./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1342389273 <...> syzkaller syzkaller login: [ 44.069651][ T26] kauditd_printk_skb: 42 callbacks suppressed [ 44.069667][ T26] audit: type=1400 audit(1686651386.496:77): avc: denied { transition } for pid=4839 comm="sshd" path="/bin/sh" dev="sda1" ino=89 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 44.098426][ T26] audit: type=1400 audit(1686651386.496:78): avc: denied { noatsecure } for pid=4839 comm="sshd" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 44.117889][ T26] audit: type=1400 audit(1686651386.506:79): avc: denied { write } for pid=4839 comm="sh" path="pipe:[1732]" dev="pipefs" ino=1732 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 44.140959][ T26] audit: type=1400 audit(1686651386.506:80): avc: denied { rlimitinh } for pid=4839 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 44.160087][ T26] audit: type=1400 audit(1686651386.506:81): avc: denied { siginh } for pid=4839 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 44.877926][ T26] audit: type=1400 audit(1686651387.306:82): avc: denied { read } for pid=4427 comm="syslogd" name="log" dev="sda1" ino=1915 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 Warning: Permanently added '10.128.1.126' (ECDSA) to the list of known hosts. execve("./syz-executor1342389273", ["./syz-executor1342389273"], 0x7ffdfa64ecb0 /* 10 vars */) = 0 brk(NULL) = 0x555555af3000 brk(0x555555af3c40) = 0x555555af3c40 arch_prctl(ARCH_SET_FS, 0x555555af3300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor1342389273", 4096) = 28 brk(0x555555b14c40) = 0x555555b14c40 brk(0x555555b15000) = 0x555555b15000 mprotect(0x7f1979636000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555af35d0) = 4990 ./strace-static-x86_64: Process 4990 attached [pid 4989] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555af35d0) = 4991 [pid 4989] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 4990] getpid() = 4990 ./strace-static-x86_64: Process 4991 attached [pid 4989] <... clone resumed>, child_tidptr=0x555555af35d0) = 4992 [pid 4990] mkdir("./syzkaller.4TwD7v", 0700 [pid 4989] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555af35d0) = 4993 [pid 4989] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555af35d0) = 4994 [pid 4989] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 4990] <... mkdir resumed>) = 0 [pid 4990] chmod("./syzkaller.4TwD7v", 0777 [pid 4989] <... clone resumed>, child_tidptr=0x555555af35d0) = 4995 ./strace-static-x86_64: Process 4993 attached [pid 4990] <... chmod resumed>) = 0 [pid 4993] getpid() = 4993 [pid 4993] mkdir("./syzkaller.XzH7LM", 0700./strace-static-x86_64: Process 4992 attached [pid 4990] chdir("./syzkaller.4TwD7v") = 0 [pid 4992] getpid(./strace-static-x86_64: Process 4995 attached [pid 4990] mkdir("./0", 0777 [pid 4995] getpid( [pid 4993] <... mkdir resumed>) = 0 [pid 4992] <... getpid resumed>) = 4992 [pid 4992] mkdir("./syzkaller.4aUDKD", 0700 [pid 4990] <... mkdir resumed>) = 0 [pid 4990] openat(AT_FDCWD, "/dev/loop0", O_RDWR [ 72.007384][ T26] audit: type=1400 audit(1686651414.436:83): avc: denied { write } for pid=4986 comm="strace-static-x" path="pipe:[1926]" dev="pipefs" ino=1926 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 72.032960][ T26] audit: type=1400 audit(1686651414.456:84): avc: denied { execmem } for pid=4989 comm="syz-executor134" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [pid 4993] chmod("./syzkaller.XzH7LM", 0777) = 0 [pid 4992] <... mkdir resumed>) = 0 [pid 4995] <... getpid resumed>) = 4995 [pid 4995] mkdir("./syzkaller.hSnKiT", 0700) = 0 [pid 4993] chdir("./syzkaller.XzH7LM") = 0 [pid 4993] mkdir("./0", 0777) = 0 [pid 4992] chmod("./syzkaller.4aUDKD", 0777) = 0 [pid 4992] chdir("./syzkaller.4aUDKD") = 0 [pid 4995] chmod("./syzkaller.hSnKiT", 0777) = 0 [pid 4992] mkdir("./0", 0777) = 0 [pid 4993] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 4995] chdir("./syzkaller.hSnKiT") = 0 [pid 4995] mkdir("./0", 0777) = 0 [pid 4992] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 3 [pid 4993] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 4995] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 3 [pid 4992] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 4993] close(3) = 0 [pid 4992] close(3) = 0 [pid 4995] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 4992] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 4995] close(3) = 0 [pid 4995] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 4993] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 4992] <... clone resumed>, child_tidptr=0x555555af35d0) = 4996 [pid 4995] <... clone resumed>, child_tidptr=0x555555af35d0) = 4997 [pid 4993] <... clone resumed>, child_tidptr=0x555555af35d0) = 4998 ./strace-static-x86_64: Process 4996 attached ./strace-static-x86_64: Process 4998 attached [pid 4996] chdir("./0") = 0 [pid 4998] chdir("./0") = 0 [pid 4996] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 4996] setpgid(0, 0 [pid 4998] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 4996] <... setpgid resumed>) = 0 [pid 4998] <... prctl resumed>) = 0 [pid 4998] setpgid(0, 0) = 0 [pid 4996] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 4998] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 4996] <... openat resumed>) = 3 [pid 4998] <... openat resumed>) = 3 [pid 4998] write(3, "1000", 4 [pid 4996] write(3, "1000", 4 [pid 4998] <... write resumed>) = 4 [pid 4996] <... write resumed>) = 4 [pid 4998] close(3 [pid 4996] close(3 [pid 4998] <... close resumed>) = 0 [pid 4996] <... close resumed>) = 0 [pid 4998] symlink("/dev/binderfs", "./binderfs" [pid 4996] symlink("/dev/binderfs", "./binderfs" [pid 4998] <... symlink resumed>) = 0 [pid 4996] <... symlink resumed>) = 0 [pid 4991] getpid( [pid 4990] <... openat resumed>) = 3 ./strace-static-x86_64: Process 4997 attached ./strace-static-x86_64: Process 4994 attached [pid 4998] memfd_create("syzkaller", 0 [pid 4996] memfd_create("syzkaller", 0 [pid 4998] <... memfd_create resumed>) = 3 [pid 4997] chdir("./0" [pid 4991] <... getpid resumed>) = 4991 [pid 4990] ioctl(3, LOOP_CLR_FD [pid 4998] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 4994] getpid( [pid 4998] <... mmap resumed>) = 0x7f197117a000 [pid 4998] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 [pid 4997] <... chdir resumed>) = 0 [pid 4994] <... getpid resumed>) = 4994 [pid 4991] mkdir("./syzkaller.4kokDz", 0700 [pid 4990] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 4997] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 4994] mkdir("./syzkaller.wrwszP", 0700 [pid 4991] <... mkdir resumed>) = 0 [pid 4990] close(3 [pid 4997] <... prctl resumed>) = 0 [pid 4994] <... mkdir resumed>) = 0 [pid 4997] setpgid(0, 0 [pid 4990] <... close resumed>) = 0 [pid 4997] <... setpgid resumed>) = 0 [pid 4990] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 4994] chmod("./syzkaller.wrwszP", 0777 [pid 4997] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 4997] write(3, "1000", 4 [pid 4994] <... chmod resumed>) = 0 [pid 4991] chmod("./syzkaller.4kokDz", 0777 [pid 4990] <... clone resumed>, child_tidptr=0x555555af35d0) = 4999 [pid 4997] <... write resumed>) = 4 [pid 4997] close(3 [pid 4994] chdir("./syzkaller.wrwszP" [pid 4991] <... chmod resumed>) = 0 [pid 4997] <... close resumed>) = 0 [pid 4997] symlink("/dev/binderfs", "./binderfs" [pid 4994] <... chdir resumed>) = 0 [pid 4991] chdir("./syzkaller.4kokDz"./strace-static-x86_64: Process 4999 attached [pid 4997] <... symlink resumed>) = 0 [pid 4999] chdir("./0" [pid 4994] mkdir("./0", 0777 [pid 4997] memfd_create("syzkaller", 0 [pid 4991] <... chdir resumed>) = 0 [pid 4999] <... chdir resumed>) = 0 [pid 4999] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 4998] <... write resumed>) = 524288 [pid 4997] <... memfd_create resumed>) = 3 [pid 4994] <... mkdir resumed>) = 0 [pid 4991] mkdir("./0", 0777 [pid 4999] setpgid(0, 0 [pid 4997] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 4999] <... setpgid resumed>) = 0 [pid 4999] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 4998] munmap(0x7f197117a000, 524288 [pid 4991] <... mkdir resumed>) = 0 [pid 4999] <... openat resumed>) = 3 [pid 4998] <... munmap resumed>) = 0 [pid 4997] <... mmap resumed>) = 0x7f197117a000 [pid 4996] <... memfd_create resumed>) = 3 [pid 4994] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 4991] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 4999] write(3, "1000", 4 [pid 4998] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 4996] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 4999] <... write resumed>) = 4 [pid 4998] <... openat resumed>) = 4 [pid 4996] <... mmap resumed>) = 0x7f197117a000 [pid 4999] close(3 [ 72.067534][ T26] audit: type=1400 audit(1686651414.496:85): avc: denied { read write } for pid=4990 comm="syz-executor134" name="loop0" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 72.106202][ T4996] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=4996 'syz-executor134' [pid 4998] ioctl(4, LOOP_SET_FD, 3 [pid 4994] <... openat resumed>) = 3 [pid 4999] <... close resumed>) = 0 [pid 4997] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 [pid 4996] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 [pid 4991] <... openat resumed>) = 3 [pid 4999] symlink("/dev/binderfs", "./binderfs") = 0 [pid 4999] memfd_create("syzkaller", 0) = 3 [pid 4999] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f197117a000 [pid 4999] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 [pid 4996] <... write resumed>) = 524288 [pid 4996] munmap(0x7f197117a000, 524288 [pid 4999] <... write resumed>) = 524288 [pid 4999] munmap(0x7f197117a000, 524288 [pid 4994] ioctl(3, LOOP_CLR_FD [pid 4991] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 4999] <... munmap resumed>) = 0 [pid 4994] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 4991] close(3 [pid 4996] <... munmap resumed>) = 0 [pid 4994] close(3 [pid 4998] <... ioctl resumed>) = 0 [pid 4994] <... close resumed>) = 0 [pid 4991] <... close resumed>) = 0 [pid 4999] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 4998] close(3 [pid 4996] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 4994] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 4999] <... openat resumed>) = 4 [pid 4998] <... close resumed>) = 0 [pid 4996] <... openat resumed>) = 4 [pid 4991] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 4999] ioctl(4, LOOP_SET_FD, 3 [pid 4998] mkdir("./file0", 0777 [ 72.147673][ T4998] loop3: detected capacity change from 0 to 1024 [ 72.152716][ T26] audit: type=1400 audit(1686651414.496:86): avc: denied { open } for pid=4993 comm="syz-executor134" path="/dev/loop3" dev="devtmpfs" ino=651 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 72.185478][ T4996] loop2: detected capacity change from 0 to 1024 [pid 4996] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 5000 attached [pid 4998] <... mkdir resumed>) = 0 [pid 4997] <... write resumed>) = 524288 [pid 4996] <... ioctl resumed>) = 0 [pid 5000] chdir("./0" [pid 4997] munmap(0x7f197117a000, 524288 [pid 4994] <... clone resumed>, child_tidptr=0x555555af35d0) = 5000 [pid 4991] <... clone resumed>, child_tidptr=0x555555af35d0) = 5001 [pid 5000] <... chdir resumed>) = 0 [pid 4997] <... munmap resumed>) = 0 [pid 4998] mount("/dev/loop3", "./file0", "hfsplus", 0, ""./strace-static-x86_64: Process 5001 attached [ 72.188780][ T26] audit: type=1400 audit(1686651414.496:87): avc: denied { ioctl } for pid=4993 comm="syz-executor134" path="/dev/loop3" dev="devtmpfs" ino=651 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 72.193213][ T4999] loop0: detected capacity change from 0 to 1024 [pid 5000] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 4997] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 5001] chdir("./0" [pid 5000] <... prctl resumed>) = 0 [pid 4998] <... mount resumed>) = 0 [pid 4997] <... openat resumed>) = 4 [pid 4996] close(3 [pid 5001] <... chdir resumed>) = 0 [pid 5000] setpgid(0, 0 [pid 4998] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY [pid 4997] ioctl(4, LOOP_SET_FD, 3 [pid 4996] <... close resumed>) = 0 [pid 5001] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5000] <... setpgid resumed>) = 0 [pid 4999] <... ioctl resumed>) = 0 [pid 4998] <... openat resumed>) = 3 [pid 4996] mkdir("./file0", 0777 [pid 5001] <... prctl resumed>) = 0 [pid 5000] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 4999] close(3 [pid 4998] ioctl(4, LOOP_CLR_FD [pid 5001] setpgid(0, 0 [pid 5000] <... openat resumed>) = 3 [pid 4999] <... close resumed>) = 0 [pid 4998] <... ioctl resumed>) = 0 [pid 4997] <... ioctl resumed>) = 0 [pid 4996] <... mkdir resumed>) = 0 [pid 5001] <... setpgid resumed>) = 0 [pid 5000] write(3, "1000", 4 [pid 4999] mkdir("./file0", 0777 [pid 4998] close(4 [pid 4997] close(3 [pid 4996] mount("/dev/loop2", "./file0", "hfsplus", 0, "" [pid 5001] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5000] <... write resumed>) = 4 [pid 4999] <... mkdir resumed>) = 0 [pid 4997] <... close resumed>) = 0 [pid 4998] <... close resumed>) = 0 [pid 5000] close(3 [pid 4997] mkdir("./file0", 0777 [pid 5001] <... openat resumed>) = 3 [pid 5000] <... close resumed>) = 0 [pid 4999] mount("/dev/loop0", "./file0", "hfsplus", 0, "" [pid 4998] openat(AT_FDCWD, "/dev/loop5", O_RDONLY [pid 4997] <... mkdir resumed>) = 0 [pid 5001] write(3, "1000", 4 [pid 5000] symlink("/dev/binderfs", "./binderfs" [pid 4997] mount("/dev/loop5", "./file0", "hfsplus", 0, "" [pid 5001] <... write resumed>) = 4 [pid 5000] <... symlink resumed>) = 0 [pid 4998] <... openat resumed>) = 4 [pid 5001] close(3 [pid 5000] memfd_create("syzkaller", 0 [pid 4998] ioctl(4, LOOP_SET_BLOCK_SIZE, 2048 [pid 5001] <... close resumed>) = 0 [pid 5000] <... memfd_create resumed>) = 3 [pid 4999] <... mount resumed>) = 0 [pid 4996] <... mount resumed>) = 0 [pid 5001] symlink("/dev/binderfs", "./binderfs" [pid 5000] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 4999] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY [pid 4996] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY [pid 5001] <... symlink resumed>) = 0 [pid 5000] <... mmap resumed>) = 0x7f197117a000 [pid 4999] <... openat resumed>) = 3 [pid 4996] <... openat resumed>) = 3 [pid 5001] memfd_create("syzkaller", 0 [pid 5000] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 [pid 4999] ioctl(4, LOOP_CLR_FD [pid 4996] ioctl(4, LOOP_CLR_FD [pid 5001] <... memfd_create resumed>) = 3 [pid 5000] <... write resumed>) = 524288 [pid 4999] <... ioctl resumed>) = 0 [ 72.227240][ T26] audit: type=1400 audit(1686651414.656:88): avc: denied { mounton } for pid=4998 comm="syz-executor134" path="/root/syzkaller.XzH7LM/0/file0" dev="sda1" ino=1943 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 72.260727][ T4997] loop5: detected capacity change from 0 to 1024 [pid 4996] <... ioctl resumed>) = 0 [pid 5001] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f197117a000 [pid 4999] close(4 [pid 4996] close(4 [pid 5000] munmap(0x7f197117a000, 524288 [pid 4999] <... close resumed>) = 0 [pid 4996] <... close resumed>) = 0 [pid 5000] <... munmap resumed>) = 0 [pid 5000] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 5000] ioctl(4, LOOP_SET_FD, 3 [pid 5001] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 [pid 4999] openat(AT_FDCWD, "/dev/loop5", O_RDONLY [pid 4996] openat(AT_FDCWD, "/dev/loop5", O_RDONLY [pid 5000] <... ioctl resumed>) = 0 [pid 5000] close(3) = 0 [pid 5000] mkdir("./file0", 0777 [pid 5001] <... write resumed>) = 524288 [pid 4999] <... openat resumed>) = 4 [pid 4996] <... openat resumed>) = 4 [pid 4999] ioctl(4, LOOP_SET_BLOCK_SIZE, 2048 [pid 4996] ioctl(4, LOOP_SET_BLOCK_SIZE, 2048 [pid 5001] munmap(0x7f197117a000, 524288) = 0 [pid 5001] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4 [pid 5001] ioctl(4, LOOP_SET_FD, 3 [pid 5000] <... mkdir resumed>) = 0 [pid 4999] <... ioctl resumed>) = 0 [pid 4998] <... ioctl resumed>) = 0 [pid 4997] <... mount resumed>) = 0 [pid 4996] <... ioctl resumed>) = 0 [pid 4997] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY [pid 4999] exit_group(0 [pid 4997] <... openat resumed>) = 3 [pid 4996] exit_group(0 [pid 4999] <... exit_group resumed>) = ? [pid 4998] exit_group(0 [pid 4997] ioctl(4, LOOP_CLR_FD [pid 4996] <... exit_group resumed>) = ? [pid 5000] mount("/dev/loop4", "./file0", "hfsplus", 0, "" [pid 4997] <... ioctl resumed>) = 0 [pid 4999] +++ exited with 0 +++ [pid 4997] close(4 [pid 4998] <... exit_group resumed>) = ? [pid 4997] <... close resumed>) = 0 [pid 4996] +++ exited with 0 +++ [pid 4990] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4999, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 4997] openat(AT_FDCWD, "/dev/loop5", O_RDONLY [pid 4990] restart_syscall(<... resuming interrupted clone ...> [pid 4997] <... openat resumed>) = 4 [pid 4990] <... restart_syscall resumed>) = 0 [pid 4997] ioctl(4, LOOP_SET_BLOCK_SIZE, 2048) = 0 [pid 4997] exit_group(0 [pid 4990] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4997] <... exit_group resumed>) = ? [pid 4990] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 4997] +++ exited with 0 +++ [pid 4990] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 4990] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 4990] getdents64(3, 0x555555af4620 /* 4 entries */, 32768) = 112 [ 72.314776][ T5000] loop4: detected capacity change from 0 to 1024 [ 72.350837][ T5001] loop1: detected capacity change from 0 to 1024 [pid 4995] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4997, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 4992] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4996, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- [pid 4990] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5001] <... ioctl resumed>) = 0 [pid 4998] +++ exited with 0 +++ [pid 5001] close(3 [pid 4990] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5001] <... close resumed>) = 0 [pid 4990] lstat("./0/binderfs", [pid 4993] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4998, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5001] mkdir("./file0", 0777 [pid 5000] <... mount resumed>) = 0 [pid 4995] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4990] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5000] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY [pid 4990] unlink("./0/binderfs" [pid 5000] <... openat resumed>) = 3 [pid 4993] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4990] <... unlink resumed>) = 0 [pid 5000] ioctl(4, LOOP_CLR_FD [pid 4990] umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5001] <... mkdir resumed>) = 0 [pid 5000] <... ioctl resumed>) = 0 [pid 4995] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 4993] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 4992] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5001] mount("/dev/loop1", "./file0", "hfsplus", 0, "" [pid 5000] close(4 [pid 4995] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 4993] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 4990] <... umount2 resumed>) = 0 [pid 5000] <... close resumed>) = 0 [pid 5000] openat(AT_FDCWD, "/dev/loop5", O_RDONLY) = 4 [pid 5000] ioctl(4, LOOP_SET_BLOCK_SIZE, 2048 [pid 4992] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5000] <... ioctl resumed>) = 0 [pid 4995] <... openat resumed>) = 3 [pid 5000] exit_group(0 [pid 4995] fstat(3, [pid 4993] <... openat resumed>) = 3 [pid 4992] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5000] <... exit_group resumed>) = ? [pid 4995] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5001] <... mount resumed>) = 0 [pid 5000] +++ exited with 0 +++ [pid 4995] getdents64(3, [pid 4993] fstat(3, [pid 4992] <... openat resumed>) = 3 [pid 4994] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5000, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 4992] fstat(3, [pid 4994] restart_syscall(<... resuming interrupted clone ...> [pid 4993] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 4995] <... getdents64 resumed>0x555555af4620 /* 4 entries */, 32768) = 112 [pid 4994] <... restart_syscall resumed>) = 0 [pid 4992] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5001] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY [pid 4995] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4993] getdents64(3, [pid 4992] getdents64(3, [pid 4990] umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5001] <... openat resumed>) = 3 [pid 4995] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 4993] <... getdents64 resumed>0x555555af4620 /* 4 entries */, 32768) = 112 [pid 4992] <... getdents64 resumed>0x555555af4620 /* 4 entries */, 32768) = 112 [pid 5001] ioctl(4, LOOP_CLR_FD [pid 4995] lstat("./0/binderfs", [pid 4994] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4990] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5001] <... ioctl resumed>) = 0 [pid 4995] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 4994] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [ 72.358005][ T26] audit: type=1400 audit(1686651414.656:89): avc: denied { mount } for pid=4998 comm="syz-executor134" name="/" dev="loop3" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dosfs_t tclass=filesystem permissive=1 [pid 4993] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4992] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5001] close(4 [pid 4995] unlink("./0/binderfs" [pid 4994] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 4993] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 4990] lstat("./0/file0", [pid 4994] <... openat resumed>) = 3 [pid 4990] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 4994] fstat(3, [pid 4990] umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4994] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 4990] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 4994] getdents64(3, [pid 4990] openat(AT_FDCWD, "./0/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 4994] <... getdents64 resumed>0x555555af4620 /* 4 entries */, 32768) = 112 [pid 4990] <... openat resumed>) = 4 [pid 4994] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4990] fstat(4, [pid 5001] <... close resumed>) = 0 [pid 4994] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 4992] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 4990] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5001] openat(AT_FDCWD, "/dev/loop5", O_RDONLY [pid 4995] <... unlink resumed>) = 0 [pid 4994] lstat("./0/binderfs", [pid 4993] lstat("./0/binderfs", [pid 4992] lstat("./0/binderfs", [pid 4990] getdents64(4, [pid 5001] <... openat resumed>) = 4 [pid 4995] umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4994] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 4990] <... getdents64 resumed>0x555555afc660 /* 2 entries */, 32768) = 48 [pid 4994] unlink("./0/binderfs" [pid 4990] getdents64(4, [pid 5001] ioctl(4, LOOP_SET_BLOCK_SIZE, 2048 [pid 4994] <... unlink resumed>) = 0 [pid 4993] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 4992] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 4990] <... getdents64 resumed>0x555555afc660 /* 0 entries */, 32768) = 0 [pid 5001] <... ioctl resumed>) = 0 [pid 4994] umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4993] unlink("./0/binderfs" [pid 4992] unlink("./0/binderfs" [pid 4990] close(4 [pid 5001] exit_group(0 [pid 4990] <... close resumed>) = 0 [pid 4993] <... unlink resumed>) = 0 [pid 4990] rmdir("./0/file0" [pid 5001] <... exit_group resumed>) = ? [pid 4993] umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4992] <... unlink resumed>) = 0 [pid 4990] <... rmdir resumed>) = 0 [pid 4990] getdents64(3, 0x555555af4620 /* 0 entries */, 32768) = 0 [pid 4990] close(3) = 0 [pid 4990] rmdir("./0" [pid 5001] +++ exited with 0 +++ [pid 4992] umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4990] <... rmdir resumed>) = 0 [pid 4991] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5001, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 4990] mkdir("./1", 0777) = 0 [pid 4990] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 4991] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4990] <... openat resumed>) = 3 [pid 4991] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 4991] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 4990] ioctl(3, LOOP_CLR_FD [pid 4991] <... openat resumed>) = 3 [pid 4991] fstat(3, [pid 4990] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 4991] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 4991] getdents64(3, [pid 4990] close(3 [pid 4991] <... getdents64 resumed>0x555555af4620 /* 4 entries */, 32768) = 112 [pid 4991] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4990] <... close resumed>) = 0 [pid 4991] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 4991] lstat("./0/binderfs", [pid 4990] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 4991] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 4991] unlink("./0/binderfs") = 0 [pid 4991] umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4990] <... clone resumed>, child_tidptr=0x555555af35d0) = 5004 [pid 4994] <... umount2 resumed>) = 0 [pid 4991] <... umount2 resumed>) = 0 [pid 4994] umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4992] <... umount2 resumed>) = 0 [pid 4991] umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4994] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 4991] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 4994] lstat("./0/file0", [pid 4991] lstat("./0/file0", [pid 4994] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 4991] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 4994] umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4991] umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4994] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 4991] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 4994] openat(AT_FDCWD, "./0/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 4991] openat(AT_FDCWD, "./0/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 4994] <... openat resumed>) = 4 [pid 4991] <... openat resumed>) = 4 [pid 4994] fstat(4, [pid 4993] <... umount2 resumed>) = 0 [pid 4991] fstat(4, [pid 4994] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 4991] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 4994] getdents64(4, [pid 4991] getdents64(4, [pid 4994] <... getdents64 resumed>0x555555afc660 /* 2 entries */, 32768) = 48 [pid 4991] <... getdents64 resumed>0x555555afc660 /* 2 entries */, 32768) = 48 [pid 4994] getdents64(4, [pid 4991] getdents64(4, [pid 4994] <... getdents64 resumed>0x555555afc660 /* 0 entries */, 32768) = 0 [pid 4991] <... getdents64 resumed>0x555555afc660 /* 0 entries */, 32768) = 0 [pid 4994] close(4 [pid 4991] close(4 [pid 4994] <... close resumed>) = 0 [pid 4991] <... close resumed>) = 0 [pid 4994] rmdir("./0/file0" [pid 4991] rmdir("./0/file0" [pid 4995] <... umount2 resumed>) = 0 [pid 4994] <... rmdir resumed>) = 0 [pid 4991] <... rmdir resumed>) = 0 [pid 4994] getdents64(3, [pid 4991] getdents64(3, [pid 4995] umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4994] <... getdents64 resumed>0x555555af4620 /* 0 entries */, 32768) = 0 [pid 4993] umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4992] umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4991] <... getdents64 resumed>0x555555af4620 /* 0 entries */, 32768) = 0 [pid 4994] close(3 [pid 4991] close(3./strace-static-x86_64: Process 5004 attached [pid 4995] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 4994] <... close resumed>) = 0 [pid 4993] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 4992] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 4991] <... close resumed>) = 0 [pid 4995] lstat("./0/file0", [pid 4994] rmdir("./0" [pid 4991] rmdir("./0" [pid 5004] chdir("./1" [pid 4995] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 4994] <... rmdir resumed>) = 0 [pid 4993] lstat("./0/file0", [pid 4992] lstat("./0/file0", [pid 4991] <... rmdir resumed>) = 0 [pid 4995] umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4994] mkdir("./1", 0777 [pid 4993] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 4991] mkdir("./1", 0777 [pid 4992] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5004] <... chdir resumed>) = 0 [pid 4995] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 4994] <... mkdir resumed>) = 0 [pid 4993] umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4992] umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4991] <... mkdir resumed>) = 0 [pid 5004] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 4995] openat(AT_FDCWD, "./0/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 4994] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 4991] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 5004] <... prctl resumed>) = 0 [pid 4995] <... openat resumed>) = 4 [pid 4994] <... openat resumed>) = 3 [pid 4993] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 4992] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5004] setpgid(0, 0 [pid 4995] fstat(4, [pid 4994] ioctl(3, LOOP_CLR_FD [pid 4993] openat(AT_FDCWD, "./0/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 4992] openat(AT_FDCWD, "./0/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5004] <... setpgid resumed>) = 0 [pid 4994] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 4994] close(3 [pid 5004] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 4994] <... close resumed>) = 0 [pid 4995] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 4994] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5004] <... openat resumed>) = 3 [pid 4995] getdents64(4, [pid 4993] <... openat resumed>) = 4 [pid 4992] <... openat resumed>) = 4 [pid 4995] <... getdents64 resumed>0x555555afc660 /* 2 entries */, 32768) = 48 [pid 4994] <... clone resumed>, child_tidptr=0x555555af35d0) = 5005 [pid 4993] fstat(4, [pid 5004] write(3, "1000", 4 [pid 4992] fstat(4, [pid 5004] <... write resumed>) = 4 [pid 4995] getdents64(4, [pid 4993] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 4992] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5004] close(3 [pid 4995] <... getdents64 resumed>0x555555afc660 /* 0 entries */, 32768) = 0 [pid 4993] getdents64(4, [pid 4992] getdents64(4, [pid 5004] <... close resumed>) = 0 [pid 4995] close(4 [pid 4993] <... getdents64 resumed>0x555555afc660 /* 2 entries */, 32768) = 48 [pid 4992] <... getdents64 resumed>0x555555afc660 /* 2 entries */, 32768) = 48 [pid 5004] symlink("/dev/binderfs", "./binderfs" [pid 4995] <... close resumed>) = 0 [pid 4993] getdents64(4, [pid 4992] getdents64(4, ./strace-static-x86_64: Process 5005 attached [pid 4993] <... getdents64 resumed>0x555555afc660 /* 0 entries */, 32768) = 0 [pid 4992] <... getdents64 resumed>0x555555afc660 /* 0 entries */, 32768) = 0 [pid 4995] rmdir("./0/file0" [pid 5005] chdir("./1") = 0 [pid 5005] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5005] setpgid(0, 0) = 0 [pid 5005] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5004] <... symlink resumed>) = 0 [pid 4993] close(4 [pid 4992] close(4 [pid 5005] write(3, "1000", 4) = 4 [pid 4995] <... rmdir resumed>) = 0 [pid 4993] <... close resumed>) = 0 [pid 4992] <... close resumed>) = 0 [pid 5005] close(3 [pid 4995] getdents64(3, [pid 4993] rmdir("./0/file0" [pid 4992] rmdir("./0/file0" [pid 5004] memfd_create("syzkaller", 0 [pid 4995] <... getdents64 resumed>0x555555af4620 /* 0 entries */, 32768) = 0 [pid 5005] <... close resumed>) = 0 [pid 5005] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5004] <... memfd_create resumed>) = 3 [pid 4995] close(3 [pid 4993] <... rmdir resumed>) = 0 [pid 4992] <... rmdir resumed>) = 0 [pid 5005] memfd_create("syzkaller", 0 [pid 5004] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 4995] <... close resumed>) = 0 [pid 4993] getdents64(3, [pid 4992] getdents64(3, [pid 5005] <... memfd_create resumed>) = 3 [pid 5004] <... mmap resumed>) = 0x7f197117a000 [pid 4995] rmdir("./0" [pid 4993] <... getdents64 resumed>0x555555af4620 /* 0 entries */, 32768) = 0 [pid 4992] <... getdents64 resumed>0x555555af4620 /* 0 entries */, 32768) = 0 [pid 5005] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f197117a000 [pid 4995] <... rmdir resumed>) = 0 [pid 4993] close(3 [pid 4992] close(3 [pid 5005] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 [pid 5004] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 [pid 4995] mkdir("./1", 0777 [pid 4993] <... close resumed>) = 0 [pid 4992] <... close resumed>) = 0 [pid 4995] <... mkdir resumed>) = 0 [pid 4993] rmdir("./0" [pid 4992] rmdir("./0" [pid 4995] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 4993] <... rmdir resumed>) = 0 [pid 4993] mkdir("./1", 0777 [pid 4992] <... rmdir resumed>) = 0 [pid 4995] <... openat resumed>) = 3 [pid 4995] ioctl(3, LOOP_CLR_FD [pid 4993] <... mkdir resumed>) = 0 [pid 4992] mkdir("./1", 0777 [pid 4995] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 4993] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 4995] close(3 [pid 4992] <... mkdir resumed>) = 0 [pid 4993] <... openat resumed>) = 3 [pid 4995] <... close resumed>) = 0 [pid 4992] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 4993] ioctl(3, LOOP_CLR_FD [pid 4995] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 4992] <... openat resumed>) = 3 [pid 4993] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 4992] ioctl(3, LOOP_CLR_FD [pid 4995] <... clone resumed>, child_tidptr=0x555555af35d0) = 5006 [pid 4993] close(3 [pid 4992] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 5005] <... write resumed>) = 524288 [pid 4993] <... close resumed>) = 0 [pid 4992] close(3 [pid 4993] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 4992] <... close resumed>) = 0 [pid 5005] munmap(0x7f197117a000, 524288 [pid 4992] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 4993] <... clone resumed>, child_tidptr=0x555555af35d0) = 5007 [pid 5005] <... munmap resumed>) = 0 [pid 5005] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 5005] ioctl(4, LOOP_SET_FD, 3 [pid 4992] <... clone resumed>, child_tidptr=0x555555af35d0) = 5008 [ 72.473770][ T26] audit: type=1400 audit(1686651414.816:90): avc: denied { unmount } for pid=4990 comm="syz-executor134" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dosfs_t tclass=filesystem permissive=1 ./strace-static-x86_64: Process 5006 attached [pid 5004] <... write resumed>) = 524288 [pid 4991] <... openat resumed>) = 3 [pid 4991] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 5006] chdir("./1" [pid 4991] close(3 [pid 5006] <... chdir resumed>) = 0 [pid 4991] <... close resumed>) = 0 [pid 4991] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5006] prctl(PR_SET_PDEATHSIG, SIGKILL./strace-static-x86_64: Process 5008 attached ) = 0 [pid 4991] <... clone resumed>, child_tidptr=0x555555af35d0) = 5009 [pid 5006] setpgid(0, 0 [pid 5008] chdir("./1" [pid 5006] <... setpgid resumed>) = 0 ./strace-static-x86_64: Process 5007 attached [pid 5006] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5008] <... chdir resumed>) = 0 [pid 5007] chdir("./1") = 0 [pid 5007] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5008] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5007] <... prctl resumed>) = 0 [pid 5006] <... openat resumed>) = 3 ./strace-static-x86_64: Process 5009 attached [pid 5008] <... prctl resumed>) = 0 [pid 5007] setpgid(0, 0 [pid 5006] write(3, "1000", 4 [pid 5009] chdir("./1" [pid 5008] setpgid(0, 0 [pid 5007] <... setpgid resumed>) = 0 [pid 5006] <... write resumed>) = 4 [pid 5004] munmap(0x7f197117a000, 524288 [pid 5009] <... chdir resumed>) = 0 [pid 5008] <... setpgid resumed>) = 0 [pid 5007] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5006] close(3 [pid 5009] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5008] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5007] <... openat resumed>) = 3 [pid 5006] <... close resumed>) = 0 [pid 5009] <... prctl resumed>) = 0 [pid 5008] <... openat resumed>) = 3 [pid 5007] write(3, "1000", 4 [pid 5006] symlink("/dev/binderfs", "./binderfs" [pid 5009] setpgid(0, 0 [pid 5007] <... write resumed>) = 4 [pid 5004] <... munmap resumed>) = 0 [pid 5009] <... setpgid resumed>) = 0 [pid 5008] write(3, "1000", 4 [pid 5007] close(3 [pid 5006] <... symlink resumed>) = 0 [pid 5009] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5008] <... write resumed>) = 4 [pid 5007] <... close resumed>) = 0 [pid 5004] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5009] <... openat resumed>) = 3 [pid 5008] close(3 [pid 5007] symlink("/dev/binderfs", "./binderfs" [pid 5006] memfd_create("syzkaller", 0 [pid 5004] <... openat resumed>) = 4 [pid 5009] write(3, "1000", 4 [pid 5008] <... close resumed>) = 0 [pid 5007] <... symlink resumed>) = 0 [pid 5006] <... memfd_create resumed>) = 3 [pid 5005] <... ioctl resumed>) = 0 [pid 5004] ioctl(4, LOOP_SET_FD, 3 [pid 5009] <... write resumed>) = 4 [pid 5008] symlink("/dev/binderfs", "./binderfs" [pid 5007] memfd_create("syzkaller", 0 [pid 5006] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5005] close(3 [pid 5009] close(3 [pid 5007] <... memfd_create resumed>) = 3 [pid 5005] <... close resumed>) = 0 [pid 5009] <... close resumed>) = 0 [pid 5007] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5005] mkdir("./file0", 0777 [pid 5009] symlink("/dev/binderfs", "./binderfs" [pid 5007] <... mmap resumed>) = 0x7f197117a000 [pid 5005] <... mkdir resumed>) = 0 [pid 5009] <... symlink resumed>) = 0 [pid 5008] <... symlink resumed>) = 0 [pid 5007] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 [pid 5006] <... mmap resumed>) = 0x7f197117a000 [pid 5005] mount("/dev/loop4", "./file0", "hfsplus", 0, "" [pid 5004] <... ioctl resumed>) = 0 [pid 5009] memfd_create("syzkaller", 0 [pid 5008] memfd_create("syzkaller", 0 [pid 5007] <... write resumed>) = 524288 [pid 5006] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 [pid 5004] close(3 [pid 5009] <... memfd_create resumed>) = 3 [pid 5005] <... mount resumed>) = 0 [pid 5009] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5005] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY [pid 5009] <... mmap resumed>) = 0x7f197117a000 [pid 5005] <... openat resumed>) = 3 [pid 5009] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 [pid 5005] ioctl(4, LOOP_CLR_FD [pid 5009] <... write resumed>) = 524288 [pid 5008] <... memfd_create resumed>) = 3 [pid 5005] <... ioctl resumed>) = 0 [pid 5007] munmap(0x7f197117a000, 524288 [pid 5005] close(4 [pid 5007] <... munmap resumed>) = 0 [pid 5005] <... close resumed>) = 0 [pid 5005] openat(AT_FDCWD, "/dev/loop5", O_RDONLY) = 4 [pid 5007] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 5006] <... write resumed>) = 524288 [pid 5005] ioctl(4, LOOP_SET_BLOCK_SIZE, 2048 [pid 5008] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5007] <... openat resumed>) = 4 [pid 5006] munmap(0x7f197117a000, 524288 [pid 5005] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 5004] <... close resumed>) = 0 [pid 5009] munmap(0x7f197117a000, 524288 [pid 5008] <... mmap resumed>) = 0x7f197117a000 [pid 5007] ioctl(4, LOOP_SET_FD, 3 [ 72.532282][ T5005] loop4: detected capacity change from 0 to 1024 [ 72.558419][ T5004] loop0: detected capacity change from 0 to 1024 [pid 5005] exit_group(0 [pid 5004] mkdir("./file0", 0777 [pid 5009] <... munmap resumed>) = 0 [pid 5008] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 [pid 5006] <... munmap resumed>) = 0 [pid 5005] <... exit_group resumed>) = ? [pid 5009] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 5005] +++ exited with 0 +++ [pid 5004] <... mkdir resumed>) = 0 [pid 5009] <... openat resumed>) = 4 [pid 5009] ioctl(4, LOOP_SET_FD, 3 [pid 4994] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5005, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5008] <... write resumed>) = 524288 [pid 5006] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 5004] mount("/dev/loop0", "./file0", "hfsplus", 0, "" [pid 4994] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5006] <... openat resumed>) = 4 [pid 4994] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 4994] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5008] munmap(0x7f197117a000, 524288 [pid 5006] ioctl(4, LOOP_SET_FD, 3 [pid 5004] <... mount resumed>) = 0 [pid 4994] <... openat resumed>) = 3 [pid 5004] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY [pid 4994] fstat(3, [pid 5004] <... openat resumed>) = 3 [pid 4994] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5004] ioctl(4, LOOP_CLR_FD [pid 4994] getdents64(3, [pid 5004] <... ioctl resumed>) = 0 [pid 4994] <... getdents64 resumed>0x555555af4620 /* 4 entries */, 32768) = 112 [pid 5004] close(4 [pid 4994] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5004] <... close resumed>) = 0 [pid 4994] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5004] openat(AT_FDCWD, "/dev/loop5", O_RDONLY [pid 4994] lstat("./1/binderfs", [pid 5004] <... openat resumed>) = 4 [pid 4994] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5004] ioctl(4, LOOP_SET_BLOCK_SIZE, 2048 [pid 4994] unlink("./1/binderfs") = 0 [pid 4994] umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5007] <... ioctl resumed>) = 0 [pid 5007] close(3) = 0 [pid 5007] mkdir("./file0", 0777) = 0 [ 72.609419][ T5007] loop3: detected capacity change from 0 to 1024 [ 72.621737][ T5009] loop1: detected capacity change from 0 to 1024 [ 72.634396][ T5006] loop5: detected capacity change from 0 to 1024 [pid 5007] mount("/dev/loop3", "./file0", "hfsplus", 0, "" [pid 5008] <... munmap resumed>) = 0 [pid 5006] <... ioctl resumed>) = 0 [pid 5009] <... ioctl resumed>) = 0 [pid 5008] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 5006] close(3 [pid 5009] close(3 [pid 5006] <... close resumed>) = 0 [pid 5009] <... close resumed>) = 0 [pid 5008] <... openat resumed>) = 4 [pid 5009] mkdir("./file0", 0777) = 0 [pid 5009] mount("/dev/loop1", "./file0", "hfsplus", 0, "" [pid 5008] ioctl(4, LOOP_SET_FD, 3 [pid 5006] mkdir("./file0", 0777 [pid 4994] <... umount2 resumed>) = 0 [pid 5006] <... mkdir resumed>) = 0 [pid 5008] <... ioctl resumed>) = 0 [pid 5006] mount("/dev/loop5", "./file0", "hfsplus", 0, "" [pid 5008] close(3 [pid 4994] umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5008] <... close resumed>) = 0 [pid 4994] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 4994] lstat("./1/file0", [pid 5009] <... mount resumed>) = 0 [pid 4994] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5008] mkdir("./file0", 0777 [pid 5009] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY [pid 4994] umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5009] <... openat resumed>) = 3 [pid 4994] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5009] ioctl(4, LOOP_CLR_FD) = 0 [pid 4994] openat(AT_FDCWD, "./1/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5009] close(4 [pid 4994] <... openat resumed>) = 4 [pid 5009] <... close resumed>) = 0 [pid 4994] fstat(4, [pid 5009] openat(AT_FDCWD, "/dev/loop5", O_RDONLY) = 4 [pid 4994] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5009] ioctl(4, LOOP_SET_BLOCK_SIZE, 2048 [pid 4994] getdents64(4, 0x555555afc660 /* 2 entries */, 32768) = 48 [pid 4994] getdents64(4, 0x555555afc660 /* 0 entries */, 32768) = 0 [pid 4994] close(4) = 0 [pid 4994] rmdir("./1/file0" [pid 5008] <... mkdir resumed>) = 0 [pid 5007] <... mount resumed>) = 0 [pid 4994] <... rmdir resumed>) = 0 [pid 5007] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY [pid 4994] getdents64(3, [pid 5008] mount("/dev/loop2", "./file0", "hfsplus", 0, "" [pid 5007] <... openat resumed>) = 3 [pid 4994] <... getdents64 resumed>0x555555af4620 /* 0 entries */, 32768) = 0 [pid 5007] ioctl(4, LOOP_CLR_FD [pid 4994] close(3) = 0 [pid 4994] rmdir("./1" [pid 5007] <... ioctl resumed>) = 0 [pid 4994] <... rmdir resumed>) = 0 [pid 5007] close(4 [pid 4994] mkdir("./2", 0777) = 0 [pid 5007] <... close resumed>) = 0 [pid 4994] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 5007] openat(AT_FDCWD, "/dev/loop5", O_RDONLY [pid 4994] <... openat resumed>) = 3 [pid 4994] ioctl(3, LOOP_CLR_FD [pid 5007] <... openat resumed>) = 4 [pid 5007] ioctl(4, LOOP_SET_BLOCK_SIZE, 2048 [pid 4994] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 4994] close(3) = 0 [pid 4994] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555af35d0) = 5010 [ 72.643458][ T26] audit: type=1400 audit(1686651415.076:91): avc: denied { append } for pid=4427 comm="syslogd" name="messages" dev="tmpfs" ino=3 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 72.670544][ T26] audit: type=1400 audit(1686651415.076:92): avc: denied { open } for pid=4427 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=3 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 72.695151][ T5008] loop2: detected capacity change from 0 to 1024 ./strace-static-x86_64: Process 5010 attached [pid 5009] <... ioctl resumed>) = 0 [pid 5007] <... ioctl resumed>) = 0 [pid 5004] <... ioctl resumed>) = 0 [pid 5010] chdir("./2" [pid 5009] exit_group(0 [pid 5007] exit_group(0 [pid 5004] exit_group(0 [pid 5010] <... chdir resumed>) = 0 [pid 5009] <... exit_group resumed>) = ? [pid 5008] <... mount resumed>) = 0 [pid 5007] <... exit_group resumed>) = ? [pid 5004] <... exit_group resumed>) = ? [pid 5010] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5009] +++ exited with 0 +++ [pid 5008] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY [pid 5007] +++ exited with 0 +++ [pid 5004] +++ exited with 0 +++ [pid 5010] <... prctl resumed>) = 0 [pid 5008] <... openat resumed>) = 3 [pid 4993] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5007, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 4990] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5004, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5010] setpgid(0, 0 [pid 5008] ioctl(4, LOOP_CLR_FD [pid 4991] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5009, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5010] <... setpgid resumed>) = 0 [pid 5008] <... ioctl resumed>) = 0 [pid 4991] restart_syscall(<... resuming interrupted clone ...> [pid 5008] close(4 [pid 4991] <... restart_syscall resumed>) = 0 [pid 5008] <... close resumed>) = 0 [pid 5008] openat(AT_FDCWD, "/dev/loop5", O_RDONLY) = 4 [pid 4991] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5008] ioctl(4, LOOP_SET_BLOCK_SIZE, 2048 [pid 4991] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5008] <... ioctl resumed>) = 0 [pid 4991] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5010] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5008] exit_group(0 [pid 4993] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4991] <... openat resumed>) = 3 [pid 4990] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5008] <... exit_group resumed>) = ? [pid 4993] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 4991] fstat(3, [pid 4990] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5010] <... openat resumed>) = 3 [pid 5008] +++ exited with 0 +++ [pid 4991] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 4990] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5010] write(3, "1000", 4 [pid 4993] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 4991] getdents64(3, [pid 4990] <... openat resumed>) = 3 [pid 5010] <... write resumed>) = 4 [pid 4993] <... openat resumed>) = 3 [pid 4992] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5008, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 4991] <... getdents64 resumed>0x555555af4620 /* 4 entries */, 32768) = 112 [pid 4990] fstat(3, [pid 5010] close(3 [pid 4993] fstat(3, [pid 4992] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4991] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4990] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5010] <... close resumed>) = 0 [pid 4993] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 4992] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 4991] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 4990] getdents64(3, [pid 5010] symlink("/dev/binderfs", "./binderfs" [pid 4993] getdents64(3, [pid 4992] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 4991] lstat("./1/binderfs", [pid 4990] <... getdents64 resumed>0x555555af4620 /* 4 entries */, 32768) = 112 [pid 5010] <... symlink resumed>) = 0 [pid 4992] <... openat resumed>) = 3 [pid 4991] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 4990] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5010] memfd_create("syzkaller", 0 [pid 4993] <... getdents64 resumed>0x555555af4620 /* 4 entries */, 32768) = 112 [pid 4992] fstat(3, [pid 4991] unlink("./1/binderfs" [pid 4990] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5010] <... memfd_create resumed>) = 3 [pid 4993] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4992] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 4991] <... unlink resumed>) = 0 [pid 4990] lstat("./1/binderfs", [pid 5010] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 4993] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 4992] getdents64(3, [pid 4991] umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4990] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [ 72.733236][ T5006] hfsplus: unable to set blocksize to 1024! [ 72.739394][ T5006] hfsplus: unable to find HFS+ superblock [pid 5010] <... mmap resumed>) = 0x7f197117a000 [pid 4993] lstat("./1/binderfs", [pid 4992] <... getdents64 resumed>0x555555af4620 /* 4 entries */, 32768) = 112 [pid 4990] unlink("./1/binderfs") = 0 [pid 4990] umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5010] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 [pid 4993] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 4993] unlink("./1/binderfs" [pid 4992] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4993] <... unlink resumed>) = 0 [pid 4992] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 4993] umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4992] lstat("./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 4992] unlink("./1/binderfs") = 0 [pid 5006] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 5006] ioctl(4, LOOP_CLR_FD [pid 4990] <... umount2 resumed>) = 0 [pid 4992] umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4993] <... umount2 resumed>) = 0 [pid 4992] <... umount2 resumed>) = 0 [pid 4991] <... umount2 resumed>) = 0 [pid 4991] umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4990] umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4993] umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4992] umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4991] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 4990] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 4991] lstat("./1/file0", [pid 4993] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 4992] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 4991] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 4990] lstat("./1/file0", [pid 5010] <... write resumed>) = 524288 [pid 4993] lstat("./1/file0", [pid 4992] lstat("./1/file0", [pid 4991] umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4990] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5010] munmap(0x7f197117a000, 524288 [pid 4993] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 4992] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 4991] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5010] <... munmap resumed>) = 0 [pid 5006] <... ioctl resumed>) = 0 [pid 4993] umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4992] umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4991] openat(AT_FDCWD, "./1/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 4990] umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5006] close(4) = 0 [pid 5010] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 5006] openat(AT_FDCWD, "/dev/loop5", O_RDONLY [pid 4993] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 4992] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 4991] <... openat resumed>) = 4 [pid 4990] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5010] <... openat resumed>) = 4 [pid 5006] <... openat resumed>) = 3 [pid 4993] openat(AT_FDCWD, "./1/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5010] ioctl(4, LOOP_SET_FD, 3 [pid 4992] openat(AT_FDCWD, "./1/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 4991] fstat(4, [pid 4990] openat(AT_FDCWD, "./1/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 4992] <... openat resumed>) = 4 [pid 5006] ioctl(3, LOOP_SET_BLOCK_SIZE, 2048 [pid 4993] <... openat resumed>) = 4 [pid 4990] <... openat resumed>) = 4 [pid 5006] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 4991] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 4990] fstat(4, [pid 4993] fstat(4, [pid 5006] exit_group(0) = ? [pid 5006] +++ exited with 0 +++ [pid 4995] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5006, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 4992] fstat(4, [pid 4991] getdents64(4, [pid 4993] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 4990] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 4992] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5010] <... ioctl resumed>) = 0 [pid 4995] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4993] getdents64(4, [pid 4992] getdents64(4, [pid 4991] <... getdents64 resumed>0x555555afc660 /* 2 entries */, 32768) = 48 [pid 4990] getdents64(4, [pid 5010] close(3 [pid 4995] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 4993] <... getdents64 resumed>0x555555afc660 /* 2 entries */, 32768) = 48 [pid 4992] <... getdents64 resumed>0x555555afc660 /* 2 entries */, 32768) = 48 [pid 4991] getdents64(4, [pid 4990] <... getdents64 resumed>0x555555afc660 /* 2 entries */, 32768) = 48 [pid 5010] <... close resumed>) = 0 [pid 4995] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 4993] getdents64(4, [pid 4992] getdents64(4, [pid 4991] <... getdents64 resumed>0x555555afc660 /* 0 entries */, 32768) = 0 [pid 4990] getdents64(4, [pid 5010] mkdir("./file0", 0777 [pid 4995] <... openat resumed>) = 3 [pid 4993] <... getdents64 resumed>0x555555afc660 /* 0 entries */, 32768) = 0 [pid 4992] <... getdents64 resumed>0x555555afc660 /* 0 entries */, 32768) = 0 [pid 4991] close(4 [pid 4990] <... getdents64 resumed>0x555555afc660 /* 0 entries */, 32768) = 0 [pid 5010] <... mkdir resumed>) = 0 [pid 4992] close(4 [pid 4990] close(4 [pid 4993] close(4 [pid 4991] <... close resumed>) = 0 [pid 4992] <... close resumed>) = 0 [pid 4990] <... close resumed>) = 0 [pid 4993] <... close resumed>) = 0 [pid 4991] rmdir("./1/file0" [pid 4995] fstat(3, [pid 4993] rmdir("./1/file0" [pid 4992] rmdir("./1/file0" [pid 4990] rmdir("./1/file0" [pid 5010] mount("/dev/loop4", "./file0", "hfsplus", 0, "" [pid 4991] <... rmdir resumed>) = 0 [pid 4993] <... rmdir resumed>) = 0 [pid 4992] <... rmdir resumed>) = 0 [pid 4990] <... rmdir resumed>) = 0 [pid 4995] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 4993] getdents64(3, [pid 4992] getdents64(3, [pid 4995] getdents64(3, [pid 4990] getdents64(3, [pid 4993] <... getdents64 resumed>0x555555af4620 /* 0 entries */, 32768) = 0 [pid 4992] <... getdents64 resumed>0x555555af4620 /* 0 entries */, 32768) = 0 [pid 4995] <... getdents64 resumed>0x555555af4620 /* 4 entries */, 32768) = 112 [pid 4993] close(3 [pid 4992] close(3 [pid 4990] <... getdents64 resumed>0x555555af4620 /* 0 entries */, 32768) = 0 [pid 4995] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4991] getdents64(3, [pid 4995] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 4992] <... close resumed>) = 0 [pid 4990] close(3 [pid 4995] lstat("./1/binderfs", [pid 4993] <... close resumed>) = 0 [pid 4992] rmdir("./1" [pid 4990] <... close resumed>) = 0 [pid 4995] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 4991] <... getdents64 resumed>0x555555af4620 /* 0 entries */, 32768) = 0 [pid 4995] unlink("./1/binderfs" [pid 4993] rmdir("./1" [pid 4992] <... rmdir resumed>) = 0 [pid 4991] close(3 [pid 4990] rmdir("./1" [pid 4995] <... unlink resumed>) = 0 [pid 4990] <... rmdir resumed>) = 0 [pid 4993] <... rmdir resumed>) = 0 [pid 4995] umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4991] <... close resumed>) = 0 [pid 4993] mkdir("./2", 0777 [pid 4992] mkdir("./2", 0777 [pid 4990] mkdir("./2", 0777 [pid 4995] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 4991] rmdir("./1" [pid 4993] <... mkdir resumed>) = 0 [pid 4995] lstat("./1/file0", [pid 4991] <... rmdir resumed>) = 0 [pid 4992] <... mkdir resumed>) = 0 [pid 4995] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 4995] umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4991] mkdir("./2", 0777 [pid 4990] <... mkdir resumed>) = 0 [pid 5010] <... mount resumed>) = 0 [pid 4995] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 4993] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 4992] openat(AT_FDCWD, "/dev/loop2", O_RDWR [ 72.826335][ T5003] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 72.845399][ T5010] loop4: detected capacity change from 0 to 1024 [pid 4991] <... mkdir resumed>) = 0 [pid 4990] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5010] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY [pid 4995] openat(AT_FDCWD, "./1/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 4993] <... openat resumed>) = 3 [pid 4992] <... openat resumed>) = 3 [pid 4991] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 4990] <... openat resumed>) = 3 [pid 5010] <... openat resumed>) = 3 [pid 4995] <... openat resumed>) = 4 [pid 4993] ioctl(3, LOOP_CLR_FD [pid 4992] ioctl(3, LOOP_CLR_FD [pid 4991] <... openat resumed>) = 3 [pid 4990] ioctl(3, LOOP_CLR_FD [pid 4993] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 4992] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 4993] close(3 [pid 4992] close(3 [pid 4991] ioctl(3, LOOP_CLR_FD [pid 4990] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 5010] ioctl(4, LOOP_CLR_FD [pid 4995] fstat(4, [pid 4993] <... close resumed>) = 0 [pid 4992] <... close resumed>) = 0 [pid 5010] <... ioctl resumed>) = 0 [pid 4991] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 4995] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 4990] close(3 [pid 5010] close(4 [pid 4995] getdents64(4, [pid 4993] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 4992] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 4991] close(3 [pid 5010] <... close resumed>) = 0 [pid 4995] <... getdents64 resumed>0x555555afc660 /* 2 entries */, 32768) = 48 [pid 4990] <... close resumed>) = 0 ./strace-static-x86_64: Process 5015 attached ./strace-static-x86_64: Process 5014 attached [pid 5010] openat(AT_FDCWD, "/dev/loop5", O_RDONLY [pid 4995] getdents64(4, [pid 4991] <... close resumed>) = 0 [pid 4990] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5015] chdir("./2" [pid 5014] chdir("./2" [pid 5010] <... openat resumed>) = 4 [pid 4995] <... getdents64 resumed>0x555555afc660 /* 0 entries */, 32768) = 0 [pid 4993] <... clone resumed>, child_tidptr=0x555555af35d0) = 5014 [pid 4992] <... clone resumed>, child_tidptr=0x555555af35d0) = 5015 [pid 4991] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5014] <... chdir resumed>) = 0 [pid 5010] ioctl(4, LOOP_SET_BLOCK_SIZE, 2048 [pid 5015] <... chdir resumed>) = 0 [pid 5014] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5010] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 4995] close(4 [pid 4990] <... clone resumed>, child_tidptr=0x555555af35d0) = 5017 [pid 5015] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5014] <... prctl resumed>) = 0 [pid 5010] exit_group(0 [pid 4995] <... close resumed>) = 0 [pid 5015] <... prctl resumed>) = 0 [pid 5014] setpgid(0, 0 [pid 4995] rmdir("./1/file0" [pid 5010] <... exit_group resumed>) = ? [pid 5015] setpgid(0, 0 [pid 5014] <... setpgid resumed>) = 0 [pid 4991] <... clone resumed>, child_tidptr=0x555555af35d0) = 5018 ./strace-static-x86_64: Process 5018 attached ./strace-static-x86_64: Process 5017 attached [pid 5015] <... setpgid resumed>) = 0 [pid 5014] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 4995] <... rmdir resumed>) = 0 [pid 5018] chdir("./2" [pid 5017] chdir("./2" [pid 5015] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5014] <... openat resumed>) = 3 [pid 5010] +++ exited with 0 +++ [pid 4995] getdents64(3, [pid 5018] <... chdir resumed>) = 0 [pid 5017] <... chdir resumed>) = 0 [pid 5015] <... openat resumed>) = 3 [pid 5014] write(3, "1000", 4 [pid 4995] <... getdents64 resumed>0x555555af4620 /* 0 entries */, 32768) = 0 [pid 5018] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5015] write(3, "1000", 4 [pid 5014] <... write resumed>) = 4 [pid 4995] close(3 [pid 4994] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5010, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5015] <... write resumed>) = 4 [pid 5014] close(3 [pid 4995] <... close resumed>) = 0 [pid 5015] close(3 [pid 5014] <... close resumed>) = 0 [pid 4995] rmdir("./1" [pid 4994] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5015] <... close resumed>) = 0 [pid 5014] symlink("/dev/binderfs", "./binderfs" [pid 5018] <... prctl resumed>) = 0 [pid 5017] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5015] symlink("/dev/binderfs", "./binderfs" [pid 5014] <... symlink resumed>) = 0 [pid 4995] <... rmdir resumed>) = 0 [pid 4994] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5018] setpgid(0, 0 [pid 5017] <... prctl resumed>) = 0 [pid 5015] <... symlink resumed>) = 0 [pid 5014] memfd_create("syzkaller", 0 [pid 4995] mkdir("./2", 0777 [pid 4994] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5018] <... setpgid resumed>) = 0 [pid 5017] setpgid(0, 0 [pid 5015] memfd_create("syzkaller", 0 [pid 5014] <... memfd_create resumed>) = 3 [pid 5018] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5017] <... setpgid resumed>) = 0 [pid 4995] <... mkdir resumed>) = 0 [pid 5015] <... memfd_create resumed>) = 3 [pid 4994] <... openat resumed>) = 3 [pid 5014] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5018] <... openat resumed>) = 3 [pid 5017] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5015] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 4995] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 4994] fstat(3, [pid 5018] write(3, "1000", 4 [pid 5017] <... openat resumed>) = 3 [pid 5014] <... mmap resumed>) = 0x7f197117a000 [pid 5015] <... mmap resumed>) = 0x7f197117a000 [pid 5018] <... write resumed>) = 4 [pid 5017] write(3, "1000", 4 [pid 4995] <... openat resumed>) = 3 [pid 4994] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5018] close(3 [pid 5017] <... write resumed>) = 4 [pid 5018] <... close resumed>) = 0 [pid 5017] close(3 [pid 5018] symlink("/dev/binderfs", "./binderfs" [pid 5017] <... close resumed>) = 0 [pid 5018] <... symlink resumed>) = 0 [pid 5017] symlink("/dev/binderfs", "./binderfs" [pid 5014] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 [pid 4995] ioctl(3, LOOP_CLR_FD [pid 4994] getdents64(3, [pid 5018] memfd_create("syzkaller", 0 [pid 5017] <... symlink resumed>) = 0 [pid 4995] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 5018] <... memfd_create resumed>) = 3 [pid 5017] memfd_create("syzkaller", 0 [pid 4995] close(3 [pid 4994] <... getdents64 resumed>0x555555af4620 /* 4 entries */, 32768) = 112 [pid 5018] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5017] <... memfd_create resumed>) = 3 [pid 5015] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 [pid 4995] <... close resumed>) = 0 [pid 4994] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5018] <... mmap resumed>) = 0x7f197117a000 [pid 5017] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 4995] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 4994] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5018] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 [pid 5017] <... mmap resumed>) = 0x7f197117a000 ./strace-static-x86_64: Process 5019 attached [pid 5018] <... write resumed>) = 524288 [pid 5017] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 [pid 5015] <... write resumed>) = 524288 [pid 5014] <... write resumed>) = 524288 [pid 4994] lstat("./2/binderfs", [pid 5019] chdir("./2" [pid 5015] munmap(0x7f197117a000, 524288 [pid 5014] munmap(0x7f197117a000, 524288 [pid 4995] <... clone resumed>, child_tidptr=0x555555af35d0) = 5019 [pid 5019] <... chdir resumed>) = 0 [pid 4994] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 4994] unlink("./2/binderfs" [pid 5019] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5018] munmap(0x7f197117a000, 524288 [pid 5017] <... write resumed>) = 524288 [pid 5015] <... munmap resumed>) = 0 [pid 5014] <... munmap resumed>) = 0 [pid 4994] <... unlink resumed>) = 0 [pid 5019] <... prctl resumed>) = 0 [pid 5015] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 5014] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 4994] umount2("./2/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5019] setpgid(0, 0 [pid 5015] <... openat resumed>) = 4 [pid 5014] <... openat resumed>) = 4 [pid 5019] <... setpgid resumed>) = 0 [pid 5018] <... munmap resumed>) = 0 [pid 5017] munmap(0x7f197117a000, 524288 [pid 5015] ioctl(4, LOOP_SET_FD, 3 [pid 5014] ioctl(4, LOOP_SET_FD, 3 [pid 5019] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5018] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 5017] <... munmap resumed>) = 0 [pid 5018] <... openat resumed>) = 4 [pid 5018] ioctl(4, LOOP_SET_FD, 3 [pid 5017] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5015] <... ioctl resumed>) = 0 [pid 5017] <... openat resumed>) = 4 [pid 5017] ioctl(4, LOOP_SET_FD, 3 [pid 5019] <... openat resumed>) = 3 [pid 5015] close(3 [pid 4994] <... umount2 resumed>) = 0 [pid 5019] write(3, "1000", 4) = 4 [pid 4994] umount2("./2/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5015] <... close resumed>) = 0 [pid 5019] close(3 [pid 4994] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5015] mkdir("./file0", 0777 [pid 5019] <... close resumed>) = 0 [pid 4994] lstat("./2/file0", [pid 5019] symlink("/dev/binderfs", "./binderfs") = 0 [pid 4994] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5019] memfd_create("syzkaller", 0 [pid 4994] umount2("./2/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5019] <... memfd_create resumed>) = 3 [pid 4994] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5019] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 4994] openat(AT_FDCWD, "./2/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5019] <... mmap resumed>) = 0x7f197117a000 [pid 5017] <... ioctl resumed>) = 0 [pid 4994] <... openat resumed>) = 4 [pid 5019] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 [pid 5017] close(3 [pid 4994] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 4994] getdents64(4, [pid 5017] <... close resumed>) = 0 [pid 4994] <... getdents64 resumed>0x555555afc660 /* 2 entries */, 32768) = 48 [pid 5017] mkdir("./file0", 0777 [pid 4994] getdents64(4, [pid 5017] <... mkdir resumed>) = 0 [pid 5015] <... mkdir resumed>) = 0 [pid 4994] <... getdents64 resumed>0x555555afc660 /* 0 entries */, 32768) = 0 [pid 4994] close(4) = 0 [pid 4994] rmdir("./2/file0" [pid 5017] mount("/dev/loop0", "./file0", "hfsplus", 0, "" [pid 4994] <... rmdir resumed>) = 0 [pid 5019] <... write resumed>) = 524288 [pid 5017] <... mount resumed>) = 0 [pid 4994] getdents64(3, [pid 5018] <... ioctl resumed>) = 0 [pid 4994] <... getdents64 resumed>0x555555af4620 /* 0 entries */, 32768) = 0 [pid 5019] munmap(0x7f197117a000, 524288 [pid 5015] mount("/dev/loop2", "./file0", "hfsplus", 0, "" [pid 4994] close(3) = 0 [pid 4994] rmdir("./2" [ 73.045253][ T5015] loop2: detected capacity change from 0 to 1024 [ 73.047597][ T5018] loop1: detected capacity change from 0 to 1024 [ 73.051843][ T5014] loop3: detected capacity change from 0 to 1024 [ 73.060566][ T5017] loop0: detected capacity change from 0 to 1024 [pid 5018] close(3 [pid 5017] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY [pid 5019] <... munmap resumed>) = 0 [pid 5018] <... close resumed>) = 0 [pid 4994] <... rmdir resumed>) = 0 [pid 4994] mkdir("./3", 0777 [pid 5018] mkdir("./file0", 0777 [pid 5017] <... openat resumed>) = 3 [pid 5019] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 5018] <... mkdir resumed>) = 0 [pid 5017] ioctl(4, LOOP_CLR_FD [pid 5015] <... mount resumed>) = 0 [pid 5014] <... ioctl resumed>) = 0 [pid 4994] <... mkdir resumed>) = 0 [pid 5019] <... openat resumed>) = 4 [pid 5018] mount("/dev/loop1", "./file0", "hfsplus", 0, "" [pid 5017] <... ioctl resumed>) = 0 [pid 5015] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY [pid 4994] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 5019] ioctl(4, LOOP_SET_FD, 3 [pid 5017] close(4 [pid 5014] close(3 [pid 5015] <... openat resumed>) = 3 [pid 5017] <... close resumed>) = 0 [pid 4994] <... openat resumed>) = 3 [pid 5017] openat(AT_FDCWD, "/dev/loop5", O_RDONLY [pid 5014] <... close resumed>) = 0 [pid 5017] <... openat resumed>) = 4 [pid 5014] mkdir("./file0", 0777 [pid 5017] ioctl(4, LOOP_SET_BLOCK_SIZE, 2048 [pid 5014] <... mkdir resumed>) = 0 [pid 5014] mount("/dev/loop3", "./file0", "hfsplus", 0, "" [pid 5018] <... mount resumed>) = 0 [pid 5015] ioctl(4, LOOP_CLR_FD [pid 4994] ioctl(3, LOOP_CLR_FD [pid 5018] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY [pid 5015] <... ioctl resumed>) = 0 [pid 5018] <... openat resumed>) = 3 [pid 5015] close(4 [pid 5014] <... mount resumed>) = 0 [pid 4994] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 5019] <... ioctl resumed>) = 0 [pid 5018] ioctl(4, LOOP_CLR_FD [pid 5015] <... close resumed>) = 0 [pid 4994] close(3 [pid 5019] close(3 [pid 5018] <... ioctl resumed>) = 0 [pid 5015] openat(AT_FDCWD, "/dev/loop5", O_RDONLY [pid 5014] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY [pid 4994] <... close resumed>) = 0 [pid 5019] <... close resumed>) = 0 [pid 5018] close(4 [pid 5015] <... openat resumed>) = 4 [pid 4994] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5019] mkdir("./file0", 0777 [pid 5018] <... close resumed>) = 0 [pid 5015] ioctl(4, LOOP_SET_BLOCK_SIZE, 2048 [pid 5014] <... openat resumed>) = 3 [pid 5018] openat(AT_FDCWD, "/dev/loop5", O_RDONLY [pid 5014] ioctl(4, LOOP_CLR_FD [pid 5019] <... mkdir resumed>) = 0 [pid 5018] <... openat resumed>) = 4 [pid 5014] <... ioctl resumed>) = 0 [pid 4994] <... clone resumed>, child_tidptr=0x555555af35d0) = 5021 ./strace-static-x86_64: Process 5021 attached [pid 5019] mount("/dev/loop5", "./file0", "hfsplus", 0, "" [pid 5018] ioctl(4, LOOP_SET_BLOCK_SIZE, 2048 [pid 5014] close(4 [pid 5021] chdir("./3" [pid 5014] <... close resumed>) = 0 [pid 5014] openat(AT_FDCWD, "/dev/loop5", O_RDONLY [pid 5021] <... chdir resumed>) = 0 [pid 5021] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5014] <... openat resumed>) = 4 [ 73.160004][ T5019] loop5: detected capacity change from 0 to 1024 [ 73.203697][ T5019] ================================================================== [ 73.211798][ T5019] BUG: KASAN: slab-use-after-free in hfsplus_read_wrapper+0xf62/0x1020 [ 73.220079][ T5019] Read of size 2 at addr ffff8880220e3c00 by task syz-executor134/5019 [ 73.228334][ T5019] [ 73.230679][ T5019] CPU: 1 PID: 5019 Comm: syz-executor134 Not tainted 6.4.0-rc6-syzkaller-00006-gfd37b884003c #0 [ 73.241283][ T5019] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023 [ 73.251538][ T5019] Call Trace: [ 73.254919][ T5019] [ 73.257862][ T5019] dump_stack_lvl+0xd9/0x150 [ 73.262490][ T5019] print_address_description.constprop.0+0x2c/0x3c0 [ 73.269197][ T5019] ? hfsplus_read_wrapper+0xf62/0x1020 [ 73.274695][ T5019] kasan_report+0x11c/0x130 [ 73.279232][ T5019] ? hfsplus_read_wrapper+0xf62/0x1020 [ 73.284806][ T5019] hfsplus_read_wrapper+0xf62/0x1020 [ 73.290120][ T5019] ? lock_downgrade+0x690/0x690 [ 73.294798][ T5021] loop4: detected capacity change from 0 to 1024 [ 73.294982][ T5019] ? hfsplus_submit_bio+0x2b0/0x2b0 [ 73.295012][ T5019] ? spin_bug+0x1c0/0x1c0 [ 73.310985][ T5019] ? mark_held_locks+0x9f/0xe0 [ 73.315767][ T5019] ? do_raw_spin_unlock+0x175/0x230 [ 73.320984][ T5019] ? _raw_spin_unlock+0x28/0x40 [ 73.325848][ T5019] ? find_nls+0x121/0x160 [ 73.330190][ T5019] hfsplus_fill_super+0x312/0x1c40 [ 73.335329][ T5019] ? ip6_addr_string_sa+0x830/0x830 [ 73.340536][ T5019] ? hfsplus_iget+0x7c0/0x7c0 [ 73.345236][ T5019] ? bdev_name.constprop.0+0x270/0x4d0 [ 73.350722][ T5019] ? fourcc_string+0x770/0x770 [ 73.355574][ T5019] ? pointer+0x173/0xc50 [ 73.359821][ T5019] ? vsscanf+0x8af/0x2600 [ 73.364153][ T5019] ? resource_string.isra.0+0x16c0/0x16c0 [ 73.369876][ T5019] ? vsnprintf+0x4df/0x1710 [ 73.374382][ T5019] ? pointer+0xc50/0xc50 [ 73.378630][ T5019] ? snprintf+0xbf/0x100 [ 73.382876][ T5019] ? vsprintf+0x30/0x30 [ 73.387047][ T5019] ? wait_for_completion_io_timeout+0x20/0x20 [ 73.393216][ T5019] ? set_blocksize+0x2d8/0x370 [ 73.397988][ T5019] mount_bdev+0x358/0x420 [ 73.402324][ T5019] ? hfsplus_iget+0x7c0/0x7c0 [ 73.407008][ T5019] ? zisofs_cleanup+0x20/0x20 [ 73.411687][ T5019] legacy_get_tree+0x109/0x220 [ 73.416463][ T5019] vfs_get_tree+0x8d/0x350 [ 73.420881][ T5019] path_mount+0x134b/0x1e40 [ 73.425746][ T5019] ? putname+0x102/0x140 [ 73.429991][ T5019] ? lockdep_hardirqs_on+0x7d/0x100 [ 73.435192][ T5019] ? finish_automount+0x9b0/0x9b0 [ 73.440221][ T5019] ? putname+0x102/0x140 [ 73.444467][ T5019] __x64_sys_mount+0x283/0x300 [ 73.449237][ T5019] ? copy_mnt_ns+0xb30/0xb30 [ 73.453859][ T5019] ? lockdep_hardirqs_on+0x7d/0x100 [ 73.459078][ T5019] ? _raw_spin_unlock_irq+0x2e/0x50 [ 73.464294][ T5019] ? ptrace_notify+0xfe/0x140 [ 73.468980][ T5019] do_syscall_64+0x39/0xb0 [ 73.473398][ T5019] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 73.479302][ T5019] RIP: 0033:0x7f19795c8f1a [ 73.483714][ T5019] Code: 48 c7 c2 c0 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 a8 00 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 73.503323][ T5019] RSP: 002b:00007ffcee9fec18 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [ 73.511748][ T5019] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f19795c8f1a [ 73.519719][ T5019] RDX: 0000000020000000 RSI: 0000000020000640 RDI: 00007ffcee9fec30 [ 73.527705][ T5019] RBP: 00007ffcee9fec30 R08: 00007ffcee9fec70 R09: 00000000000005cd [ 73.535969][ T5019] R10: 0000000000000000 R11: 0000000000000286 R12: 0000000000000004 [ 73.544217][ T5019] R13: 0000555555af32c0 R14: 0000000000000000 R15: 00007ffcee9fec70 [ 73.552300][ T5019] [ 73.555321][ T5019] [ 73.557636][ T5019] The buggy address belongs to the object at ffff8880220e3c00 [ 73.557636][ T5019] which belongs to the cache kmalloc-512 of size 512 [ 73.571686][ T5019] The buggy address is located 0 bytes inside of [ 73.571686][ T5019] freed 512-byte region [ffff8880220e3c00, ffff8880220e3e00) [ 73.585401][ T5019] [ 73.587714][ T5019] The buggy address belongs to the physical page: [ 73.594211][ T5019] page:ffffea00008838c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880220e3c00 pfn:0x220e3 [ 73.605768][ T5019] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) [ 73.613401][ T5019] page_type: 0x3() [ 73.617124][ T5019] raw: 00fff00000000200 ffff888012440600 ffffea0000ae0290 ffffea00009003d0 [ 73.625706][ T5019] raw: ffff8880220e3c00 ffff8880220e3000 0000000100000003 0000000000000000 [ 73.634541][ T5019] page dumped because: kasan: bad access detected [ 73.641201][ T5019] page_owner tracks the page as allocated [ 73.647165][ T5019] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x242000(__GFP_NOWARN|__GFP_COMP|__GFP_THISNODE), pid 1, tgid 1 (swapper/0), ts 9985636434, free_ts 8883827541 [ 73.664708][ T5019] post_alloc_hook+0x2db/0x350 [ 73.669485][ T5019] get_page_from_freelist+0xf41/0x2c00 [ 73.675329][ T5019] __alloc_pages+0x1cb/0x4a0 [ 73.680096][ T5019] cache_grow_begin+0x9b/0x3b0 [ 73.684907][ T5019] cache_alloc_refill+0x27f/0x380 [ 73.690052][ T5019] __kmem_cache_alloc_node+0x360/0x3f0 [ 73.695521][ T5019] kmalloc_trace+0x26/0xe0 [ 73.700045][ T5019] usb_cache_string+0x62/0x160 [ 73.704817][ T5019] usb_new_device+0x1d1/0x19d0 [ 73.709584][ T5019] register_root_hub+0x23d/0x650 [ 73.714525][ T5019] usb_add_hcd+0xd4d/0x1a60 [ 73.719028][ T5019] vhci_hcd_probe+0x1c1/0x490 [ 73.723805][ T5019] platform_probe+0x100/0x200 [ 73.728489][ T5019] really_probe+0x240/0xca0 [ 73.733869][ T5019] __driver_probe_device+0x1df/0x4b0 [ 73.739151][ T5019] driver_probe_device+0x4c/0x1a0 [ 73.744259][ T5019] page last free stack trace: [ 73.748921][ T5019] free_unref_page_prepare+0x62e/0xcb0 [ 73.754487][ T5019] free_unref_page+0x33/0x370 [ 73.759162][ T5019] vfree+0x180/0x7e0 [ 73.763057][ T5019] delayed_vfree_work+0x57/0x70 [ 73.767909][ T5019] process_one_work+0x99a/0x15e0 [ 73.772957][ T5019] worker_thread+0x67d/0x10c0 [ 73.777639][ T5019] kthread+0x344/0x440 [ 73.781717][ T5019] ret_from_fork+0x1f/0x30 [ 73.786158][ T5019] [ 73.788478][ T5019] Memory state around the buggy address: [ 73.794114][ T5019] ffff8880220e3b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 73.802173][ T5019] ffff8880220e3b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 73.810229][ T5019] >ffff8880220e3c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 73.818895][ T5019] ^ [ 73.822995][ T5019] ffff8880220e3c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 73.831078][ T5019] ffff8880220e3d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 73.839145][ T5019] ================================================================== [ 73.847991][ T5019] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 73.855208][ T5019] CPU: 1 PID: 5019 Comm: syz-executor134 Not tainted 6.4.0-rc6-syzkaller-00006-gfd37b884003c #0 [ 73.865645][ T5019] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023 [ 73.875727][ T5019] Call Trace: [ 73.879021][ T5019] [ 73.881963][ T5019] dump_stack_lvl+0xd9/0x150 [ 73.886575][ T5019] panic+0x686/0x730 [ 73.890509][ T5019] ? panic_smp_self_stop+0xa0/0xa0 [ 73.895651][ T5019] ? preempt_schedule_thunk+0x1a/0x20 [ 73.901058][ T5019] ? preempt_schedule_common+0x45/0xb0 [pid 5021] <... prctl resumed>) = 0 [pid 5018] <... ioctl resumed>) = 0 [pid 5017] <... ioctl resumed>) = 0 [pid 5015] <... ioctl resumed>) = 0 [pid 5014] ioctl(4, LOOP_SET_BLOCK_SIZE, 2048 [pid 5021] setpgid(0, 0 [pid 5015] exit_group(0 [pid 5021] <... setpgid resumed>) = 0 [pid 5015] <... exit_group resumed>) = ? [pid 5021] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5015] +++ exited with 0 +++ [pid 5021] <... openat resumed>) = 3 [pid 4992] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5015, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5021] write(3, "1000", 4 [pid 4992] restart_syscall(<... resuming interrupted clone ...> [pid 5021] <... write resumed>) = 4 [pid 4992] <... restart_syscall resumed>) = 0 [pid 5021] close(3) = 0 [pid 5021] symlink("/dev/binderfs", "./binderfs" [pid 4992] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5021] <... symlink resumed>) = 0 [pid 4992] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5021] memfd_create("syzkaller", 0 [pid 4992] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5021] <... memfd_create resumed>) = 3 [pid 4992] <... openat resumed>) = 3 [pid 5021] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 4992] fstat(3, [pid 5021] <... mmap resumed>) = 0x7f197117a000 [pid 4992] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5021] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 [pid 4992] getdents64(3, [pid 5021] <... write resumed>) = 524288 [pid 4992] <... getdents64 resumed>0x555555af4620 /* 4 entries */, 32768) = 112 [pid 4992] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 4992] lstat("./2/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 4992] unlink("./2/binderfs") = 0 [pid 5021] munmap(0x7f197117a000, 524288 [pid 4992] umount2("./2/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 5021] <... munmap resumed>) = 0 [pid 5021] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 5021] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5021] close(3) = 0 [pid 5021] mkdir("./file0", 0777) = 0 [pid 5021] mount("/dev/loop4", "./file0", "hfsplus", 0, "" [pid 5018] exit_group(0 [pid 5017] exit_group(0 [pid 4992] <... umount2 resumed>) = 0 [pid 5018] <... exit_group resumed>) = ? [pid 5017] <... exit_group resumed>) = ? [pid 5014] <... ioctl resumed>) = 0 [pid 5018] +++ exited with 0 +++ [pid 4991] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5018, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5017] +++ exited with 0 +++ [pid 4990] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5017, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- [pid 4990] restart_syscall(<... resuming interrupted clone ...> [pid 5014] exit_group(0 [pid 4990] <... restart_syscall resumed>) = 0 [pid 4990] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4991] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4990] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5014] <... exit_group resumed>) = ? [pid 4991] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 4990] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5014] +++ exited with 0 +++ [pid 4991] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 4990] <... openat resumed>) = 3 [pid 4993] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5014, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 4991] <... openat resumed>) = 3 [pid 4990] fstat(3, [pid 4991] fstat(3, [pid 4990] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 4991] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 4990] getdents64(3, [pid 4993] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4991] getdents64(3, [pid 4990] <... getdents64 resumed>0x555555af4620 /* 4 entries */, 32768) = 112 [pid 4993] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 4991] <... getdents64 resumed>0x555555af4620 /* 4 entries */, 32768) = 112 [pid 4990] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4993] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 4991] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4990] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 4993] <... openat resumed>) = 3 [pid 4991] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 4990] lstat("./2/binderfs", [pid 4993] fstat(3, [pid 4992] umount2("./2/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4991] lstat("./2/binderfs", [pid 4990] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 4993] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 4992] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 4991] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 4990] unlink("./2/binderfs" [pid 4993] getdents64(3, [pid 4992] lstat("./2/file0", [pid 4991] unlink("./2/binderfs" [pid 4990] <... unlink resumed>) = 0 [pid 4993] <... getdents64 resumed>0x555555af4620 /* 4 entries */, 32768) = 112 [pid 4992] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 4991] <... unlink resumed>) = 0 [pid 4990] umount2("./2/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4993] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4992] umount2("./2/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4991] umount2("./2/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 4993] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 4992] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [ 73.906564][ T5019] check_panic_on_warn+0xb1/0xc0 [ 73.911553][ T5019] end_report+0xe9/0x120 [ 73.915933][ T5019] ? hfsplus_read_wrapper+0xf62/0x1020 [ 73.921418][ T5019] kasan_report+0xf9/0x130 [ 73.925863][ T5019] ? hfsplus_read_wrapper+0xf62/0x1020 [ 73.931351][ T5019] hfsplus_read_wrapper+0xf62/0x1020 [ 73.936662][ T5019] ? lock_downgrade+0x690/0x690 [ 73.941542][ T5019] ? hfsplus_submit_bio+0x2b0/0x2b0 [ 73.946781][ T5019] ? spin_bug+0x1c0/0x1c0 [ 73.951227][ T5019] ? mark_held_locks+0x9f/0xe0 [ 73.956022][ T5019] ? do_raw_spin_unlock+0x175/0x230 [ 73.961255][ T5019] ? _raw_spin_unlock+0x28/0x40 [ 73.966136][ T5019] ? find_nls+0x121/0x160 [ 73.970497][ T5019] hfsplus_fill_super+0x312/0x1c40 [ 73.975645][ T5019] ? ip6_addr_string_sa+0x830/0x830 [ 73.980889][ T5019] ? hfsplus_iget+0x7c0/0x7c0 [ 73.985695][ T5019] ? bdev_name.constprop.0+0x270/0x4d0 [ 73.991375][ T5019] ? fourcc_string+0x770/0x770 [ 73.996173][ T5019] ? pointer+0x173/0xc50 [ 74.000534][ T5019] ? vsscanf+0x8af/0x2600 [ 74.004894][ T5019] ? resource_string.isra.0+0x16c0/0x16c0 [ 74.010666][ T5019] ? vsnprintf+0x4df/0x1710 [ 74.015208][ T5019] ? pointer+0xc50/0xc50 [ 74.019483][ T5019] ? snprintf+0xbf/0x100 [ 74.023759][ T5019] ? vsprintf+0x30/0x30 [ 74.028118][ T5019] ? wait_for_completion_io_timeout+0x20/0x20 [ 74.034227][ T5019] ? set_blocksize+0x2d8/0x370 [ 74.039030][ T5019] mount_bdev+0x358/0x420 [ 74.043397][ T5019] ? hfsplus_iget+0x7c0/0x7c0 [ 74.048110][ T5019] ? zisofs_cleanup+0x20/0x20 [ 74.052818][ T5019] legacy_get_tree+0x109/0x220 [ 74.057623][ T5019] vfs_get_tree+0x8d/0x350 [ 74.062068][ T5019] path_mount+0x134b/0x1e40 [ 74.066605][ T5019] ? putname+0x102/0x140 [ 74.071319][ T5019] ? lockdep_hardirqs_on+0x7d/0x100 [ 74.077304][ T5019] ? finish_automount+0x9b0/0x9b0 [ 74.082361][ T5019] ? putname+0x102/0x140 [ 74.086633][ T5019] __x64_sys_mount+0x283/0x300 [ 74.091426][ T5019] ? copy_mnt_ns+0xb30/0xb30 [ 74.096134][ T5019] ? lockdep_hardirqs_on+0x7d/0x100 [ 74.101359][ T5019] ? _raw_spin_unlock_irq+0x2e/0x50 [ 74.106592][ T5019] ? ptrace_notify+0xfe/0x140 [ 74.111493][ T5019] do_syscall_64+0x39/0xb0 [ 74.116072][ T5019] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 74.122113][ T5019] RIP: 0033:0x7f19795c8f1a [ 74.126651][ T5019] Code: 48 c7 c2 c0 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 a8 00 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 74.146283][ T5019] RSP: 002b:00007ffcee9fec18 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [ 74.154716][ T5019] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f19795c8f1a [ 74.162692][ T5019] RDX: 0000000020000000 RSI: 0000000020000640 RDI: 00007ffcee9fec30 [ 74.170660][ T5019] RBP: 00007ffcee9fec30 R08: 00007ffcee9fec70 R09: 00000000000005cd [ 74.178713][ T5019] R10: 0000000000000000 R11: 0000000000000286 R12: 0000000000000004 [ 74.186678][ T5019] R13: 0000555555af32c0 R14: 0000000000000000 R15: 00007ffcee9fec70 [ 74.194648][ T5019] [ 74.197883][ T5019] Kernel Offset: disabled [ 74.202198][ T5019] Rebooting in 86400 seconds..