./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor726334699 <...> Warning: Permanently added '10.128.1.95' (ED25519) to the list of known hosts. execve("./syz-executor726334699", ["./syz-executor726334699"], 0x7ffdf8ed8950 /* 10 vars */) = 0 brk(NULL) = 0x5555689a0000 brk(0x5555689a0d00) = 0x5555689a0d00 arch_prctl(ARCH_SET_FS, 0x5555689a0380) = 0 set_tid_address(0x5555689a0650) = 5220 set_robust_list(0x5555689a0660, 24) = 0 rseq(0x5555689a0ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor726334699", 4096) = 27 getrandom("\x7a\x12\x17\x67\x1f\x4a\xcc\xab", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x5555689a0d00 brk(0x5555689c1d00) = 0x5555689c1d00 brk(0x5555689c2000) = 0x5555689c2000 mprotect(0x7fdfcc35c000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 mkdir("./syzkaller.OD1TQE", 0700) = 0 chmod("./syzkaller.OD1TQE", 0777) = 0 chdir("./syzkaller.OD1TQE") = 0 mkdir("./0", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5221 attached [pid 5221] set_robust_list(0x5555689a0660, 24 [pid 5220] <... clone resumed>, child_tidptr=0x5555689a0650) = 5221 [pid 5221] <... set_robust_list resumed>) = 0 [pid 5221] chdir("./0") = 0 [pid 5221] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5221] setpgid(0, 0) = 0 [pid 5221] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5221] write(3, "1000", 4) = 4 [pid 5221] close(3) = 0 [pid 5221] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5221] write(1, "executing program\n", 18executing program ) = 18 [pid 5221] memfd_create("syzkaller", 0) = 3 [pid 5221] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdfc3e00000 [pid 5221] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5221] munmap(0x7fdfc3e00000, 138412032) = 0 [pid 5221] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5221] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5221] close(3) = 0 [pid 5221] close(4) = 0 [pid 5221] mkdir("./file7", 0777) = 0 [pid 5221] mount("/dev/loop0", "./file7", "jfs", MS_SYNCHRONOUS|MS_NODIRATIME, "") = 0 [pid 5221] openat(AT_FDCWD, "./file7", O_RDONLY|O_DIRECTORY) = 3 [pid 5221] chdir("./file7") = 0 [pid 5221] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [ 71.584043][ T5221] loop0: detected capacity change from 0 to 32768 [pid 5221] creat("./bus", 000) = 4 [pid 5221] mount("/dev/sg0", "./bus", NULL, MS_BIND, NULL) = 0 [pid 5221] exit_group(0) = ? [pid 5221] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5221, si_uid=0, si_status=0, si_utime=1 /* 0.01 s */, si_stime=19 /* 0.19 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555689a16f0 /* 4 entries */, 32768) = 112 umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./0/binderfs") = 0 umount2("./0/file7", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EBUSY (Device or resource busy) newfstatat(AT_FDCWD, "./0/file7", {st_mode=S_IFDIR|0755, st_size=256, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./0/file7", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EBUSY (Device or resource busy) openat(AT_FDCWD, "./0/file7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0755, st_size=256, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555689a9730 /* 8 entries */, 32768) = 232 umount2("./0/file7/bus", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./0/file7/bus", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/file7/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./0/file7/bus") = 0 umount2("./0/file7/file.cold", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/file7/file.cold", {st_mode=S_IFREG|0755, st_size=100, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./0/file7/file.cold") = 0 umount2("./0/file7/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/file7/file0", {st_mode=S_IFDIR|0755, st_size=256, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./0/file7/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./0/file7/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 5 newfstatat(5, "", {st_mode=S_IFDIR|0755, st_size=256, ...}, AT_EMPTY_PATH) = 0 getdents64(5, 0x5555689b1770 /* 4 entries */, 32768) = 112 umount2("./0/file7/file0/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/file7/file0/file0", {st_mode=S_IFREG|0755, st_size=1050, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./0/file7/file0/file0") = 0 umount2("./0/file7/file0/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/file7/file0/file1", {st_mode=S_IFLNK|0777, st_size=39, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./0/file7/file0/file1") = 0 getdents64(5, 0x5555689b1770 /* 0 entries */, 32768) = 0 close(5) = 0 rmdir("./0/file7/file0") = 0 umount2("./0/file7/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/file7/file1", {st_mode=S_IFREG|0755, st_size=10, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./0/file7/file1") = 0 umount2("./0/file7/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 71.850907][ T112] BUG: spinlock bad magic on CPU#0, jfsCommit/112 [ 71.857371][ T112] lock: 0xffff88807188b7f8, .magic: ffffffff, .owner: /0, .owner_cpu: 512 [ 71.866018][ T112] CPU: 0 UID: 0 PID: 112 Comm: jfsCommit Not tainted 6.12.0-rc2-syzkaller-00074-gd3d1556696c1 #0 [ 71.876527][ T112] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 71.886593][ T112] Call Trace: [ 71.889886][ T112] [ 71.892817][ T112] dump_stack_lvl+0x241/0x360 newfstatat(AT_FDCWD, "./0/file7/file2", {st_mode=S_IFREG|0755, st_size=9000, ...}, AT_SYMLINK_NOFOLLOW) = 0 [ 71.897600][ T112] ? __pfx_dump_stack_lvl+0x10/0x10 [ 71.902810][ T112] ? spin_bug+0x13b/0x1d0 [ 71.907262][ T112] do_raw_spin_lock+0x209/0x370 [ 71.912123][ T112] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 71.917529][ T112] _raw_spin_lock_irqsave+0xe1/0x120 [ 71.922827][ T112] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 71.928746][ T112] __wake_up_common_lock+0x25/0x1e0 [ 71.933959][ T112] release_metapage+0xb2/0x960 [ 71.938735][ T112] ? txFreeMap+0xa9c/0xd50 [ 71.943184][ T112] ? __mark_inode_dirty+0x3db/0xe90 [ 71.948409][ T112] xtTruncate+0x1006/0x3270 [ 71.952922][ T112] ? __pfx_xtTruncate+0x10/0x10 [ 71.957796][ T112] jfs_free_zero_link+0x46e/0x6e0 [ 71.962836][ T112] ? inode_wait_for_writeback+0x111/0x2a0 [ 71.968738][ T112] ? __pfx_jfs_free_zero_link+0x10/0x10 [ 71.974303][ T112] jfs_evict_inode+0x35f/0x440 [ 71.979157][ T112] ? __pfx_jfs_evict_inode+0x10/0x10 [ 71.984463][ T112] evict+0x4e8/0x9b0 [ 71.988386][ T112] ? __pfx_evict+0x10/0x10 [ 71.992807][ T112] ? iput+0x713/0xa50 [ 71.996797][ T112] txUpdateMap+0x931/0xb10 [ 72.001215][ T112] ? __pfx_txUpdateMap+0x10/0x10 [ 72.006152][ T112] ? __wake_up_common_lock+0x18c/0x1e0 [ 72.011705][ T112] jfs_lazycommit+0x49a/0xb80 [ 72.016378][ T112] ? _raw_spin_unlock_irqrestore+0x8f/0x140 [ 72.022269][ T112] ? lockdep_hardirqs_on+0x99/0x150 [ 72.027484][ T112] ? __pfx_jfs_lazycommit+0x10/0x10 [ 72.032691][ T112] ? __pfx_default_wake_function+0x10/0x10 [ 72.038496][ T112] ? __kthread_parkme+0x169/0x1d0 [ 72.043521][ T112] ? __pfx_jfs_lazycommit+0x10/0x10 [ 72.048798][ T112] kthread+0x2f0/0x390 [ 72.052863][ T112] ? __pfx_jfs_lazycommit+0x10/0x10 [ 72.058141][ T112] ? __pfx_kthread+0x10/0x10 [ 72.062720][ T112] ret_from_fork+0x4b/0x80 [ 72.067137][ T112] ? __pfx_kthread+0x10/0x10 [ 72.071717][ T112] ret_from_fork_asm+0x1a/0x30 [ 72.076506][ T112] [ 72.079551][ T112] ------------[ cut here ]------------ [ 72.085001][ T112] UBSAN: array-index-out-of-bounds in kernel/locking/qspinlock.c:131:9 [ 72.093223][ T112] index 8975 is out of range for type 'unsigned long[8]' [ 72.100248][ T112] CPU: 0 UID: 0 PID: 112 Comm: jfsCommit Not tainted 6.12.0-rc2-syzkaller-00074-gd3d1556696c1 #0 [ 72.110923][ T112] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 72.121104][ T112] Call Trace: [ 72.124385][ T112] [ 72.127429][ T112] dump_stack_lvl+0x241/0x360 [ 72.132108][ T112] ? __pfx_dump_stack_lvl+0x10/0x10 [ 72.137302][ T112] ? __pfx__printk+0x10/0x10 [ 72.141892][ T112] ? is_bpf_text_address+0x26/0x2a0 [ 72.147116][ T112] __ubsan_handle_out_of_bounds+0x121/0x150 [ 72.153037][ T112] ? rcu_is_watching+0x15/0xb0 [ 72.158263][ T112] __pv_queued_spin_lock_slowpath+0xd54/0xdb0 [ 72.164368][ T112] ? ret_from_fork_asm+0x1a/0x30 [ 72.169403][ T112] ? __printk_cpu_sync_put+0x67/0x80 [ 72.174692][ T112] ? __pfx___pv_queued_spin_lock_slowpath+0x10/0x10 [ 72.181303][ T112] queued_spin_lock_slowpath+0x42/0x50 [ 72.186780][ T112] do_raw_spin_lock+0x272/0x370 [ 72.191646][ T112] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 72.197124][ T112] _raw_spin_lock_irqsave+0xe1/0x120 [ 72.202415][ T112] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 72.208397][ T112] __wake_up_common_lock+0x25/0x1e0 [ 72.213612][ T112] release_metapage+0xb2/0x960 [ 72.218469][ T112] ? txFreeMap+0xa9c/0xd50 [ 72.222896][ T112] ? __mark_inode_dirty+0x3db/0xe90 [ 72.228114][ T112] xtTruncate+0x1006/0x3270 [ 72.232649][ T112] ? __pfx_xtTruncate+0x10/0x10 [ 72.237527][ T112] jfs_free_zero_link+0x46e/0x6e0 [ 72.242573][ T112] ? inode_wait_for_writeback+0x111/0x2a0 [ 72.248306][ T112] ? __pfx_jfs_free_zero_link+0x10/0x10 [ 72.253950][ T112] jfs_evict_inode+0x35f/0x440 [ 72.258715][ T112] ? __pfx_jfs_evict_inode+0x10/0x10 [ 72.264020][ T112] evict+0x4e8/0x9b0 [ 72.267931][ T112] ? __pfx_evict+0x10/0x10 [ 72.272376][ T112] ? iput+0x713/0xa50 [ 72.276374][ T112] txUpdateMap+0x931/0xb10 [ 72.280797][ T112] ? __pfx_txUpdateMap+0x10/0x10 [ 72.285753][ T112] ? __wake_up_common_lock+0x18c/0x1e0 [ 72.291235][ T112] jfs_lazycommit+0x49a/0xb80 [ 72.295934][ T112] ? _raw_spin_unlock_irqrestore+0x8f/0x140 [ 72.301828][ T112] ? lockdep_hardirqs_on+0x99/0x150 [ 72.307124][ T112] ? __pfx_jfs_lazycommit+0x10/0x10 [ 72.312330][ T112] ? __pfx_default_wake_function+0x10/0x10 [ 72.318141][ T112] ? __kthread_parkme+0x169/0x1d0 [ 72.323167][ T112] ? __pfx_jfs_lazycommit+0x10/0x10 [ 72.328363][ T112] kthread+0x2f0/0x390 [ 72.332426][ T112] ? __pfx_jfs_lazycommit+0x10/0x10 [ 72.337619][ T112] ? __pfx_kthread+0x10/0x10 [ 72.342376][ T112] ret_from_fork+0x4b/0x80 [ 72.346792][ T112] ? __pfx_kthread+0x10/0x10 [ 72.351393][ T112] ret_from_fork_asm+0x1a/0x30 [ 72.356187][ T112] [ 72.359209][ T112] ---[ end trace ]--- [ 72.363270][ T112] Kernel panic - not syncing: UBSAN: panic_on_warn set ... [ 72.370456][ T112] CPU: 0 UID: 0 PID: 112 Comm: jfsCommit Not tainted 6.12.0-rc2-syzkaller-00074-gd3d1556696c1 #0 [ 72.381034][ T112] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 72.391083][ T112] Call Trace: [ 72.394363][ T112] [ 72.397286][ T112] dump_stack_lvl+0x241/0x360 [ 72.402052][ T112] ? __pfx_dump_stack_lvl+0x10/0x10 [ 72.407334][ T112] ? __pfx__printk+0x10/0x10 [ 72.411990][ T112] ? vscnprintf+0x5d/0x90 [ 72.416320][ T112] panic+0x349/0x880 [ 72.420227][ T112] ? check_panic_on_warn+0x21/0xb0 [ 72.425375][ T112] ? __pfx_panic+0x10/0x10 [ 72.429812][ T112] ? _printk+0xd5/0x120 [ 72.434011][ T112] ? __pfx__printk+0x10/0x10 [ 72.438631][ T112] ? is_bpf_text_address+0x26/0x2a0 [ 72.443835][ T112] check_panic_on_warn+0x86/0xb0 [ 72.448775][ T112] __ubsan_handle_out_of_bounds+0x141/0x150 [ 72.454680][ T112] ? rcu_is_watching+0x15/0xb0 [ 72.459552][ T112] __pv_queued_spin_lock_slowpath+0xd54/0xdb0 [ 72.465625][ T112] ? ret_from_fork_asm+0x1a/0x30 [ 72.470737][ T112] ? __printk_cpu_sync_put+0x67/0x80 [ 72.476044][ T112] ? __pfx___pv_queued_spin_lock_slowpath+0x10/0x10 [ 72.482663][ T112] queued_spin_lock_slowpath+0x42/0x50 [ 72.488141][ T112] do_raw_spin_lock+0x272/0x370 [ 72.492994][ T112] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 72.498365][ T112] _raw_spin_lock_irqsave+0xe1/0x120 [ 72.503670][ T112] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 72.509565][ T112] __wake_up_common_lock+0x25/0x1e0 [ 72.514769][ T112] release_metapage+0xb2/0x960 [ 72.519529][ T112] ? txFreeMap+0xa9c/0xd50 [ 72.523943][ T112] ? __mark_inode_dirty+0x3db/0xe90 [ 72.529144][ T112] xtTruncate+0x1006/0x3270 [ 72.533649][ T112] ? __pfx_xtTruncate+0x10/0x10 [ 72.538502][ T112] jfs_free_zero_link+0x46e/0x6e0 [ 72.543529][ T112] ? inode_wait_for_writeback+0x111/0x2a0 [ 72.549250][ T112] ? __pfx_jfs_free_zero_link+0x10/0x10 [ 72.554802][ T112] jfs_evict_inode+0x35f/0x440 [ 72.559582][ T112] ? __pfx_jfs_evict_inode+0x10/0x10 [ 72.564989][ T112] evict+0x4e8/0x9b0 [ 72.568887][ T112] ? __pfx_evict+0x10/0x10 [ 72.573301][ T112] ? iput+0x713/0xa50 [ 72.577277][ T112] txUpdateMap+0x931/0xb10 [ 72.581692][ T112] ? __pfx_txUpdateMap+0x10/0x10 [ 72.586645][ T112] ? __wake_up_common_lock+0x18c/0x1e0 [ 72.592129][ T112] jfs_lazycommit+0x49a/0xb80 [ 72.596818][ T112] ? _raw_spin_unlock_irqrestore+0x8f/0x140 [ 72.602705][ T112] ? lockdep_hardirqs_on+0x99/0x150 [ 72.608006][ T112] ? __pfx_jfs_lazycommit+0x10/0x10 [ 72.613210][ T112] ? __pfx_default_wake_function+0x10/0x10 [ 72.619101][ T112] ? __kthread_parkme+0x169/0x1d0 [ 72.624131][ T112] ? __pfx_jfs_lazycommit+0x10/0x10 [ 72.629429][ T112] kthread+0x2f0/0x390 [ 72.633494][ T112] ? __pfx_jfs_lazycommit+0x10/0x10 [ 72.638775][ T112] ? __pfx_kthread+0x10/0x10 [ 72.643354][ T112] ret_from_fork+0x4b/0x80 [ 72.647797][ T112] ? __pfx_kthread+0x10/0x10 [ 72.652382][ T112] ret_from_fork_asm+0x1a/0x30 [ 72.657177][ T112] [ 72.660442][ T112] Kernel Offset: disabled [ 72.664771][ T112] Rebooting in 86400 seconds..