./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor415410613
<...>
Warning: Permanently added '10.128.1.176' (ED25519) to the list of known hosts.
execve("./syz-executor415410613", ["./syz-executor415410613"], 0x7fffd3c483f0 /* 10 vars */) = 0
brk(NULL) = 0x55556e885000
brk(0x55556e885d00) = 0x55556e885d00
arch_prctl(ARCH_SET_FS, 0x55556e885380) = 0
set_tid_address(0x55556e885650) = 5831
set_robust_list(0x55556e885660, 24) = 0
rseq(0x55556e885ca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor415410613", 4096) = 27
getrandom("\x51\x1f\x5b\x88\xa3\x2b\xdf\x9c", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x55556e885d00
brk(0x55556e8a6d00) = 0x55556e8a6d00
brk(0x55556e8a7000) = 0x55556e8a7000
mprotect(0x7fbaf8a4c000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
mkdir("./syzkaller.YtVSyU", 0700) = 0
chmod("./syzkaller.YtVSyU", 0777) = 0
chdir("./syzkaller.YtVSyU") = 0
mkdir("./0", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5832 attached
, child_tidptr=0x55556e885650) = 5832
[pid 5832] set_robust_list(0x55556e885660, 24) = 0
[pid 5832] chdir("./0") = 0
[pid 5832] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5832] setpgid(0, 0) = 0
[pid 5832] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5832] write(3, "1000", 4) = 4
[pid 5832] close(3) = 0
[pid 5832] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 5832] write(1, "executing program\n", 18) = 18
[pid 5832] memfd_create("syzkaller", 0) = 3
[pid 5832] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbaf0400000
[pid 5832] write(3, "\xb5\x84\x31\x7b\xb6\x84\x31\x7b\xb7\x84\x31\x7b\xb8\x84\x31\x7b\xb9\x84\x31\x7b\xba\x84\x31\x7b\xbb\x84\x31\x7b\xbc\x84\x31\x7b\xbd\x84\x31\x7b\xbe\x84\x31\x7b\xbf\x84\x31\x7b\xc0\x84\x31\x7b\xc1\x84\x31\x7b\xc2\x84\x31\x7b\xc3\x84\x31\x7b\xc4\x84\x31\x7b\xc5\x84\x31\x7b\xc6\x84\x31\x7b\xc7\x84\x31\x7b\xc8\x84\x31\x7b\xc9\x84\x31\x7b\xca\x84\x31\x7b\xcb\x84\x31\x7b\xcc\x84\x31\x7b\xcd\x84\x31\x7b"..., 65536) = 65536
[pid 5832] munmap(0x7fbaf0400000, 138412032) = 0
[pid 5832] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 5832] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 5832] close(3) = 0
[pid 5832] close(4) = 0
[pid 5832] mkdir("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", 0777) = 0
[pid 5832] mount("/dev/loop0", "\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", "sysv", 0, "") = 0
[pid 5832] openat(AT_FDCWD, "\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", O_RDONLY|O_DIRECTORY) = 3
[pid 5832] chdir("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f") = 0
[pid 5832] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy)
[ 76.851511][ T5832] loop0: detected capacity change from 0 to 128
[ 76.874776][ T5832] VFS: Found a Xenix FS (block size = 1024) on device loop0
[ 76.889827][ T5832] syz-executor415: attempt to access beyond end of device
[pid 5832] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOATIME|FASYNC, 000) = -1 EIO (Input/output error)
[pid 5832] exit_group(0) = ?
[pid 5832] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5832, si_uid=0, si_status=0, si_utime=0, si_stime=6 /* 0.06 s */} ---
[ 76.889827][ T5832] loop0: rw=0, sector=6491536, nr_sectors = 2 limit=128
[ 76.904678][ T5832] Buffer I/O error on dev loop0, logical block 3245768, async page read
[ 76.923736][ T5832] syz-executor415: attempt to access beyond end of device
[ 76.923736][ T5832] loop0: rw=0, sector=6491536, nr_sectors = 2 limit=128
[ 76.938125][ T5832] Buffer I/O error on dev loop0, logical block 3245768, async page read
umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x55556e8866f0 /* 4 entries */, 32768) = 176
umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./0/binderfs") = 0
[ 77.079053][ T5831] sysv_free_block: flc_count > flc_size
[ 77.085661][ T5831] sysv_free_block: flc_count > flc_size
[ 77.091313][ T5831] sysv_free_block: flc_count > flc_size
[ 77.097156][ T5831] sysv_free_block: flc_count > flc_size
[ 77.102761][ T5831] sysv_free_block: flc_count > flc_size
[ 77.108425][ T5831] sysv_free_block: flc_count > flc_size
[ 77.114208][ T5831] sysv_free_block: flc_count > flc_size
[ 77.119999][ T5831] sysv_free_block: flc_count > flc_size
umount2("\x2e\x2f\x30\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("\x2e\x2f\x30\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "\x2e\x2f\x30\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
[ 77.125682][ T5831] sysv_free_block: flc_count > flc_size
[ 77.131235][ T5831] sysv_free_block: flc_count > flc_size
[ 77.137555][ T5831] sysv_free_inode: inode 0,1,2 or nonexistent inode
umount2("\x2e\x2f\x30\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "\x2e\x2f\x30\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x55556e88e730 /* 2 entries */, 32768) = 48
getdents64(4, 0x55556e88e730 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("\x2e\x2f\x30\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38") = 0
getdents64(3, 0x55556e8866f0 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./0") = 0
mkdir("./1", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = 0
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5834 attached
, child_tidptr=0x55556e885650) = 5834
[pid 5834] set_robust_list(0x55556e885660, 24) = 0
[pid 5834] chdir("./1") = 0
[pid 5834] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5834] setpgid(0, 0) = 0
[pid 5834] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5834] write(3, "1000", 4) = 4
[pid 5834] close(3) = 0
[pid 5834] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 5834] write(1, "executing program\n", 18) = 18
[pid 5834] memfd_create("syzkaller", 0) = 3
[pid 5834] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbaf0400000
[pid 5834] write(3, "\xb5\x84\x31\x7b\xb6\x84\x31\x7b\xb7\x84\x31\x7b\xb8\x84\x31\x7b\xb9\x84\x31\x7b\xba\x84\x31\x7b\xbb\x84\x31\x7b\xbc\x84\x31\x7b\xbd\x84\x31\x7b\xbe\x84\x31\x7b\xbf\x84\x31\x7b\xc0\x84\x31\x7b\xc1\x84\x31\x7b\xc2\x84\x31\x7b\xc3\x84\x31\x7b\xc4\x84\x31\x7b\xc5\x84\x31\x7b\xc6\x84\x31\x7b\xc7\x84\x31\x7b\xc8\x84\x31\x7b\xc9\x84\x31\x7b\xca\x84\x31\x7b\xcb\x84\x31\x7b\xcc\x84\x31\x7b\xcd\x84\x31\x7b"..., 65536) = 65536
[pid 5834] munmap(0x7fbaf0400000, 138412032) = 0
[pid 5834] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 5834] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 5834] close(3) = 0
[pid 5834] close(4) = 0
[pid 5834] mkdir("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", 0777) = 0
[ 77.407352][ T5834] loop0: detected capacity change from 0 to 128
[pid 5834] mount("/dev/loop0", "\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", "sysv", 0, "") = 0
[pid 5834] openat(AT_FDCWD, "\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", O_RDONLY|O_DIRECTORY) = 3
[pid 5834] chdir("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f") = 0
[pid 5834] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy)
[ 77.459052][ T5834] VFS: Found a Xenix FS (block size = 1024) on device loop0
[ 77.491719][ T5834] syz-executor415: attempt to access beyond end of device
[ 77.491719][ T5834] loop0: rw=0, sector=6491536, nr_sectors = 2 limit=128
[ 77.505953][ T5834] Buffer I/O error on dev loop0, logical block 3245768, async page read
[pid 5834] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOATIME|FASYNC, 000) = -1 EIO (Input/output error)
[pid 5834] exit_group(0) = ?
[pid 5834] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5834, si_uid=0, si_status=0, si_utime=0, si_stime=6 /* 0.06 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x55556e8866f0 /* 4 entries */, 32768) = 176
umount2("./1/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[ 77.529887][ T5834] syz-executor415: attempt to access beyond end of device
[ 77.529887][ T5834] loop0: rw=0, sector=6491536, nr_sectors = 2 limit=128
[ 77.544129][ T5834] Buffer I/O error on dev loop0, logical block 3245768, async page read
newfstatat(AT_FDCWD, "./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./1/binderfs") = 0
[ 77.604692][ T5831] sysv_free_block: flc_count > flc_size
[ 77.610565][ T5831] sysv_free_block: flc_count > flc_size
[ 77.616205][ T5831] sysv_free_block: flc_count > flc_size
[ 77.621794][ T5831] sysv_free_block: flc_count > flc_size
[ 77.627459][ T5831] sysv_free_block: flc_count > flc_size
[ 77.633051][ T5831] sysv_free_block: flc_count > flc_size
[ 77.638712][ T5831] sysv_free_block: flc_count > flc_size
[ 77.644403][ T5831] sysv_free_block: flc_count > flc_size
umount2("\x2e\x2f\x31\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("\x2e\x2f\x31\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "\x2e\x2f\x31\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("\x2e\x2f\x31\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[ 77.650054][ T5831] sysv_free_block: flc_count > flc_size
[ 77.655747][ T5831] sysv_free_block: flc_count > flc_size
[ 77.662179][ T5831] sysv_free_inode: inode 0,1,2 or nonexistent inode
openat(AT_FDCWD, "\x2e\x2f\x31\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x55556e88e730 /* 2 entries */, 32768) = 48
getdents64(4, 0x55556e88e730 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("\x2e\x2f\x31\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38") = 0
getdents64(3, 0x55556e8866f0 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./1") = 0
mkdir("./2", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = 0
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e885650) = 5835
./strace-static-x86_64: Process 5835 attached
[pid 5835] set_robust_list(0x55556e885660, 24) = 0
[pid 5835] chdir("./2") = 0
[pid 5835] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5835] setpgid(0, 0) = 0
[pid 5835] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5835] write(3, "1000", 4) = 4
[pid 5835] close(3) = 0
[pid 5835] symlink("/dev/binderfs", "./binderfs") = 0
[pid 5835] write(1, "executing program\n", 18executing program
) = 18
[pid 5835] memfd_create("syzkaller", 0) = 3
[pid 5835] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbaf0400000
[pid 5835] write(3, "\xb5\x84\x31\x7b\xb6\x84\x31\x7b\xb7\x84\x31\x7b\xb8\x84\x31\x7b\xb9\x84\x31\x7b\xba\x84\x31\x7b\xbb\x84\x31\x7b\xbc\x84\x31\x7b\xbd\x84\x31\x7b\xbe\x84\x31\x7b\xbf\x84\x31\x7b\xc0\x84\x31\x7b\xc1\x84\x31\x7b\xc2\x84\x31\x7b\xc3\x84\x31\x7b\xc4\x84\x31\x7b\xc5\x84\x31\x7b\xc6\x84\x31\x7b\xc7\x84\x31\x7b\xc8\x84\x31\x7b\xc9\x84\x31\x7b\xca\x84\x31\x7b\xcb\x84\x31\x7b\xcc\x84\x31\x7b\xcd\x84\x31\x7b"..., 65536) = 65536
[pid 5835] munmap(0x7fbaf0400000, 138412032) = 0
[pid 5835] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 5835] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 5835] close(3) = 0
[pid 5835] close(4) = 0
[pid 5835] mkdir("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", 0777) = 0
[ 77.946737][ T5835] loop0: detected capacity change from 0 to 128
[pid 5835] mount("/dev/loop0", "\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", "sysv", 0, "") = 0
[pid 5835] openat(AT_FDCWD, "\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", O_RDONLY|O_DIRECTORY) = 3
[pid 5835] chdir("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f") = 0
[pid 5835] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy)
[ 77.990576][ T5835] VFS: Found a Xenix FS (block size = 1024) on device loop0
[ 78.014594][ T5835] syz-executor415: attempt to access beyond end of device
[ 78.014594][ T5835] loop0: rw=0, sector=6491536, nr_sectors = 2 limit=128
[ 78.028931][ T5835] Buffer I/O error on dev loop0, logical block 3245768, async page read
[pid 5835] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOATIME|FASYNC, 000) = -1 EIO (Input/output error)
[pid 5835] exit_group(0) = ?
[pid 5835] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5835, si_uid=0, si_status=0, si_utime=0, si_stime=7 /* 0.07 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
[ 78.038353][ T5835] unable to read i-node block
[ 78.043427][ T5835] syz-executor415: attempt to access beyond end of device
[ 78.043427][ T5835] loop0: rw=0, sector=6491536, nr_sectors = 2 limit=128
[ 78.057590][ T5835] Buffer I/O error on dev loop0, logical block 3245768, async page read
[ 78.066301][ T5835] sysv_free_inode: unable to read inode block on device loop0
getdents64(3, 0x55556e8866f0 /* 4 entries */, 32768) = 176
umount2("./2/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./2/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./2/binderfs") = 0
[ 78.176668][ T5831] sysv_free_block: flc_count > flc_size
[ 78.182284][ T5831] sysv_free_block: flc_count > flc_size
[ 78.188139][ T5831] sysv_free_block: flc_count > flc_size
[ 78.193735][ T5831] sysv_free_block: flc_count > flc_size
[ 78.199389][ T5831] sysv_free_block: flc_count > flc_size
[ 78.205068][ T5831] sysv_free_block: flc_count > flc_size
[ 78.210631][ T5831] sysv_free_block: flc_count > flc_size
[ 78.216286][ T5831] sysv_free_block: flc_count > flc_size
umount2("\x2e\x2f\x32\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("\x2e\x2f\x32\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "\x2e\x2f\x32\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("\x2e\x2f\x32\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[ 78.221856][ T5831] sysv_free_block: flc_count > flc_size
[ 78.227609][ T5831] sysv_free_block: flc_count > flc_size
[ 78.233747][ T5831] sysv_free_inode: inode 0,1,2 or nonexistent inode
openat(AT_FDCWD, "\x2e\x2f\x32\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x55556e88e730 /* 2 entries */, 32768) = 48
getdents64(4, 0x55556e88e730 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("\x2e\x2f\x32\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38") = 0
getdents64(3, 0x55556e8866f0 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./2") = 0
mkdir("./3", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = 0
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e885650) = 5836
./strace-static-x86_64: Process 5836 attached
[pid 5836] set_robust_list(0x55556e885660, 24) = 0
[pid 5836] chdir("./3") = 0
[pid 5836] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5836] setpgid(0, 0) = 0
[pid 5836] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5836] write(3, "1000", 4) = 4
[pid 5836] close(3) = 0
[pid 5836] symlink("/dev/binderfs", "./binderfs") = 0
[pid 5836] write(1, "executing program\n", 18executing program
) = 18
[pid 5836] memfd_create("syzkaller", 0) = 3
[pid 5836] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbaf0400000
[pid 5836] write(3, "\xb5\x84\x31\x7b\xb6\x84\x31\x7b\xb7\x84\x31\x7b\xb8\x84\x31\x7b\xb9\x84\x31\x7b\xba\x84\x31\x7b\xbb\x84\x31\x7b\xbc\x84\x31\x7b\xbd\x84\x31\x7b\xbe\x84\x31\x7b\xbf\x84\x31\x7b\xc0\x84\x31\x7b\xc1\x84\x31\x7b\xc2\x84\x31\x7b\xc3\x84\x31\x7b\xc4\x84\x31\x7b\xc5\x84\x31\x7b\xc6\x84\x31\x7b\xc7\x84\x31\x7b\xc8\x84\x31\x7b\xc9\x84\x31\x7b\xca\x84\x31\x7b\xcb\x84\x31\x7b\xcc\x84\x31\x7b\xcd\x84\x31\x7b"..., 65536) = 65536
[pid 5836] munmap(0x7fbaf0400000, 138412032) = 0
[pid 5836] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 5836] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 5836] close(3) = 0
[pid 5836] close(4) = 0
[pid 5836] mkdir("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", 0777) = 0
[ 78.506737][ T5836] loop0: detected capacity change from 0 to 128
[pid 5836] mount("/dev/loop0", "\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", "sysv", 0, "") = 0
[pid 5836] openat(AT_FDCWD, "\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", O_RDONLY|O_DIRECTORY) = 3
[pid 5836] chdir("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f") = 0
[pid 5836] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy)
[ 78.547743][ T5836] VFS: Found a Xenix FS (block size = 1024) on device loop0
[ 78.591149][ T5836] syz-executor415: attempt to access beyond end of device
[ 78.591149][ T5836] loop0: rw=0, sector=6491536, nr_sectors = 2 limit=128
[ 78.605405][ T5836] Buffer I/O error on dev loop0, logical block 3245768, async page read
[ 78.629151][ T5836] syz-executor415: attempt to access beyond end of device
[pid 5836] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOATIME|FASYNC, 000) = -1 EIO (Input/output error)
[pid 5836] exit_group(0) = ?
[pid 5836] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5836, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./3", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
[ 78.629151][ T5836] loop0: rw=0, sector=6491536, nr_sectors = 2 limit=128
[ 78.643790][ T5836] Buffer I/O error on dev loop0, logical block 3245768, async page read
getdents64(3, 0x55556e8866f0 /* 4 entries */, 32768) = 176
umount2("./3/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./3/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./3/binderfs") = 0
[ 78.763453][ T5831] sysv_free_block: flc_count > flc_size
[ 78.769196][ T5831] sysv_free_block: flc_count > flc_size
[ 78.774813][ T5831] sysv_free_block: flc_count > flc_size
[ 78.780533][ T5831] sysv_free_block: flc_count > flc_size
[ 78.786244][ T5831] sysv_free_block: flc_count > flc_size
[ 78.791997][ T5831] sysv_free_block: flc_count > flc_size
[ 78.797665][ T5831] sysv_free_block: flc_count > flc_size
[ 78.803263][ T5831] sysv_free_block: flc_count > flc_size
umount2("\x2e\x2f\x33\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("\x2e\x2f\x33\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "\x2e\x2f\x33\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("\x2e\x2f\x33\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[ 78.808899][ T5831] sysv_free_block: flc_count > flc_size
[ 78.814612][ T5831] sysv_free_block: flc_count > flc_size
[ 78.820653][ T5831] sysv_free_inode: inode 0,1,2 or nonexistent inode
openat(AT_FDCWD, "\x2e\x2f\x33\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x55556e88e730 /* 2 entries */, 32768) = 48
getdents64(4, 0x55556e88e730 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("\x2e\x2f\x33\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38") = 0
getdents64(3, 0x55556e8866f0 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./3") = 0
mkdir("./4", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = 0
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5837 attached
, child_tidptr=0x55556e885650) = 5837
[pid 5837] set_robust_list(0x55556e885660, 24) = 0
[pid 5837] chdir("./4") = 0
[pid 5837] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5837] setpgid(0, 0) = 0
[pid 5837] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5837] write(3, "1000", 4) = 4
[pid 5837] close(3) = 0
[pid 5837] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 5837] write(1, "executing program\n", 18) = 18
[pid 5837] memfd_create("syzkaller", 0) = 3
[pid 5837] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbaf0400000
[pid 5837] write(3, "\xb5\x84\x31\x7b\xb6\x84\x31\x7b\xb7\x84\x31\x7b\xb8\x84\x31\x7b\xb9\x84\x31\x7b\xba\x84\x31\x7b\xbb\x84\x31\x7b\xbc\x84\x31\x7b\xbd\x84\x31\x7b\xbe\x84\x31\x7b\xbf\x84\x31\x7b\xc0\x84\x31\x7b\xc1\x84\x31\x7b\xc2\x84\x31\x7b\xc3\x84\x31\x7b\xc4\x84\x31\x7b\xc5\x84\x31\x7b\xc6\x84\x31\x7b\xc7\x84\x31\x7b\xc8\x84\x31\x7b\xc9\x84\x31\x7b\xca\x84\x31\x7b\xcb\x84\x31\x7b\xcc\x84\x31\x7b\xcd\x84\x31\x7b"..., 65536) = 65536
[pid 5837] munmap(0x7fbaf0400000, 138412032) = 0
[pid 5837] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 5837] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 5837] close(3) = 0
[pid 5837] close(4) = 0
[pid 5837] mkdir("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", 0777) = 0
[ 79.074067][ T5837] loop0: detected capacity change from 0 to 128
[pid 5837] mount("/dev/loop0", "\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", "sysv", 0, "") = 0
[pid 5837] openat(AT_FDCWD, "\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", O_RDONLY|O_DIRECTORY) = 3
[pid 5837] chdir("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f") = 0
[pid 5837] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy)
[ 79.115349][ T5837] VFS: Found a Xenix FS (block size = 1024) on device loop0
[ 79.146734][ T5837] syz-executor415: attempt to access beyond end of device
[ 79.146734][ T5837] loop0: rw=0, sector=6491536, nr_sectors = 2 limit=128
[pid 5837] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOATIME|FASYNC, 000) = -1 EIO (Input/output error)
[pid 5837] exit_group(0) = ?
[pid 5837] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5837, si_uid=0, si_status=0, si_utime=0, si_stime=6 /* 0.06 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./4", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[ 79.161018][ T5837] Buffer I/O error on dev loop0, logical block 3245768, async page read
[ 79.169739][ T5837] unable to read i-node block
[ 79.174569][ T5837] syz-executor415: attempt to access beyond end of device
[ 79.174569][ T5837] loop0: rw=0, sector=6491536, nr_sectors = 2 limit=128
[ 79.188628][ T5837] Buffer I/O error on dev loop0, logical block 3245768, async page read
[ 79.197185][ T5837] sysv_free_inode: unable to read inode block on device loop0
openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x55556e8866f0 /* 4 entries */, 32768) = 176
umount2("./4/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./4/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./4/binderfs") = 0
[ 79.346573][ T5831] sysv_free_block: flc_count > flc_size
[ 79.352184][ T5831] sysv_free_block: flc_count > flc_size
[ 79.357979][ T5831] sysv_free_block: flc_count > flc_size
[ 79.363569][ T5831] sysv_free_block: flc_count > flc_size
[ 79.369191][ T5831] sysv_free_block: flc_count > flc_size
[ 79.374764][ T5831] sysv_free_block: flc_count > flc_size
[ 79.380510][ T5831] sysv_free_block: flc_count > flc_size
[ 79.386163][ T5831] sysv_free_block: flc_count > flc_size
umount2("\x2e\x2f\x34\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("\x2e\x2f\x34\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "\x2e\x2f\x34\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("\x2e\x2f\x34\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[ 79.391736][ T5831] sysv_free_block: flc_count > flc_size
[ 79.397402][ T5831] sysv_free_block: flc_count > flc_size
[ 79.403324][ T5831] sysv_free_inode: inode 0,1,2 or nonexistent inode
openat(AT_FDCWD, "\x2e\x2f\x34\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x55556e88e730 /* 2 entries */, 32768) = 48
getdents64(4, 0x55556e88e730 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("\x2e\x2f\x34\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38") = 0
getdents64(3, 0x55556e8866f0 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./4") = 0
mkdir("./5", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = 0
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5838 attached
, child_tidptr=0x55556e885650) = 5838
[pid 5838] set_robust_list(0x55556e885660, 24) = 0
[pid 5838] chdir("./5") = 0
[pid 5838] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5838] setpgid(0, 0) = 0
[pid 5838] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5838] write(3, "1000", 4) = 4
[pid 5838] close(3) = 0
[pid 5838] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 5838] write(1, "executing program\n", 18) = 18
[pid 5838] memfd_create("syzkaller", 0) = 3
[pid 5838] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbaf0400000
[pid 5838] write(3, "\xb5\x84\x31\x7b\xb6\x84\x31\x7b\xb7\x84\x31\x7b\xb8\x84\x31\x7b\xb9\x84\x31\x7b\xba\x84\x31\x7b\xbb\x84\x31\x7b\xbc\x84\x31\x7b\xbd\x84\x31\x7b\xbe\x84\x31\x7b\xbf\x84\x31\x7b\xc0\x84\x31\x7b\xc1\x84\x31\x7b\xc2\x84\x31\x7b\xc3\x84\x31\x7b\xc4\x84\x31\x7b\xc5\x84\x31\x7b\xc6\x84\x31\x7b\xc7\x84\x31\x7b\xc8\x84\x31\x7b\xc9\x84\x31\x7b\xca\x84\x31\x7b\xcb\x84\x31\x7b\xcc\x84\x31\x7b\xcd\x84\x31\x7b"..., 65536) = 65536
[pid 5838] munmap(0x7fbaf0400000, 138412032) = 0
[pid 5838] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 5838] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 5838] close(3) = 0
[pid 5838] close(4) = 0
[pid 5838] mkdir("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", 0777) = 0
[pid 5838] mount("/dev/loop0", "\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", "sysv", 0, "") = 0
[pid 5838] openat(AT_FDCWD, "\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", O_RDONLY|O_DIRECTORY) = 3
[pid 5838] chdir("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f") = 0
[pid 5838] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy)
[ 79.722459][ T5838] loop0: detected capacity change from 0 to 128
[ 79.739849][ T5838] VFS: Found a Xenix FS (block size = 1024) on device loop0
[ 79.754264][ T5838] ==================================================================
[ 79.762399][ T5838] BUG: KASAN: use-after-free in sysv_new_inode+0xfc7/0x1160
[ 79.769781][ T5838] Read of size 2 at addr ffff888075ea61ce by task syz-executor415/5838
[ 79.778032][ T5838]
[ 79.780389][ T5838] CPU: 1 UID: 0 PID: 5838 Comm: syz-executor415 Not tainted 6.12.0-syzkaller-00171-g23acd177540d #0
[ 79.791159][ T5838] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024
[ 79.801256][ T5838] Call Trace:
[ 79.804555][ T5838]
[ 79.807527][ T5838] dump_stack_lvl+0x241/0x360
[ 79.812234][ T5838] ? __pfx_dump_stack_lvl+0x10/0x10
[ 79.817443][ T5838] ? __pfx__printk+0x10/0x10
[ 79.822128][ T5838] ? _printk+0xd5/0x120
[ 79.826294][ T5838] ? __virt_addr_valid+0x183/0x530
[ 79.831997][ T5838] ? __virt_addr_valid+0x183/0x530
[ 79.837121][ T5838] print_report+0x169/0x550
[ 79.841818][ T5838] ? __virt_addr_valid+0x183/0x530
[ 79.846976][ T5838] ? __virt_addr_valid+0x183/0x530
[ 79.852127][ T5838] ? __virt_addr_valid+0x45f/0x530
[ 79.857356][ T5838] ? __phys_addr+0xba/0x170
[ 79.861913][ T5838] ? sysv_new_inode+0xfc7/0x1160
[ 79.866954][ T5838] kasan_report+0x143/0x180
[ 79.871474][ T5838] ? sysv_new_inode+0xfc7/0x1160
[ 79.876444][ T5838] sysv_new_inode+0xfc7/0x1160
[ 79.881231][ T5838] ? __pfx_sysv_new_inode+0x10/0x10
[ 79.886474][ T5838] ? _raw_spin_unlock+0x28/0x50
[ 79.891353][ T5838] ? __d_add+0x500/0x800
[ 79.895653][ T5838] sysv_mknod+0x4e/0xe0
[ 79.899861][ T5838] ? __pfx_sysv_create+0x10/0x10
[ 79.905287][ T5838] path_openat+0x1c03/0x3590
[ 79.909946][ T5838] ? __pfx_path_openat+0x10/0x10
[ 79.914942][ T5838] do_filp_open+0x235/0x490
[ 79.919579][ T5838] ? __pfx_do_filp_open+0x10/0x10
[ 79.924636][ T5838] ? do_raw_spin_lock+0x14f/0x370
[ 79.929790][ T5838] ? alloc_fd+0x61a/0x690
[ 79.934135][ T5838] do_sys_openat2+0x13e/0x1d0
[ 79.938823][ T5838] ? __pfx_do_sys_openat2+0x10/0x10
[ 79.944813][ T5838] ? lockdep_hardirqs_on+0x99/0x150
[ 79.950019][ T5838] ? _raw_spin_unlock_irq+0x2e/0x50
[ 79.955240][ T5838] ? ptrace_notify+0x279/0x380
[ 79.960034][ T5838] __x64_sys_open+0x225/0x270
[ 79.964721][ T5838] ? __pfx___x64_sys_open+0x10/0x10
[ 79.969947][ T5838] ? do_syscall_64+0x100/0x230
[ 79.974740][ T5838] do_syscall_64+0xf3/0x230
[ 79.979251][ T5838] ? clear_bhb_loop+0x35/0x90
[ 79.983970][ T5838] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 79.989913][ T5838] RIP: 0033:0x7fbaf89ce0e9
[ 79.994346][ T5838] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 21 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 80.014157][ T5838] RSP: 002b:00007fffefec9918 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
[ 80.022611][ T5838] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fbaf89ce0e9
[ 80.030691][ T5838] RDX: 0000000000000000 RSI: 0000000000143142 RDI: 0000000020000040
[ 80.038795][ T5838] RBP: 00000000ffffffff R08: 0000000000009e87 R09: 0000000000000000
[ 80.046797][ T5838] R10: 00007fffefec99a0 R11: 0000000000000246 R12: 00007fffefec9960
[ 80.054816][ T5838] R13: 00007fffefec99a0 R14: 0000000000010000 R15: 0000000000000003
[ 80.062927][ T5838]
[ 80.065964][ T5838]
[ 80.068288][ T5838] The buggy address belongs to the physical page:
[ 80.074737][ T5838] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x7f0f7ba0f pfn:0x75ea6
[ 80.084216][ T5838] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 80.091344][ T5838] raw: 00fff00000000000 dead000000000100 dead000000000122 0000000000000000
[ 80.099935][ T5838] raw: 00000007f0f7ba0f 0000000000000000 00000000ffffffff 0000000000000000
[ 80.108529][ T5838] page dumped because: kasan: bad access detected
[ 80.114964][ T5838] page_owner tracks the page as freed
[ 80.120339][ T5838] page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_ZERO), pid 5820, tgid 5820 (sshd), ts 70311537057, free_ts 70365425188
[ 80.138420][ T5838] post_alloc_hook+0x1f3/0x230
[ 80.143203][ T5838] get_page_from_freelist+0x363e/0x3790
[ 80.148772][ T5838] __alloc_pages_noprof+0x292/0x710
[ 80.154018][ T5838] alloc_pages_mpol_noprof+0x3e8/0x680
[ 80.159662][ T5838] vma_alloc_folio_noprof+0x12e/0x230
[ 80.165067][ T5838] folio_prealloc+0x31/0x170
[ 80.169674][ T5838] handle_pte_fault+0x24dd/0x6820
[ 80.174813][ T5838] handle_mm_fault+0x1053/0x1ad0
[ 80.179765][ T5838] exc_page_fault+0x459/0x8c0
[ 80.184541][ T5838] asm_exc_page_fault+0x26/0x30
[ 80.189501][ T5838] page last free pid 5820 tgid 5820 stack trace:
[ 80.195831][ T5838] free_unref_folios+0xf21/0x1a10
[ 80.200871][ T5838] folios_put_refs+0x76c/0x860
[ 80.205668][ T5838] free_pages_and_swap_cache+0x2ea/0x690
[ 80.211341][ T5838] tlb_flush_mmu+0x3a3/0x680
[ 80.216033][ T5838] tlb_finish_mmu+0xd4/0x200
[ 80.220673][ T5838] vms_clear_ptes+0x437/0x530
[ 80.225365][ T5838] vms_complete_munmap_vmas+0x214/0x8f0
[ 80.230924][ T5838] do_vmi_align_munmap+0x5ef/0x6f0
[ 80.236063][ T5838] do_vmi_munmap+0x24e/0x2d0
[ 80.240676][ T5838] __vm_munmap+0x24c/0x480
[ 80.245199][ T5838] __x64_sys_munmap+0x60/0x70
[ 80.249882][ T5838] do_syscall_64+0xf3/0x230
[ 80.254505][ T5838] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 80.260432][ T5838]
[ 80.262783][ T5838] Memory state around the buggy address:
[ 80.268437][ T5838] ffff888075ea6080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 80.276614][ T5838] ffff888075ea6100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 80.284682][ T5838] >ffff888075ea6180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 80.292743][ T5838] ^
[ 80.299159][ T5838] ffff888075ea6200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 80.307226][ T5838] ffff888075ea6280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 80.315287][ T5838] ==================================================================
[ 80.324641][ T5838] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 80.331887][ T5838] CPU: 0 UID: 0 PID: 5838 Comm: syz-executor415 Not tainted 6.12.0-syzkaller-00171-g23acd177540d #0
[ 80.342683][ T5838] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024
[ 80.352751][ T5838] Call Trace:
[ 80.356036][ T5838]
[ 80.358974][ T5838] dump_stack_lvl+0x241/0x360
[ 80.363687][ T5838] ? __pfx_dump_stack_lvl+0x10/0x10
[ 80.368901][ T5838] ? __pfx__printk+0x10/0x10
[ 80.373591][ T5838] ? preempt_schedule+0xe1/0xf0
[ 80.378489][ T5838] ? vscnprintf+0x5d/0x90
[ 80.382833][ T5838] panic+0x349/0x880
[ 80.386749][ T5838] ? check_panic_on_warn+0x21/0xb0
[ 80.391873][ T5838] ? __pfx_panic+0x10/0x10
[ 80.396309][ T5838] ? _raw_spin_unlock_irqrestore+0x130/0x140
[ 80.402312][ T5838] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 80.408657][ T5838] ? print_report+0x502/0x550
[ 80.413617][ T5838] check_panic_on_warn+0x86/0xb0
[ 80.418577][ T5838] ? sysv_new_inode+0xfc7/0x1160
[ 80.423558][ T5838] end_report+0x77/0x160
[ 80.427812][ T5838] kasan_report+0x154/0x180
[ 80.432323][ T5838] ? sysv_new_inode+0xfc7/0x1160
[ 80.437280][ T5838] sysv_new_inode+0xfc7/0x1160
[ 80.442068][ T5838] ? __pfx_sysv_new_inode+0x10/0x10
[ 80.447297][ T5838] ? _raw_spin_unlock+0x28/0x50
[ 80.452193][ T5838] ? __d_add+0x500/0x800
[ 80.456544][ T5838] sysv_mknod+0x4e/0xe0
[ 80.460723][ T5838] ? __pfx_sysv_create+0x10/0x10
[ 80.465682][ T5838] path_openat+0x1c03/0x3590
[ 80.470301][ T5838] ? __pfx_path_openat+0x10/0x10
[ 80.475262][ T5838] do_filp_open+0x235/0x490
[ 80.479782][ T5838] ? __pfx_do_filp_open+0x10/0x10
[ 80.484817][ T5838] ? do_raw_spin_lock+0x14f/0x370
[ 80.489877][ T5838] ? alloc_fd+0x61a/0x690
[ 80.494222][ T5838] do_sys_openat2+0x13e/0x1d0
[ 80.498911][ T5838] ? __pfx_do_sys_openat2+0x10/0x10
[ 80.504143][ T5838] ? lockdep_hardirqs_on+0x99/0x150
[ 80.509353][ T5838] ? _raw_spin_unlock_irq+0x2e/0x50
[ 80.514594][ T5838] ? ptrace_notify+0x279/0x380
[ 80.519465][ T5838] __x64_sys_open+0x225/0x270
[ 80.524598][ T5838] ? __pfx___x64_sys_open+0x10/0x10
[ 80.530018][ T5838] ? do_syscall_64+0x100/0x230
[ 80.534801][ T5838] do_syscall_64+0xf3/0x230
[ 80.539316][ T5838] ? clear_bhb_loop+0x35/0x90
[ 80.544003][ T5838] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 80.549911][ T5838] RIP: 0033:0x7fbaf89ce0e9
[ 80.554377][ T5838] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 21 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 80.574200][ T5838] RSP: 002b:00007fffefec9918 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
[ 80.582732][ T5838] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fbaf89ce0e9
[ 80.590715][ T5838] RDX: 0000000000000000 RSI: 0000000000143142 RDI: 0000000020000040
[ 80.598812][ T5838] RBP: 00000000ffffffff R08: 0000000000009e87 R09: 0000000000000000
[ 80.606794][ T5838] R10: 00007fffefec99a0 R11: 0000000000000246 R12: 00007fffefec9960
[ 80.614778][ T5838] R13: 00007fffefec99a0 R14: 0000000000010000 R15: 0000000000000003
[ 80.622766][ T5838]
[ 80.626152][ T5838] Kernel Offset: disabled
[ 80.630519][ T5838] Rebooting in 86400 seconds..