./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1463606425 <...> forked to background, child pid 5489 no interfaces have a carrier [ 36.826174][ T5490] 8021q: adding VLAN 0 to HW filter on device bond0 [ 36.836741][ T5490] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: OK syzkaller Warning: Permanently added '10.128.10.46' (ED25519) to the list of known hosts. execve("./syz-executor1463606425", ["./syz-executor1463606425"], 0x7fffbc11b670 /* 10 vars */) = 0 brk(NULL) = 0x555581cf4000 brk(0x555581cf4d00) = 0x555581cf4d00 arch_prctl(ARCH_SET_FS, 0x555581cf4380) = 0 set_tid_address(0x555581cf4650) = 5820 set_robust_list(0x555581cf4660, 24) = 0 rseq(0x555581cf4ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor1463606425", 4096) = 28 getrandom("\x47\xc4\x79\xc3\x64\x4d\x69\x17", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555581cf4d00 brk(0x555581d15d00) = 0x555581d15d00 brk(0x555581d16000) = 0x555581d16000 mprotect(0x7f6423749000, 16384, PROT_READ) = 0 mmap(0x3ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x3ffffffff000 mmap(0x400000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x400000000000 mmap(0x400001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x400001000000 mkdir("./syzkaller.5Vge7e", 0700) = 0 chmod("./syzkaller.5Vge7e", 0777) = 0 chdir("./syzkaller.5Vge7e") = 0 mkdir("./0", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5821 attached [pid 5821] set_robust_list(0x555581cf4660, 24 [pid 5820] <... clone resumed>, child_tidptr=0x555581cf4650) = 5821 [pid 5821] <... set_robust_list resumed>) = 0 [pid 5821] chdir("./0") = 0 [pid 5821] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5821] setpgid(0, 0) = 0 [pid 5821] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5821] write(3, "1000", 4) = 4 [pid 5821] close(3) = 0 [pid 5821] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5821] write(1, "executing program\n", 18) = 18 [pid 5821] memfd_create("syzkaller", 0) = 3 [pid 5821] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f641b200000 [pid 5821] write(3, "\xb5\x84\x31\x7b\xb6\x84\x31\x7b\xb7\x84\x31\x7b\xb8\x84\x31\x7b\xb9\x84\x31\x7b\xba\x84\x31\x7b\xbb\x84\x31\x7b\xbc\x84\x31\x7b\xbd\x84\x31\x7b\xbe\x84\x31\x7b\xbf\x84\x31\x7b\xc0\x84\x31\x7b\xc1\x84\x31\x7b\xc2\x84\x31\x7b\xc3\x84\x31\x7b\xc4\x84\x31\x7b\xc5\x84\x31\x7b\xc6\x84\x31\x7b\xc7\x84\x31\x7b\xc8\x84\x31\x7b\xc9\x84\x31\x7b\xca\x84\x31\x7b\xcb\x84\x31\x7b\xcc\x84\x31\x7b\xcd\x84\x31\x7b"..., 65536) = 65536 [pid 5821] munmap(0x7f641b200000, 138412032) = 0 [pid 5821] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5821] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5821] close(3) = 0 [pid 5821] close(4) = 0 [pid 5821] mkdir("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", 0777) = 0 [pid 5821] mount("/dev/loop0", "\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", "sysv", 0, "") = 0 [pid 5821] openat(AT_FDCWD, "\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", O_RDONLY|O_DIRECTORY) = 3 [pid 5821] chdir("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f") = 0 [pid 5821] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) syzkaller login: [ 60.889768][ T5821] loop0: detected capacity change from 0 to 128 [ 60.924244][ T5821] VFS: Found a Xenix FS (block size = 1024) on device loop0 [ 60.945939][ T5821] syz-executor146: attempt to access beyond end of device [ 60.945939][ T5821] loop0: rw=0, sector=6491536, nr_sectors = 2 limit=128 [ 60.960307][ T5821] Buffer I/O error on dev loop0, logical block 3245768, async page read [ 60.980310][ T5821] syz-executor146: attempt to access beyond end of device [ 60.980310][ T5821] loop0: rw=0, sector=6491536, nr_sectors = 2 limit=128 [pid 5821] mknodat(AT_FDCWD, "./file0", 000) = -1 EIO (Input/output error) [pid 5821] exit_group(0) = ? [pid 5821] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5821, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [ 60.994299][ T5821] Buffer I/O error on dev loop0, logical block 3245768, async page read newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555581cf56f0 /* 4 entries */, 32768) = 176 umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./0/binderfs") = 0 [ 61.095423][ T5820] sysv_free_block: flc_count > flc_size [ 61.101164][ T5820] sysv_free_block: flc_count > flc_size [ 61.107070][ T5820] sysv_free_block: flc_count > flc_size [ 61.112619][ T5820] sysv_free_block: flc_count > flc_size [ 61.118232][ T5820] sysv_free_block: flc_count > flc_size [ 61.123810][ T5820] sysv_free_block: flc_count > flc_size [ 61.129336][ T5820] sysv_free_block: flc_count > flc_size [ 61.134944][ T5820] sysv_free_block: flc_count > flc_size umount2("\x2e\x2f\x30\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("\x2e\x2f\x30\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "\x2e\x2f\x30\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("\x2e\x2f\x30\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "\x2e\x2f\x30\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [ 61.140517][ T5820] sysv_free_block: flc_count > flc_size [ 61.146125][ T5820] sysv_free_block: flc_count > flc_size [ 61.152164][ T5820] sysv_free_inode: inode 0,1,2 or nonexistent inode newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555581cfd730 /* 2 entries */, 32768) = 48 getdents64(4, 0x555581cfd730 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("\x2e\x2f\x30\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38") = 0 getdents64(3, 0x555581cf56f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./0") = 0 mkdir("./1", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5823 attached [pid 5823] set_robust_list(0x555581cf4660, 24 [pid 5820] <... clone resumed>, child_tidptr=0x555581cf4650) = 5823 [pid 5823] <... set_robust_list resumed>) = 0 [pid 5823] chdir("./1") = 0 [pid 5823] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5823] setpgid(0, 0) = 0 [pid 5823] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5823] write(3, "1000", 4) = 4 [pid 5823] close(3) = 0 [pid 5823] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5823] write(1, "executing program\n", 18) = 18 [pid 5823] memfd_create("syzkaller", 0) = 3 [pid 5823] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f641b200000 [pid 5823] write(3, "\xb5\x84\x31\x7b\xb6\x84\x31\x7b\xb7\x84\x31\x7b\xb8\x84\x31\x7b\xb9\x84\x31\x7b\xba\x84\x31\x7b\xbb\x84\x31\x7b\xbc\x84\x31\x7b\xbd\x84\x31\x7b\xbe\x84\x31\x7b\xbf\x84\x31\x7b\xc0\x84\x31\x7b\xc1\x84\x31\x7b\xc2\x84\x31\x7b\xc3\x84\x31\x7b\xc4\x84\x31\x7b\xc5\x84\x31\x7b\xc6\x84\x31\x7b\xc7\x84\x31\x7b\xc8\x84\x31\x7b\xc9\x84\x31\x7b\xca\x84\x31\x7b\xcb\x84\x31\x7b\xcc\x84\x31\x7b\xcd\x84\x31\x7b"..., 65536) = 65536 [pid 5823] munmap(0x7f641b200000, 138412032) = 0 [pid 5823] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5823] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5823] close(3) = 0 [pid 5823] close(4) = 0 [pid 5823] mkdir("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", 0777) = 0 [pid 5823] mount("/dev/loop0", "\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", "sysv", 0, "") = 0 [pid 5823] openat(AT_FDCWD, "\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", O_RDONLY|O_DIRECTORY) = 3 [pid 5823] chdir("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f") = 0 [pid 5823] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [ 61.484074][ T5823] loop0: detected capacity change from 0 to 128 [ 61.520178][ T5823] VFS: Found a Xenix FS (block size = 1024) on device loop0 [ 61.557114][ T5823] syz-executor146: attempt to access beyond end of device [ 61.557114][ T5823] loop0: rw=0, sector=6491536, nr_sectors = 2 limit=128 [ 61.571246][ T5823] Buffer I/O error on dev loop0, logical block 3245768, async page read [ 61.580359][ T5823] unable to read i-node block [ 61.585227][ T5823] syz-executor146: attempt to access beyond end of device [ 61.585227][ T5823] loop0: rw=0, sector=6491536, nr_sectors = 2 limit=128 [ 61.599180][ T5823] Buffer I/O error on dev loop0, logical block 3245768, async page read [pid 5823] mknodat(AT_FDCWD, "./file0", 000) = -1 EIO (Input/output error) [pid 5823] exit_group(0) = ? [pid 5823] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5823, si_uid=0, si_status=0, si_utime=0, si_stime=7 /* 0.07 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [ 61.607736][ T5823] sysv_free_inode: unable to read inode block on device loop0 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555581cf56f0 /* 4 entries */, 32768) = 176 umount2("./1/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./1/binderfs") = 0 [ 61.743987][ T5820] sysv_free_block: flc_count > flc_size [ 61.749562][ T5820] sysv_free_block: flc_count > flc_size [ 61.755237][ T5820] sysv_free_block: flc_count > flc_size [ 61.760797][ T5820] sysv_free_block: flc_count > flc_size [ 61.766376][ T5820] sysv_free_block: flc_count > flc_size [ 61.771926][ T5820] sysv_free_block: flc_count > flc_size [ 61.777516][ T5820] sysv_free_block: flc_count > flc_size [ 61.783103][ T5820] sysv_free_block: flc_count > flc_size [ 61.788693][ T5820] sysv_free_block: flc_count > flc_size umount2("\x2e\x2f\x31\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("\x2e\x2f\x31\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "\x2e\x2f\x31\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("\x2e\x2f\x31\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "\x2e\x2f\x31\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [ 61.794278][ T5820] sysv_free_block: flc_count > flc_size [ 61.800432][ T5820] sysv_free_inode: inode 0,1,2 or nonexistent inode getdents64(4, 0x555581cfd730 /* 2 entries */, 32768) = 48 getdents64(4, 0x555581cfd730 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("\x2e\x2f\x31\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38") = 0 getdents64(3, 0x555581cf56f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./1") = 0 mkdir("./2", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5824 attached [pid 5824] set_robust_list(0x555581cf4660, 24 [pid 5820] <... clone resumed>, child_tidptr=0x555581cf4650) = 5824 [pid 5824] <... set_robust_list resumed>) = 0 [pid 5824] chdir("./2") = 0 [pid 5824] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5824] setpgid(0, 0) = 0 [pid 5824] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5824] write(3, "1000", 4) = 4 [pid 5824] close(3) = 0 [pid 5824] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5824] write(1, "executing program\n", 18) = 18 [pid 5824] memfd_create("syzkaller", 0) = 3 [pid 5824] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f641b200000 [pid 5824] write(3, "\xb5\x84\x31\x7b\xb6\x84\x31\x7b\xb7\x84\x31\x7b\xb8\x84\x31\x7b\xb9\x84\x31\x7b\xba\x84\x31\x7b\xbb\x84\x31\x7b\xbc\x84\x31\x7b\xbd\x84\x31\x7b\xbe\x84\x31\x7b\xbf\x84\x31\x7b\xc0\x84\x31\x7b\xc1\x84\x31\x7b\xc2\x84\x31\x7b\xc3\x84\x31\x7b\xc4\x84\x31\x7b\xc5\x84\x31\x7b\xc6\x84\x31\x7b\xc7\x84\x31\x7b\xc8\x84\x31\x7b\xc9\x84\x31\x7b\xca\x84\x31\x7b\xcb\x84\x31\x7b\xcc\x84\x31\x7b\xcd\x84\x31\x7b"..., 65536) = 65536 [pid 5824] munmap(0x7f641b200000, 138412032) = 0 [pid 5824] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5824] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5824] close(3) = 0 [pid 5824] close(4) = 0 [pid 5824] mkdir("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", 0777) = 0 [pid 5824] mount("/dev/loop0", "\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", "sysv", 0, "") = 0 [pid 5824] openat(AT_FDCWD, "\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", O_RDONLY|O_DIRECTORY) = 3 [pid 5824] chdir("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f") = 0 [pid 5824] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [ 62.091547][ T5824] loop0: detected capacity change from 0 to 128 [ 62.131541][ T5824] VFS: Found a Xenix FS (block size = 1024) on device loop0 [ 62.172355][ T5824] syz-executor146: attempt to access beyond end of device [ 62.172355][ T5824] loop0: rw=0, sector=6491536, nr_sectors = 2 limit=128 [ 62.186489][ T5824] Buffer I/O error on dev loop0, logical block 3245768, async page read [ 62.195402][ T5824] ================================================================== [ 62.203492][ T5824] BUG: KASAN: use-after-free in sysv_new_inode+0xfe4/0x1190 [ 62.210798][ T5824] Read of size 2 at addr ffff8880788651ce by task syz-executor146/5824 [ 62.219017][ T5824] [ 62.221338][ T5824] CPU: 1 UID: 0 PID: 5824 Comm: syz-executor146 Not tainted 6.14.0-rc2-syzkaller-00390-g224e74511041 #0 [ 62.221351][ T5824] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 62.221367][ T5824] Call Trace: [ 62.221375][ T5824] [ 62.221380][ T5824] dump_stack_lvl+0x241/0x360 [ 62.221397][ T5824] ? __pfx_dump_stack_lvl+0x10/0x10 [ 62.221406][ T5824] ? __pfx__printk+0x10/0x10 [ 62.221421][ T5824] ? _printk+0xd5/0x120 [ 62.221434][ T5824] ? __virt_addr_valid+0x183/0x530 [ 62.221448][ T5824] ? __virt_addr_valid+0x183/0x530 [ 62.221461][ T5824] print_report+0x169/0x550 [ 62.221475][ T5824] ? __virt_addr_valid+0x183/0x530 [ 62.221488][ T5824] ? __virt_addr_valid+0x183/0x530 [ 62.221501][ T5824] ? __virt_addr_valid+0x45f/0x530 [ 62.221514][ T5824] ? __phys_addr+0xba/0x170 [ 62.221527][ T5824] ? sysv_new_inode+0xfe4/0x1190 [ 62.221536][ T5824] kasan_report+0x143/0x180 [ 62.221550][ T5824] ? sysv_new_inode+0xfe4/0x1190 [ 62.221560][ T5824] sysv_new_inode+0xfe4/0x1190 [ 62.221572][ T5824] ? __pfx_sysv_new_inode+0x10/0x10 [ 62.221587][ T5824] ? generic_permission+0x356/0x680 [ 62.221599][ T5824] sysv_mknod+0x4e/0xe0 [ 62.221610][ T5824] vfs_create+0x23c/0x3d0 [ 62.221622][ T5824] do_mknodat+0x447/0x5b0 [ 62.221633][ T5824] ? __pfx_do_mknodat+0x10/0x10 [ 62.221643][ T5824] ? getname_flags+0x1e3/0x540 [ 62.221652][ T5824] __x64_sys_mknodat+0xa7/0xc0 [ 62.221664][ T5824] do_syscall_64+0xf3/0x230 [ 62.221680][ T5824] ? clear_bhb_loop+0x35/0x90 [ 62.221694][ T5824] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 62.221707][ T5824] RIP: 0033:0x7f64236cb129 [ 62.221720][ T5824] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 21 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 62.221728][ T5824] RSP: 002b:00007ffda38d2b68 EFLAGS: 00000246 ORIG_RAX: 0000000000000103 [ 62.221739][ T5824] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f64236cb129 [ 62.221745][ T5824] RDX: 0000000000000000 RSI: 0000400000000000 RDI: 00000000ffffff9c [ 62.221751][ T5824] RBP: 00000000ffffffff R08: 0000000000009e8c R09: 0000000000000000 [ 62.221757][ T5824] R10: 0000000000000700 R11: 0000000000000246 R12: 0000000000010000 [ 62.221762][ T5824] R13: 00007ffda38d2c00 R14: 0000400000000000 R15: 0000000000000003 [ 62.221771][ T5824] [ 62.221775][ T5824] [ 62.450504][ T5824] The buggy address belongs to the physical page: [ 62.456907][ T5824] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x7f641b20f pfn:0x78865 [ 62.466372][ T5824] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 62.473467][ T5824] raw: 00fff00000000000 ffffea0001e771c8 ffffea0001e755c8 0000000000000000 [ 62.482029][ T5824] raw: 00000007f641b20f 0000000000000000 00000000ffffffff 0000000000000000 [ 62.490612][ T5824] page dumped because: kasan: bad access detected [ 62.497020][ T5824] page_owner tracks the page as freed [ 62.502362][ T5824] page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_ZERO), pid 5824, tgid 5824 (syz-executor146), ts 62077914485, free_ts 62120425196 [ 62.521270][ T5824] post_alloc_hook+0x1f4/0x240 [ 62.526024][ T5824] get_page_from_freelist+0x3651/0x37a0 [ 62.531553][ T5824] __alloc_frozen_pages_noprof+0x292/0x710 [ 62.537371][ T5824] alloc_pages_mpol+0x311/0x660 [ 62.542222][ T5824] vma_alloc_folio_noprof+0x12b/0x260 [ 62.547576][ T5824] folio_prealloc+0x2e/0x170 [ 62.552145][ T5824] __handle_mm_fault+0x3e4b/0x70f0 [ 62.557251][ T5824] handle_mm_fault+0x2c1/0x7e0 [ 62.561992][ T5824] exc_page_fault+0x459/0x8b0 [ 62.566650][ T5824] asm_exc_page_fault+0x26/0x30 [ 62.571479][ T5824] page last free pid 5822 tgid 5822 stack trace: [ 62.577781][ T5824] free_unref_folios+0xe2f/0x18a0 [ 62.582782][ T5824] folios_put_refs+0x76c/0x860 [ 62.587532][ T5824] folio_batch_move_lru+0x39a/0x420 [ 62.592709][ T5824] __folio_batch_add_and_move+0x5bb/0xd70 [ 62.598406][ T5824] filemap_add_folio+0x24e/0x380 [ 62.603320][ T5824] page_cache_ra_unbounded+0x40c/0x820 [ 62.608765][ T5824] page_cache_sync_ra+0x3e2/0xb00 [ 62.613769][ T5824] filemap_get_pages+0x59a/0x1fb0 [ 62.618779][ T5824] filemap_read+0x464/0x1260 [ 62.623347][ T5824] blkdev_read_iter+0x31f/0x460 [ 62.628176][ T5824] vfs_read+0x975/0xb40 [ 62.632308][ T5824] ksys_read+0x18f/0x2b0 [ 62.636535][ T5824] do_syscall_64+0xf3/0x230 [ 62.641018][ T5824] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 62.646892][ T5824] [ 62.649190][ T5824] Memory state around the buggy address: [ 62.654795][ T5824] ffff888078865080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 62.662836][ T5824] ffff888078865100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 62.670880][ T5824] >ffff888078865180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 62.678920][ T5824] ^ [ 62.685308][ T5824] ffff888078865200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 62.693365][ T5824] ffff888078865280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 62.701404][ T5824] ================================================================== [ 62.710127][ T5824] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 62.717344][ T5824] CPU: 1 UID: 0 PID: 5824 Comm: syz-executor146 Not tainted 6.14.0-rc2-syzkaller-00390-g224e74511041 #0 [ 62.728463][ T5824] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 62.738627][ T5824] Call Trace: [ 62.741905][ T5824] [ 62.744820][ T5824] dump_stack_lvl+0x241/0x360 [ 62.749484][ T5824] ? __pfx_dump_stack_lvl+0x10/0x10 [ 62.754664][ T5824] ? __pfx__printk+0x10/0x10 [ 62.759242][ T5824] ? preempt_schedule+0xe1/0xf0 [ 62.764112][ T5824] ? vscnprintf+0x5d/0x90 [ 62.768436][ T5824] panic+0x349/0x880 [ 62.772325][ T5824] ? check_panic_on_warn+0x21/0xb0 [ 62.777431][ T5824] ? __pfx_panic+0x10/0x10 [ 62.781839][ T5824] ? _raw_spin_unlock_irqrestore+0x130/0x140 [ 62.787800][ T5824] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 62.794109][ T5824] ? print_report+0x502/0x550 [ 62.798790][ T5824] check_panic_on_warn+0x86/0xb0 [ 62.803735][ T5824] ? sysv_new_inode+0xfe4/0x1190 [ 62.808677][ T5824] end_report+0x77/0x160 [ 62.812911][ T5824] kasan_report+0x154/0x180 [ 62.817406][ T5824] ? sysv_new_inode+0xfe4/0x1190 [ 62.822330][ T5824] sysv_new_inode+0xfe4/0x1190 [ 62.827085][ T5824] ? __pfx_sysv_new_inode+0x10/0x10 [ 62.832271][ T5824] ? generic_permission+0x356/0x680 [ 62.837453][ T5824] sysv_mknod+0x4e/0xe0 [ 62.841592][ T5824] vfs_create+0x23c/0x3d0 [ 62.845910][ T5824] do_mknodat+0x447/0x5b0 [ 62.850219][ T5824] ? __pfx_do_mknodat+0x10/0x10 [ 62.855056][ T5824] ? getname_flags+0x1e3/0x540 [ 62.859803][ T5824] __x64_sys_mknodat+0xa7/0xc0 [ 62.864552][ T5824] do_syscall_64+0xf3/0x230 [ 62.869038][ T5824] ? clear_bhb_loop+0x35/0x90 [ 62.873708][ T5824] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 62.879596][ T5824] RIP: 0033:0x7f64236cb129 [ 62.883995][ T5824] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 21 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 62.903590][ T5824] RSP: 002b:00007ffda38d2b68 EFLAGS: 00000246 ORIG_RAX: 0000000000000103 [ 62.911992][ T5824] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f64236cb129 [ 62.919949][ T5824] RDX: 0000000000000000 RSI: 0000400000000000 RDI: 00000000ffffff9c [ 62.927924][ T5824] RBP: 00000000ffffffff R08: 0000000000009e8c R09: 0000000000000000 [ 62.935880][ T5824] R10: 0000000000000700 R11: 0000000000000246 R12: 0000000000010000 [ 62.943837][ T5824] R13: 00007ffda38d2c00 R14: 0000400000000000 R15: 0000000000000003 [ 62.951796][ T5824] [ 62.955052][ T5824] Kernel Offset: disabled [ 62.959365][ T5824] Rebooting in 86400 seconds..