./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1589937521 <...> [ 92.009036][ T24] cfg80211: failed to load regulatory.db Warning: Permanently added '10.128.10.29' (ED25519) to the list of known hosts. execve("./syz-executor1589937521", ["./syz-executor1589937521"], 0x7fff47fab5a0 /* 10 vars */) = 0 brk(NULL) = 0x555591b87000 brk(0x555591b87d00) = 0x555591b87d00 arch_prctl(ARCH_SET_FS, 0x555591b87380) = 0 set_tid_address(0x555591b87650) = 5845 set_robust_list(0x555591b87660, 24) = 0 rseq(0x555591b87ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor1589937521", 4096) = 28 getrandom("\x00\x28\x42\xe1\x83\x6f\x75\x92", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555591b87d00 brk(0x555591ba8d00) = 0x555591ba8d00 brk(0x555591ba9000) = 0x555591ba9000 mprotect(0x7f9ccf09f000, 16384, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 mkdir("/syzcgroup", 0777) = 0 mkdir("/syzcgroup/unified", 0777) = 0 mount("none", "/syzcgroup/unified", "cgroup2", 0, NULL) = 0 chmod("/syzcgroup/unified", 0777) = 0 openat(AT_FDCWD, "/syzcgroup/unified/cgroup.subtree_control", O_WRONLY) = 3 write(3, "+cpu", 4) = 4 write(3, "+io", 3) = 3 write(3, "+pids", 5) = 5 close(3) = 0 mkdir("/syzcgroup/net", 0777) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "net") = -1 EINVAL (Invalid argument) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio") = 0 umount2("/syzcgroup/net", 0) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "devices") = 0 umount2("/syzcgroup/net", 0) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "blkio") = 0 umount2("/syzcgroup/net", 0) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "freezer") = 0 umount2("/syzcgroup/net", 0) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) [ 93.295414][ T5845] cgroup: Unknown subsys name 'net' mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = 0 chmod("/syzcgroup/net", 0777) = 0 mkdir("/syzcgroup/cpu", 0777) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset") = -1 EINVAL (Invalid argument) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct") = 0 umount2("/syzcgroup/cpu", 0) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "hugetlb") = 0 umount2("/syzcgroup/cpu", 0) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "rlimit") = -1 EINVAL (Invalid argument) mount("none", "/syzcgroup/cpu", "cgroup", 0, "memory") = 0 umount2("/syzcgroup/cpu", 0) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct,hugetlb,memory") = ? ERESTARTNOINTR (To be restarted) [ 93.494859][ T5845] cgroup: Unknown subsys name 'cpuset' [ 93.519285][ T5845] cgroup: Unknown subsys name 'rlimit' mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct,hugetlb,memory") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct,hugetlb,memory") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct,hugetlb,memory") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct,hugetlb,memory") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct,hugetlb,memory") = 0 chmod("/syzcgroup/cpu", 0777) = 0 openat(AT_FDCWD, "/syzcgroup/cpu/cgroup.clone_children", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/syzcgroup/cpu/cpuset.memory_pressure_enabled", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5846 attached , child_tidptr=0x555591b87650) = 5846 [pid 5845] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5846] set_robust_list(0x555591b87660, 24) = 0 [pid 5846] mkdir("./syzkaller.vUbpY9", 0700./strace-static-x86_64: Process 5847 attached [pid 5845] <... clone resumed>, child_tidptr=0x555591b87650) = 5847 [pid 5845] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5847] set_robust_list(0x555591b87660, 24) = 0 [pid 5846] <... mkdir resumed>) = 0 ./strace-static-x86_64: Process 5848 attached [pid 5847] mkdir("./syzkaller.SOOssq", 0700 [pid 5845] <... clone resumed>, child_tidptr=0x555591b87650) = 5848 [pid 5848] set_robust_list(0x555591b87660, 24 [pid 5846] chmod("./syzkaller.vUbpY9", 0777 [pid 5845] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5848] <... set_robust_list resumed>) = 0 [pid 5847] <... mkdir resumed>) = 0 [pid 5846] <... chmod resumed>) = 0 [pid 5848] mkdir("./syzkaller.uAIQ6r", 0700 [pid 5847] chmod("./syzkaller.SOOssq", 0777 [pid 5846] chdir("./syzkaller.vUbpY9"./strace-static-x86_64: Process 5849 attached [pid 5845] <... clone resumed>, child_tidptr=0x555591b87650) = 5849 [pid 5845] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5849] set_robust_list(0x555591b87660, 24 [pid 5847] <... chmod resumed>) = 0 [pid 5846] <... chdir resumed>) = 0 [pid 5849] <... set_robust_list resumed>) = 0 [pid 5848] <... mkdir resumed>) = 0 [pid 5847] chdir("./syzkaller.SOOssq" [pid 5846] unshare(CLONE_NEWPID./strace-static-x86_64: Process 5850 attached [pid 5845] <... clone resumed>, child_tidptr=0x555591b87650) = 5850 [pid 5850] set_robust_list(0x555591b87660, 24) = 0 [pid 5849] mkdir("./syzkaller.S40DWh", 0700 [pid 5848] chmod("./syzkaller.uAIQ6r", 0777 [pid 5847] <... chdir resumed>) = 0 [pid 5846] <... unshare resumed>) = 0 [pid 5847] unshare(CLONE_NEWPID) = 0 [pid 5850] mkdir("./syzkaller.wsWu8Y", 0700 [pid 5847] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5849] <... mkdir resumed>) = 0 [pid 5848] <... chmod resumed>) = 0 [pid 5846] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5851 attached [pid 5851] set_robust_list(0x555591b87660, 24) = 0 [pid 5850] <... mkdir resumed>) = 0 [pid 5851] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5851] getppid() = 0 [pid 5851] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5851] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, ./strace-static-x86_64: Process 5852 attached NULL) = 0 [pid 5850] chmod("./syzkaller.wsWu8Y", 0777 [pid 5849] chmod("./syzkaller.S40DWh", 0777 [pid 5848] chdir("./syzkaller.uAIQ6r" [pid 5847] <... clone resumed>, child_tidptr=0x555591b87650) = 5851 [pid 5851] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, [pid 5848] <... chdir resumed>) = 0 [pid 5852] set_robust_list(0x555591b87660, 24 [pid 5851] <... prlimit64 resumed>NULL) = 0 [pid 5848] unshare(CLONE_NEWPID [pid 5852] <... set_robust_list resumed>) = 0 [pid 5851] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, [pid 5852] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5851] <... prlimit64 resumed>NULL) = 0 [pid 5849] <... chmod resumed>) = 0 [pid 5848] <... unshare resumed>) = 0 [pid 5851] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, [pid 5850] <... chmod resumed>) = 0 [pid 5846] <... clone resumed>, child_tidptr=0x555591b87650) = 5852 [pid 5852] <... prctl resumed>) = 0 [pid 5851] <... prlimit64 resumed>NULL) = 0 [pid 5852] getppid( [pid 5851] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, [pid 5852] <... getppid resumed>) = 0 [pid 5851] <... prlimit64 resumed>NULL) = 0 [pid 5852] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, [pid 5851] unshare(CLONE_NEWNS [pid 5852] <... prlimit64 resumed>NULL) = 0 [pid 5850] chdir("./syzkaller.wsWu8Y" [pid 5849] chdir("./syzkaller.S40DWh" [pid 5848] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5851] <... unshare resumed>) = 0 [pid 5850] <... chdir resumed>) = 0 [pid 5849] <... chdir resumed>) = 0 [pid 5851] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5851] unshare(CLONE_NEWIPC./strace-static-x86_64: Process 5853 attached [pid 5852] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, [pid 5850] unshare(CLONE_NEWPID [pid 5849] unshare(CLONE_NEWPID [pid 5853] set_robust_list(0x555591b87660, 24 [pid 5852] <... prlimit64 resumed>NULL) = 0 [pid 5851] <... unshare resumed>) = 0 [pid 5850] <... unshare resumed>) = 0 [pid 5848] <... clone resumed>, child_tidptr=0x555591b87650) = 5853 [pid 5852] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, [pid 5849] <... unshare resumed>) = 0 [pid 5853] <... set_robust_list resumed>) = 0 [pid 5850] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5852] <... prlimit64 resumed>NULL) = 0 [pid 5851] unshare(CLONE_NEWCGROUP [pid 5849] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5852] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, [pid 5853] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5853] getppid() = 0 [pid 5853] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 ./strace-static-x86_64: Process 5855 attached ./strace-static-x86_64: Process 5854 attached [pid 5852] <... prlimit64 resumed>NULL) = 0 [pid 5851] <... unshare resumed>) = 0 [pid 5852] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, [pid 5851] unshare(CLONE_NEWUTS [pid 5855] set_robust_list(0x555591b87660, 24) = 0 [pid 5854] set_robust_list(0x555591b87660, 24 [pid 5852] <... prlimit64 resumed>NULL) = 0 [pid 5851] <... unshare resumed>) = 0 [pid 5849] <... clone resumed>, child_tidptr=0x555591b87650) = 5854 [pid 5855] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5854] <... set_robust_list resumed>) = 0 [pid 5853] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, [pid 5852] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, [pid 5851] unshare(CLONE_SYSVSEM [pid 5850] <... clone resumed>, child_tidptr=0x555591b87650) = 5855 [pid 5853] <... prlimit64 resumed>NULL) = 0 [pid 5852] <... prlimit64 resumed>NULL) = 0 [pid 5851] <... unshare resumed>) = 0 [pid 5854] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5855] <... prctl resumed>) = 0 [pid 5853] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, [pid 5852] unshare(CLONE_NEWNS [pid 5853] <... prlimit64 resumed>NULL) = 0 [pid 5851] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC [pid 5853] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5853] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5853] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, [pid 5852] <... unshare resumed>) = 0 [pid 5855] getppid( [pid 5854] <... prctl resumed>) = 0 [pid 5853] <... prlimit64 resumed>NULL) = 0 [pid 5852] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL [pid 5851] <... openat resumed>) = 3 [pid 5855] <... getppid resumed>) = 0 [pid 5854] getppid( [pid 5853] unshare(CLONE_NEWNS [pid 5855] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, [pid 5854] <... getppid resumed>) = 0 [pid 5852] <... mount resumed>) = 0 [pid 5851] write(3, "16777216", 8 [pid 5855] <... prlimit64 resumed>NULL) = 0 [pid 5854] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, [pid 5851] <... write resumed>) = 8 [pid 5855] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, [pid 5854] <... prlimit64 resumed>NULL) = 0 [pid 5855] <... prlimit64 resumed>NULL) = 0 [pid 5854] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, [pid 5852] unshare(CLONE_NEWIPC [pid 5851] close(3 [pid 5855] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, [pid 5854] <... prlimit64 resumed>NULL) = 0 [pid 5853] <... unshare resumed>) = 0 [pid 5855] <... prlimit64 resumed>NULL) = 0 [pid 5854] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, [pid 5855] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, [pid 5854] <... prlimit64 resumed>NULL) = 0 [pid 5853] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL [pid 5851] <... close resumed>) = 0 [pid 5855] <... prlimit64 resumed>NULL) = 0 [pid 5854] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, [pid 5853] <... mount resumed>) = 0 [pid 5852] <... unshare resumed>) = 0 [pid 5855] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, [pid 5854] <... prlimit64 resumed>NULL) = 0 [pid 5855] <... prlimit64 resumed>NULL) = 0 [pid 5854] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, [pid 5853] unshare(CLONE_NEWIPC [pid 5852] unshare(CLONE_NEWCGROUP [pid 5851] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC [pid 5855] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, [pid 5854] <... prlimit64 resumed>NULL) = 0 [pid 5855] <... prlimit64 resumed>NULL) = 0 [pid 5854] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, [pid 5853] <... unshare resumed>) = 0 [pid 5852] <... unshare resumed>) = 0 [pid 5851] <... openat resumed>) = 3 [pid 5855] unshare(CLONE_NEWNS [pid 5854] <... prlimit64 resumed>NULL) = 0 [pid 5852] unshare(CLONE_NEWUTS [pid 5854] unshare(CLONE_NEWNS [pid 5853] unshare(CLONE_NEWCGROUP [pid 5852] <... unshare resumed>) = 0 [pid 5851] write(3, "536870912", 9 [pid 5855] <... unshare resumed>) = 0 [pid 5855] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5854] <... unshare resumed>) = 0 [pid 5853] <... unshare resumed>) = 0 [pid 5852] unshare(CLONE_SYSVSEM [pid 5851] <... write resumed>) = 9 [pid 5854] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL [pid 5853] unshare(CLONE_NEWUTS [pid 5852] <... unshare resumed>) = 0 [pid 5851] close(3 [pid 5855] unshare(CLONE_NEWIPC [pid 5854] <... mount resumed>) = 0 [pid 5853] <... unshare resumed>) = 0 [pid 5852] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC [pid 5851] <... close resumed>) = 0 [pid 5854] unshare(CLONE_NEWIPC [pid 5851] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC [pid 5855] <... unshare resumed>) = 0 [pid 5854] <... unshare resumed>) = 0 [pid 5853] unshare(CLONE_SYSVSEM [pid 5852] <... openat resumed>) = 3 [pid 5851] <... openat resumed>) = 3 [pid 5853] <... unshare resumed>) = 0 [pid 5855] unshare(CLONE_NEWCGROUP [pid 5854] unshare(CLONE_NEWCGROUP [pid 5852] write(3, "16777216", 8 [pid 5851] write(3, "1024", 4 [pid 5853] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC [pid 5855] <... unshare resumed>) = 0 [pid 5851] <... write resumed>) = 4 [pid 5855] unshare(CLONE_NEWUTS [pid 5854] <... unshare resumed>) = 0 [pid 5852] <... write resumed>) = 8 [pid 5855] <... unshare resumed>) = 0 [pid 5854] unshare(CLONE_NEWUTS [pid 5853] <... openat resumed>) = 3 [pid 5852] close(3 [pid 5851] close(3 [pid 5855] unshare(CLONE_SYSVSEM [pid 5854] <... unshare resumed>) = 0 [pid 5853] write(3, "16777216", 8 [pid 5852] <... close resumed>) = 0 [pid 5851] <... close resumed>) = 0 [pid 5855] <... unshare resumed>) = 0 [pid 5854] unshare(CLONE_SYSVSEM [pid 5853] <... write resumed>) = 8 [pid 5852] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC [pid 5851] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC [pid 5855] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC [pid 5854] <... unshare resumed>) = 0 [pid 5853] close(3) = 0 [pid 5854] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC [pid 5853] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 5852] <... openat resumed>) = 3 [pid 5851] <... openat resumed>) = 3 [pid 5855] <... openat resumed>) = 3 [pid 5852] write(3, "536870912", 9 [pid 5855] write(3, "16777216", 8 [pid 5854] <... openat resumed>) = 3 [pid 5853] write(3, "536870912", 9 [pid 5852] <... write resumed>) = 9 [pid 5851] write(3, "8192", 4 [pid 5855] <... write resumed>) = 8 [pid 5854] write(3, "16777216", 8 [pid 5853] <... write resumed>) = 9 [pid 5852] close(3 [pid 5854] <... write resumed>) = 8 [pid 5851] <... write resumed>) = 4 [pid 5854] close(3 [pid 5853] close(3 [pid 5852] <... close resumed>) = 0 [pid 5851] close(3 [pid 5855] close(3 [pid 5854] <... close resumed>) = 0 [pid 5853] <... close resumed>) = 0 [pid 5855] <... close resumed>) = 0 [pid 5854] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC [pid 5853] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC [pid 5852] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC [pid 5851] <... close resumed>) = 0 [pid 5855] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC [pid 5853] <... openat resumed>) = 3 [pid 5854] <... openat resumed>) = 3 [pid 5853] write(3, "1024", 4 [pid 5855] <... openat resumed>) = 3 [pid 5854] write(3, "536870912", 9 [pid 5852] <... openat resumed>) = 3 [pid 5851] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC [pid 5855] write(3, "536870912", 9 [pid 5854] <... write resumed>) = 9 [pid 5853] <... write resumed>) = 4 [pid 5852] write(3, "1024", 4 [pid 5855] <... write resumed>) = 9 [pid 5854] close(3 [pid 5853] close(3 [pid 5852] <... write resumed>) = 4 [pid 5851] <... openat resumed>) = 3 [pid 5855] close(3 [pid 5854] <... close resumed>) = 0 [pid 5853] <... close resumed>) = 0 [pid 5852] close(3 [pid 5855] <... close resumed>) = 0 [pid 5854] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC [pid 5853] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC [pid 5851] write(3, "1024", 4 [pid 5855] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC [pid 5852] <... close resumed>) = 0 [pid 5855] <... openat resumed>) = 3 [pid 5853] <... openat resumed>) = 3 [pid 5851] <... write resumed>) = 4 [pid 5853] write(3, "8192", 4 [pid 5854] <... openat resumed>) = 3 [pid 5851] close(3 [pid 5853] <... write resumed>) = 4 [pid 5855] write(3, "1024", 4 [pid 5854] write(3, "1024", 4 [pid 5853] close(3 [pid 5852] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC [pid 5851] <... close resumed>) = 0 [pid 5855] <... write resumed>) = 4 [pid 5854] <... write resumed>) = 4 [pid 5852] <... openat resumed>) = 3 [pid 5855] close(3) = 0 [pid 5855] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC [pid 5852] write(3, "8192", 4 [pid 5855] <... openat resumed>) = 3 [pid 5852] <... write resumed>) = 4 [pid 5852] close(3) = 0 [pid 5855] write(3, "8192", 4 [pid 5852] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC [pid 5855] <... write resumed>) = 4 [pid 5852] <... openat resumed>) = 3 [pid 5855] close(3) = 0 [pid 5855] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5854] close(3 [pid 5853] <... close resumed>) = 0 [pid 5852] write(3, "1024", 4 [pid 5851] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC [pid 5854] <... close resumed>) = 0 [pid 5853] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC [pid 5852] <... write resumed>) = 4 [pid 5855] write(3, "1024", 4 [pid 5854] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC [pid 5853] <... openat resumed>) = 3 [pid 5852] close(3 [pid 5851] <... openat resumed>) = 3 [pid 5855] <... write resumed>) = 4 [pid 5855] close(3 [pid 5852] <... close resumed>) = 0 [pid 5855] <... close resumed>) = 0 [pid 5854] <... openat resumed>) = 3 [pid 5853] write(3, "1024", 4 [pid 5852] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC [pid 5851] write(3, "1024", 4 [pid 5854] write(3, "8192", 4 [pid 5851] <... write resumed>) = 4 [pid 5855] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC [pid 5854] <... write resumed>) = 4 [pid 5853] <... write resumed>) = 4 [pid 5852] <... openat resumed>) = 3 [pid 5851] close(3 [pid 5855] <... openat resumed>) = 3 [pid 5854] close(3 [pid 5853] close(3 [pid 5852] write(3, "1024", 4 [pid 5855] write(3, "1024", 4 [pid 5854] <... close resumed>) = 0 [pid 5853] <... close resumed>) = 0 [pid 5851] <... close resumed>) = 0 [pid 5855] <... write resumed>) = 4 [pid 5853] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC [pid 5852] <... write resumed>) = 4 [pid 5851] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC [pid 5855] close(3 [pid 5854] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC [pid 5853] <... openat resumed>) = 3 [pid 5852] close(3 [pid 5855] <... close resumed>) = 0 [pid 5855] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC [pid 5853] write(3, "1024", 4 [pid 5852] <... close resumed>) = 0 [pid 5851] <... openat resumed>) = 3 [pid 5854] <... openat resumed>) = 3 [pid 5855] <... openat resumed>) = 3 [pid 5854] write(3, "1024", 4 [pid 5853] <... write resumed>) = 4 [pid 5852] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC [pid 5854] <... write resumed>) = 4 [pid 5853] close(3 [pid 5852] <... openat resumed>) = 3 [pid 5851] write(3, "1024 1048576 500 1024", 21 [pid 5855] write(3, "1024 1048576 500 1024", 21 [pid 5854] close(3 [pid 5853] <... close resumed>) = 0 [pid 5851] <... write resumed>) = 21 [pid 5854] <... close resumed>) = 0 [pid 5851] close(3 [pid 5855] <... write resumed>) = 21 [pid 5853] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC [pid 5852] write(3, "1024 1048576 500 1024", 21 [pid 5855] close(3 [pid 5854] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC [pid 5853] <... openat resumed>) = 3 [pid 5852] <... write resumed>) = 21 [pid 5851] <... close resumed>) = 0 [pid 5855] <... close resumed>) = 0 [pid 5855] getpid() = 1 [pid 5854] <... openat resumed>) = 3 [pid 5853] write(3, "1024 1048576 500 1024", 21 [pid 5852] close(3 [pid 5851] getpid( [pid 5855] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, [pid 5853] <... write resumed>) = 21 [pid 5851] <... getpid resumed>) = 1 [pid 5855] <... capget resumed>{effective=1< [pid 5853] close(3 [pid 5852] <... close resumed>) = 0 [pid 5851] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, [pid 5855] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 5854] <... write resumed>) = 4 [pid 5853] <... close resumed>) = 0 [pid 5852] getpid( [pid 5851] <... capget resumed>{effective=1<) = 0 [pid 5853] getpid( [pid 5852] <... getpid resumed>) = 1 [pid 5855] unshare(CLONE_NEWNET [pid 5853] <... getpid resumed>) = 1 [pid 5852] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, [pid 5854] close(3 [pid 5853] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, [pid 5852] <... capget resumed>{effective=1< [pid 5854] <... close resumed>) = 0 [pid 5853] <... capget resumed>{effective=1< [pid 5851] <... capset resumed>) = 0 [pid 5854] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC [pid 5853] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 5852] <... capset resumed>) = 0 [pid 5851] unshare(CLONE_NEWNET [pid 5854] <... openat resumed>) = 3 [pid 5853] <... capset resumed>) = 0 [pid 5852] unshare(CLONE_NEWNET [pid 5854] write(3, "1024 1048576 500 1024", 21) = 21 [pid 5854] close(3) = 0 [pid 5854] getpid() = 1 [pid 5854] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 5853] unshare(CLONE_NEWNET) = 0 [pid 5853] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC [pid 5854] <... unshare resumed>) = 0 [pid 5853] <... openat resumed>) = 3 [pid 5853] write(3, "0 65535", 7 [pid 5854] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC) = 3 [pid 5853] <... write resumed>) = 7 [pid 5854] write(3, "0 65535", 7 [pid 5853] close(3 [pid 5854] <... write resumed>) = 7 [pid 5853] <... close resumed>) = 0 [pid 5854] close(3 [pid 5853] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC [pid 5854] <... close resumed>) = 0 [pid 5854] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC [pid 5853] <... openat resumed>) = 3 [pid 5855] <... unshare resumed>) = 0 [pid 5854] <... openat resumed>) = 3 [pid 5853] write(3, "100000", 6 [pid 5851] <... unshare resumed>) = 0 [pid 5855] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC [pid 5854] write(3, "100000", 6 [pid 5851] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC [pid 5854] <... write resumed>) = 6 [pid 5855] <... openat resumed>) = 3 [pid 5854] close(3 [pid 5853] <... write resumed>) = 6 [pid 5851] <... openat resumed>) = 3 [pid 5854] <... close resumed>) = 0 [pid 5853] close(3 [pid 5851] write(3, "0 65535", 7 [pid 5855] write(3, "0 65535", 7 [pid 5854] mkdir("./syz-tmp", 0777 [pid 5853] <... close resumed>) = 0 [pid 5852] <... unshare resumed>) = 0 [pid 5853] mkdir("./syz-tmp", 0777 [pid 5851] <... write resumed>) = 7 [pid 5855] <... write resumed>) = 7 [pid 5854] <... mkdir resumed>) = 0 [pid 5853] <... mkdir resumed>) = 0 [pid 5852] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC [pid 5851] close(3 [pid 5855] close(3 [pid 5854] mount("", "./syz-tmp", "tmpfs", 0, NULL [pid 5853] mount("", "./syz-tmp", "tmpfs", 0, NULL [pid 5855] <... close resumed>) = 0 [pid 5854] <... mount resumed>) = 0 [pid 5852] <... openat resumed>) = 3 [pid 5851] <... close resumed>) = 0 [pid 5855] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC [pid 5854] mkdir("./syz-tmp/newroot", 0777 [pid 5855] <... openat resumed>) = 3 [pid 5854] <... mkdir resumed>) = 0 [pid 5853] <... mount resumed>) = 0 [pid 5852] write(3, "0 65535", 7 [pid 5851] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC [pid 5855] write(3, "100000", 6) = 6 [pid 5854] mkdir("./syz-tmp/newroot/dev", 0700 [pid 5852] <... write resumed>) = 7 [pid 5851] <... openat resumed>) = 3 [pid 5855] close(3 [pid 5854] <... mkdir resumed>) = 0 [pid 5853] mkdir("./syz-tmp/newroot", 0777 [pid 5852] close(3 [pid 5855] <... close resumed>) = 0 [pid 5851] write(3, "100000", 6 [pid 5855] mkdir("./syz-tmp", 0777 [pid 5852] <... close resumed>) = 0 [pid 5851] <... write resumed>) = 6 [pid 5854] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5853] <... mkdir resumed>) = 0 [pid 5851] close(3 [pid 5855] <... mkdir resumed>) = 0 [pid 5853] mkdir("./syz-tmp/newroot/dev", 0700 [pid 5852] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC [pid 5851] <... close resumed>) = 0 [pid 5853] <... mkdir resumed>) = 0 [pid 5855] mount("", "./syz-tmp", "tmpfs", 0, NULL [pid 5854] <... mount resumed>) = 0 [pid 5853] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5852] <... openat resumed>) = 3 [pid 5851] mkdir("./syz-tmp", 0777 [pid 5855] <... mount resumed>) = 0 [pid 5854] mkdir("./syz-tmp/newroot/proc", 0700 [pid 5853] <... mount resumed>) = 0 [pid 5855] mkdir("./syz-tmp/newroot", 0777 [pid 5853] mkdir("./syz-tmp/newroot/proc", 0700 [pid 5852] write(3, "100000", 6 [pid 5851] <... mkdir resumed>) = 0 [pid 5855] <... mkdir resumed>) = 0 [pid 5854] <... mkdir resumed>) = 0 [pid 5853] <... mkdir resumed>) = 0 [pid 5852] <... write resumed>) = 6 [pid 5852] close(3 [pid 5855] mkdir("./syz-tmp/newroot/dev", 0700 [pid 5852] <... close resumed>) = 0 [pid 5855] <... mkdir resumed>) = 0 [pid 5852] mkdir("./syz-tmp", 0777 [pid 5851] mount("", "./syz-tmp", "tmpfs", 0, NULL [pid 5854] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL) = 0 [pid 5853] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL [pid 5852] <... mkdir resumed>) = 0 [pid 5851] <... mount resumed>) = 0 [pid 5855] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5854] mkdir("./syz-tmp/newroot/selinux", 0700 [pid 5853] <... mount resumed>) = 0 [pid 5855] <... mount resumed>) = 0 [pid 5854] <... mkdir resumed>) = 0 [pid 5853] mkdir("./syz-tmp/newroot/selinux", 0700 [pid 5852] mount("", "./syz-tmp", "tmpfs", 0, NULL [pid 5851] mkdir("./syz-tmp/newroot", 0777 [pid 5855] mkdir("./syz-tmp/newroot/proc", 0700 [pid 5851] <... mkdir resumed>) = 0 [pid 5854] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5853] <... mkdir resumed>) = 0 [pid 5852] <... mount resumed>) = 0 [pid 5851] mkdir("./syz-tmp/newroot/dev", 0700 [pid 5855] <... mkdir resumed>) = 0 [pid 5854] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 5853] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5855] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL [pid 5854] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5853] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 5852] mkdir("./syz-tmp/newroot", 0777 [pid 5851] <... mkdir resumed>) = 0 [pid 5855] <... mount resumed>) = 0 [pid 5854] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 5853] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5852] <... mkdir resumed>) = 0 [pid 5854] mkdir("./syz-tmp/newroot/sys", 0700 [pid 5853] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 5855] mkdir("./syz-tmp/newroot/selinux", 0700 [pid 5852] mkdir("./syz-tmp/newroot/dev", 0700 [pid 5851] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5855] <... mkdir resumed>) = 0 [pid 5854] <... mkdir resumed>) = 0 [pid 5853] mkdir("./syz-tmp/newroot/sys", 0700 [pid 5855] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5854] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5853] <... mkdir resumed>) = 0 [pid 5852] <... mkdir resumed>) = 0 [pid 5851] <... mount resumed>) = 0 [pid 5855] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 5854] <... mount resumed>) = 0 [pid 5853] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5855] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5853] <... mount resumed>) = 0 [pid 5852] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5851] mkdir("./syz-tmp/newroot/proc", 0700 [pid 5855] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 5854] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5852] <... mount resumed>) = 0 [pid 5855] mkdir("./syz-tmp/newroot/sys", 0700 [pid 5854] <... mount resumed>) = 0 [pid 5853] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5852] mkdir("./syz-tmp/newroot/proc", 0700 [pid 5851] <... mkdir resumed>) = 0 [pid 5855] <... mkdir resumed>) = 0 [pid 5851] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL [pid 5854] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5853] <... mount resumed>) = 0 [pid 5852] <... mkdir resumed>) = 0 [pid 5855] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5853] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5851] <... mount resumed>) = 0 [pid 5854] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 5852] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL [pid 5855] <... mount resumed>) = 0 [pid 5854] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5853] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 5851] mkdir("./syz-tmp/newroot/selinux", 0700 [pid 5855] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5853] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5852] <... mount resumed>) = 0 [pid 5855] <... mount resumed>) = 0 [pid 5854] <... mount resumed>) = 0 [pid 5851] <... mkdir resumed>) = 0 [pid 5853] <... mount resumed>) = 0 [pid 5854] mkdir("./syz-tmp/newroot/syz-inputs", 0700 [pid 5852] mkdir("./syz-tmp/newroot/selinux", 0700 [pid 5855] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5853] mkdir("./syz-tmp/newroot/syz-inputs", 0700 [pid 5851] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5855] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 5854] <... mkdir resumed>) = 0 [pid 5853] <... mkdir resumed>) = 0 [pid 5852] <... mkdir resumed>) = 0 [pid 5855] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5854] mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL, MS_RDONLY|MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5852] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5854] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 5852] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 5851] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 5853] mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL, MS_RDONLY|MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5852] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5855] <... mount resumed>) = 0 [pid 5852] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 5855] mkdir("./syz-tmp/newroot/syz-inputs", 0700 [pid 5854] mkdir("./syz-tmp/newroot/syzcgroup", 0700 [pid 5853] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 5851] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5855] <... mkdir resumed>) = 0 [pid 5854] <... mkdir resumed>) = 0 [pid 5853] mkdir("./syz-tmp/newroot/syzcgroup", 0700 [pid 5852] mkdir("./syz-tmp/newroot/sys", 0700 [pid 5854] mkdir("./syz-tmp/newroot/syzcgroup/unified", 0700 [pid 5852] <... mkdir resumed>) = 0 [pid 5851] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 5855] mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL, MS_RDONLY|MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5854] <... mkdir resumed>) = 0 [pid 5853] <... mkdir resumed>) = 0 [pid 5851] mkdir("./syz-tmp/newroot/sys", 0700 [pid 5855] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 5854] mkdir("./syz-tmp/newroot/syzcgroup/cpu", 0700 [pid 5852] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5855] mkdir("./syz-tmp/newroot/syzcgroup", 0700 [pid 5854] <... mkdir resumed>) = 0 [pid 5853] mkdir("./syz-tmp/newroot/syzcgroup/unified", 0700 [pid 5851] <... mkdir resumed>) = 0 [pid 5854] mkdir("./syz-tmp/newroot/syzcgroup/net", 0700 [pid 5852] <... mount resumed>) = 0 [pid 5855] <... mkdir resumed>) = 0 [pid 5854] <... mkdir resumed>) = 0 [pid 5853] <... mkdir resumed>) = 0 [pid 5852] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5851] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5855] mkdir("./syz-tmp/newroot/syzcgroup/unified", 0700 [pid 5851] <... mount resumed>) = 0 [pid 5855] <... mkdir resumed>) = 0 [pid 5853] mkdir("./syz-tmp/newroot/syzcgroup/cpu", 0700 [pid 5852] <... mount resumed>) = 0 [pid 5854] mount("/syzcgroup/unified", "./syz-tmp/newroot/syzcgroup/unified", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5853] <... mkdir resumed>) = 0 [pid 5855] mkdir("./syz-tmp/newroot/syzcgroup/cpu", 0700 [pid 5854] <... mount resumed>) = 0 [pid 5853] mkdir("./syz-tmp/newroot/syzcgroup/net", 0700 [pid 5852] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5851] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5855] <... mkdir resumed>) = 0 [pid 5854] mount("/syzcgroup/cpu", "./syz-tmp/newroot/syzcgroup/cpu", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5853] <... mkdir resumed>) = 0 [pid 5852] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 5854] <... mount resumed>) = 0 [pid 5851] <... mount resumed>) = 0 [pid 5855] mkdir("./syz-tmp/newroot/syzcgroup/net", 0700 [pid 5852] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5853] mount("/syzcgroup/unified", "./syz-tmp/newroot/syzcgroup/unified", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5854] mount("/syzcgroup/net", "./syz-tmp/newroot/syzcgroup/net", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5851] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5855] <... mkdir resumed>) = 0 [pid 5852] <... mount resumed>) = 0 [pid 5853] <... mount resumed>) = 0 [pid 5851] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 5854] <... mount resumed>) = 0 [pid 5855] mount("/syzcgroup/unified", "./syz-tmp/newroot/syzcgroup/unified", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5851] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5854] mkdir("./syz-tmp/pivot", 0777 [pid 5853] mount("/syzcgroup/cpu", "./syz-tmp/newroot/syzcgroup/cpu", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5852] mkdir("./syz-tmp/newroot/syz-inputs", 0700 [pid 5855] <... mount resumed>) = 0 [pid 5851] <... mount resumed>) = 0 [pid 5854] <... mkdir resumed>) = 0 [pid 5853] <... mount resumed>) = 0 [pid 5852] <... mkdir resumed>) = 0 [pid 5855] mount("/syzcgroup/cpu", "./syz-tmp/newroot/syzcgroup/cpu", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5854] pivot_root("./syz-tmp", "./syz-tmp/pivot" [pid 5853] mount("/syzcgroup/net", "./syz-tmp/newroot/syzcgroup/net", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5852] mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL, MS_RDONLY|MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5851] mkdir("./syz-tmp/newroot/syz-inputs", 0700 [pid 5855] <... mount resumed>) = 0 [pid 5854] <... pivot_root resumed>) = 0 [pid 5852] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 5853] <... mount resumed>) = 0 [pid 5851] <... mkdir resumed>) = 0 [pid 5853] mkdir("./syz-tmp/pivot", 0777 [pid 5852] mkdir("./syz-tmp/newroot/syzcgroup", 0700 [pid 5851] mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL, MS_RDONLY|MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5855] mount("/syzcgroup/net", "./syz-tmp/newroot/syzcgroup/net", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5854] chdir("/" [pid 5853] <... mkdir resumed>) = 0 [pid 5852] <... mkdir resumed>) = 0 [pid 5851] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 5854] <... chdir resumed>) = 0 [pid 5853] pivot_root("./syz-tmp", "./syz-tmp/pivot" [pid 5852] mkdir("./syz-tmp/newroot/syzcgroup/unified", 0700 [pid 5851] mkdir("./syz-tmp/newroot/syzcgroup", 0700 [pid 5855] <... mount resumed>) = 0 [pid 5854] umount2("./pivot", MNT_DETACH [pid 5852] <... mkdir resumed>) = 0 [pid 5855] mkdir("./syz-tmp/pivot", 0777 [pid 5853] <... pivot_root resumed>) = 0 [pid 5851] <... mkdir resumed>) = 0 [pid 5855] <... mkdir resumed>) = 0 [pid 5852] mkdir("./syz-tmp/newroot/syzcgroup/cpu", 0700 [pid 5855] pivot_root("./syz-tmp", "./syz-tmp/pivot" [pid 5854] <... umount2 resumed>) = 0 [pid 5853] chdir("/" [pid 5852] <... mkdir resumed>) = 0 [pid 5851] mkdir("./syz-tmp/newroot/syzcgroup/unified", 0700 [pid 5854] chroot("./newroot" [pid 5853] <... chdir resumed>) = 0 [pid 5852] mkdir("./syz-tmp/newroot/syzcgroup/net", 0700 [pid 5854] <... chroot resumed>) = 0 [pid 5853] umount2("./pivot", MNT_DETACH [pid 5852] <... mkdir resumed>) = 0 [pid 5855] <... pivot_root resumed>) = 0 [pid 5854] chdir("/" [pid 5855] chdir("/" [pid 5851] <... mkdir resumed>) = 0 [pid 5855] <... chdir resumed>) = 0 [pid 5854] <... chdir resumed>) = 0 [pid 5851] mkdir("./syz-tmp/newroot/syzcgroup/cpu", 0700 [pid 5855] umount2("./pivot", MNT_DETACH [pid 5854] mkdir("/dev/gadgetfs", 0777 [pid 5853] <... umount2 resumed>) = 0 [pid 5852] mount("/syzcgroup/unified", "./syz-tmp/newroot/syzcgroup/unified", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5851] <... mkdir resumed>) = 0 [pid 5851] mkdir("./syz-tmp/newroot/syzcgroup/net", 0700 [pid 5855] <... umount2 resumed>) = 0 [pid 5854] <... mkdir resumed>) = 0 [pid 5853] chroot("./newroot" [pid 5852] <... mount resumed>) = 0 [pid 5851] <... mkdir resumed>) = 0 [pid 5851] mount("/syzcgroup/unified", "./syz-tmp/newroot/syzcgroup/unified", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5855] chroot("./newroot" [pid 5854] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL [pid 5853] <... chroot resumed>) = 0 [pid 5852] mount("/syzcgroup/cpu", "./syz-tmp/newroot/syzcgroup/cpu", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5851] <... mount resumed>) = 0 [pid 5855] <... chroot resumed>) = 0 [pid 5854] <... mount resumed>) = 0 [pid 5853] chdir("/" [pid 5852] <... mount resumed>) = 0 [pid 5851] mount("/syzcgroup/cpu", "./syz-tmp/newroot/syzcgroup/cpu", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5853] <... chdir resumed>) = 0 [pid 5852] mount("/syzcgroup/net", "./syz-tmp/newroot/syzcgroup/net", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5853] mkdir("/dev/gadgetfs", 0777 [pid 5855] chdir("/" [pid 5854] mkdir("/dev/binderfs", 0777 [pid 5853] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 5852] <... mount resumed>) = 0 [pid 5851] <... mount resumed>) = 0 [pid 5855] <... chdir resumed>) = 0 [pid 5853] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL [pid 5855] mkdir("/dev/gadgetfs", 0777 [pid 5854] <... mkdir resumed>) = 0 [pid 5853] <... mount resumed>) = 0 [pid 5851] mount("/syzcgroup/net", "./syz-tmp/newroot/syzcgroup/net", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5855] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 5855] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL [pid 5854] mount("binder", "/dev/binderfs", "binder", 0, NULL [pid 5853] mkdir("/dev/binderfs", 0777 [pid 5852] mkdir("./syz-tmp/pivot", 0777 [pid 5855] <... mount resumed>) = 0 [pid 5851] <... mount resumed>) = 0 [pid 5855] mkdir("/dev/binderfs", 0777 [pid 5854] <... mount resumed>) = 0 [pid 5853] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 5852] <... mkdir resumed>) = 0 [pid 5851] mkdir("./syz-tmp/pivot", 0777 [pid 5853] mount("binder", "/dev/binderfs", "binder", 0, NULL [pid 5852] pivot_root("./syz-tmp", "./syz-tmp/pivot" [pid 5855] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 5854] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL [pid 5855] mount("binder", "/dev/binderfs", "binder", 0, NULL [pid 5854] <... mount resumed>) = -1 EBUSY (Device or resource busy) [pid 5852] <... pivot_root resumed>) = 0 [pid 5853] <... mount resumed>) = 0 [pid 5851] <... mkdir resumed>) = 0 [pid 5852] chdir("/") = 0 [pid 5851] pivot_root("./syz-tmp", "./syz-tmp/pivot" [pid 5855] <... mount resumed>) = 0 [pid 5854] getpid( [pid 5853] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL [pid 5852] umount2("./pivot", MNT_DETACH [pid 5854] <... getpid resumed>) = 1 [pid 5854] mkdir("/syzcgroup/unified/syz3", 0777 [pid 5853] <... mount resumed>) = -1 EBUSY (Device or resource busy) [pid 5851] <... pivot_root resumed>) = 0 [pid 5855] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL [pid 5853] getpid( [pid 5852] <... umount2 resumed>) = 0 [pid 5851] chdir("/" [pid 5855] <... mount resumed>) = -1 EBUSY (Device or resource busy) [pid 5855] getpid( [pid 5854] <... mkdir resumed>) = 0 [pid 5853] <... getpid resumed>) = 1 [pid 5852] chroot("./newroot" [pid 5851] <... chdir resumed>) = 0 [pid 5855] <... getpid resumed>) = 1 [pid 5854] openat(AT_FDCWD, "/syzcgroup/unified/syz3/pids.max", O_WRONLY|O_CLOEXEC [pid 5853] mkdir("/syzcgroup/unified/syz2", 0777 [pid 5852] <... chroot resumed>) = 0 [pid 5851] umount2("./pivot", MNT_DETACH [pid 5855] mkdir("/syzcgroup/unified/syz4", 0777 [pid 5851] <... umount2 resumed>) = 0 [pid 5852] chdir("/" [pid 5851] chroot("./newroot" [pid 5855] <... mkdir resumed>) = 0 [pid 5854] <... openat resumed>) = 3 [pid 5853] <... mkdir resumed>) = 0 [pid 5852] <... chdir resumed>) = 0 [pid 5855] openat(AT_FDCWD, "/syzcgroup/unified/syz4/pids.max", O_WRONLY|O_CLOEXEC [pid 5853] openat(AT_FDCWD, "/syzcgroup/unified/syz2/pids.max", O_WRONLY|O_CLOEXEC [pid 5851] <... chroot resumed>) = 0 [pid 5855] <... openat resumed>) = 3 [pid 5853] <... openat resumed>) = 3 [pid 5851] chdir("/") = 0 [pid 5851] mkdir("/dev/gadgetfs", 0777 [pid 5855] write(3, "32", 2 [pid 5851] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 5855] <... write resumed>) = 2 [pid 5853] write(3, "32", 2 [pid 5851] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL [pid 5855] close(3 [pid 5854] write(3, "32", 2 [pid 5853] <... write resumed>) = 2 [pid 5852] mkdir("/dev/gadgetfs", 0777 [pid 5851] <... mount resumed>) = 0 [pid 5854] <... write resumed>) = 2 [pid 5852] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 5854] close(3 [pid 5852] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL [pid 5855] <... close resumed>) = 0 [pid 5854] <... close resumed>) = 0 [pid 5853] close(3 [pid 5851] mkdir("/dev/binderfs", 0777 [pid 5855] openat(AT_FDCWD, "/syzcgroup/unified/syz4/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 5854] openat(AT_FDCWD, "/syzcgroup/unified/syz3/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 5853] <... close resumed>) = 0 [pid 5852] <... mount resumed>) = 0 [pid 5851] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 5855] <... openat resumed>) = 3 [pid 5853] openat(AT_FDCWD, "/syzcgroup/unified/syz2/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 5852] mkdir("/dev/binderfs", 0777 [pid 5851] mount("binder", "/dev/binderfs", "binder", 0, NULL [pid 5855] write(3, "1", 1 [pid 5854] <... openat resumed>) = 3 [pid 5853] <... openat resumed>) = 3 [pid 5852] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 5854] write(3, "1", 1 [pid 5852] mount("binder", "/dev/binderfs", "binder", 0, NULL [pid 5853] write(3, "1", 1 [pid 5851] <... mount resumed>) = 0 [pid 5852] <... mount resumed>) = 0 [pid 5852] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL [pid 5851] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL [pid 5852] <... mount resumed>) = -1 EBUSY (Device or resource busy) [pid 5855] <... write resumed>) = 1 [pid 5854] <... write resumed>) = 1 [pid 5853] <... write resumed>) = 1 [pid 5852] getpid( [pid 5851] <... mount resumed>) = -1 EBUSY (Device or resource busy) [pid 5855] close(3 [pid 5854] close(3 [pid 5853] close(3 [pid 5852] <... getpid resumed>) = 1 [pid 5855] <... close resumed>) = 0 [pid 5854] <... close resumed>) = 0 [pid 5853] <... close resumed>) = 0 [pid 5852] mkdir("/syzcgroup/unified/syz0", 0777 [pid 5851] getpid( [pid 5855] mkdir("/syzcgroup/cpu/syz4", 0777 [pid 5854] mkdir("/syzcgroup/cpu/syz3", 0777 [pid 5853] mkdir("/syzcgroup/cpu/syz2", 0777 [pid 5852] <... mkdir resumed>) = 0 [pid 5851] <... getpid resumed>) = 1 [pid 5851] mkdir("/syzcgroup/unified/syz1", 0777 [pid 5852] openat(AT_FDCWD, "/syzcgroup/unified/syz0/pids.max", O_WRONLY|O_CLOEXEC [pid 5855] <... mkdir resumed>) = 0 [pid 5854] <... mkdir resumed>) = 0 [pid 5851] <... mkdir resumed>) = 0 [pid 5853] <... mkdir resumed>) = 0 [pid 5852] <... openat resumed>) = 3 [pid 5855] openat(AT_FDCWD, "/syzcgroup/cpu/syz4/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 5854] openat(AT_FDCWD, "/syzcgroup/cpu/syz3/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 5855] <... openat resumed>) = 3 [pid 5854] <... openat resumed>) = 3 [pid 5853] openat(AT_FDCWD, "/syzcgroup/cpu/syz2/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 5852] write(3, "32", 2 [pid 5853] <... openat resumed>) = 3 [pid 5852] <... write resumed>) = 2 [pid 5852] close(3 [pid 5853] write(3, "1", 1 [pid 5852] <... close resumed>) = 0 [pid 5855] write(3, "1", 1 [pid 5854] write(3, "1", 1 [pid 5851] openat(AT_FDCWD, "/syzcgroup/unified/syz1/pids.max", O_WRONLY|O_CLOEXEC [pid 5855] <... write resumed>) = 1 [pid 5853] <... write resumed>) = 1 [pid 5852] openat(AT_FDCWD, "/syzcgroup/unified/syz0/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 5851] <... openat resumed>) = 3 [pid 5854] <... write resumed>) = 1 [pid 5851] write(3, "32", 2 [pid 5855] close(3 [pid 5854] close(3 [pid 5853] close(3 [pid 5852] <... openat resumed>) = 3 [pid 5851] <... write resumed>) = 2 [pid 5855] <... close resumed>) = 0 [pid 5854] <... close resumed>) = 0 [pid 5851] close(3 [pid 5855] openat(AT_FDCWD, "/syzcgroup/cpu/syz4/memory.soft_limit_in_bytes", O_WRONLY|O_CLOEXEC) = 3 [pid 5854] openat(AT_FDCWD, "/syzcgroup/cpu/syz3/memory.soft_limit_in_bytes", O_WRONLY|O_CLOEXEC [pid 5853] <... close resumed>) = 0 [pid 5852] write(3, "1", 1 [pid 5851] <... close resumed>) = 0 [pid 5855] write(3, "313524224", 9 [pid 5854] <... openat resumed>) = 3 [pid 5853] openat(AT_FDCWD, "/syzcgroup/cpu/syz2/memory.soft_limit_in_bytes", O_WRONLY|O_CLOEXEC [pid 5852] <... write resumed>) = 1 [pid 5851] openat(AT_FDCWD, "/syzcgroup/unified/syz1/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 5854] write(3, "313524224", 9 [pid 5853] <... openat resumed>) = 3 [pid 5852] close(3 [pid 5851] <... openat resumed>) = 3 [pid 5854] <... write resumed>) = 9 [pid 5853] write(3, "313524224", 9 [pid 5852] <... close resumed>) = 0 [pid 5854] close(3 [pid 5853] <... write resumed>) = 9 [pid 5852] mkdir("/syzcgroup/cpu/syz0", 0777 [pid 5854] <... close resumed>) = 0 [pid 5852] <... mkdir resumed>) = 0 [pid 5851] write(3, "1", 1 [pid 5853] close(3) = 0 [pid 5853] openat(AT_FDCWD, "/syzcgroup/cpu/syz2/memory.limit_in_bytes", O_WRONLY|O_CLOEXEC [pid 5855] <... write resumed>) = 9 [pid 5854] openat(AT_FDCWD, "/syzcgroup/cpu/syz3/memory.limit_in_bytes", O_WRONLY|O_CLOEXEC [pid 5853] <... openat resumed>) = 3 [pid 5852] openat(AT_FDCWD, "/syzcgroup/cpu/syz0/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 5851] <... write resumed>) = 1 [pid 5853] write(3, "314572800", 9 [pid 5855] close(3 [pid 5854] <... openat resumed>) = 3 [pid 5853] <... write resumed>) = 9 [pid 5853] close(3) = 0 [pid 5853] mkdir("/syzcgroup/net/syz2", 0777 [pid 5855] <... close resumed>) = 0 [pid 5854] write(3, "314572800", 9 [pid 5852] <... openat resumed>) = 3 [pid 5851] close(3 [pid 5855] openat(AT_FDCWD, "/syzcgroup/cpu/syz4/memory.limit_in_bytes", O_WRONLY|O_CLOEXEC [pid 5851] <... close resumed>) = 0 [pid 5855] <... openat resumed>) = 3 [pid 5854] <... write resumed>) = 9 [pid 5852] write(3, "1", 1 [pid 5855] write(3, "314572800", 9 [pid 5853] <... mkdir resumed>) = 0 [pid 5852] <... write resumed>) = 1 [pid 5851] mkdir("/syzcgroup/cpu/syz1", 0777 [pid 5855] <... write resumed>) = 9 [pid 5854] close(3 [pid 5853] openat(AT_FDCWD, "/syzcgroup/net/syz2/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 5855] close(3 [pid 5854] <... close resumed>) = 0 [pid 5853] <... openat resumed>) = 3 [pid 5852] close(3 [pid 5855] <... close resumed>) = 0 [pid 5854] mkdir("/syzcgroup/net/syz3", 0777 [pid 5855] mkdir("/syzcgroup/net/syz4", 0777 [pid 5853] write(3, "1", 1 [pid 5852] <... close resumed>) = 0 [pid 5852] openat(AT_FDCWD, "/syzcgroup/cpu/syz0/memory.soft_limit_in_bytes", O_WRONLY|O_CLOEXEC [pid 5851] <... mkdir resumed>) = 0 [pid 5854] <... mkdir resumed>) = 0 [pid 5854] openat(AT_FDCWD, "/syzcgroup/net/syz3/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 5852] <... openat resumed>) = 3 [pid 5851] openat(AT_FDCWD, "/syzcgroup/cpu/syz1/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 5852] write(3, "313524224", 9 [pid 5851] <... openat resumed>) = 3 [pid 5852] <... write resumed>) = 9 [pid 5851] write(3, "1", 1 [pid 5855] <... mkdir resumed>) = 0 [pid 5854] <... openat resumed>) = 3 [pid 5853] <... write resumed>) = 1 [pid 5852] close(3 [pid 5854] write(3, "1", 1 [pid 5852] <... close resumed>) = 0 [pid 5851] <... write resumed>) = 1 [pid 5855] openat(AT_FDCWD, "/syzcgroup/net/syz4/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 5854] <... write resumed>) = 1 [pid 5853] close(3 [pid 5852] openat(AT_FDCWD, "/syzcgroup/cpu/syz0/memory.limit_in_bytes", O_WRONLY|O_CLOEXEC [pid 5854] close(3 [pid 5853] <... close resumed>) = 0 [pid 5851] close(3 [pid 5853] mkdir("./0", 0777 [pid 5854] <... close resumed>) = 0 [pid 5852] <... openat resumed>) = 3 [pid 5851] <... close resumed>) = 0 [pid 5854] mkdir("./0", 0777 [pid 5853] <... mkdir resumed>) = 0 [pid 5852] write(3, "314572800", 9 [pid 5851] openat(AT_FDCWD, "/syzcgroup/cpu/syz1/memory.soft_limit_in_bytes", O_WRONLY|O_CLOEXEC [pid 5853] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5854] <... mkdir resumed>) = 0 [pid 5851] <... openat resumed>) = 3 [pid 5852] <... write resumed>) = 9 [pid 5854] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5852] close(3 [pid 5855] <... openat resumed>) = 3 [pid 5852] <... close resumed>) = 0 [pid 5851] write(3, "313524224", 9./strace-static-x86_64: Process 5862 attached ./strace-static-x86_64: Process 5861 attached [pid 5855] write(3, "1", 1 [pid 5853] <... clone resumed>, child_tidptr=0x555591b87650) = 2 [pid 5852] mkdir("/syzcgroup/net/syz0", 0777 [pid 5851] <... write resumed>) = 9 [pid 5862] set_robust_list(0x555591b87660, 24 [pid 5861] set_robust_list(0x555591b87660, 24 [pid 5855] <... write resumed>) = 1 [pid 5854] <... clone resumed>, child_tidptr=0x555591b87650) = 2 [pid 5862] <... set_robust_list resumed>) = 0 [pid 5861] <... set_robust_list resumed>) = 0 [pid 5851] close(3 [pid 5855] close(3 [pid 5862] chdir("./0" [pid 5861] chdir("./0" [pid 5855] <... close resumed>) = 0 [pid 5862] <... chdir resumed>) = 0 [pid 5861] <... chdir resumed>) = 0 [pid 5855] mkdir("./0", 0777 [pid 5851] <... close resumed>) = 0 [pid 5862] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5861] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5855] <... mkdir resumed>) = 0 [pid 5852] <... mkdir resumed>) = 0 [pid 5851] openat(AT_FDCWD, "/syzcgroup/cpu/syz1/memory.limit_in_bytes", O_WRONLY|O_CLOEXEC [pid 5862] <... prctl resumed>) = 0 [pid 5861] <... prctl resumed>) = 0 [pid 5855] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5852] openat(AT_FDCWD, "/syzcgroup/net/syz0/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 5851] <... openat resumed>) = 3 [pid 5862] setpgid(0, 0 [pid 5861] setpgid(0, 0 [pid 5852] <... openat resumed>) = 3 [pid 5851] write(3, "314572800", 9 [pid 5861] <... setpgid resumed>) = 0 [pid 5861] symlink("/syzcgroup/unified/syz2", "./cgroup" [pid 5862] <... setpgid resumed>) = 0 [pid 5851] <... write resumed>) = 9 ./strace-static-x86_64: Process 5863 attached [pid 5862] symlink("/syzcgroup/unified/syz3", "./cgroup" [pid 5861] <... symlink resumed>) = 0 [pid 5852] write(3, "1", 1 [pid 5863] set_robust_list(0x555591b87660, 24 [pid 5862] <... symlink resumed>) = 0 [pid 5861] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu" [pid 5855] <... clone resumed>, child_tidptr=0x555591b87650) = 2 [pid 5852] <... write resumed>) = 1 [pid 5851] close(3 [pid 5863] <... set_robust_list resumed>) = 0 [pid 5863] chdir("./0" [pid 5862] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu" [pid 5861] <... symlink resumed>) = 0 [pid 5852] close(3 [pid 5851] <... close resumed>) = 0 [pid 5862] <... symlink resumed>) = 0 [pid 5861] symlink("/syzcgroup/net/syz2", "./cgroup.net" [pid 5852] <... close resumed>) = 0 [pid 5851] mkdir("/syzcgroup/net/syz1", 0777 [pid 5863] <... chdir resumed>) = 0 [ 94.479369][ T5855] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [pid 5862] symlink("/syzcgroup/net/syz3", "./cgroup.net" [pid 5861] <... symlink resumed>) = 0 [pid 5851] <... mkdir resumed>) = 0 [pid 5863] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5862] <... symlink resumed>) = 0 [pid 5861] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5852] mkdir("./0", 0777 [pid 5863] setpgid(0, 0) = 0 [pid 5861] <... openat resumed>) = 3 [pid 5852] <... mkdir resumed>) = 0 [pid 5862] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5861] write(3, "1000", 4 [pid 5852] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5864 attached [pid 5863] symlink("/syzcgroup/unified/syz4", "./cgroup" [pid 5861] <... write resumed>) = 4 [pid 5861] close(3) = 0 [pid 5863] <... symlink resumed>) = 0 [pid 5862] <... openat resumed>) = 3 [pid 5861] symlink("/dev/binderfs", "./binderfs"executing program ) = 0 [pid 5862] write(3, "1000", 4 [pid 5861] write(1, "executing program\n", 18 [pid 5862] <... write resumed>) = 4 [pid 5861] <... write resumed>) = 18 [pid 5851] openat(AT_FDCWD, "/syzcgroup/net/syz1/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 5864] set_robust_list(0x555591b87660, 24 [pid 5863] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu" [pid 5862] close(3 [pid 5861] getpid( [pid 5851] <... openat resumed>) = 3 [pid 5864] <... set_robust_list resumed>) = 0 [pid 5862] <... close resumed>) = 0 [pid 5861] <... getpid resumed>) = 2 [pid 5852] <... clone resumed>, child_tidptr=0x555591b87650) = 2 [pid 5862] symlink("/dev/binderfs", "./binderfs" [pid 5861] pidfd_open(2, 0 [pid 5851] write(3, "1", 1 [pid 5864] chdir("./0" [pid 5862] <... symlink resumed>) = 0 [pid 5861] <... pidfd_open resumed>) = 3 [pid 5851] <... write resumed>) = 1 executing program [pid 5864] <... chdir resumed>) = 0 [pid 5863] <... symlink resumed>) = 0 [pid 5862] write(1, "executing program\n", 18 [pid 5861] openat(AT_FDCWD, "./binderfs/binder0", O_RDONLY [pid 5864] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5863] symlink("/syzcgroup/net/syz4", "./cgroup.net" [pid 5862] <... write resumed>) = 18 [pid 5851] close(3 [pid 5864] <... prctl resumed>) = 0 [pid 5864] setpgid(0, 0 [pid 5863] <... symlink resumed>) = 0 [pid 5862] getpid( [pid 5861] <... openat resumed>) = 4 [pid 5851] <... close resumed>) = 0 [pid 5863] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5862] <... getpid resumed>) = 2 [pid 5861] ioctl(4, BINDER_VERSION [pid 5851] mkdir("./0", 0777 [pid 5864] <... setpgid resumed>) = 0 [pid 5863] <... openat resumed>) = 3 [pid 5862] pidfd_open(2, 0 [pid 5864] symlink("/syzcgroup/unified/syz0", "./cgroup" [pid 5863] write(3, "1000", 4) = 4 [pid 5864] <... symlink resumed>) = 0 [pid 5863] close(3 [pid 5864] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu" [pid 5863] <... close resumed>) = 0 [pid 5863] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5863] write(1, "executing program\n", 18 [pid 5851] <... mkdir resumed>) = 0 [pid 5862] <... pidfd_open resumed>) = 3 [pid 5864] <... symlink resumed>) = 0 [pid 5851] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDexecuting program [pid 5863] <... write resumed>) = 18 [pid 5862] openat(AT_FDCWD, "./binderfs/binder0", O_RDONLY [pid 5863] getpid() = 2 [pid 5863] pidfd_open(2, 0./strace-static-x86_64: Process 5865 attached [pid 5864] symlink("/syzcgroup/net/syz0", "./cgroup.net" [pid 5863] <... pidfd_open resumed>) = 3 [pid 5862] <... openat resumed>) = 4 [pid 5861] <... ioctl resumed>, 0) = -1 EINVAL (Invalid argument) [pid 5865] set_robust_list(0x555591b87660, 24 [pid 5864] <... symlink resumed>) = 0 [pid 5863] openat(AT_FDCWD, "./binderfs/binder0", O_RDONLY [pid 5862] ioctl(4, BINDER_VERSION [pid 5861] setns(3, CLONE_NEWNS|CLONE_NEWUTS|CLONE_NEWPID [pid 5851] <... clone resumed>, child_tidptr=0x555591b87650) = 2 [pid 5865] <... set_robust_list resumed>) = 0 [pid 5864] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5863] <... openat resumed>) = 4 [pid 5862] <... ioctl resumed>, 0) = -1 EINVAL (Invalid argument) [pid 5865] chdir("./0") = 0 [pid 5864] <... openat resumed>) = 3 [pid 5865] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5864] write(3, "1000", 4 [pid 5865] <... prctl resumed>) = 0 [pid 5864] <... write resumed>) = 4 [pid 5861] <... setns resumed>) = 0 [pid 5865] setpgid(0, 0 [pid 5864] close(3 [pid 5861] umount2(".", MNT_DETACH [pid 5865] <... setpgid resumed>) = 0 [pid 5864] <... close resumed>) = 0 [pid 5865] symlink("/syzcgroup/unified/syz1", "./cgroup" [pid 5864] symlink("/dev/binderfs", "./binderfs"executing program [pid 5865] <... symlink resumed>) = 0 [pid 5864] <... symlink resumed>) = 0 [pid 5863] ioctl(4, BINDER_VERSION [pid 5865] symlink("/syzcgroup/cpu/syz1", "./cgroup.cpu" [pid 5864] write(1, "executing program\n", 18 [pid 5865] <... symlink resumed>) = 0 [pid 5864] <... write resumed>) = 18 [pid 5865] symlink("/syzcgroup/net/syz1", "./cgroup.net" [pid 5864] getpid( [pid 5865] <... symlink resumed>) = 0 [pid 5864] <... getpid resumed>) = 2 [pid 5865] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5864] pidfd_open(2, 0 [pid 5865] <... openat resumed>) = 3 [pid 5864] <... pidfd_open resumed>) = 3 [pid 5864] openat(AT_FDCWD, "./binderfs/binder0", O_RDONLY [pid 5865] write(3, "1000", 4 [pid 5864] <... openat resumed>) = 4 [pid 5865] <... write resumed>) = 4 [pid 5864] ioctl(4, BINDER_VERSION [pid 5865] close(3) = 0 [pid 5863] <... ioctl resumed>, 0) = -1 EINVAL (Invalid argument) [pid 5862] setns(3, CLONE_NEWNS|CLONE_NEWUTS|CLONE_NEWPID [pid 5861] <... umount2 resumed>) = 0 executing program [pid 5863] setns(3, CLONE_NEWNS|CLONE_NEWUTS|CLONE_NEWPID [pid 5861] close(3 [pid 5863] <... setns resumed>) = 0 [pid 5862] <... setns resumed>) = 0 [pid 5863] umount2(".", MNT_DETACH [pid 5862] umount2(".", MNT_DETACH [pid 5865] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5861] <... close resumed>) = 0 [pid 5862] <... umount2 resumed>) = 0 [pid 5865] write(1, "executing program\n", 18) = 18 [pid 5865] getpid() = 2 [pid 5865] pidfd_open(2, 0 [pid 5862] close(3 [pid 5865] <... pidfd_open resumed>) = 3 [pid 5863] <... umount2 resumed>) = 0 [pid 5862] <... close resumed>) = 0 [pid 5862] close(4 [pid 5863] close(3 [pid 5862] <... close resumed>) = 0 [pid 5861] close(4 [pid 5865] openat(AT_FDCWD, "./binderfs/binder0", O_RDONLY) = 4 [ 94.554941][ T5861] binder: 5861:5861 ioctl c0046209 0 returned -22 [ 94.568213][ T5862] binder: 5862:5862 ioctl c0046209 0 returned -22 [ 94.579842][ T5863] binder: 5863:5863 ioctl c0046209 0 returned -22 [ 94.584624][ T5864] binder: 5864:5864 ioctl c0046209 0 returned -22 [pid 5865] ioctl(4, BINDER_VERSION [pid 5864] <... ioctl resumed>, 0) = -1 EINVAL (Invalid argument) [pid 5863] <... close resumed>) = 0 [pid 5862] close(5 [pid 5861] <... close resumed>) = 0 [pid 5864] setns(3, CLONE_NEWNS|CLONE_NEWUTS|CLONE_NEWPID [pid 5863] close(4 [pid 5862] <... close resumed>) = -1 EBADF (Bad file descriptor) [ 94.602948][ T5865] binder: 5865:5865 ioctl c0046209 0 returned -22 [ 94.613006][ T5863] ================================================================== [ 94.621184][ T5863] BUG: KASAN: slab-use-after-free in binder_remove_device+0xa1/0xe0 [ 94.629188][ T5863] Write of size 8 at addr ffff888029560408 by task syz-executor158/5863 [ 94.637637][ T5863] [ 94.639988][ T5863] CPU: 0 UID: 0 PID: 5863 Comm: syz-executor158 Not tainted 6.15.0-rc7-next-20250523-syzkaller #0 PREEMPT(full) [ 94.640007][ T5863] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 94.640022][ T5863] Call Trace: [ 94.640031][ T5863] [ 94.640038][ T5863] dump_stack_lvl+0x189/0x250 [ 94.640055][ T5863] ? __virt_addr_valid+0x1c8/0x5c0 [ 94.640071][ T5863] ? rcu_is_watching+0x15/0xb0 [ 94.640084][ T5863] ? __kasan_check_byte+0x12/0x40 [ 94.640104][ T5863] ? __pfx_dump_stack_lvl+0x10/0x10 [ 94.640117][ T5863] ? rcu_is_watching+0x15/0xb0 [ 94.640130][ T5863] ? lock_release+0x4b/0x3e0 [ 94.640153][ T5863] ? __virt_addr_valid+0x1c8/0x5c0 [ 94.640168][ T5863] ? __virt_addr_valid+0x4a5/0x5c0 [ 94.640184][ T5863] print_report+0xd2/0x2b0 [ 94.640204][ T5863] ? binder_remove_device+0xa1/0xe0 [ 94.640217][ T5863] kasan_report+0x118/0x150 [ 94.640233][ T5863] ? binder_remove_device+0xa1/0xe0 [ 94.640250][ T5863] binder_remove_device+0xa1/0xe0 [ 94.640264][ T5863] binderfs_evict_inode+0x16b/0x240 [ 94.640288][ T5863] ? __pfx_binderfs_evict_inode+0x10/0x10 [ 94.640310][ T5863] evict+0x501/0x9c0 [ 94.640336][ T5863] ? __pfx_evict+0x10/0x10 [ 94.640356][ T5863] ? do_raw_spin_unlock+0x122/0x240 [ 94.640374][ T5863] ? _raw_spin_unlock+0x28/0x50 [ 94.640392][ T5863] ? iput+0x6d8/0x9d0 [ 94.640410][ T5863] __dentry_kill+0x209/0x660 [ 94.640428][ T5863] ? shrink_kill+0x8d/0x2c0 [ 94.640445][ T5863] shrink_kill+0xa9/0x2c0 [ 94.640463][ T5863] shrink_dentry_list+0x2e0/0x5e0 [ 94.640484][ T5863] shrink_dcache_parent+0xa1/0x2c0 [ 94.640504][ T5863] ? __pfx_shrink_dcache_parent+0x10/0x10 [ 94.640534][ T5863] do_one_tree+0x23/0xe0 [ 94.640554][ T5863] shrink_dcache_for_umount+0xa0/0x170 [ 94.640575][ T5863] generic_shutdown_super+0x67/0x2c0 [ 94.640599][ T5863] kill_litter_super+0x76/0xb0 [ 94.640622][ T5863] binderfs_kill_super+0x44/0x90 [ 94.640644][ T5863] deactivate_locked_super+0xb9/0x130 [ 94.640666][ T5863] cleanup_mnt+0x425/0x4c0 [ 94.640686][ T5863] ? lockdep_hardirqs_on+0x9c/0x150 [ 94.640705][ T5863] task_work_run+0x1d4/0x260 [ 94.640724][ T5863] ? __pfx_task_work_run+0x10/0x10 [ 94.640746][ T5863] ptrace_notify+0x281/0x2c0 [ 94.640769][ T5863] ? __pfx_ptrace_notify+0x10/0x10 [ 94.640789][ T5863] ? fput_close_sync+0x119/0x200 [ 94.640809][ T5863] ? __pfx_fput_close_sync+0x10/0x10 [ 94.640832][ T5863] syscall_exit_work+0xc6/0x1d0 [ 94.640854][ T5863] do_syscall_64+0x2ad/0x3b0 [ 94.640877][ T5863] ? lockdep_hardirqs_on+0x9c/0x150 [ 94.640893][ T5863] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.640907][ T5863] ? clear_bhb_loop+0x60/0xb0 [ 94.640924][ T5863] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.640939][ T5863] RIP: 0033:0x7f9ccf02a0c0 [ 94.640957][ T5863] Code: ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 80 3d c1 9f 07 00 00 74 17 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 48 c3 0f 1f 80 00 00 00 00 48 83 ec 18 89 7c [ 94.640970][ T5863] RSP: 002b:00007ffdf1ea3858 EFLAGS: 00000202 ORIG_RAX: 0000000000000003 [ 94.640986][ T5863] RAX: 0000000000000000 RBX: 0000000000000005 RCX: 00007f9ccf02a0c0 [ 94.640995][ T5863] RDX: 00007f9ccf02af99 RSI: 0000000000000002 RDI: 0000000000000004 [ 94.641004][ T5863] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 94.641013][ T5863] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f9ccf074036 [ 94.641022][ T5863] R13: 00007ffdf1ea3890 R14: 00007ffdf1ea38d0 R15: 0000000000000000 [ 94.641038][ T5863] [ 94.641043][ T5863] [ 94.981793][ T5863] Allocated by task 5853: [ 94.986263][ T5863] kasan_save_track+0x3e/0x80 [ 94.991158][ T5863] __kasan_kmalloc+0x93/0xb0 [ 94.995771][ T5863] __kmalloc_cache_noprof+0x230/0x3d0 [ 95.001165][ T5863] binderfs_binder_device_create+0x1eb/0xc40 [ 95.007166][ T5863] binderfs_fill_super+0xa0e/0xe90 [ 95.012380][ T5863] get_tree_nodev+0xbb/0x150 [ 95.016985][ T5863] vfs_get_tree+0x92/0x2b0 [ 95.021409][ T5863] do_new_mount+0x24a/0xa40 [ 95.025916][ T5863] __se_sys_mount+0x317/0x410 [ 95.030609][ T5863] do_syscall_64+0xfa/0x3b0 [ 95.035127][ T5863] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.041025][ T5863] [ 95.043438][ T5863] Freed by task 918: [ 95.047331][ T5863] kasan_save_track+0x3e/0x80 [ 95.052026][ T5863] kasan_save_free_info+0x46/0x50 [ 95.057059][ T5863] __kasan_slab_free+0x62/0x70 [ 95.061825][ T5863] kfree+0x18e/0x440 [ 95.065725][ T5863] binder_proc_dec_tmpref+0x228/0x4f0 [ 95.071104][ T5863] binder_deferred_func+0x13a5/0x1520 [ 95.076486][ T5863] process_scheduled_works+0xade/0x17b0 [ 95.082049][ T5863] worker_thread+0x8a0/0xda0 [ 95.086646][ T5863] kthread+0x711/0x8a0 [ 95.090720][ T5863] ret_from_fork+0x3fc/0x770 [ 95.095406][ T5863] ret_from_fork_asm+0x1a/0x30 [ 95.100179][ T5863] [ 95.102501][ T5863] The buggy address belongs to the object at ffff888029560400 [ 95.102501][ T5863] which belongs to the cache kmalloc-512 of size 512 [ 95.116648][ T5863] The buggy address is located 8 bytes inside of [ 95.116648][ T5863] freed 512-byte region [ffff888029560400, ffff888029560600) [ 95.130793][ T5863] [ 95.133498][ T5863] The buggy address belongs to the physical page: [ 95.140017][ T5863] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x29560 [ 95.148847][ T5863] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 95.157356][ T5863] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 95.164923][ T5863] page_type: f5(slab) [ 95.168929][ T5863] raw: 00fff00000000040 ffff88801a441c80 dead000000000100 dead000000000122 [ 95.177626][ T5863] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 95.186340][ T5863] head: 00fff00000000040 ffff88801a441c80 dead000000000100 dead000000000122 [ 95.195023][ T5863] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 95.203706][ T5863] head: 00fff00000000002 ffffea0000a55801 00000000ffffffff 00000000ffffffff [ 95.212384][ T5863] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 95.221068][ T5863] page dumped because: kasan: bad access detected [ 95.227501][ T5863] page_owner tracks the page as allocated [ 95.233213][ T5863] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5208, tgid 5208 (udevd), ts 39951856979, free_ts 39922872746 [ 95.254337][ T5863] post_alloc_hook+0x240/0x2a0 [ 95.259113][ T5863] get_page_from_freelist+0x21e4/0x22c0 [ 95.264668][ T5863] __alloc_frozen_pages_noprof+0x181/0x370 [ 95.270504][ T5863] alloc_pages_mpol+0x232/0x4a0 [ 95.275392][ T5863] allocate_slab+0x8a/0x3b0 [ 95.280182][ T5863] ___slab_alloc+0xbfc/0x1480 [ 95.284888][ T5863] __kmalloc_cache_noprof+0x296/0x3d0 [ 95.290987][ T5863] kernfs_fop_open+0x397/0xca0 [ 95.296026][ T5863] do_dentry_open+0xdf0/0x1970 [ 95.300891][ T5863] vfs_open+0x3b/0x340 [ 95.304975][ T5863] path_openat+0x2ee5/0x3830 [ 95.309617][ T5863] do_filp_open+0x1fa/0x410 [ 95.314153][ T5863] do_sys_openat2+0x121/0x1c0 [ 95.318859][ T5863] __x64_sys_openat+0x138/0x170 [ 95.323720][ T5863] do_syscall_64+0xfa/0x3b0 [ 95.328233][ T5863] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.334134][ T5863] page last free pid 5207 tgid 5207 stack trace: [ 95.340465][ T5863] __free_frozen_pages+0xc71/0xe70 [ 95.345598][ T5863] __slab_free+0x326/0x400 [ 95.350024][ T5863] qlist_free_all+0x97/0x140 [ 95.354816][ T5863] kasan_quarantine_reduce+0x148/0x160 [ 95.360301][ T5863] __kasan_slab_alloc+0x22/0x80 [ 95.365154][ T5863] __kmalloc_noprof+0x224/0x4f0 [ 95.370066][ T5863] tomoyo_realpath_from_path+0xe3/0x5d0 [ 95.375800][ T5863] tomoyo_path2_perm+0x288/0x680 [ 95.381279][ T5863] tomoyo_path_rename+0x141/0x190 [ 95.386351][ T5863] security_path_rename+0x250/0x490 [ 95.391582][ T5863] do_renameat2+0x64d/0xc50 [ 95.396103][ T5863] __x64_sys_rename+0x82/0x90 [ 95.400789][ T5863] do_syscall_64+0xfa/0x3b0 [ 95.405303][ T5863] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.411222][ T5863] [ 95.413549][ T5863] Memory state around the buggy address: [ 95.419186][ T5863] ffff888029560300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 95.427250][ T5863] ffff888029560380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 95.435315][ T5863] >ffff888029560400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.443380][ T5863] ^ [ 95.447709][ T5863] ffff888029560480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.455774][ T5863] ffff888029560500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.463861][ T5863] ================================================================== [ 95.472553][ T5863] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 95.479781][ T5863] CPU: 0 UID: 0 PID: 5863 Comm: syz-executor158 Not tainted 6.15.0-rc7-next-20250523-syzkaller #0 PREEMPT(full) [ 95.491705][ T5863] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 95.501778][ T5863] Call Trace: [ 95.505071][ T5863] [ 95.508009][ T5863] dump_stack_lvl+0x99/0x250 [ 95.512617][ T5863] ? __asan_memcpy+0x40/0x70 [ 95.517229][ T5863] ? __pfx_dump_stack_lvl+0x10/0x10 [ 95.522437][ T5863] ? __pfx__printk+0x10/0x10 [ 95.527079][ T5863] panic+0x2db/0x790 [ 95.530995][ T5863] ? __pfx_panic+0x10/0x10 [ 95.535491][ T5863] ? _raw_spin_unlock_irqrestore+0xa8/0x110 [ 95.541414][ T5863] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 95.547385][ T5863] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 95.553738][ T5863] ? print_memory_metadata+0x314/0x400 [ 95.559224][ T5863] ? binder_remove_device+0xa1/0xe0 [ 95.564607][ T5863] check_panic_on_warn+0x89/0xb0 [ 95.569562][ T5863] ? binder_remove_device+0xa1/0xe0 [ 95.574767][ T5863] end_report+0x78/0x160 [ 95.579018][ T5863] kasan_report+0x129/0x150 [ 95.583531][ T5863] ? binder_remove_device+0xa1/0xe0 [ 95.588739][ T5863] binder_remove_device+0xa1/0xe0 [ 95.593769][ T5863] binderfs_evict_inode+0x16b/0x240 [ 95.598986][ T5863] ? __pfx_binderfs_evict_inode+0x10/0x10 [ 95.604720][ T5863] evict+0x501/0x9c0 [ 95.608636][ T5863] ? __pfx_evict+0x10/0x10 [ 95.613070][ T5863] ? do_raw_spin_unlock+0x122/0x240 [ 95.618475][ T5863] ? _raw_spin_unlock+0x28/0x50 [ 95.623329][ T5863] ? iput+0x6d8/0x9d0 [ 95.627326][ T5863] __dentry_kill+0x209/0x660 [ 95.632031][ T5863] ? shrink_kill+0x8d/0x2c0 [ 95.636577][ T5863] shrink_kill+0xa9/0x2c0 [ 95.640934][ T5863] shrink_dentry_list+0x2e0/0x5e0 [ 95.646073][ T5863] shrink_dcache_parent+0xa1/0x2c0 [ 95.651210][ T5863] ? __pfx_shrink_dcache_parent+0x10/0x10 [ 95.657387][ T5863] do_one_tree+0x23/0xe0 [ 95.661671][ T5863] shrink_dcache_for_umount+0xa0/0x170 [ 95.667243][ T5863] generic_shutdown_super+0x67/0x2c0 [ 95.672636][ T5863] kill_litter_super+0x76/0xb0 [ 95.677437][ T5863] binderfs_kill_super+0x44/0x90 [ 95.682404][ T5863] deactivate_locked_super+0xb9/0x130 [ 95.687890][ T5863] cleanup_mnt+0x425/0x4c0 [ 95.692351][ T5863] ? lockdep_hardirqs_on+0x9c/0x150 [ 95.697624][ T5863] task_work_run+0x1d4/0x260 [ 95.702416][ T5863] ? __pfx_task_work_run+0x10/0x10 [ 95.707728][ T5863] ptrace_notify+0x281/0x2c0 [ 95.712349][ T5863] ? __pfx_ptrace_notify+0x10/0x10 [ 95.717476][ T5863] ? fput_close_sync+0x119/0x200 [ 95.722434][ T5863] ? __pfx_fput_close_sync+0x10/0x10 [ 95.727739][ T5863] syscall_exit_work+0xc6/0x1d0 [ 95.732629][ T5863] do_syscall_64+0x2ad/0x3b0 [ 95.737243][ T5863] ? lockdep_hardirqs_on+0x9c/0x150 [ 95.742467][ T5863] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.748642][ T5863] ? clear_bhb_loop+0x60/0xb0 [ 95.753454][ T5863] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.759481][ T5863] RIP: 0033:0x7f9ccf02a0c0 [ 95.763917][ T5863] Code: ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 80 3d c1 9f 07 00 00 74 17 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 48 c3 0f 1f 80 00 00 00 00 48 83 ec 18 89 7c [ 95.783536][ T5863] RSP: 002b:00007ffdf1ea3858 EFLAGS: 00000202 ORIG_RAX: 0000000000000003 [ 95.791994][ T5863] RAX: 0000000000000000 RBX: 0000000000000005 RCX: 00007f9ccf02a0c0 [ 95.799984][ T5863] RDX: 00007f9ccf02af99 RSI: 0000000000000002 RDI: 0000000000000004 [ 95.807971][ T5863] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 95.815949][ T5863] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f9ccf074036 [ 95.823951][ T5863] R13: 00007ffdf1ea3890 R14: 00007ffdf1ea38d0 R15: 0000000000000000 [ 95.831974][ T5863] [ 95.835256][ T5863] Kernel Offset: disabled [ 95.839596][ T5863] Rebooting in 86400 seconds..