... openat resumed>) = 4 [pid 3635] chdir("./0" [pid 3634] openat(4, "syz0", O_RDWR|O_PATH [pid 3633] openat(4, "syz0", O_RDWR|O_PATH [pid 3624] <... clone resumed>, child_tidptr=0x555555d515d0) = 2 [pid 3635] <... chdir resumed>) = 0 [pid 3634] <... openat resumed>) = 5 [pid 3633] <... openat resumed>) = 5 [pid 3635] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 3634] openat(5, "memory.max", O_RDWR [pid 3633] openat(5, "memory.max", O_RDWR [pid 3635] <... prctl resumed>) = 0 [pid 3634] <... openat resumed>) = 6 [pid 3633] <... openat resumed>) = 6 [pid 3632] prctl(PR_SET_PDEATHSIG, SIGKILL [ 50.070590][ T3630] slab_unreclaimable 41616 [ 50.070590][ T3630] slab 71136 [ 50.070590][ T3630] workingset_refault_anon 0 [ 50.170168][ T3630] Tasks state (memory values in pages): [ 50.176851][ T3630] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 50.187866][ T3630] [ 3621] 0 3621 4371 38 40960 0 0 syz-executor417 [pid 3635] setpgid(0, 0 [pid 3634] sendfile(6, 6, NULL, 2 [pid 3633] sendfile(6, 6, NULL, 2 [pid 3635] <... setpgid resumed>) = 0 [pid 3632] <... prctl resumed>) = 0 [pid 3635] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 3635] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 3635] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 3635] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 3632] setpgid(0, 0 [pid 3635] <... openat resumed>) = 3 [pid 3632] <... setpgid resumed>) = 0 [pid 3635] write(3, "1000", 4 [pid 3632] symlink("/syzcgroup/unified/syz5", "./cgroup" [pid 3635] <... write resumed>) = 4 [pid 3635] close(3) = 0 [pid 3635] symlink("/dev/binderfs", "./binderfs") = 0 [pid 3635] mkdir("./file0", 000 [pid 3632] <... symlink resumed>) = 0 [pid 3635] <... mkdir resumed>) = 0 [pid 3632] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu" [pid 3635] open("./file0", O_RDONLY) = 3 [pid 3632] <... symlink resumed>) = 0 [pid 3635] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 3635] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 3635] openat(4, "syz0", O_RDWR|O_PATH) = 5 [pid 3632] symlink("/syzcgroup/net/syz5", "./cgroup.net" [pid 3635] openat(5, "memory.max", O_RDWR) = 6 [pid 3632] <... symlink resumed>) = 0 [pid 3635] sendfile(6, 6, NULL, 2 [ 50.198714][ T3630] [ 3630] 0 3630 4371 14 53248 0 1000 syz-executor417 [ 50.211465][ T3630] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz0,mems_allowed=0-1,oom_memcg=/syz0,task_memcg=/syz0,task=syz-executor417,pid=3621,uid=0 [ 50.228804][ T3630] Memory cgroup out of memory: Killed process 3621 (syz-executor417) total-vm:17484kB, anon-rss:56kB, file-rss:96kB, shmem-rss:0kB, UID:0 pgtables:40kB oom_score_adj:0 [pid 3632] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 3630] <... sendfile resumed>) = ? [pid 3632] <... openat resumed>) = 3 [pid 3632] write(3, "1000", 4) = 4 [pid 3632] close(3) = 0 [pid 3632] symlink("/dev/binderfs", "./binderfs") = 0 [pid 3632] mkdir("./file0", 000) = 0 [pid 3632] open("./file0", O_RDONLY) = 3 [pid 3630] +++ killed by SIGKILL +++ [pid 3632] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 3621] +++ killed by SIGKILL +++ [pid 3632] <... mount resumed>) = 0 [pid 3632] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 3632] openat(4, "syz0", O_RDWR|O_PATH) = 5 [pid 3632] openat(5, "memory.max", O_RDWR) = 6 [pid 3632] sendfile(6, 6, NULL, 2 [pid 3615] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=3621, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=13} --- [pid 3615] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555d515d0) = -1 ENOMEM (Cannot allocate memory) [pid 3615] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555d515d0) = -1 ENOMEM (Cannot allocate memory) [pid 3615] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555d515d0) = -1 ENOMEM (Cannot allocate memory) [pid 3615] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555d515d0) = -1 ENOMEM (Cannot allocate memory) [ 50.313757][ T3631] syz-executor417 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 50.335035][ T3631] CPU: 0 PID: 3631 Comm: syz-executor417 Not tainted 5.19.0-rc7-syzkaller-00007-g353f7988dd84 #0 [ 50.345585][ T3631] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 [ 50.355658][ T3631] Call Trace: [ 50.358962][ T3631] [pid 3615] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555d515d0) = -1 ENOMEM (Cannot allocate memory) [ 50.361911][ T3631] dump_stack_lvl+0x1e3/0x2cb [ 50.366627][ T3631] ? bfq_pos_tree_add_move+0x436/0x436 [ 50.372112][ T3631] ? panic+0x76e/0x76e [ 50.376249][ T3631] dump_header+0xdb/0x970 [ 50.380590][ T3631] out_of_memory+0x895/0xb30 [ 50.385211][ T3631] ? unregister_oom_notifier+0x20/0x20 [ 50.390691][ T3631] ? lockdep_hardirqs_on_prepare+0x448/0x7b0 [ 50.396687][ T3631] mem_cgroup_out_of_memory+0x25d/0x3b0 [ 50.402258][ T3631] ? mem_cgroup_oom_trylock+0x220/0x220 [ 50.407838][ T3631] ? cgroup_file_notify+0x106/0x190 [ 50.413060][ T3631] memory_max_write+0x364/0x4f0 [ 50.417941][ T3631] ? memory_max_show+0xa0/0xa0 [ 50.422739][ T3631] ? read_lock_is_recursive+0x10/0x10 [ 50.428135][ T3631] ? memory_max_show+0xa0/0xa0 [ 50.432969][ T3631] cgroup_file_write+0x2ab/0x780 [ 50.437934][ T3631] ? cgroup_seqfile_stop+0xd0/0xd0 [ 50.443071][ T3631] ? check_heap_object+0x23e/0x820 [ 50.448211][ T3631] ? cgroup_seqfile_stop+0xd0/0xd0 [ 50.453339][ T3631] kernfs_fop_write_iter+0x3ac/0x500 [ 50.458637][ T3631] do_iter_readv_writev+0x499/0x650 [ 50.463829][ T3631] ? generic_file_rw_checks+0x250/0x250 [ 50.469390][ T3631] ? bpf_lsm_file_permission+0x5/0x10 [ 50.474781][ T3631] ? security_file_permission+0xe0/0x5c0 [ 50.480429][ T3631] ? do_iter_write+0x147/0x7a0 [ 50.485215][ T3631] do_iter_write+0x1f1/0x7a0 [ 50.489834][ T3631] ? vfs_iter_write+0x69/0xa0 [ 50.494542][ T3631] iter_file_splice_write+0x830/0xff0 [ 50.499966][ T3631] ? splice_from_pipe+0x220/0x220 [ 50.505095][ T3631] ? generic_file_splice_read+0x46b/0x660 [ 50.510865][ T3631] ? splice_shrink_spd+0xb0/0xb0 [ 50.515841][ T3631] ? splice_from_pipe+0x220/0x220 [ 50.520908][ T3631] direct_splice_actor+0xe6/0x1c0 [ 50.525973][ T3631] splice_direct_to_actor+0x514/0xc20 [ 50.531362][ T3631] ? __lock_acquire+0x129a/0x1f80 [ 50.536415][ T3631] ? do_splice_direct+0x3f0/0x3f0 [ 50.541465][ T3631] ? pipe_to_sendpage+0x340/0x340 [ 50.546480][ T3631] ? bpf_lsm_file_permission+0x5/0x10 [ 50.551849][ T3631] ? security_file_permission+0xe0/0x5c0 [ 50.557510][ T3631] do_splice_direct+0x2a0/0x3f0 [ 50.562391][ T3631] ? splice_direct_to_actor+0xc20/0xc20 [ 50.567959][ T3631] ? rcu_read_lock_any_held+0xb3/0x150 [ 50.573428][ T3631] ? _raw_spin_lock_irqsave+0x120/0x120 [ 50.578986][ T3631] do_sendfile+0x623/0xf90 [ 50.583437][ T3631] ? do_pwritev+0x360/0x360 [ 50.587950][ T3631] ? _raw_spin_unlock_irq+0x2a/0x40 [ 50.593155][ T3631] ? ptrace_notify+0x245/0x340 [ 50.597961][ T3631] ? do_notify_parent+0xeb0/0xeb0 [ 50.602985][ T3631] ? lockdep_hardirqs_on_prepare+0x448/0x7b0 [ 50.608991][ T3631] __se_sys_sendfile64+0x178/0x1e0 [ 50.614123][ T3631] ? __x64_sys_sendfile64+0xa0/0xa0 [ 50.619343][ T3631] ? syscall_enter_from_user_mode+0x2e/0x1a0 [ 50.625336][ T3631] ? syscall_enter_from_user_mode+0x86/0x1a0 [ 50.631317][ T3631] do_syscall_64+0x2b/0x70 [ 50.635732][ T3631] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 50.641615][ T3631] RIP: 0033:0x7f647bbcde19 [ 50.646040][ T3631] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 50.665662][ T3631] RSP: 002b:00007ffd4087ce08 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 50.674103][ T3631] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f647bbcde19 [ 50.682092][ T3631] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000006 [ 50.690078][ T3631] RBP: 0000000000000000 R08: 00007ffd4087ce30 R09: 00007ffd4087ce30 [ 50.698065][ T3631] R10: 0000000000000002 R11: 0000000000000246 R12: 00007ffd4087ce2c [ 50.706044][ T3631] R13: 00007ffd4087ce40 R14: 00007ffd4087ce80 R15: 0000000000000000 [ 50.714022][ T3631] [ 50.718461][ T3631] memory: usage 80kB, limit 0kB, failcnt 0 [ 50.729698][ T3631] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 50.736701][ T3631] Memory cgroup stats for /syz0: [ 50.736936][ T3631] anon 0 [ 50.736936][ T3631] file 12288 [ 50.736936][ T3631] kernel 69632 [ 50.736936][ T3631] kernel_stack 0 [ 50.736936][ T3631] pagetables 0 [ 50.736936][ T3631] percpu 0 [ 50.736936][ T3631] sock 0 [ 50.736936][ T3631] vmalloc 0 [ 50.736936][ T3631] shmem 0 [ 50.736936][ T3631] zswap 0 [ 50.736936][ T3631] zswapped 0 [ 50.736936][ T3631] file_mapped 0 [ 50.736936][ T3631] file_dirty 0 [ 50.736936][ T3631] file_writeback 0 [ 50.736936][ T3631] swapcached 0 [ 50.736936][ T3631] anon_thp 0 [ 50.736936][ T3631] file_thp 0 [ 50.736936][ T3631] shmem_thp 0 [ 50.736936][ T3631] inactive_anon 0 [ 50.736936][ T3631] active_anon 0 [ 50.736936][ T3631] inactive_file 8192 [ 50.736936][ T3631] active_file 4096 [ 50.736936][ T3631] unevictable 0 [ 50.736936][ T3631] slab_reclaimable 29520 [ 50.736936][ T3631] slab_unreclaimable 37656 [ 50.736936][ T3631] slab 67176 [ 50.736936][ T3631] workingset_refault_anon 0 [ 50.842813][ T3631] Tasks state (memory values in pages): [ 50.848577][ T3631] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 50.858668][ T3631] Out of memory and no killable processes... [pid 3631] <... sendfile resumed>) = 2 [pid 3631] close(3) = 0 [pid 3631] close(4) = 0 [pid 3631] close(5) = 0 [pid 3631] close(6) = 0 [pid 3631] close(7) = -1 EBADF (Bad file descriptor) [pid 3631] close(8) = -1 EBADF (Bad file descriptor) [pid 3631] close(9) = -1 EBADF (Bad file descriptor) [pid 3631] close(10) = -1 EBADF (Bad file descriptor) [pid 3631] close(11) = -1 EBADF (Bad file descriptor) [pid 3631] close(12) = -1 EBADF (Bad file descriptor) [pid 3631] close(13) = -1 EBADF (Bad file descriptor) [pid 3631] close(14) = -1 EBADF (Bad file descriptor) [pid 3631] close(15) = -1 EBADF (Bad file descriptor) [pid 3631] close(16) = -1 EBADF (Bad file descriptor) [pid 3631] close(17) = -1 EBADF (Bad file descriptor) [pid 3631] close(18) = -1 EBADF (Bad file descriptor) [pid 3631] close(19) = -1 EBADF (Bad file descriptor) [pid 3631] close(20) = -1 EBADF (Bad file descriptor) [pid 3631] close(21) = -1 EBADF (Bad file descriptor) [pid 3631] close(22) = -1 EBADF (Bad file descriptor) [pid 3631] close(23) = -1 EBADF (Bad file descriptor) [pid 3631] close(24) = -1 EBADF (Bad file descriptor) [pid 3631] close(25) = -1 EBADF (Bad file descriptor) [pid 3631] close(26) = -1 EBADF (Bad file descriptor) [pid 3631] close(27) = -1 EBADF (Bad file descriptor) [pid 3631] close(28) = -1 EBADF (Bad file descriptor) [pid 3631] close(29) = -1 EBADF (Bad file descriptor) [pid 3631] exit_group(0) = ? [pid 3631] +++ exited with 0 +++ [pid 3623] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=55} --- [pid 3623] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3623] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 3623] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 3623] getdents64(3, 0x555555d52620 /* 7 entries */, 32768) = 208 [pid 3623] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3623] lstat("./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 3623] unlink("./0/binderfs") = 0 [pid 3623] umount2("./0/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3623] lstat("./0/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 3623] unlink("./0/cgroup") = 0 [pid 3623] umount2("./0/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3623] lstat("./0/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3623] unlink("./0/cgroup.net") = 0 [ 50.864780][ T3634] syz-executor417 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 50.875832][ T3634] CPU: 1 PID: 3634 Comm: syz-executor417 Not tainted 5.19.0-rc7-syzkaller-00007-g353f7988dd84 #0 [ 50.886372][ T3634] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 [ 50.896443][ T3634] Call Trace: [ 50.899738][ T3634] [ 50.902686][ T3634] dump_stack_lvl+0x1e3/0x2cb [ 50.907397][ T3634] ? bfq_pos_tree_add_move+0x436/0x436 [ 50.912902][ T3634] ? panic+0x76e/0x76e [ 50.917009][ T3634] dump_header+0xdb/0x970 [ 50.921367][ T3634] out_of_memory+0x895/0xb30 [ 50.925972][ T3634] ? unregister_oom_notifier+0x20/0x20 [ 50.931435][ T3634] ? lockdep_hardirqs_on_prepare+0x448/0x7b0 [ 50.937435][ T3634] mem_cgroup_out_of_memory+0x25d/0x3b0 [ 50.942996][ T3634] ? mem_cgroup_oom_trylock+0x220/0x220 [ 50.948580][ T3634] ? cgroup_file_notify+0x106/0x190 [ 50.953790][ T3634] memory_max_write+0x364/0x4f0 [ 50.958640][ T3634] ? memory_max_show+0xa0/0xa0 [ 50.963403][ T3634] ? read_lock_is_recursive+0x10/0x10 [ 50.968778][ T3634] ? memory_max_show+0xa0/0xa0 [ 50.973566][ T3634] cgroup_file_write+0x2ab/0x780 [ 50.978559][ T3634] ? cgroup_seqfile_stop+0xd0/0xd0 [ 50.983682][ T3634] ? check_heap_object+0x23e/0x820 [ 50.988804][ T3634] ? cgroup_seqfile_stop+0xd0/0xd0 [ 50.993935][ T3634] kernfs_fop_write_iter+0x3ac/0x500 [ 50.999238][ T3634] do_iter_readv_writev+0x499/0x650 [ 51.004448][ T3634] ? generic_file_rw_checks+0x250/0x250 [ 51.010011][ T3634] ? bpf_lsm_file_permission+0x5/0x10 [ 51.015386][ T3634] ? security_file_permission+0xe0/0x5c0 [ 51.021037][ T3634] ? do_iter_write+0x147/0x7a0 [ 51.025820][ T3634] do_iter_write+0x1f1/0x7a0 [ 51.030424][ T3634] ? vfs_iter_write+0x69/0xa0 [ 51.035106][ T3634] iter_file_splice_write+0x830/0xff0 [ 51.040524][ T3634] ? splice_from_pipe+0x220/0x220 [ 51.045562][ T3634] ? generic_file_splice_read+0x46b/0x660 [ 51.051295][ T3634] ? splice_shrink_spd+0xb0/0xb0 [ 51.056247][ T3634] ? splice_from_pipe+0x220/0x220 [ 51.061293][ T3634] direct_splice_actor+0xe6/0x1c0 [ 51.066346][ T3634] splice_direct_to_actor+0x514/0xc20 [ 51.071743][ T3634] ? __lock_acquire+0x129a/0x1f80 [ 51.076806][ T3634] ? do_splice_direct+0x3f0/0x3f0 [ 51.081858][ T3634] ? pipe_to_sendpage+0x340/0x340 [ 51.086903][ T3634] ? bpf_lsm_file_permission+0x5/0x10 [ 51.092273][ T3634] ? security_file_permission+0xe0/0x5c0 [ 51.097938][ T3634] do_splice_direct+0x2a0/0x3f0 [ 51.102818][ T3634] ? splice_direct_to_actor+0xc20/0xc20 [ 51.108379][ T3634] ? rcu_read_lock_any_held+0xb3/0x150 [ 51.113858][ T3634] ? _raw_spin_lock_irqsave+0x120/0x120 [ 51.119418][ T3634] do_sendfile+0x623/0xf90 [ 51.123888][ T3634] ? do_pwritev+0x360/0x360 [ 51.128415][ T3634] ? _raw_spin_unlock_irq+0x2a/0x40 [ 51.133635][ T3634] ? ptrace_notify+0x245/0x340 [ 51.138407][ T3634] ? do_notify_parent+0xeb0/0xeb0 [ 51.143418][ T3634] ? lockdep_hardirqs_on_prepare+0x448/0x7b0 [ 51.149407][ T3634] __se_sys_sendfile64+0x178/0x1e0 [ 51.154529][ T3634] ? __x64_sys_sendfile64+0xa0/0xa0 [ 51.159724][ T3634] ? syscall_enter_from_user_mode+0x2e/0x1a0 [ 51.165732][ T3634] ? syscall_enter_from_user_mode+0x86/0x1a0 [ 51.171741][ T3634] do_syscall_64+0x2b/0x70 [ 51.176188][ T3634] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 51.182106][ T3634] RIP: 0033:0x7f647bbcde19 [ 51.186539][ T3634] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 51.206168][ T3634] RSP: 002b:00007ffd4087ce08 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [pid 3623] umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 3623] umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3623] lstat("./0/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3623] umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 51.214603][ T3634] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f647bbcde19 [ 51.222575][ T3634] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000006 [ 51.230564][ T3634] RBP: 0000000000000000 R08: 00007ffd4087ce30 R09: 00007ffd4087ce30 [ 51.238546][ T3634] R10: 0000000000000002 R11: 0000000000000246 R12: 00007ffd4087ce2c [ 51.246523][ T3634] R13: 00007ffd4087ce40 R14: 00007ffd4087ce80 R15: 0000000000000000 [ 51.254540][ T3634] [pid 3623] openat(AT_FDCWD, "./0/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 3623] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3623] getdents64(4, 0x555555d5a660 /* 2 entries */, 32768) = 48 [pid 3623] getdents64(4, 0x555555d5a660 /* 0 entries */, 32768) = 0 [pid 3623] close(4) = 0 [pid 3623] rmdir("./0/file0") = 0 [pid 3623] umount2("./0/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3623] lstat("./0/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3623] unlink("./0/cgroup.cpu") = 0 [pid 3623] getdents64(3, 0x555555d52620 /* 0 entries */, 32768) = 0 [pid 3623] close(3) = 0 [pid 3623] rmdir("./0") = 0 [pid 3623] mkdir("./1", 0777) = 0 [pid 3623] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3641 attached [pid 3641] chdir("./1" [pid 3623] <... clone resumed>, child_tidptr=0x555555d515d0) = 3 [pid 3641] <... chdir resumed>) = 0 [pid 3641] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3641] setpgid(0, 0) = 0 [pid 3641] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 3641] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 3641] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [pid 3641] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3641] write(3, "1000", 4) = 4 [pid 3641] close(3) = 0 [pid 3641] symlink("/dev/binderfs", "./binderfs") = 0 [ 51.270719][ T3634] memory: usage 80kB, limit 0kB, failcnt 0 [ 51.276638][ T3634] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 51.283538][ T3634] Memory cgroup stats for /syz0: [ 51.283746][ T3634] anon 0 [ 51.283746][ T3634] file 12288 [ 51.283746][ T3634] kernel 69632 [ 51.283746][ T3634] kernel_stack 0 [ 51.283746][ T3634] pagetables 0 [ 51.283746][ T3634] percpu 0 [ 51.283746][ T3634] sock 0 [ 51.283746][ T3634] vmalloc 0 [ 51.283746][ T3634] shmem 0 [ 51.283746][ T3634] zswap 0 [pid 3641] mkdir("./file0", 000) = 0 [pid 3641] open("./file0", O_RDONLY) = 3 [pid 3641] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 3641] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 3641] openat(4, "syz0", O_RDWR|O_PATH) = 5 [pid 3641] openat(5, "memory.max", O_RDWR) = 6 [ 51.283746][ T3634] zswapped 0 [ 51.283746][ T3634] file_mapped 0 [ 51.283746][ T3634] file_dirty 0 [ 51.283746][ T3634] file_writeback 0 [ 51.283746][ T3634] swapcached 0 [ 51.283746][ T3634] anon_thp 0 [ 51.283746][ T3634] file_thp 0 [ 51.283746][ T3634] shmem_thp 0 [ 51.283746][ T3634] inactive_anon 0 [ 51.283746][ T3634] active_anon 0 [ 51.283746][ T3634] inactive_file 4096 [ 51.283746][ T3634] active_file 8192 [ 51.283746][ T3634] unevictable 0 [ 51.283746][ T3634] slab_reclaimable 29520 [ 51.283746][ T3634] slab_unreclaimable 37656 [pid 3641] sendfile(6, 6, NULL, 2 [pid 3634] <... sendfile resumed>) = 2 [pid 3634] close(3) = 0 [pid 3634] close(4) = 0 [pid 3634] close(5) = 0 [pid 3634] close(6) = 0 [pid 3634] close(7) = -1 EBADF (Bad file descriptor) [ 51.283746][ T3634] slab 67176 [ 51.283746][ T3634] workingset_refault_anon 0 [ 51.378653][ T3634] Tasks state (memory values in pages): [ 51.384228][ T3634] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 51.393779][ T3634] Out of memory and no killable processes... [ 51.400267][ T3633] syz-executor417 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 3634] close(8) = -1 EBADF (Bad file descriptor) [pid 3634] close(9) = -1 EBADF (Bad file descriptor) [pid 3634] close(10) = -1 EBADF (Bad file descriptor) [pid 3634] close(11) = -1 EBADF (Bad file descriptor) [pid 3634] close(12) = -1 EBADF (Bad file descriptor) [pid 3634] close(13) = -1 EBADF (Bad file descriptor) [pid 3634] close(14) = -1 EBADF (Bad file descriptor) [pid 3634] close(15) = -1 EBADF (Bad file descriptor) [pid 3634] close(16) = -1 EBADF (Bad file descriptor) [pid 3634] close(17) = -1 EBADF (Bad file descriptor) [pid 3634] close(18) = -1 EBADF (Bad file descriptor) [pid 3634] close(19) = -1 EBADF (Bad file descriptor) [pid 3634] close(20) = -1 EBADF (Bad file descriptor) [pid 3634] close(21) = -1 EBADF (Bad file descriptor) [pid 3634] close(22) = -1 EBADF (Bad file descriptor) [pid 3634] close(23) = -1 EBADF (Bad file descriptor) [pid 3634] close(24) = -1 EBADF (Bad file descriptor) [pid 3634] close(25) = -1 EBADF (Bad file descriptor) [pid 3634] close(26) = -1 EBADF (Bad file descriptor) [pid 3634] close(27) = -1 EBADF (Bad file descriptor) [pid 3634] close(28) = -1 EBADF (Bad file descriptor) [pid 3634] close(29) = -1 EBADF (Bad file descriptor) [pid 3634] exit_group(0) = ? [pid 3634] +++ exited with 0 +++ [pid 3622] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=55} --- [pid 3622] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3622] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 3622] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 3622] getdents64(3, 0x555555d52620 /* 7 entries */, 32768) = 208 [pid 3622] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3622] lstat("./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 3622] unlink("./0/binderfs") = 0 [ 51.416479][ T3633] CPU: 1 PID: 3633 Comm: syz-executor417 Not tainted 5.19.0-rc7-syzkaller-00007-g353f7988dd84 #0 [ 51.427011][ T3633] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 [ 51.437111][ T3633] Call Trace: [ 51.440406][ T3633] [ 51.443354][ T3633] dump_stack_lvl+0x1e3/0x2cb [ 51.448060][ T3633] ? bfq_pos_tree_add_move+0x436/0x436 [ 51.453544][ T3633] ? panic+0x76e/0x76e [ 51.457652][ T3633] dump_header+0xdb/0x970 [ 51.462010][ T3633] out_of_memory+0x895/0xb30 [pid 3622] umount2("./0/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3622] lstat("./0/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 3622] unlink("./0/cgroup") = 0 [pid 3622] umount2("./0/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3622] lstat("./0/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3622] unlink("./0/cgroup.net") = 0 [ 51.466626][ T3633] ? unregister_oom_notifier+0x20/0x20 [ 51.472110][ T3633] ? lockdep_hardirqs_on_prepare+0x448/0x7b0 [ 51.478121][ T3633] mem_cgroup_out_of_memory+0x25d/0x3b0 [ 51.483683][ T3633] ? mem_cgroup_oom_trylock+0x220/0x220 [ 51.489254][ T3633] ? cgroup_file_notify+0x106/0x190 [ 51.494473][ T3633] memory_max_write+0x364/0x4f0 [ 51.499362][ T3633] ? memory_max_show+0xa0/0xa0 [ 51.504154][ T3633] ? read_lock_is_recursive+0x10/0x10 [ 51.509568][ T3633] ? memory_max_show+0xa0/0xa0 [ 51.514368][ T3633] cgroup_file_write+0x2ab/0x780 [ 51.519334][ T3633] ? cgroup_seqfile_stop+0xd0/0xd0 [ 51.524464][ T3633] ? check_heap_object+0x23e/0x820 [ 51.529601][ T3633] ? cgroup_seqfile_stop+0xd0/0xd0 [ 51.534721][ T3633] kernfs_fop_write_iter+0x3ac/0x500 [ 51.540010][ T3633] do_iter_readv_writev+0x499/0x650 [ 51.545212][ T3633] ? generic_file_rw_checks+0x250/0x250 [ 51.550761][ T3633] ? bpf_lsm_file_permission+0x5/0x10 [ 51.556132][ T3633] ? security_file_permission+0xe0/0x5c0 [ 51.561790][ T3633] ? do_iter_write+0x147/0x7a0 [ 51.566561][ T3633] do_iter_write+0x1f1/0x7a0 [ 51.571172][ T3633] ? vfs_iter_write+0x69/0xa0 [ 51.575854][ T3633] iter_file_splice_write+0x830/0xff0 [ 51.581341][ T3633] ? splice_from_pipe+0x220/0x220 [ 51.586394][ T3633] ? generic_file_splice_read+0x46b/0x660 [ 51.592119][ T3633] ? splice_shrink_spd+0xb0/0xb0 [ 51.597064][ T3633] ? splice_from_pipe+0x220/0x220 [ 51.602088][ T3633] direct_splice_actor+0xe6/0x1c0 [ 51.607130][ T3633] splice_direct_to_actor+0x514/0xc20 [ 51.612509][ T3633] ? __lock_acquire+0x129a/0x1f80 [ 51.617544][ T3633] ? do_splice_direct+0x3f0/0x3f0 [ 51.622569][ T3633] ? pipe_to_sendpage+0x340/0x340 [ 51.627598][ T3633] ? bpf_lsm_file_permission+0x5/0x10 [ 51.632973][ T3633] ? security_file_permission+0xe0/0x5c0 [ 51.638609][ T3633] do_splice_direct+0x2a0/0x3f0 [ 51.643468][ T3633] ? splice_direct_to_actor+0xc20/0xc20 [ 51.649013][ T3633] ? rcu_read_lock_any_held+0xb3/0x150 [ 51.654494][ T3633] ? _raw_spin_lock_irqsave+0x120/0x120 [ 51.660058][ T3633] do_sendfile+0x623/0xf90 [ 51.664496][ T3633] ? do_pwritev+0x360/0x360 [ 51.669000][ T3633] ? _raw_spin_unlock_irq+0x2a/0x40 [ 51.674200][ T3633] ? ptrace_notify+0x245/0x340 [ 51.678967][ T3633] ? do_notify_parent+0xeb0/0xeb0 [ 51.684007][ T3633] ? lockdep_hardirqs_on_prepare+0x448/0x7b0 [ 51.689994][ T3633] __se_sys_sendfile64+0x178/0x1e0 [ 51.695195][ T3633] ? __x64_sys_sendfile64+0xa0/0xa0 [ 51.700392][ T3633] ? syscall_enter_from_user_mode+0x2e/0x1a0 [ 51.706376][ T3633] ? syscall_enter_from_user_mode+0x86/0x1a0 [ 51.712355][ T3633] do_syscall_64+0x2b/0x70 [ 51.716768][ T3633] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 51.722657][ T3633] RIP: 0033:0x7f647bbcde19 [ 51.727067][ T3633] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 51.746697][ T3633] RSP: 002b:00007ffd4087ce08 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 51.755133][ T3633] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f647bbcde19 [ 51.763105][ T3633] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000006 [pid 3622] umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 3622] umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3622] lstat("./0/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3622] umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3622] openat(AT_FDCWD, "./0/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 3622] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3622] getdents64(4, 0x555555d5a660 /* 2 entries */, 32768) = 48 [pid 3622] getdents64(4, 0x555555d5a660 /* 0 entries */, 32768) = 0 [pid 3622] close(4) = 0 [ 51.771106][ T3633] RBP: 0000000000000000 R08: 00007ffd4087ce30 R09: 00007ffd4087ce30 [ 51.779087][ T3633] R10: 0000000000000002 R11: 0000000000000246 R12: 00007ffd4087ce2c [ 51.787055][ T3633] R13: 00007ffd4087ce40 R14: 00007ffd4087ce80 R15: 0000000000000000 [ 51.795044][ T3633] [ 51.799937][ T3633] memory: usage 80kB, limit 0kB, failcnt 0 [ 51.809905][ T3633] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 51.817620][ T3633] Memory cgroup stats for /syz0: [pid 3622] rmdir("./0/file0") = 0 [pid 3622] umount2("./0/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3622] lstat("./0/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3622] unlink("./0/cgroup.cpu") = 0 [pid 3622] getdents64(3, 0x555555d52620 /* 0 entries */, 32768) = 0 [pid 3622] close(3) = 0 [pid 3622] rmdir("./0") = 0 [pid 3622] mkdir("./1", 0777) = 0 [pid 3622] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3642 attached [pid 3642] chdir("./1" [pid 3622] <... clone resumed>, child_tidptr=0x555555d515d0) = 3 [pid 3642] <... chdir resumed>) = 0 [pid 3642] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3642] setpgid(0, 0) = 0 [pid 3642] symlink("/syzcgroup/unified/syz1", "./cgroup") = 0 [pid 3642] symlink("/syzcgroup/cpu/syz1", "./cgroup.cpu") = 0 [pid 3642] symlink("/syzcgroup/net/syz1", "./cgroup.net") = 0 [ 51.818095][ T3633] anon 0 [ 51.818095][ T3633] file 12288 [ 51.818095][ T3633] kernel 69632 [ 51.818095][ T3633] kernel_stack 0 [ 51.818095][ T3633] pagetables 0 [ 51.818095][ T3633] percpu 0 [ 51.818095][ T3633] sock 0 [ 51.818095][ T3633] vmalloc 0 [ 51.818095][ T3633] shmem 0 [ 51.818095][ T3633] zswap 0 [ 51.818095][ T3633] zswapped 0 [ 51.818095][ T3633] file_mapped 0 [ 51.818095][ T3633] file_dirty 0 [ 51.818095][ T3633] file_writeback 0 [ 51.818095][ T3633] swapcached 0 [ 51.818095][ T3633] anon_thp 0 [pid 3642] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3642] write(3, "1000", 4) = 4 [pid 3642] close(3) = 0 [pid 3642] symlink("/dev/binderfs", "./binderfs") = 0 [pid 3642] mkdir("./file0", 000) = 0 [pid 3642] open("./file0", O_RDONLY) = 3 [pid 3642] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 3642] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 3642] openat(4, "syz0", O_RDWR|O_PATH) = 5 [pid 3642] openat(5, "memory.max", O_RDWR) = 6 [ 51.818095][ T3633] file_thp 0 [ 51.818095][ T3633] shmem_thp 0 [ 51.818095][ T3633] inactive_anon 0 [ 51.818095][ T3633] active_anon 0 [ 51.818095][ T3633] inactive_file 8192 [ 51.818095][ T3633] active_file 4096 [ 51.818095][ T3633] unevictable 0 [ 51.818095][ T3633] slab_reclaimable 29520 [ 51.818095][ T3633] slab_unreclaimable 37656 [ 51.818095][ T3633] slab 67176 [ 51.818095][ T3633] workingset_refault_anon 0 [ 51.918963][ T3633] Tasks state (memory values in pages): [pid 3642] sendfile(6, 6, NULL, 2 [pid 3633] <... sendfile resumed>) = 2 [ 51.924630][ T3633] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 51.934265][ T3633] Out of memory and no killable processes... [ 51.940619][ T3635] syz-executor417 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 51.954632][ T3635] CPU: 0 PID: 3635 Comm: syz-executor417 Not tainted 5.19.0-rc7-syzkaller-00007-g353f7988dd84 #0 [pid 3633] close(3) = 0 [pid 3633] close(4) = 0 [pid 3633] close(5) = 0 [pid 3633] close(6) = 0 [pid 3633] close(7) = -1 EBADF (Bad file descriptor) [pid 3633] close(8) = -1 EBADF (Bad file descriptor) [pid 3633] close(9) = -1 EBADF (Bad file descriptor) [pid 3633] close(10) = -1 EBADF (Bad file descriptor) [pid 3633] close(11) = -1 EBADF (Bad file descriptor) [ 51.965163][ T3635] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 [ 51.975234][ T3635] Call Trace: [ 51.978527][ T3635] [ 51.981472][ T3635] dump_stack_lvl+0x1e3/0x2cb [ 51.986180][ T3635] ? bfq_pos_tree_add_move+0x436/0x436 [ 51.991661][ T3635] ? panic+0x76e/0x76e [ 51.995746][ T3635] dump_header+0xdb/0x970 [ 52.000127][ T3635] out_of_memory+0x895/0xb30 [ 52.004743][ T3635] ? unregister_oom_notifier+0x20/0x20 [ 52.010226][ T3635] ? lockdep_hardirqs_on_prepare+0x448/0x7b0 [ 52.016238][ T3635] mem_cgroup_out_of_memory+0x25d/0x3b0 [ 52.021843][ T3635] ? mem_cgroup_oom_trylock+0x220/0x220 [ 52.027397][ T3635] ? cgroup_file_notify+0x106/0x190 [ 52.032621][ T3635] memory_max_write+0x364/0x4f0 [ 52.037478][ T3635] ? memory_max_show+0xa0/0xa0 [ 52.042249][ T3635] ? read_lock_is_recursive+0x10/0x10 [ 52.047628][ T3635] ? memory_max_show+0xa0/0xa0 [ 52.052398][ T3635] cgroup_file_write+0x2ab/0x780 [ 52.057343][ T3635] ? cgroup_seqfile_stop+0xd0/0xd0 [ 52.062453][ T3635] ? check_heap_object+0x23e/0x820 [ 52.067578][ T3635] ? cgroup_seqfile_stop+0xd0/0xd0 [ 52.072691][ T3635] kernfs_fop_write_iter+0x3ac/0x500 [ 52.077993][ T3635] do_iter_readv_writev+0x499/0x650 [ 52.083199][ T3635] ? generic_file_rw_checks+0x250/0x250 [ 52.088752][ T3635] ? bpf_lsm_file_permission+0x5/0x10 [ 52.094122][ T3635] ? security_file_permission+0xe0/0x5c0 [ 52.099753][ T3635] ? do_iter_write+0x147/0x7a0 [ 52.104529][ T3635] do_iter_write+0x1f1/0x7a0 [ 52.109131][ T3635] ? vfs_iter_write+0x69/0xa0 [ 52.113809][ T3635] iter_file_splice_write+0x830/0xff0 [ 52.119202][ T3635] ? splice_from_pipe+0x220/0x220 [ 52.124232][ T3635] ? generic_file_splice_read+0x46b/0x660 [ 52.129980][ T3635] ? splice_shrink_spd+0xb0/0xb0 [ 52.134944][ T3635] ? splice_from_pipe+0x220/0x220 [ 52.139978][ T3635] direct_splice_actor+0xe6/0x1c0 [ 52.145028][ T3635] splice_direct_to_actor+0x514/0xc20 [ 52.150403][ T3635] ? __lock_acquire+0x129a/0x1f80 [ 52.155432][ T3635] ? do_splice_direct+0x3f0/0x3f0 [ 52.160458][ T3635] ? pipe_to_sendpage+0x340/0x340 [ 52.165481][ T3635] ? bpf_lsm_file_permission+0x5/0x10 [ 52.170849][ T3635] ? security_file_permission+0xe0/0x5c0 [ 52.176486][ T3635] do_splice_direct+0x2a0/0x3f0 [ 52.181341][ T3635] ? splice_direct_to_actor+0xc20/0xc20 [ 52.186883][ T3635] ? rcu_read_lock_any_held+0xb3/0x150 [ 52.192366][ T3635] ? _raw_spin_lock_irqsave+0x120/0x120 [ 52.197937][ T3635] do_sendfile+0x623/0xf90 [ 52.202371][ T3635] ? do_pwritev+0x360/0x360 [ 52.206874][ T3635] ? _raw_spin_unlock_irq+0x2a/0x40 [ 52.212085][ T3635] ? ptrace_notify+0x245/0x340 [ 52.216865][ T3635] ? do_notify_parent+0xeb0/0xeb0 [ 52.221897][ T3635] ? lockdep_hardirqs_on_prepare+0x448/0x7b0 [ 52.227885][ T3635] __se_sys_sendfile64+0x178/0x1e0 [ 52.233006][ T3635] ? __x64_sys_sendfile64+0xa0/0xa0 [ 52.238217][ T3635] ? syscall_enter_from_user_mode+0x2e/0x1a0 [ 52.244205][ T3635] ? syscall_enter_from_user_mode+0x86/0x1a0 [ 52.250193][ T3635] do_syscall_64+0x2b/0x70 [ 52.254609][ T3635] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 52.260501][ T3635] RIP: 0033:0x7f647bbcde19 [ 52.264918][ T3635] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 52.284524][ T3635] RSP: 002b:00007ffd4087ce08 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 52.292936][ T3635] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f647bbcde19 [ 52.300903][ T3635] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000006 [ 52.308866][ T3635] RBP: 0000000000000000 R08: 00007ffd4087ce30 R09: 00007ffd4087ce30 [ 52.316833][ T3635] R10: 0000000000000002 R11: 0000000000000246 R12: 00007ffd4087ce2c [pid 3633] close(12) = -1 EBADF (Bad file descriptor) [pid 3633] close(13) = -1 EBADF (Bad file descriptor) [pid 3633] close(14) = -1 EBADF (Bad file descriptor) [pid 3633] close(15) = -1 EBADF (Bad file descriptor) [pid 3633] close(16) = -1 EBADF (Bad file descriptor) [pid 3633] close(17) = -1 EBADF (Bad file descriptor) [pid 3633] close(18) = -1 EBADF (Bad file descriptor) [pid 3633] close(19) = -1 EBADF (Bad file descriptor) [pid 3633] close(20) = -1 EBADF (Bad file descriptor) [pid 3633] close(21) = -1 EBADF (Bad file descriptor) [pid 3633] close(22) = -1 EBADF (Bad file descriptor) [pid 3633] close(23) = -1 EBADF (Bad file descriptor) [pid 3633] close(24) = -1 EBADF (Bad file descriptor) [pid 3633] close(25) = -1 EBADF (Bad file descriptor) [pid 3633] close(26) = -1 EBADF (Bad file descriptor) [pid 3633] close(27) = -1 EBADF (Bad file descriptor) [pid 3633] close(28) = -1 EBADF (Bad file descriptor) [ 52.324798][ T3635] R13: 00007ffd4087ce40 R14: 00007ffd4087ce80 R15: 0000000000000000 [ 52.332789][ T3635] [ 52.341362][ T3635] memory: usage 80kB, limit 0kB, failcnt 0 [ 52.350862][ T3635] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 52.358401][ T3635] Memory cgroup stats for /syz0: [ 52.358544][ T3635] anon 0 [ 52.358544][ T3635] file 12288 [ 52.358544][ T3635] kernel 69632 [ 52.358544][ T3635] kernel_stack 0 [pid 3633] close(29) = -1 EBADF (Bad file descriptor) [pid 3633] exit_group(0) = ? [pid 3633] +++ exited with 0 +++ [pid 3625] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=53} --- [pid 3625] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 52.358544][ T3635] pagetables 0 [ 52.358544][ T3635] percpu 0 [ 52.358544][ T3635] sock 0 [ 52.358544][ T3635] vmalloc 0 [ 52.358544][ T3635] shmem 0 [ 52.358544][ T3635] zswap 0 [ 52.358544][ T3635] zswapped 0 [ 52.358544][ T3635] file_mapped 0 [ 52.358544][ T3635] file_dirty 0 [ 52.358544][ T3635] file_writeback 0 [ 52.358544][ T3635] swapcached 0 [ 52.358544][ T3635] anon_thp 0 [ 52.358544][ T3635] file_thp 0 [ 52.358544][ T3635] shmem_thp 0 [ 52.358544][ T3635] inactive_anon 0 [ 52.358544][ T3635] active_anon 0 [pid 3625] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 3625] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 3625] getdents64(3, 0x555555d52620 /* 7 entries */, 32768) = 208 [pid 3625] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3625] lstat("./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 3625] unlink("./0/binderfs") = 0 [pid 3625] umount2("./0/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3625] lstat("./0/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 3625] unlink("./0/cgroup") = 0 [pid 3625] umount2("./0/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3625] lstat("./0/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3625] unlink("./0/cgroup.net") = 0 [pid 3625] umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 3625] umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3625] lstat("./0/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3625] umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3625] openat(AT_FDCWD, "./0/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 3625] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3625] getdents64(4, 0x555555d5a660 /* 2 entries */, 32768) = 48 [pid 3625] getdents64(4, 0x555555d5a660 /* 0 entries */, 32768) = 0 [pid 3625] close(4) = 0 [pid 3625] rmdir("./0/file0") = 0 [pid 3625] umount2("./0/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3625] lstat("./0/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3625] unlink("./0/cgroup.cpu") = 0 [pid 3625] getdents64(3, 0x555555d52620 /* 0 entries */, 32768) = 0 [pid 3625] close(3) = 0 [ 52.358544][ T3635] inactive_file 8192 [ 52.358544][ T3635] active_file 4096 [ 52.358544][ T3635] unevictable 0 [ 52.358544][ T3635] slab_reclaimable 29520 [ 52.358544][ T3635] slab_unreclaimable 37656 [ 52.358544][ T3635] slab 67176 [ 52.358544][ T3635] workingset_refault_anon 0 [ 52.453968][ T3635] Tasks state (memory values in pages): [ 52.464586][ T3635] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 3625] rmdir("./0") = 0 [pid 3625] mkdir("./1", 0777 [pid 3635] <... sendfile resumed>) = 2 [pid 3625] <... mkdir resumed>) = 0 [pid 3635] close(3) = 0 [pid 3635] close(4) = 0 [pid 3635] close(5) = 0 [pid 3635] close(6) = 0 [pid 3635] close(7) = -1 EBADF (Bad file descriptor) [pid 3635] close(8) = -1 EBADF (Bad file descriptor) [pid 3635] close(9) = -1 EBADF (Bad file descriptor) [pid 3635] close(10) = -1 EBADF (Bad file descriptor) [pid 3635] close(11) = -1 EBADF (Bad file descriptor) [pid 3635] close(12) = -1 EBADF (Bad file descriptor) [pid 3635] close(13) = -1 EBADF (Bad file descriptor) [pid 3635] close(14) = -1 EBADF (Bad file descriptor) [pid 3635] close(15) = -1 EBADF (Bad file descriptor) [pid 3635] close(16) = -1 EBADF (Bad file descriptor) [pid 3635] close(17) = -1 EBADF (Bad file descriptor) [pid 3635] close(18) = -1 EBADF (Bad file descriptor) [pid 3635] close(19) = -1 EBADF (Bad file descriptor) [pid 3635] close(20) = -1 EBADF (Bad file descriptor) [pid 3635] close(21) = -1 EBADF (Bad file descriptor) [pid 3635] close(22) = -1 EBADF (Bad file descriptor) [pid 3635] close(23) = -1 EBADF (Bad file descriptor) [pid 3635] close(24) = -1 EBADF (Bad file descriptor) [pid 3635] close(25) = -1 EBADF (Bad file descriptor) [pid 3635] close(26) = -1 EBADF (Bad file descriptor) [pid 3635] close(27) = -1 EBADF (Bad file descriptor) [pid 3635] close(28) = -1 EBADF (Bad file descriptor) [pid 3635] close(29) = -1 EBADF (Bad file descriptor) [pid 3635] exit_group(0) = ? [pid 3635] +++ exited with 0 +++ [pid 3625] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 3624] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=53} --- [pid 3625] <... clone resumed>, child_tidptr=0x555555d515d0) = 3 ./strace-static-x86_64: Process 3643 attached [pid 3643] chdir("./1") = 0 [pid 3643] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3643] setpgid(0, 0) = 0 [pid 3643] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [pid 3643] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 3643] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 3643] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3643] write(3, "1000", 4) = 4 [pid 3643] close(3) = 0 [pid 3643] symlink("/dev/binderfs", "./binderfs") = 0 [pid 3643] mkdir("./file0", 000) = 0 [pid 3643] open("./file0", O_RDONLY) = 3 [pid 3643] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 3643] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 3643] openat(4, "syz0", O_RDWR|O_PATH) = 5 [pid 3643] openat(5, "memory.max", O_RDWR) = 6 [ 52.475022][ T3635] Out of memory and no killable processes... [ 52.481744][ T3632] syz-executor417 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 52.492466][ T3632] CPU: 1 PID: 3632 Comm: syz-executor417 Not tainted 5.19.0-rc7-syzkaller-00007-g353f7988dd84 #0 [ 52.502990][ T3632] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 [ 52.513060][ T3632] Call Trace: [ 52.516357][ T3632] [ 52.519304][ T3632] dump_stack_lvl+0x1e3/0x2cb [pid 3643] sendfile(6, 6, NULL, 2 [pid 3624] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3624] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 3624] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 3624] getdents64(3, 0x555555d52620 /* 7 entries */, 32768) = 208 [pid 3624] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3624] lstat("./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 3624] unlink("./0/binderfs") = 0 [pid 3624] umount2("./0/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3624] lstat("./0/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 3624] unlink("./0/cgroup") = 0 [pid 3624] umount2("./0/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3624] lstat("./0/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3624] unlink("./0/cgroup.net") = 0 [ 52.524013][ T3632] ? bfq_pos_tree_add_move+0x436/0x436 [ 52.529497][ T3632] ? panic+0x76e/0x76e [ 52.533600][ T3632] dump_header+0xdb/0x970 [ 52.537961][ T3632] out_of_memory+0x895/0xb30 [ 52.542578][ T3632] ? unregister_oom_notifier+0x20/0x20 [ 52.548064][ T3632] ? lockdep_hardirqs_on_prepare+0x448/0x7b0 [ 52.554075][ T3632] mem_cgroup_out_of_memory+0x25d/0x3b0 [ 52.559645][ T3632] ? preempt_schedule_thunk+0x16/0x18 [ 52.565033][ T3632] ? mem_cgroup_oom_trylock+0x220/0x220 [ 52.570594][ T3632] ? cgroup_file_notify+0x123/0x190 [ 52.575814][ T3632] memory_max_write+0x364/0x4f0 [ 52.580714][ T3632] ? memory_max_show+0xa0/0xa0 [ 52.585510][ T3632] ? read_lock_is_recursive+0x10/0x10 [ 52.590918][ T3632] ? memory_max_show+0xa0/0xa0 [ 52.595682][ T3632] cgroup_file_write+0x2ab/0x780 [ 52.600629][ T3632] ? cgroup_seqfile_stop+0xd0/0xd0 [ 52.605755][ T3632] ? check_heap_object+0x23e/0x820 [ 52.610880][ T3632] ? cgroup_seqfile_stop+0xd0/0xd0 [ 52.615988][ T3632] kernfs_fop_write_iter+0x3ac/0x500 [ 52.621282][ T3632] do_iter_readv_writev+0x499/0x650 [ 52.626484][ T3632] ? generic_file_rw_checks+0x250/0x250 [ 52.632048][ T3632] ? bpf_lsm_file_permission+0x5/0x10 [ 52.637420][ T3632] ? security_file_permission+0xe0/0x5c0 [ 52.643056][ T3632] ? do_iter_write+0x147/0x7a0 [ 52.647820][ T3632] do_iter_write+0x1f1/0x7a0 [ 52.652413][ T3632] ? vfs_iter_write+0x69/0xa0 [ 52.657087][ T3632] iter_file_splice_write+0x830/0xff0 [ 52.662474][ T3632] ? splice_from_pipe+0x220/0x220 [ 52.667494][ T3632] ? generic_file_splice_read+0x46b/0x660 [ 52.673218][ T3632] ? splice_shrink_spd+0xb0/0xb0 [ 52.678162][ T3632] ? splice_from_pipe+0x220/0x220 [ 52.683192][ T3632] direct_splice_actor+0xe6/0x1c0 [ 52.688213][ T3632] splice_direct_to_actor+0x514/0xc20 [ 52.693578][ T3632] ? __lock_acquire+0x129a/0x1f80 [ 52.698607][ T3632] ? do_splice_direct+0x3f0/0x3f0 [ 52.703628][ T3632] ? pipe_to_sendpage+0x340/0x340 [ 52.708652][ T3632] ? bpf_lsm_file_permission+0x5/0x10 [ 52.714017][ T3632] ? security_file_permission+0xe0/0x5c0 [ 52.719664][ T3632] do_splice_direct+0x2a0/0x3f0 [ 52.724516][ T3632] ? splice_direct_to_actor+0xc20/0xc20 [ 52.730055][ T3632] ? rcu_read_lock_any_held+0xb3/0x150 [ 52.735530][ T3632] ? _raw_spin_lock_irqsave+0x120/0x120 [ 52.741077][ T3632] do_sendfile+0x623/0xf90 [ 52.745499][ T3632] ? do_pwritev+0x360/0x360 [ 52.749998][ T3632] ? _raw_spin_unlock_irq+0x2a/0x40 [ 52.755187][ T3632] ? ptrace_notify+0x245/0x340 [ 52.759951][ T3632] ? do_notify_parent+0xeb0/0xeb0 [ 52.764965][ T3632] ? lockdep_hardirqs_on_prepare+0x448/0x7b0 [ 52.770963][ T3632] __se_sys_sendfile64+0x178/0x1e0 [ 52.776087][ T3632] ? __x64_sys_sendfile64+0xa0/0xa0 [ 52.781311][ T3632] ? syscall_enter_from_user_mode+0x2e/0x1a0 [ 52.787310][ T3632] ? syscall_enter_from_user_mode+0x86/0x1a0 [ 52.793301][ T3632] do_syscall_64+0x2b/0x70 [ 52.797717][ T3632] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 52.803610][ T3632] RIP: 0033:0x7f647bbcde19 [ 52.808021][ T3632] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 52.827629][ T3632] RSP: 002b:00007ffd4087ce08 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 52.836044][ T3632] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f647bbcde19 [ 52.844016][ T3632] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000006 [ 52.851983][ T3632] RBP: 0000000000000000 R08: 00007ffd4087ce30 R09: 00007ffd4087ce30 [ 52.859947][ T3632] R10: 0000000000000002 R11: 0000000000000246 R12: 00007ffd4087ce2c [ 52.867912][ T3632] R13: 00007ffd4087ce40 R14: 00007ffd4087ce80 R15: 0000000000000000 [ 52.875892][ T3632] [pid 3624] umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [ 52.882708][ T3632] memory: usage 80kB, limit 0kB, failcnt 0 [ 52.890478][ T3632] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 52.899205][ T3632] Memory cgroup stats for /syz0: [ 52.899399][ T3632] anon 0 [ 52.899399][ T3632] file 12288 [ 52.899399][ T3632] kernel 69632 [ 52.899399][ T3632] kernel_stack 0 [ 52.899399][ T3632] pagetables 0 [ 52.899399][ T3632] percpu 0 [ 52.899399][ T3632] sock 0 [ 52.899399][ T3632] vmalloc 0 [ 52.899399][ T3632] shmem 0 [ 52.899399][ T3632] zswap 0 [ 52.899399][ T3632] zswapped 0 [ 52.899399][ T3632] file_mapped 0 [ 52.899399][ T3632] file_dirty 0 [ 52.899399][ T3632] file_writeback 0 [ 52.899399][ T3632] swapcached 0 [ 52.899399][ T3632] anon_thp 0 [ 52.899399][ T3632] file_thp 0 [ 52.899399][ T3632] shmem_thp 0 [ 52.899399][ T3632] inactive_anon 0 [ 52.899399][ T3632] active_anon 0 [ 52.899399][ T3632] inactive_file 8192 [ 52.899399][ T3632] active_file 4096 [ 52.899399][ T3632] unevictable 0 [ 52.899399][ T3632] slab_reclaimable 29520 [pid 3624] umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3624] lstat("./0/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3624] umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3624] openat(AT_FDCWD, "./0/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 3624] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3624] getdents64(4, 0x555555d5a660 /* 2 entries */, 32768) = 48 [pid 3624] getdents64(4, 0x555555d5a660 /* 0 entries */, 32768) = 0 [pid 3624] close(4) = 0 [pid 3624] rmdir("./0/file0") = 0 [pid 3624] umount2("./0/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3624] lstat("./0/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3624] unlink("./0/cgroup.cpu") = 0 [pid 3624] getdents64(3, 0x555555d52620 /* 0 entries */, 32768) = 0 [pid 3624] close(3) = 0 [pid 3624] rmdir("./0") = 0 [pid 3624] mkdir("./1", 0777) = 0 [pid 3624] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555d515d0) = 3 [ 52.899399][ T3632] slab_unreclaimable 37656 [ 52.899399][ T3632] slab 67176 [ 52.899399][ T3632] workingset_refault_anon 0 [ 52.996983][ T3632] Tasks state (memory values in pages): [ 53.002646][ T3632] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 53.012247][ T3632] Out of memory and no killable processes... [ 53.019617][ T3641] syz-executor417 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 ./strace-static-x86_64: Process 3644 attached [pid 3632] <... sendfile resumed>) = 2 [pid 3644] chdir("./1") = 0 [pid 3644] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3644] setpgid(0, 0) = 0 [pid 3644] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 3644] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 3644] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 3644] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3644] write(3, "1000", 4) = 4 [pid 3644] close(3) = 0 [pid 3644] symlink("/dev/binderfs", "./binderfs") = 0 [pid 3644] mkdir("./file0", 000) = 0 [pid 3644] open("./file0", O_RDONLY) = 3 [pid 3644] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 3644] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 3644] openat(4, "syz0", O_RDWR|O_PATH) = 5 [pid 3644] openat(5, "memory.max", O_RDWR) = 6 [ 53.030202][ T3641] CPU: 0 PID: 3641 Comm: syz-executor417 Not tainted 5.19.0-rc7-syzkaller-00007-g353f7988dd84 #0 [ 53.040811][ T3641] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 [ 53.050879][ T3641] Call Trace: [ 53.054172][ T3641] [ 53.057115][ T3641] dump_stack_lvl+0x1e3/0x2cb [ 53.061819][ T3641] ? bfq_pos_tree_add_move+0x436/0x436 [ 53.067291][ T3641] ? panic+0x76e/0x76e [ 53.071376][ T3641] dump_header+0xdb/0x970 [ 53.075736][ T3641] out_of_memory+0x895/0xb30 [pid 3644] sendfile(6, 6, NULL, 2 [pid 3632] close(3) = 0 [pid 3632] close(4) = 0 [pid 3632] close(5) = 0 [pid 3632] close(6) = 0 [pid 3632] close(7) = -1 EBADF (Bad file descriptor) [ 53.080352][ T3641] ? unregister_oom_notifier+0x20/0x20 [ 53.085817][ T3641] ? lockdep_hardirqs_on_prepare+0x448/0x7b0 [ 53.091822][ T3641] mem_cgroup_out_of_memory+0x25d/0x3b0 [ 53.097391][ T3641] ? mem_cgroup_oom_trylock+0x220/0x220 [ 53.102963][ T3641] ? cgroup_file_notify+0x123/0x190 [ 53.108187][ T3641] memory_max_write+0x364/0x4f0 [ 53.113078][ T3641] ? memory_max_show+0xa0/0xa0 [ 53.117871][ T3641] ? read_lock_is_recursive+0x10/0x10 [ 53.123264][ T3641] ? memory_max_show+0xa0/0xa0 [ 53.128054][ T3641] cgroup_file_write+0x2ab/0x780 [pid 3632] close(8) = -1 EBADF (Bad file descriptor) [pid 3632] close(9) = -1 EBADF (Bad file descriptor) [pid 3632] close(10) = -1 EBADF (Bad file descriptor) [pid 3632] close(11) = -1 EBADF (Bad file descriptor) [pid 3632] close(12) = -1 EBADF (Bad file descriptor) [pid 3632] close(13) = -1 EBADF (Bad file descriptor) [pid 3632] close(14) = -1 EBADF (Bad file descriptor) [pid 3632] close(15) = -1 EBADF (Bad file descriptor) [pid 3632] close(16) = -1 EBADF (Bad file descriptor) [ 53.133019][ T3641] ? cgroup_seqfile_stop+0xd0/0xd0 [ 53.138149][ T3641] ? check_heap_object+0x23e/0x820 [ 53.143291][ T3641] ? cgroup_seqfile_stop+0xd0/0xd0 [ 53.148418][ T3641] kernfs_fop_write_iter+0x3ac/0x500 [ 53.153740][ T3641] do_iter_readv_writev+0x499/0x650 [ 53.158967][ T3641] ? generic_file_rw_checks+0x250/0x250 [ 53.164588][ T3641] ? bpf_lsm_file_permission+0x5/0x10 [ 53.169973][ T3641] ? security_file_permission+0xe0/0x5c0 [ 53.175624][ T3641] ? do_iter_write+0x147/0x7a0 [ 53.180397][ T3641] do_iter_write+0x1f1/0x7a0 [ 53.185006][ T3641] ? vfs_iter_write+0x69/0xa0 [ 53.189690][ T3641] iter_file_splice_write+0x830/0xff0 [ 53.195095][ T3641] ? splice_from_pipe+0x220/0x220 [ 53.200145][ T3641] ? generic_file_splice_read+0x46b/0x660 [ 53.205859][ T3641] ? splice_shrink_spd+0xb0/0xb0 [ 53.210814][ T3641] ? splice_from_pipe+0x220/0x220 [ 53.215846][ T3641] direct_splice_actor+0xe6/0x1c0 [ 53.220880][ T3641] splice_direct_to_actor+0x514/0xc20 [ 53.226260][ T3641] ? __lock_acquire+0x129a/0x1f80 [ 53.231302][ T3641] ? do_splice_direct+0x3f0/0x3f0 [ 53.236349][ T3641] ? pipe_to_sendpage+0x340/0x340 [ 53.241392][ T3641] ? bpf_lsm_file_permission+0x5/0x10 [ 53.246780][ T3641] ? security_file_permission+0xe0/0x5c0 [ 53.252429][ T3641] do_splice_direct+0x2a0/0x3f0 [ 53.257289][ T3641] ? splice_direct_to_actor+0xc20/0xc20 [ 53.262854][ T3641] ? rcu_read_lock_any_held+0xb3/0x150 [ 53.268322][ T3641] ? _raw_spin_lock_irqsave+0x120/0x120 [ 53.273880][ T3641] do_sendfile+0x623/0xf90 [ 53.278310][ T3641] ? do_pwritev+0x360/0x360 [ 53.282822][ T3641] ? _raw_spin_unlock_irq+0x2a/0x40 [ 53.288029][ T3641] ? ptrace_notify+0x245/0x340 [ 53.292798][ T3641] ? do_notify_parent+0xeb0/0xeb0 [ 53.297827][ T3641] ? lockdep_hardirqs_on_prepare+0x448/0x7b0 [ 53.303860][ T3641] __se_sys_sendfile64+0x178/0x1e0 [ 53.308976][ T3641] ? __x64_sys_sendfile64+0xa0/0xa0 [ 53.314185][ T3641] ? syscall_enter_from_user_mode+0x2e/0x1a0 [ 53.320156][ T3641] ? syscall_enter_from_user_mode+0x86/0x1a0 [ 53.326130][ T3641] do_syscall_64+0x2b/0x70 [ 53.330536][ T3641] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 53.336428][ T3641] RIP: 0033:0x7f647bbcde19 [ 53.340844][ T3641] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 53.360457][ T3641] RSP: 002b:00007ffd4087ce08 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 53.368871][ T3641] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f647bbcde19 [ 53.376862][ T3641] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000006 [pid 3632] close(17) = -1 EBADF (Bad file descriptor) [pid 3632] close(18) = -1 EBADF (Bad file descriptor) [pid 3632] close(19) = -1 EBADF (Bad file descriptor) [pid 3632] close(20) = -1 EBADF (Bad file descriptor) [pid 3632] close(21) = -1 EBADF (Bad file descriptor) [pid 3632] close(22) = -1 EBADF (Bad file descriptor) [pid 3632] close(23) = -1 EBADF (Bad file descriptor) [pid 3632] close(24) = -1 EBADF (Bad file descriptor) [pid 3632] close(25) = -1 EBADF (Bad file descriptor) [pid 3632] close(26) = -1 EBADF (Bad file descriptor) [pid 3632] close(27) = -1 EBADF (Bad file descriptor) [pid 3632] close(28) = -1 EBADF (Bad file descriptor) [pid 3632] close(29) = -1 EBADF (Bad file descriptor) [pid 3632] exit_group(0) = ? [pid 3632] +++ exited with 0 +++ [pid 3626] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=54} --- [pid 3626] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3626] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 3626] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 3626] getdents64(3, 0x555555d52620 /* 7 entries */, 32768) = 208 [pid 3626] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3626] lstat("./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 3626] unlink("./0/binderfs") = 0 [pid 3626] umount2("./0/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3626] lstat("./0/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 3626] unlink("./0/cgroup") = 0 [pid 3626] umount2("./0/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3626] lstat("./0/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3626] unlink("./0/cgroup.net") = 0 [pid 3626] umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 3626] umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3626] lstat("./0/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3626] umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3626] openat(AT_FDCWD, "./0/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 3626] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3626] getdents64(4, 0x555555d5a660 /* 2 entries */, 32768) = 48 [pid 3626] getdents64(4, 0x555555d5a660 /* 0 entries */, 32768) = 0 [ 53.384874][ T3641] RBP: 0000000000000000 R08: 00007ffd4087ce30 R09: 00007ffd4087ce30 [ 53.392860][ T3641] R10: 0000000000000002 R11: 0000000000000246 R12: 00007ffd4087ce2c [ 53.400838][ T3641] R13: 00007ffd4087ce40 R14: 00007ffd4087ce80 R15: 0000000000000001 [ 53.408836][ T3641] [ 53.414926][ T3641] memory: usage 80kB, limit 0kB, failcnt 0 [ 53.423413][ T3641] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [pid 3626] close(4) = 0 [pid 3626] rmdir("./0/file0") = 0 [pid 3626] umount2("./0/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3626] lstat("./0/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3626] unlink("./0/cgroup.cpu") = 0 [pid 3626] getdents64(3, 0x555555d52620 /* 0 entries */, 32768) = 0 [pid 3626] close(3) = 0 [pid 3626] rmdir("./0") = 0 [pid 3626] mkdir("./1", 0777) = 0 [ 53.431219][ T3641] Memory cgroup stats for /syz0: [ 53.431400][ T3641] anon 0 [ 53.431400][ T3641] file 12288 [ 53.431400][ T3641] kernel 69632 [ 53.431400][ T3641] kernel_stack 0 [ 53.431400][ T3641] pagetables 0 [ 53.431400][ T3641] percpu 0 [ 53.431400][ T3641] sock 0 [ 53.431400][ T3641] vmalloc 0 [ 53.431400][ T3641] shmem 0 [ 53.431400][ T3641] zswap 0 [ 53.431400][ T3641] zswapped 0 [ 53.431400][ T3641] file_mapped 0 [ 53.431400][ T3641] file_dirty 0 [ 53.431400][ T3641] file_writeback 0 [ 53.431400][ T3641] swapcached 0 [ 53.431400][ T3641] anon_thp 0 [pid 3626] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3645 attached [pid 3645] chdir("./1" [pid 3626] <... clone resumed>, child_tidptr=0x555555d515d0) = 3 [pid 3645] <... chdir resumed>) = 0 [pid 3645] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3645] setpgid(0, 0) = 0 [pid 3645] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 3645] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [pid 3645] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 3645] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3645] write(3, "1000", 4) = 4 [pid 3645] close(3) = 0 [pid 3645] symlink("/dev/binderfs", "./binderfs") = 0 [pid 3645] mkdir("./file0", 000) = 0 [pid 3645] open("./file0", O_RDONLY) = 3 [pid 3645] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 3645] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 3645] openat(4, "syz0", O_RDWR|O_PATH) = 5 [pid 3645] openat(5, "memory.max", O_RDWR) = 6 [ 53.431400][ T3641] file_thp 0 [ 53.431400][ T3641] shmem_thp 0 [ 53.431400][ T3641] inactive_anon 0 [ 53.431400][ T3641] active_anon 0 [ 53.431400][ T3641] inactive_file 8192 [ 53.431400][ T3641] active_file 4096 [ 53.431400][ T3641] unevictable 0 [ 53.431400][ T3641] slab_reclaimable 29520 [ 53.431400][ T3641] slab_unreclaimable 37656 [ 53.431400][ T3641] slab 67176 [ 53.431400][ T3641] workingset_refault_anon 0 [ 53.528657][ T3641] Tasks state (memory values in pages): [pid 3645] sendfile(6, 6, NULL, 2 [pid 3641] <... sendfile resumed>) = 2 [pid 3641] close(3) = 0 [pid 3641] close(4) = 0 [pid 3641] close(5) = 0 [pid 3641] close(6) = 0 [pid 3641] close(7) = -1 EBADF (Bad file descriptor) [pid 3641] close(8) = -1 EBADF (Bad file descriptor) [pid 3641] close(9) = -1 EBADF (Bad file descriptor) [pid 3641] close(10) = -1 EBADF (Bad file descriptor) [pid 3641] close(11) = -1 EBADF (Bad file descriptor) [pid 3641] close(12) = -1 EBADF (Bad file descriptor) [pid 3641] close(13) = -1 EBADF (Bad file descriptor) [pid 3641] close(14) = -1 EBADF (Bad file descriptor) [pid 3641] close(15) = -1 EBADF (Bad file descriptor) [pid 3641] close(16) = -1 EBADF (Bad file descriptor) [pid 3641] close(17) = -1 EBADF (Bad file descriptor) [pid 3641] close(18) = -1 EBADF (Bad file descriptor) [pid 3641] close(19) = -1 EBADF (Bad file descriptor) [pid 3641] close(20) = -1 EBADF (Bad file descriptor) [pid 3641] close(21) = -1 EBADF (Bad file descriptor) [pid 3641] close(22) = -1 EBADF (Bad file descriptor) [pid 3641] close(23) = -1 EBADF (Bad file descriptor) [pid 3641] close(24) = -1 EBADF (Bad file descriptor) [pid 3641] close(25) = -1 EBADF (Bad file descriptor) [pid 3641] close(26) = -1 EBADF (Bad file descriptor) [pid 3641] close(27) = -1 EBADF (Bad file descriptor) [pid 3641] close(28) = -1 EBADF (Bad file descriptor) [pid 3641] close(29) = -1 EBADF (Bad file descriptor) [pid 3641] exit_group(0) = ? [pid 3641] +++ exited with 0 +++ [pid 3623] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3, si_uid=0, si_status=0, si_utime=0, si_stime=53} --- [ 53.534318][ T3641] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 53.544257][ T3641] Out of memory and no killable processes... [ 53.554480][ T3642] syz-executor417 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 53.566691][ T3642] CPU: 1 PID: 3642 Comm: syz-executor417 Not tainted 5.19.0-rc7-syzkaller-00007-g353f7988dd84 #0 [pid 3623] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3623] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 3623] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 3623] getdents64(3, 0x555555d52620 /* 7 entries */, 32768) = 208 [pid 3623] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3623] lstat("./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [ 53.577216][ T3642] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 [ 53.587288][ T3642] Call Trace: [ 53.590585][ T3642] [ 53.593535][ T3642] dump_stack_lvl+0x1e3/0x2cb [ 53.598240][ T3642] ? bfq_pos_tree_add_move+0x436/0x436 [ 53.603729][ T3642] ? panic+0x76e/0x76e [ 53.607840][ T3642] dump_header+0xdb/0x970 [ 53.612204][ T3642] out_of_memory+0x895/0xb30 [ 53.616821][ T3642] ? unregister_oom_notifier+0x20/0x20 [ 53.622292][ T3642] ? lockdep_hardirqs_on_prepare+0x448/0x7b0 [ 53.628329][ T3642] mem_cgroup_out_of_memory+0x25d/0x3b0 [ 53.633885][ T3642] ? preempt_schedule_thunk+0x16/0x18 [ 53.639266][ T3642] ? mem_cgroup_oom_trylock+0x220/0x220 [ 53.644838][ T3642] ? cgroup_file_notify+0x123/0x190 [ 53.650050][ T3642] memory_max_write+0x364/0x4f0 [ 53.654929][ T3642] ? memory_max_show+0xa0/0xa0 [ 53.659709][ T3642] ? read_lock_is_recursive+0x10/0x10 [ 53.665086][ T3642] ? memory_max_show+0xa0/0xa0 [ 53.669861][ T3642] cgroup_file_write+0x2ab/0x780 [ 53.674814][ T3642] ? cgroup_seqfile_stop+0xd0/0xd0 [ 53.679934][ T3642] ? check_heap_object+0x23e/0x820 [ 53.685065][ T3642] ? cgroup_seqfile_stop+0xd0/0xd0 [ 53.690197][ T3642] kernfs_fop_write_iter+0x3ac/0x500 [ 53.695506][ T3642] do_iter_readv_writev+0x499/0x650 [ 53.700719][ T3642] ? generic_file_rw_checks+0x250/0x250 [ 53.706281][ T3642] ? bpf_lsm_file_permission+0x5/0x10 [ 53.711673][ T3642] ? security_file_permission+0xe0/0x5c0 [ 53.717311][ T3642] ? do_iter_write+0x147/0x7a0 [ 53.722078][ T3642] do_iter_write+0x1f1/0x7a0 [ 53.726708][ T3642] ? vfs_iter_write+0x69/0xa0 [ 53.731397][ T3642] iter_file_splice_write+0x830/0xff0 [ 53.736806][ T3642] ? splice_from_pipe+0x220/0x220 [ 53.741836][ T3642] ? generic_file_splice_read+0x46b/0x660 [ 53.747548][ T3642] ? splice_shrink_spd+0xb0/0xb0 [ 53.752501][ T3642] ? splice_from_pipe+0x220/0x220 [ 53.757536][ T3642] direct_splice_actor+0xe6/0x1c0 [ 53.762564][ T3642] splice_direct_to_actor+0x514/0xc20 [ 53.767962][ T3642] ? __lock_acquire+0x129a/0x1f80 [ 53.773005][ T3642] ? do_splice_direct+0x3f0/0x3f0 [ 53.778041][ T3642] ? pipe_to_sendpage+0x340/0x340 [ 53.783068][ T3642] ? bpf_lsm_file_permission+0x5/0x10 [ 53.788446][ T3642] ? security_file_permission+0xe0/0x5c0 [ 53.794088][ T3642] do_splice_direct+0x2a0/0x3f0 [ 53.798979][ T3642] ? splice_direct_to_actor+0xc20/0xc20 [ 53.804522][ T3642] ? rcu_read_lock_any_held+0xb3/0x150 [ 53.810007][ T3642] ? _raw_spin_lock_irqsave+0x120/0x120 [ 53.815565][ T3642] do_sendfile+0x623/0xf90 [ 53.819996][ T3642] ? do_pwritev+0x360/0x360 [ 53.824514][ T3642] ? _raw_spin_unlock_irq+0x2a/0x40 [ 53.829718][ T3642] ? ptrace_notify+0x245/0x340 [ 53.834489][ T3642] ? do_notify_parent+0xeb0/0xeb0 [ 53.839516][ T3642] ? lockdep_hardirqs_on_prepare+0x448/0x7b0 [ 53.845488][ T3642] __se_sys_sendfile64+0x178/0x1e0 [ 53.850605][ T3642] ? __x64_sys_sendfile64+0xa0/0xa0 [ 53.855811][ T3642] ? syscall_enter_from_user_mode+0x2e/0x1a0 [ 53.861787][ T3642] ? syscall_enter_from_user_mode+0x86/0x1a0 [ 53.867761][ T3642] do_syscall_64+0x2b/0x70 [ 53.872181][ T3642] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 53.878068][ T3642] RIP: 0033:0x7f647bbcde19 [ 53.882483][ T3642] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 53.902095][ T3642] RSP: 002b:00007ffd4087ce08 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 53.910500][ T3642] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f647bbcde19 [ 53.918460][ T3642] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000006 [ 53.926522][ T3642] RBP: 0000000000000000 R08: 00007ffd4087ce30 R09: 00007ffd4087ce30 [pid 3623] unlink("./1/binderfs") = 0 [pid 3623] umount2("./1/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3623] lstat("./1/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 3623] unlink("./1/cgroup") = 0 [pid 3623] umount2("./1/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3623] lstat("./1/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3623] unlink("./1/cgroup.net") = 0 [ 53.934498][ T3642] R10: 0000000000000002 R11: 0000000000000246 R12: 00007ffd4087ce2c [ 53.942462][ T3642] R13: 00007ffd4087ce40 R14: 00007ffd4087ce80 R15: 0000000000000001 [ 53.950442][ T3642] [ 53.957346][ T3642] memory: usage 80kB, limit 0kB, failcnt 0 [ 53.963614][ T3642] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 53.973153][ T3642] Memory cgroup stats for /syz0: [ 53.973353][ T3642] anon 0 [ 53.973353][ T3642] file 12288 [ 53.973353][ T3642] kernel 69632 [ 53.973353][ T3642] kernel_stack 0 [ 53.973353][ T3642] pagetables 0 [ 53.973353][ T3642] percpu 0 [ 53.973353][ T3642] sock 0 [ 53.973353][ T3642] vmalloc 0 [ 53.973353][ T3642] shmem 0 [ 53.973353][ T3642] zswap 0 [ 53.973353][ T3642] zswapped 0 [ 53.973353][ T3642] file_mapped 0 [ 53.973353][ T3642] file_dirty 0 [ 53.973353][ T3642] file_writeback 0 [ 53.973353][ T3642] swapcached 0 [ 53.973353][ T3642] anon_thp 0 [ 53.973353][ T3642] file_thp 0 [ 53.973353][ T3642] shmem_thp 0 [ 53.973353][ T3642] inactive_anon 0 [ 53.973353][ T3642] active_anon 0 [ 53.973353][ T3642] inactive_file 8192 [ 53.973353][ T3642] active_file 4096 [ 53.973353][ T3642] unevictable 0 [ 53.973353][ T3642] slab_reclaimable 29520 [ 53.973353][ T3642] slab_unreclaimable 37656 [ 53.973353][ T3642] slab 67176 [ 53.973353][ T3642] workingset_refault_anon 0 [ 54.070371][ T3642] Tasks state (memory values in pages): [ 54.075950][ T3642] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 3623] umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 3642] <... sendfile resumed>) = 2 [pid 3623] <... umount2 resumed>) = 0 [pid 3642] close(3 [pid 3623] umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 3642] <... close resumed>) = 0 [pid 3623] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [ 54.085497][ T3642] Out of memory and no killable processes... [ 54.091850][ T3643] syz-executor417 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 54.113501][ T8] INFO: trying to register non-static key. [ 54.119339][ T8] The code is fine but needs lockdep annotation, or maybe [ 54.126444][ T8] you didn't initialize this object before use? [ 54.132681][ T8] turning off the locking correctness validator. [ 54.138999][ T8] CPU: 0 PID: 8 Comm: kworker/u4:0 Not tainted 5.19.0-rc7-syzkaller-00007-g353f7988dd84 #0 [ 54.148996][ T8] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 [ 54.159047][ T8] Workqueue: netns cleanup_net [ 54.163822][ T8] Call Trace: [ 54.167088][ T8] [ 54.170014][ T8] dump_stack_lvl+0x1e3/0x2cb [ 54.174706][ T8] ? bfq_pos_tree_add_move+0x436/0x436 [ 54.180168][ T8] ? panic+0x76e/0x76e [ 54.184231][ T8] ? __is_module_percpu_address+0x3fc/0x4a0 [ 54.190121][ T8] ? __module_address+0x2e/0x2b0 [ 54.195049][ T8] assign_lock_key+0x22a/0x240 [ 54.199811][ T8] ? SOFTIRQ_verbose+0x10/0x10 [ 54.204607][ T8] register_lock_class+0x287/0x9d0 [ 54.209719][ T8] ? reacquire_held_locks+0x680/0x680 [ 54.215087][ T8] ? is_dynamic_key+0x1f0/0x1f0 [ 54.219946][ T8] __lock_acquire+0xe9/0x1f80 [ 54.224621][ T8] lock_acquire+0x1a7/0x400 [ 54.229117][ T8] ? ieee80211_do_stop+0x115/0x1cf0 [ 54.234315][ T8] ? read_lock_is_recursive+0x10/0x10 [ 54.239682][ T8] ? __local_bh_disable_ip+0x183/0x210 [ 54.245132][ T8] ? ieee80211_do_stop+0x115/0x1cf0 [ 54.250320][ T8] ? __bpf_trace_softirq+0x10/0x10 [ 54.255421][ T8] ? trace_raw_output_contention_end+0xd0/0xd0 [ 54.261577][ T8] ? rcu_read_lock_sched_held+0x89/0x130 [ 54.267217][ T8] ? ieee80211_do_stop+0x115/0x1cf0 [ 54.272411][ T8] _raw_spin_lock_bh+0x31/0x40 [ 54.277170][ T8] ? ieee80211_do_stop+0x115/0x1cf0 [ 54.282362][ T8] ieee80211_do_stop+0x115/0x1cf0 [ 54.287392][ T8] ? ieee80211_stop+0x452/0x4d0 [ 54.292241][ T8] ? lockdep_hardirqs_on+0x95/0x140 [ 54.297436][ T8] ? __local_bh_enable_ip+0x163/0x1f0 [ 54.302806][ T8] ? ieee80211_sdata_stop+0x70/0x70 [ 54.308001][ T8] ? do_raw_spin_unlock+0x134/0x8a0 [ 54.313194][ T8] ? dev_deactivate_many+0xb54/0xe30 [ 54.318473][ T8] ieee80211_stop+0x45f/0x4d0 [ 54.323157][ T8] ? ieee80211_open+0x1f0/0x1f0 [ 54.328007][ T8] __dev_close_many+0x2ef/0x3e0 [ 54.332855][ T8] ? dev_close_many+0x5d0/0x5d0 [ 54.337713][ T8] dev_close_many+0x275/0x5d0 [ 54.342386][ T8] ? __dev_open+0x510/0x510 [ 54.346888][ T8] dev_close+0x1b1/0x2b0 [ 54.351140][ T8] ? __dev_close_many+0x3e0/0x3e0 [ 54.356164][ T8] ? trace_contention_end+0x4b/0x140 [ 54.361528][ T8] cfg80211_shutdown_all_interfaces+0xc0/0x1e0 [ 54.367684][ T8] ieee80211_remove_interfaces+0x19a/0x840 [ 54.373499][ T8] ? _raw_spin_unlock_irqrestore+0x8b/0x130 [ 54.379389][ T8] ? mutex_lock_io_nested+0x60/0x60 [ 54.384583][ T8] ? _raw_spin_unlock_irqrestore+0xd9/0x130 [ 54.390471][ T8] ? ieee80211_do_stop+0x1cf0/0x1cf0 [ 54.395764][ T8] ? do_raw_spin_unlock+0x134/0x8a0 [ 54.400962][ T8] ieee80211_unregister_hw+0x57/0x220 [ 54.406331][ T8] mac80211_hwsim_del_radio+0x2ba/0x4a0 [ 54.411874][ T8] ? rhashtable_remove_fast+0xa40/0xa40 [ 54.417433][ T8] hwsim_exit_net+0x5d3/0x680 [ 54.422108][ T8] ? hwsim_init_net+0x80/0x80 [ 54.426782][ T8] ? __ip_vs_dev_cleanup_batch+0x250/0x270 [ 54.432589][ T8] cleanup_net+0x758/0xc50 [ 54.437021][ T8] ? ops_free_list+0x350/0x350 [ 54.441781][ T8] ? _raw_spin_unlock_irq+0x1f/0x40 [ 54.446971][ T8] process_one_work+0x81c/0xd10 [ 54.451822][ T8] ? worker_detach_from_pool+0x260/0x260 [ 54.457447][ T8] ? _raw_spin_lock_irqsave+0x120/0x120 [ 54.462995][ T8] ? kthread_data+0x4d/0xc0 [ 54.467488][ T8] ? wq_worker_running+0x95/0x190 [ 54.472503][ T8] worker_thread+0xb14/0x1330 [ 54.477189][ T8] kthread+0x266/0x300 [ 54.481244][ T8] ? rcu_lock_release+0x20/0x20 [ 54.486085][ T8] ? kthread_blkcg+0xd0/0xd0 [pid 3642] close(4 [pid 3623] lstat("./1/file0", [pid 3642] <... close resumed>) = 0 [pid 3623] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3623] umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3623] openat(AT_FDCWD, "./1/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 3623] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3623] getdents64(4, 0x555555d5a660 /* 2 entries */, 32768) = 48 [pid 3623] getdents64(4, 0x555555d5a660 /* 0 entries */, 32768) = 0 [pid 3623] close(4) = 0 [pid 3623] rmdir("./1/file0") = 0 [pid 3623] umount2("./1/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3623] lstat("./1/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3623] unlink("./1/cgroup.cpu") = 0 [pid 3623] getdents64(3, 0x555555d52620 /* 0 entries */, 32768) = 0 [pid 3623] close(3) = 0 [pid 3623] rmdir("./1") = 0 [pid 3623] mkdir("./2", 0777) = 0 [pid 3623] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3646 attached [pid 3646] chdir("./2" [pid 3623] <... clone resumed>, child_tidptr=0x555555d515d0) = 4 [pid 3646] <... chdir resumed>) = 0 [pid 3646] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3646] setpgid(0, 0) = 0 [pid 3646] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 3646] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 3646] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [pid 3646] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3646] write(3, "1000", 4) = 4 [pid 3646] close(3) = 0 [pid 3646] symlink("/dev/binderfs", "./binderfs") = 0 [pid 3646] mkdir("./file0", 000) = 0 [pid 3646] open("./file0", O_RDONLY) = 3 [pid 3646] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 3646] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 3646] openat(4, "syz0", O_RDWR|O_PATH) = 5 [pid 3646] openat(5, "memory.max", O_RDWR) = 6 [ 54.490666][ T8] ret_from_fork+0x1f/0x30 [ 54.495087][ T8] [ 54.502987][ T3643] CPU: 1 PID: 3643 Comm: syz-executor417 Not tainted 5.19.0-rc7-syzkaller-00007-g353f7988dd84 #0 [ 54.513517][ T3643] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 [ 54.523584][ T3643] Call Trace: [ 54.526868][ T3643] [ 54.529809][ T3643] dump_stack_lvl+0x1e3/0x2cb [ 54.534505][ T3643] ? bfq_pos_tree_add_move+0x436/0x436 [pid 3646] sendfile(6, 6, NULL, 2 [pid 3642] close(5) = 0 [pid 3642] close(6) = 0 [pid 3642] close(7) = -1 EBADF (Bad file descriptor) [pid 3642] close(8) = -1 EBADF (Bad file descriptor) [pid 3642] close(9) = -1 EBADF (Bad file descriptor) [pid 3642] close(10) = -1 EBADF (Bad file descriptor) [pid 3642] close(11) = -1 EBADF (Bad file descriptor) [pid 3642] close(12) = -1 EBADF (Bad file descriptor) [pid 3642] close(13) = -1 EBADF (Bad file descriptor) [pid 3642] close(14) = -1 EBADF (Bad file descriptor) [pid 3642] close(15) = -1 EBADF (Bad file descriptor) [pid 3642] close(16) = -1 EBADF (Bad file descriptor) [pid 3642] close(17) = -1 EBADF (Bad file descriptor) [pid 3642] close(18) = -1 EBADF (Bad file descriptor) [pid 3642] close(19) = -1 EBADF (Bad file descriptor) [pid 3642] close(20) = -1 EBADF (Bad file descriptor) [pid 3642] close(21) = -1 EBADF (Bad file descriptor) [pid 3642] close(22) = -1 EBADF (Bad file descriptor) [pid 3642] close(23) = -1 EBADF (Bad file descriptor) [pid 3642] close(24) = -1 EBADF (Bad file descriptor) [pid 3642] close(25) = -1 EBADF (Bad file descriptor) [pid 3642] close(26) = -1 EBADF (Bad file descriptor) [pid 3642] close(27) = -1 EBADF (Bad file descriptor) [pid 3642] close(28) = -1 EBADF (Bad file descriptor) [pid 3642] close(29) = -1 EBADF (Bad file descriptor) [pid 3642] exit_group(0) = ? [pid 3642] +++ exited with 0 +++ [pid 3622] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3, si_uid=0, si_status=0, si_utime=0, si_stime=55} --- [pid 3622] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 3622] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3622] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 3622] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 3622] getdents64(3, 0x555555d52620 /* 7 entries */, 32768) = 208 [pid 3622] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3622] lstat("./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 3622] unlink("./1/binderfs") = 0 [pid 3622] umount2("./1/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3622] lstat("./1/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 3622] unlink("./1/cgroup") = 0 [pid 3622] umount2("./1/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3622] lstat("./1/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3622] unlink("./1/cgroup.net") = 0 [ 54.539990][ T3643] ? panic+0x76e/0x76e [ 54.544077][ T3643] dump_header+0xdb/0x970 [ 54.548419][ T3643] out_of_memory+0x895/0xb30 [ 54.553025][ T3643] ? unregister_oom_notifier+0x20/0x20 [ 54.558493][ T3643] ? lockdep_hardirqs_on_prepare+0x448/0x7b0 [ 54.564496][ T3643] mem_cgroup_out_of_memory+0x25d/0x3b0 [ 54.570061][ T3643] ? mem_cgroup_oom_trylock+0x220/0x220 [ 54.575629][ T3643] ? cgroup_file_notify+0x123/0x190 [ 54.580833][ T3643] memory_max_write+0x364/0x4f0 [ 54.585683][ T3643] ? memory_max_show+0xa0/0xa0 [ 54.590447][ T3643] ? read_lock_is_recursive+0x10/0x10 [ 54.595807][ T3643] ? memory_max_show+0xa0/0xa0 [ 54.600573][ T3643] cgroup_file_write+0x2ab/0x780 [ 54.605850][ T3643] ? cgroup_seqfile_stop+0xd0/0xd0 [ 54.610968][ T3643] ? check_heap_object+0x23e/0x820 [ 54.616079][ T3643] ? cgroup_seqfile_stop+0xd0/0xd0 [ 54.621178][ T3643] kernfs_fop_write_iter+0x3ac/0x500 [ 54.626488][ T3643] do_iter_readv_writev+0x499/0x650 [ 54.631684][ T3643] ? generic_file_rw_checks+0x250/0x250 [ 54.637244][ T3643] ? bpf_lsm_file_permission+0x5/0x10 [ 54.642622][ T3643] ? security_file_permission+0xe0/0x5c0 [ 54.648262][ T3643] ? do_iter_write+0x147/0x7a0 [ 54.653125][ T3643] do_iter_write+0x1f1/0x7a0 [ 54.657724][ T3643] ? vfs_iter_write+0x69/0xa0 [ 54.662406][ T3643] iter_file_splice_write+0x830/0xff0 [ 54.667797][ T3643] ? splice_from_pipe+0x220/0x220 [ 54.672826][ T3643] ? generic_file_splice_read+0x46b/0x660 [ 54.678555][ T3643] ? splice_shrink_spd+0xb0/0xb0 [ 54.683504][ T3643] ? splice_from_pipe+0x220/0x220 [ 54.688527][ T3643] direct_splice_actor+0xe6/0x1c0 [ 54.693543][ T3643] splice_direct_to_actor+0x514/0xc20 [ 54.698923][ T3643] ? __lock_acquire+0x129a/0x1f80 [ 54.703941][ T3643] ? do_splice_direct+0x3f0/0x3f0 [ 54.708969][ T3643] ? pipe_to_sendpage+0x340/0x340 [ 54.713976][ T3643] ? bpf_lsm_file_permission+0x5/0x10 [ 54.719330][ T3643] ? security_file_permission+0xe0/0x5c0 [ 54.724948][ T3643] do_splice_direct+0x2a0/0x3f0 [ 54.729782][ T3643] ? splice_direct_to_actor+0xc20/0xc20 [ 54.735324][ T3643] ? rcu_read_lock_any_held+0xb3/0x150 [ 54.740784][ T3643] do_sendfile+0x623/0xf90 [ 54.745186][ T3643] ? do_pwritev+0x360/0x360 [ 54.749682][ T3643] ? _raw_spin_unlock_irq+0x2a/0x40 [ 54.754883][ T3643] ? ptrace_notify+0x245/0x340 [ 54.759652][ T3643] ? do_notify_parent+0xeb0/0xeb0 [ 54.764688][ T3643] ? lockdep_hardirqs_on+0x95/0x140 [ 54.769891][ T3643] __se_sys_sendfile64+0x178/0x1e0 [ 54.774989][ T3643] ? __x64_sys_sendfile64+0xa0/0xa0 [ 54.780171][ T3643] ? syscall_enter_from_user_mode+0x86/0x1a0 [ 54.786148][ T3643] do_syscall_64+0x2b/0x70 [ 54.790573][ T3643] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 54.796474][ T3643] RIP: 0033:0x7f647bbcde19 [ 54.800878][ T3643] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 54.820468][ T3643] RSP: 002b:00007ffd4087ce08 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 54.828870][ T3643] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f647bbcde19 [pid 3622] umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 3622] umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3622] lstat("./1/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3622] umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3622] openat(AT_FDCWD, "./1/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 3622] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3622] getdents64(4, 0x555555d5a660 /* 2 entries */, 32768) = 48 [pid 3622] getdents64(4, 0x555555d5a660 /* 0 entries */, 32768) = 0 [pid 3622] close(4) = 0 [pid 3622] rmdir("./1/file0") = 0 [pid 3622] umount2("./1/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3622] lstat("./1/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [ 54.836825][ T3643] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000006 [ 54.844785][ T3643] RBP: 0000000000000000 R08: 00007ffd4087ce30 R09: 00007ffd4087ce30 [ 54.853001][ T3643] R10: 0000000000000002 R11: 0000000000000246 R12: 00007ffd4087ce2c [ 54.860956][ T3643] R13: 00007ffd4087ce40 R14: 00007ffd4087ce80 R15: 0000000000000001 [ 54.868922][ T3643] [ 54.873115][ T3643] memory: usage 80kB, limit 0kB, failcnt 0 [ 54.878985][ T3643] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 54.885849][ T3643] Memory cgroup stats for /syz0: [pid 3622] unlink("./1/cgroup.cpu") = 0 [pid 3622] getdents64(3, 0x555555d52620 /* 0 entries */, 32768) = 0 [pid 3622] close(3) = 0 [pid 3622] rmdir("./1") = 0 [pid 3622] mkdir("./2", 0777) = 0 [pid 3622] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555d515d0) = 4 ./strace-static-x86_64: Process 3647 attached [pid 3647] chdir("./2") = 0 [pid 3647] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3647] setpgid(0, 0) = 0 [pid 3647] symlink("/syzcgroup/unified/syz1", "./cgroup") = 0 [pid 3647] symlink("/syzcgroup/cpu/syz1", "./cgroup.cpu") = 0 [pid 3647] symlink("/syzcgroup/net/syz1", "./cgroup.net") = 0 [pid 3647] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3647] write(3, "1000", 4) = 4 [pid 3647] close(3) = 0 [pid 3647] symlink("/dev/binderfs", "./binderfs") = 0 [pid 3647] mkdir("./file0", 000) = 0 [pid 3647] open("./file0", O_RDONLY) = 3 [pid 3647] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 3647] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 3647] openat(4, "syz0", O_RDWR|O_PATH) = 5 [pid 3647] openat(5, "memory.max", O_RDWR) = 6 [ 54.886003][ T3643] anon 0 [ 54.886003][ T3643] file 12288 [ 54.886003][ T3643] kernel 69632 [ 54.886003][ T3643] kernel_stack 0 [ 54.886003][ T3643] pagetables 0 [ 54.886003][ T3643] percpu 0 [ 54.886003][ T3643] sock 0 [ 54.886003][ T3643] vmalloc 0 [ 54.886003][ T3643] shmem 0 [ 54.886003][ T3643] zswap 0 [ 54.886003][ T3643] zswapped 0 [ 54.886003][ T3643] file_mapped 0 [ 54.886003][ T3643] file_dirty 0 [ 54.886003][ T3643] file_writeback 0 [ 54.886003][ T3643] swapcached 0 [ 54.886003][ T3643] anon_thp 0 [ 54.886003][ T3643] file_thp 0 [ 54.886003][ T3643] shmem_thp 0 [ 54.886003][ T3643] inactive_anon 0 [ 54.886003][ T3643] active_anon 0 [ 54.886003][ T3643] inactive_file 4096 [ 54.886003][ T3643] active_file 8192 [ 54.886003][ T3643] unevictable 0 [ 54.886003][ T3643] slab_reclaimable 29520 [ 54.886003][ T3643] slab_unreclaimable 37656 [ 54.886003][ T3643] slab 67176 [ 54.886003][ T3643] workingset_refault_anon 0 [ 54.980413][ T3643] Tasks state (memory values in pages): [pid 3647] sendfile(6, 6, NULL, 2 [pid 3643] <... sendfile resumed>) = 2 [pid 3643] close(3) = 0 [pid 3643] close(4) = 0 [pid 3643] close(5) = 0 [pid 3643] close(6) = 0 [pid 3643] close(7) = -1 EBADF (Bad file descriptor) [pid 3643] close(8) = -1 EBADF (Bad file descriptor) [pid 3643] close(9) = -1 EBADF (Bad file descriptor) [pid 3643] close(10) = -1 EBADF (Bad file descriptor) [pid 3643] close(11) = -1 EBADF (Bad file descriptor) [pid 3643] close(12) = -1 EBADF (Bad file descriptor) [pid 3643] close(13) = -1 EBADF (Bad file descriptor) [pid 3643] close(14) = -1 EBADF (Bad file descriptor) [pid 3643] close(15) = -1 EBADF (Bad file descriptor) [pid 3643] close(16) = -1 EBADF (Bad file descriptor) [pid 3643] close(17) = -1 EBADF (Bad file descriptor) [pid 3643] close(18) = -1 EBADF (Bad file descriptor) [pid 3643] close(19) = -1 EBADF (Bad file descriptor) [pid 3643] close(20) = -1 EBADF (Bad file descriptor) [pid 3643] close(21) = -1 EBADF (Bad file descriptor) [pid 3643] close(22) = -1 EBADF (Bad file descriptor) [pid 3643] close(23) = -1 EBADF (Bad file descriptor) [pid 3643] close(24) = -1 EBADF (Bad file descriptor) [pid 3643] close(25) = -1 EBADF (Bad file descriptor) [pid 3643] close(26) = -1 EBADF (Bad file descriptor) [pid 3643] close(27) = -1 EBADF (Bad file descriptor) [pid 3643] close(28) = -1 EBADF (Bad file descriptor) [pid 3643] close(29) = -1 EBADF (Bad file descriptor) [pid 3643] exit_group(0) = ? [pid 3643] +++ exited with 0 +++ [pid 3625] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3, si_uid=0, si_status=0, si_utime=0, si_stime=57} --- [pid 3625] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 3625] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3625] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 3625] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 3625] getdents64(3, 0x555555d52620 /* 7 entries */, 32768) = 208 [pid 3625] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3625] lstat("./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 3625] unlink("./1/binderfs") = 0 [pid 3625] umount2("./1/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3625] lstat("./1/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 3625] unlink("./1/cgroup") = 0 [pid 3625] umount2("./1/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3625] lstat("./1/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [ 54.985987][ T3643] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 54.995615][ T3643] Out of memory and no killable processes... [ 55.001990][ T3644] syz-executor417 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 55.012540][ T3644] CPU: 1 PID: 3644 Comm: syz-executor417 Not tainted 5.19.0-rc7-syzkaller-00007-g353f7988dd84 #0 [ 55.023058][ T3644] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 [ 55.033121][ T3644] Call Trace: [ 55.036407][ T3644] [pid 3625] unlink("./1/cgroup.net") = 0 [ 55.039344][ T3644] dump_stack_lvl+0x1e3/0x2cb [ 55.044040][ T3644] ? bfq_pos_tree_add_move+0x436/0x436 [ 55.049515][ T3644] ? panic+0x76e/0x76e [ 55.053600][ T3644] dump_header+0xdb/0x970 [ 55.057939][ T3644] out_of_memory+0x895/0xb30 [ 55.062544][ T3644] ? unregister_oom_notifier+0x20/0x20 [ 55.068003][ T3644] ? lockdep_hardirqs_on_prepare+0x448/0x7b0 [ 55.073982][ T3644] mem_cgroup_out_of_memory+0x25d/0x3b0 [ 55.079529][ T3644] ? preempt_schedule_thunk+0x16/0x18 [ 55.084892][ T3644] ? mem_cgroup_oom_trylock+0x220/0x220 [ 55.090448][ T3644] ? cgroup_file_notify+0x123/0x190 [ 55.095634][ T3644] memory_max_write+0x364/0x4f0 [ 55.100469][ T3644] ? memory_max_show+0xa0/0xa0 [ 55.105214][ T3644] ? read_lock_is_recursive+0x10/0x10 [ 55.110571][ T3644] ? memory_max_show+0xa0/0xa0 [ 55.115323][ T3644] cgroup_file_write+0x2ab/0x780 [ 55.120251][ T3644] ? cgroup_seqfile_stop+0xd0/0xd0 [ 55.125354][ T3644] ? check_heap_object+0x23e/0x820 [ 55.130464][ T3644] ? cgroup_seqfile_stop+0xd0/0xd0 [ 55.135563][ T3644] kernfs_fop_write_iter+0x3ac/0x500 [ 55.140846][ T3644] do_iter_readv_writev+0x499/0x650 [ 55.146035][ T3644] ? generic_file_rw_checks+0x250/0x250 [ 55.151576][ T3644] ? bpf_lsm_file_permission+0x5/0x10 [ 55.156933][ T3644] ? security_file_permission+0xe0/0x5c0 [ 55.162589][ T3644] ? do_iter_write+0x147/0x7a0 [ 55.167352][ T3644] do_iter_write+0x1f1/0x7a0 [ 55.171943][ T3644] ? vfs_iter_write+0x69/0xa0 [ 55.176609][ T3644] iter_file_splice_write+0x830/0xff0 [ 55.181981][ T3644] ? splice_from_pipe+0x220/0x220 [ 55.187004][ T3644] ? generic_file_splice_read+0x46b/0x660 [ 55.192721][ T3644] ? splice_shrink_spd+0xb0/0xb0 [ 55.197659][ T3644] ? splice_from_pipe+0x220/0x220 [ 55.202675][ T3644] direct_splice_actor+0xe6/0x1c0 [ 55.207690][ T3644] splice_direct_to_actor+0x514/0xc20 [ 55.213047][ T3644] ? __lock_acquire+0x129a/0x1f80 [ 55.218068][ T3644] ? do_splice_direct+0x3f0/0x3f0 [ 55.223092][ T3644] ? pipe_to_sendpage+0x340/0x340 [ 55.228129][ T3644] ? bpf_lsm_file_permission+0x5/0x10 [ 55.233509][ T3644] ? security_file_permission+0xe0/0x5c0 [ 55.239153][ T3644] do_splice_direct+0x2a0/0x3f0 [ 55.244002][ T3644] ? splice_direct_to_actor+0xc20/0xc20 [ 55.249538][ T3644] ? rcu_read_lock_any_held+0xb3/0x150 [ 55.254999][ T3644] ? _raw_spin_lock_irqsave+0x120/0x120 [ 55.260541][ T3644] do_sendfile+0x623/0xf90 [ 55.264960][ T3644] ? do_pwritev+0x360/0x360 [ 55.269460][ T3644] ? _raw_spin_unlock_irq+0x2a/0x40 [ 55.274648][ T3644] ? ptrace_notify+0x245/0x340 [ 55.279402][ T3644] ? do_notify_parent+0xeb0/0xeb0 [ 55.284411][ T3644] ? lockdep_hardirqs_on_prepare+0x448/0x7b0 [ 55.290383][ T3644] __se_sys_sendfile64+0x178/0x1e0 [ 55.295482][ T3644] ? __x64_sys_sendfile64+0xa0/0xa0 [ 55.300664][ T3644] ? syscall_enter_from_user_mode+0x2e/0x1a0 [ 55.306635][ T3644] ? syscall_enter_from_user_mode+0x86/0x1a0 [ 55.312601][ T3644] do_syscall_64+0x2b/0x70 [ 55.317008][ T3644] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 55.322887][ T3644] RIP: 0033:0x7f647bbcde19 [ 55.327291][ T3644] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 55.346882][ T3644] RSP: 002b:00007ffd4087ce08 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 55.355283][ T3644] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f647bbcde19 [ 55.363239][ T3644] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000006 [ 55.371206][ T3644] RBP: 0000000000000000 R08: 00007ffd4087ce30 R09: 00007ffd4087ce30 [ 55.379163][ T3644] R10: 0000000000000002 R11: 0000000000000246 R12: 00007ffd4087ce2c [pid 3625] umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 3625] umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3625] lstat("./1/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3625] umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3625] openat(AT_FDCWD, "./1/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 3625] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3625] getdents64(4, 0x555555d5a660 /* 2 entries */, 32768) = 48 [pid 3625] getdents64(4, 0x555555d5a660 /* 0 entries */, 32768) = 0 [pid 3625] close(4) = 0 [pid 3625] rmdir("./1/file0") = 0 [pid 3625] umount2("./1/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3625] lstat("./1/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3625] unlink("./1/cgroup.cpu") = 0 [pid 3625] getdents64(3, 0x555555d52620 /* 0 entries */, 32768) = 0 [pid 3625] close(3) = 0 [pid 3625] rmdir("./1") = 0 [pid 3625] mkdir("./2", 0777) = 0 [pid 3625] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555d515d0) = 4 ./strace-static-x86_64: Process 3649 attached [pid 3649] chdir("./2") = 0 [pid 3649] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3649] setpgid(0, 0) = 0 [pid 3649] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [pid 3649] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 3649] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 3649] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3649] write(3, "1000", 4) = 4 [ 55.387123][ T3644] R13: 00007ffd4087ce40 R14: 00007ffd4087ce80 R15: 0000000000000001 [ 55.395085][ T3644] [ 55.399328][ T3644] memory: usage 80kB, limit 0kB, failcnt 0 [ 55.405524][ T3644] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 55.412892][ T3644] Memory cgroup stats for /syz0: [ 55.413200][ T3644] anon 0 [ 55.413200][ T3644] file 12288 [ 55.413200][ T3644] kernel 69632 [ 55.413200][ T3644] kernel_stack 0 [ 55.413200][ T3644] pagetables 0 [ 55.413200][ T3644] percpu 0 [ 55.413200][ T3644] sock 0 [ 55.413200][ T3644] vmalloc 0 [pid 3649] close(3) = 0 [pid 3649] symlink("/dev/binderfs", "./binderfs") = 0 [pid 3649] mkdir("./file0", 000) = 0 [pid 3649] open("./file0", O_RDONLY) = 3 [pid 3649] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 3649] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 3649] openat(4, "syz0", O_RDWR|O_PATH) = 5 [pid 3649] openat(5, "memory.max", O_RDWR) = 6 [ 55.413200][ T3644] shmem 0 [ 55.413200][ T3644] zswap 0 [ 55.413200][ T3644] zswapped 0 [ 55.413200][ T3644] file_mapped 0 [ 55.413200][ T3644] file_dirty 0 [ 55.413200][ T3644] file_writeback 0 [ 55.413200][ T3644] swapcached 0 [ 55.413200][ T3644] anon_thp 0 [ 55.413200][ T3644] file_thp 0 [ 55.413200][ T3644] shmem_thp 0 [ 55.413200][ T3644] inactive_anon 0 [ 55.413200][ T3644] active_anon 0 [ 55.413200][ T3644] inactive_file 8192 [ 55.413200][ T3644] active_file 4096 [ 55.413200][ T3644] unevictable 0 [ 55.413200][ T3644] slab_reclaimable 29520 [pid 3649] sendfile(6, 6, NULL, 2 [pid 3644] <... sendfile resumed>) = 2 [pid 3644] close(3) = 0 [pid 3644] close(4) = 0 [pid 3644] close(5) = 0 [pid 3644] close(6) = 0 [pid 3644] close(7) = -1 EBADF (Bad file descriptor) [pid 3644] close(8) = -1 EBADF (Bad file descriptor) [pid 3644] close(9) = -1 EBADF (Bad file descriptor) [pid 3644] close(10) = -1 EBADF (Bad file descriptor) [pid 3644] close(11) = -1 EBADF (Bad file descriptor) [pid 3644] close(12) = -1 EBADF (Bad file descriptor) [pid 3644] close(13) = -1 EBADF (Bad file descriptor) [pid 3644] close(14) = -1 EBADF (Bad file descriptor) [ 55.413200][ T3644] slab_unreclaimable 37656 [ 55.413200][ T3644] slab 67176 [ 55.413200][ T3644] workingset_refault_anon 0 [ 55.507773][ T3644] Tasks state (memory values in pages): [ 55.513355][ T3644] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 55.522870][ T3644] Out of memory and no killable processes... [ 55.528932][ T3645] syz-executor417 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 3644] close(15) = -1 EBADF (Bad file descriptor) [pid 3644] close(16) = -1 EBADF (Bad file descriptor) [pid 3644] close(17) = -1 EBADF (Bad file descriptor) [pid 3644] close(18) = -1 EBADF (Bad file descriptor) [pid 3644] close(19) = -1 EBADF (Bad file descriptor) [pid 3644] close(20) = -1 EBADF (Bad file descriptor) [pid 3644] close(21) = -1 EBADF (Bad file descriptor) [pid 3644] close(22) = -1 EBADF (Bad file descriptor) [pid 3644] close(23) = -1 EBADF (Bad file descriptor) [pid 3644] close(24) = -1 EBADF (Bad file descriptor) [pid 3644] close(25) = -1 EBADF (Bad file descriptor) [pid 3644] close(26) = -1 EBADF (Bad file descriptor) [pid 3644] close(27) = -1 EBADF (Bad file descriptor) [pid 3644] close(28) = -1 EBADF (Bad file descriptor) [pid 3644] close(29) = -1 EBADF (Bad file descriptor) [pid 3644] exit_group(0) = ? [pid 3644] +++ exited with 0 +++ [pid 3624] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3, si_uid=0, si_status=0, si_utime=0, si_stime=54} --- [pid 3624] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3624] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 3624] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 3624] getdents64(3, 0x555555d52620 /* 7 entries */, 32768) = 208 [pid 3624] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3624] lstat("./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 3624] unlink("./1/binderfs") = 0 [pid 3624] umount2("./1/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3624] lstat("./1/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 3624] unlink("./1/cgroup") = 0 [pid 3624] umount2("./1/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3624] lstat("./1/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3624] unlink("./1/cgroup.net") = 0 [ 55.540370][ T3645] CPU: 1 PID: 3645 Comm: syz-executor417 Not tainted 5.19.0-rc7-syzkaller-00007-g353f7988dd84 #0 [ 55.550887][ T3645] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 [ 55.560952][ T3645] Call Trace: [ 55.564240][ T3645] [ 55.567188][ T3645] dump_stack_lvl+0x1e3/0x2cb [ 55.571975][ T3645] ? bfq_pos_tree_add_move+0x436/0x436 [ 55.577527][ T3645] ? panic+0x76e/0x76e [ 55.581594][ T3645] dump_header+0xdb/0x970 [ 55.585945][ T3645] out_of_memory+0x895/0xb30 [ 55.590533][ T3645] ? unregister_oom_notifier+0x20/0x20 [ 55.596002][ T3645] ? lockdep_hardirqs_on_prepare+0x448/0x7b0 [ 55.601984][ T3645] mem_cgroup_out_of_memory+0x25d/0x3b0 [ 55.607526][ T3645] ? mem_cgroup_oom_trylock+0x220/0x220 [ 55.613101][ T3645] ? cgroup_file_notify+0x123/0x190 [ 55.618285][ T3645] memory_max_write+0x364/0x4f0 [ 55.623125][ T3645] ? memory_max_show+0xa0/0xa0 [ 55.627874][ T3645] ? read_lock_is_recursive+0x10/0x10 [ 55.633238][ T3645] ? memory_max_show+0xa0/0xa0 [ 55.638002][ T3645] cgroup_file_write+0x2ab/0x780 [ 55.642946][ T3645] ? cgroup_seqfile_stop+0xd0/0xd0 [ 55.648062][ T3645] ? check_heap_object+0x23e/0x820 [ 55.653176][ T3645] ? cgroup_seqfile_stop+0xd0/0xd0 [ 55.658278][ T3645] kernfs_fop_write_iter+0x3ac/0x500 [ 55.663563][ T3645] do_iter_readv_writev+0x499/0x650 [ 55.668756][ T3645] ? generic_file_rw_checks+0x250/0x250 [ 55.674304][ T3645] ? bpf_lsm_file_permission+0x5/0x10 [ 55.679669][ T3645] ? security_file_permission+0xe0/0x5c0 [ 55.685375][ T3645] ? do_iter_write+0x147/0x7a0 [ 55.690130][ T3645] do_iter_write+0x1f1/0x7a0 [ 55.694711][ T3645] ? vfs_iter_write+0x69/0xa0 [ 55.699376][ T3645] iter_file_splice_write+0x830/0xff0 [ 55.704750][ T3645] ? splice_from_pipe+0x220/0x220 [ 55.709760][ T3645] ? generic_file_splice_read+0x46b/0x660 [ 55.715487][ T3645] ? splice_shrink_spd+0xb0/0xb0 [ 55.720425][ T3645] ? splice_from_pipe+0x220/0x220 [ 55.725447][ T3645] direct_splice_actor+0xe6/0x1c0 [ 55.730502][ T3645] splice_direct_to_actor+0x514/0xc20 [ 55.735872][ T3645] ? __lock_acquire+0x129a/0x1f80 [ 55.740897][ T3645] ? do_splice_direct+0x3f0/0x3f0 [ 55.745933][ T3645] ? pipe_to_sendpage+0x340/0x340 [ 55.750954][ T3645] ? bpf_lsm_file_permission+0x5/0x10 [ 55.756328][ T3645] ? security_file_permission+0xe0/0x5c0 [ 55.761968][ T3645] do_splice_direct+0x2a0/0x3f0 [ 55.766812][ T3645] ? splice_direct_to_actor+0xc20/0xc20 [ 55.772344][ T3645] ? rcu_read_lock_any_held+0xb3/0x150 [ 55.777809][ T3645] ? _raw_spin_lock_irqsave+0x120/0x120 [ 55.783367][ T3645] do_sendfile+0x623/0xf90 [ 55.787782][ T3645] ? do_pwritev+0x360/0x360 [ 55.792273][ T3645] ? _raw_spin_unlock_irq+0x2a/0x40 [ 55.797489][ T3645] ? ptrace_notify+0x245/0x340 [ 55.802251][ T3645] ? do_notify_parent+0xeb0/0xeb0 [ 55.807280][ T3645] ? lockdep_hardirqs_on_prepare+0x448/0x7b0 [ 55.813254][ T3645] __se_sys_sendfile64+0x178/0x1e0 [ 55.818361][ T3645] ? __x64_sys_sendfile64+0xa0/0xa0 [ 55.823579][ T3645] ? syscall_enter_from_user_mode+0x2e/0x1a0 [ 55.829556][ T3645] ? syscall_enter_from_user_mode+0x86/0x1a0 [ 55.835527][ T3645] do_syscall_64+0x2b/0x70 [ 55.839936][ T3645] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 55.845823][ T3645] RIP: 0033:0x7f647bbcde19 [ 55.850234][ T3645] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 55.869834][ T3645] RSP: 002b:00007ffd4087ce08 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 55.878242][ T3645] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f647bbcde19 [ 55.886213][ T3645] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000006 [pid 3624] umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 3624] umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3624] lstat("./1/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3624] umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3624] openat(AT_FDCWD, "./1/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 3624] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3624] getdents64(4, 0x555555d5a660 /* 2 entries */, 32768) = 48 [pid 3624] getdents64(4, 0x555555d5a660 /* 0 entries */, 32768) = 0 [ 55.894177][ T3645] RBP: 0000000000000000 R08: 00007ffd4087ce30 R09: 00007ffd4087ce30 [ 55.902140][ T3645] R10: 0000000000000002 R11: 0000000000000246 R12: 00007ffd4087ce2c [ 55.910102][ T3645] R13: 00007ffd4087ce40 R14: 00007ffd4087ce80 R15: 0000000000000001 [ 55.918071][ T3645] [ 55.923277][ T3645] memory: usage 80kB, limit 0kB, failcnt 0 [ 55.929383][ T3645] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 55.936269][ T3645] Memory cgroup stats for /syz0: [ 55.936495][ T3645] anon 0 [pid 3624] close(4) = 0 [pid 3624] rmdir("./1/file0") = 0 [pid 3624] umount2("./1/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3624] lstat("./1/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3624] unlink("./1/cgroup.cpu") = 0 [pid 3624] getdents64(3, 0x555555d52620 /* 0 entries */, 32768) = 0 [pid 3624] close(3) = 0 [pid 3624] rmdir("./1") = 0 [pid 3624] mkdir("./2", 0777) = 0 [pid 3624] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555d515d0) = 4 ./strace-static-x86_64: Process 3650 attached [pid 3650] chdir("./2") = 0 [pid 3650] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3650] setpgid(0, 0) = 0 [pid 3650] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 3650] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 3650] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 3650] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3650] write(3, "1000", 4) = 4 [pid 3650] close(3) = 0 [pid 3650] symlink("/dev/binderfs", "./binderfs") = 0 [pid 3650] mkdir("./file0", 000) = 0 [pid 3650] open("./file0", O_RDONLY) = 3 [pid 3650] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 3650] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 3650] openat(4, "syz0", O_RDWR|O_PATH) = 5 [pid 3650] openat(5, "memory.max", O_RDWR) = 6 [ 55.936495][ T3645] file 12288 [ 55.936495][ T3645] kernel 69632 [ 55.936495][ T3645] kernel_stack 0 [ 55.936495][ T3645] pagetables 0 [ 55.936495][ T3645] percpu 0 [ 55.936495][ T3645] sock 0 [ 55.936495][ T3645] vmalloc 0 [ 55.936495][ T3645] shmem 0 [ 55.936495][ T3645] zswap 0 [ 55.936495][ T3645] zswapped 0 [ 55.936495][ T3645] file_mapped 0 [ 55.936495][ T3645] file_dirty 0 [ 55.936495][ T3645] file_writeback 0 [ 55.936495][ T3645] swapcached 0 [ 55.936495][ T3645] anon_thp 0 [ 55.936495][ T3645] file_thp 0 [ 55.936495][ T3645] shmem_thp 0 [ 55.936495][ T3645] inactive_anon 0 [ 55.936495][ T3645] active_anon 0 [ 55.936495][ T3645] inactive_file 8192 [ 55.936495][ T3645] active_file 4096 [ 55.936495][ T3645] unevictable 0 [ 55.936495][ T3645] slab_reclaimable 29520 [ 55.936495][ T3645] slab_unreclaimable 37656 [ 55.936495][ T3645] slab 67176 [ 55.936495][ T3645] workingset_refault_anon 0 [ 56.030629][ T3645] Tasks state (memory values in pages): [ 56.036189][ T3645] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 3650] sendfile(6, 6, NULL, 2 [pid 3645] <... sendfile resumed>) = 2 [pid 3645] close(3) = 0 [pid 3645] close(4) = 0 [pid 3645] close(5) = 0 [pid 3645] close(6) = 0 [pid 3645] close(7) = -1 EBADF (Bad file descriptor) [pid 3645] close(8) = -1 EBADF (Bad file descriptor) [pid 3645] close(9) = -1 EBADF (Bad file descriptor) [pid 3645] close(10) = -1 EBADF (Bad file descriptor) [pid 3645] close(11) = -1 EBADF (Bad file descriptor) [pid 3645] close(12) = -1 EBADF (Bad file descriptor) [pid 3645] close(13) = -1 EBADF (Bad file descriptor) [pid 3645] close(14) = -1 EBADF (Bad file descriptor) [pid 3645] close(15) = -1 EBADF (Bad file descriptor) [pid 3645] close(16) = -1 EBADF (Bad file descriptor) [pid 3645] close(17) = -1 EBADF (Bad file descriptor) [pid 3645] close(18) = -1 EBADF (Bad file descriptor) [pid 3645] close(19) = -1 EBADF (Bad file descriptor) [pid 3645] close(20) = -1 EBADF (Bad file descriptor) [pid 3645] close(21) = -1 EBADF (Bad file descriptor) [pid 3645] close(22) = -1 EBADF (Bad file descriptor) [pid 3645] close(23) = -1 EBADF (Bad file descriptor) [pid 3645] close(24) = -1 EBADF (Bad file descriptor) [pid 3645] close(25) = -1 EBADF (Bad file descriptor) [pid 3645] close(26) = -1 EBADF (Bad file descriptor) [pid 3645] close(27) = -1 EBADF (Bad file descriptor) [pid 3645] close(28) = -1 EBADF (Bad file descriptor) [pid 3645] close(29) = -1 EBADF (Bad file descriptor) [pid 3645] exit_group(0) = ? [pid 3645] +++ exited with 0 +++ [pid 3626] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3, si_uid=0, si_status=0, si_utime=0, si_stime=53} --- [pid 3626] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3626] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 3626] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 3626] getdents64(3, 0x555555d52620 /* 7 entries */, 32768) = 208 [pid 3626] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3626] lstat("./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 3626] unlink("./1/binderfs") = 0 [pid 3626] umount2("./1/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3626] lstat("./1/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 3626] unlink("./1/cgroup") = 0 [pid 3626] umount2("./1/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3626] lstat("./1/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3626] unlink("./1/cgroup.net") = 0 [ 56.047060][ T3645] Out of memory and no killable processes... [ 56.053089][ T3646] syz-executor417 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 56.064649][ T3646] CPU: 0 PID: 3646 Comm: syz-executor417 Not tainted 5.19.0-rc7-syzkaller-00007-g353f7988dd84 #0 [ 56.075174][ T3646] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 [ 56.085233][ T3646] Call Trace: [ 56.088521][ T3646] [ 56.091447][ T3646] dump_stack_lvl+0x1e3/0x2cb [ 56.096126][ T3646] ? bfq_pos_tree_add_move+0x436/0x436 [ 56.101588][ T3646] ? panic+0x76e/0x76e [ 56.105657][ T3646] dump_header+0xdb/0x970 [ 56.109983][ T3646] out_of_memory+0x895/0xb30 [ 56.114581][ T3646] ? unregister_oom_notifier+0x20/0x20 [ 56.120033][ T3646] ? __lock_acquire+0x1f80/0x1f80 [ 56.125066][ T3646] mem_cgroup_out_of_memory+0x25d/0x3b0 [ 56.130615][ T3646] ? mem_cgroup_oom_trylock+0x220/0x220 [ 56.136147][ T3646] ? cgroup_file_notify+0x123/0x190 [ 56.141340][ T3646] memory_max_write+0x364/0x4f0 [ 56.146202][ T3646] ? memory_max_show+0xa0/0xa0 [ 56.150961][ T3646] ? read_lock_is_recursive+0x10/0x10 [ 56.156345][ T3646] ? memory_max_show+0xa0/0xa0 [ 56.161108][ T3646] cgroup_file_write+0x2ab/0x780 [ 56.166041][ T3646] ? cgroup_seqfile_stop+0xd0/0xd0 [ 56.171138][ T3646] ? check_heap_object+0x23e/0x820 [ 56.176243][ T3646] ? kernfs_get_active+0xee/0x160 [ 56.181254][ T3646] ? cgroup_seqfile_stop+0xd0/0xd0 [ 56.186356][ T3646] kernfs_fop_write_iter+0x3ac/0x500 [ 56.191634][ T3646] do_iter_readv_writev+0x499/0x650 [ 56.196824][ T3646] ? generic_file_rw_checks+0x250/0x250 [ 56.202361][ T3646] ? bpf_lsm_file_permission+0x5/0x10 [ 56.207726][ T3646] ? security_file_permission+0xe0/0x5c0 [ 56.213348][ T3646] ? do_iter_write+0x147/0x7a0 [ 56.218102][ T3646] do_iter_write+0x1f1/0x7a0 [ 56.222679][ T3646] ? vfs_iter_write+0x69/0xa0 [ 56.227351][ T3646] iter_file_splice_write+0x830/0xff0 [ 56.232720][ T3646] ? splice_from_pipe+0x220/0x220 [ 56.237731][ T3646] ? generic_file_splice_read+0x46b/0x660 [ 56.243452][ T3646] ? splice_shrink_spd+0xb0/0xb0 [ 56.248392][ T3646] ? splice_from_pipe+0x220/0x220 [ 56.253418][ T3646] direct_splice_actor+0xe6/0x1c0 [ 56.258440][ T3646] splice_direct_to_actor+0x514/0xc20 [ 56.263809][ T3646] ? do_splice_direct+0x3f0/0x3f0 [ 56.268849][ T3646] ? pipe_to_sendpage+0x340/0x340 [ 56.273866][ T3646] ? do_sendfile+0x600/0xf90 [ 56.278447][ T3646] ? read_lock_is_recursive+0x10/0x10 [ 56.283807][ T3646] ? bpf_lsm_file_permission+0x5/0x10 [ 56.289166][ T3646] ? security_file_permission+0xe0/0x5c0 [ 56.294798][ T3646] do_splice_direct+0x2a0/0x3f0 [ 56.299644][ T3646] ? splice_direct_to_actor+0xc20/0xc20 [ 56.305188][ T3646] ? rcu_read_lock_any_held+0x5f/0x150 [ 56.310651][ T3646] ? _raw_spin_lock_irq+0xdb/0x110 [ 56.315751][ T3646] ? _raw_spin_lock_irqsave+0x120/0x120 [ 56.321290][ T3646] do_sendfile+0x623/0xf90 [ 56.325701][ T3646] ? do_pwritev+0x360/0x360 [ 56.330203][ T3646] ? _raw_spin_unlock_irq+0x2a/0x40 [ 56.335401][ T3646] ? ptrace_notify+0x245/0x340 [ 56.340159][ T3646] ? do_notify_parent+0xeb0/0xeb0 [ 56.345182][ T3646] __se_sys_sendfile64+0x178/0x1e0 [ 56.350292][ T3646] ? __x64_sys_sendfile64+0xa0/0xa0 [ 56.355484][ T3646] ? syscall_enter_from_user_mode+0x86/0x1a0 [ 56.361466][ T3646] do_syscall_64+0x2b/0x70 [ 56.365879][ T3646] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 56.371761][ T3646] RIP: 0033:0x7f647bbcde19 [ 56.376169][ T3646] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 56.395775][ T3646] RSP: 002b:00007ffd4087ce08 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 56.404207][ T3646] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f647bbcde19 [ 56.412189][ T3646] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000006 [ 56.420511][ T3646] RBP: 0000000000000000 R08: 00007ffd4087ce30 R09: 00007ffd4087ce30 [ 56.428492][ T3646] R10: 0000000000000002 R11: 0000000000000246 R12: 00007ffd4087ce2c [ 56.436455][ T3646] R13: 00007ffd4087ce40 R14: 00007ffd4087ce80 R15: 0000000000000002 [ 56.444426][ T3646] [pid 3626] umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 3626] umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3626] lstat("./1/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3626] umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3626] openat(AT_FDCWD, "./1/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 3626] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3626] getdents64(4, 0x555555d5a660 /* 2 entries */, 32768) = 48 [pid 3626] getdents64(4, 0x555555d5a660 /* 0 entries */, 32768) = 0 [pid 3626] close(4) = 0 [pid 3626] rmdir("./1/file0") = 0 [pid 3626] umount2("./1/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3626] lstat("./1/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3626] unlink("./1/cgroup.cpu") = 0 [pid 3626] getdents64(3, 0x555555d52620 /* 0 entries */, 32768) = 0 [pid 3626] close(3) = 0 [pid 3626] rmdir("./1") = 0 [pid 3626] mkdir("./2", 0777) = 0 [pid 3626] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3651 attached [pid 3651] chdir("./2" [pid 3626] <... clone resumed>, child_tidptr=0x555555d515d0) = 4 [pid 3651] <... chdir resumed>) = 0 [pid 3651] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3651] setpgid(0, 0) = 0 [pid 3651] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 3651] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [pid 3651] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 3651] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3651] write(3, "1000", 4) = 4 [pid 3651] close(3) = 0 [pid 3651] symlink("/dev/binderfs", "./binderfs") = 0 [pid 3651] mkdir("./file0", 000) = 0 [pid 3651] open("./file0", O_RDONLY) = 3 [pid 3651] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 3651] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 3651] openat(4, "syz0", O_RDWR|O_PATH) = 5 [pid 3651] openat(5, "memory.max", O_RDWR) = 6 [ 56.456406][ T3646] memory: usage 80kB, limit 0kB, failcnt 0 [ 56.462733][ T3646] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 56.470242][ T3646] Memory cgroup stats for /syz0: [ 56.470427][ T3646] anon 0 [ 56.470427][ T3646] file 12288 [ 56.470427][ T3646] kernel 69632 [ 56.470427][ T3646] kernel_stack 0 [ 56.470427][ T3646] pagetables 0 [ 56.470427][ T3646] percpu 0 [ 56.470427][ T3646] sock 0 [ 56.470427][ T3646] vmalloc 0 [ 56.470427][ T3646] shmem 0 [ 56.470427][ T3646] zswap 0 [ 56.470427][ T3646] zswapped 0 [ 56.470427][ T3646] file_mapped 0 [ 56.470427][ T3646] file_dirty 0 [ 56.470427][ T3646] file_writeback 0 [ 56.470427][ T3646] swapcached 0 [ 56.470427][ T3646] anon_thp 0 [ 56.470427][ T3646] file_thp 0 [ 56.470427][ T3646] shmem_thp 0 [ 56.470427][ T3646] inactive_anon 0 [ 56.470427][ T3646] active_anon 0 [ 56.470427][ T3646] inactive_file 8192 [ 56.470427][ T3646] active_file 4096 [ 56.470427][ T3646] unevictable 0 [ 56.470427][ T3646] slab_reclaimable 29520 [ 56.470427][ T3646] slab_unreclaimable 37656 [pid 3651] sendfile(6, 6, NULL, 2 [pid 3646] <... sendfile resumed>) = 2 [pid 3646] close(3) = 0 [pid 3646] close(4) = 0 [pid 3646] close(5) = 0 [pid 3646] close(6) = 0 [pid 3646] close(7) = -1 EBADF (Bad file descriptor) [pid 3646] close(8) = -1 EBADF (Bad file descriptor) [pid 3646] close(9) = -1 EBADF (Bad file descriptor) [pid 3646] close(10) = -1 EBADF (Bad file descriptor) [pid 3646] close(11) = -1 EBADF (Bad file descriptor) [pid 3646] close(12) = -1 EBADF (Bad file descriptor) [pid 3646] close(13) = -1 EBADF (Bad file descriptor) [pid 3646] close(14) = -1 EBADF (Bad file descriptor) [pid 3646] close(15) = -1 EBADF (Bad file descriptor) [pid 3646] close(16) = -1 EBADF (Bad file descriptor) [pid 3646] close(17) = -1 EBADF (Bad file descriptor) [pid 3646] close(18) = -1 EBADF (Bad file descriptor) [pid 3646] close(19) = -1 EBADF (Bad file descriptor) [pid 3646] close(20) = -1 EBADF (Bad file descriptor) [pid 3646] close(21) = -1 EBADF (Bad file descriptor) [pid 3646] close(22) = -1 EBADF (Bad file descriptor) [pid 3646] close(23) = -1 EBADF (Bad file descriptor) [pid 3646] close(24) = -1 EBADF (Bad file descriptor) [pid 3646] close(25) = -1 EBADF (Bad file descriptor) [pid 3646] close(26) = -1 EBADF (Bad file descriptor) [pid 3646] close(27) = -1 EBADF (Bad file descriptor) [pid 3646] close(28) = -1 EBADF (Bad file descriptor) [pid 3646] close(29) = -1 EBADF (Bad file descriptor) [pid 3646] exit_group(0) = ? [pid 3646] +++ exited with 0 +++ [pid 3623] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4, si_uid=0, si_status=0, si_utime=0, si_stime=52} --- [pid 3623] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3623] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 3623] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 3623] getdents64(3, 0x555555d52620 /* 7 entries */, 32768) = 208 [ 56.470427][ T3646] slab 67176 [ 56.470427][ T3646] workingset_refault_anon 0 [ 56.564779][ T3646] Tasks state (memory values in pages): [ 56.570384][ T3646] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 56.580005][ T3646] Out of memory and no killable processes... [ 56.586138][ T3647] syz-executor417 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 3623] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3623] lstat("./2/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 3623] unlink("./2/binderfs") = 0 [pid 3623] umount2("./2/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3623] lstat("./2/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 3623] unlink("./2/cgroup") = 0 [pid 3623] umount2("./2/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3623] lstat("./2/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3623] unlink("./2/cgroup.net") = 0 [ 56.601842][ T3647] CPU: 0 PID: 3647 Comm: syz-executor417 Not tainted 5.19.0-rc7-syzkaller-00007-g353f7988dd84 #0 [ 56.612376][ T3647] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 [ 56.622437][ T3647] Call Trace: [ 56.625715][ T3647] [ 56.628649][ T3647] dump_stack_lvl+0x1e3/0x2cb [ 56.633367][ T3647] ? bfq_pos_tree_add_move+0x436/0x436 [ 56.638834][ T3647] ? panic+0x76e/0x76e [ 56.642906][ T3647] dump_header+0xdb/0x970 [ 56.647225][ T3647] out_of_memory+0x895/0xb30 [ 56.651834][ T3647] ? unregister_oom_notifier+0x20/0x20 [ 56.657293][ T3647] ? __lock_acquire+0x1f80/0x1f80 [ 56.662335][ T3647] mem_cgroup_out_of_memory+0x25d/0x3b0 [ 56.667894][ T3647] ? mem_cgroup_oom_trylock+0x220/0x220 [ 56.673425][ T3647] ? cgroup_file_notify+0x123/0x190 [ 56.678625][ T3647] memory_max_write+0x364/0x4f0 [ 56.683464][ T3647] ? memory_max_show+0xa0/0xa0 [ 56.688234][ T3647] ? read_lock_is_recursive+0x10/0x10 [ 56.693590][ T3647] ? memory_max_show+0xa0/0xa0 [ 56.698336][ T3647] cgroup_file_write+0x2ab/0x780 [ 56.703261][ T3647] ? cgroup_seqfile_stop+0xd0/0xd0 [ 56.708357][ T3647] ? check_heap_object+0x23e/0x820 [ 56.713472][ T3647] ? kernfs_get_active+0xee/0x160 [ 56.718479][ T3647] ? cgroup_seqfile_stop+0xd0/0xd0 [ 56.723582][ T3647] kernfs_fop_write_iter+0x3ac/0x500 [ 56.728878][ T3647] do_iter_readv_writev+0x499/0x650 [ 56.734086][ T3647] ? generic_file_rw_checks+0x250/0x250 [ 56.739651][ T3647] ? bpf_lsm_file_permission+0x5/0x10 [ 56.745032][ T3647] ? security_file_permission+0xe0/0x5c0 [ 56.750654][ T3647] ? do_iter_write+0x147/0x7a0 [ 56.755433][ T3647] do_iter_write+0x1f1/0x7a0 [ 56.760024][ T3647] ? vfs_iter_write+0x69/0xa0 [ 56.764695][ T3647] iter_file_splice_write+0x830/0xff0 [ 56.770079][ T3647] ? splice_from_pipe+0x220/0x220 [ 56.775089][ T3647] ? generic_file_splice_read+0x46b/0x660 [ 56.780792][ T3647] ? splice_shrink_spd+0xb0/0xb0 [ 56.785803][ T3647] ? splice_from_pipe+0x220/0x220 [ 56.790811][ T3647] direct_splice_actor+0xe6/0x1c0 [ 56.795825][ T3647] splice_direct_to_actor+0x514/0xc20 [ 56.801202][ T3647] ? do_splice_direct+0x3f0/0x3f0 [ 56.806244][ T3647] ? pipe_to_sendpage+0x340/0x340 [ 56.811275][ T3647] ? do_sendfile+0x600/0xf90 [ 56.815864][ T3647] ? read_lock_is_recursive+0x10/0x10 [ 56.821225][ T3647] ? bpf_lsm_file_permission+0x5/0x10 [ 56.826586][ T3647] ? security_file_permission+0xe0/0x5c0 [ 56.832276][ T3647] do_splice_direct+0x2a0/0x3f0 [ 56.837122][ T3647] ? splice_direct_to_actor+0xc20/0xc20 [ 56.842649][ T3647] ? rcu_read_lock_any_held+0x5f/0x150 [ 56.848101][ T3647] ? _raw_spin_lock_irq+0xdb/0x110 [ 56.853219][ T3647] ? _raw_spin_lock_irqsave+0x120/0x120 [ 56.858781][ T3647] do_sendfile+0x623/0xf90 [ 56.863194][ T3647] ? do_pwritev+0x360/0x360 [ 56.867706][ T3647] ? _raw_spin_unlock_irq+0x2a/0x40 [ 56.872909][ T3647] ? ptrace_notify+0x245/0x340 [ 56.877683][ T3647] ? do_notify_parent+0xeb0/0xeb0 [ 56.882714][ T3647] __se_sys_sendfile64+0x178/0x1e0 [ 56.887833][ T3647] ? __x64_sys_sendfile64+0xa0/0xa0 [ 56.893045][ T3647] ? syscall_enter_from_user_mode+0x86/0x1a0 [ 56.899018][ T3647] do_syscall_64+0x2b/0x70 [ 56.903449][ T3647] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 56.909335][ T3647] RIP: 0033:0x7f647bbcde19 [ 56.913751][ T3647] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 56.933356][ T3647] RSP: 002b:00007ffd4087ce08 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 56.941761][ T3647] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f647bbcde19 [ 56.949731][ T3647] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000006 [pid 3623] umount2("./2/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 3623] umount2("./2/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3623] lstat("./2/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3623] umount2("./2/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3623] openat(AT_FDCWD, "./2/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 3623] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3623] getdents64(4, 0x555555d5a660 /* 2 entries */, 32768) = 48 [pid 3623] getdents64(4, 0x555555d5a660 /* 0 entries */, 32768) = 0 [pid 3623] close(4) = 0 [pid 3623] rmdir("./2/file0") = 0 [pid 3623] umount2("./2/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3623] lstat("./2/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3623] unlink("./2/cgroup.cpu") = 0 [pid 3623] getdents64(3, 0x555555d52620 /* 0 entries */, 32768) = 0 [pid 3623] close(3) = 0 [pid 3623] rmdir("./2") = 0 [pid 3623] mkdir("./3", 0777) = 0 [pid 3623] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3652 attached [pid 3652] chdir("./3" [pid 3623] <... clone resumed>, child_tidptr=0x555555d515d0) = 5 [pid 3652] <... chdir resumed>) = 0 [pid 3652] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3652] setpgid(0, 0) = 0 [pid 3652] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 3652] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 3652] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [ 56.957686][ T3647] RBP: 0000000000000000 R08: 00007ffd4087ce30 R09: 00007ffd4087ce30 [ 56.965739][ T3647] R10: 0000000000000002 R11: 0000000000000246 R12: 00007ffd4087ce2c [ 56.973724][ T3647] R13: 00007ffd4087ce40 R14: 00007ffd4087ce80 R15: 0000000000000002 [ 56.981898][ T3647] [ 56.998084][ T3647] memory: usage 80kB, limit 0kB, failcnt 0 [pid 3652] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3652] write(3, "1000", 4) = 4 [pid 3652] close(3) = 0 [pid 3652] symlink("/dev/binderfs", "./binderfs") = 0 [pid 3652] mkdir("./file0", 000) = 0 [pid 3652] open("./file0", O_RDONLY) = 3 [pid 3652] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 3652] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 3652] openat(4, "syz0", O_RDWR|O_PATH) = 5 [pid 3652] openat(5, "memory.max", O_RDWR) = 6 [ 57.004275][ T3647] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 57.026373][ T3647] Memory cgroup stats for /syz0: [ 57.026462][ T3647] anon 0 [ 57.026462][ T3647] file 12288 [ 57.026462][ T3647] kernel 69632 [ 57.026462][ T3647] kernel_stack 0 [ 57.026462][ T3647] pagetables 0 [ 57.026462][ T3647] percpu 0 [ 57.026462][ T3647] sock 0 [ 57.026462][ T3647] vmalloc 0 [ 57.026462][ T3647] shmem 0 [ 57.026462][ T3647] zswap 0 [ 57.026462][ T3647] zswapped 0 [ 57.026462][ T3647] file_mapped 0 [ 57.026462][ T3647] file_dirty 0 [ 57.026462][ T3647] file_writeback 0 [ 57.026462][ T3647] swapcached 0 [ 57.026462][ T3647] anon_thp 0 [ 57.026462][ T3647] file_thp 0 [ 57.026462][ T3647] shmem_thp 0 [ 57.026462][ T3647] inactive_anon 0 [ 57.026462][ T3647] active_anon 0 [ 57.026462][ T3647] inactive_file 4096 [ 57.026462][ T3647] active_file 8192 [ 57.026462][ T3647] unevictable 0 [ 57.026462][ T3647] slab_reclaimable 29520 [ 57.026462][ T3647] slab_unreclaimable 37656 [ 57.026462][ T3647] slab 67176 [ 57.026462][ T3647] workingset_refault_anon 0 [ 57.136368][ T3647] Tasks state (memory values in pages): [ 57.141939][ T3647] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 3652] sendfile(6, 6, NULL, 2 [pid 3647] <... sendfile resumed>) = 2 [pid 3647] close(3) = 0 [pid 3647] close(4) = 0 [pid 3647] close(5) = 0 [pid 3647] close(6) = 0 [pid 3647] close(7) = -1 EBADF (Bad file descriptor) [pid 3647] close(8) = -1 EBADF (Bad file descriptor) [pid 3647] close(9) = -1 EBADF (Bad file descriptor) [pid 3647] close(10) = -1 EBADF (Bad file descriptor) [pid 3647] close(11) = -1 EBADF (Bad file descriptor) [pid 3647] close(12) = -1 EBADF (Bad file descriptor) [pid 3647] close(13) = -1 EBADF (Bad file descriptor) [pid 3647] close(14) = -1 EBADF (Bad file descriptor) [pid 3647] close(15) = -1 EBADF (Bad file descriptor) [pid 3647] close(16) = -1 EBADF (Bad file descriptor) [pid 3647] close(17) = -1 EBADF (Bad file descriptor) [pid 3647] close(18) = -1 EBADF (Bad file descriptor) [pid 3647] close(19) = -1 EBADF (Bad file descriptor) [pid 3647] close(20) = -1 EBADF (Bad file descriptor) [pid 3647] close(21) = -1 EBADF (Bad file descriptor) [pid 3647] close(22) = -1 EBADF (Bad file descriptor) [pid 3647] close(23) = -1 EBADF (Bad file descriptor) [pid 3647] close(24) = -1 EBADF (Bad file descriptor) [pid 3647] close(25) = -1 EBADF (Bad file descriptor) [pid 3647] close(26) = -1 EBADF (Bad file descriptor) [pid 3647] close(27) = -1 EBADF (Bad file descriptor) [pid 3647] close(28) = -1 EBADF (Bad file descriptor) [pid 3647] close(29) = -1 EBADF (Bad file descriptor) [pid 3647] exit_group(0) = ? [pid 3647] +++ exited with 0 +++ [pid 3622] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4, si_uid=0, si_status=0, si_utime=0, si_stime=53} --- [pid 3622] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 57.156431][ T3647] Out of memory and no killable processes... [ 57.162539][ T3649] syz-executor417 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 57.186381][ T3649] CPU: 0 PID: 3649 Comm: syz-executor417 Not tainted 5.19.0-rc7-syzkaller-00007-g353f7988dd84 #0 [ 57.196897][ T3649] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 [pid 3622] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 3622] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 3622] getdents64(3, 0x555555d52620 /* 7 entries */, 32768) = 208 [pid 3622] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3622] lstat("./2/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 3622] unlink("./2/binderfs") = 0 [pid 3622] umount2("./2/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3622] lstat("./2/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 3622] unlink("./2/cgroup") = 0 [ 57.206938][ T3649] Call Trace: [ 57.210208][ T3649] [ 57.213135][ T3649] dump_stack_lvl+0x1e3/0x2cb [ 57.217827][ T3649] ? bfq_pos_tree_add_move+0x436/0x436 [ 57.223300][ T3649] ? panic+0x76e/0x76e [ 57.227369][ T3649] dump_header+0xdb/0x970 [ 57.231695][ T3649] out_of_memory+0x895/0xb30 [ 57.236289][ T3649] ? unregister_oom_notifier+0x20/0x20 [ 57.241754][ T3649] ? __lock_acquire+0x1f80/0x1f80 [ 57.246787][ T3649] mem_cgroup_out_of_memory+0x25d/0x3b0 [ 57.252354][ T3649] ? preempt_schedule_thunk+0x16/0x18 [ 57.257712][ T3649] ? mem_cgroup_oom_trylock+0x220/0x220 [ 57.263266][ T3649] ? cgroup_file_notify+0x123/0x190 [ 57.268461][ T3649] memory_max_write+0x364/0x4f0 [ 57.273308][ T3649] ? memory_max_show+0xa0/0xa0 [ 57.278085][ T3649] ? read_lock_is_recursive+0x10/0x10 [ 57.283467][ T3649] ? memory_max_show+0xa0/0xa0 [ 57.288232][ T3649] cgroup_file_write+0x2ab/0x780 [ 57.293162][ T3649] ? cgroup_seqfile_stop+0xd0/0xd0 [ 57.298259][ T3649] ? check_heap_object+0x23e/0x820 [ 57.303359][ T3649] ? kernfs_get_active+0xee/0x160 [ 57.308387][ T3649] ? cgroup_seqfile_stop+0xd0/0xd0 [ 57.313483][ T3649] kernfs_fop_write_iter+0x3ac/0x500 [ 57.318761][ T3649] do_iter_readv_writev+0x499/0x650 [ 57.323947][ T3649] ? generic_file_rw_checks+0x250/0x250 [ 57.329483][ T3649] ? bpf_lsm_file_permission+0x5/0x10 [ 57.334842][ T3649] ? security_file_permission+0xe0/0x5c0 [ 57.340457][ T3649] ? do_iter_write+0x147/0x7a0 [ 57.345206][ T3649] do_iter_write+0x1f1/0x7a0 [ 57.349782][ T3649] ? vfs_iter_write+0x69/0xa0 [ 57.354443][ T3649] iter_file_splice_write+0x830/0xff0 [ 57.359836][ T3649] ? splice_from_pipe+0x220/0x220 [ 57.364846][ T3649] ? generic_file_splice_read+0x46b/0x660 [ 57.370552][ T3649] ? splice_shrink_spd+0xb0/0xb0 [ 57.375550][ T3649] ? splice_from_pipe+0x220/0x220 [ 57.380569][ T3649] direct_splice_actor+0xe6/0x1c0 [ 57.385580][ T3649] splice_direct_to_actor+0x514/0xc20 [ 57.390962][ T3649] ? do_splice_direct+0x3f0/0x3f0 [ 57.395980][ T3649] ? pipe_to_sendpage+0x340/0x340 [ 57.401014][ T3649] ? do_sendfile+0x600/0xf90 [ 57.405600][ T3649] ? read_lock_is_recursive+0x10/0x10 [ 57.410987][ T3649] ? bpf_lsm_file_permission+0x5/0x10 [ 57.416345][ T3649] ? security_file_permission+0xe0/0x5c0 [ 57.421965][ T3649] do_splice_direct+0x2a0/0x3f0 [ 57.426805][ T3649] ? splice_direct_to_actor+0xc20/0xc20 [ 57.432341][ T3649] ? rcu_read_lock_any_held+0x5f/0x150 [ 57.437785][ T3649] ? _raw_spin_lock_irq+0xdb/0x110 [ 57.442902][ T3649] ? _raw_spin_lock_irqsave+0x120/0x120 [ 57.448448][ T3649] do_sendfile+0x623/0xf90 [ 57.452880][ T3649] ? do_pwritev+0x360/0x360 [ 57.457394][ T3649] ? _raw_spin_unlock_irq+0x2a/0x40 [ 57.462767][ T3649] ? ptrace_notify+0x245/0x340 [ 57.467523][ T3649] ? do_notify_parent+0xeb0/0xeb0 [ 57.472629][ T3649] __se_sys_sendfile64+0x178/0x1e0 [ 57.477751][ T3649] ? __x64_sys_sendfile64+0xa0/0xa0 [ 57.483132][ T3649] ? syscall_enter_from_user_mode+0x86/0x1a0 [ 57.489118][ T3649] do_syscall_64+0x2b/0x70 [ 57.493890][ T3649] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 57.499785][ T3649] RIP: 0033:0x7f647bbcde19 [ 57.504199][ T3649] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 57.523796][ T3649] RSP: 002b:00007ffd4087ce08 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 57.532196][ T3649] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f647bbcde19 [ 57.540163][ T3649] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000006 [ 57.548118][ T3649] RBP: 0000000000000000 R08: 00007ffd4087ce30 R09: 00007ffd4087ce30 [pid 3622] umount2("./2/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3622] lstat("./2/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3622] unlink("./2/cgroup.net") = 0 [pid 3622] umount2("./2/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [ 57.556089][ T3649] R10: 0000000000000002 R11: 0000000000000246 R12: 00007ffd4087ce2c [ 57.564048][ T3649] R13: 00007ffd4087ce40 R14: 00007ffd4087ce80 R15: 0000000000000002 [ 57.572023][ T3649] [ 57.580943][ T3649] memory: usage 80kB, limit 0kB, failcnt 0 [ 57.586975][ T3649] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 57.593827][ T3649] Memory cgroup stats for /syz0: [ 57.594000][ T3649] anon 0 [ 57.594000][ T3649] file 12288 [ 57.594000][ T3649] kernel 69632 [ 57.594000][ T3649] kernel_stack 0 [ 57.594000][ T3649] pagetables 0 [ 57.594000][ T3649] percpu 0 [ 57.594000][ T3649] sock 0 [ 57.594000][ T3649] vmalloc 0 [ 57.594000][ T3649] shmem 0 [ 57.594000][ T3649] zswap 0 [ 57.594000][ T3649] zswapped 0 [ 57.594000][ T3649] file_mapped 0 [ 57.594000][ T3649] file_dirty 0 [ 57.594000][ T3649] file_writeback 0 [ 57.594000][ T3649] swapcached 0 [ 57.594000][ T3649] anon_thp 0 [ 57.594000][ T3649] file_thp 0 [ 57.594000][ T3649] shmem_thp 0 [ 57.594000][ T3649] inactive_anon 0 [ 57.594000][ T3649] active_anon 0 [pid 3622] umount2("./2/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3622] lstat("./2/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3622] umount2("./2/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3622] openat(AT_FDCWD, "./2/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 3622] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3622] getdents64(4, 0x555555d5a660 /* 2 entries */, 32768) = 48 [pid 3622] getdents64(4, 0x555555d5a660 /* 0 entries */, 32768) = 0 [pid 3622] close(4) = 0 [pid 3622] rmdir("./2/file0") = 0 [pid 3622] umount2("./2/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3622] lstat("./2/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3622] unlink("./2/cgroup.cpu") = 0 [pid 3622] getdents64(3, 0x555555d52620 /* 0 entries */, 32768) = 0 [pid 3622] close(3) = 0 [pid 3622] rmdir("./2") = 0 [pid 3622] mkdir("./3", 0777) = 0 [pid 3622] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3653 attached , child_tidptr=0x555555d515d0) = 5 [pid 3653] chdir("./3") = 0 [pid 3653] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [ 57.594000][ T3649] inactive_file 8192 [ 57.594000][ T3649] active_file 4096 [ 57.594000][ T3649] unevictable 0 [ 57.594000][ T3649] slab_reclaimable 29520 [ 57.594000][ T3649] slab_unreclaimable 37656 [ 57.594000][ T3649] slab 67176 [ 57.594000][ T3649] workingset_refault_anon 0 [ 57.699512][ T3649] Tasks state (memory values in pages): [pid 3653] setpgid(0, 0) = 0 [pid 3653] symlink("/syzcgroup/unified/syz1", "./cgroup") = 0 [pid 3653] symlink("/syzcgroup/cpu/syz1", "./cgroup.cpu") = 0 [pid 3653] symlink("/syzcgroup/net/syz1", "./cgroup.net" [pid 3649] <... sendfile resumed>) = 2 [pid 3649] close(3 [pid 3653] <... symlink resumed>) = 0 [pid 3649] <... close resumed>) = 0 [pid 3649] close(4) = 0 [pid 3653] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 3649] close(5 [pid 3653] <... openat resumed>) = 3 [pid 3649] <... close resumed>) = 0 [pid 3649] close(6) = 0 [pid 3649] close(7 [pid 3653] write(3, "1000", 4 [pid 3649] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 3649] close(8 [pid 3653] <... write resumed>) = 4 [pid 3653] close(3 [pid 3649] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 3649] close(9) = -1 EBADF (Bad file descriptor) [pid 3653] <... close resumed>) = 0 [pid 3649] close(10) = -1 EBADF (Bad file descriptor) [pid 3649] close(11) = -1 EBADF (Bad file descriptor) [pid 3649] close(12 [pid 3653] symlink("/dev/binderfs", "./binderfs") = 0 [pid 3649] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 3653] mkdir("./file0", 000 [pid 3649] close(13) = -1 EBADF (Bad file descriptor) [pid 3649] close(14) = -1 EBADF (Bad file descriptor) [pid 3649] close(15) = -1 EBADF (Bad file descriptor) [pid 3649] close(16) = -1 EBADF (Bad file descriptor) [pid 3653] <... mkdir resumed>) = 0 [pid 3649] close(17 [pid 3653] open("./file0", O_RDONLY) = 3 [pid 3653] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 3649] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 3649] close(18) = -1 EBADF (Bad file descriptor) [pid 3653] <... mount resumed>) = 0 [pid 3649] close(19 [pid 3653] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 3649] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 3649] close(20 [pid 3653] openat(4, "syz0", O_RDWR|O_PATH) = 5 [pid 3653] openat(5, "memory.max", O_RDWR [pid 3649] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 3649] close(21 [pid 3653] <... openat resumed>) = 6 [pid 3653] sendfile(6, 6, NULL, 2 [pid 3649] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 3649] close(22) = -1 EBADF (Bad file descriptor) [pid 3649] close(23) = -1 EBADF (Bad file descriptor) [pid 3649] close(24) = -1 EBADF (Bad file descriptor) [pid 3649] close(25) = -1 EBADF (Bad file descriptor) [pid 3649] close(26) = -1 EBADF (Bad file descriptor) [pid 3649] close(27) = -1 EBADF (Bad file descriptor) [pid 3649] close(28) = -1 EBADF (Bad file descriptor) [pid 3649] close(29) = -1 EBADF (Bad file descriptor) [pid 3649] exit_group(0) = ? [pid 3649] +++ exited with 0 +++ [pid 3625] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4, si_uid=0, si_status=0, si_utime=0, si_stime=53} --- [ 57.705925][ T3649] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 57.716441][ T3649] Out of memory and no killable processes... [ 57.723080][ T3650] syz-executor417 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 57.747210][ T3650] CPU: 0 PID: 3650 Comm: syz-executor417 Not tainted 5.19.0-rc7-syzkaller-00007-g353f7988dd84 #0 [ 57.757826][ T3650] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 [ 57.767893][ T3650] Call Trace: [ 57.771184][ T3650] [ 57.774133][ T3650] dump_stack_lvl+0x1e3/0x2cb [ 57.778826][ T3650] ? bfq_pos_tree_add_move+0x436/0x436 [ 57.784292][ T3650] ? panic+0x76e/0x76e [ 57.788376][ T3650] dump_header+0xdb/0x970 [ 57.792727][ T3650] out_of_memory+0x895/0xb30 [ 57.797336][ T3650] ? unregister_oom_notifier+0x20/0x20 [ 57.802799][ T3650] ? __lock_acquire+0x1f80/0x1f80 [ 57.807824][ T3650] mem_cgroup_out_of_memory+0x25d/0x3b0 [ 57.813368][ T3650] ? preempt_schedule_thunk+0x16/0x18 [ 57.818738][ T3650] ? mem_cgroup_oom_trylock+0x220/0x220 [ 57.824282][ T3650] ? cgroup_file_notify+0x123/0x190 [ 57.829476][ T3650] memory_max_write+0x364/0x4f0 [ 57.834325][ T3650] ? memory_max_show+0xa0/0xa0 [ 57.839083][ T3650] ? read_lock_is_recursive+0x10/0x10 [ 57.844713][ T3650] ? memory_max_show+0xa0/0xa0 [ 57.849470][ T3650] cgroup_file_write+0x2ab/0x780 [ 57.854406][ T3650] ? cgroup_seqfile_stop+0xd0/0xd0 [ 57.859523][ T3650] ? check_heap_object+0x23e/0x820 [ 57.864629][ T3650] ? kernfs_get_active+0xee/0x160 [ 57.869641][ T3650] ? cgroup_seqfile_stop+0xd0/0xd0 [ 57.874741][ T3650] kernfs_fop_write_iter+0x3ac/0x500 [ 57.880036][ T3650] do_iter_readv_writev+0x499/0x650 [ 57.885227][ T3650] ? generic_file_rw_checks+0x250/0x250 [ 57.890766][ T3650] ? bpf_lsm_file_permission+0x5/0x10 [ 57.896130][ T3650] ? security_file_permission+0xe0/0x5c0 [ 57.901751][ T3650] ? do_iter_write+0x147/0x7a0 [ 57.906506][ T3650] do_iter_write+0x1f1/0x7a0 [ 57.911086][ T3650] ? vfs_iter_write+0x69/0xa0 [ 57.915766][ T3650] iter_file_splice_write+0x830/0xff0 [ 57.921134][ T3650] ? splice_from_pipe+0x220/0x220 [ 57.926148][ T3650] ? generic_file_splice_read+0x46b/0x660 [ 57.931861][ T3650] ? splice_shrink_spd+0xb0/0xb0 [ 57.936789][ T3650] ? splice_from_pipe+0x220/0x220 [ 57.941801][ T3650] direct_splice_actor+0xe6/0x1c0 [ 57.946833][ T3650] splice_direct_to_actor+0x514/0xc20 [ 57.952204][ T3650] ? do_splice_direct+0x3f0/0x3f0 [ 57.957233][ T3650] ? pipe_to_sendpage+0x340/0x340 [ 57.962243][ T3650] ? do_sendfile+0x600/0xf90 [ 57.966821][ T3650] ? read_lock_is_recursive+0x10/0x10 [ 57.972189][ T3650] ? bpf_lsm_file_permission+0x5/0x10 [ 57.977551][ T3650] ? security_file_permission+0xe0/0x5c0 [ 57.983173][ T3650] do_splice_direct+0x2a0/0x3f0 [ 57.988017][ T3650] ? splice_direct_to_actor+0xc20/0xc20 [ 57.993547][ T3650] ? rcu_read_lock_any_held+0x5f/0x150 [ 57.998997][ T3650] ? _raw_spin_lock_irq+0xdb/0x110 [ 58.004095][ T3650] ? _raw_spin_lock_irqsave+0x120/0x120 [ 58.009629][ T3650] do_sendfile+0x623/0xf90 [ 58.014045][ T3650] ? do_pwritev+0x360/0x360 [ 58.018534][ T3650] ? _raw_spin_unlock_irq+0x2a/0x40 [ 58.023815][ T3650] ? ptrace_notify+0x245/0x340 [ 58.028568][ T3650] ? do_notify_parent+0xeb0/0xeb0 [ 58.033581][ T3650] __se_sys_sendfile64+0x178/0x1e0 [ 58.038680][ T3650] ? __x64_sys_sendfile64+0xa0/0xa0 [ 58.043868][ T3650] ? syscall_enter_from_user_mode+0x86/0x1a0 [ 58.049854][ T3650] do_syscall_64+0x2b/0x70 [ 58.054267][ T3650] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 58.060163][ T3650] RIP: 0033:0x7f647bbcde19 [ 58.064579][ T3650] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 58.084172][ T3650] RSP: 002b:00007ffd4087ce08 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 58.092574][ T3650] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f647bbcde19 [ 58.100544][ T3650] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000006 [pid 3625] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3625] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 3625] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 3625] getdents64(3, 0x555555d52620 /* 7 entries */, 32768) = 208 [pid 3625] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3625] lstat("./2/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 3625] unlink("./2/binderfs") = 0 [pid 3625] umount2("./2/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3625] lstat("./2/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 3625] unlink("./2/cgroup") = 0 [pid 3625] umount2("./2/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3625] lstat("./2/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3625] unlink("./2/cgroup.net") = 0 [pid 3625] umount2("./2/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 3625] umount2("./2/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3625] lstat("./2/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3625] umount2("./2/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3625] openat(AT_FDCWD, "./2/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 3625] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3625] getdents64(4, 0x555555d5a660 /* 2 entries */, 32768) = 48 [ 58.108500][ T3650] RBP: 0000000000000000 R08: 00007ffd4087ce30 R09: 00007ffd4087ce30 [ 58.116456][ T3650] R10: 0000000000000002 R11: 0000000000000246 R12: 00007ffd4087ce2c [ 58.124412][ T3650] R13: 00007ffd4087ce40 R14: 00007ffd4087ce80 R15: 0000000000000002 [ 58.132397][ T3650] [ 58.149166][ T3650] memory: usage 80kB, limit 0kB, failcnt 0 [ 58.155555][ T3650] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [pid 3625] getdents64(4, 0x555555d5a660 /* 0 entries */, 32768) = 0 [pid 3625] close(4) = 0 [pid 3625] rmdir("./2/file0") = 0 [pid 3625] umount2("./2/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3625] lstat("./2/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3625] unlink("./2/cgroup.cpu") = 0 [pid 3625] getdents64(3, 0x555555d52620 /* 0 entries */, 32768) = 0 [pid 3625] close(3) = 0 [pid 3625] rmdir("./2") = 0 [pid 3625] mkdir("./3", 0777) = 0 [pid 3625] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3654 attached [pid 3654] chdir("./3" [pid 3625] <... clone resumed>, child_tidptr=0x555555d515d0) = 5 [pid 3654] <... chdir resumed>) = 0 [pid 3654] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3654] setpgid(0, 0) = 0 [pid 3654] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [pid 3654] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 3654] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 3654] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3654] write(3, "1000", 4) = 4 [pid 3654] close(3) = 0 [pid 3654] symlink("/dev/binderfs", "./binderfs") = 0 [pid 3654] mkdir("./file0", 000) = 0 [pid 3654] open("./file0", O_RDONLY) = 3 [pid 3654] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 3654] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 3654] openat(4, "syz0", O_RDWR|O_PATH) = 5 [pid 3654] openat(5, "memory.max", O_RDWR) = 6 [ 58.162751][ T3650] Memory cgroup stats for /syz0: [ 58.162884][ T3650] anon 0 [ 58.162884][ T3650] file 12288 [ 58.162884][ T3650] kernel 69632 [ 58.162884][ T3650] kernel_stack 0 [ 58.162884][ T3650] pagetables 0 [ 58.162884][ T3650] percpu 0 [ 58.162884][ T3650] sock 0 [ 58.162884][ T3650] vmalloc 0 [ 58.162884][ T3650] shmem 0 [ 58.162884][ T3650] zswap 0 [ 58.162884][ T3650] zswapped 0 [ 58.162884][ T3650] file_mapped 0 [ 58.162884][ T3650] file_dirty 0 [ 58.162884][ T3650] file_writeback 0 [ 58.162884][ T3650] swapcached 0 [ 58.162884][ T3650] anon_thp 0 [ 58.162884][ T3650] file_thp 0 [ 58.162884][ T3650] shmem_thp 0 [ 58.162884][ T3650] inactive_anon 0 [ 58.162884][ T3650] active_anon 0 [ 58.162884][ T3650] inactive_file 8192 [ 58.162884][ T3650] active_file 4096 [ 58.162884][ T3650] unevictable 0 [ 58.162884][ T3650] slab_reclaimable 29520 [ 58.162884][ T3650] slab_unreclaimable 37656 [ 58.162884][ T3650] slab 67176 [ 58.162884][ T3650] workingset_refault_anon 0 [ 58.257704][ T3650] Tasks state (memory values in pages): [pid 3654] sendfile(6, 6, NULL, 2 [pid 3650] <... sendfile resumed>) = 2 [pid 3650] close(3) = 0 [pid 3650] close(4) = 0 [pid 3650] close(5) = 0 [pid 3650] close(6) = 0 [pid 3650] close(7) = -1 EBADF (Bad file descriptor) [pid 3650] close(8) = -1 EBADF (Bad file descriptor) [pid 3650] close(9) = -1 EBADF (Bad file descriptor) [pid 3650] close(10) = -1 EBADF (Bad file descriptor) [pid 3650] close(11) = -1 EBADF (Bad file descriptor) [pid 3650] close(12) = -1 EBADF (Bad file descriptor) [pid 3650] close(13) = -1 EBADF (Bad file descriptor) [pid 3650] close(14) = -1 EBADF (Bad file descriptor) [pid 3650] close(15) = -1 EBADF (Bad file descriptor) [pid 3650] close(16) = -1 EBADF (Bad file descriptor) [pid 3650] close(17) = -1 EBADF (Bad file descriptor) [pid 3650] close(18) = -1 EBADF (Bad file descriptor) [pid 3650] close(19) = -1 EBADF (Bad file descriptor) [pid 3650] close(20) = -1 EBADF (Bad file descriptor) [pid 3650] close(21) = -1 EBADF (Bad file descriptor) [pid 3650] close(22) = -1 EBADF (Bad file descriptor) [pid 3650] close(23) = -1 EBADF (Bad file descriptor) [pid 3650] close(24) = -1 EBADF (Bad file descriptor) [pid 3650] close(25) = -1 EBADF (Bad file descriptor) [pid 3650] close(26) = -1 EBADF (Bad file descriptor) [pid 3650] close(27) = -1 EBADF (Bad file descriptor) [pid 3650] close(28) = -1 EBADF (Bad file descriptor) [pid 3650] close(29) = -1 EBADF (Bad file descriptor) [pid 3650] exit_group(0) = ? [pid 3650] +++ exited with 0 +++ [pid 3624] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4, si_uid=0, si_status=0, si_utime=0, si_stime=52} --- [pid 3624] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 3624] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3624] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [ 58.263832][ T3650] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 58.273605][ T3650] Out of memory and no killable processes... [ 58.279844][ T3651] syz-executor417 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 58.290516][ T3651] CPU: 1 PID: 3651 Comm: syz-executor417 Not tainted 5.19.0-rc7-syzkaller-00007-g353f7988dd84 #0 [ 58.301024][ T3651] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 [ 58.311059][ T3651] Call Trace: [ 58.314323][ T3651] [ 58.317259][ T3651] dump_stack_lvl+0x1e3/0x2cb [ 58.321922][ T3651] ? bfq_pos_tree_add_move+0x436/0x436 [ 58.327377][ T3651] ? panic+0x76e/0x76e [ 58.331442][ T3651] dump_header+0xdb/0x970 [ 58.335754][ T3651] out_of_memory+0x895/0xb30 [ 58.340326][ T3651] ? unregister_oom_notifier+0x20/0x20 [ 58.345766][ T3651] ? __lock_acquire+0x1f80/0x1f80 [ 58.350838][ T3651] mem_cgroup_out_of_memory+0x25d/0x3b0 [ 58.356369][ T3651] ? preempt_schedule_thunk+0x16/0x18 [ 58.361723][ T3651] ? mem_cgroup_oom_trylock+0x220/0x220 [ 58.367296][ T3651] ? cgroup_file_notify+0x123/0x190 [ 58.372474][ T3651] memory_max_write+0x364/0x4f0 [ 58.377308][ T3651] ? memory_max_show+0xa0/0xa0 [ 58.382050][ T3651] ? read_lock_is_recursive+0x10/0x10 [ 58.387404][ T3651] ? memory_max_show+0xa0/0xa0 [ 58.392162][ T3651] cgroup_file_write+0x2ab/0x780 [ 58.397095][ T3651] ? cgroup_seqfile_stop+0xd0/0xd0 [ 58.402195][ T3651] ? check_heap_object+0x23e/0x820 [ 58.407301][ T3651] ? kernfs_get_active+0xee/0x160 [ 58.412314][ T3651] ? cgroup_seqfile_stop+0xd0/0xd0 [ 58.417415][ T3651] kernfs_fop_write_iter+0x3ac/0x500 [ 58.422690][ T3651] do_iter_readv_writev+0x499/0x650 [ 58.427880][ T3651] ? generic_file_rw_checks+0x250/0x250 [ 58.433421][ T3651] ? bpf_lsm_file_permission+0x5/0x10 [ 58.438782][ T3651] ? security_file_permission+0xe0/0x5c0 [ 58.444401][ T3651] ? do_iter_write+0x147/0x7a0 [ 58.449170][ T3651] do_iter_write+0x1f1/0x7a0 [ 58.453751][ T3651] ? vfs_iter_write+0x69/0xa0 [ 58.458422][ T3651] iter_file_splice_write+0x830/0xff0 [ 58.463979][ T3651] ? splice_from_pipe+0x220/0x220 [ 58.468989][ T3651] ? generic_file_splice_read+0x46b/0x660 [ 58.474696][ T3651] ? splice_shrink_spd+0xb0/0xb0 [ 58.479638][ T3651] ? splice_from_pipe+0x220/0x220 [ 58.484662][ T3651] direct_splice_actor+0xe6/0x1c0 [ 58.489675][ T3651] splice_direct_to_actor+0x514/0xc20 [ 58.495038][ T3651] ? do_splice_direct+0x3f0/0x3f0 [ 58.500059][ T3651] ? pipe_to_sendpage+0x340/0x340 [ 58.505072][ T3651] ? do_sendfile+0x600/0xf90 [ 58.509650][ T3651] ? read_lock_is_recursive+0x10/0x10 [ 58.515014][ T3651] ? bpf_lsm_file_permission+0x5/0x10 [ 58.520372][ T3651] ? security_file_permission+0xe0/0x5c0 [ 58.525993][ T3651] do_splice_direct+0x2a0/0x3f0 [ 58.530833][ T3651] ? splice_direct_to_actor+0xc20/0xc20 [ 58.536368][ T3651] ? rcu_read_lock_any_held+0x5f/0x150 [ 58.541832][ T3651] ? _raw_spin_lock_irq+0xdb/0x110 [ 58.546931][ T3651] ? _raw_spin_lock_irqsave+0x120/0x120 [ 58.552464][ T3651] do_sendfile+0x623/0xf90 [ 58.556876][ T3651] ? do_pwritev+0x360/0x360 [ 58.561369][ T3651] ? _raw_spin_unlock_irq+0x2a/0x40 [ 58.566559][ T3651] ? ptrace_notify+0x245/0x340 [ 58.571315][ T3651] ? do_notify_parent+0xeb0/0xeb0 [ 58.576338][ T3651] __se_sys_sendfile64+0x178/0x1e0 [ 58.581440][ T3651] ? __x64_sys_sendfile64+0xa0/0xa0 [ 58.586627][ T3651] ? syscall_enter_from_user_mode+0x86/0x1a0 [ 58.592598][ T3651] do_syscall_64+0x2b/0x70 [ 58.597005][ T3651] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 58.602887][ T3651] RIP: 0033:0x7f647bbcde19 [ 58.607293][ T3651] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 58.626887][ T3651] RSP: 002b:00007ffd4087ce08 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 58.635290][ T3651] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f647bbcde19 [ 58.643255][ T3651] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000006 [ 58.651213][ T3651] RBP: 0000000000000000 R08: 00007ffd4087ce30 R09: 00007ffd4087ce30 [pid 3624] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 3624] getdents64(3, 0x555555d52620 /* 7 entries */, 32768) = 208 [pid 3624] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3624] lstat("./2/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 3624] unlink("./2/binderfs") = 0 [pid 3624] umount2("./2/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3624] lstat("./2/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 3624] unlink("./2/cgroup") = 0 [pid 3624] umount2("./2/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3624] lstat("./2/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3624] unlink("./2/cgroup.net") = 0 [ 58.659170][ T3651] R10: 0000000000000002 R11: 0000000000000246 R12: 00007ffd4087ce2c [ 58.667130][ T3651] R13: 00007ffd4087ce40 R14: 00007ffd4087ce80 R15: 0000000000000002 [ 58.675093][ T3651] [ 58.678921][ T3651] memory: usage 80kB, limit 0kB, failcnt 0 [ 58.685458][ T3651] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 58.692769][ T3651] Memory cgroup stats for /syz0: [ 58.693011][ T3651] anon 0 [ 58.693011][ T3651] file 12288 [ 58.693011][ T3651] kernel 69632 [ 58.693011][ T3651] kernel_stack 0 [ 58.693011][ T3651] pagetables 0 [ 58.693011][ T3651] percpu 0 [ 58.693011][ T3651] sock 0 [ 58.693011][ T3651] vmalloc 0 [ 58.693011][ T3651] shmem 0 [ 58.693011][ T3651] zswap 0 [ 58.693011][ T3651] zswapped 0 [ 58.693011][ T3651] file_mapped 0 [ 58.693011][ T3651] file_dirty 4096 [ 58.693011][ T3651] file_writeback 0 [ 58.693011][ T3651] swapcached 0 [ 58.693011][ T3651] anon_thp 0 [ 58.693011][ T3651] file_thp 0 [ 58.693011][ T3651] shmem_thp 0 [ 58.693011][ T3651] inactive_anon 0 [ 58.693011][ T3651] active_anon 0 [ 58.693011][ T3651] inactive_file 8192 [pid 3624] umount2("./2/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 3624] umount2("./2/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3624] lstat("./2/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3624] umount2("./2/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3624] openat(AT_FDCWD, "./2/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 3624] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3624] getdents64(4, 0x555555d5a660 /* 2 entries */, 32768) = 48 [pid 3624] getdents64(4, 0x555555d5a660 /* 0 entries */, 32768) = 0 [pid 3624] close(4) = 0 [pid 3624] rmdir("./2/file0") = 0 [pid 3624] umount2("./2/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3624] lstat("./2/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3624] unlink("./2/cgroup.cpu") = 0 [pid 3624] getdents64(3, 0x555555d52620 /* 0 entries */, 32768) = 0 [pid 3624] close(3) = 0 [pid 3624] rmdir("./2") = 0 [pid 3624] mkdir("./3", 0777) = 0 [pid 3624] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555d515d0) = 5 ./strace-static-x86_64: Process 3655 attached [pid 3655] chdir("./3") = 0 [pid 3655] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3655] setpgid(0, 0) = 0 [pid 3655] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 3655] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 3655] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 3655] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3655] write(3, "1000", 4) = 4 [pid 3655] close(3) = 0 [pid 3655] symlink("/dev/binderfs", "./binderfs") = 0 [pid 3655] mkdir("./file0", 000) = 0 [ 58.693011][ T3651] active_file 4096 [ 58.693011][ T3651] unevictable 0 [ 58.693011][ T3651] slab_reclaimable 29520 [ 58.693011][ T3651] slab_unreclaimable 37656 [ 58.693011][ T3651] slab 67176 [ 58.693011][ T3651] workingset_refault_anon 0 [ 58.787982][ T3651] Tasks state (memory values in pages): [ 58.793586][ T3651] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 58.803699][ T3651] Out of memory and no killable processes... [pid 3655] open("./file0", O_RDONLY) = 3 [pid 3655] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 3655] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 3655] openat(4, "syz0", O_RDWR|O_PATH) = 5 [pid 3651] <... sendfile resumed>) = 2 [pid 3655] openat(5, "memory.max", O_RDWR) = 6 [pid 3655] sendfile(6, 6, NULL, 2 [pid 3651] close(3) = 0 [pid 3651] close(4) = 0 [pid 3651] close(5) = 0 [pid 3651] close(6) = 0 [pid 3651] close(7) = -1 EBADF (Bad file descriptor) [pid 3651] close(8) = -1 EBADF (Bad file descriptor) [pid 3651] close(9) = -1 EBADF (Bad file descriptor) [pid 3651] close(10) = -1 EBADF (Bad file descriptor) [pid 3651] close(11) = -1 EBADF (Bad file descriptor) [pid 3651] close(12) = -1 EBADF (Bad file descriptor) [pid 3651] close(13) = -1 EBADF (Bad file descriptor) [pid 3651] close(14) = -1 EBADF (Bad file descriptor) [pid 3651] close(15) = -1 EBADF (Bad file descriptor) [pid 3651] close(16) = -1 EBADF (Bad file descriptor) [pid 3651] close(17) = -1 EBADF (Bad file descriptor) [pid 3651] close(18) = -1 EBADF (Bad file descriptor) [pid 3651] close(19) = -1 EBADF (Bad file descriptor) [pid 3651] close(20) = -1 EBADF (Bad file descriptor) [pid 3651] close(21) = -1 EBADF (Bad file descriptor) [pid 3651] close(22) = -1 EBADF (Bad file descriptor) [pid 3651] close(23) = -1 EBADF (Bad file descriptor) [pid 3651] close(24) = -1 EBADF (Bad file descriptor) [pid 3651] close(25) = -1 EBADF (Bad file descriptor) [pid 3651] close(26) = -1 EBADF (Bad file descriptor) [pid 3651] close(27) = -1 EBADF (Bad file descriptor) [pid 3651] close(28) = -1 EBADF (Bad file descriptor) [pid 3651] close(29) = -1 EBADF (Bad file descriptor) [pid 3651] exit_group(0) = ? [pid 3651] +++ exited with 0 +++ [ 58.810786][ T3652] syz-executor417 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 58.821341][ T3652] CPU: 0 PID: 3652 Comm: syz-executor417 Not tainted 5.19.0-rc7-syzkaller-00007-g353f7988dd84 #0 [ 58.831868][ T3652] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 [ 58.841930][ T3652] Call Trace: [ 58.845222][ T3652] [ 58.848190][ T3652] dump_stack_lvl+0x1e3/0x2cb [ 58.852882][ T3652] ? bfq_pos_tree_add_move+0x436/0x436 [ 58.858351][ T3652] ? panic+0x76e/0x76e [ 58.862422][ T3652] dump_header+0xdb/0x970 [pid 3626] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4, si_uid=0, si_status=0, si_utime=0, si_stime=53} --- [pid 3626] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 3626] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3626] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 3626] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 3626] getdents64(3, 0x555555d52620 /* 7 entries */, 32768) = 208 [pid 3626] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3626] lstat("./2/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [ 58.866747][ T3652] out_of_memory+0x895/0xb30 [ 58.871337][ T3652] ? unregister_oom_notifier+0x20/0x20 [ 58.876793][ T3652] ? __lock_acquire+0x1f80/0x1f80 [ 58.881828][ T3652] mem_cgroup_out_of_memory+0x25d/0x3b0 [ 58.887376][ T3652] ? mem_cgroup_oom_trylock+0x220/0x220 [ 58.892907][ T3652] ? cgroup_file_notify+0x123/0x190 [ 58.898100][ T3652] memory_max_write+0x364/0x4f0 [ 58.902962][ T3652] ? memory_max_show+0xa0/0xa0 [ 58.907727][ T3652] ? read_lock_is_recursive+0x10/0x10 [ 58.913085][ T3652] ? memory_max_show+0xa0/0xa0 [ 58.917842][ T3652] cgroup_file_write+0x2ab/0x780 [ 58.922781][ T3652] ? cgroup_seqfile_stop+0xd0/0xd0 [ 58.927886][ T3652] ? check_heap_object+0x23e/0x820 [ 58.932998][ T3652] ? kernfs_get_active+0xee/0x160 [ 58.938004][ T3652] ? cgroup_seqfile_stop+0xd0/0xd0 [ 58.943108][ T3652] kernfs_fop_write_iter+0x3ac/0x500 [ 58.948405][ T3652] do_iter_readv_writev+0x499/0x650 [ 58.953605][ T3652] ? generic_file_rw_checks+0x250/0x250 [ 58.959135][ T3652] ? bpf_lsm_file_permission+0x5/0x10 [ 58.964492][ T3652] ? security_file_permission+0xe0/0x5c0 [ 58.970106][ T3652] ? do_iter_write+0x147/0x7a0 [ 58.974863][ T3652] do_iter_write+0x1f1/0x7a0 [ 58.979455][ T3652] ? vfs_iter_write+0x69/0xa0 [ 58.984133][ T3652] iter_file_splice_write+0x830/0xff0 [ 58.989504][ T3652] ? splice_from_pipe+0x220/0x220 [ 58.994510][ T3652] ? generic_file_splice_read+0x46b/0x660 [ 59.000215][ T3652] ? splice_shrink_spd+0xb0/0xb0 [ 59.005152][ T3652] ? splice_from_pipe+0x220/0x220 [ 59.010179][ T3652] direct_splice_actor+0xe6/0x1c0 [ 59.015189][ T3652] splice_direct_to_actor+0x514/0xc20 [ 59.020549][ T3652] ? do_splice_direct+0x3f0/0x3f0 [ 59.025560][ T3652] ? pipe_to_sendpage+0x340/0x340 [ 59.030592][ T3652] ? do_sendfile+0x600/0xf90 [ 59.035177][ T3652] ? read_lock_is_recursive+0x10/0x10 [ 59.040538][ T3652] ? bpf_lsm_file_permission+0x5/0x10 [ 59.045892][ T3652] ? security_file_permission+0xe0/0x5c0 [ 59.051537][ T3652] do_splice_direct+0x2a0/0x3f0 [ 59.056382][ T3652] ? splice_direct_to_actor+0xc20/0xc20 [ 59.061931][ T3652] ? rcu_read_lock_any_held+0x5f/0x150 [ 59.067429][ T3652] ? _raw_spin_lock_irq+0xdb/0x110 [ 59.072540][ T3652] ? _raw_spin_lock_irqsave+0x120/0x120 [ 59.078071][ T3652] do_sendfile+0x623/0xf90 [ 59.082480][ T3652] ? do_pwritev+0x360/0x360 [ 59.086978][ T3652] ? _raw_spin_unlock_irq+0x2a/0x40 [ 59.092178][ T3652] ? ptrace_notify+0x245/0x340 [ 59.096938][ T3652] ? do_notify_parent+0xeb0/0xeb0 [ 59.101962][ T3652] __se_sys_sendfile64+0x178/0x1e0 [ 59.107060][ T3652] ? __x64_sys_sendfile64+0xa0/0xa0 [ 59.112251][ T3652] ? syscall_enter_from_user_mode+0x86/0x1a0 [ 59.118235][ T3652] do_syscall_64+0x2b/0x70 [ 59.122643][ T3652] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 59.128530][ T3652] RIP: 0033:0x7f647bbcde19 [ 59.132945][ T3652] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 59.152533][ T3652] RSP: 002b:00007ffd4087ce08 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [pid 3626] unlink("./2/binderfs") = 0 [pid 3626] umount2("./2/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3626] lstat("./2/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 3626] unlink("./2/cgroup") = 0 [pid 3626] umount2("./2/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3626] lstat("./2/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3626] unlink("./2/cgroup.net") = 0 [pid 3626] umount2("./2/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 3626] umount2("./2/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3626] lstat("./2/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3626] umount2("./2/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3626] openat(AT_FDCWD, "./2/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 3626] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3626] getdents64(4, 0x555555d5a660 /* 2 entries */, 32768) = 48 [pid 3626] getdents64(4, 0x555555d5a660 /* 0 entries */, 32768) = 0 [pid 3626] close(4) = 0 [pid 3626] rmdir("./2/file0") = 0 [pid 3626] umount2("./2/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3626] lstat("./2/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3626] unlink("./2/cgroup.cpu") = 0 [pid 3626] getdents64(3, 0x555555d52620 /* 0 entries */, 32768) = 0 [pid 3626] close(3) = 0 [pid 3626] rmdir("./2") = 0 [pid 3626] mkdir("./3", 0777) = 0 [ 59.160949][ T3652] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f647bbcde19 [ 59.168914][ T3652] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000006 [ 59.176886][ T3652] RBP: 0000000000000000 R08: 00007ffd4087ce30 R09: 00007ffd4087ce30 [ 59.184856][ T3652] R10: 0000000000000002 R11: 0000000000000246 R12: 00007ffd4087ce2c [ 59.192810][ T3652] R13: 00007ffd4087ce40 R14: 00007ffd4087ce80 R15: 0000000000000003 [ 59.200770][ T3652] [ 59.205527][ T3652] memory: usage 80kB, limit 0kB, failcnt 0 [ 59.211962][ T3652] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [pid 3626] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3656 attached [pid 3656] chdir("./3" [pid 3626] <... clone resumed>, child_tidptr=0x555555d515d0) = 5 [pid 3656] <... chdir resumed>) = 0 [pid 3656] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3656] setpgid(0, 0) = 0 [pid 3656] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 3656] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [pid 3656] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 3656] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3656] write(3, "1000", 4) = 4 [pid 3656] close(3) = 0 [pid 3656] symlink("/dev/binderfs", "./binderfs") = 0 [pid 3656] mkdir("./file0", 000) = 0 [pid 3656] open("./file0", O_RDONLY) = 3 [pid 3656] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 3656] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 3656] openat(4, "syz0", O_RDWR|O_PATH) = 5 [pid 3656] openat(5, "memory.max", O_RDWR) = 6 [ 59.219654][ T3652] Memory cgroup stats for /syz0: [ 59.219813][ T3652] anon 0 [ 59.219813][ T3652] file 12288 [ 59.219813][ T3652] kernel 69632 [ 59.219813][ T3652] kernel_stack 0 [ 59.219813][ T3652] pagetables 0 [ 59.219813][ T3652] percpu 0 [ 59.219813][ T3652] sock 0 [ 59.219813][ T3652] vmalloc 0 [ 59.219813][ T3652] shmem 0 [ 59.219813][ T3652] zswap 0 [ 59.219813][ T3652] zswapped 0 [ 59.219813][ T3652] file_mapped 0 [ 59.219813][ T3652] file_dirty 0 [ 59.219813][ T3652] file_writeback 0 [ 59.219813][ T3652] swapcached 0 [ 59.219813][ T3652] anon_thp 0 [ 59.219813][ T3652] file_thp 0 [ 59.219813][ T3652] shmem_thp 0 [ 59.219813][ T3652] inactive_anon 0 [ 59.219813][ T3652] active_anon 0 [ 59.219813][ T3652] inactive_file 8192 [ 59.219813][ T3652] active_file 4096 [ 59.219813][ T3652] unevictable 0 [ 59.219813][ T3652] slab_reclaimable 29520 [ 59.219813][ T3652] slab_unreclaimable 37656 [ 59.219813][ T3652] slab 67176 [ 59.219813][ T3652] workingset_refault_anon 0 [pid 3656] sendfile(6, 6, NULL, 2 [pid 3652] <... sendfile resumed>) = 2 [pid 3652] close(3) = 0 [pid 3652] close(4) = 0 [pid 3652] close(5) = 0 [pid 3652] close(6) = 0 [pid 3652] close(7) = -1 EBADF (Bad file descriptor) [pid 3652] close(8) = -1 EBADF (Bad file descriptor) [pid 3652] close(9) = -1 EBADF (Bad file descriptor) [pid 3652] close(10) = -1 EBADF (Bad file descriptor) [pid 3652] close(11) = -1 EBADF (Bad file descriptor) [pid 3652] close(12) = -1 EBADF (Bad file descriptor) [pid 3652] close(13) = -1 EBADF (Bad file descriptor) [pid 3652] close(14) = -1 EBADF (Bad file descriptor) [pid 3652] close(15) = -1 EBADF (Bad file descriptor) [pid 3652] close(16) = -1 EBADF (Bad file descriptor) [pid 3652] close(17) = -1 EBADF (Bad file descriptor) [pid 3652] close(18) = -1 EBADF (Bad file descriptor) [pid 3652] close(19) = -1 EBADF (Bad file descriptor) [pid 3652] close(20) = -1 EBADF (Bad file descriptor) [pid 3652] close(21) = -1 EBADF (Bad file descriptor) [pid 3652] close(22) = -1 EBADF (Bad file descriptor) [pid 3652] close(23) = -1 EBADF (Bad file descriptor) [pid 3652] close(24) = -1 EBADF (Bad file descriptor) [pid 3652] close(25) = -1 EBADF (Bad file descriptor) [pid 3652] close(26) = -1 EBADF (Bad file descriptor) [pid 3652] close(27) = -1 EBADF (Bad file descriptor) [pid 3652] close(28) = -1 EBADF (Bad file descriptor) [pid 3652] close(29) = -1 EBADF (Bad file descriptor) [pid 3652] exit_group(0) = ? [pid 3652] +++ exited with 0 +++ [pid 3623] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5, si_uid=0, si_status=0, si_utime=0, si_stime=52} --- [pid 3623] umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3623] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 3623] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 3623] getdents64(3, 0x555555d52620 /* 7 entries */, 32768) = 208 [pid 3623] umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3623] lstat("./3/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 3623] unlink("./3/binderfs") = 0 [pid 3623] umount2("./3/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3623] lstat("./3/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 3623] unlink("./3/cgroup") = 0 [pid 3623] umount2("./3/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3623] lstat("./3/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3623] unlink("./3/cgroup.net") = 0 [ 59.315187][ T3652] Tasks state (memory values in pages): [ 59.320769][ T3652] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 59.330462][ T3652] Out of memory and no killable processes... [ 59.336682][ T3653] syz-executor417 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 59.346983][ T3653] CPU: 1 PID: 3653 Comm: syz-executor417 Not tainted 5.19.0-rc7-syzkaller-00007-g353f7988dd84 #0 [ 59.357491][ T3653] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 [ 59.367554][ T3653] Call Trace: [ 59.370819][ T3653] [ 59.373737][ T3653] dump_stack_lvl+0x1e3/0x2cb [ 59.378402][ T3653] ? bfq_pos_tree_add_move+0x436/0x436 [ 59.383846][ T3653] ? panic+0x76e/0x76e [ 59.387912][ T3653] dump_header+0xdb/0x970 [ 59.392252][ T3653] out_of_memory+0x895/0xb30 [ 59.396845][ T3653] ? unregister_oom_notifier+0x20/0x20 [ 59.402300][ T3653] ? __lock_acquire+0x1f80/0x1f80 [ 59.407342][ T3653] mem_cgroup_out_of_memory+0x25d/0x3b0 [ 59.412888][ T3653] ? preempt_schedule_thunk+0x16/0x18 [ 59.418251][ T3653] ? mem_cgroup_oom_trylock+0x220/0x220 [ 59.423814][ T3653] ? cgroup_file_notify+0x123/0x190 [ 59.429017][ T3653] memory_max_write+0x364/0x4f0 [ 59.433858][ T3653] ? memory_max_show+0xa0/0xa0 [ 59.438610][ T3653] ? read_lock_is_recursive+0x10/0x10 [ 59.443966][ T3653] ? memory_max_show+0xa0/0xa0 [ 59.448715][ T3653] cgroup_file_write+0x2ab/0x780 [ 59.453640][ T3653] ? cgroup_seqfile_stop+0xd0/0xd0 [ 59.458738][ T3653] ? check_heap_object+0x23e/0x820 [ 59.463842][ T3653] ? kernfs_get_active+0xee/0x160 [ 59.468854][ T3653] ? cgroup_seqfile_stop+0xd0/0xd0 [ 59.473953][ T3653] kernfs_fop_write_iter+0x3ac/0x500 [ 59.479231][ T3653] do_iter_readv_writev+0x499/0x650 [ 59.484434][ T3653] ? generic_file_rw_checks+0x250/0x250 [ 59.489980][ T3653] ? bpf_lsm_file_permission+0x5/0x10 [ 59.495362][ T3653] ? security_file_permission+0xe0/0x5c0 [ 59.500994][ T3653] ? do_iter_write+0x147/0x7a0 [ 59.505758][ T3653] do_iter_write+0x1f1/0x7a0 [ 59.510344][ T3653] ? vfs_iter_write+0x69/0xa0 [ 59.515012][ T3653] iter_file_splice_write+0x830/0xff0 [ 59.520485][ T3653] ? splice_from_pipe+0x220/0x220 [ 59.525499][ T3653] ? generic_file_splice_read+0x46b/0x660 [ 59.531214][ T3653] ? splice_shrink_spd+0xb0/0xb0 [ 59.536144][ T3653] ? splice_from_pipe+0x220/0x220 [ 59.541157][ T3653] direct_splice_actor+0xe6/0x1c0 [ 59.546173][ T3653] splice_direct_to_actor+0x514/0xc20 [ 59.551538][ T3653] ? do_splice_direct+0x3f0/0x3f0 [ 59.556551][ T3653] ? pipe_to_sendpage+0x340/0x340 [ 59.561579][ T3653] ? do_sendfile+0x600/0xf90 [ 59.566165][ T3653] ? read_lock_is_recursive+0x10/0x10 [ 59.571528][ T3653] ? bpf_lsm_file_permission+0x5/0x10 [ 59.576888][ T3653] ? security_file_permission+0xe0/0x5c0 [ 59.582510][ T3653] do_splice_direct+0x2a0/0x3f0 [ 59.587352][ T3653] ? splice_direct_to_actor+0xc20/0xc20 [ 59.592884][ T3653] ? rcu_read_lock_any_held+0x5f/0x150 [ 59.598337][ T3653] ? _raw_spin_lock_irq+0xdb/0x110 [ 59.603440][ T3653] ? _raw_spin_lock_irqsave+0x120/0x120 [ 59.608979][ T3653] do_sendfile+0x623/0xf90 [ 59.613391][ T3653] ? do_pwritev+0x360/0x360 [ 59.617883][ T3653] ? _raw_spin_unlock_irq+0x2a/0x40 [ 59.623070][ T3653] ? ptrace_notify+0x245/0x340 [ 59.627825][ T3653] ? do_notify_parent+0xeb0/0xeb0 [ 59.632838][ T3653] __se_sys_sendfile64+0x178/0x1e0 [ 59.637937][ T3653] ? __x64_sys_sendfile64+0xa0/0xa0 [ 59.643124][ T3653] ? syscall_enter_from_user_mode+0x86/0x1a0 [ 59.649096][ T3653] do_syscall_64+0x2b/0x70 [ 59.653519][ T3653] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 59.659420][ T3653] RIP: 0033:0x7f647bbcde19 [ 59.663826][ T3653] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 59.683420][ T3653] RSP: 002b:00007ffd4087ce08 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 59.691819][ T3653] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f647bbcde19 [ 59.699777][ T3653] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000006 [ 59.707736][ T3653] RBP: 0000000000000000 R08: 00007ffd4087ce30 R09: 00007ffd4087ce30 [pid 3623] umount2("./3/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 3623] umount2("./3/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3623] lstat("./3/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3623] umount2("./3/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3623] openat(AT_FDCWD, "./3/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 3623] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3623] getdents64(4, 0x555555d5a660 /* 2 entries */, 32768) = 48 [pid 3623] getdents64(4, 0x555555d5a660 /* 0 entries */, 32768) = 0 [pid 3623] close(4) = 0 [pid 3623] rmdir("./3/file0") = 0 [pid 3623] umount2("./3/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3623] lstat("./3/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3623] unlink("./3/cgroup.cpu") = 0 [pid 3623] getdents64(3, 0x555555d52620 /* 0 entries */, 32768) = 0 [pid 3623] close(3) = 0 [pid 3623] rmdir("./3") = 0 [pid 3623] mkdir("./4", 0777) = 0 [pid 3623] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3657 attached [pid 3657] chdir("./4" [pid 3623] <... clone resumed>, child_tidptr=0x555555d515d0) = 6 [pid 3657] <... chdir resumed>) = 0 [pid 3657] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3657] setpgid(0, 0) = 0 [pid 3657] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 3657] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 3657] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [pid 3657] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3657] write(3, "1000", 4) = 4 [pid 3657] close(3) = 0 [pid 3657] symlink("/dev/binderfs", "./binderfs") = 0 [pid 3657] mkdir("./file0", 000) = 0 [pid 3657] open("./file0", O_RDONLY) = 3 [pid 3657] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 3657] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 3657] openat(4, "syz0", O_RDWR|O_PATH) = 5 [ 59.715696][ T3653] R10: 0000000000000002 R11: 0000000000000246 R12: 00007ffd4087ce2c [ 59.723653][ T3653] R13: 00007ffd4087ce40 R14: 00007ffd4087ce80 R15: 0000000000000003 [ 59.731618][ T3653] [ 59.737679][ T3653] memory: usage 80kB, limit 0kB, failcnt 0 [ 59.743926][ T3653] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 59.753115][ T3653] Memory cgroup stats for /syz0: [ 59.753272][ T3653] anon 0 [ 59.753272][ T3653] file 12288 [ 59.753272][ T3653] kernel 69632 [ 59.753272][ T3653] kernel_stack 0 [pid 3657] openat(5, "memory.max", O_RDWR) = 6 [ 59.753272][ T3653] pagetables 0 [ 59.753272][ T3653] percpu 0 [ 59.753272][ T3653] sock 0 [ 59.753272][ T3653] vmalloc 0 [ 59.753272][ T3653] shmem 0 [ 59.753272][ T3653] zswap 0 [ 59.753272][ T3653] zswapped 0 [ 59.753272][ T3653] file_mapped 0 [ 59.753272][ T3653] file_dirty 0 [ 59.753272][ T3653] file_writeback 0 [ 59.753272][ T3653] swapcached 0 [ 59.753272][ T3653] anon_thp 0 [ 59.753272][ T3653] file_thp 0 [ 59.753272][ T3653] shmem_thp 0 [ 59.753272][ T3653] inactive_anon 0 [ 59.753272][ T3653] active_anon 0 [ 59.753272][ T3653] inactive_file 0 [ 59.753272][ T3653] active_file 12288 [ 59.753272][ T3653] unevictable 0 [ 59.753272][ T3653] slab_reclaimable 29520 [ 59.753272][ T3653] slab_unreclaimable 37656 [ 59.753272][ T3653] slab 67176 [ 59.753272][ T3653] workingset_refault_anon 0 [ 59.848165][ T3653] Tasks state (memory values in pages): [ 59.853733][ T3653] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 59.863348][ T3653] Out of memory and no killable processes... [pid 3657] sendfile(6, 6, NULL, 2 [pid 3653] <... sendfile resumed>) = 2 [ 59.869746][ T3654] syz-executor417 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 59.880159][ T3654] CPU: 0 PID: 3654 Comm: syz-executor417 Not tainted 5.19.0-rc7-syzkaller-00007-g353f7988dd84 #0 [ 59.890669][ T3654] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 [ 59.900717][ T3654] Call Trace: [ 59.903998][ T3654] [ 59.906949][ T3654] dump_stack_lvl+0x1e3/0x2cb [ 59.911619][ T3654] ? bfq_pos_tree_add_move+0x436/0x436 [ 59.917064][ T3654] ? panic+0x76e/0x76e [pid 3653] close(3) = 0 [pid 3653] close(4) = 0 [pid 3653] close(5) = 0 [pid 3653] close(6) = 0 [pid 3653] close(7) = -1 EBADF (Bad file descriptor) [pid 3653] close(8) = -1 EBADF (Bad file descriptor) [pid 3653] close(9) = -1 EBADF (Bad file descriptor) [pid 3653] close(10) = -1 EBADF (Bad file descriptor) [pid 3653] close(11) = -1 EBADF (Bad file descriptor) [pid 3653] close(12) = -1 EBADF (Bad file descriptor) [pid 3653] close(13) = -1 EBADF (Bad file descriptor) [pid 3653] close(14) = -1 EBADF (Bad file descriptor) [pid 3653] close(15) = -1 EBADF (Bad file descriptor) [pid 3653] close(16) = -1 EBADF (Bad file descriptor) [ 59.921130][ T3654] dump_header+0xdb/0x970 [ 59.925461][ T3654] out_of_memory+0x895/0xb30 [ 59.930047][ T3654] ? unregister_oom_notifier+0x20/0x20 [ 59.935518][ T3654] ? __lock_acquire+0x1f80/0x1f80 [ 59.940546][ T3654] mem_cgroup_out_of_memory+0x25d/0x3b0 [ 59.946077][ T3654] ? preempt_schedule_thunk+0x16/0x18 [ 59.951441][ T3654] ? mem_cgroup_oom_trylock+0x220/0x220 [ 59.957003][ T3654] ? cgroup_file_notify+0x123/0x190 [ 59.962221][ T3654] memory_max_write+0x364/0x4f0 [ 59.967089][ T3654] ? memory_max_show+0xa0/0xa0 [pid 3653] close(17) = -1 EBADF (Bad file descriptor) [pid 3653] close(18) = -1 EBADF (Bad file descriptor) [pid 3653] close(19) = -1 EBADF (Bad file descriptor) [pid 3653] close(20) = -1 EBADF (Bad file descriptor) [pid 3653] close(21) = -1 EBADF (Bad file descriptor) [pid 3653] close(22) = -1 EBADF (Bad file descriptor) [pid 3653] close(23) = -1 EBADF (Bad file descriptor) [pid 3653] close(24) = -1 EBADF (Bad file descriptor) [pid 3653] close(25) = -1 EBADF (Bad file descriptor) [pid 3653] close(26) = -1 EBADF (Bad file descriptor) [pid 3653] close(27) = -1 EBADF (Bad file descriptor) [pid 3653] close(28) = -1 EBADF (Bad file descriptor) [pid 3653] close(29) = -1 EBADF (Bad file descriptor) [pid 3653] exit_group(0) = ? [pid 3653] +++ exited with 0 +++ [pid 3622] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5, si_uid=0, si_status=0, si_utime=0, si_stime=52} --- [pid 3622] umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 59.971870][ T3654] ? read_lock_is_recursive+0x10/0x10 [ 59.977260][ T3654] ? memory_max_show+0xa0/0xa0 [ 59.982046][ T3654] cgroup_file_write+0x2ab/0x780 [ 59.986999][ T3654] ? cgroup_seqfile_stop+0xd0/0xd0 [ 59.992139][ T3654] ? check_heap_object+0x23e/0x820 [ 59.997252][ T3654] ? kernfs_get_active+0xee/0x160 [ 60.002269][ T3654] ? cgroup_seqfile_stop+0xd0/0xd0 [ 60.007363][ T3654] kernfs_fop_write_iter+0x3ac/0x500 [ 60.012636][ T3654] do_iter_readv_writev+0x499/0x650 [ 60.017844][ T3654] ? generic_file_rw_checks+0x250/0x250 [ 60.023390][ T3654] ? bpf_lsm_file_permission+0x5/0x10 [ 60.028854][ T3654] ? security_file_permission+0xe0/0x5c0 [ 60.034473][ T3654] ? do_iter_write+0x147/0x7a0 [ 60.039236][ T3654] do_iter_write+0x1f1/0x7a0 [ 60.043845][ T3654] ? vfs_iter_write+0x69/0xa0 [ 60.048526][ T3654] iter_file_splice_write+0x830/0xff0 [ 60.053909][ T3654] ? splice_from_pipe+0x220/0x220 [ 60.058944][ T3654] ? generic_file_splice_read+0x46b/0x660 [ 60.064678][ T3654] ? splice_shrink_spd+0xb0/0xb0 [ 60.069605][ T3654] ? splice_from_pipe+0x220/0x220 [ 60.074620][ T3654] direct_splice_actor+0xe6/0x1c0 [ 60.079640][ T3654] splice_direct_to_actor+0x514/0xc20 [ 60.085022][ T3654] ? do_splice_direct+0x3f0/0x3f0 [ 60.090064][ T3654] ? pipe_to_sendpage+0x340/0x340 [ 60.095102][ T3654] ? do_sendfile+0x600/0xf90 [ 60.099694][ T3654] ? read_lock_is_recursive+0x10/0x10 [ 60.105059][ T3654] ? bpf_lsm_file_permission+0x5/0x10 [ 60.110441][ T3654] ? security_file_permission+0xe0/0x5c0 [ 60.116074][ T3654] do_splice_direct+0x2a0/0x3f0 [pid 3622] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 3622] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 3622] getdents64(3, 0x555555d52620 /* 7 entries */, 32768) = 208 [pid 3622] umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3622] lstat("./3/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 3622] unlink("./3/binderfs") = 0 [pid 3622] umount2("./3/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3622] lstat("./3/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 3622] unlink("./3/cgroup") = 0 [ 60.120918][ T3654] ? splice_direct_to_actor+0xc20/0xc20 [ 60.126457][ T3654] ? rcu_read_lock_any_held+0x5f/0x150 [ 60.131934][ T3654] ? _raw_spin_lock_irq+0xdb/0x110 [ 60.137066][ T3654] ? _raw_spin_lock_irqsave+0x120/0x120 [ 60.142612][ T3654] do_sendfile+0x623/0xf90 [ 60.147040][ T3654] ? do_pwritev+0x360/0x360 [ 60.151540][ T3654] ? _raw_spin_unlock_irq+0x2a/0x40 [ 60.156753][ T3654] ? ptrace_notify+0x245/0x340 [ 60.161509][ T3654] ? do_notify_parent+0xeb0/0xeb0 [ 60.166524][ T3654] __se_sys_sendfile64+0x178/0x1e0 [ 60.171625][ T3654] ? __x64_sys_sendfile64+0xa0/0xa0 [ 60.176824][ T3654] ? syscall_enter_from_user_mode+0x86/0x1a0 [ 60.182811][ T3654] do_syscall_64+0x2b/0x70 [ 60.187223][ T3654] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 60.193119][ T3654] RIP: 0033:0x7f647bbcde19 [ 60.197521][ T3654] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 3622] umount2("./3/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3622] lstat("./3/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3622] unlink("./3/cgroup.net") = 0 [pid 3622] umount2("./3/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 3622] umount2("./3/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3622] lstat("./3/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [ 60.217116][ T3654] RSP: 002b:00007ffd4087ce08 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 60.225518][ T3654] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f647bbcde19 [ 60.233488][ T3654] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000006 [ 60.241473][ T3654] RBP: 0000000000000000 R08: 00007ffd4087ce30 R09: 00007ffd4087ce30 [ 60.249474][ T3654] R10: 0000000000000002 R11: 0000000000000246 R12: 00007ffd4087ce2c [ 60.257527][ T3654] R13: 00007ffd4087ce40 R14: 00007ffd4087ce80 R15: 0000000000000003 [ 60.265504][ T3654] [pid 3622] umount2("./3/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3622] openat(AT_FDCWD, "./3/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 3622] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3622] getdents64(4, 0x555555d5a660 /* 2 entries */, 32768) = 48 [pid 3622] getdents64(4, 0x555555d5a660 /* 0 entries */, 32768) = 0 [pid 3622] close(4) = 0 [pid 3622] rmdir("./3/file0") = 0 [pid 3622] umount2("./3/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3622] lstat("./3/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3622] unlink("./3/cgroup.cpu") = 0 [pid 3622] getdents64(3, 0x555555d52620 /* 0 entries */, 32768) = 0 [pid 3622] close(3) = 0 [pid 3622] rmdir("./3") = 0 [pid 3622] mkdir("./4", 0777) = 0 [pid 3622] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555d515d0) = 6 ./strace-static-x86_64: Process 3658 attached [pid 3658] chdir("./4") = 0 [pid 3658] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3658] setpgid(0, 0) = 0 [pid 3658] symlink("/syzcgroup/unified/syz1", "./cgroup") = 0 [pid 3658] symlink("/syzcgroup/cpu/syz1", "./cgroup.cpu") = 0 [pid 3658] symlink("/syzcgroup/net/syz1", "./cgroup.net") = 0 [pid 3658] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3658] write(3, "1000", 4) = 4 [pid 3658] close(3) = 0 [pid 3658] symlink("/dev/binderfs", "./binderfs") = 0 [pid 3658] mkdir("./file0", 000) = 0 [pid 3658] open("./file0", O_RDONLY) = 3 [pid 3658] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 3658] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 3658] openat(4, "syz0", O_RDWR|O_PATH) = 5 [pid 3658] openat(5, "memory.max", O_RDWR) = 6 [ 60.270715][ T3654] memory: usage 80kB, limit 0kB, failcnt 0 [ 60.276934][ T3654] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 60.284183][ T3654] Memory cgroup stats for /syz0: [ 60.284683][ T3654] anon 0 [ 60.284683][ T3654] file 12288 [ 60.284683][ T3654] kernel 69632 [ 60.284683][ T3654] kernel_stack 0 [ 60.284683][ T3654] pagetables 0 [ 60.284683][ T3654] percpu 0 [ 60.284683][ T3654] sock 0 [ 60.284683][ T3654] vmalloc 0 [ 60.284683][ T3654] shmem 0 [ 60.284683][ T3654] zswap 0 [ 60.284683][ T3654] zswapped 0 [ 60.284683][ T3654] file_mapped 0 [ 60.284683][ T3654] file_dirty 0 [ 60.284683][ T3654] file_writeback 0 [ 60.284683][ T3654] swapcached 0 [ 60.284683][ T3654] anon_thp 0 [ 60.284683][ T3654] file_thp 0 [ 60.284683][ T3654] shmem_thp 0 [ 60.284683][ T3654] inactive_anon 0 [ 60.284683][ T3654] active_anon 0 [ 60.284683][ T3654] inactive_file 8192 [ 60.284683][ T3654] active_file 4096 [ 60.284683][ T3654] unevictable 0 [ 60.284683][ T3654] slab_reclaimable 29520 [ 60.284683][ T3654] slab_unreclaimable 37656 [ 60.284683][ T3654] slab 67176 [pid 3658] sendfile(6, 6, NULL, 2 [pid 3654] <... sendfile resumed>) = 2 [pid 3654] close(3) = 0 [pid 3654] close(4) = 0 [pid 3654] close(5) = 0 [pid 3654] close(6) = 0 [pid 3654] close(7) = -1 EBADF (Bad file descriptor) [pid 3654] close(8) = -1 EBADF (Bad file descriptor) [pid 3654] close(9) = -1 EBADF (Bad file descriptor) [pid 3654] close(10) = -1 EBADF (Bad file descriptor) [pid 3654] close(11) = -1 EBADF (Bad file descriptor) [pid 3654] close(12) = -1 EBADF (Bad file descriptor) [pid 3654] close(13) = -1 EBADF (Bad file descriptor) [pid 3654] close(14) = -1 EBADF (Bad file descriptor) [pid 3654] close(15) = -1 EBADF (Bad file descriptor) [pid 3654] close(16) = -1 EBADF (Bad file descriptor) [pid 3654] close(17) = -1 EBADF (Bad file descriptor) [pid 3654] close(18) = -1 EBADF (Bad file descriptor) [pid 3654] close(19) = -1 EBADF (Bad file descriptor) [pid 3654] close(20) = -1 EBADF (Bad file descriptor) [pid 3654] close(21) = -1 EBADF (Bad file descriptor) [pid 3654] close(22) = -1 EBADF (Bad file descriptor) [pid 3654] close(23) = -1 EBADF (Bad file descriptor) [pid 3654] close(24) = -1 EBADF (Bad file descriptor) [pid 3654] close(25) = -1 EBADF (Bad file descriptor) [pid 3654] close(26) = -1 EBADF (Bad file descriptor) [pid 3654] close(27) = -1 EBADF (Bad file descriptor) [pid 3654] close(28) = -1 EBADF (Bad file descriptor) [pid 3654] close(29) = -1 EBADF (Bad file descriptor) [pid 3654] exit_group(0) = ? [pid 3654] +++ exited with 0 +++ [pid 3625] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5, si_uid=0, si_status=0, si_utime=0, si_stime=54} --- [pid 3625] umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3625] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 3625] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 3625] getdents64(3, 0x555555d52620 /* 7 entries */, 32768) = 208 [pid 3625] umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3625] lstat("./3/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 3625] unlink("./3/binderfs") = 0 [pid 3625] umount2("./3/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3625] lstat("./3/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 3625] unlink("./3/cgroup") = 0 [pid 3625] umount2("./3/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3625] lstat("./3/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3625] unlink("./3/cgroup.net") = 0 [ 60.284683][ T3654] workingset_refault_anon 0 [ 60.379448][ T3654] Tasks state (memory values in pages): [ 60.385036][ T3654] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 60.394623][ T3654] Out of memory and no killable processes... [ 60.400728][ T3655] syz-executor417 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 60.411229][ T3655] CPU: 1 PID: 3655 Comm: syz-executor417 Not tainted 5.19.0-rc7-syzkaller-00007-g353f7988dd84 #0 [ 60.421750][ T3655] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 [ 60.431819][ T3655] Call Trace: [ 60.435110][ T3655] [ 60.438038][ T3655] dump_stack_lvl+0x1e3/0x2cb [ 60.442724][ T3655] ? bfq_pos_tree_add_move+0x436/0x436 [ 60.448173][ T3655] ? panic+0x76e/0x76e [ 60.452245][ T3655] dump_header+0xdb/0x970 [ 60.456579][ T3655] out_of_memory+0x895/0xb30 [ 60.461180][ T3655] ? unregister_oom_notifier+0x20/0x20 [ 60.466630][ T3655] ? __lock_acquire+0x1f80/0x1f80 [ 60.471646][ T3655] mem_cgroup_out_of_memory+0x25d/0x3b0 [ 60.477184][ T3655] ? preempt_schedule_thunk+0x16/0x18 [ 60.482559][ T3655] ? mem_cgroup_oom_trylock+0x220/0x220 [ 60.488092][ T3655] ? cgroup_file_notify+0x123/0x190 [ 60.493273][ T3655] memory_max_write+0x364/0x4f0 [ 60.498113][ T3655] ? memory_max_show+0xa0/0xa0 [ 60.502890][ T3655] ? read_lock_is_recursive+0x10/0x10 [ 60.508244][ T3655] ? memory_max_show+0xa0/0xa0 [ 60.513004][ T3655] cgroup_file_write+0x2ab/0x780 [ 60.517950][ T3655] ? cgroup_seqfile_stop+0xd0/0xd0 [ 60.523052][ T3655] ? check_heap_object+0x23e/0x820 [ 60.528149][ T3655] ? kernfs_get_active+0xee/0x160 [ 60.533162][ T3655] ? cgroup_seqfile_stop+0xd0/0xd0 [ 60.538631][ T3655] kernfs_fop_write_iter+0x3ac/0x500 [ 60.544050][ T3655] do_iter_readv_writev+0x499/0x650 [ 60.549236][ T3655] ? generic_file_rw_checks+0x250/0x250 [ 60.554772][ T3655] ? bpf_lsm_file_permission+0x5/0x10 [ 60.560129][ T3655] ? security_file_permission+0xe0/0x5c0 [ 60.565750][ T3655] ? do_iter_write+0x147/0x7a0 [ 60.570524][ T3655] do_iter_write+0x1f1/0x7a0 [ 60.575120][ T3655] ? vfs_iter_write+0x69/0xa0 [ 60.579786][ T3655] iter_file_splice_write+0x830/0xff0 [ 60.585255][ T3655] ? splice_from_pipe+0x220/0x220 [ 60.590285][ T3655] ? generic_file_splice_read+0x46b/0x660 [ 60.596015][ T3655] ? splice_shrink_spd+0xb0/0xb0 [ 60.600959][ T3655] ? splice_from_pipe+0x220/0x220 [ 60.605988][ T3655] direct_splice_actor+0xe6/0x1c0 [ 60.611001][ T3655] splice_direct_to_actor+0x514/0xc20 [ 60.616387][ T3655] ? do_splice_direct+0x3f0/0x3f0 [ 60.621412][ T3655] ? pipe_to_sendpage+0x340/0x340 [ 60.626435][ T3655] ? do_sendfile+0x600/0xf90 [ 60.631014][ T3655] ? read_lock_is_recursive+0x10/0x10 [ 60.636371][ T3655] ? bpf_lsm_file_permission+0x5/0x10 [ 60.641728][ T3655] ? security_file_permission+0xe0/0x5c0 [ 60.647355][ T3655] do_splice_direct+0x2a0/0x3f0 [ 60.652219][ T3655] ? splice_direct_to_actor+0xc20/0xc20 [ 60.657770][ T3655] ? rcu_read_lock_any_held+0x5f/0x150 [ 60.663241][ T3655] ? _raw_spin_lock_irq+0xdb/0x110 [ 60.668354][ T3655] ? _raw_spin_lock_irqsave+0x120/0x120 [ 60.673885][ T3655] do_sendfile+0x623/0xf90 [ 60.678305][ T3655] ? do_pwritev+0x360/0x360 [ 60.682803][ T3655] ? _raw_spin_unlock_irq+0x2a/0x40 [ 60.688013][ T3655] ? ptrace_notify+0x245/0x340 [ 60.692788][ T3655] ? do_notify_parent+0xeb0/0xeb0 [ 60.697821][ T3655] __se_sys_sendfile64+0x178/0x1e0 [ 60.702946][ T3655] ? __x64_sys_sendfile64+0xa0/0xa0 [ 60.708165][ T3655] ? syscall_enter_from_user_mode+0x86/0x1a0 [ 60.714153][ T3655] do_syscall_64+0x2b/0x70 [ 60.718588][ T3655] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 60.724473][ T3655] RIP: 0033:0x7f647bbcde19 [ 60.728895][ T3655] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 60.748502][ T3655] RSP: 002b:00007ffd4087ce08 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 60.756915][ T3655] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f647bbcde19 [ 60.764890][ T3655] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000006 [pid 3625] umount2("./3/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 3625] umount2("./3/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3625] lstat("./3/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3625] umount2("./3/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3625] openat(AT_FDCWD, "./3/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 3625] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3625] getdents64(4, 0x555555d5a660 /* 2 entries */, 32768) = 48 [pid 3625] getdents64(4, 0x555555d5a660 /* 0 entries */, 32768) = 0 [pid 3625] close(4) = 0 [pid 3625] rmdir("./3/file0") = 0 [pid 3625] umount2("./3/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3625] lstat("./3/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3625] unlink("./3/cgroup.cpu") = 0 [pid 3625] getdents64(3, 0x555555d52620 /* 0 entries */, 32768) = 0 [pid 3625] close(3) = 0 [pid 3625] rmdir("./3") = 0 [pid 3625] mkdir("./4", 0777) = 0 [pid 3625] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555d515d0) = 6 ./strace-static-x86_64: Process 3659 attached [pid 3659] chdir("./4") = 0 [ 60.772871][ T3655] RBP: 0000000000000000 R08: 00007ffd4087ce30 R09: 00007ffd4087ce30 [ 60.780848][ T3655] R10: 0000000000000002 R11: 0000000000000246 R12: 00007ffd4087ce2c [ 60.788813][ T3655] R13: 00007ffd4087ce40 R14: 00007ffd4087ce80 R15: 0000000000000003 [ 60.796789][ T3655] [ 60.800628][ T3655] memory: usage 80kB, limit 0kB, failcnt 0 [ 60.806494][ T3655] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 60.813350][ T3655] Memory cgroup stats for /syz0: [ 60.813522][ T3655] anon 0 [ 60.813522][ T3655] file 12288 [pid 3659] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3659] setpgid(0, 0) = 0 [pid 3659] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [pid 3659] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 3659] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 3659] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3659] write(3, "1000", 4) = 4 [pid 3659] close(3) = 0 [pid 3659] symlink("/dev/binderfs", "./binderfs") = 0 [pid 3659] mkdir("./file0", 000) = 0 [pid 3659] open("./file0", O_RDONLY) = 3 [pid 3659] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 3659] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 3659] openat(4, "syz0", O_RDWR|O_PATH) = 5 [pid 3659] openat(5, "memory.max", O_RDWR) = 6 [ 60.813522][ T3655] kernel 69632 [ 60.813522][ T3655] kernel_stack 0 [ 60.813522][ T3655] pagetables 0 [ 60.813522][ T3655] percpu 0 [ 60.813522][ T3655] sock 0 [ 60.813522][ T3655] vmalloc 0 [ 60.813522][ T3655] shmem 0 [ 60.813522][ T3655] zswap 0 [ 60.813522][ T3655] zswapped 0 [ 60.813522][ T3655] file_mapped 0 [ 60.813522][ T3655] file_dirty 0 [ 60.813522][ T3655] file_writeback 0 [ 60.813522][ T3655] swapcached 0 [ 60.813522][ T3655] anon_thp 0 [ 60.813522][ T3655] file_thp 0 [ 60.813522][ T3655] shmem_thp 0 [ 60.813522][ T3655] inactive_anon 0 [ 60.813522][ T3655] active_anon 0 [ 60.813522][ T3655] inactive_file 8192 [ 60.813522][ T3655] active_file 4096 [ 60.813522][ T3655] unevictable 0 [ 60.813522][ T3655] slab_reclaimable 29520 [ 60.813522][ T3655] slab_unreclaimable 37656 [ 60.813522][ T3655] slab 67176 [ 60.813522][ T3655] workingset_refault_anon 0 [ 60.908083][ T3655] Tasks state (memory values in pages): [ 60.913642][ T3655] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [pid 3659] sendfile(6, 6, NULL, 2 [pid 3655] <... sendfile resumed>) = 2 [ 60.923131][ T3655] Out of memory and no killable processes... [ 60.929156][ T3656] syz-executor417 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 60.939500][ T3656] CPU: 1 PID: 3656 Comm: syz-executor417 Not tainted 5.19.0-rc7-syzkaller-00007-g353f7988dd84 #0 [ 60.950013][ T3656] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 [ 60.960056][ T3656] Call Trace: [ 60.963323][ T3656] [ 60.966243][ T3656] dump_stack_lvl+0x1e3/0x2cb [ 60.970924][ T3656] ? bfq_pos_tree_add_move+0x436/0x436 [ 60.976372][ T3656] ? panic+0x76e/0x76e [ 60.980432][ T3656] dump_header+0xdb/0x970 [ 60.984750][ T3656] out_of_memory+0x895/0xb30 [ 60.989328][ T3656] ? unregister_oom_notifier+0x20/0x20 [ 60.994775][ T3656] ? __lock_acquire+0x1f80/0x1f80 [ 60.999787][ T3656] mem_cgroup_out_of_memory+0x25d/0x3b0 [ 61.005319][ T3656] ? preempt_schedule_thunk+0x16/0x18 [ 61.010678][ T3656] ? mem_cgroup_oom_trylock+0x220/0x220 [ 61.016212][ T3656] ? cgroup_file_notify+0x123/0x190 [ 61.021406][ T3656] memory_max_write+0x364/0x4f0 [ 61.026254][ T3656] ? memory_max_show+0xa0/0xa0 [ 61.031007][ T3656] ? read_lock_is_recursive+0x10/0x10 [ 61.036364][ T3656] ? memory_max_show+0xa0/0xa0 [ 61.041114][ T3656] cgroup_file_write+0x2ab/0x780 [ 61.046041][ T3656] ? cgroup_seqfile_stop+0xd0/0xd0 [ 61.051143][ T3656] ? check_heap_object+0x23e/0x820 [ 61.056240][ T3656] ? kernfs_get_active+0xee/0x160 [ 61.061250][ T3656] ? cgroup_seqfile_stop+0xd0/0xd0 [ 61.066347][ T3656] kernfs_fop_write_iter+0x3ac/0x500 [ 61.071620][ T3656] do_iter_readv_writev+0x499/0x650 [ 61.076808][ T3656] ? generic_file_rw_checks+0x250/0x250 [ 61.082341][ T3656] ? bpf_lsm_file_permission+0x5/0x10 [ 61.087703][ T3656] ? security_file_permission+0xe0/0x5c0 [ 61.093323][ T3656] ? do_iter_write+0x147/0x7a0 [ 61.098072][ T3656] do_iter_write+0x1f1/0x7a0 [ 61.102651][ T3656] ? vfs_iter_write+0x69/0xa0 [ 61.107311][ T3656] iter_file_splice_write+0x830/0xff0 [ 61.112678][ T3656] ? splice_from_pipe+0x220/0x220 [ 61.117684][ T3656] ? generic_file_splice_read+0x46b/0x660 [ 61.123390][ T3656] ? splice_shrink_spd+0xb0/0xb0 [ 61.128316][ T3656] ? splice_from_pipe+0x220/0x220 [ 61.133330][ T3656] direct_splice_actor+0xe6/0x1c0 [ 61.138342][ T3656] splice_direct_to_actor+0x514/0xc20 [ 61.143706][ T3656] ? do_splice_direct+0x3f0/0x3f0 [ 61.148717][ T3656] ? pipe_to_sendpage+0x340/0x340 [ 61.153728][ T3656] ? do_sendfile+0x600/0xf90 [ 61.158303][ T3656] ? read_lock_is_recursive+0x10/0x10 [ 61.163662][ T3656] ? bpf_lsm_file_permission+0x5/0x10 [ 61.169020][ T3656] ? security_file_permission+0xe0/0x5c0 [ 61.174642][ T3656] do_splice_direct+0x2a0/0x3f0 [ 61.179485][ T3656] ? splice_direct_to_actor+0xc20/0xc20 [ 61.185014][ T3656] ? rcu_read_lock_any_held+0x5f/0x150 [ 61.190460][ T3656] ? _raw_spin_lock_irq+0xdb/0x110 [ 61.195556][ T3656] ? _raw_spin_lock_irqsave+0x120/0x120 [ 61.201088][ T3656] do_sendfile+0x623/0xf90 [ 61.205493][ T3656] ? do_pwritev+0x360/0x360 [ 61.209982][ T3656] ? _raw_spin_unlock_irq+0x2a/0x40 [ 61.215181][ T3656] ? ptrace_notify+0x245/0x340 [ 61.219938][ T3656] ? do_notify_parent+0xeb0/0xeb0 [ 61.224954][ T3656] __se_sys_sendfile64+0x178/0x1e0 [ 61.230058][ T3656] ? __x64_sys_sendfile64+0xa0/0xa0 [ 61.235243][ T3656] ? syscall_enter_from_user_mode+0x86/0x1a0 [ 61.241213][ T3656] do_syscall_64+0x2b/0x70 [ 61.245628][ T3656] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 61.251537][ T3656] RIP: 0033:0x7f647bbcde19 [ 61.255941][ T3656] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 61.275534][ T3656] RSP: 002b:00007ffd4087ce08 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 61.284020][ T3656] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f647bbcde19 [ 61.291977][ T3656] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000006 [ 61.299935][ T3656] RBP: 0000000000000000 R08: 00007ffd4087ce30 R09: 00007ffd4087ce30 [ 61.307892][ T3656] R10: 0000000000000002 R11: 0000000000000246 R12: 00007ffd4087ce2c [ 61.315865][ T3656] R13: 00007ffd4087ce40 R14: 00007ffd4087ce80 R15: 0000000000000003 [ 61.323831][ T3656] [pid 3655] close(3) = 0 [pid 3655] close(4) = 0 [pid 3655] close(5) = 0 [pid 3655] close(6) = 0 [pid 3655] close(7) = -1 EBADF (Bad file descriptor) [pid 3655] close(8) = -1 EBADF (Bad file descriptor) [pid 3655] close(9) = -1 EBADF (Bad file descriptor) [pid 3655] close(10) = -1 EBADF (Bad file descriptor) [pid 3655] close(11) = -1 EBADF (Bad file descriptor) [pid 3655] close(12) = -1 EBADF (Bad file descriptor) [pid 3655] close(13) = -1 EBADF (Bad file descriptor) [pid 3655] close(14) = -1 EBADF (Bad file descriptor) [pid 3655] close(15) = -1 EBADF (Bad file descriptor) [pid 3655] close(16) = -1 EBADF (Bad file descriptor) [pid 3655] close(17) = -1 EBADF (Bad file descriptor) [pid 3655] close(18) = -1 EBADF (Bad file descriptor) [pid 3655] close(19) = -1 EBADF (Bad file descriptor) [pid 3655] close(20) = -1 EBADF (Bad file descriptor) [pid 3655] close(21) = -1 EBADF (Bad file descriptor) [pid 3655] close(22) = -1 EBADF (Bad file descriptor) [pid 3655] close(23) = -1 EBADF (Bad file descriptor) [pid 3655] close(24) = -1 EBADF (Bad file descriptor) [pid 3655] close(25) = -1 EBADF (Bad file descriptor) [pid 3655] close(26) = -1 EBADF (Bad file descriptor) [pid 3655] close(27) = -1 EBADF (Bad file descriptor) [pid 3655] close(28) = -1 EBADF (Bad file descriptor) [pid 3655] close(29) = -1 EBADF (Bad file descriptor) [pid 3655] exit_group(0) = ? [pid 3655] +++ exited with 0 +++ [pid 3624] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5, si_uid=0, si_status=0, si_utime=0, si_stime=54} --- [pid 3624] umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3624] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 3624] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 3624] getdents64(3, 0x555555d52620 /* 7 entries */, 32768) = 208 [pid 3624] umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3624] lstat("./3/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 3624] unlink("./3/binderfs") = 0 [pid 3624] umount2("./3/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3624] lstat("./3/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 3624] unlink("./3/cgroup") = 0 [pid 3624] umount2("./3/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3624] lstat("./3/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3624] unlink("./3/cgroup.net") = 0 [ 61.327597][ T3656] memory: usage 80kB, limit 0kB, failcnt 0 [ 61.333414][ T3656] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 61.340971][ T3656] Memory cgroup stats for /syz0: [ 61.343928][ T3656] anon 0 [ 61.343928][ T3656] file 12288 [ 61.343928][ T3656] kernel 69632 [ 61.343928][ T3656] kernel_stack 0 [ 61.343928][ T3656] pagetables 0 [ 61.343928][ T3656] percpu 0 [ 61.343928][ T3656] sock 0 [ 61.343928][ T3656] vmalloc 0 [ 61.343928][ T3656] shmem 0 [ 61.343928][ T3656] zswap 0 [ 61.343928][ T3656] zswapped 0 [ 61.343928][ T3656] file_mapped 0 [ 61.343928][ T3656] file_dirty 0 [ 61.343928][ T3656] file_writeback 0 [ 61.343928][ T3656] swapcached 0 [ 61.343928][ T3656] anon_thp 0 [ 61.343928][ T3656] file_thp 0 [ 61.343928][ T3656] shmem_thp 0 [ 61.343928][ T3656] inactive_anon 0 [ 61.343928][ T3656] active_anon 0 [ 61.343928][ T3656] inactive_file 8192 [ 61.343928][ T3656] active_file 4096 [ 61.343928][ T3656] unevictable 0 [ 61.343928][ T3656] slab_reclaimable 29520 [ 61.343928][ T3656] slab_unreclaimable 37656 [pid 3624] umount2("./3/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 3624] umount2("./3/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3624] lstat("./3/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3624] umount2("./3/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3624] openat(AT_FDCWD, "./3/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 3624] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3624] getdents64(4, 0x555555d5a660 /* 2 entries */, 32768) = 48 [pid 3624] getdents64(4, 0x555555d5a660 /* 0 entries */, 32768) = 0 [pid 3624] close(4) = 0 [pid 3624] rmdir("./3/file0") = 0 [pid 3624] umount2("./3/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3624] lstat("./3/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3624] unlink("./3/cgroup.cpu") = 0 [pid 3624] getdents64(3, 0x555555d52620 /* 0 entries */, 32768) = 0 [pid 3624] close(3) = 0 [pid 3624] rmdir("./3") = 0 [pid 3624] mkdir("./4", 0777) = 0 [pid 3624] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555d515d0) = 6 ./strace-static-x86_64: Process 3660 attached [pid 3656] <... sendfile resumed>) = 2 [pid 3660] chdir("./4" [pid 3656] close(3 [pid 3660] <... chdir resumed>) = 0 [pid 3656] <... close resumed>) = 0 [pid 3660] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 3656] close(4 [pid 3660] <... prctl resumed>) = 0 [pid 3656] <... close resumed>) = 0 [pid 3660] setpgid(0, 0 [pid 3656] close(5 [pid 3660] <... setpgid resumed>) = 0 [pid 3656] <... close resumed>) = 0 [ 61.343928][ T3656] slab 67176 [ 61.343928][ T3656] workingset_refault_anon 0 [ 61.438630][ T3656] Tasks state (memory values in pages): [ 61.444789][ T3656] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 61.454606][ T3656] Out of memory and no killable processes... [ 61.461268][ T3657] syz-executor417 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 3660] symlink("/syzcgroup/unified/syz2", "./cgroup" [pid 3656] close(6 [pid 3660] <... symlink resumed>) = 0 [pid 3656] <... close resumed>) = 0 [pid 3660] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu" [pid 3656] close(7 [pid 3660] <... symlink resumed>) = 0 [pid 3656] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 3660] symlink("/syzcgroup/net/syz2", "./cgroup.net" [pid 3656] close(8 [pid 3660] <... symlink resumed>) = 0 [pid 3656] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 3660] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 3656] close(9 [pid 3660] <... openat resumed>) = 3 [pid 3656] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 3660] write(3, "1000", 4 [pid 3656] close(10 [pid 3660] <... write resumed>) = 4 [pid 3656] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 3660] close(3 [pid 3656] close(11 [pid 3660] <... close resumed>) = 0 [pid 3656] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 3660] symlink("/dev/binderfs", "./binderfs" [pid 3656] close(12 [pid 3660] <... symlink resumed>) = 0 [pid 3656] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 3660] mkdir("./file0", 000 [pid 3656] close(13 [pid 3660] <... mkdir resumed>) = 0 [pid 3656] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 3660] open("./file0", O_RDONLY [pid 3656] close(14 [pid 3660] <... open resumed>) = 3 [pid 3656] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 3660] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 3656] close(15 [pid 3660] <... mount resumed>) = 0 [pid 3656] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 3660] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH [pid 3656] close(16 [pid 3660] <... openat resumed>) = 4 [pid 3656] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 3660] openat(4, "syz0", O_RDWR|O_PATH [pid 3656] close(17 [pid 3660] <... openat resumed>) = 5 [pid 3656] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 3660] openat(5, "memory.max", O_RDWR [pid 3656] close(18 [pid 3660] <... openat resumed>) = 6 [pid 3656] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 3660] sendfile(6, 6, NULL, 2 [pid 3656] close(19) = -1 EBADF (Bad file descriptor) [pid 3656] close(20) = -1 EBADF (Bad file descriptor) [pid 3656] close(21) = -1 EBADF (Bad file descriptor) [pid 3656] close(22) = -1 EBADF (Bad file descriptor) [pid 3656] close(23) = -1 EBADF (Bad file descriptor) [pid 3656] close(24) = -1 EBADF (Bad file descriptor) [pid 3656] close(25) = -1 EBADF (Bad file descriptor) [pid 3656] close(26) = -1 EBADF (Bad file descriptor) [pid 3656] close(27) = -1 EBADF (Bad file descriptor) [pid 3656] close(28) = -1 EBADF (Bad file descriptor) [pid 3656] close(29) = -1 EBADF (Bad file descriptor) [pid 3656] exit_group(0) = ? [pid 3656] +++ exited with 0 +++ [pid 3626] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5, si_uid=0, si_status=0, si_utime=0, si_stime=54} --- [pid 3626] umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3626] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 3626] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 3626] getdents64(3, 0x555555d52620 /* 7 entries */, 32768) = 208 [pid 3626] umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3626] lstat("./3/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 3626] unlink("./3/binderfs") = 0 [pid 3626] umount2("./3/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3626] lstat("./3/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 3626] unlink("./3/cgroup") = 0 [pid 3626] umount2("./3/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3626] lstat("./3/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3626] unlink("./3/cgroup.net") = 0 [ 61.473458][ T3657] CPU: 1 PID: 3657 Comm: syz-executor417 Not tainted 5.19.0-rc7-syzkaller-00007-g353f7988dd84 #0 [ 61.483977][ T3657] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 [ 61.494037][ T3657] Call Trace: [ 61.497313][ T3657] [ 61.500228][ T3657] dump_stack_lvl+0x1e3/0x2cb [ 61.504906][ T3657] ? bfq_pos_tree_add_move+0x436/0x436 [ 61.510370][ T3657] ? panic+0x76e/0x76e [ 61.514427][ T3657] dump_header+0xdb/0x970 [ 61.518750][ T3657] out_of_memory+0x895/0xb30 [ 61.523322][ T3657] ? unregister_oom_notifier+0x20/0x20 [ 61.528856][ T3657] ? __lock_acquire+0x1f80/0x1f80 [ 61.533896][ T3657] mem_cgroup_out_of_memory+0x25d/0x3b0 [ 61.539436][ T3657] ? preempt_schedule_thunk+0x16/0x18 [ 61.544804][ T3657] ? mem_cgroup_oom_trylock+0x220/0x220 [ 61.550342][ T3657] ? cgroup_file_notify+0x123/0x190 [ 61.555542][ T3657] memory_max_write+0x364/0x4f0 [ 61.560378][ T3657] ? memory_max_show+0xa0/0xa0 [ 61.565139][ T3657] ? read_lock_is_recursive+0x10/0x10 [ 61.570518][ T3657] ? memory_max_show+0xa0/0xa0 [ 61.575267][ T3657] cgroup_file_write+0x2ab/0x780 [ 61.580205][ T3657] ? cgroup_seqfile_stop+0xd0/0xd0 [ 61.585311][ T3657] ? check_heap_object+0x23e/0x820 [ 61.590416][ T3657] ? kernfs_get_active+0xee/0x160 [ 61.595432][ T3657] ? cgroup_seqfile_stop+0xd0/0xd0 [ 61.600546][ T3657] kernfs_fop_write_iter+0x3ac/0x500 [ 61.605841][ T3657] do_iter_readv_writev+0x499/0x650 [ 61.611035][ T3657] ? generic_file_rw_checks+0x250/0x250 [ 61.616576][ T3657] ? bpf_lsm_file_permission+0x5/0x10 [ 61.621943][ T3657] ? security_file_permission+0xe0/0x5c0 [ 61.627572][ T3657] ? do_iter_write+0x147/0x7a0 [ 61.632329][ T3657] do_iter_write+0x1f1/0x7a0 [ 61.636913][ T3657] ? vfs_iter_write+0x69/0xa0 [ 61.641592][ T3657] iter_file_splice_write+0x830/0xff0 [ 61.646961][ T3657] ? splice_from_pipe+0x220/0x220 [ 61.651975][ T3657] ? generic_file_splice_read+0x46b/0x660 [ 61.657687][ T3657] ? splice_shrink_spd+0xb0/0xb0 [ 61.662617][ T3657] ? splice_from_pipe+0x220/0x220 [ 61.667630][ T3657] direct_splice_actor+0xe6/0x1c0 [ 61.672642][ T3657] splice_direct_to_actor+0x514/0xc20 [ 61.678008][ T3657] ? do_splice_direct+0x3f0/0x3f0 [ 61.683110][ T3657] ? pipe_to_sendpage+0x340/0x340 [ 61.688122][ T3657] ? do_sendfile+0x600/0xf90 [ 61.692698][ T3657] ? read_lock_is_recursive+0x10/0x10 [ 61.698065][ T3657] ? bpf_lsm_file_permission+0x5/0x10 [ 61.703422][ T3657] ? security_file_permission+0xe0/0x5c0 [ 61.709040][ T3657] do_splice_direct+0x2a0/0x3f0 [ 61.713892][ T3657] ? splice_direct_to_actor+0xc20/0xc20 [ 61.719424][ T3657] ? rcu_read_lock_any_held+0x5f/0x150 [ 61.724870][ T3657] ? _raw_spin_lock_irq+0xdb/0x110 [ 61.729967][ T3657] ? _raw_spin_lock_irqsave+0x120/0x120 [ 61.735517][ T3657] do_sendfile+0x623/0xf90 [ 61.739946][ T3657] ? do_pwritev+0x360/0x360 [ 61.744438][ T3657] ? _raw_spin_unlock_irq+0x2a/0x40 [ 61.749632][ T3657] ? ptrace_notify+0x245/0x340 [ 61.754381][ T3657] ? do_notify_parent+0xeb0/0xeb0 [ 61.759392][ T3657] __se_sys_sendfile64+0x178/0x1e0 [ 61.764493][ T3657] ? __x64_sys_sendfile64+0xa0/0xa0 [ 61.769677][ T3657] ? syscall_enter_from_user_mode+0x86/0x1a0 [ 61.775644][ T3657] do_syscall_64+0x2b/0x70 [ 61.780050][ T3657] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 61.785931][ T3657] RIP: 0033:0x7f647bbcde19 [ 61.790333][ T3657] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 61.809937][ T3657] RSP: 002b:00007ffd4087ce08 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 61.818349][ T3657] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f647bbcde19 [pid 3626] umount2("./3/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 3626] umount2("./3/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3626] lstat("./3/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3626] umount2("./3/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3626] openat(AT_FDCWD, "./3/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 3626] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3626] getdents64(4, 0x555555d5a660 /* 2 entries */, 32768) = 48 [pid 3626] getdents64(4, 0x555555d5a660 /* 0 entries */, 32768) = 0 [pid 3626] close(4) = 0 [pid 3626] rmdir("./3/file0") = 0 [pid 3626] umount2("./3/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3626] lstat("./3/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3626] unlink("./3/cgroup.cpu") = 0 [pid 3626] getdents64(3, 0x555555d52620 /* 0 entries */, 32768) = 0 [pid 3626] close(3) = 0 [ 61.826311][ T3657] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000006 [ 61.834272][ T3657] RBP: 0000000000000000 R08: 00007ffd4087ce30 R09: 00007ffd4087ce30 [ 61.842233][ T3657] R10: 0000000000000002 R11: 0000000000000246 R12: 00007ffd4087ce2c [ 61.850221][ T3657] R13: 00007ffd4087ce40 R14: 00007ffd4087ce80 R15: 0000000000000004 [ 61.858185][ T3657] [ 61.863442][ T3657] memory: usage 80kB, limit 0kB, failcnt 0 [ 61.869416][ T3657] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 61.876266][ T3657] Memory cgroup stats for /syz0: [pid 3626] rmdir("./3") = 0 [pid 3626] mkdir("./4", 0777) = 0 [pid 3626] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555d515d0) = 6 ./strace-static-x86_64: Process 3661 attached [pid 3661] chdir("./4") = 0 [pid 3661] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3661] setpgid(0, 0) = 0 [pid 3661] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 3661] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [pid 3661] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 3661] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3661] write(3, "1000", 4) = 4 [pid 3661] close(3) = 0 [pid 3661] symlink("/dev/binderfs", "./binderfs") = 0 [pid 3661] mkdir("./file0", 000) = 0 [pid 3661] open("./file0", O_RDONLY) = 3 [pid 3661] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 3661] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 3661] openat(4, "syz0", O_RDWR|O_PATH) = 5 [pid 3661] openat(5, "memory.max", O_RDWR) = 6 [ 61.876463][ T3657] anon 0 [ 61.876463][ T3657] file 12288 [ 61.876463][ T3657] kernel 69632 [ 61.876463][ T3657] kernel_stack 0 [ 61.876463][ T3657] pagetables 0 [ 61.876463][ T3657] percpu 0 [ 61.876463][ T3657] sock 0 [ 61.876463][ T3657] vmalloc 0 [ 61.876463][ T3657] shmem 0 [ 61.876463][ T3657] zswap 0 [ 61.876463][ T3657] zswapped 0 [ 61.876463][ T3657] file_mapped 0 [ 61.876463][ T3657] file_dirty 0 [ 61.876463][ T3657] file_writeback 0 [ 61.876463][ T3657] swapcached 0 [ 61.876463][ T3657] anon_thp 0 [ 61.876463][ T3657] file_thp 0 [ 61.876463][ T3657] shmem_thp 0 [ 61.876463][ T3657] inactive_anon 0 [ 61.876463][ T3657] active_anon 0 [ 61.876463][ T3657] inactive_file 8192 [ 61.876463][ T3657] active_file 4096 [ 61.876463][ T3657] unevictable 0 [ 61.876463][ T3657] slab_reclaimable 29520 [ 61.876463][ T3657] slab_unreclaimable 37656 [ 61.876463][ T3657] slab 67176 [ 61.876463][ T3657] workingset_refault_anon 0 [ 61.970493][ T3657] Tasks state (memory values in pages): [pid 3661] sendfile(6, 6, NULL, 2 [pid 3657] <... sendfile resumed>) = 2 [pid 3657] close(3) = 0 [pid 3657] close(4) = 0 [pid 3657] close(5) = 0 [pid 3657] close(6) = 0 [pid 3657] close(7) = -1 EBADF (Bad file descriptor) [pid 3657] close(8) = -1 EBADF (Bad file descriptor) [pid 3657] close(9) = -1 EBADF (Bad file descriptor) [pid 3657] close(10) = -1 EBADF (Bad file descriptor) [pid 3657] close(11) = -1 EBADF (Bad file descriptor) [pid 3657] close(12) = -1 EBADF (Bad file descriptor) [pid 3657] close(13) = -1 EBADF (Bad file descriptor) [pid 3657] close(14) = -1 EBADF (Bad file descriptor) [pid 3657] close(15) = -1 EBADF (Bad file descriptor) [pid 3657] close(16) = -1 EBADF (Bad file descriptor) [pid 3657] close(17) = -1 EBADF (Bad file descriptor) [pid 3657] close(18) = -1 EBADF (Bad file descriptor) [pid 3657] close(19) = -1 EBADF (Bad file descriptor) [pid 3657] close(20) = -1 EBADF (Bad file descriptor) [pid 3657] close(21) = -1 EBADF (Bad file descriptor) [pid 3657] close(22) = -1 EBADF (Bad file descriptor) [pid 3657] close(23) = -1 EBADF (Bad file descriptor) [pid 3657] close(24) = -1 EBADF (Bad file descriptor) [pid 3657] close(25) = -1 EBADF (Bad file descriptor) [pid 3657] close(26) = -1 EBADF (Bad file descriptor) [pid 3657] close(27) = -1 EBADF (Bad file descriptor) [pid 3657] close(28) = -1 EBADF (Bad file descriptor) [pid 3657] close(29) = -1 EBADF (Bad file descriptor) [pid 3657] exit_group(0) = ? [pid 3657] +++ exited with 0 +++ [pid 3623] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6, si_uid=0, si_status=0, si_utime=0, si_stime=52} --- [pid 3623] umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3623] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 3623] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 3623] getdents64(3, 0x555555d52620 /* 7 entries */, 32768) = 208 [ 61.976050][ T3657] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 61.986068][ T3657] Out of memory and no killable processes... [ 61.992233][ T3658] syz-executor417 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 62.002588][ T3658] CPU: 1 PID: 3658 Comm: syz-executor417 Not tainted 5.19.0-rc7-syzkaller-00007-g353f7988dd84 #0 [ 62.013100][ T3658] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 [ 62.023166][ T3658] Call Trace: [ 62.026455][ T3658] [pid 3623] umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3623] lstat("./4/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 3623] unlink("./4/binderfs") = 0 [pid 3623] umount2("./4/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3623] lstat("./4/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 3623] unlink("./4/cgroup") = 0 [pid 3623] umount2("./4/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3623] lstat("./4/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3623] unlink("./4/cgroup.net") = 0 [ 62.029392][ T3658] dump_stack_lvl+0x1e3/0x2cb [ 62.034086][ T3658] ? bfq_pos_tree_add_move+0x436/0x436 [ 62.039562][ T3658] ? panic+0x76e/0x76e [ 62.043648][ T3658] dump_header+0xdb/0x970 [ 62.047984][ T3658] out_of_memory+0x895/0xb30 [ 62.052566][ T3658] ? unregister_oom_notifier+0x20/0x20 [ 62.058021][ T3658] ? __lock_acquire+0x1f80/0x1f80 [ 62.063070][ T3658] mem_cgroup_out_of_memory+0x25d/0x3b0 [ 62.068623][ T3658] ? mem_cgroup_oom_trylock+0x220/0x220 [ 62.074161][ T3658] ? cgroup_file_notify+0x123/0x190 [ 62.079347][ T3658] memory_max_write+0x364/0x4f0 [ 62.084187][ T3658] ? memory_max_show+0xa0/0xa0 [ 62.088952][ T3658] ? read_lock_is_recursive+0x10/0x10 [ 62.094309][ T3658] ? memory_max_show+0xa0/0xa0 [ 62.099060][ T3658] cgroup_file_write+0x2ab/0x780 [ 62.104003][ T3658] ? cgroup_seqfile_stop+0xd0/0xd0 [ 62.109101][ T3658] ? check_heap_object+0x23e/0x820 [ 62.114205][ T3658] ? kernfs_get_active+0xee/0x160 [ 62.119217][ T3658] ? cgroup_seqfile_stop+0xd0/0xd0 [ 62.124315][ T3658] kernfs_fop_write_iter+0x3ac/0x500 [ 62.129588][ T3658] do_iter_readv_writev+0x499/0x650 [ 62.134778][ T3658] ? generic_file_rw_checks+0x250/0x250 [ 62.140313][ T3658] ? bpf_lsm_file_permission+0x5/0x10 [ 62.145671][ T3658] ? security_file_permission+0xe0/0x5c0 [ 62.151297][ T3658] ? do_iter_write+0x147/0x7a0 [ 62.156045][ T3658] do_iter_write+0x1f1/0x7a0 [ 62.160623][ T3658] ? vfs_iter_write+0x69/0xa0 [ 62.165289][ T3658] iter_file_splice_write+0x830/0xff0 [ 62.170656][ T3658] ? splice_from_pipe+0x220/0x220 [ 62.175684][ T3658] ? generic_file_splice_read+0x46b/0x660 [ 62.181393][ T3658] ? splice_shrink_spd+0xb0/0xb0 [ 62.186324][ T3658] ? splice_from_pipe+0x220/0x220 [ 62.191335][ T3658] direct_splice_actor+0xe6/0x1c0 [ 62.196357][ T3658] splice_direct_to_actor+0x514/0xc20 [ 62.201731][ T3658] ? do_splice_direct+0x3f0/0x3f0 [ 62.206747][ T3658] ? pipe_to_sendpage+0x340/0x340 [ 62.211773][ T3658] ? do_sendfile+0x600/0xf90 [ 62.216348][ T3658] ? read_lock_is_recursive+0x10/0x10 [ 62.221719][ T3658] ? bpf_lsm_file_permission+0x5/0x10 [ 62.227076][ T3658] ? security_file_permission+0xe0/0x5c0 [ 62.232699][ T3658] do_splice_direct+0x2a0/0x3f0 [ 62.237539][ T3658] ? splice_direct_to_actor+0xc20/0xc20 [ 62.243069][ T3658] ? rcu_read_lock_any_held+0x5f/0x150 [ 62.248519][ T3658] ? _raw_spin_lock_irq+0xdb/0x110 [ 62.253620][ T3658] ? _raw_spin_lock_irqsave+0x120/0x120 [ 62.259156][ T3658] do_sendfile+0x623/0xf90 [ 62.263564][ T3658] ? do_pwritev+0x360/0x360 [ 62.268055][ T3658] ? _raw_spin_unlock_irq+0x2a/0x40 [ 62.273237][ T3658] ? ptrace_notify+0x245/0x340 [ 62.277991][ T3658] ? do_notify_parent+0xeb0/0xeb0 [ 62.283004][ T3658] __se_sys_sendfile64+0x178/0x1e0 [ 62.288104][ T3658] ? __x64_sys_sendfile64+0xa0/0xa0 [ 62.293289][ T3658] ? syscall_enter_from_user_mode+0x86/0x1a0 [ 62.299262][ T3658] do_syscall_64+0x2b/0x70 [ 62.303669][ T3658] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 62.309547][ T3658] RIP: 0033:0x7f647bbcde19 [ 62.313953][ T3658] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 62.333546][ T3658] RSP: 002b:00007ffd4087ce08 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 62.341960][ T3658] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f647bbcde19 [ 62.349920][ T3658] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000006 [ 62.357878][ T3658] RBP: 0000000000000000 R08: 00007ffd4087ce30 R09: 00007ffd4087ce30 [ 62.365834][ T3658] R10: 0000000000000002 R11: 0000000000000246 R12: 00007ffd4087ce2c [ 62.373791][ T3658] R13: 00007ffd4087ce40 R14: 00007ffd4087ce80 R15: 0000000000000004 [pid 3623] umount2("./4/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 3623] umount2("./4/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3623] lstat("./4/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3623] umount2("./4/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3623] openat(AT_FDCWD, "./4/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 3623] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3623] getdents64(4, 0x555555d5a660 /* 2 entries */, 32768) = 48 [pid 3623] getdents64(4, 0x555555d5a660 /* 0 entries */, 32768) = 0 [pid 3623] close(4) = 0 [pid 3623] rmdir("./4/file0") = 0 [pid 3623] umount2("./4/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3623] lstat("./4/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3623] unlink("./4/cgroup.cpu") = 0 [ 62.381755][ T3658] [ 62.386855][ T3658] memory: usage 80kB, limit 0kB, failcnt 0 [ 62.392690][ T3658] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 62.400435][ T3658] Memory cgroup stats for /syz0: [ 62.400590][ T3658] anon 0 [ 62.400590][ T3658] file 12288 [ 62.400590][ T3658] kernel 69632 [ 62.400590][ T3658] kernel_stack 0 [ 62.400590][ T3658] pagetables 0 [ 62.400590][ T3658] percpu 0 [ 62.400590][ T3658] sock 0 [ 62.400590][ T3658] vmalloc 0 [ 62.400590][ T3658] shmem 0 [pid 3623] getdents64(3, 0x555555d52620 /* 0 entries */, 32768) = 0 [pid 3623] close(3) = 0 [pid 3623] rmdir("./4") = 0 [pid 3623] mkdir("./5", 0777) = 0 [pid 3623] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3662 attached [pid 3662] chdir("./5" [pid 3623] <... clone resumed>, child_tidptr=0x555555d515d0) = 7 [pid 3662] <... chdir resumed>) = 0 [pid 3662] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3662] setpgid(0, 0) = 0 [ 62.400590][ T3658] zswap 0 [ 62.400590][ T3658] zswapped 0 [ 62.400590][ T3658] file_mapped 0 [ 62.400590][ T3658] file_dirty 0 [ 62.400590][ T3658] file_writeback 0 [ 62.400590][ T3658] swapcached 0 [ 62.400590][ T3658] anon_thp 0 [ 62.400590][ T3658] file_thp 0 [ 62.400590][ T3658] shmem_thp 0 [ 62.400590][ T3658] inactive_anon 0 [ 62.400590][ T3658] active_anon 0 [ 62.400590][ T3658] inactive_file 4096 [ 62.400590][ T3658] active_file 8192 [ 62.400590][ T3658] unevictable 0 [ 62.400590][ T3658] slab_reclaimable 29520 [pid 3662] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 3662] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 3662] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [pid 3662] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3662] write(3, "1000", 4) = 4 [pid 3662] close(3) = 0 [pid 3662] symlink("/dev/binderfs", "./binderfs") = 0 [pid 3662] mkdir("./file0", 000) = 0 [pid 3662] open("./file0", O_RDONLY) = 3 [pid 3662] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 3662] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 3662] openat(4, "syz0", O_RDWR|O_PATH) = 5 [pid 3662] openat(5, "memory.max", O_RDWR) = 6 [pid 3662] sendfile(6, 6, NULL, 2 [pid 3658] <... sendfile resumed>) = 2 [ 62.400590][ T3658] slab_unreclaimable 37656 [ 62.400590][ T3658] slab 67176 [ 62.400590][ T3658] workingset_refault_anon 0 [ 62.497219][ T3658] Tasks state (memory values in pages): [ 62.502777][ T3658] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 62.512670][ T3658] Out of memory and no killable processes... [ 62.519122][ T3659] syz-executor417 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [pid 3658] close(3) = 0 [pid 3658] close(4) = 0 [pid 3658] close(5) = 0 [pid 3658] close(6) = 0 [pid 3658] close(7) = -1 EBADF (Bad file descriptor) [pid 3658] close(8) = -1 EBADF (Bad file descriptor) [pid 3658] close(9) = -1 EBADF (Bad file descriptor) [pid 3658] close(10) = -1 EBADF (Bad file descriptor) [pid 3658] close(11) = -1 EBADF (Bad file descriptor) [pid 3658] close(12) = -1 EBADF (Bad file descriptor) [pid 3658] close(13) = -1 EBADF (Bad file descriptor) [pid 3658] close(14) = -1 EBADF (Bad file descriptor) [pid 3658] close(15) = -1 EBADF (Bad file descriptor) [pid 3658] close(16) = -1 EBADF (Bad file descriptor) [pid 3658] close(17) = -1 EBADF (Bad file descriptor) [pid 3658] close(18) = -1 EBADF (Bad file descriptor) [pid 3658] close(19) = -1 EBADF (Bad file descriptor) [pid 3658] close(20) = -1 EBADF (Bad file descriptor) [pid 3658] close(21) = -1 EBADF (Bad file descriptor) [pid 3658] close(22) = -1 EBADF (Bad file descriptor) [pid 3658] close(23) = -1 EBADF (Bad file descriptor) [pid 3658] close(24) = -1 EBADF (Bad file descriptor) [pid 3658] close(25) = -1 EBADF (Bad file descriptor) [pid 3658] close(26) = -1 EBADF (Bad file descriptor) [pid 3658] close(27) = -1 EBADF (Bad file descriptor) [pid 3658] close(28) = -1 EBADF (Bad file descriptor) [pid 3658] close(29) = -1 EBADF (Bad file descriptor) [pid 3658] exit_group(0) = ? [pid 3658] +++ exited with 0 +++ [pid 3622] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6, si_uid=0, si_status=0, si_utime=0, si_stime=52} --- [pid 3622] umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 62.529757][ T3659] CPU: 0 PID: 3659 Comm: syz-executor417 Not tainted 5.19.0-rc7-syzkaller-00007-g353f7988dd84 #0 [ 62.540271][ T3659] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 [ 62.550325][ T3659] Call Trace: [ 62.553602][ T3659] [ 62.556534][ T3659] dump_stack_lvl+0x1e3/0x2cb [ 62.561226][ T3659] ? bfq_pos_tree_add_move+0x436/0x436 [ 62.566696][ T3659] ? panic+0x76e/0x76e [ 62.570784][ T3659] dump_header+0xdb/0x970 [ 62.575130][ T3659] out_of_memory+0x895/0xb30 [ 62.580172][ T3659] ? unregister_oom_notifier+0x20/0x20 [ 62.585643][ T3659] ? __lock_acquire+0x1f80/0x1f80 [ 62.590678][ T3659] mem_cgroup_out_of_memory+0x25d/0x3b0 [ 62.596232][ T3659] ? preempt_schedule_thunk+0x16/0x18 [ 62.601591][ T3659] ? mem_cgroup_oom_trylock+0x220/0x220 [ 62.607133][ T3659] ? cgroup_file_notify+0x123/0x190 [ 62.612342][ T3659] memory_max_write+0x364/0x4f0 [ 62.617208][ T3659] ? memory_max_show+0xa0/0xa0 [ 62.621977][ T3659] ? read_lock_is_recursive+0x10/0x10 [ 62.627363][ T3659] ? memory_max_show+0xa0/0xa0 [ 62.632225][ T3659] cgroup_file_write+0x2ab/0x780 [ 62.637166][ T3659] ? cgroup_seqfile_stop+0xd0/0xd0 [ 62.642271][ T3659] ? check_heap_object+0x23e/0x820 [ 62.647386][ T3659] ? kernfs_get_active+0xee/0x160 [ 62.652398][ T3659] ? cgroup_seqfile_stop+0xd0/0xd0 [ 62.657501][ T3659] kernfs_fop_write_iter+0x3ac/0x500 [ 62.662778][ T3659] do_iter_readv_writev+0x499/0x650 [ 62.668059][ T3659] ? generic_file_rw_checks+0x250/0x250 [ 62.673604][ T3659] ? bpf_lsm_file_permission+0x5/0x10 [ 62.678975][ T3659] ? security_file_permission+0xe0/0x5c0 [pid 3622] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 3622] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 3622] getdents64(3, 0x555555d52620 /* 7 entries */, 32768) = 208 [pid 3622] umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3622] lstat("./4/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 3622] unlink("./4/binderfs") = 0 [pid 3622] umount2("./4/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3622] lstat("./4/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 3622] unlink("./4/cgroup") = 0 [ 62.684605][ T3659] ? do_iter_write+0x147/0x7a0 [ 62.689446][ T3659] do_iter_write+0x1f1/0x7a0 [ 62.694022][ T3659] ? vfs_iter_write+0x69/0xa0 [ 62.698689][ T3659] iter_file_splice_write+0x830/0xff0 [ 62.704068][ T3659] ? splice_from_pipe+0x220/0x220 [ 62.709129][ T3659] ? generic_file_splice_read+0x46b/0x660 [ 62.714849][ T3659] ? splice_shrink_spd+0xb0/0xb0 [ 62.719799][ T3659] ? splice_from_pipe+0x220/0x220 [ 62.724840][ T3659] direct_splice_actor+0xe6/0x1c0 [ 62.729874][ T3659] splice_direct_to_actor+0x514/0xc20 [ 62.735249][ T3659] ? do_splice_direct+0x3f0/0x3f0 [ 62.740275][ T3659] ? pipe_to_sendpage+0x340/0x340 [ 62.745300][ T3659] ? do_sendfile+0x600/0xf90 [ 62.749882][ T3659] ? read_lock_is_recursive+0x10/0x10 [ 62.755279][ T3659] ? bpf_lsm_file_permission+0x5/0x10 [ 62.760661][ T3659] ? security_file_permission+0xe0/0x5c0 [ 62.766281][ T3659] do_splice_direct+0x2a0/0x3f0 [ 62.771134][ T3659] ? splice_direct_to_actor+0xc20/0xc20 [ 62.776679][ T3659] ? rcu_read_lock_any_held+0x5f/0x150 [ 62.782150][ T3659] ? _raw_spin_lock_irq+0xdb/0x110 [ 62.787273][ T3659] ? _raw_spin_lock_irqsave+0x120/0x120 [ 62.792819][ T3659] do_sendfile+0x623/0xf90 [ 62.797236][ T3659] ? do_pwritev+0x360/0x360 [ 62.801746][ T3659] ? _raw_spin_unlock_irq+0x2a/0x40 [ 62.806951][ T3659] ? ptrace_notify+0x245/0x340 [ 62.811722][ T3659] ? do_notify_parent+0xeb0/0xeb0 [ 62.816745][ T3659] __se_sys_sendfile64+0x178/0x1e0 [ 62.821865][ T3659] ? __x64_sys_sendfile64+0xa0/0xa0 [ 62.827071][ T3659] ? syscall_enter_from_user_mode+0x86/0x1a0 [ 62.833053][ T3659] do_syscall_64+0x2b/0x70 [ 62.837544][ T3659] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 62.843431][ T3659] RIP: 0033:0x7f647bbcde19 [ 62.847856][ T3659] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 62.867624][ T3659] RSP: 002b:00007ffd4087ce08 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 62.876026][ T3659] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f647bbcde19 [pid 3622] umount2("./4/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3622] lstat("./4/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3622] unlink("./4/cgroup.net") = 0 [pid 3622] umount2("./4/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 3622] umount2("./4/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3622] lstat("./4/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3622] umount2("./4/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3622] openat(AT_FDCWD, "./4/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 3622] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3622] getdents64(4, 0x555555d5a660 /* 2 entries */, 32768) = 48 [pid 3622] getdents64(4, 0x555555d5a660 /* 0 entries */, 32768) = 0 [pid 3622] close(4) = 0 [pid 3622] rmdir("./4/file0") = 0 [pid 3622] umount2("./4/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3622] lstat("./4/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3622] unlink("./4/cgroup.cpu") = 0 [pid 3622] getdents64(3, 0x555555d52620 /* 0 entries */, 32768) = 0 [pid 3622] close(3) = 0 [pid 3622] rmdir("./4") = 0 [pid 3622] mkdir("./5", 0777) = 0 [pid 3622] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3663 attached [pid 3663] chdir("./5" [pid 3622] <... clone resumed>, child_tidptr=0x555555d515d0) = 7 [ 62.883996][ T3659] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000006 [ 62.891981][ T3659] RBP: 0000000000000000 R08: 00007ffd4087ce30 R09: 00007ffd4087ce30 [ 62.899958][ T3659] R10: 0000000000000002 R11: 0000000000000246 R12: 00007ffd4087ce2c [ 62.907923][ T3659] R13: 00007ffd4087ce40 R14: 00007ffd4087ce80 R15: 0000000000000004 [ 62.915915][ T3659] [ 62.925915][ T3659] memory: usage 80kB, limit 0kB, failcnt 0 [pid 3663] <... chdir resumed>) = 0 [pid 3663] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3663] setpgid(0, 0) = 0 [pid 3663] symlink("/syzcgroup/unified/syz1", "./cgroup") = 0 [pid 3663] symlink("/syzcgroup/cpu/syz1", "./cgroup.cpu") = 0 [pid 3663] symlink("/syzcgroup/net/syz1", "./cgroup.net") = 0 [pid 3663] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3663] write(3, "1000", 4) = 4 [pid 3663] close(3) = 0 [pid 3663] symlink("/dev/binderfs", "./binderfs") = 0 [pid 3663] mkdir("./file0", 000) = 0 [pid 3663] open("./file0", O_RDONLY) = 3 [pid 3663] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 3663] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 3663] openat(4, "syz0", O_RDWR|O_PATH) = 5 [pid 3663] openat(5, "memory.max", O_RDWR) = 6 [ 62.932080][ T3659] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 62.939637][ T3659] Memory cgroup stats for /syz0: [ 62.939796][ T3659] anon 0 [ 62.939796][ T3659] file 12288 [ 62.939796][ T3659] kernel 69632 [ 62.939796][ T3659] kernel_stack 0 [ 62.939796][ T3659] pagetables 0 [ 62.939796][ T3659] percpu 0 [ 62.939796][ T3659] sock 0 [ 62.939796][ T3659] vmalloc 0 [ 62.939796][ T3659] shmem 0 [ 62.939796][ T3659] zswap 0 [ 62.939796][ T3659] zswapped 0 [ 62.939796][ T3659] file_mapped 0 [ 62.939796][ T3659] file_dirty 0 [ 62.939796][ T3659] file_writeback 0 [ 62.939796][ T3659] swapcached 0 [ 62.939796][ T3659] anon_thp 0 [ 62.939796][ T3659] file_thp 0 [ 62.939796][ T3659] shmem_thp 0 [ 62.939796][ T3659] inactive_anon 0 [ 62.939796][ T3659] active_anon 0 [ 62.939796][ T3659] inactive_file 8192 [ 62.939796][ T3659] active_file 4096 [ 62.939796][ T3659] unevictable 0 [ 62.939796][ T3659] slab_reclaimable 29520 [ 62.939796][ T3659] slab_unreclaimable 37656 [ 62.939796][ T3659] slab 67176 [ 62.939796][ T3659] workingset_refault_anon 0 [pid 3663] sendfile(6, 6, NULL, 2 [pid 3659] <... sendfile resumed>) = 2 [ 63.036117][ T3659] Tasks state (memory values in pages): [ 63.041930][ T3659] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 63.051586][ T3659] Out of memory and no killable processes... [ 63.057799][ T3660] syz-executor417 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 63.068325][ T3660] CPU: 0 PID: 3660 Comm: syz-executor417 Not tainted 5.19.0-rc7-syzkaller-00007-g353f7988dd84 #0 [pid 3659] close(3) = 0 [pid 3659] close(4) = 0 [pid 3659] close(5) = 0 [pid 3659] close(6) = 0 [pid 3659] close(7) = -1 EBADF (Bad file descriptor) [pid 3659] close(8) = -1 EBADF (Bad file descriptor) [pid 3659] close(9) = -1 EBADF (Bad file descriptor) [pid 3659] close(10) = -1 EBADF (Bad file descriptor) [pid 3659] close(11) = -1 EBADF (Bad file descriptor) [pid 3659] close(12) = -1 EBADF (Bad file descriptor) [pid 3659] close(13) = -1 EBADF (Bad file descriptor) [pid 3659] close(14) = -1 EBADF (Bad file descriptor) [pid 3659] close(15) = -1 EBADF (Bad file descriptor) [pid 3659] close(16) = -1 EBADF (Bad file descriptor) [pid 3659] close(17) = -1 EBADF (Bad file descriptor) [pid 3659] close(18) = -1 EBADF (Bad file descriptor) [pid 3659] close(19) = -1 EBADF (Bad file descriptor) [pid 3659] close(20) = -1 EBADF (Bad file descriptor) [pid 3659] close(21) = -1 EBADF (Bad file descriptor) [pid 3659] close(22) = -1 EBADF (Bad file descriptor) [pid 3659] close(23) = -1 EBADF (Bad file descriptor) [pid 3659] close(24) = -1 EBADF (Bad file descriptor) [pid 3659] close(25) = -1 EBADF (Bad file descriptor) [pid 3659] close(26) = -1 EBADF (Bad file descriptor) [pid 3659] close(27) = -1 EBADF (Bad file descriptor) [pid 3659] close(28) = -1 EBADF (Bad file descriptor) [pid 3659] close(29) = -1 EBADF (Bad file descriptor) [pid 3659] exit_group(0) = ? [pid 3659] +++ exited with 0 +++ [pid 3625] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6, si_uid=0, si_status=0, si_utime=0, si_stime=53} --- [pid 3625] umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3625] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 3625] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [ 63.078835][ T3660] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 [ 63.088876][ T3660] Call Trace: [ 63.092156][ T3660] [ 63.095103][ T3660] dump_stack_lvl+0x1e3/0x2cb [ 63.099786][ T3660] ? bfq_pos_tree_add_move+0x436/0x436 [ 63.105265][ T3660] ? panic+0x76e/0x76e [ 63.109352][ T3660] dump_header+0xdb/0x970 [ 63.113701][ T3660] out_of_memory+0x895/0xb30 [ 63.118314][ T3660] ? unregister_oom_notifier+0x20/0x20 [ 63.123780][ T3660] ? __lock_acquire+0x1f80/0x1f80 [ 63.128794][ T3660] mem_cgroup_out_of_memory+0x25d/0x3b0 [ 63.134335][ T3660] ? mem_cgroup_oom_trylock+0x220/0x220 [ 63.139889][ T3660] ? cgroup_file_notify+0x123/0x190 [ 63.145072][ T3660] memory_max_write+0x364/0x4f0 [ 63.149915][ T3660] ? memory_max_show+0xa0/0xa0 [ 63.154759][ T3660] ? read_lock_is_recursive+0x10/0x10 [ 63.160130][ T3660] ? memory_max_show+0xa0/0xa0 [ 63.164888][ T3660] cgroup_file_write+0x2ab/0x780 [ 63.169823][ T3660] ? cgroup_seqfile_stop+0xd0/0xd0 [ 63.174924][ T3660] ? check_heap_object+0x23e/0x820 [ 63.180051][ T3660] ? kernfs_get_active+0xee/0x160 [ 63.185070][ T3660] ? cgroup_seqfile_stop+0xd0/0xd0 [ 63.190445][ T3660] kernfs_fop_write_iter+0x3ac/0x500 [ 63.195729][ T3660] do_iter_readv_writev+0x499/0x650 [ 63.200976][ T3660] ? generic_file_rw_checks+0x250/0x250 [ 63.206516][ T3660] ? bpf_lsm_file_permission+0x5/0x10 [ 63.211879][ T3660] ? security_file_permission+0xe0/0x5c0 [ 63.217587][ T3660] ? do_iter_write+0x147/0x7a0 [ 63.222342][ T3660] do_iter_write+0x1f1/0x7a0 [ 63.226925][ T3660] ? vfs_iter_write+0x69/0xa0 [ 63.231588][ T3660] iter_file_splice_write+0x830/0xff0 [ 63.236960][ T3660] ? splice_from_pipe+0x220/0x220 [ 63.241969][ T3660] ? generic_file_splice_read+0x46b/0x660 [ 63.247679][ T3660] ? splice_shrink_spd+0xb0/0xb0 [ 63.252611][ T3660] ? splice_from_pipe+0x220/0x220 [ 63.257623][ T3660] direct_splice_actor+0xe6/0x1c0 [ 63.262634][ T3660] splice_direct_to_actor+0x514/0xc20 [ 63.268000][ T3660] ? do_splice_direct+0x3f0/0x3f0 [ 63.273020][ T3660] ? pipe_to_sendpage+0x340/0x340 [ 63.278030][ T3660] ? do_sendfile+0x600/0xf90 [ 63.282607][ T3660] ? read_lock_is_recursive+0x10/0x10 [ 63.287968][ T3660] ? bpf_lsm_file_permission+0x5/0x10 [ 63.293330][ T3660] ? security_file_permission+0xe0/0x5c0 [ 63.298950][ T3660] do_splice_direct+0x2a0/0x3f0 [ 63.303790][ T3660] ? splice_direct_to_actor+0xc20/0xc20 [ 63.309323][ T3660] ? rcu_read_lock_any_held+0x5f/0x150 [ 63.314773][ T3660] ? _raw_spin_lock_irq+0xdb/0x110 [ 63.319873][ T3660] ? _raw_spin_lock_irqsave+0x120/0x120 [ 63.325414][ T3660] do_sendfile+0x623/0xf90 [ 63.329833][ T3660] ? do_pwritev+0x360/0x360 [ 63.334326][ T3660] ? _raw_spin_unlock_irq+0x2a/0x40 [ 63.339524][ T3660] ? ptrace_notify+0x245/0x340 [ 63.344276][ T3660] ? do_notify_parent+0xeb0/0xeb0 [ 63.349287][ T3660] __se_sys_sendfile64+0x178/0x1e0 [ 63.354386][ T3660] ? __x64_sys_sendfile64+0xa0/0xa0 [ 63.359574][ T3660] ? syscall_enter_from_user_mode+0x86/0x1a0 [ 63.365543][ T3660] do_syscall_64+0x2b/0x70 [ 63.369950][ T3660] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 63.375831][ T3660] RIP: 0033:0x7f647bbcde19 [ 63.380234][ T3660] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 63.399828][ T3660] RSP: 002b:00007ffd4087ce08 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 63.408229][ T3660] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f647bbcde19 [ 63.416191][ T3660] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000006 [ 63.424156][ T3660] RBP: 0000000000000000 R08: 00007ffd4087ce30 R09: 00007ffd4087ce30 [pid 3625] getdents64(3, 0x555555d52620 /* 7 entries */, 32768) = 208 [pid 3625] umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3625] lstat("./4/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 3625] unlink("./4/binderfs") = 0 [pid 3625] umount2("./4/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3625] lstat("./4/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 3625] unlink("./4/cgroup") = 0 [pid 3625] umount2("./4/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3625] lstat("./4/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3625] unlink("./4/cgroup.net") = 0 [pid 3625] umount2("./4/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 3625] umount2("./4/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3625] lstat("./4/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3625] umount2("./4/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3625] openat(AT_FDCWD, "./4/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 3625] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3625] getdents64(4, 0x555555d5a660 /* 2 entries */, 32768) = 48 [pid 3625] getdents64(4, 0x555555d5a660 /* 0 entries */, 32768) = 0 [pid 3625] close(4) = 0 [pid 3625] rmdir("./4/file0") = 0 [pid 3625] umount2("./4/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3625] lstat("./4/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3625] unlink("./4/cgroup.cpu") = 0 [pid 3625] getdents64(3, 0x555555d52620 /* 0 entries */, 32768) = 0 [pid 3625] close(3) = 0 [pid 3625] rmdir("./4") = 0 [pid 3625] mkdir("./5", 0777) = 0 [pid 3625] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3664 attached [pid 3664] chdir("./5" [pid 3625] <... clone resumed>, child_tidptr=0x555555d515d0) = 7 [pid 3664] <... chdir resumed>) = 0 [pid 3664] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3664] setpgid(0, 0) = 0 [pid 3664] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [pid 3664] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 3664] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 3664] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3664] write(3, "1000", 4) = 4 [pid 3664] close(3) = 0 [pid 3664] symlink("/dev/binderfs", "./binderfs") = 0 [pid 3664] mkdir("./file0", 000) = 0 [pid 3664] open("./file0", O_RDONLY) = 3 [pid 3664] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 3664] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 3664] openat(4, "syz0", O_RDWR|O_PATH) = 5 [pid 3664] openat(5, "memory.max", O_RDWR) = 6 [ 63.432116][ T3660] R10: 0000000000000002 R11: 0000000000000246 R12: 00007ffd4087ce2c [ 63.440078][ T3660] R13: 00007ffd4087ce40 R14: 00007ffd4087ce80 R15: 0000000000000004 [ 63.448045][ T3660] [ 63.452458][ T3660] memory: usage 80kB, limit 0kB, failcnt 0 [ 63.460754][ T3660] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 63.468765][ T3660] Memory cgroup stats for /syz0: [ 63.469040][ T3660] anon 0 [ 63.469040][ T3660] file 12288 [ 63.469040][ T3660] kernel 69632 [ 63.469040][ T3660] kernel_stack 0 [ 63.469040][ T3660] pagetables 0 [ 63.469040][ T3660] percpu 0 [ 63.469040][ T3660] sock 0 [ 63.469040][ T3660] vmalloc 0 [ 63.469040][ T3660] shmem 0 [ 63.469040][ T3660] zswap 0 [ 63.469040][ T3660] zswapped 0 [ 63.469040][ T3660] file_mapped 0 [ 63.469040][ T3660] file_dirty 0 [ 63.469040][ T3660] file_writeback 0 [ 63.469040][ T3660] swapcached 0 [ 63.469040][ T3660] anon_thp 0 [ 63.469040][ T3660] file_thp 0 [ 63.469040][ T3660] shmem_thp 0 [ 63.469040][ T3660] inactive_anon 0 [ 63.469040][ T3660] active_anon 0 [ 63.469040][ T3660] inactive_file 8192 [ 63.469040][ T3660] active_file 4096 [ 63.469040][ T3660] unevictable 0 [ 63.469040][ T3660] slab_reclaimable 29520 [ 63.469040][ T3660] slab_unreclaimable 37656 [ 63.469040][ T3660] slab 67176 [ 63.469040][ T3660] workingset_refault_anon 0 [ 63.564939][ T3660] Tasks state (memory values in pages): [ 63.570693][ T3660] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 63.580852][ T3660] Out of memory and no killable processes... [pid 3664] sendfile(6, 6, NULL, 2 [pid 3660] <... sendfile resumed>) = 2 [pid 3660] close(3) = 0 [pid 3660] close(4) = 0 [pid 3660] close(5) = 0 [pid 3660] close(6) = 0 [pid 3660] close(7) = -1 EBADF (Bad file descriptor) [pid 3660] close(8) = -1 EBADF (Bad file descriptor) [pid 3660] close(9) = -1 EBADF (Bad file descriptor) [pid 3660] close(10) = -1 EBADF (Bad file descriptor) [pid 3660] close(11) = -1 EBADF (Bad file descriptor) [pid 3660] close(12) = -1 EBADF (Bad file descriptor) [pid 3660] close(13) = -1 EBADF (Bad file descriptor) [pid 3660] close(14) = -1 EBADF (Bad file descriptor) [pid 3660] close(15) = -1 EBADF (Bad file descriptor) [pid 3660] close(16) = -1 EBADF (Bad file descriptor) [pid 3660] close(17) = -1 EBADF (Bad file descriptor) [pid 3660] close(18) = -1 EBADF (Bad file descriptor) [pid 3660] close(19) = -1 EBADF (Bad file descriptor) [pid 3660] close(20) = -1 EBADF (Bad file descriptor) [pid 3660] close(21) = -1 EBADF (Bad file descriptor) [pid 3660] close(22) = -1 EBADF (Bad file descriptor) [pid 3660] close(23) = -1 EBADF (Bad file descriptor) [pid 3660] close(24) = -1 EBADF (Bad file descriptor) [pid 3660] close(25) = -1 EBADF (Bad file descriptor) [pid 3660] close(26) = -1 EBADF (Bad file descriptor) [pid 3660] close(27) = -1 EBADF (Bad file descriptor) [pid 3660] close(28) = -1 EBADF (Bad file descriptor) [pid 3660] close(29) = -1 EBADF (Bad file descriptor) [pid 3660] exit_group(0) = ? [pid 3660] +++ exited with 0 +++ [pid 3624] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6, si_uid=0, si_status=0, si_utime=0, si_stime=52} --- [pid 3624] umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 63.587045][ T3661] syz-executor417 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 63.597491][ T3661] CPU: 0 PID: 3661 Comm: syz-executor417 Not tainted 5.19.0-rc7-syzkaller-00007-g353f7988dd84 #0 [ 63.607998][ T3661] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 [ 63.618065][ T3661] Call Trace: [ 63.621353][ T3661] [ 63.624288][ T3661] dump_stack_lvl+0x1e3/0x2cb [ 63.628982][ T3661] ? bfq_pos_tree_add_move+0x436/0x436 [ 63.634459][ T3661] ? panic+0x76e/0x76e [ 63.638543][ T3661] dump_header+0xdb/0x970 [ 63.642904][ T3661] out_of_memory+0x895/0xb30 [ 63.647497][ T3661] ? unregister_oom_notifier+0x20/0x20 [ 63.652967][ T3661] ? __lock_acquire+0x1f80/0x1f80 [ 63.658003][ T3661] mem_cgroup_out_of_memory+0x25d/0x3b0 [ 63.663557][ T3661] ? mem_cgroup_oom_trylock+0x220/0x220 [ 63.669106][ T3661] ? cgroup_file_notify+0x123/0x190 [ 63.674304][ T3661] memory_max_write+0x364/0x4f0 [ 63.679168][ T3661] ? memory_max_show+0xa0/0xa0 [ 63.683941][ T3661] ? read_lock_is_recursive+0x10/0x10 [ 63.689310][ T3661] ? memory_max_show+0xa0/0xa0 [ 63.694093][ T3661] cgroup_file_write+0x2ab/0x780 [ 63.699042][ T3661] ? cgroup_seqfile_stop+0xd0/0xd0 [ 63.704163][ T3661] ? check_heap_object+0x23e/0x820 [ 63.709292][ T3661] ? kernfs_get_active+0xee/0x160 [ 63.714341][ T3661] ? cgroup_seqfile_stop+0xd0/0xd0 [ 63.719439][ T3661] kernfs_fop_write_iter+0x3ac/0x500 [ 63.724725][ T3661] do_iter_readv_writev+0x499/0x650 [ 63.729941][ T3661] ? generic_file_rw_checks+0x250/0x250 [pid 3624] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 3624] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 3624] getdents64(3, 0x555555d52620 /* 7 entries */, 32768) = 208 [pid 3624] umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3624] lstat("./4/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 3624] unlink("./4/binderfs") = 0 [pid 3624] umount2("./4/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3624] lstat("./4/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 3624] unlink("./4/cgroup") = 0 [ 63.735491][ T3661] ? bpf_lsm_file_permission+0x5/0x10 [ 63.740846][ T3661] ? security_file_permission+0xe0/0x5c0 [ 63.746471][ T3661] ? do_iter_write+0x147/0x7a0 [ 63.751244][ T3661] do_iter_write+0x1f1/0x7a0 [ 63.755834][ T3661] ? vfs_iter_write+0x69/0xa0 [ 63.760493][ T3661] iter_file_splice_write+0x830/0xff0 [ 63.765859][ T3661] ? splice_from_pipe+0x220/0x220 [ 63.770871][ T3661] ? generic_file_splice_read+0x46b/0x660 [ 63.776592][ T3661] ? splice_shrink_spd+0xb0/0xb0 [ 63.781546][ T3661] ? splice_from_pipe+0x220/0x220 [ 63.786581][ T3661] direct_splice_actor+0xe6/0x1c0 [ 63.791624][ T3661] splice_direct_to_actor+0x514/0xc20 [ 63.797008][ T3661] ? do_splice_direct+0x3f0/0x3f0 [ 63.802042][ T3661] ? pipe_to_sendpage+0x340/0x340 [ 63.807073][ T3661] ? do_sendfile+0x600/0xf90 [ 63.811676][ T3661] ? read_lock_is_recursive+0x10/0x10 [ 63.817057][ T3661] ? bpf_lsm_file_permission+0x5/0x10 [ 63.822414][ T3661] ? security_file_permission+0xe0/0x5c0 [ 63.828032][ T3661] do_splice_direct+0x2a0/0x3f0 [ 63.832879][ T3661] ? splice_direct_to_actor+0xc20/0xc20 [ 63.838424][ T3661] ? rcu_read_lock_any_held+0x5f/0x150 [ 63.843880][ T3661] ? _raw_spin_lock_irq+0xdb/0x110 [ 63.849005][ T3661] ? _raw_spin_lock_irqsave+0x120/0x120 [ 63.854557][ T3661] do_sendfile+0x623/0xf90 [ 63.858974][ T3661] ? do_pwritev+0x360/0x360 [ 63.863473][ T3661] ? _raw_spin_unlock_irq+0x2a/0x40 [ 63.868663][ T3661] ? ptrace_notify+0x245/0x340 [ 63.873426][ T3661] ? do_notify_parent+0xeb0/0xeb0 [ 63.878434][ T3661] __se_sys_sendfile64+0x178/0x1e0 [ 63.883554][ T3661] ? __x64_sys_sendfile64+0xa0/0xa0 [ 63.888762][ T3661] ? syscall_enter_from_user_mode+0x86/0x1a0 [ 63.894746][ T3661] do_syscall_64+0x2b/0x70 [ 63.899151][ T3661] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 63.905034][ T3661] RIP: 0033:0x7f647bbcde19 [ 63.909454][ T3661] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 63.929050][ T3661] RSP: 002b:00007ffd4087ce08 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [pid 3624] umount2("./4/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3624] lstat("./4/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3624] unlink("./4/cgroup.net") = 0 [pid 3624] umount2("./4/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 3624] umount2("./4/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3624] lstat("./4/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3624] umount2("./4/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3624] openat(AT_FDCWD, "./4/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 3624] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 3624] getdents64(4, 0x555555d5a660 /* 2 entries */, 32768) = 48 [pid 3624] getdents64(4, 0x555555d5a660 /* 0 entries */, 32768) = 0 [pid 3624] close(4) = 0 [pid 3624] rmdir("./4/file0") = 0 [pid 3624] umount2("./4/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 63.937555][ T3661] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f647bbcde19 [ 63.945515][ T3661] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000006 [ 63.953480][ T3661] RBP: 0000000000000000 R08: 00007ffd4087ce30 R09: 00007ffd4087ce30 [ 63.961475][ T3661] R10: 0000000000000002 R11: 0000000000000246 R12: 00007ffd4087ce2c [ 63.969446][ T3661] R13: 00007ffd4087ce40 R14: 00007ffd4087ce80 R15: 0000000000000004 [ 63.977407][ T3661] [pid 3624] lstat("./4/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3624] unlink("./4/cgroup.cpu") = 0 [pid 3624] getdents64(3, 0x555555d52620 /* 0 entries */, 32768) = 0 [pid 3624] close(3) = 0 [pid 3624] rmdir("./4") = 0 [pid 3624] mkdir("./5", 0777) = 0 [pid 3624] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3665 attached [pid 3665] chdir("./5" [pid 3624] <... clone resumed>, child_tidptr=0x555555d515d0) = 7 [pid 3665] <... chdir resumed>) = 0 [pid 3665] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3665] setpgid(0, 0) = 0 [pid 3665] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 3665] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 3665] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 3665] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3665] write(3, "1000", 4) = 4 [pid 3665] close(3) = 0 [pid 3665] symlink("/dev/binderfs", "./binderfs") = 0 [pid 3665] mkdir("./file0", 000) = 0 [pid 3665] open("./file0", O_RDONLY) = 3 [pid 3665] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 3665] openat(AT_FDCWD, "./file0", O_RDWR|O_PATH) = 4 [pid 3665] openat(4, "syz0", O_RDWR|O_PATH) = 5 [pid 3665] openat(5, "memory.max", O_RDWR) = 6 [ 63.987071][ T3661] memory: usage 80kB, limit 0kB, failcnt 0 [ 63.994070][ T3661] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 64.001845][ T3661] Memory cgroup stats for /syz0: [ 64.002009][ T3661] anon 0 [ 64.002009][ T3661] file 12288 [ 64.002009][ T3661] kernel 69632 [ 64.002009][ T3661] kernel_stack 0 [ 64.002009][ T3661] pagetables 0 [ 64.002009][ T3661] percpu 0 [ 64.002009][ T3661] sock 0 [ 64.002009][ T3661] vmalloc 0 [ 64.002009][ T3661] shmem 0 [ 64.002009][ T3661] zswap 0 [ 64.002009][ T3661] zswapped 0 [ 64.002009][ T3661] file_mapped 0 [ 64.002009][ T3661] file_dirty 4096 [ 64.002009][ T3661] file_writeback 0 [ 64.002009][ T3661] swapcached 0 [ 64.002009][ T3661] anon_thp 0 [ 64.002009][ T3661] file_thp 0 [ 64.002009][ T3661] shmem_thp 0 [ 64.002009][ T3661] inactive_anon 0 [ 64.002009][ T3661] active_anon 0 [ 64.002009][ T3661] inactive_file 8192 [ 64.002009][ T3661] active_file 4096 [ 64.002009][ T3661] unevictable 0 [ 64.002009][ T3661] slab_reclaimable 29520 [ 64.002009][ T3661] slab_unreclaimable 37656 [ 64.002009][ T3661] slab 67176 [pid 3665] sendfile(6, 6, NULL, 2 [pid 3661] <... sendfile resumed>) = 2 [pid 3661] close(3) = 0 [pid 3661] close(4) = 0 [pid 3661] close(5) = 0 [pid 3661] close(6) = 0 [pid 3661] close(7) = -1 EBADF (Bad file descriptor) [pid 3661] close(8) = -1 EBADF (Bad file descriptor) [pid 3661] close(9) = -1 EBADF (Bad file descriptor) [pid 3661] close(10) = -1 EBADF (Bad file descriptor) [pid 3661] close(11) = -1 EBADF (Bad file descriptor) [pid 3661] close(12) = -1 EBADF (Bad file descriptor) [pid 3661] close(13) = -1 EBADF (Bad file descriptor) [pid 3661] close(14) = -1 EBADF (Bad file descriptor) [pid 3661] close(15) = -1 EBADF (Bad file descriptor) [pid 3661] close(16) = -1 EBADF (Bad file descriptor) [pid 3661] close(17) = -1 EBADF (Bad file descriptor) [pid 3661] close(18) = -1 EBADF (Bad file descriptor) [pid 3661] close(19) = -1 EBADF (Bad file descriptor) [pid 3661] close(20) = -1 EBADF (Bad file descriptor) [pid 3661] close(21) = -1 EBADF (Bad file descriptor) [pid 3661] close(22) = -1 EBADF (Bad file descriptor) [pid 3661] close(23) = -1 EBADF (Bad file descriptor) [pid 3661] close(24) = -1 EBADF (Bad file descriptor) [pid 3661] close(25) = -1 EBADF (Bad file descriptor) [pid 3661] close(26) = -1 EBADF (Bad file descriptor) [pid 3661] close(27) = -1 EBADF (Bad file descriptor) [pid 3661] close(28) = -1 EBADF (Bad file descriptor) [pid 3661] close(29) = -1 EBADF (Bad file descriptor) [pid 3661] exit_group(0) = ? [pid 3661] +++ exited with 0 +++ [pid 3626] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6, si_uid=0, si_status=0, si_utime=0, si_stime=52} --- [pid 3626] umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3626] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 3626] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 3626] getdents64(3, 0x555555d52620 /* 7 entries */, 32768) = 208 [pid 3626] umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3626] lstat("./4/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 3626] unlink("./4/binderfs") = 0 [pid 3626] umount2("./4/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3626] lstat("./4/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 3626] unlink("./4/cgroup") = 0 [pid 3626] umount2("./4/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 3626] lstat("./4/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 3626] unlink("./4/cgroup.net") = 0