./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2361881208 <...> Warning: Permanently added '10.128.0.219' (ED25519) to the list of known hosts. execve("./syz-executor2361881208", ["./syz-executor2361881208"], 0x7ffe627bba10 /* 10 vars */) = 0 brk(NULL) = 0x5555718d6000 brk(0x5555718d6d40) = 0x5555718d6d40 arch_prctl(ARCH_SET_FS, 0x5555718d63c0) = 0 set_tid_address(0x5555718d6690) = 5845 set_robust_list(0x5555718d66a0, 24) = 0 rseq(0x5555718d6ce0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor2361881208", 4096) = 28 getrandom("\xf1\x99\x66\xc4\x2f\x20\x64\xaf", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x5555718d6d40 brk(0x5555718f7d40) = 0x5555718f7d40 brk(0x5555718f8000) = 0x5555718f8000 mprotect(0x7fd31fa95000, 16384, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555718d6690) = 5846 ./strace-static-x86_64: Process 5846 attached [pid 5845] openat(AT_FDCWD, "/sys/kernel/debug/x86/nmi_longest_ns", O_WRONLY|O_CLOEXEC) = 3 [pid 5846] set_robust_list(0x5555718d66a0, 24 [pid 5845] write(3, "10000000000", 11 [pid 5846] <... set_robust_list resumed>) = 0 [pid 5845] <... write resumed>) = 11 [pid 5845] close(3) = 0 [pid 5845] openat(AT_FDCWD, "/proc/sys/kernel/hung_task_check_interval_secs", O_WRONLY|O_CLOEXEC) = 3 [pid 5845] write(3, "20", 2) = 2 [pid 5845] close(3) = 0 [pid 5845] openat(AT_FDCWD, "/proc/sys/net/core/bpf_jit_kallsyms", O_WRONLY|O_CLOEXEC) = 3 [pid 5845] write(3, "1", 1) = 1 [pid 5845] close(3) = 0 [pid 5845] openat(AT_FDCWD, "/proc/sys/net/core/bpf_jit_harden", O_WRONLY|O_CLOEXEC) = 3 [pid 5845] write(3, "0", 1) = 1 [pid 5845] close(3) = 0 [pid 5845] openat(AT_FDCWD, "/proc/sys/kernel/kptr_restrict", O_WRONLY|O_CLOEXEC) = 3 [pid 5845] write(3, "0", 1) = 1 [pid 5845] close(3) = 0 [pid 5845] openat(AT_FDCWD, "/proc/sys/kernel/softlockup_all_cpu_backtrace", O_WRONLY|O_CLOEXEC) = 3 [pid 5845] write(3, "1", 1) = 1 [pid 5845] close(3) = 0 [pid 5845] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC) = 3 [pid 5845] write(3, "100", 3) = 3 [pid 5845] close(3) = 0 [pid 5845] openat(AT_FDCWD, "/proc/sys/vm/oom_dump_tasks", O_WRONLY|O_CLOEXEC) = 3 [pid 5845] write(3, "0", 1) = 1 [pid 5845] close(3) = 0 [pid 5845] openat(AT_FDCWD, "/proc/sys/debug/exception-trace", O_WRONLY|O_CLOEXEC) = 3 [pid 5845] write(3, "0", 1) = 1 [pid 5845] close(3) = 0 [pid 5845] openat(AT_FDCWD, "/proc/sys/kernel/printk", O_WRONLY|O_CLOEXEC) = 3 [pid 5845] write(3, "7 4 1 3", 7) = 7 [pid 5845] close(3) = 0 [pid 5845] openat(AT_FDCWD, "/proc/sys/kernel/keys/gc_delay", O_WRONLY|O_CLOEXEC) = 3 [pid 5845] write(3, "1", 1) = 1 [pid 5845] close(3) = 0 [pid 5845] openat(AT_FDCWD, "/proc/sys/vm/oom_kill_allocating_task", O_WRONLY|O_CLOEXEC) = 3 [pid 5845] write(3, "1", 1) = 1 [pid 5845] close(3) = 0 [pid 5845] openat(AT_FDCWD, "/proc/sys/kernel/ctrl-alt-del", O_WRONLY|O_CLOEXEC) = 3 [pid 5845] write(3, "0", 1) = 1 [pid 5845] close(3) = 0 [pid 5845] openat(AT_FDCWD, "/proc/sys/kernel/cad_pid", O_WRONLY|O_CLOEXEC) = 3 [pid 5845] write(3, "5846", 4) = 4 [pid 5845] close(3) = 0 [pid 5845] kill(5846, SIGKILL) = 0 [pid 5846] +++ killed by SIGKILL +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5846, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} --- socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3 socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4 sendto(4, [{nlmsg_len=36, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0d\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x35\x34\x00\x00\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 36 recvfrom(4, [{nlmsg_len=864, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5845}, "\x01\x02\x00\x00\x0d\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x35\x34\x00\x00\x00\x00\x06\x00\x01\x00\x1d\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x30\x00\x00\x00\xe8\x02\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x05\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x03\x00"...], 4096, 0, NULL, NULL) = 864 recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5845}, {error=0, msg={nlmsg_len=36, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5 ioctl(5, SIOCGIFINDEX, {ifr_name="wpan0", ifr_ifindex=11}) = 0 close(5) = 0 sendto(4, [{nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x0b\x00\x00\x00\x08\x00\x03\x00\x0b\x00\x00\x00\x06\x00\x0a\x00\xa0\xaa\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 36 recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5845}, {error=0, msg={nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5 ioctl(5, SIOCGIFINDEX, {ifr_name="wpan0", ifr_ifindex=11}) = 0 close(5) = 0 sendto(3, [{nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0b\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x0c\x00\x01\x00\x02\x00\xaa\xaa\xaa\xaa\xaa\xaa"], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 44 recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5845}, {error=0, msg={nlmsg_len=44, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 sendto(3, [{nlmsg_len=68, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|NLM_F_EXCL|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {ifi_family=AF_UNSPEC, ifi_type=ARPHRD_NETROM, ifi_index=0, ifi_flags=0, ifi_change=0}, [[{nla_len=11, nla_type=IFLA_IFNAME}, "lowpan0"...], [{nla_len=16, nla_type=IFLA_LINKINFO}, [{nla_len=10, nla_type=IFLA_INFO_KIND}, "lowpan"...]], [{nla_len=8, nla_type=IFLA_LINK}, 11]]], 68, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 68 recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5845}, {error=0, msg={nlmsg_len=68, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|NLM_F_EXCL|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5 ioctl(5, SIOCGIFINDEX, {ifr_name="wpan1", ifr_ifindex=12}) = 0 close(5) = 0 sendto(4, [{nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x0b\x00\x00\x00\x08\x00\x03\x00\x0c\x00\x00\x00\x06\x00\x0a\x00\xa1\xaa\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 36 recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5845}, {error=0, msg={nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5 ioctl(5, SIOCGIFINDEX, {ifr_name="wpan1", ifr_ifindex=12}) = 0 close(5) = 0 sendto(3, [{nlmsg_len=44, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, {ifi_family=AF_UNSPEC, ifi_type=ARPHRD_NETROM, ifi_index=if_nametoindex("wpan1"), ifi_flags=IFF_UP, ifi_change=0x1}, [{nla_len=12, nla_type=IFLA_ADDRESS}, 02:01:aa:aa:aa:aa:aa]], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 44 recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5845}, {error=0, msg={nlmsg_len=44, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 close(3) = 0 close(4) = 0 mkdir("./syzkaller.DBG7gi", 0700) = 0 chmod("./syzkaller.DBG7gi", 0777) = 0 chdir("./syzkaller.DBG7gi") = 0 mkdir("./0", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5849 attached [pid 5849] set_robust_list(0x5555718d66a0, 24) = 0 [pid 5849] chdir("./0" [pid 5845] <... clone resumed>, child_tidptr=0x5555718d6690) = 5849 [pid 5849] <... chdir resumed>) = 0 [pid 5849] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5849] setpgid(0, 0) = 0 [pid 5849] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5849] write(3, "1000", 4) = 4 [pid 5849] close(3) = 0 [pid 5849] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5849] write(1, "executing program\n", 18executing program ) = 18 [pid 5849] futex(0x7fd31fa9b6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5849] rt_sigaction(SIGRT_1, {sa_handler=0x7fd31fa1c710, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fd31fa0e050}, NULL, 8) = 0 [pid 5849] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5849] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fd31f981000 [pid 5849] mprotect(0x7fd31f982000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5849] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5849] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fd31f9a1990, parent_tid=0x7fd31f9a1990, exit_signal=0, stack=0x7fd31f981000, stack_size=0x20300, tls=0x7fd31f9a16c0}./strace-static-x86_64: Process 5850 attached [pid 5850] rseq(0x7fd31f9a1fe0, 0x20, 0, 0x53053053) = 0 [pid 5850] set_robust_list(0x7fd31f9a19a0, 24 [pid 5849] <... clone3 resumed> => {parent_tid=[5850]}, 88) = 5850 [pid 5850] <... set_robust_list resumed>) = 0 [pid 5849] rt_sigprocmask(SIG_SETMASK, [], [pid 5850] rt_sigprocmask(SIG_SETMASK, [], [pid 5849] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5850] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5849] futex(0x7fd31fa9b6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5850] memfd_create("syzkaller", 0 [pid 5849] <... futex resumed>) = 0 [pid 5850] <... memfd_create resumed>) = 3 [pid 5849] futex(0x7fd31fa9b6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5850] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd317400000 [pid 5850] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5850] munmap(0x7fd317400000, 138412032) = 0 [pid 5850] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5850] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5850] close(3) = 0 [pid 5850] close(4) = 0 [pid 5850] mkdir("./file0", 0777) = 0 [ 162.664353][ T5850] loop0: detected capacity change from 0 to 32768 [ 162.762880][ T5850] bcachefs (da441363-bb6a-4ab9-999b-c1f40db4fee2): Using encoding defined by superblock: utf8-12.1.0 [ 162.790208][ T5850] bcachefs (loop0): starting version 1.7: mi_btree_bitmap opts=errors=continue,metadata_checksum=none,data_checksum=none,str_hash=crc32c,noacl,usrquota,grpquota,nojournal_transaction_names,allocator_stuck_timeout=256 [ 162.790208][ T5850] allowing incompatible features above 0.0: (unknown version) [ 162.819754][ T5850] bcachefs (loop0): initializing new filesystem [ 162.827622][ T5850] bcachefs (loop0): going read-write [ 162.838157][ T5850] bcachefs (loop0): marking superblocks [ 162.856025][ T5850] bcachefs (loop0): initializing freespace [pid 5850] mount("/dev/loop0", "./file0", "bcachefs", MS_SYNCHRONOUS, "") = 0 [pid 5850] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5850] chdir("./file0") = 0 [ 162.864347][ T5850] bcachefs (loop0): done initializing freespace [ 162.874891][ T5850] bcachefs (loop0): reading snapshots table [ 162.880898][ T5850] bcachefs (loop0): reading snapshots done [ 162.899873][ T5850] bcachefs (loop0): done starting filesystem [pid 5850] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5850] ioctl(4, LOOP_CLR_FD) = 0 [pid 5850] close(4) = 0 [pid 5850] futex(0x7fd31fa9b6cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5850] futex(0x7fd31fa9b6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5849] <... futex resumed>) = 0 [pid 5849] futex(0x7fd31fa9b6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5850] <... futex resumed>) = 0 [pid 5849] <... futex resumed>) = 1 [pid 5850] openat(AT_FDCWD, "./file0", O_RDWR|O_CREAT|O_NONBLOCK|O_NOFOLLOW, 004 [pid 5849] futex(0x7fd31fa9b6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5850] <... openat resumed>) = 4 [pid 5850] futex(0x7fd31fa9b6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5849] <... futex resumed>) = 0 [pid 5850] <... futex resumed>) = 1 [pid 5849] futex(0x7fd31fa9b6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5850] fcntl(4, F_SETFL, O_RDONLY|O_DIRECT [pid 5849] <... futex resumed>) = 0 [pid 5850] <... fcntl resumed>) = 0 [pid 5850] futex(0x7fd31fa9b6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5849] futex(0x7fd31fa9b6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5850] <... futex resumed>) = 0 [pid 5849] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5850] futex(0x7fd31fa9b6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5849] futex(0x7fd31fa9b6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5850] <... futex resumed>) = 0 [pid 5849] <... futex resumed>) = 1 [pid 5850] write(4, "\x60\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\x00\x00\x00\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x9a\x06\x00\x04\x00\x00\x00\x00\xae\x00\x00\x00\x00\x00\x40\x02\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x7b\xfe\x69\xd7"..., 4294966978 [pid 5849] futex(0x7fd31fa9b6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [pid 5849] futex(0x7fd31fa9b6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5849] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fd31f960000 [pid 5849] mprotect(0x7fd31f961000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5849] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5849] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fd31f980990, parent_tid=0x7fd31f980990, exit_signal=0, stack=0x7fd31f960000, stack_size=0x20300, tls=0x7fd31f9806c0}./strace-static-x86_64: Process 5861 attached [pid 5861] rseq(0x7fd31f980fe0, 0x20, 0, 0x53053053) = 0 [pid 5849] <... clone3 resumed> => {parent_tid=[5861]}, 88) = 5861 [pid 5861] set_robust_list(0x7fd31f9809a0, 24) = 0 [pid 5849] rt_sigprocmask(SIG_SETMASK, [], [pid 5861] rt_sigprocmask(SIG_SETMASK, [], [pid 5849] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5861] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5861] futex(0x7fd31fa9b6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5849] futex(0x7fd31fa9b6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5861] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5849] <... futex resumed>) = 0 [pid 5849] futex(0x7fd31fa9b6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5861] memfd_create("syzkaller", 0) = 5 [pid 5861] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd317400000 [pid 5861] write(5, "\xeb\x52\x90\x4e\x54\x46\x53\x20\x20\x20\x20\x00\x02\x08\x00\x00\x00\x00\x00\x00\x00\xf8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x80\x00\xff\x0f\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\xff\x00\x00\x00\x00\x00\x00\x00\xf6\x00\x00\x00\x01\x00\x00\x00\x51\x49\x92\x54\x8e\xa5\x9a\x39\x00\x00\x00\x00\x0e\x1f\xbe\x71\x7c\xac\x22\xc0\x74\x0b\x56\xb4\x0e\xbb\x07\x00"..., 2097152) = 2097152 [pid 5861] munmap(0x7fd317400000, 138412032) = 0 [pid 5861] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 6 [pid 5861] ioctl(6, LOOP_SET_FD, 5) = -1 EBUSY (Device or resource busy) [pid 5861] ioctl(6, LOOP_CLR_FD) = 0 [pid 5861] ioctl(6, LOOP_SET_FD, 5) = -1 EBUSY (Device or resource busy) [pid 5861] close(6) = 0 [pid 5861] close(5) = 0 [pid 5861] futex(0x7fd31fa9b6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5861] futex(0x7fd31fa9b6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5849] <... futex resumed>) = 0 [pid 5849] futex(0x7fd31fa9b6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5861] <... futex resumed>) = 0 [pid 5849] <... futex resumed>) = 1 [pid 5861] openat(AT_FDCWD, "./bus", O_RDWR|O_CREAT|O_APPEND|O_SYNC, 000 [pid 5849] futex(0x7fd31fa9b6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5861] <... openat resumed>) = 5 [pid 5861] futex(0x7fd31fa9b6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5849] <... futex resumed>) = 0 [pid 5861] pwrite64(5, "\x32\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65007, 65228 [pid 5849] futex(0x7fd31fa9b6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5849] futex(0x7fd31fa9b6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [pid 5849] futex(0x7fd31fa9b6ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5849] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fd31f93f000 [pid 5849] mprotect(0x7fd31f940000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5849] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5849] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fd31f95f990, parent_tid=0x7fd31f95f990, exit_signal=0, stack=0x7fd31f93f000, stack_size=0x20300, tls=0x7fd31f95f6c0}./strace-static-x86_64: Process 5862 attached [pid 5862] rseq(0x7fd31f95ffe0, 0x20, 0, 0x53053053) = 0 [pid 5862] set_robust_list(0x7fd31f95f9a0, 24 [pid 5849] <... clone3 resumed> => {parent_tid=[5862]}, 88) = 5862 [pid 5862] <... set_robust_list resumed>) = 0 [pid 5862] rt_sigprocmask(SIG_SETMASK, [], [pid 5849] rt_sigprocmask(SIG_SETMASK, [], [pid 5862] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5849] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5862] futex(0x7fd31fa9b6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5849] futex(0x7fd31fa9b6e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5862] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5849] <... futex resumed>) = 0 [pid 5862] creat("./file0", 017233 [pid 5849] futex(0x7fd31fa9b6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [pid 5849] exit_group(0) = ? [pid 5845] kill(-5849, SIGKILL) = 0 [pid 5845] kill(5849, SIGKILL) = 0 [pid 5845] openat(AT_FDCWD, "/sys/fs/fuse/connections", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5845] newfstatat(3, "", {st_mode=S_IFDIR|0755, st_size=0, ...}, AT_EMPTY_PATH) = 0 [pid 5845] getdents64(3, 0x5555718d7730 /* 2 entries */, 32768) = 48 [pid 5845] getdents64(3, 0x5555718d7730 /* 0 entries */, 32768) = 0 [pid 5845] close(3) = 0 [pid 5861] <... pwrite64 resumed>) = ? [pid 5861] +++ exited with 0 +++ [ 194.227424][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.234067][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.666454][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.672874][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.107150][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.113498][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 326.703970][ T31] INFO: task syz-executor236:5862 blocked for more than 143 seconds. [ 326.712088][ T31] Not tainted 6.15.0-rc6-syzkaller-00278-g172a9d94339c #0 [ 326.719868][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 326.728624][ T31] task:syz-executor236 state:D stack:26936 pid:5862 tgid:5849 ppid:5845 task_flags:0x400140 flags:0x00004006 [ 326.740625][ T31] Call Trace: [ 326.743950][ T31] [ 326.746887][ T31] __schedule+0x168f/0x4c70 [ 326.751408][ T31] ? __lock_acquire+0xaac/0xd20 [ 326.756363][ T31] ? schedule+0x165/0x360 [ 326.760743][ T31] ? __pfx___schedule+0x10/0x10 [ 326.765685][ T31] ? schedule+0x91/0x360 [ 326.769974][ T31] schedule+0x165/0x360 [ 326.774349][ T31] schedule_preempt_disabled+0x13/0x30 [ 326.779836][ T31] rwsem_down_write_slowpath+0xbec/0x1030 [ 326.785636][ T31] ? rwsem_down_write_slowpath+0x7ec/0x1030 [ 326.791568][ T31] ? __pfx_rwsem_down_write_slowpath+0x10/0x10 [ 326.797775][ T31] ? __lock_acquire+0xaac/0xd20 [ 326.802684][ T31] ? process_measurement+0x3d8/0x1a40 [ 326.808158][ T31] ? bch2_path_put+0xbf9/0x1cc0 [ 326.813045][ T31] down_write+0x1ab/0x1f0 [ 326.817426][ T31] ? __pfx_down_write+0x10/0x10 [ 326.822332][ T31] ? ima_get_action+0x75/0xb0 [ 326.827118][ T31] process_measurement+0x3d8/0x1a40 [ 326.832341][ T31] ? bch2_trans_unlock+0x333/0x4b0 [ 326.837529][ T31] ? kfree+0x4d/0x440 [ 326.841554][ T31] ? __pfx_process_measurement+0x10/0x10 [ 326.847226][ T31] ? bch2_trans_put+0xa67/0x10a0 [ 326.852217][ T31] ? tomoyo_file_open+0x166/0x220 [ 326.857295][ T31] ima_file_check+0xd7/0x120 [ 326.861906][ T31] ? __pfx_ima_file_check+0x10/0x10 [ 326.867158][ T31] security_file_post_open+0xbb/0x290 [ 326.872573][ T31] path_openat+0x2f26/0x3830 [ 326.877252][ T31] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 326.883189][ T31] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 326.889626][ T31] ? rcu_is_watching+0x15/0xb0 [ 326.894485][ T31] ? __pfx_path_openat+0x10/0x10 [ 326.899458][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 326.905622][ T31] do_filp_open+0x1fa/0x410 [ 326.910169][ T31] ? __pfx_do_filp_open+0x10/0x10 [ 326.915260][ T31] ? _raw_spin_unlock+0x28/0x50 [ 326.920114][ T31] ? alloc_fd+0x64c/0x6c0 [ 326.924524][ T31] do_sys_openat2+0x121/0x1c0 [ 326.929228][ T31] ? __pfx_ptrace_notify+0x10/0x10 [ 326.934395][ T31] ? __pfx_do_sys_openat2+0x10/0x10 [ 326.939715][ T31] ? rcu_is_watching+0x15/0xb0 [ 326.944575][ T31] __x64_sys_creat+0x8f/0xc0 [ 326.949208][ T31] do_syscall_64+0xf6/0x210 [ 326.953819][ T31] ? ret_from_fork_asm+0x1a/0x30 [ 326.958807][ T31] ? clear_bhb_loop+0x60/0xb0 [ 326.963495][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 326.969452][ T31] RIP: 0033:0x7fd31f9f4ef9 [ 326.973945][ T31] RSP: 002b:00007fd31f95f218 EFLAGS: 00000246 ORIG_RAX: 0000000000000055 [ 326.982368][ T31] RAX: ffffffffffffffda RBX: 00007fd31fa9b6e8 RCX: 00007fd31f9f4ef9 [ 326.990453][ T31] RDX: ffffffffffffffb0 RSI: c9028ba210c11e9b RDI: 00002000000000c0 [ 326.998489][ T31] RBP: 00007fd31fa9b6e0 R08: 0000000000000000 R09: 0000000000000000 [ 327.006518][ T31] R10: 00007ffcb62f60c7 R11: 0000000000000246 R12: 00007fd31fa67314 [ 327.014545][ T31] R13: 00002000000000c0 R14: 0030656c69662f2e R15: 00007ffcb62f60c8 [ 327.022553][ T31] [ 327.025678][ T31] [ 327.025678][ T31] Showing all locks held in the system: [ 327.033415][ T31] 1 lock held by khungtaskd/31: [ 327.038323][ T31] #0: ffffffff8df3dce0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 327.048269][ T31] 1 lock held by kworker/u8:3/53: [ 327.053329][ T31] #0: ffff8880b88399d8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140 [ 327.063378][ T31] 1 lock held by klogd/5178: [ 327.068005][ T31] #0: ffff8880b88399d8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140 [ 327.077991][ T31] 2 locks held by getty/5577: [ 327.082679][ T31] #0: ffff8880340120a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 327.092489][ T31] #1: ffffc900036ec2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 [ 327.102674][ T31] 3 locks held by syz-executor236/5850: [ 327.108263][ T31] #0: ffff888078b629b8 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x247/0x320 [ 327.117413][ T31] #1: ffff88823bfbe420 (sb_writers#9){.+.+}-{0:0}, at: vfs_write+0x211/0xa90 [ 327.126366][ T31] #2: ffff8880761b08e0 (&sb->s_type->i_mutex_key#14){+.+.}-{4:4}, at: bch2_direct_write+0x267/0x2d50 [ 327.137420][ T31] 2 locks held by syz-executor236/5862: [ 327.142959][ T31] #0: ffff88823bfbe420 (sb_writers#9){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 327.152245][ T31] #1: ffff8880761b08e0 (&sb->s_type->i_mutex_key#14){+.+.}-{4:4}, at: process_measurement+0x3d8/0x1a40 [ 327.163480][ T31] [ 327.165965][ T31] ============================================= [ 327.165965][ T31] [ 327.174572][ T31] NMI backtrace for cpu 0 [ 327.174594][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.15.0-rc6-syzkaller-00278-g172a9d94339c #0 PREEMPT(full) [ 327.174617][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 327.174629][ T31] Call Trace: [ 327.174636][ T31] [ 327.174644][ T31] dump_stack_lvl+0x189/0x250 [ 327.174675][ T31] ? __wake_up_klogd+0xd9/0x110 [ 327.174701][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 327.174729][ T31] ? __pfx__printk+0x10/0x10 [ 327.174772][ T31] nmi_cpu_backtrace+0x39e/0x3d0 [ 327.174798][ T31] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 327.174812][ T31] ? _printk+0xcf/0x120 [ 327.174838][ T31] ? __pfx__printk+0x10/0x10 [ 327.174863][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 327.174879][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 327.174897][ T31] watchdog+0xfee/0x1030 [ 327.174916][ T31] ? watchdog+0x1de/0x1030 [ 327.174940][ T31] kthread+0x70e/0x8a0 [ 327.174959][ T31] ? __pfx_watchdog+0x10/0x10 [ 327.174976][ T31] ? __pfx_kthread+0x10/0x10 [ 327.174993][ T31] ? __pfx_kthread+0x10/0x10 [ 327.175009][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 327.175026][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 327.175044][ T31] ? __pfx_kthread+0x10/0x10 [ 327.175060][ T31] ret_from_fork+0x4b/0x80 [ 327.175074][ T31] ? __pfx_kthread+0x10/0x10 [ 327.175090][ T31] ret_from_fork_asm+0x1a/0x30 [ 327.175123][ T31] [ 327.175128][ T31] Sending NMI from CPU 0 to CPUs 1: [ 327.321826][ C1] NMI backtrace for cpu 1 [ 327.321842][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 6.15.0-rc6-syzkaller-00278-g172a9d94339c #0 PREEMPT(full) [ 327.321863][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 327.321873][ C1] RIP: 0010:pv_native_safe_halt+0x13/0x20 [ 327.321906][ C1] Code: 43 d4 02 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d a3 9f 18 00 f3 0f 1e fa fb f4 18 d4 02 00 cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 [ 327.321921][ C1] RSP: 0018:ffffc90000197de0 EFLAGS: 000002c6 [ 327.321937][ C1] RAX: a55f7e0638390b00 RBX: ffffffff81977048 RCX: a55f7e0638390b00 [ 327.321950][ C1] RDX: 0000000000000001 RSI: ffffffff8d73a84c RDI: ffffffff8bc12000 [ 327.321963][ C1] RBP: ffffc90000197f20 R08: ffff8880b8932b5b R09: 1ffff1101712656b [ 327.321976][ C1] R10: dffffc0000000000 R11: ffffed101712656c R12: ffffffff8f7e0670 [ 327.321989][ C1] R13: 0000000000000001 R14: 0000000000000001 R15: 1ffff110038dcb40 [ 327.322000][ C1] FS: 0000000000000000(0000) GS:ffff8881261f6000(0000) knlGS:0000000000000000 [ 327.322014][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 327.322026][ C1] CR2: 000055b5f126d168 CR3: 000000000dd38000 CR4: 00000000003526f0 [ 327.322041][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 327.322051][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 327.322061][ C1] Call Trace: [ 327.322069][ C1] [ 327.322075][ C1] default_idle+0x13/0x20 [ 327.322116][ C1] default_idle_call+0x74/0xb0 [ 327.322143][ C1] do_idle+0x1e8/0x510 [ 327.322171][ C1] ? asm_sysvec_call_function_single+0x1a/0x20 [ 327.322191][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 327.322213][ C1] ? __pfx_do_idle+0x10/0x10 [ 327.322245][ C1] ? do_idle+0x4ed/0x510 [ 327.322274][ C1] cpu_startup_entry+0x44/0x60 [ 327.322302][ C1] start_secondary+0x101/0x110 [ 327.322329][ C1] common_startup_64+0x13e/0x147 [ 327.322362][ C1] [ 327.322876][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 327.523230][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.15.0-rc6-syzkaller-00278-g172a9d94339c #0 PREEMPT(full) [ 327.535386][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 327.545449][ T31] Call Trace: [ 327.548730][ T31] [ 327.551664][ T31] dump_stack_lvl+0x99/0x250 [ 327.556294][ T31] ? __asan_memcpy+0x40/0x70 [ 327.560893][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 327.566103][ T31] ? __pfx__printk+0x10/0x10 [ 327.570720][ T31] panic+0x2db/0x790 [ 327.574632][ T31] ? __pfx_panic+0x10/0x10 [ 327.579084][ T31] ? nmi_backtrace_stall_check+0x433/0x440 [ 327.584900][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 327.590291][ T31] ? nmi_trigger_cpumask_backtrace+0x2b6/0x300 [ 327.596478][ T31] watchdog+0x102d/0x1030 [ 327.600825][ T31] ? watchdog+0x1de/0x1030 [ 327.605258][ T31] kthread+0x70e/0x8a0 [ 327.609338][ T31] ? __pfx_watchdog+0x10/0x10 [ 327.614024][ T31] ? __pfx_kthread+0x10/0x10 [ 327.618624][ T31] ? __pfx_kthread+0x10/0x10 [ 327.623224][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 327.628519][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 327.633730][ T31] ? __pfx_kthread+0x10/0x10 [ 327.638331][ T31] ret_from_fork+0x4b/0x80 [ 327.642754][ T31] ? __pfx_kthread+0x10/0x10 [ 327.647441][ T31] ret_from_fork_asm+0x1a/0x30 [ 327.652237][ T31] [ 327.655580][ T31] Kernel Offset: disabled [ 327.659919][ T31] Rebooting in 86400 seconds..