./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3620422733 <...> Warning: Permanently added '10.128.1.87' (ECDSA) to the list of known hosts. execve("./syz-executor3620422733", ["./syz-executor3620422733"], 0x7fffb487fc30 /* 10 vars */) = 0 brk(NULL) = 0x555557287000 brk(0x555557287c40) = 0x555557287c40 arch_prctl(ARCH_SET_FS, 0x555557287300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 set_tid_address(0x5555572875d0) = 292 set_robust_list(0x5555572875e0, 24) = 0 rt_sigaction(SIGRTMIN, {sa_handler=0x7f600e040690, sa_mask=[], sa_flags=SA_RESTORER|SA_SIGINFO, sa_restorer=0x7f600e040d60}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=0x7f600e040730, sa_mask=[], sa_flags=SA_RESTORER|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f600e040d60}, NULL, 8) = 0 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor3620422733", 4096) = 28 brk(0x5555572a8c40) = 0x5555572a8c40 brk(0x5555572a9000) = 0x5555572a9000 mprotect(0x7f600e103000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555572875d0) = 293 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555572875d0) = 294 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555572875d0) = 295 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555572875d0) = 296 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555572875d0) = 297 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555572875d0) = 298 ./strace-static-x86_64: Process 294 attached [pid 294] set_robust_list(0x5555572875e0, 24) = 0 [pid 294] getpid() = 294 [pid 294] mkdir("./syzkaller.6GNILo", 0700./strace-static-x86_64: Process 295 attached ./strace-static-x86_64: Process 296 attached ./strace-static-x86_64: Process 297 attached ./strace-static-x86_64: Process 298 attached ./strace-static-x86_64: Process 293 attached [pid 298] set_robust_list(0x5555572875e0, 24 [pid 297] set_robust_list(0x5555572875e0, 24 [pid 296] set_robust_list(0x5555572875e0, 24 [pid 295] set_robust_list(0x5555572875e0, 24 [pid 296] <... set_robust_list resumed>) = 0 [pid 296] getpid( [pid 298] <... set_robust_list resumed>) = 0 [pid 297] <... set_robust_list resumed>) = 0 [pid 295] <... set_robust_list resumed>) = 0 [pid 294] <... mkdir resumed>) = 0 [pid 293] set_robust_list(0x5555572875e0, 24 [pid 296] <... getpid resumed>) = 296 [pid 297] getpid( [pid 296] mkdir("./syzkaller.2mSqAy", 0700 [pid 295] getpid( [pid 298] getpid( [pid 297] <... getpid resumed>) = 297 [pid 295] <... getpid resumed>) = 295 [pid 294] chmod("./syzkaller.6GNILo", 0777 [pid 293] <... set_robust_list resumed>) = 0 [pid 298] <... getpid resumed>) = 298 [pid 298] mkdir("./syzkaller.kumyKI", 0700 [pid 297] mkdir("./syzkaller.IrUvXE", 0700 [pid 296] <... mkdir resumed>) = 0 [pid 295] mkdir("./syzkaller.qF1bbv", 0700 [pid 294] <... chmod resumed>) = 0 [pid 297] <... mkdir resumed>) = 0 [pid 296] chmod("./syzkaller.2mSqAy", 0777 [pid 294] chdir("./syzkaller.6GNILo" [pid 297] chmod("./syzkaller.IrUvXE", 0777) = 0 [pid 296] <... chmod resumed>) = 0 [pid 293] getpid( [pid 294] <... chdir resumed>) = 0 [pid 297] chdir("./syzkaller.IrUvXE") = 0 [pid 298] <... mkdir resumed>) = 0 [pid 297] mkdir("./0", 0777 [pid 295] <... mkdir resumed>) = 0 [pid 296] chdir("./syzkaller.2mSqAy" [pid 298] chmod("./syzkaller.kumyKI", 0777 [pid 295] chmod("./syzkaller.qF1bbv", 0777 [pid 294] mkdir("./0", 0777 [pid 293] <... getpid resumed>) = 293 [pid 296] <... chdir resumed>) = 0 [pid 297] <... mkdir resumed>) = 0 [pid 295] <... chmod resumed>) = 0 [pid 296] mkdir("./0", 0777 [pid 295] chdir("./syzkaller.qF1bbv" [pid 298] <... chmod resumed>) = 0 [pid 293] mkdir("./syzkaller.SN8fLk", 0700 [pid 295] <... chdir resumed>) = 0 [pid 294] <... mkdir resumed>) = 0 [pid 296] <... mkdir resumed>) = 0 [pid 298] chdir("./syzkaller.kumyKI" [pid 297] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 296] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 295] mkdir("./0", 0777 [pid 294] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 298] <... chdir resumed>) = 0 [pid 293] <... mkdir resumed>) = 0 [pid 295] <... mkdir resumed>) = 0 [pid 298] mkdir("./0", 0777 [pid 295] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 298] <... mkdir resumed>) = 0 [pid 297] <... openat resumed>) = 3 [pid 296] <... openat resumed>) = 3 [pid 293] chmod("./syzkaller.SN8fLk", 0777 [pid 295] <... openat resumed>) = 3 [pid 295] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 295] close(3) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 296] ioctl(3, LOOP_CLR_FD [pid 298] <... openat resumed>) = 3 [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] close(3) = 0 [pid 298] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] close(3) = 0 [pid 297] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] close(3) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 293] <... chmod resumed>) = 0 [pid 295] <... clone resumed>, child_tidptr=0x5555572875d0) = 299 [pid 293] chdir("./syzkaller.SN8fLk") = 0 [pid 293] mkdir("./0", 0777 [pid 298] <... clone resumed>, child_tidptr=0x5555572875d0) = 301 [pid 296] <... clone resumed>, child_tidptr=0x5555572875d0) = 300 [pid 297] <... clone resumed>, child_tidptr=0x5555572875d0) = 302 [pid 293] <... mkdir resumed>) = 0 [pid 293] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 293] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 293] close(3) = 0 [pid 293] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555572875d0) = 303 ./strace-static-x86_64: Process 303 attached [pid 303] set_robust_list(0x5555572875e0, 24) = 0 [pid 303] chdir("./0") = 0 [pid 303] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 303] setpgid(0, 0) = 0 [pid 303] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 303] write(3, "1000", 4) = 4 [pid 303] close(3) = 0 [pid 303] symlink("/dev/binderfs", "./binderfs") = 0 [pid 303] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 303] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 303] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 303] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[304], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 304 [pid 303] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 303] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 304 attached [pid 304] set_robust_list(0x7f600e02f9e0, 24) = 0 [pid 304] memfd_create("syzkaller", 0) = 3 [pid 304] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 [pid 304] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 304] munmap(0x7f6005c0f000, 262144) = 0 [pid 304] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 19.521799][ T30] audit: type=1400 audit(1686806008.038:66): avc: denied { execmem } for pid=292 comm="syz-executor362" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 19.531612][ T30] audit: type=1400 audit(1686806008.038:68): avc: denied { open } for pid=296 comm="syz-executor362" path="/dev/loop3" dev="devtmpfs" ino=115 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 19.542427][ T30] audit: type=1400 audit(1686806008.038:67): avc: denied { read write } for pid=297 comm="syz-executor362" name="loop4" dev="devtmpfs" ino=116 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [pid 304] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 302 attached ./strace-static-x86_64: Process 301 attached ./strace-static-x86_64: Process 300 attached ./strace-static-x86_64: Process 299 attached [pid 294] <... openat resumed>) = 3 [pid 304] <... ioctl resumed>) = 0 [pid 304] close(3) = 0 [pid 304] mkdir("./file1", 0777) = 0 [pid 304] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 302] set_robust_list(0x5555572875e0, 24) = 0 [pid 302] chdir("./0") = 0 [pid 302] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 302] setpgid(0, 0) = 0 [pid 302] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 302] write(3, "1000", 4) = 4 [pid 302] close(3) = 0 [pid 302] symlink("/dev/binderfs", "./binderfs") = 0 [pid 302] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 302] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 302] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 302] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[306], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 306 [pid 302] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 302] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 301] set_robust_list(0x5555572875e0, 24) = 0 [pid 301] chdir("./0") = 0 [pid 301] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 301] setpgid(0, 0) = 0 [pid 301] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 301] write(3, "1000", 4) = 4 [pid 301] close(3) = 0 [pid 301] symlink("/dev/binderfs", "./binderfs") = 0 [pid 301] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 301] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 301] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 301] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[307], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 307 [pid 301] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 301] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 300] set_robust_list(0x5555572875e0, 24) = 0 [pid 300] chdir("./0") = 0 [pid 300] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 300] setpgid(0, 0) = 0 [pid 300] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 300] write(3, "1000", 4) = 4 [pid 300] close(3) = 0 [pid 300] symlink("/dev/binderfs", "./binderfs") = 0 [pid 300] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 300] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 300] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 300] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[308], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 308 [pid 300] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 300] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 299] set_robust_list(0x5555572875e0, 24) = 0 [pid 299] chdir("./0") = 0 [pid 299] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 299] setpgid(0, 0) = 0 [pid 299] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 299] write(3, "1000", 4) = 4 [pid 299] close(3) = 0 [pid 299] symlink("/dev/binderfs", "./binderfs") = 0 [pid 299] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 299] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 299] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 299] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 294] ioctl(3, LOOP_CLR_FD [pid 299] <... clone resumed>, parent_tid=[309], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 309 [pid 299] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 299] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 294] close(3) = 0 [ 19.546398][ T304] loop0: detected capacity change from 0 to 512 [ 19.572880][ T30] audit: type=1400 audit(1686806008.048:69): avc: denied { ioctl } for pid=295 comm="syz-executor362" path="/dev/loop2" dev="devtmpfs" ino=114 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 310 attached ./strace-static-x86_64: Process 309 attached ./strace-static-x86_64: Process 308 attached ./strace-static-x86_64: Process 307 attached ./strace-static-x86_64: Process 306 attached , child_tidptr=0x5555572875d0) = 310 [pid 309] set_robust_list(0x7f600e02f9e0, 24) = 0 [pid 309] memfd_create("syzkaller", 0) = 3 [pid 309] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 [pid 308] set_robust_list(0x7f600e02f9e0, 24 [pid 307] set_robust_list(0x7f600e02f9e0, 24 [pid 308] <... set_robust_list resumed>) = 0 [pid 307] <... set_robust_list resumed>) = 0 [pid 308] memfd_create("syzkaller", 0 [pid 307] memfd_create("syzkaller", 0 [pid 308] <... memfd_create resumed>) = 3 [pid 307] <... memfd_create resumed>) = 3 [pid 308] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 [pid 307] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 [pid 309] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 307] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 306] set_robust_list(0x7f600e02f9e0, 24) = 0 [pid 306] memfd_create("syzkaller", 0) = 3 [pid 306] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 [pid 308] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 309] <... write resumed>) = 262144 [pid 309] munmap(0x7f6005c0f000, 262144) = 0 [pid 309] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 4 [pid 309] ioctl(4, LOOP_SET_FD, 3 [pid 308] <... write resumed>) = 262144 [pid 307] <... write resumed>) = 262144 [pid 306] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 307] munmap(0x7f6005c0f000, 262144 [pid 308] munmap(0x7f6005c0f000, 262144) = 0 [pid 307] <... munmap resumed>) = 0 [pid 307] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 4 [pid 308] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 308] ioctl(4, LOOP_SET_FD, 3 [ 19.602449][ T30] audit: type=1400 audit(1686806008.088:70): avc: denied { mounton } for pid=303 comm="syz-executor362" path="/root/syzkaller.SN8fLk/0/file1" dev="sda1" ino=1940 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 19.632744][ T309] loop2: detected capacity change from 0 to 512 [ 19.632752][ T304] EXT4-fs (loop0): 1 orphan inode deleted [ 19.632768][ T304] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 19.640838][ T308] loop3: detected capacity change from 0 to 512 [pid 307] ioctl(4, LOOP_SET_FD, 3 [pid 304] <... mount resumed>) = 0 [pid 306] <... write resumed>) = 262144 [pid 310] set_robust_list(0x5555572875e0, 24) = 0 [pid 310] chdir("./0") = 0 [pid 310] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 310] setpgid(0, 0) = 0 [pid 310] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 306] munmap(0x7f6005c0f000, 262144) = 0 [pid 310] write(3, "1000", 4) = 4 [pid 310] close(3) = 0 [pid 310] symlink("/dev/binderfs", "./binderfs" [pid 306] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 310] <... symlink resumed>) = 0 [pid 306] ioctl(4, LOOP_SET_FD, 3 [pid 310] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 309] <... ioctl resumed>) = 0 [pid 308] <... ioctl resumed>) = 0 [pid 307] <... ioctl resumed>) = 0 [pid 304] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 309] close(3 [pid 308] close(3 [pid 304] <... openat resumed>) = 3 [pid 309] <... close resumed>) = 0 [pid 308] <... close resumed>) = 0 [pid 304] chdir("./file1" [pid 309] mkdir("./file1", 0777 [pid 308] mkdir("./file1", 0777 [pid 304] <... chdir resumed>) = 0 [pid 309] <... mkdir resumed>) = 0 [pid 308] <... mkdir resumed>) = 0 [pid 304] ioctl(4, LOOP_CLR_FD [pid 309] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 308] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 304] <... ioctl resumed>) = 0 [pid 310] <... futex resumed>) = 0 [pid 307] close(3 [pid 306] <... ioctl resumed>) = 0 [pid 304] close(4 [pid 310] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 307] <... close resumed>) = 0 [pid 304] <... close resumed>) = 0 [pid 304] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 303] <... futex resumed>) = 0 [pid 304] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 303] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 304] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 303] <... futex resumed>) = 0 [ 19.645302][ T304] ext4 filesystem being mounted at /root/syzkaller.SN8fLk/0/file1 supports timestamps until 2038 (0x7fffffff) [ 19.655694][ T307] loop5: detected capacity change from 0 to 512 [ 19.661972][ T30] audit: type=1400 audit(1686806008.158:71): avc: denied { mount } for pid=303 comm="syz-executor362" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 19.675805][ T306] loop4: detected capacity change from 0 to 512 [pid 304] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 303] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 310] <... mmap resumed>) = 0x7f600e00f000 [pid 307] mkdir("./file1", 0777 [pid 306] close(3 [pid 304] <... open resumed>) = 4 [pid 310] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE [pid 307] <... mkdir resumed>) = 0 [pid 310] <... mprotect resumed>) = 0 [pid 307] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 306] <... close resumed>) = 0 [pid 310] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 306] mkdir("./file1", 0777 [pid 310] <... clone resumed>, parent_tid=[317], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 317 [pid 310] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 306] <... mkdir resumed>) = 0 [pid 310] <... futex resumed>) = 0 [pid 310] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 306] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue"./strace-static-x86_64: Process 317 attached [pid 317] set_robust_list(0x7f600e02f9e0, 24) = 0 [pid 317] memfd_create("syzkaller", 0) = 3 [pid 317] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 [pid 317] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 317] munmap(0x7f6005c0f000, 262144) = 0 [pid 317] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4 [pid 317] ioctl(4, LOOP_SET_FD, 3 [pid 304] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 303] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 317] <... ioctl resumed>) = 0 [pid 317] close(3) = 0 [pid 317] mkdir("./file1", 0777) = 0 [pid 317] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 304] <... futex resumed>) = 0 [pid 303] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 304] fallocate(4, 0, 35143, 7) = 0 [pid 303] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 304] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 303] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 304] <... futex resumed>) = 0 [pid 303] <... mmap resumed>) = 0x7f6005c2e000 [pid 304] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 303] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 303] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[323], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 323 [pid 303] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 303] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 323 attached [pid 323] set_robust_list(0x7f6005c4e9e0, 24) = 0 [pid 323] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0 [pid 323] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 303] <... futex resumed>) = 0 [pid 303] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 304] <... futex resumed>) = 0 [pid 303] <... futex resumed>) = 1 [pid 304] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 303] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 304] <... open resumed>) = 5 [pid 304] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 303] <... futex resumed>) = 0 [pid 304] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 303] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 304] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 303] <... futex resumed>) = 0 [pid 304] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 303] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 304] <... futex resumed>) = 0 [pid 303] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 304] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 303] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 303] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 323] <... futex resumed>) = 1 [ 19.712256][ T30] audit: type=1400 audit(1686806008.228:72): avc: denied { write } for pid=303 comm="syz-executor362" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 19.719240][ T317] loop1: detected capacity change from 0 to 512 [ 19.734433][ T30] audit: type=1400 audit(1686806008.228:73): avc: denied { add_name } for pid=303 comm="syz-executor362" name="bus" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 19.765853][ T308] EXT4-fs (loop3): 1 orphan inode deleted [ 19.769502][ T30] audit: type=1400 audit(1686806008.228:74): avc: denied { create } for pid=303 comm="syz-executor362" name="bus" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 19.773127][ T308] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [pid 323] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 304] <... write resumed>) = 262144 [pid 303] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 304] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 304] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 308] <... mount resumed>) = 0 [pid 308] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 308] chdir("./file1") = 0 [pid 308] ioctl(4, LOOP_CLR_FD) = 0 [pid 308] close(4) = 0 [pid 308] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... futex resumed>) = 0 [pid 300] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 300] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 308] <... futex resumed>) = 1 [pid 308] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 308] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... futex resumed>) = 0 [pid 300] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 300] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 300] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6005c2e000 [pid 300] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 300] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[328], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 328 [pid 300] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 300] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 308] <... futex resumed>) = 1 [pid 308] fallocate(4, 0, 35143, 7) = 0 [pid 308] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 308] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 303] exit_group(0 [pid 323] <... futex resumed>) = ? [pid 304] <... futex resumed>) = ? [pid 303] <... exit_group resumed>) = ? [pid 323] +++ exited with 0 +++ [pid 304] +++ exited with 0 +++ [pid 303] +++ exited with 0 +++ [pid 293] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=303, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 293] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 293] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 293] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 293] getdents64(3, 0x555557288620 /* 4 entries */, 32768) = 112 [pid 293] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 293] lstat("./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 293] unlink("./0/binderfs") = 0 [ 19.792321][ T30] audit: type=1400 audit(1686806008.228:75): avc: denied { read write open } for pid=303 comm="syz-executor362" path="/root/syzkaller.SN8fLk/0/file1/bus" dev="loop0" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 19.804571][ T309] EXT4-fs (loop2): 1 orphan inode deleted [ 19.828482][ T308] ext4 filesystem being mounted at /root/syzkaller.2mSqAy/0/file1 supports timestamps until 2038 (0x7fffffff) [ 19.833755][ T309] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 19.852733][ T307] EXT4-fs (loop5): 1 orphan inode deleted [pid 293] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 328 attached [pid 309] <... mount resumed>) = 0 [pid 300] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 300] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 300] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 300] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 300] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 300] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 300] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 308] <... futex resumed>) = 0 [pid 308] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 5 [pid 308] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... futex resumed>) = 0 [pid 300] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 300] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 308] <... futex resumed>) = 1 [pid 308] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096) = -1 EBADF (Bad file descriptor) [pid 308] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... futex resumed>) = 0 [pid 300] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 300] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 308] <... futex resumed>) = 1 [ 19.863430][ T309] ext4 filesystem being mounted at /root/syzkaller.qF1bbv/0/file1 supports timestamps until 2038 (0x7fffffff) [ 19.866098][ T306] EXT4-fs (loop4): 1 orphan inode deleted [ 19.875128][ T307] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 19.881016][ T317] EXT4-fs (loop1): 1 orphan inode deleted [ 19.893649][ T307] ext4 filesystem being mounted at /root/syzkaller.kumyKI/0/file1 supports timestamps until 2038 (0x7fffffff) [ 19.906006][ T306] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [pid 308] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 328] set_robust_list(0x7f6005c4e9e0, 24 [pid 309] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 307] <... mount resumed>) = 0 [pid 308] <... write resumed>) = 167936 [pid 308] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... futex resumed>) = 0 [pid 308] <... futex resumed>) = 1 [pid 308] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 328] <... set_robust_list resumed>) = 0 [pid 309] <... openat resumed>) = 3 [pid 307] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 306] <... mount resumed>) = 0 [pid 306] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 306] chdir("./file1") = 0 [pid 306] ioctl(4, LOOP_CLR_FD) = 0 [pid 306] close(4) = 0 [pid 306] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 302] <... futex resumed>) = 0 [pid 302] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 302] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 306] <... futex resumed>) = 1 [pid 306] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 306] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 302] <... futex resumed>) = 0 [pid 302] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 302] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 302] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6005c2e000 [pid 302] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 302] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[331], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 331 [pid 302] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 302] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 306] <... futex resumed>) = 1 [pid 306] fallocate(4, 0, 35143, 7) = 0 [pid 306] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 306] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 331 attached [pid 331] set_robust_list(0x7f6005c4e9e0, 24) = 0 [pid 331] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL) = 0 [pid 331] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 302] <... futex resumed>) = 0 [pid 302] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 302] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 306] <... futex resumed>) = 0 [pid 306] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 5 [pid 306] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 302] <... futex resumed>) = 0 [pid 302] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 302] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 306] <... futex resumed>) = 1 [pid 306] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096) = -1 EBADF (Bad file descriptor) [pid 306] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 302] <... futex resumed>) = 0 [pid 302] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 302] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 306] <... futex resumed>) = 1 [pid 306] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 293] <... umount2 resumed>) = 0 [pid 293] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 293] lstat("./0/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 293] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 293] openat(AT_FDCWD, "./0/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 293] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 293] getdents64(4, 0x555557290660 /* 2 entries */, 32768) = 48 [pid 293] getdents64(4, 0x555557290660 /* 0 entries */, 32768) = 0 [pid 328] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 309] chdir("./file1" [pid 307] <... openat resumed>) = 3 [pid 293] close(4) = 0 [pid 293] rmdir("./0/file1") = 0 [pid 293] getdents64(3, 0x555557288620 /* 0 entries */, 32768) = 0 [pid 293] close(3) = 0 [pid 293] rmdir("./0") = 0 [pid 293] mkdir("./1", 0777) = 0 [pid 293] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 293] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 293] close(3) = 0 [pid 293] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555572875d0) = 332 [pid 306] <... write resumed>) = 262144 [pid 306] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 302] <... futex resumed>) = 0 [pid 306] <... futex resumed>) = 1 [pid 302] exit_group(0) = ? [pid 306] +++ exited with 0 +++ [pid 331] <... futex resumed>) = ? [pid 309] <... chdir resumed>) = 0 [pid 328] <... mount resumed>) = 0 [pid 309] ioctl(4, LOOP_CLR_FD [pid 307] chdir("./file1" [pid 328] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 309] <... ioctl resumed>) = 0 [pid 307] <... chdir resumed>) = 0 [pid 328] <... futex resumed>) = 0 [pid 309] close(4 [pid 307] ioctl(4, LOOP_CLR_FD./strace-static-x86_64: Process 332 attached [pid 331] +++ exited with 0 +++ [pid 317] <... mount resumed>) = 0 [pid 302] +++ exited with 0 +++ [pid 300] exit_group(0 [pid 309] <... close resumed>) = 0 [pid 308] <... futex resumed>) = ? [pid 307] <... ioctl resumed>) = 0 [pid 300] <... exit_group resumed>) = ? [pid 328] +++ exited with 0 +++ [pid 309] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 308] +++ exited with 0 +++ [pid 307] close(4 [pid 300] +++ exited with 0 +++ [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=302, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 297] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 317] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 309] <... futex resumed>) = 1 [pid 307] <... close resumed>) = 0 [pid 299] <... futex resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=300, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 299] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] restart_syscall(<... resuming interrupted clone ...> [pid 317] <... openat resumed>) = 3 [pid 309] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 307] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... futex resumed>) = 0 [pid 297] <... openat resumed>) = 3 [pid 296] <... restart_syscall resumed>) = 0 [pid 317] chdir("./file1" [pid 309] <... open resumed>) = 4 [pid 307] <... futex resumed>) = 1 [pid 301] <... futex resumed>) = 0 [pid 299] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] fstat(3, [pid 317] <... chdir resumed>) = 0 [pid 309] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 307] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 301] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 297] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 317] ioctl(4, LOOP_CLR_FD [pid 309] <... futex resumed>) = 0 [pid 307] <... open resumed>) = 4 [pid 301] <... futex resumed>) = 0 [pid 299] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] getdents64(3, [pid 296] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 309] fallocate(4, 0, 35143, 7 [pid 307] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... futex resumed>) = 0 [pid 297] <... getdents64 resumed>0x555557288620 /* 4 entries */, 32768) = 112 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 317] <... ioctl resumed>) = 0 [pid 309] <... fallocate resumed>) = 0 [pid 307] <... futex resumed>) = 0 [pid 301] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 299] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 309] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 307] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 301] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... futex resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... openat resumed>) = 3 [pid 309] <... futex resumed>) = 0 [pid 307] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 301] <... futex resumed>) = 0 [pid 299] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 297] lstat("./0/binderfs", [pid 296] fstat(3, [pid 309] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 307] fallocate(4, 0, 35143, 7 [pid 301] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... mmap resumed>) = 0x7f6005c2e000 [pid 297] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 307] <... fallocate resumed>) = 0 [pid 301] <... futex resumed>) = 0 [pid 299] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE [pid 297] unlink("./0/binderfs" [pid 296] getdents64(3, [pid 307] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 299] <... mprotect resumed>) = 0 [pid 297] <... unlink resumed>) = 0 [pid 296] <... getdents64 resumed>0x555557288620 /* 4 entries */, 32768) = 112 [pid 307] <... futex resumed>) = 0 [pid 301] <... mmap resumed>) = 0x7f6005c2e000 [pid 299] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 297] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 317] close(4 [pid 307] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 301] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 332] set_robust_list(0x5555572875e0, 24 [pid 317] <... close resumed>) = 0 [pid 301] <... mprotect resumed>) = 0 [pid 299] <... clone resumed>, parent_tid=[333], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 333 [pid 296] lstat("./0/binderfs", ./strace-static-x86_64: Process 333 attached [pid 332] <... set_robust_list resumed>) = 0 [pid 317] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 299] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 317] <... futex resumed>) = 1 [pid 310] <... futex resumed>) = 0 [pid 299] <... futex resumed>) = 0 [pid 296] unlink("./0/binderfs"./strace-static-x86_64: Process 334 attached [pid 333] set_robust_list(0x7f6005c4e9e0, 24 [pid 332] chdir("./1" [pid 317] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 310] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] <... clone resumed>, parent_tid=[334], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 334 [pid 299] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... unlink resumed>) = 0 [pid 301] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 334] set_robust_list(0x7f6005c4e9e0, 24 [pid 333] <... set_robust_list resumed>) = 0 [pid 332] <... chdir resumed>) = 0 [pid 317] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 310] <... futex resumed>) = 0 [pid 301] <... futex resumed>) = 0 [pid 301] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 332] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 317] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 310] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 334] <... set_robust_list resumed>) = 0 [pid 334] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL) = 0 [pid 334] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 301] <... futex resumed>) = 0 [pid 334] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 301] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 307] <... futex resumed>) = 0 [pid 301] <... futex resumed>) = 1 [pid 307] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 301] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 307] <... open resumed>) = 5 [pid 307] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 301] <... futex resumed>) = 0 [pid 307] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 301] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 307] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 301] <... futex resumed>) = 0 [pid 307] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 301] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 307] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 307] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 301] <... futex resumed>) = 0 [pid 307] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 301] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 307] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 301] <... futex resumed>) = 0 [pid 307] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 301] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 333] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 332] <... prctl resumed>) = 0 [pid 317] <... open resumed>) = 4 [pid 333] <... mount resumed>) = 0 [pid 332] setpgid(0, 0 [pid 317] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 333] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 332] <... setpgid resumed>) = 0 [pid 317] <... futex resumed>) = 1 [pid 310] <... futex resumed>) = 0 [pid 333] <... futex resumed>) = 1 [pid 332] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 317] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 310] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... futex resumed>) = 0 [pid 333] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 332] <... openat resumed>) = 3 [pid 317] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 310] <... futex resumed>) = 0 [pid 307] <... write resumed>) = 262144 [pid 299] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 332] write(3, "1000", 4 [pid 317] fallocate(4, 0, 35143, 7 [pid 310] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 309] <... futex resumed>) = 0 [pid 307] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... futex resumed>) = 1 [pid 307] <... futex resumed>) = 1 [pid 301] <... futex resumed>) = 0 [pid 307] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 301] exit_group(0 [pid 334] <... futex resumed>) = ? [pid 307] <... futex resumed>) = ? [pid 301] <... exit_group resumed>) = ? [pid 334] +++ exited with 0 +++ [pid 307] +++ exited with 0 +++ [pid 301] +++ exited with 0 +++ [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=301, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 298] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 298] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 298] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] getdents64(3, 0x555557288620 /* 4 entries */, 32768) = 112 [pid 298] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 310] <... futex resumed>) = 0 [pid 309] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] lstat("./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 317] <... fallocate resumed>) = 0 [pid 298] unlink("./0/binderfs" [pid 332] <... write resumed>) = 4 [pid 317] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 310] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 309] <... open resumed>) = 5 [pid 299] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... unlink resumed>) = 0 [pid 332] close(3 [pid 317] <... futex resumed>) = 0 [pid 310] <... mmap resumed>) = 0x7f6005c2e000 [pid 309] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 298] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 332] <... close resumed>) = 0 [pid 317] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 310] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE [pid 309] <... futex resumed>) = 0 [pid 299] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 332] symlink("/dev/binderfs", "./binderfs" [pid 310] <... mprotect resumed>) = 0 [pid 309] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 299] <... futex resumed>) = 0 [pid 332] <... symlink resumed>) = 0 [pid 310] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 309] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 299] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 332] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 309] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 332] <... futex resumed>) = 0 [pid 310] <... clone resumed>, parent_tid=[335], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 335 [pid 309] <... futex resumed>) = 0 [pid 299] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 332] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 310] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 309] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 299] <... futex resumed>) = 0 ./strace-static-x86_64: Process 335 attached [pid 332] <... mmap resumed>) = 0x7f600e00f000 [pid 310] <... futex resumed>) = 0 [pid 335] set_robust_list(0x7f6005c4e9e0, 24 [pid 332] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE [pid 310] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 332] <... mprotect resumed>) = 0 [ 19.909199][ T317] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 19.927346][ T306] ext4 filesystem being mounted at /root/syzkaller.IrUvXE/0/file1 supports timestamps until 2038 (0x7fffffff) [ 19.930558][ T317] ext4 filesystem being mounted at /root/syzkaller.6GNILo/0/file1 supports timestamps until 2038 (0x7fffffff) [pid 335] <... set_robust_list resumed>) = 0 [pid 332] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 309] <... write resumed>) = 262144 [pid 335] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 309] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 335] <... mount resumed>) = 0 [pid 309] <... futex resumed>) = 1 [pid 335] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 309] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 335] <... futex resumed>) = 1 [pid 335] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] <... futex resumed>) = 0 [pid 310] <... futex resumed>) = 0 ./strace-static-x86_64: Process 336 attached [pid 310] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] exit_group(0 [pid 336] set_robust_list(0x7f600e02f9e0, 24 [pid 333] <... futex resumed>) = ? [pid 332] <... clone resumed>, parent_tid=[336], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 336 [pid 317] <... futex resumed>) = 0 [pid 310] <... futex resumed>) = 1 [pid 309] <... futex resumed>) = ? [pid 299] <... exit_group resumed>) = ? [pid 336] <... set_robust_list resumed>) = 0 [pid 333] +++ exited with 0 +++ [pid 332] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 317] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 310] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 336] memfd_create("syzkaller", 0 [pid 332] <... futex resumed>) = 0 [pid 317] <... open resumed>) = 5 [pid 336] <... memfd_create resumed>) = 3 [pid 332] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 317] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 336] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 317] <... futex resumed>) = 1 [pid 310] <... futex resumed>) = 0 [pid 336] <... mmap resumed>) = 0x7f6005c0f000 [pid 317] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 310] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 336] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 317] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 310] <... futex resumed>) = 0 [pid 297] <... umount2 resumed>) = 0 [pid 296] <... umount2 resumed>) = 0 [pid 317] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 310] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 317] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 317] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 310] <... futex resumed>) = 0 [pid 317] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 310] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... umount2 resumed>) = 0 [pid 317] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 310] <... futex resumed>) = 0 [pid 317] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 310] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 336] <... write resumed>) = 262144 [pid 336] munmap(0x7f6005c0f000, 262144) = 0 [pid 336] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 336] ioctl(4, LOOP_SET_FD, 3 [pid 317] <... write resumed>) = 262144 [pid 309] +++ exited with 0 +++ [pid 299] +++ exited with 0 +++ [pid 298] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 317] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 317] <... futex resumed>) = 1 [pid 310] <... futex resumed>) = 0 [pid 298] lstat("./0/file1", [pid 297] lstat("./0/file1", [pid 296] lstat("./0/file1", [pid 317] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 310] exit_group(0 [pid 298] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 317] <... futex resumed>) = ? [pid 310] <... exit_group resumed>) = ? [pid 298] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=299, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 317] +++ exited with 0 +++ [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 335] <... futex resumed>) = ? [pid 298] openat(AT_FDCWD, "./0/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... openat resumed>) = 4 [pid 297] openat(AT_FDCWD, "./0/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 336] <... ioctl resumed>) = 0 [pid 298] fstat(4, [pid 296] openat(AT_FDCWD, "./0/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] <... openat resumed>) = 4 [pid 295] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] getdents64(4, [pid 297] fstat(4, [pid 296] <... openat resumed>) = 4 [pid 297] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] <... openat resumed>) = 3 [pid 296] fstat(4, [pid 336] close(3 [pid 298] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 297] getdents64(4, [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] fstat(3, [pid 298] getdents64(4, [pid 297] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 298] <... getdents64 resumed>0x555557290660 /* 0 entries */, 32768) = 0 [pid 297] getdents64(4, [pid 296] getdents64(4, [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] close(4 [pid 297] <... getdents64 resumed>0x555557290660 /* 0 entries */, 32768) = 0 [pid 296] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 297] close(4 [pid 295] getdents64(3, [pid 296] getdents64(4, [pid 298] <... close resumed>) = 0 [pid 297] <... close resumed>) = 0 [pid 296] <... getdents64 resumed>0x555557290660 /* 0 entries */, 32768) = 0 [pid 295] <... getdents64 resumed>0x555557288620 /* 4 entries */, 32768) = 112 [pid 298] rmdir("./0/file1" [pid 297] rmdir("./0/file1" [pid 296] close(4 [pid 295] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 336] <... close resumed>) = 0 [pid 336] mkdir("./file1", 0777 [pid 298] <... rmdir resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 297] <... rmdir resumed>) = 0 [pid 296] rmdir("./0/file1" [pid 298] getdents64(3, [pid 297] getdents64(3, [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... rmdir resumed>) = 0 [pid 295] lstat("./0/binderfs", [pid 297] <... getdents64 resumed>0x555557288620 /* 0 entries */, 32768) = 0 [pid 296] getdents64(3, [pid 298] <... getdents64 resumed>0x555557288620 /* 0 entries */, 32768) = 0 [pid 297] close(3 [pid 296] <... getdents64 resumed>0x555557288620 /* 0 entries */, 32768) = 0 [pid 295] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 298] close(3 [pid 297] <... close resumed>) = 0 [pid 296] close(3 [pid 295] unlink("./0/binderfs" [pid 298] <... close resumed>) = 0 [pid 297] rmdir("./0" [pid 296] <... close resumed>) = 0 [pid 336] <... mkdir resumed>) = 0 [pid 295] <... unlink resumed>) = 0 [pid 336] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 297] <... rmdir resumed>) = 0 [pid 298] rmdir("./0" [pid 296] rmdir("./0" [pid 295] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] mkdir("./1", 0777 [pid 298] <... rmdir resumed>) = 0 [pid 296] <... rmdir resumed>) = 0 [pid 296] mkdir("./1", 0777 [pid 297] <... mkdir resumed>) = 0 [pid 296] <... mkdir resumed>) = 0 [pid 298] mkdir("./1", 0777) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 297] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 296] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 298] <... openat resumed>) = 3 [pid 297] <... openat resumed>) = 3 [pid 296] <... openat resumed>) = 3 [pid 298] ioctl(3, LOOP_CLR_FD [pid 297] ioctl(3, LOOP_CLR_FD [pid 296] ioctl(3, LOOP_CLR_FD [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] close(3 [pid 297] close(3 [pid 296] close(3 [pid 298] <... close resumed>) = 0 [pid 297] <... close resumed>) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] <... close resumed>) = 0 [pid 335] +++ exited with 0 +++ [pid 310] +++ exited with 0 +++ [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=310, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 337 attached [pid 337] set_robust_list(0x5555572875e0, 24) = 0 [pid 337] chdir("./1") = 0 [pid 337] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 337] setpgid(0, 0) = 0 [pid 337] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 294] restart_syscall(<... resuming interrupted clone ...> [pid 337] write(3, "1000", 4) = 4 [pid 337] close(3) = 0 [pid 337] symlink("/dev/binderfs", "./binderfs" [pid 294] <... restart_syscall resumed>) = 0 [pid 298] <... clone resumed>, child_tidptr=0x5555572875d0) = 337 [pid 297] <... clone resumed>, child_tidptr=0x5555572875d0) = 339 [pid 296] <... clone resumed>, child_tidptr=0x5555572875d0) = 340 [pid 294] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 294] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 294] getdents64(3, 0x555557288620 /* 4 entries */, 32768) = 112 [pid 294] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 337] <... symlink resumed>) = 0 [pid 294] lstat("./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 294] unlink("./0/binderfs" [pid 337] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 337] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 294] <... unlink resumed>) = 0 [pid 337] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 294] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 337] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[341], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 341 [pid 337] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 337] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 340 attached [pid 340] set_robust_list(0x5555572875e0, 24) = 0 [pid 340] chdir("./1") = 0 [pid 340] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 340] setpgid(0, 0) = 0 [pid 340] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 340] write(3, "1000", 4) = 4 [pid 340] close(3) = 0 [pid 340] symlink("/dev/binderfs", "./binderfs") = 0 [pid 340] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 340] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 340] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 340] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[342], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 342 [pid 340] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 340] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 342 attached [pid 342] set_robust_list(0x7f600e02f9e0, 24) = 0 [pid 342] memfd_create("syzkaller", 0) = 3 [pid 342] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 [pid 342] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 342] munmap(0x7f6005c0f000, 262144) = 0 [pid 342] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 342] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 341 attached ./strace-static-x86_64: Process 339 attached [pid 295] <... umount2 resumed>) = 0 [pid 295] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] lstat("./0/file1", [pid 339] set_robust_list(0x5555572875e0, 24 [pid 295] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 341] set_robust_list(0x7f600e02f9e0, 24 [pid 339] <... set_robust_list resumed>) = 0 [pid 295] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 342] <... ioctl resumed>) = 0 [pid 342] close(3) = 0 [pid 342] mkdir("./file1", 0777 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 342] <... mkdir resumed>) = 0 [pid 342] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 341] <... set_robust_list resumed>) = 0 [pid 341] memfd_create("syzkaller", 0) = 3 [pid 341] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 [pid 341] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 341] munmap(0x7f6005c0f000, 262144) = 0 [pid 341] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 4 [ 20.011261][ T336] loop0: detected capacity change from 0 to 512 [ 20.044519][ T342] loop3: detected capacity change from 0 to 512 [ 20.053002][ T336] EXT4-fs (loop0): 1 orphan inode deleted [pid 341] ioctl(4, LOOP_SET_FD, 3 [pid 295] openat(AT_FDCWD, "./0/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 341] <... ioctl resumed>) = 0 [pid 341] close(3 [pid 295] <... openat resumed>) = 4 [pid 341] <... close resumed>) = 0 [pid 341] mkdir("./file1", 0777 [pid 295] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 341] <... mkdir resumed>) = 0 [pid 341] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 295] getdents64(4, 0x555557290660 /* 2 entries */, 32768) = 48 [pid 339] chdir("./1" [pid 295] getdents64(4, 0x555557290660 /* 0 entries */, 32768) = 0 [pid 339] <... chdir resumed>) = 0 [pid 295] close(4) = 0 [pid 339] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 295] rmdir("./0/file1" [pid 336] <... mount resumed>) = 0 [pid 336] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 295] <... rmdir resumed>) = 0 [pid 336] <... openat resumed>) = 3 [pid 336] chdir("./file1") = 0 [pid 336] ioctl(4, LOOP_CLR_FD) = 0 [pid 336] close(4) = 0 [pid 336] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 332] <... futex resumed>) = 0 [pid 332] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 332] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 336] <... futex resumed>) = 1 [pid 336] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 295] getdents64(3, 0x555557288620 /* 0 entries */, 32768) = 0 [pid 339] setpgid(0, 0 [pid 295] close(3 [pid 339] <... setpgid resumed>) = 0 [pid 294] <... umount2 resumed>) = 0 [pid 294] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] lstat("./0/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 294] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] openat(AT_FDCWD, "./0/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 294] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 294] getdents64(4, 0x555557290660 /* 2 entries */, 32768) = 48 [pid 295] <... close resumed>) = 0 [pid 294] getdents64(4, 0x555557290660 /* 0 entries */, 32768) = 0 [pid 294] close(4) = 0 [pid 339] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 295] rmdir("./0" [pid 339] <... openat resumed>) = 3 [pid 294] rmdir("./0/file1" [pid 295] <... rmdir resumed>) = 0 [pid 339] write(3, "1000", 4 [pid 295] mkdir("./1", 0777 [pid 294] <... rmdir resumed>) = 0 [pid 339] <... write resumed>) = 4 [pid 294] getdents64(3, 0x555557288620 /* 0 entries */, 32768) = 0 [pid 294] close(3) = 0 [pid 294] rmdir("./0" [pid 295] <... mkdir resumed>) = 0 [pid 294] <... rmdir resumed>) = 0 [pid 339] close(3 [pid 295] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 3 [pid 294] mkdir("./1", 0777 [pid 295] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 295] close(3) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 294] <... mkdir resumed>) = 0 [pid 294] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 294] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 294] close(3) = 0 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] <... clone resumed>, child_tidptr=0x5555572875d0) = 344 [pid 339] <... close resumed>) = 0 [pid 339] symlink("/dev/binderfs", "./binderfs" [pid 294] <... clone resumed>, child_tidptr=0x5555572875d0) = 345 [pid 339] <... symlink resumed>) = 0 [pid 339] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 344 attached ) = 0 [pid 339] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 344] set_robust_list(0x5555572875e0, 24 [pid 339] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 344] <... set_robust_list resumed>) = 0 [pid 344] chdir("./1" [pid 339] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 344] <... chdir resumed>) = 0 [pid 344] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 344] setpgid(0, 0) = 0 [pid 344] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 344] write(3, "1000", 4 [pid 339] <... clone resumed>, parent_tid=[346], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 346 [pid 339] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 339] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 344] <... write resumed>) = 4 [pid 344] close(3) = 0 [pid 344] symlink("/dev/binderfs", "./binderfs") = 0 [pid 344] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 344] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 344] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 344] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[347], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 347 [pid 344] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 344] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 346 attached [pid 346] set_robust_list(0x7f600e02f9e0, 24) = 0 [pid 346] memfd_create("syzkaller", 0) = 3 [pid 346] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 [pid 336] <... open resumed>) = 4 [pid 336] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 332] <... futex resumed>) = 0 [pid 332] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 332] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 332] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6005c2e000 [pid 332] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 332] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[348], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 348 [pid 332] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 332] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 346] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 336] fallocate(4, 0, 35143, 7) = 0 [pid 346] <... write resumed>) = 262144 [pid 346] munmap(0x7f6005c0f000, 262144 [pid 336] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 346] <... munmap resumed>) = 0 [pid 336] <... futex resumed>) = 0 [pid 346] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [ 20.057556][ T341] loop5: detected capacity change from 0 to 512 [ 20.066586][ T336] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 20.078207][ T336] ext4 filesystem being mounted at /root/syzkaller.SN8fLk/1/file1 supports timestamps until 2038 (0x7fffffff) [pid 346] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 347 attached ./strace-static-x86_64: Process 345 attached [pid 336] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 348 attached [pid 348] set_robust_list(0x7f6005c4e9e0, 24) = 0 [pid 348] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0 [pid 348] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 332] <... futex resumed>) = 0 [pid 332] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 348] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 346] <... ioctl resumed>) = 0 [pid 346] close(3) = 0 [pid 346] mkdir("./file1", 0777 [pid 332] <... futex resumed>) = 0 [pid 332] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 346] <... mkdir resumed>) = 0 [pid 346] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 336] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 336] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 5 [pid 336] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 332] <... futex resumed>) = 0 [pid 347] set_robust_list(0x7f600e02f9e0, 24 [pid 336] <... futex resumed>) = 1 [pid 332] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 336] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 332] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 336] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 336] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 345] set_robust_list(0x5555572875e0, 24) = 0 [pid 332] <... futex resumed>) = 0 [pid 336] <... futex resumed>) = 1 [pid 332] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 336] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 332] <... futex resumed>) = 0 [pid 332] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 345] chdir("./1") = 0 [pid 345] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 345] setpgid(0, 0) = 0 [pid 345] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 345] write(3, "1000", 4) = 4 [pid 345] close(3) = 0 [pid 345] symlink("/dev/binderfs", "./binderfs") = 0 [pid 345] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 345] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 345] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 345] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[349], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 349 [pid 345] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 345] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 349 attached [pid 349] set_robust_list(0x7f600e02f9e0, 24) = 0 [pid 349] memfd_create("syzkaller", 0) = 3 [pid 349] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 [pid 349] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 349] munmap(0x7f6005c0f000, 262144) = 0 [pid 349] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4 [pid 349] ioctl(4, LOOP_SET_FD, 3 [pid 347] <... set_robust_list resumed>) = 0 [pid 336] <... write resumed>) = 262144 [pid 336] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 332] <... futex resumed>) = 0 [pid 349] <... ioctl resumed>) = 0 [pid 347] memfd_create("syzkaller", 0 [pid 349] close(3) = 0 [pid 347] <... memfd_create resumed>) = 3 [pid 336] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 332] exit_group(0 [pid 348] <... futex resumed>) = ? [pid 347] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 332] <... exit_group resumed>) = ? [pid 348] +++ exited with 0 +++ [pid 347] <... mmap resumed>) = 0x7f6005c0f000 [pid 347] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 336] <... futex resumed>) = ? [pid 336] +++ exited with 0 +++ [pid 332] +++ exited with 0 +++ [pid 349] mkdir("./file1", 0777 [pid 293] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=332, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 349] <... mkdir resumed>) = 0 [pid 293] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 293] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 347] <... write resumed>) = 262144 [pid 293] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 349] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 293] getdents64(3, 0x555557288620 /* 4 entries */, 32768) = 112 [pid 293] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 293] lstat("./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 293] unlink("./1/binderfs") = 0 [pid 293] umount2("./1/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 347] munmap(0x7f6005c0f000, 262144) = 0 [pid 347] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 4 [pid 347] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 347] close(3) = 0 [pid 347] mkdir("./file1", 0777) = 0 [ 20.107731][ T346] loop4: detected capacity change from 0 to 512 [ 20.125807][ T349] loop1: detected capacity change from 0 to 512 [ 20.135899][ T342] EXT4-fs (loop3): 1 orphan inode deleted [ 20.141500][ T347] loop2: detected capacity change from 0 to 512 [ 20.143376][ T341] EXT4-fs (loop5): 1 orphan inode deleted [pid 347] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 342] <... mount resumed>) = 0 [pid 342] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 342] chdir("./file1") = 0 [pid 342] ioctl(4, LOOP_CLR_FD) = 0 [pid 342] close(4) = 0 [pid 342] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 340] <... futex resumed>) = 0 [pid 340] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 340] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 342] <... futex resumed>) = 1 [ 20.153958][ T341] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 20.158501][ T342] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 20.177184][ T341] ext4 filesystem being mounted at /root/syzkaller.kumyKI/1/file1 supports timestamps until 2038 (0x7fffffff) [ 20.178786][ T349] EXT4-fs (loop1): 1 orphan inode deleted [ 20.194378][ T342] ext4 filesystem being mounted at /root/syzkaller.2mSqAy/1/file1 supports timestamps until 2038 (0x7fffffff) [ 20.194696][ T346] EXT4-fs (loop4): 1 orphan inode deleted [pid 342] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 342] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 341] <... mount resumed>) = 0 [pid 341] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 341] chdir("./file1") = 0 [pid 341] ioctl(4, LOOP_CLR_FD) = 0 [pid 341] close(4) = 0 [pid 341] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 337] <... futex resumed>) = 0 [pid 337] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 337] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 341] <... futex resumed>) = 1 [pid 341] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 342] <... futex resumed>) = 1 [pid 340] <... futex resumed>) = 0 [pid 342] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 340] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 342] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 340] <... futex resumed>) = 0 [pid 342] fallocate(4, 0, 35143, 7 [pid 340] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 342] <... fallocate resumed>) = 0 [pid 341] <... open resumed>) = 4 [pid 340] <... futex resumed>) = 0 [pid 293] <... umount2 resumed>) = 0 [pid 342] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 341] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 340] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 342] <... futex resumed>) = 0 [pid 342] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 341] <... futex resumed>) = 1 [pid 340] <... mmap resumed>) = 0x7f6005c2e000 [pid 337] <... futex resumed>) = 0 [pid 293] umount2("./1/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 340] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 341] fallocate(4, 0, 35143, 7 [pid 340] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 337] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 293] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 341] <... fallocate resumed>) = 0 [pid 337] <... futex resumed>) = 0 [pid 293] lstat("./1/file1", [pid 340] <... clone resumed>, parent_tid=[361], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 361 [pid 341] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 340] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 337] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 293] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 341] <... futex resumed>) = 0 [pid 340] <... futex resumed>) = 0 [pid 337] <... futex resumed>) = 0 [pid 293] umount2("./1/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 340] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 341] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 337] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 293] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 337] <... mmap resumed>) = 0x7f6005c2e000 [pid 293] openat(AT_FDCWD, "./1/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 337] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE [pid 293] <... openat resumed>) = 4 [pid 337] <... mprotect resumed>) = 0 [pid 293] fstat(4, [pid 337] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 293] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 293] getdents64(4, [pid 337] <... clone resumed>, parent_tid=[362], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 362 [pid 293] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 337] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 293] getdents64(4, [pid 337] <... futex resumed>) = 0 [pid 293] <... getdents64 resumed>0x555557290660 /* 0 entries */, 32768) = 0 [pid 337] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 293] close(4) = 0 [pid 293] rmdir("./1/file1") = 0 [pid 293] getdents64(3, 0x555557288620 /* 0 entries */, 32768) = 0 [pid 293] close(3) = 0 [pid 293] rmdir("./1") = 0 [pid 293] mkdir("./2", 0777) = 0 [pid 293] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 293] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 293] close(3) = 0 [pid 293] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555572875d0) = 363 [ 20.208580][ T349] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 20.222916][ T349] ext4 filesystem being mounted at /root/syzkaller.6GNILo/1/file1 supports timestamps until 2038 (0x7fffffff) [ 20.223849][ T347] EXT4-fs (loop2): 1 orphan inode deleted [ 20.236706][ T346] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. ./strace-static-x86_64: Process 363 attached ./strace-static-x86_64: Process 362 attached ./strace-static-x86_64: Process 361 attached [pid 349] <... mount resumed>) = 0 [pid 346] <... mount resumed>) = 0 [pid 346] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 349] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 346] chdir("./file1") = 0 [pid 349] chdir("./file1") = 0 [pid 346] ioctl(4, LOOP_CLR_FD [pid 349] ioctl(4, LOOP_CLR_FD [pid 346] <... ioctl resumed>) = 0 [pid 349] <... ioctl resumed>) = 0 [pid 349] close(4 [pid 346] close(4 [pid 349] <... close resumed>) = 0 [pid 346] <... close resumed>) = 0 [pid 346] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 349] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 345] <... futex resumed>) = 0 [pid 345] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 345] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 346] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 349] <... futex resumed>) = 1 [pid 349] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 349] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 345] <... futex resumed>) = 0 [pid 345] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 345] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 345] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6005c2e000 [pid 345] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 345] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[364], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 364 [pid 345] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 345] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 349] <... futex resumed>) = 1 [pid 349] fallocate(4, 0, 35143, 7) = 0 [pid 349] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 349] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 363] set_robust_list(0x5555572875e0, 24) = 0 [pid 363] chdir("./2") = 0 [pid 363] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 363] setpgid(0, 0) = 0 [pid 363] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 363] write(3, "1000", 4) = 4 [pid 363] close(3) = 0 [pid 363] symlink("/dev/binderfs", "./binderfs") = 0 [pid 363] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 363] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 363] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 363] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[365], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 365 [pid 363] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 363] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 362] set_robust_list(0x7f6005c4e9e0, 24) = 0 [pid 362] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL) = 0 [pid 362] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 337] <... futex resumed>) = 0 [pid 362] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 337] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 341] <... futex resumed>) = 0 [pid 337] <... futex resumed>) = 1 [pid 341] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 337] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 361] set_robust_list(0x7f6005c4e9e0, 24 [pid 341] <... open resumed>) = 5 [pid 341] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 337] <... futex resumed>) = 0 [pid 341] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 337] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 341] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 337] <... futex resumed>) = 0 [pid 341] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 337] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 341] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 341] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 337] <... futex resumed>) = 0 [pid 341] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 337] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 341] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 337] <... futex resumed>) = 0 [pid 341] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 337] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 341] <... write resumed>) = 262144 [pid 341] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 337] <... futex resumed>) = 0 [pid 341] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 337] exit_group(0 [pid 362] <... futex resumed>) = ? [pid 341] <... futex resumed>) = ? [pid 337] <... exit_group resumed>) = ? [pid 362] +++ exited with 0 +++ [pid 361] <... set_robust_list resumed>) = 0 [pid 341] +++ exited with 0 +++ [pid 339] <... futex resumed>) = 0 [pid 337] +++ exited with 0 +++ ./strace-static-x86_64: Process 364 attached [pid 364] set_robust_list(0x7f6005c4e9e0, 24) = 0 [pid 364] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL) = 0 [pid 364] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 345] <... futex resumed>) = 0 [pid 345] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 345] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 349] <... futex resumed>) = 0 [pid 349] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 5 [pid 349] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 345] <... futex resumed>) = 0 [pid 345] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 345] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 349] <... futex resumed>) = 1 [pid 349] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096) = -1 EBADF (Bad file descriptor) [pid 349] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 345] <... futex resumed>) = 0 [pid 345] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 345] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 349] <... futex resumed>) = 1 [pid 349] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 361] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 339] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=337, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 361] <... mount resumed>) = 0 [pid 346] <... futex resumed>) = 0 [pid 339] <... futex resumed>) = 1 [pid 298] restart_syscall(<... resuming interrupted clone ...> [pid 361] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 339] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 361] <... futex resumed>) = 1 [pid 298] <... restart_syscall resumed>) = 0 [pid 340] <... futex resumed>) = 0 [pid 361] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 346] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 340] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 342] <... futex resumed>) = 0 [pid 340] <... futex resumed>) = 1 [pid 342] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 340] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 342] <... open resumed>) = 5 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 342] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 346] <... open resumed>) = 4 [pid 342] <... futex resumed>) = 1 [pid 340] <... futex resumed>) = 0 [pid 298] <... openat resumed>) = 3 [pid 346] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 342] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 340] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] fstat(3, [pid 346] <... futex resumed>) = 1 [pid 342] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 340] <... futex resumed>) = 0 [pid 339] <... futex resumed>) = 0 [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 346] fallocate(4, 0, 35143, 7 [pid 342] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 340] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 339] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] getdents64(3, [pid 342] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 339] <... futex resumed>) = 0 [pid 298] <... getdents64 resumed>0x555557288620 /* 4 entries */, 32768) = 112 [pid 346] <... fallocate resumed>) = 0 [pid 342] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 339] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 346] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 342] <... futex resumed>) = 1 [pid 340] <... futex resumed>) = 0 [pid 339] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 346] <... futex resumed>) = 0 [pid 342] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 340] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 339] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] lstat("./1/binderfs", [pid 342] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 340] <... futex resumed>) = 0 [pid 339] <... mmap resumed>) = 0x7f6005c2e000 [pid 342] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 340] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 339] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE [pid 346] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 339] <... mprotect resumed>) = 0 [ 20.260671][ T346] ext4 filesystem being mounted at /root/syzkaller.IrUvXE/1/file1 supports timestamps until 2038 (0x7fffffff) [ 20.268551][ T347] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [pid 298] unlink("./1/binderfs"./strace-static-x86_64: Process 365 attached [pid 364] <... futex resumed>) = 1 [pid 349] <... write resumed>) = 262144 [pid 342] <... write resumed>) = 262144 [pid 339] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 298] <... unlink resumed>) = 0 [pid 365] set_robust_list(0x7f600e02f9e0, 24 [pid 364] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 349] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 342] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./1/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 349] <... futex resumed>) = 1 [pid 342] <... futex resumed>) = 1 [pid 340] <... futex resumed>) = 0 [pid 339] <... clone resumed>, parent_tid=[366], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 366 [pid 349] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 345] <... futex resumed>) = 0 [pid 345] exit_group(0 [pid 342] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 340] exit_group(0 [pid 339] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 345] <... exit_group resumed>) = ? [pid 361] <... futex resumed>) = ? [pid 342] <... futex resumed>) = ? [pid 340] <... exit_group resumed>) = ? [pid 339] <... futex resumed>) = 0 [pid 361] +++ exited with 0 +++ [pid 347] <... mount resumed>) = 0 [pid 347] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 347] chdir("./file1" [pid 342] +++ exited with 0 +++ [pid 340] +++ exited with 0 +++ [pid 347] <... chdir resumed>) = 0 [pid 339] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=340, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 296] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 349] <... futex resumed>) = ? [pid 296] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 347] ioctl(4, LOOP_CLR_FD [pid 296] <... openat resumed>) = 3 [pid 347] <... ioctl resumed>) = 0 [pid 347] close(4) = 0 [pid 347] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 344] <... futex resumed>) = 0 [pid 344] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 344] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 347] <... futex resumed>) = 1 [pid 347] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 296] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] getdents64(3, [pid 365] <... set_robust_list resumed>) = 0 [pid 296] <... getdents64 resumed>0x555557288620 /* 4 entries */, 32768) = 112 [pid 349] +++ exited with 0 +++ [pid 296] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 364] <... futex resumed>) = 230 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] lstat("./1/binderfs", [pid 365] memfd_create("syzkaller", 0) = 3 [pid 364] +++ exited with 0 +++ [pid 345] +++ exited with 0 +++ [pid 296] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 296] unlink("./1/binderfs" [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=345, si_uid=0, si_status=0, si_utime=0, si_stime=7} --- [pid 296] <... unlink resumed>) = 0 [pid 296] umount2("./1/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 365] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 294] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 365] <... mmap resumed>) = 0x7f6005c0f000 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 294] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 294] getdents64(3, 0x555557288620 /* 4 entries */, 32768) = 112 [pid 294] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] lstat("./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 294] unlink("./1/binderfs") = 0 [pid 294] umount2("./1/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 365] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 365] munmap(0x7f6005c0f000, 262144) = 0 [pid 365] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 365] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 366 attached [pid 347] <... open resumed>) = 4 [pid 347] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 344] <... futex resumed>) = 0 [pid 344] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 344] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 344] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6005c2e000 [pid 344] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 344] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[367], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 367 [pid 344] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 344] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 347] <... futex resumed>) = 1 [pid 347] fallocate(4, 0, 35143, 7) = 0 [pid 347] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 347] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 366] set_robust_list(0x7f6005c4e9e0, 24) = 0 [pid 366] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL) = 0 [pid 366] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 339] <... futex resumed>) = 0 [pid 339] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 346] <... futex resumed>) = 0 [pid 339] <... futex resumed>) = 1 [pid 346] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 339] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 346] <... open resumed>) = 5 [pid 346] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 339] <... futex resumed>) = 0 [pid 346] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 339] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 346] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 339] <... futex resumed>) = 0 [pid 346] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 339] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 346] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 346] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 339] <... futex resumed>) = 0 [pid 346] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 339] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 346] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 339] <... futex resumed>) = 0 [pid 346] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 339] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 367 attached [pid 366] <... futex resumed>) = 1 [pid 365] <... ioctl resumed>) = 0 [pid 365] close(3) = 0 [pid 365] mkdir("./file1", 0777) = 0 [pid 365] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 367] set_robust_list(0x7f6005c4e9e0, 24 [pid 346] <... write resumed>) = 262144 [pid 366] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 346] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 367] <... set_robust_list resumed>) = 0 [pid 346] <... futex resumed>) = 1 [pid 339] <... futex resumed>) = 0 [pid 346] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 339] exit_group(0 [pid 346] <... futex resumed>) = ? [pid 339] <... exit_group resumed>) = ? [pid 367] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 366] <... futex resumed>) = ? [pid 366] +++ exited with 0 +++ [pid 367] <... mount resumed>) = 0 [pid 367] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 367] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 344] <... futex resumed>) = 0 [pid 346] +++ exited with 0 +++ [pid 344] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 339] +++ exited with 0 +++ [pid 344] <... futex resumed>) = 1 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=339, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 344] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] restart_syscall(<... resuming interrupted clone ...> [pid 347] <... futex resumed>) = 0 [pid 347] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 5 [pid 347] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 344] <... futex resumed>) = 0 [pid 347] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 344] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 347] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 344] <... futex resumed>) = 0 [pid 347] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 344] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 347] <... futex resumed>) = 0 [pid 344] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 347] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 344] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 347] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 344] <... futex resumed>) = 0 [pid 347] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 344] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] <... restart_syscall resumed>) = 0 [pid 297] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 297] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] getdents64(3, [pid 347] <... write resumed>) = 262144 [pid 297] <... getdents64 resumed>0x555557288620 /* 4 entries */, 32768) = 112 [pid 347] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 347] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 297] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 344] <... futex resumed>) = 0 [pid 297] lstat("./1/binderfs", [pid 344] exit_group(0 [pid 297] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 297] unlink("./1/binderfs") = 0 [pid 297] umount2("./1/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 344] <... exit_group resumed>) = ? [pid 367] <... futex resumed>) = ? [pid 367] +++ exited with 0 +++ [pid 347] <... futex resumed>) = ? [pid 347] +++ exited with 0 +++ [pid 344] +++ exited with 0 +++ [pid 298] <... umount2 resumed>) = 0 [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=344, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [ 20.302214][ T347] ext4 filesystem being mounted at /root/syzkaller.qF1bbv/1/file1 supports timestamps until 2038 (0x7fffffff) [ 20.328646][ T365] loop0: detected capacity change from 0 to 512 [ 20.346674][ T365] EXT4-fs (loop0): 1 orphan inode deleted [pid 298] umount2("./1/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] lstat("./1/file1", [pid 295] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] <... openat resumed>) = 3 [pid 298] umount2("./1/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] fstat(3, [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] openat(AT_FDCWD, "./1/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] getdents64(3, [pid 298] <... openat resumed>) = 4 [pid 295] <... getdents64 resumed>0x555557288620 /* 4 entries */, 32768) = 112 [pid 298] fstat(4, [pid 295] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] getdents64(4, [pid 295] lstat("./1/binderfs", [pid 298] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 295] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 298] getdents64(4, [pid 295] unlink("./1/binderfs" [pid 298] <... getdents64 resumed>0x555557290660 /* 0 entries */, 32768) = 0 [pid 295] <... unlink resumed>) = 0 [pid 298] close(4 [pid 295] umount2("./1/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... close resumed>) = 0 [pid 298] rmdir("./1/file1") = 0 [pid 298] getdents64(3, 0x555557288620 /* 0 entries */, 32768) = 0 [pid 298] close(3) = 0 [pid 298] rmdir("./1") = 0 [pid 298] mkdir("./2", 0777) = 0 [pid 365] <... mount resumed>) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 3 [pid 298] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 298] close(3 [pid 365] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 298] <... close resumed>) = 0 [pid 294] <... umount2 resumed>) = 0 [pid 294] umount2("./1/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... umount2 resumed>) = 0 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] lstat("./1/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 294] umount2("./1/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 365] <... openat resumed>) = 3 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] umount2("./1/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] openat(AT_FDCWD, "./1/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] <... clone resumed>, child_tidptr=0x5555572875d0) = 370 [pid 296] lstat("./1/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] umount2("./1/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... openat resumed>) = 4 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] fstat(4, [pid 296] openat(AT_FDCWD, "./1/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] <... openat resumed>) = 4 [pid 294] getdents64(4, [pid 296] fstat(4, [pid 294] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] getdents64(4, 0x555557290660 /* 2 entries */, 32768) = 48 [pid 296] getdents64(4, 0x555557290660 /* 0 entries */, 32768) = 0 [pid 296] close(4 [pid 294] getdents64(4, [pid 296] <... close resumed>) = 0 [pid 294] <... getdents64 resumed>0x555557290660 /* 0 entries */, 32768) = 0 [pid 296] rmdir("./1/file1") = 0 [pid 294] close(4 [pid 296] getdents64(3, [pid 294] <... close resumed>) = 0 [pid 296] <... getdents64 resumed>0x555557288620 /* 0 entries */, 32768) = 0 [pid 296] close(3) = 0 [pid 296] rmdir("./1") = 0 [pid 294] rmdir("./1/file1" [pid 296] mkdir("./2", 0777) = 0 [pid 294] <... rmdir resumed>) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 294] getdents64(3, [pid 296] <... openat resumed>) = 3 [pid 294] <... getdents64 resumed>0x555557288620 /* 0 entries */, 32768) = 0 [pid 294] close(3 [pid 296] ioctl(3, LOOP_CLR_FD [pid 294] <... close resumed>) = 0 [pid 294] rmdir("./1" [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] close(3) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 294] <... rmdir resumed>) = 0 [pid 296] <... clone resumed>, child_tidptr=0x5555572875d0) = 371 [pid 294] mkdir("./2", 0777./strace-static-x86_64: Process 370 attached [pid 370] set_robust_list(0x5555572875e0, 24 [pid 294] <... mkdir resumed>) = 0 [pid 370] <... set_robust_list resumed>) = 0 [pid 294] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 294] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 294] close(3 [pid 370] chdir("./2" [pid 294] <... close resumed>) = 0 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 370] <... chdir resumed>) = 0 [pid 370] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 370] setpgid(0, 0) = 0 [pid 370] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 294] <... clone resumed>, child_tidptr=0x5555572875d0) = 372 [pid 370] <... openat resumed>) = 3 [pid 370] write(3, "1000", 4) = 4 [pid 370] close(3) = 0 [pid 370] symlink("/dev/binderfs", "./binderfs") = 0 [pid 370] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 370] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 370] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 370] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 365] chdir("./file1" [pid 370] <... clone resumed>, parent_tid=[373], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 373 [pid 370] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 370] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 372 attached [pid 372] set_robust_list(0x5555572875e0, 24) = 0 [pid 372] chdir("./2" [pid 365] <... chdir resumed>) = 0 [pid 372] <... chdir resumed>) = 0 [pid 372] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 372] setpgid(0, 0) = 0 [pid 372] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 372] write(3, "1000", 4) = 4 [pid 372] close(3) = 0 [pid 372] symlink("/dev/binderfs", "./binderfs" [pid 365] ioctl(4, LOOP_CLR_FD) = 0 [pid 365] close(4 [pid 372] <... symlink resumed>) = 0 [pid 372] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 365] <... close resumed>) = 0 [pid 372] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 365] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 363] <... futex resumed>) = 0 [pid 365] <... futex resumed>) = 1 [pid 363] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 365] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 363] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 372] <... mmap resumed>) = 0x7f600e00f000 [pid 372] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 372] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[374], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 374 [pid 372] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 372] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 374 attached [pid 374] set_robust_list(0x7f600e02f9e0, 24 [pid 365] <... open resumed>) = 4 [pid 365] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 374] <... set_robust_list resumed>) = 0 [pid 365] <... futex resumed>) = 1 [pid 363] <... futex resumed>) = 0 [pid 363] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 365] fallocate(4, 0, 35143, 7 [pid 363] <... futex resumed>) = 0 [pid 363] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 374] memfd_create("syzkaller", 0 [pid 363] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6005c2e000 [pid 363] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE [pid 365] <... fallocate resumed>) = 0 [pid 363] <... mprotect resumed>) = 0 [pid 363] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 365] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 374] <... memfd_create resumed>) = 3 [pid 365] <... futex resumed>) = 0 [pid 363] <... clone resumed>, parent_tid=[375], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 375 [pid 363] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 365] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 363] <... futex resumed>) = 0 [pid 363] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 374] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0./strace-static-x86_64: Process 371 attached ./strace-static-x86_64: Process 373 attached ) = 0x7f6005c0f000 [pid 373] set_robust_list(0x7f600e02f9e0, 24) = 0 [pid 373] memfd_create("syzkaller", 0 [pid 371] set_robust_list(0x5555572875e0, 24) = 0 [pid 371] chdir("./2" [pid 373] <... memfd_create resumed>) = 3 [pid 371] <... chdir resumed>) = 0 [pid 371] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 373] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 371] <... prctl resumed>) = 0 [pid 373] <... mmap resumed>) = 0x7f6005c0f000 [pid 371] setpgid(0, 0) = 0 [pid 371] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 374] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 371] write(3, "1000", 4) = 4 ./strace-static-x86_64: Process 375 attached [pid 375] set_robust_list(0x7f6005c4e9e0, 24) = 0 [pid 375] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 371] close(3 [pid 375] <... mount resumed>) = 0 [pid 375] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 363] <... futex resumed>) = 0 [pid 375] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 363] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 365] <... futex resumed>) = 0 [pid 365] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 363] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 365] <... open resumed>) = 5 [pid 365] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 363] <... futex resumed>) = 0 [pid 365] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 363] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 365] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 363] <... futex resumed>) = 0 [pid 365] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 363] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 365] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 365] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 363] <... futex resumed>) = 0 [pid 365] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 363] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 365] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 363] <... futex resumed>) = 0 [pid 365] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 363] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 374] <... write resumed>) = 262144 [pid 374] munmap(0x7f6005c0f000, 262144) = 0 [pid 374] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4 [pid 374] ioctl(4, LOOP_SET_FD, 3 [pid 373] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 371] <... close resumed>) = 0 [pid 365] <... write resumed>) = 262144 [pid 365] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 363] <... futex resumed>) = 0 [pid 365] <... futex resumed>) = 1 [pid 365] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 363] exit_group(0 [pid 374] <... ioctl resumed>) = 0 [pid 363] <... exit_group resumed>) = ? [pid 375] <... futex resumed>) = ? [pid 365] <... futex resumed>) = ? [pid 374] close(3) = 0 [pid 375] +++ exited with 0 +++ [pid 374] mkdir("./file1", 0777) = 0 [pid 374] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 365] +++ exited with 0 +++ [pid 363] +++ exited with 0 +++ [pid 293] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=363, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 293] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 293] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 293] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 293] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 293] getdents64(3, 0x555557288620 /* 4 entries */, 32768) = 112 [pid 293] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 293] lstat("./2/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 293] unlink("./2/binderfs") = 0 [pid 293] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 373] <... write resumed>) = 262144 [pid 373] munmap(0x7f6005c0f000, 262144) = 0 [pid 373] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 4 [ 20.352973][ T365] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 20.364025][ T365] ext4 filesystem being mounted at /root/syzkaller.SN8fLk/2/file1 supports timestamps until 2038 (0x7fffffff) [ 20.397957][ T374] loop1: detected capacity change from 0 to 512 [pid 373] ioctl(4, LOOP_SET_FD, 3 [pid 371] symlink("/dev/binderfs", "./binderfs" [pid 373] <... ioctl resumed>) = 0 [pid 373] close(3) = 0 [pid 373] mkdir("./file1", 0777 [pid 371] <... symlink resumed>) = 0 [pid 371] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 373] <... mkdir resumed>) = 0 [pid 373] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 371] <... futex resumed>) = 0 [pid 371] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 371] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 371] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[376], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 376 [pid 295] <... umount2 resumed>) = 0 [pid 371] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 371] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 376 attached [pid 376] set_robust_list(0x7f600e02f9e0, 24) = 0 [pid 376] memfd_create("syzkaller", 0) = 3 [pid 376] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 [pid 376] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 376] munmap(0x7f6005c0f000, 262144) = 0 [pid 376] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 376] ioctl(4, LOOP_SET_FD, 3 [pid 297] <... umount2 resumed>) = 0 [pid 295] umount2("./1/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./1/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] lstat("./1/file1", [pid 297] lstat("./1/file1", [pid 295] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] umount2("./1/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./1/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 376] <... ioctl resumed>) = 0 [pid 376] close(3) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./1/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] openat(AT_FDCWD, "./1/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] <... openat resumed>) = 4 [pid 295] <... openat resumed>) = 4 [pid 297] fstat(4, [pid 295] fstat(4, [pid 297] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] getdents64(4, [pid 295] getdents64(4, [pid 297] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 295] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 297] getdents64(4, 0x555557290660 /* 0 entries */, 32768) = 0 [pid 295] getdents64(4, [pid 297] close(4) = 0 [pid 295] <... getdents64 resumed>0x555557290660 /* 0 entries */, 32768) = 0 [pid 297] rmdir("./1/file1" [pid 295] close(4 [pid 376] mkdir("./file1", 0777 [pid 297] <... rmdir resumed>) = 0 [pid 295] <... close resumed>) = 0 [pid 297] getdents64(3, [pid 295] rmdir("./1/file1" [pid 297] <... getdents64 resumed>0x555557288620 /* 0 entries */, 32768) = 0 [pid 295] <... rmdir resumed>) = 0 [pid 297] close(3 [pid 295] getdents64(3, [pid 297] <... close resumed>) = 0 [pid 295] <... getdents64 resumed>0x555557288620 /* 0 entries */, 32768) = 0 [pid 297] rmdir("./1" [pid 295] close(3 [pid 297] <... rmdir resumed>) = 0 [pid 295] <... close resumed>) = 0 [pid 297] mkdir("./2", 0777 [pid 295] rmdir("./1" [pid 376] <... mkdir resumed>) = 0 [pid 376] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 297] <... mkdir resumed>) = 0 [pid 295] <... rmdir resumed>) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 295] mkdir("./2", 0777 [pid 297] <... openat resumed>) = 3 [pid 295] <... mkdir resumed>) = 0 [pid 297] ioctl(3, LOOP_CLR_FD [pid 295] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] close(3 [pid 295] <... openat resumed>) = 3 [pid 297] <... close resumed>) = 0 [pid 295] ioctl(3, LOOP_CLR_FD [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] <... clone resumed>, child_tidptr=0x5555572875d0) = 378 [pid 295] close(3) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555572875d0) = 380 ./strace-static-x86_64: Process 380 attached [pid 380] set_robust_list(0x5555572875e0, 24) = 0 [pid 380] chdir("./2") = 0 ./strace-static-x86_64: Process 378 attached [pid 380] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 380] setpgid(0, 0) = 0 [pid 380] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 380] write(3, "1000", 4 [pid 378] set_robust_list(0x5555572875e0, 24 [pid 380] <... write resumed>) = 4 [pid 380] close(3) = 0 [pid 378] <... set_robust_list resumed>) = 0 [pid 380] symlink("/dev/binderfs", "./binderfs" [pid 378] chdir("./2") = 0 [pid 378] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 378] setpgid(0, 0) = 0 [pid 378] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 380] <... symlink resumed>) = 0 [pid 378] write(3, "1000", 4 [pid 380] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 378] <... write resumed>) = 4 [pid 378] close(3) = 0 [pid 378] symlink("/dev/binderfs", "./binderfs" [pid 380] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 378] <... symlink resumed>) = 0 [pid 378] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 378] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 378] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [ 20.409247][ T373] loop5: detected capacity change from 0 to 512 [ 20.425457][ T376] loop3: detected capacity change from 0 to 512 [ 20.443159][ T374] EXT4-fs (loop1): 1 orphan inode deleted [ 20.450731][ T374] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [pid 380] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE [pid 378] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 380] <... mprotect resumed>) = 0 [pid 293] <... umount2 resumed>) = 0 [pid 293] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 293] lstat("./2/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 293] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 293] openat(AT_FDCWD, "./2/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 293] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 293] getdents64(4, 0x555557290660 /* 2 entries */, 32768) = 48 [pid 293] getdents64(4, 0x555557290660 /* 0 entries */, 32768) = 0 [pid 293] close(4) = 0 [pid 293] rmdir("./2/file1") = 0 [pid 293] getdents64(3, 0x555557288620 /* 0 entries */, 32768) = 0 [pid 293] close(3) = 0 [pid 293] rmdir("./2") = 0 [pid 293] mkdir("./3", 0777) = 0 [pid 293] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 293] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 293] close(3) = 0 [pid 293] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555572875d0) = 385 [pid 378] <... clone resumed>, parent_tid=[386], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 386 [pid 378] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 378] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 380] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 374] <... mount resumed>) = 0 [pid 380] <... clone resumed>, parent_tid=[387], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 387 [pid 380] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 380] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 385 attached ./strace-static-x86_64: Process 386 attached [pid 386] set_robust_list(0x7f600e02f9e0, 24) = 0 [pid 386] memfd_create("syzkaller", 0 [pid 385] set_robust_list(0x5555572875e0, 24) = 0 [pid 385] chdir("./3" [pid 386] <... memfd_create resumed>) = 3 [pid 385] <... chdir resumed>) = 0 [pid 385] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 386] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 385] <... prctl resumed>) = 0 [pid 386] <... mmap resumed>) = 0x7f6005c0f000 [pid 385] setpgid(0, 0) = 0 [pid 385] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC./strace-static-x86_64: Process 387 attached [pid 387] set_robust_list(0x7f600e02f9e0, 24) = 0 [pid 387] memfd_create("syzkaller", 0 [pid 385] <... openat resumed>) = 3 [pid 387] <... memfd_create resumed>) = 3 [pid 385] write(3, "1000", 4) = 4 [pid 387] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 [pid 385] close(3) = 0 [pid 385] symlink("/dev/binderfs", "./binderfs") = 0 [ 20.468405][ T376] EXT4-fs (loop3): 1 orphan inode deleted [ 20.472816][ T374] ext4 filesystem being mounted at /root/syzkaller.6GNILo/2/file1 supports timestamps until 2038 (0x7fffffff) [ 20.484042][ T376] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 20.498895][ T373] EXT4-fs (loop5): 1 orphan inode deleted [ 20.505104][ T373] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [pid 374] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 387] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 386] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 385] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 385] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 385] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 385] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[388], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 388 [pid 385] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 385] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 386] <... write resumed>) = 262144 [pid 386] munmap(0x7f6005c0f000, 262144) = 0 [pid 387] <... write resumed>) = 262144 [pid 386] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 386] ioctl(4, LOOP_SET_FD, 3 [pid 387] munmap(0x7f6005c0f000, 262144 [pid 374] <... openat resumed>) = 3 [pid 373] <... mount resumed>) = 0 [pid 374] chdir("./file1") = 0 [pid 374] ioctl(4, LOOP_CLR_FD) = 0 [pid 374] close(4) = 0 [pid 374] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 387] <... munmap resumed>) = 0 [pid 374] <... futex resumed>) = 1 [pid 373] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 372] <... futex resumed>) = 0 [pid 387] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 4 [pid 373] <... openat resumed>) = 3 [pid 387] ioctl(4, LOOP_SET_FD, 3 [pid 374] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 372] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 374] <... open resumed>) = 4 [pid 372] <... futex resumed>) = 0 [pid 374] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 372] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 374] <... futex resumed>) = 0 [pid 372] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 374] fallocate(4, 0, 35143, 7 [pid 372] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 374] <... fallocate resumed>) = 0 [pid 372] <... futex resumed>) = 0 [pid 374] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 372] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 374] <... futex resumed>) = 0 [pid 372] <... futex resumed>) = 0 [pid 374] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 372] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6005c2e000 [pid 372] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 372] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[389], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 389 [pid 372] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 372] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 389 attached [pid 389] set_robust_list(0x7f6005c4e9e0, 24) = 0 [pid 389] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL) = 0 [pid 389] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 372] <... futex resumed>) = 0 [pid 373] chdir("./file1" [pid 372] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 374] <... futex resumed>) = 0 [pid 372] <... futex resumed>) = 1 ./strace-static-x86_64: Process 388 attached [pid 374] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 373] <... chdir resumed>) = 0 [pid 372] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 388] set_robust_list(0x7f600e02f9e0, 24 [pid 374] <... open resumed>) = 5 [pid 373] ioctl(4, LOOP_CLR_FD [pid 388] <... set_robust_list resumed>) = 0 [pid 374] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 373] <... ioctl resumed>) = 0 [pid 388] memfd_create("syzkaller", 0 [pid 374] <... futex resumed>) = 1 [pid 373] close(4 [pid 372] <... futex resumed>) = 0 [pid 388] <... memfd_create resumed>) = 3 [pid 387] <... ioctl resumed>) = 0 [pid 374] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 373] <... close resumed>) = 0 [pid 372] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 388] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 374] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 372] <... futex resumed>) = 0 [pid 374] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 372] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 374] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 374] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 372] <... futex resumed>) = 0 [pid 374] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 372] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 374] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 372] <... futex resumed>) = 0 [pid 374] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 372] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 374] <... write resumed>) = 262144 [pid 374] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 372] <... futex resumed>) = 0 [pid 374] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 372] exit_group(0 [pid 374] <... futex resumed>) = ? [pid 372] <... exit_group resumed>) = ? [pid 374] +++ exited with 0 +++ [pid 387] close(3) = 0 [pid 387] mkdir("./file1", 0777) = 0 [pid 387] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 388] <... mmap resumed>) = 0x7f6005c0f000 [pid 373] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 376] <... mount resumed>) = 0 [pid 389] <... futex resumed>) = ? [pid 388] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 376] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 373] <... futex resumed>) = 1 [pid 370] <... futex resumed>) = 0 [pid 373] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 370] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 370] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 388] <... write resumed>) = 262144 [pid 389] +++ exited with 0 +++ [pid 388] munmap(0x7f6005c0f000, 262144 [pid 376] <... openat resumed>) = 3 [pid 373] <... open resumed>) = 4 [pid 372] +++ exited with 0 +++ [pid 388] <... munmap resumed>) = 0 [pid 373] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=372, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 388] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 376] chdir("./file1" [pid 373] <... futex resumed>) = 1 [pid 370] <... futex resumed>) = 0 [ 20.516152][ T373] ext4 filesystem being mounted at /root/syzkaller.kumyKI/2/file1 supports timestamps until 2038 (0x7fffffff) [ 20.519815][ T386] loop4: detected capacity change from 0 to 512 [ 20.536974][ T387] loop2: detected capacity change from 0 to 512 [ 20.551347][ T376] ext4 filesystem being mounted at /root/syzkaller.2mSqAy/2/file1 supports timestamps until 2038 (0x7fffffff) [pid 294] restart_syscall(<... resuming interrupted clone ...> [pid 388] <... openat resumed>) = 4 [pid 376] <... chdir resumed>) = 0 [pid 373] fallocate(4, 0, 35143, 7 [pid 370] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] <... restart_syscall resumed>) = 0 [pid 388] ioctl(4, LOOP_SET_FD, 3 [pid 370] <... futex resumed>) = 0 [pid 373] <... fallocate resumed>) = 0 [pid 370] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 294] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW [pid 388] <... ioctl resumed>) = 0 [pid 376] ioctl(4, LOOP_CLR_FD [pid 373] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 370] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 373] <... futex resumed>) = 0 [pid 370] <... mmap resumed>) = 0x7f6005c2e000 [pid 294] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 373] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 370] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE [pid 294] <... openat resumed>) = 3 [pid 370] <... mprotect resumed>) = 0 [pid 294] fstat(3, [pid 370] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 294] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 294] getdents64(3, [pid 370] <... clone resumed>, parent_tid=[393], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 393 [pid 294] <... getdents64 resumed>0x555557288620 /* 4 entries */, 32768) = 112 [pid 370] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 370] <... futex resumed>) = 0 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 370] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] lstat("./2/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 294] unlink("./2/binderfs" [pid 388] close(3 [pid 376] <... ioctl resumed>) = 0 [pid 294] <... unlink resumed>) = 0 [pid 388] <... close resumed>) = 0 [pid 376] close(4 [pid 294] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 388] mkdir("./file1", 0777 [pid 376] <... close resumed>) = 0 [pid 376] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 393 attached ) = 1 [pid 371] <... futex resumed>) = 0 [pid 371] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 376] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 371] <... futex resumed>) = 0 [pid 393] set_robust_list(0x7f6005c4e9e0, 24 [pid 371] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 388] <... mkdir resumed>) = 0 [pid 376] <... open resumed>) = 4 [pid 388] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 376] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 371] <... futex resumed>) = 0 [pid 393] <... set_robust_list resumed>) = 0 [pid 376] fallocate(4, 0, 35143, 7 [pid 371] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 371] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 393] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 371] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 393] <... mount resumed>) = 0 [pid 376] <... fallocate resumed>) = 0 [pid 371] <... mmap resumed>) = 0x7f6005c2e000 [pid 393] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 376] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 371] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE [pid 393] <... futex resumed>) = 1 [pid 376] <... futex resumed>) = 0 [pid 371] <... mprotect resumed>) = 0 [pid 370] <... futex resumed>) = 0 [pid 393] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 376] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 371] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 370] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 373] <... futex resumed>) = 0 [pid 370] <... futex resumed>) = 1 [pid 370] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 373] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 5 [pid 371] <... clone resumed>, parent_tid=[396], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 396 [pid 373] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 371] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 373] <... futex resumed>) = 1 [pid 371] <... futex resumed>) = 0 [pid 370] <... futex resumed>) = 0 [pid 370] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 373] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 371] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 370] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 373] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 373] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 370] <... futex resumed>) = 0 [pid 373] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 370] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 386] <... ioctl resumed>) = 0 [pid 386] close(3) = 0 [pid 386] mkdir("./file1", 0777) = 0 [pid 386] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 373] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 373] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 370] <... futex resumed>) = 0 [ 20.574633][ T388] loop0: detected capacity change from 0 to 512 [ 20.593798][ T388] EXT4-fs (loop0): 1 orphan inode deleted [ 20.602544][ T387] EXT4-fs (loop2): 1 orphan inode deleted [ 20.608644][ T387] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [pid 370] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 396 attached [pid 396] set_robust_list(0x7f6005c4e9e0, 24) = 0 [pid 396] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL) = 0 [pid 396] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 371] <... futex resumed>) = 0 [pid 396] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 371] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 376] <... futex resumed>) = 0 [pid 373] <... write resumed>) = 262144 [pid 371] <... futex resumed>) = 1 [pid 294] <... umount2 resumed>) = 0 [pid 376] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 373] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 371] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 376] <... open resumed>) = 5 [pid 373] <... futex resumed>) = 1 [pid 370] <... futex resumed>) = 0 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 376] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 373] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 370] exit_group(0 [pid 294] lstat("./2/file1", [pid 393] <... futex resumed>) = ? [pid 376] <... futex resumed>) = 1 [pid 373] <... futex resumed>) = ? [pid 371] <... futex resumed>) = 0 [pid 370] <... exit_group resumed>) = ? [pid 294] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 393] +++ exited with 0 +++ [pid 388] <... mount resumed>) = 0 [pid 387] <... mount resumed>) = 0 [pid 376] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 373] +++ exited with 0 +++ [pid 371] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 370] +++ exited with 0 +++ [pid 294] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 388] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 387] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=370, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 388] <... openat resumed>) = 3 [pid 387] <... openat resumed>) = 3 [pid 388] chdir("./file1" [pid 387] chdir("./file1" [pid 388] <... chdir resumed>) = 0 [pid 388] ioctl(4, LOOP_CLR_FD [pid 387] <... chdir resumed>) = 0 [pid 376] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 371] <... futex resumed>) = 0 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 388] <... ioctl resumed>) = 0 [pid 298] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW [pid 388] close(4 [pid 387] ioctl(4, LOOP_CLR_FD [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 388] <... close resumed>) = 0 [pid 387] <... ioctl resumed>) = 0 [pid 298] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 388] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 387] close(4 [pid 298] <... openat resumed>) = 3 [pid 388] <... futex resumed>) = 1 [pid 387] <... close resumed>) = 0 [pid 385] <... futex resumed>) = 0 [pid 298] fstat(3, [pid 388] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 387] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 385] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 388] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 387] <... futex resumed>) = 1 [pid 385] <... futex resumed>) = 0 [pid 298] getdents64(3, [pid 388] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 387] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 385] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... getdents64 resumed>0x555557288620 /* 4 entries */, 32768) = 112 [pid 388] <... open resumed>) = 4 [pid 380] <... futex resumed>) = 0 [pid 376] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 371] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] openat(AT_FDCWD, "./2/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 388] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 380] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 388] <... futex resumed>) = 1 [pid 385] <... futex resumed>) = 0 [pid 298] lstat("./2/binderfs", [pid 388] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 385] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 388] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 385] <... futex resumed>) = 0 [pid 298] unlink("./2/binderfs" [pid 388] fallocate(4, 0, 35143, 7 [pid 385] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... unlink resumed>) = 0 [pid 388] <... fallocate resumed>) = 0 [pid 387] <... futex resumed>) = 0 [pid 385] <... futex resumed>) = 0 [pid 380] <... futex resumed>) = 1 [pid 376] <... futex resumed>) = 0 [pid 371] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 298] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... openat resumed>) = 4 [pid 388] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 387] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 385] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 380] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 376] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 371] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 388] <... futex resumed>) = 0 [pid 385] <... mmap resumed>) = 0x7f6005c2e000 [pid 388] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 385] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 385] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 376] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 371] <... futex resumed>) = 0 [pid 294] fstat(4, [pid 385] <... clone resumed>, parent_tid=[400], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 400 [pid 385] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 376] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 371] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 385] <... futex resumed>) = 0 [pid 385] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 387] <... open resumed>) = 4 [pid 376] <... write resumed>) = 262144 [pid 298] <... umount2 resumed>) = 0 [pid 294] getdents64(4, 0x555557290660 /* 2 entries */, 32768) = 48 [pid 294] getdents64(4, 0x555557290660 /* 0 entries */, 32768) = 0 [pid 294] close(4) = 0 [pid 294] rmdir("./2/file1") = 0 [pid 294] getdents64(3, 0x555557288620 /* 0 entries */, 32768) = 0 [pid 294] close(3) = 0 [pid 294] rmdir("./2") = 0 [pid 294] mkdir("./3", 0777) = 0 [pid 294] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 294] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 294] close(3) = 0 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555572875d0) = 401 [pid 376] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 387] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 376] <... futex resumed>) = 1 [pid 371] <... futex resumed>) = 0 [pid 387] <... futex resumed>) = 1 [pid 380] <... futex resumed>) = 0 [pid 376] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 371] exit_group(0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 396] <... futex resumed>) = -1 EINVAL (Invalid argument) [pid 387] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 380] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 396] +++ exited with 0 +++ [pid 371] <... exit_group resumed>) = ? [pid 380] <... futex resumed>) = 0 [pid 387] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 380] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 376] <... futex resumed>) = ? [pid 298] lstat("./2/file1", [pid 387] fallocate(4, 0, 35143, 7 [pid 380] <... futex resumed>) = 0 [pid 380] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 387] <... fallocate resumed>) = 0 [pid 380] <... mmap resumed>) = 0x7f6005c2e000 [pid 376] +++ exited with 0 +++ [pid 371] +++ exited with 0 +++ [pid 298] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 387] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 380] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=371, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 380] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 296] restart_syscall(<... resuming interrupted clone ...> [pid 380] <... clone resumed>, parent_tid=[402], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 402 [pid 380] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 380] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 387] <... futex resumed>) = 0 [pid 296] <... restart_syscall resumed>) = 0 [pid 296] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 296] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] getdents64(3, 0x555557288620 /* 4 entries */, 32768) = 112 [pid 296] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] openat(AT_FDCWD, "./2/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] lstat("./2/binderfs", [pid 298] <... openat resumed>) = 4 [pid 296] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 ./strace-static-x86_64: Process 400 attached [pid 400] set_robust_list(0x7f6005c4e9e0, 24) = 0 [pid 400] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 296] unlink("./2/binderfs" [pid 298] fstat(4, [pid 400] <... mount resumed>) = 0 [pid 400] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... unlink resumed>) = 0 [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] getdents64(4, [pid 385] <... futex resumed>) = 0 [pid 385] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 388] <... futex resumed>) = 0 [pid 385] <... futex resumed>) = 1 [pid 388] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 385] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 388] <... open resumed>) = 5 [pid 388] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 385] <... futex resumed>) = 0 [pid 388] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 385] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 388] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 385] <... futex resumed>) = 0 [pid 388] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 385] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 388] <... futex resumed>) = 0 [pid 385] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 388] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 385] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 387] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 385] <... futex resumed>) = 0 [pid 298] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 385] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 400] <... futex resumed>) = 1 [pid 400] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 388] <... write resumed>) = 262144 [pid 298] getdents64(4, [pid 388] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... getdents64 resumed>0x555557290660 /* 0 entries */, 32768) = 0 [pid 388] <... futex resumed>) = 1 [pid 385] <... futex resumed>) = 0 [pid 298] close(4 [pid 388] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 385] exit_group(0 [pid 298] <... close resumed>) = 0 [pid 388] <... futex resumed>) = ? [pid 385] <... exit_group resumed>) = ? [pid 298] rmdir("./2/file1" [pid 388] +++ exited with 0 +++ [pid 298] <... rmdir resumed>) = 0 [ 20.620928][ T388] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 20.631324][ T387] ext4 filesystem being mounted at /root/syzkaller.qF1bbv/2/file1 supports timestamps until 2038 (0x7fffffff) [ 20.632423][ T388] ext4 filesystem being mounted at /root/syzkaller.SN8fLk/3/file1 supports timestamps until 2038 (0x7fffffff) [ 20.667086][ T386] EXT4-fs (loop4): 1 orphan inode deleted [pid 298] getdents64(3, ./strace-static-x86_64: Process 402 attached ./strace-static-x86_64: Process 401 attached [pid 400] <... futex resumed>) = ? [pid 298] <... getdents64 resumed>0x555557288620 /* 0 entries */, 32768) = 0 [pid 298] close(3) = 0 [pid 298] rmdir("./2" [pid 402] set_robust_list(0x7f6005c4e9e0, 24 [pid 401] set_robust_list(0x5555572875e0, 24 [pid 400] +++ exited with 0 +++ [pid 385] +++ exited with 0 +++ [pid 298] <... rmdir resumed>) = 0 [pid 402] <... set_robust_list resumed>) = 0 [pid 298] mkdir("./3", 0777 [pid 386] <... mount resumed>) = 0 [pid 293] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=385, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 401] <... set_robust_list resumed>) = 0 [pid 402] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL) = 0 [pid 401] chdir("./3" [pid 386] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 402] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 401] <... chdir resumed>) = 0 [pid 298] <... mkdir resumed>) = 0 [pid 402] <... futex resumed>) = 1 [pid 401] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 380] <... futex resumed>) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 293] umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW [pid 402] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 401] <... prctl resumed>) = 0 [pid 380] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 293] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 401] setpgid(0, 0 [pid 387] <... futex resumed>) = 0 [pid 380] <... futex resumed>) = 1 [pid 293] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 401] <... setpgid resumed>) = 0 [pid 387] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 380] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 293] <... openat resumed>) = 3 [pid 293] fstat(3, [pid 401] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 293] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 387] <... open resumed>) = 5 [pid 387] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 401] <... openat resumed>) = 3 [pid 387] <... futex resumed>) = 1 [pid 380] <... futex resumed>) = 0 [pid 293] getdents64(3, 0x555557288620 /* 4 entries */, 32768) = 112 [pid 293] umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 293] lstat("./3/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 293] unlink("./3/binderfs") = 0 [pid 293] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 380] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 387] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 380] <... futex resumed>) = 0 [pid 387] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 401] write(3, "1000", 4 [pid 380] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 386] <... openat resumed>) = 3 [pid 386] chdir("./file1") = 0 [pid 386] ioctl(4, LOOP_CLR_FD) = 0 [pid 386] close(4) = 0 [pid 386] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 378] <... futex resumed>) = 0 [pid 378] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 378] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 386] <... futex resumed>) = 1 [pid 387] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 386] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 387] <... futex resumed>) = 1 [pid 387] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 380] <... futex resumed>) = 0 [pid 401] <... write resumed>) = 4 [pid 401] close(3 [pid 387] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 380] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 386] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 380] <... futex resumed>) = 0 [pid 387] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 401] <... close resumed>) = 0 [pid 380] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 378] <... futex resumed>) = 0 [pid 378] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 378] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 378] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6005c2e000 [pid 378] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 378] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[403], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 403 [pid 378] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 378] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 386] <... futex resumed>) = 1 [pid 386] fallocate(4, 0, 35143, 7) = 0 [pid 386] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 386] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 401] symlink("/dev/binderfs", "./binderfs"./strace-static-x86_64: Process 403 attached [pid 403] set_robust_list(0x7f6005c4e9e0, 24) = 0 [pid 403] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL) = 0 [pid 403] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 378] <... futex resumed>) = 0 [pid 378] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 378] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 386] <... futex resumed>) = 0 [pid 386] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 5 [pid 386] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 378] <... futex resumed>) = 0 [pid 378] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 378] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 386] <... futex resumed>) = 1 [pid 386] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 296] <... umount2 resumed>) = 0 [pid 386] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 386] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 378] <... futex resumed>) = 0 [pid 378] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 378] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 386] <... futex resumed>) = 1 [pid 386] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 403] <... futex resumed>) = 1 [pid 298] <... openat resumed>) = 3 [pid 296] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 403] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 387] <... write resumed>) = 262144 [pid 387] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 387] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 401] <... symlink resumed>) = 0 [pid 401] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 401] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 380] <... futex resumed>) = 0 [pid 298] ioctl(3, LOOP_CLR_FD [pid 380] exit_group(0 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 402] <... futex resumed>) = ? [pid 380] <... exit_group resumed>) = ? [pid 298] close(3 [pid 296] lstat("./2/file1", [pid 402] +++ exited with 0 +++ [pid 401] <... mmap resumed>) = 0x7f600e00f000 [pid 401] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 298] <... close resumed>) = 0 [pid 296] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 401] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 296] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 401] <... clone resumed>, parent_tid=[405], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 405 [pid 401] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 401] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... clone resumed>, child_tidptr=0x5555572875d0) = 404 [pid 296] openat(AT_FDCWD, "./2/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 387] <... futex resumed>) = ? [pid 296] <... openat resumed>) = 4 [pid 296] fstat(4, [pid 387] +++ exited with 0 +++ [pid 380] +++ exited with 0 +++ [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] getdents64(4, [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=380, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 296] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 295] restart_syscall(<... resuming interrupted clone ...> [pid 296] getdents64(4, 0x555557290660 /* 0 entries */, 32768) = 0 [pid 295] <... restart_syscall resumed>) = 0 [pid 296] close(4) = 0 [pid 296] rmdir("./2/file1" [pid 295] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] <... rmdir resumed>) = 0 [pid 295] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] getdents64(3, [pid 295] <... openat resumed>) = 3 [pid 296] <... getdents64 resumed>0x555557288620 /* 0 entries */, 32768) = 0 [pid 295] fstat(3, [pid 296] close(3 [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] <... close resumed>) = 0 [pid 296] rmdir("./2" [pid 295] getdents64(3, 0x555557288620 /* 4 entries */, 32768) = 112 [pid 296] <... rmdir resumed>) = 0 [pid 295] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] mkdir("./3", 0777 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] lstat("./2/binderfs", [pid 296] <... mkdir resumed>) = 0 [pid 295] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 295] unlink("./2/binderfs") = 0 [pid 296] <... openat resumed>) = 3 [pid 295] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) ./strace-static-x86_64: Process 405 attached [pid 386] <... write resumed>) = 262144 [pid 296] close(3) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 404 attached [pid 404] set_robust_list(0x5555572875e0, 24) = 0 [pid 404] chdir("./3") = 0 [pid 404] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 404] setpgid(0, 0) = 0 [pid 404] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 296] <... clone resumed>, child_tidptr=0x5555572875d0) = 406 [pid 404] write(3, "1000", 4) = 4 [pid 404] close(3) = 0 [pid 404] symlink("/dev/binderfs", "./binderfs") = 0 [pid 404] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 404] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 404] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 404] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[407], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 407 [pid 404] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 404] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 407 attached [pid 407] set_robust_list(0x7f600e02f9e0, 24) = 0 [pid 407] memfd_create("syzkaller", 0) = 3 [pid 407] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 [pid 407] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 407] munmap(0x7f6005c0f000, 262144) = 0 [pid 407] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 4 [ 20.698391][ T386] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 20.709792][ T386] ext4 filesystem being mounted at /root/syzkaller.IrUvXE/2/file1 supports timestamps until 2038 (0x7fffffff) [pid 407] ioctl(4, LOOP_SET_FD, 3 [pid 386] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 407] <... ioctl resumed>) = 0 [pid 407] close(3) = 0 [pid 407] mkdir("./file1", 0777 [pid 386] <... futex resumed>) = 1 [pid 378] <... futex resumed>) = 0 [pid 378] exit_group(0 [pid 403] <... futex resumed>) = ? [pid 378] <... exit_group resumed>) = ? [pid 403] +++ exited with 0 +++ [pid 407] <... mkdir resumed>) = 0 [pid 407] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 405] set_robust_list(0x7f600e02f9e0, 24) = 0 [pid 405] memfd_create("syzkaller", 0 [pid 386] +++ exited with 0 +++ [pid 378] +++ exited with 0 +++ [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=378, si_uid=0, si_status=0, si_utime=0, si_stime=7} --- [pid 297] restart_syscall(<... resuming interrupted clone ...> [pid 405] <... memfd_create resumed>) = 3 [pid 405] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 [pid 297] <... restart_syscall resumed>) = 0 [pid 297] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 297] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] getdents64(3, 0x555557288620 /* 4 entries */, 32768) = 112 [pid 297] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] lstat("./2/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 297] unlink("./2/binderfs") = 0 [pid 297] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 405] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 405] munmap(0x7f6005c0f000, 262144) = 0 [pid 405] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4 [pid 405] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 405] close(3) = 0 [pid 405] mkdir("./file1", 0777) = 0 [pid 405] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue"./strace-static-x86_64: Process 406 attached [pid 406] set_robust_list(0x5555572875e0, 24) = 0 [pid 406] chdir("./3") = 0 [pid 406] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 406] setpgid(0, 0) = 0 [pid 406] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 406] write(3, "1000", 4) = 4 [pid 406] close(3) = 0 [pid 406] symlink("/dev/binderfs", "./binderfs") = 0 [pid 406] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 406] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 406] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 406] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[410], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 410 [pid 406] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 406] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 410 attached [pid 410] set_robust_list(0x7f600e02f9e0, 24) = 0 [pid 410] memfd_create("syzkaller", 0) = 3 [pid 410] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 [pid 410] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 410] munmap(0x7f6005c0f000, 262144 [pid 293] <... umount2 resumed>) = 0 [pid 410] <... munmap resumed>) = 0 [pid 410] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 410] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 293] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 410] close(3) = 0 [pid 410] mkdir("./file1", 0777) = 0 [pid 410] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 293] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 293] lstat("./3/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 293] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 293] openat(AT_FDCWD, "./3/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 293] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 293] getdents64(4, 0x555557290660 /* 2 entries */, 32768) = 48 [pid 293] getdents64(4, 0x555557290660 /* 0 entries */, 32768) = 0 [pid 293] close(4) = 0 [pid 293] rmdir("./3/file1") = 0 [pid 293] getdents64(3, 0x555557288620 /* 0 entries */, 32768) = 0 [pid 293] close(3) = 0 [pid 293] rmdir("./3") = 0 [pid 293] mkdir("./4", 0777) = 0 [pid 293] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 293] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 293] close(3) = 0 [pid 293] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555572875d0) = 412 [ 20.753013][ T407] loop5: detected capacity change from 0 to 512 [ 20.766474][ T405] loop1: detected capacity change from 0 to 512 [ 20.780499][ T410] loop3: detected capacity change from 0 to 512 [ 20.781223][ T407] EXT4-fs (loop5): 1 orphan inode deleted [ 20.792508][ T407] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. ./strace-static-x86_64: Process 412 attached [pid 412] set_robust_list(0x5555572875e0, 24 [pid 407] <... mount resumed>) = 0 [pid 412] <... set_robust_list resumed>) = 0 [pid 412] chdir("./4") = 0 [pid 412] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 412] setpgid(0, 0) = 0 [pid 412] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 412] write(3, "1000", 4) = 4 [pid 412] close(3) = 0 [pid 412] symlink("/dev/binderfs", "./binderfs") = 0 [pid 412] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 412] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 412] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 412] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[415], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 415 [pid 412] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 412] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 407] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 407] chdir("./file1") = 0 [pid 407] ioctl(4, LOOP_CLR_FD) = 0 [pid 407] close(4) = 0 [pid 407] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 407] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 415 attached [pid 415] set_robust_list(0x7f600e02f9e0, 24) = 0 [pid 415] memfd_create("syzkaller", 0) = 3 [pid 415] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 [pid 415] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 415] munmap(0x7f6005c0f000, 262144) = 0 [pid 415] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 415] ioctl(4, LOOP_SET_FD, 3 [pid 404] <... futex resumed>) = 0 [pid 297] <... umount2 resumed>) = 0 [pid 295] <... umount2 resumed>) = 0 [pid 295] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] lstat("./2/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] lstat("./2/file1", [pid 295] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./2/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... openat resumed>) = 4 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] fstat(4, [pid 415] <... ioctl resumed>) = 0 [pid 405] <... mount resumed>) = 0 [pid 404] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] openat(AT_FDCWD, "./2/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 405] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 404] <... futex resumed>) = 1 [pid 405] <... openat resumed>) = 3 [pid 404] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 405] chdir("./file1") = 0 [pid 405] ioctl(4, LOOP_CLR_FD) = 0 [pid 405] close(4) = 0 [pid 405] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 401] <... futex resumed>) = 0 [pid 405] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 401] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 405] <... open resumed>) = 4 [pid 401] <... futex resumed>) = 0 [pid 405] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 401] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 405] <... futex resumed>) = 0 [pid 401] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 405] fallocate(4, 0, 35143, 7 [pid 401] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 405] <... fallocate resumed>) = 0 [pid 401] <... futex resumed>) = 0 [pid 405] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 401] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 405] <... futex resumed>) = 0 [pid 401] <... futex resumed>) = 0 [pid 405] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 401] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6005c2e000 [pid 401] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE) = 0 [ 20.801044][ T405] EXT4-fs (loop1): 1 orphan inode deleted [ 20.804006][ T407] ext4 filesystem being mounted at /root/syzkaller.kumyKI/3/file1 supports timestamps until 2038 (0x7fffffff) [ 20.809967][ T405] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 20.829260][ T415] loop0: detected capacity change from 0 to 512 [ 20.832580][ T405] ext4 filesystem being mounted at /root/syzkaller.6GNILo/3/file1 supports timestamps until 2038 (0x7fffffff) [pid 401] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[417], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 417 [pid 401] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 401] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 415] close(3) = 0 [pid 415] mkdir("./file1", 0777 [pid 407] <... futex resumed>) = 0 [pid 297] <... openat resumed>) = 4 [pid 295] getdents64(4, [pid 407] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 297] fstat(4, [pid 295] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 ./strace-static-x86_64: Process 417 attached [pid 415] <... mkdir resumed>) = 0 [pid 407] <... open resumed>) = 4 [pid 297] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] getdents64(4, [pid 407] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] getdents64(4, [pid 295] <... getdents64 resumed>0x555557290660 /* 0 entries */, 32768) = 0 [pid 407] <... futex resumed>) = 1 [pid 404] <... futex resumed>) = 0 [pid 404] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 407] fallocate(4, 0, 35143, 7 [pid 404] <... futex resumed>) = 0 [pid 297] getdents64(4, [pid 295] close(4 [pid 407] <... fallocate resumed>) = 0 [pid 404] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... getdents64 resumed>0x555557290660 /* 0 entries */, 32768) = 0 [pid 295] <... close resumed>) = 0 [pid 407] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 404] <... futex resumed>) = 0 [pid 297] close(4 [pid 295] rmdir("./2/file1" [pid 407] <... futex resumed>) = 0 [pid 404] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 297] <... close resumed>) = 0 [pid 295] <... rmdir resumed>) = 0 [pid 404] <... mmap resumed>) = 0x7f6005c2e000 [pid 297] rmdir("./2/file1" [pid 407] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 404] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE [pid 295] getdents64(3, [pid 417] set_robust_list(0x7f6005c4e9e0, 24 [pid 415] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 404] <... mprotect resumed>) = 0 [pid 297] <... rmdir resumed>) = 0 [pid 295] <... getdents64 resumed>0x555557288620 /* 0 entries */, 32768) = 0 [pid 404] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 297] getdents64(3, [pid 295] close(3 [pid 297] <... getdents64 resumed>0x555557288620 /* 0 entries */, 32768) = 0 [pid 295] <... close resumed>) = 0 [pid 297] close(3 [pid 295] rmdir("./2" [pid 297] <... close resumed>) = 0 [pid 410] <... mount resumed>) = 0 [pid 410] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 295] <... rmdir resumed>) = 0 [pid 297] rmdir("./2" [pid 410] <... openat resumed>) = 3 [pid 410] chdir("./file1" [pid 297] <... rmdir resumed>) = 0 [pid 404] <... clone resumed>, parent_tid=[418], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 418 [pid 404] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 404] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 410] <... chdir resumed>) = 0 [pid 410] ioctl(4, LOOP_CLR_FD [pid 295] mkdir("./3", 0777 [pid 297] mkdir("./3", 0777 [pid 410] <... ioctl resumed>) = 0 [pid 410] close(4 [pid 295] <... mkdir resumed>) = 0 [pid 410] <... close resumed>) = 0 [pid 410] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 406] <... futex resumed>) = 0 [pid 297] <... mkdir resumed>) = 0 [pid 406] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 406] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 410] <... futex resumed>) = 1 [pid 410] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 297] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 3 [pid 295] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 410] <... open resumed>) = 4 [pid 410] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 406] <... futex resumed>) = 0 [pid 406] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 406] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 406] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6005c2e000 [pid 406] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 406] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[419], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 419 [pid 406] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 406] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 410] <... futex resumed>) = 1 [pid 410] fallocate(4, 0, 35143, 7) = 0 [pid 410] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 410] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 295] <... openat resumed>) = 3 [pid 297] ioctl(3, LOOP_CLR_FD [pid 295] ioctl(3, LOOP_CLR_FD [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] close(3 [pid 295] close(3 [pid 297] <... close resumed>) = 0 [pid 295] <... close resumed>) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555572875d0) = 421 [pid 297] <... clone resumed>, child_tidptr=0x5555572875d0) = 420 ./strace-static-x86_64: Process 420 attached [pid 420] set_robust_list(0x5555572875e0, 24) = 0 [pid 420] chdir("./3") = 0 [pid 420] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 420] setpgid(0, 0) = 0 [pid 420] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 420] write(3, "1000", 4) = 4 [pid 420] close(3) = 0 [pid 420] symlink("/dev/binderfs", "./binderfs") = 0 [pid 420] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 420] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 420] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 420] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[422], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 422 [pid 420] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 420] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 422 attached [pid 422] set_robust_list(0x7f600e02f9e0, 24) = 0 [pid 422] memfd_create("syzkaller", 0) = 3 [pid 422] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 [pid 422] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 401] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 401] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 401] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 401] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 405] <... futex resumed>) = 0 [pid 401] <... futex resumed>) = 1 [pid 405] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 401] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 405] <... open resumed>) = 5 [pid 405] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 401] <... futex resumed>) = 0 [pid 405] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 401] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 405] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 401] <... futex resumed>) = 0 [pid 405] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 401] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 405] <... futex resumed>) = 0 [pid 401] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 405] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 401] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 417] <... set_robust_list resumed>) = 0 [pid 401] <... futex resumed>) = 0 [pid 401] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 417] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL) = 0 [pid 417] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 422] <... write resumed>) = 262144 [pid 422] munmap(0x7f6005c0f000, 262144) = 0 [pid 422] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [ 20.846730][ T410] EXT4-fs (loop3): 1 orphan inode deleted [ 20.858905][ T410] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 20.871716][ T410] ext4 filesystem being mounted at /root/syzkaller.2mSqAy/3/file1 supports timestamps until 2038 (0x7fffffff) [pid 422] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 421 attached ./strace-static-x86_64: Process 419 attached ./strace-static-x86_64: Process 418 attached [pid 417] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 405] <... write resumed>) = 167936 [pid 422] <... ioctl resumed>) = 0 [pid 422] close(3) = 0 [pid 422] mkdir("./file1", 0777) = 0 [pid 422] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 421] set_robust_list(0x5555572875e0, 24) = 0 [pid 421] chdir("./3") = 0 [pid 421] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 421] setpgid(0, 0) = 0 [pid 421] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 421] write(3, "1000", 4) = 4 [pid 421] close(3) = 0 [pid 421] symlink("/dev/binderfs", "./binderfs") = 0 [pid 421] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 421] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 421] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 421] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[425], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 425 [pid 421] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 421] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 425 attached [pid 425] set_robust_list(0x7f600e02f9e0, 24) = 0 [pid 425] memfd_create("syzkaller", 0) = 3 [pid 425] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 [pid 425] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 425] munmap(0x7f6005c0f000, 262144) = 0 [pid 425] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 4 [pid 425] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 425] close(3) = 0 [pid 425] mkdir("./file1", 0777) = 0 [pid 425] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 419] set_robust_list(0x7f6005c4e9e0, 24) = 0 [pid 419] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL) = 0 [pid 419] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 406] <... futex resumed>) = 0 [pid 406] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 410] <... futex resumed>) = 0 [pid 406] <... futex resumed>) = 1 [pid 410] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 406] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 410] <... open resumed>) = 5 [pid 410] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 406] <... futex resumed>) = 0 [pid 410] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 406] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 410] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 406] <... futex resumed>) = 0 [pid 410] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 406] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 410] <... futex resumed>) = 0 [pid 406] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 410] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 406] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 406] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 419] <... futex resumed>) = 1 [pid 419] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 418] set_robust_list(0x7f6005c4e9e0, 24) = 0 [pid 418] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL) = 0 [pid 418] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 418] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 405] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 401] <... futex resumed>) = 0 [pid 401] exit_group(0 [pid 417] <... futex resumed>) = ? [pid 401] <... exit_group resumed>) = ? [pid 417] +++ exited with 0 +++ [pid 405] <... futex resumed>) = ? [pid 405] +++ exited with 0 +++ [pid 401] +++ exited with 0 +++ [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=401, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 294] umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 294] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 294] getdents64(3, 0x555557288620 /* 4 entries */, 32768) = 112 [pid 294] umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] lstat("./3/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 294] unlink("./3/binderfs") = 0 [pid 294] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 410] <... write resumed>) = 262144 [pid 404] <... futex resumed>) = 0 [pid 410] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 406] <... futex resumed>) = 0 [pid 410] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 406] exit_group(0 [pid 410] <... futex resumed>) = ? [pid 406] <... exit_group resumed>) = ? [pid 410] +++ exited with 0 +++ [pid 419] <... futex resumed>) = ? [pid 419] +++ exited with 0 +++ [pid 406] +++ exited with 0 +++ [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=406, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 296] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 296] umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 296] fstat(3, [pid 404] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] getdents64(3, 0x555557288620 /* 4 entries */, 32768) = 112 [pid 296] umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] lstat("./3/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 407] <... futex resumed>) = 0 [pid 404] <... futex resumed>) = 1 [pid 296] unlink("./3/binderfs") = 0 [pid 296] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 407] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 404] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 415] <... mount resumed>) = 0 [pid 415] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 415] chdir("./file1") = 0 [pid 415] ioctl(4, LOOP_CLR_FD) = 0 [pid 415] close(4) = 0 [pid 415] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 412] <... futex resumed>) = 0 [pid 415] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 412] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 407] <... open resumed>) = 5 [pid 415] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 415] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 415] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 415] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 412] <... futex resumed>) = 1 [pid 412] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 407] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 412] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 407] <... futex resumed>) = 1 [pid 412] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 404] <... futex resumed>) = 0 [pid 412] <... futex resumed>) = 0 [pid 407] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 404] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 412] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 407] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 404] <... futex resumed>) = 0 [pid 412] <... futex resumed>) = 0 [pid 407] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 404] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 412] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 407] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 412] <... mmap resumed>) = 0x7f6005c2e000 [pid 407] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 412] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE [pid 407] <... futex resumed>) = 1 [pid 404] <... futex resumed>) = 0 [pid 412] <... mprotect resumed>) = 0 [pid 407] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 404] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 412] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 407] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 404] <... futex resumed>) = 0 [pid 407] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 404] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 412] <... clone resumed>, parent_tid=[428], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 428 ./strace-static-x86_64: Process 428 attached [pid 415] <... futex resumed>) = 0 [pid 412] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 412] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 415] fallocate(4, 0, 35143, 7) = 0 [pid 415] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 415] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 428] set_robust_list(0x7f6005c4e9e0, 24) = 0 [pid 428] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0 [pid 428] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 412] <... futex resumed>) = 0 [pid 412] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 412] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 415] <... futex resumed>) = 0 [pid 415] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 5 [pid 415] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 412] <... futex resumed>) = 0 [pid 412] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 412] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 415] <... futex resumed>) = 1 [pid 415] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096) = -1 EBADF (Bad file descriptor) [pid 415] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 412] <... futex resumed>) = 0 [pid 412] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 412] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 415] <... futex resumed>) = 1 [pid 415] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 428] <... futex resumed>) = 1 [ 20.915606][ T422] loop4: detected capacity change from 0 to 512 [ 20.924102][ T415] EXT4-fs (loop0): 1 orphan inode deleted [ 20.928503][ T425] loop2: detected capacity change from 0 to 512 [ 20.929687][ T415] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 20.947516][ T415] ext4 filesystem being mounted at /root/syzkaller.SN8fLk/4/file1 supports timestamps until 2038 (0x7fffffff) [pid 428] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 407] <... write resumed>) = 262144 [pid 407] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 407] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 415] <... write resumed>) = 262144 [pid 404] <... futex resumed>) = 0 [pid 415] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 404] exit_group(0 [pid 412] <... futex resumed>) = 0 [pid 412] exit_group(0 [pid 428] <... futex resumed>) = ? [pid 412] <... exit_group resumed>) = ? [pid 428] +++ exited with 0 +++ [pid 404] <... exit_group resumed>) = ? [pid 415] <... futex resumed>) = ? [pid 418] <... futex resumed>) = ? [pid 296] <... umount2 resumed>) = 0 [pid 418] +++ exited with 0 +++ [pid 296] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 415] +++ exited with 0 +++ [pid 412] +++ exited with 0 +++ [pid 293] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=412, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 293] umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] lstat("./3/file1", [pid 293] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 293] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 293] <... openat resumed>) = 3 [pid 293] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 293] getdents64(3, [pid 296] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 293] <... getdents64 resumed>0x555557288620 /* 4 entries */, 32768) = 112 [pid 293] umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 293] lstat("./4/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 293] unlink("./4/binderfs" [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 293] <... unlink resumed>) = 0 [pid 293] umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] openat(AT_FDCWD, "./3/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 296] fstat(4, [pid 294] <... umount2 resumed>) = 0 [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] getdents64(4, [pid 407] <... futex resumed>) = ? [pid 407] +++ exited with 0 +++ [pid 404] +++ exited with 0 +++ [pid 296] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 294] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=404, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 296] getdents64(4, 0x555557290660 /* 0 entries */, 32768) = 0 [pid 298] umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] close(4 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... close resumed>) = 0 [pid 298] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] rmdir("./3/file1" [pid 294] lstat("./3/file1", [pid 298] <... openat resumed>) = 3 [pid 298] fstat(3, [pid 296] <... rmdir resumed>) = 0 [pid 294] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [ 20.982223][ T422] EXT4-fs (loop4): 1 orphan inode deleted [ 20.989662][ T422] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 21.005539][ T425] EXT4-fs (loop2): 1 orphan inode deleted [ 21.017871][ T425] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] getdents64(3, [pid 294] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 422] <... mount resumed>) = 0 [pid 422] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 422] chdir("./file1") = 0 [pid 422] ioctl(4, LOOP_CLR_FD) = 0 [pid 422] close(4) = 0 [pid 422] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 420] <... futex resumed>) = 0 [pid 420] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 420] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 422] <... futex resumed>) = 1 [pid 422] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 422] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 420] <... futex resumed>) = 0 [pid 420] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 420] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 420] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6005c2e000 [pid 420] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 420] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[431], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 431 [pid 420] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 420] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 422] <... futex resumed>) = 1 [pid 422] fallocate(4, 0, 35143, 7) = 0 [pid 422] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 422] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] getdents64(3, 0x555557288620 /* 4 entries */, 32768) = 112 [pid 298] umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] lstat("./3/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 298] unlink("./3/binderfs") = 0 [pid 298] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... getdents64 resumed>0x555557288620 /* 0 entries */, 32768) = 0 [pid 296] close(3) = 0 [pid 296] rmdir("./3") = 0 [pid 296] mkdir("./4", 0777) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 296] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 296] close(3) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555572875d0) = 432 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] openat(AT_FDCWD, "./3/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 294] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 294] getdents64(4, 0x555557290660 /* 2 entries */, 32768) = 48 [pid 294] getdents64(4, 0x555557290660 /* 0 entries */, 32768) = 0 [pid 294] close(4) = 0 [pid 294] rmdir("./3/file1") = 0 [pid 294] getdents64(3, 0x555557288620 /* 0 entries */, 32768) = 0 [pid 294] close(3) = 0 [pid 294] rmdir("./3") = 0 [pid 294] mkdir("./4", 0777) = 0 [pid 294] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 294] ioctl(3, LOOP_CLR_FD./strace-static-x86_64: Process 432 attached ./strace-static-x86_64: Process 431 attached [pid 425] <... mount resumed>) = 0 [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 431] set_robust_list(0x7f6005c4e9e0, 24 [pid 425] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 294] close(3 [pid 431] <... set_robust_list resumed>) = 0 [pid 425] <... openat resumed>) = 3 [pid 294] <... close resumed>) = 0 [pid 293] <... umount2 resumed>) = 0 [pid 431] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 425] chdir("./file1" [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 293] umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 431] <... mount resumed>) = 0 [pid 425] <... chdir resumed>) = 0 [pid 431] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 425] ioctl(4, LOOP_CLR_FD [pid 294] <... clone resumed>, child_tidptr=0x5555572875d0) = 433 [pid 293] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 431] <... futex resumed>) = 1 [pid 425] <... ioctl resumed>) = 0 [pid 420] <... futex resumed>) = 0 [pid 431] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 425] close(4 [pid 420] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 425] <... close resumed>) = 0 [pid 422] <... futex resumed>) = 0 [pid 420] <... futex resumed>) = 1 [pid 425] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 422] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 420] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 425] <... futex resumed>) = 1 [pid 422] <... open resumed>) = 5 [pid 421] <... futex resumed>) = 0 [pid 293] lstat("./4/file1", [pid 425] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 422] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 421] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 425] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 422] <... futex resumed>) = 1 [pid 421] <... futex resumed>) = 0 [pid 420] <... futex resumed>) = 0 [pid 293] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 425] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 422] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 421] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 420] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 293] umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 425] <... open resumed>) = 4 [pid 422] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 420] <... futex resumed>) = 0 [pid 293] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 425] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 422] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 420] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 293] openat(AT_FDCWD, "./4/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 425] <... futex resumed>) = 1 [pid 422] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 421] <... futex resumed>) = 0 [pid 425] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 422] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 421] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 293] <... openat resumed>) = 4 [pid 425] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 422] <... futex resumed>) = 1 [pid 421] <... futex resumed>) = 0 [pid 420] <... futex resumed>) = 0 [pid 425] fallocate(4, 0, 35143, 7 [pid 422] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 421] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 420] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 425] <... fallocate resumed>) = 0 [pid 422] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 421] <... futex resumed>) = 0 [pid 420] <... futex resumed>) = 0 [pid 425] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 422] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 421] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 420] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 433 attached [pid 432] set_robust_list(0x5555572875e0, 24 [pid 425] <... futex resumed>) = 0 [pid 421] <... mmap resumed>) = 0x7f6005c2e000 [pid 293] fstat(4, [pid 432] <... set_robust_list resumed>) = 0 [pid 425] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 421] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE [pid 432] chdir("./4" [pid 421] <... mprotect resumed>) = 0 [pid 293] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 432] <... chdir resumed>) = 0 [pid 422] <... write resumed>) = 262144 [pid 421] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 432] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 293] getdents64(4, [pid 432] <... prctl resumed>) = 0 [pid 422] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 421] <... clone resumed>, parent_tid=[434], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 434 [pid 433] set_robust_list(0x5555572875e0, 24 [pid 432] setpgid(0, 0 [pid 422] <... futex resumed>) = 1 [pid 421] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 420] <... futex resumed>) = 0 [pid 293] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 433] <... set_robust_list resumed>) = 0 [pid 432] <... setpgid resumed>) = 0 [pid 422] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 421] <... futex resumed>) = 0 [pid 420] exit_group(0 [pid 293] getdents64(4, [pid 432] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 431] <... futex resumed>) = ? [pid 422] <... futex resumed>) = ? [pid 421] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 420] <... exit_group resumed>) = ? [pid 432] <... openat resumed>) = 3 [pid 431] +++ exited with 0 +++ [pid 422] +++ exited with 0 +++ [pid 293] <... getdents64 resumed>0x555557290660 /* 0 entries */, 32768) = 0 [pid 432] write(3, "1000", 4) = 4 [pid 432] close(3) = 0 [pid 420] +++ exited with 0 +++ [pid 293] close(4 [pid 432] symlink("/dev/binderfs", "./binderfs") = 0 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=420, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 293] <... close resumed>) = 0 [pid 432] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW [pid 293] rmdir("./4/file1" [pid 432] <... futex resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 432] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 297] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 432] <... mmap resumed>) = 0x7f600e00f000 [pid 297] <... openat resumed>) = 3 [pid 293] <... rmdir resumed>) = 0 [pid 433] chdir("./4" [pid 432] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE [pid 297] fstat(3, [pid 293] getdents64(3, [pid 432] <... mprotect resumed>) = 0 [pid 297] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 432] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 297] getdents64(3, [pid 293] <... getdents64 resumed>0x555557288620 /* 0 entries */, 32768) = 0 [pid 297] <... getdents64 resumed>0x555557288620 /* 4 entries */, 32768) = 112 [pid 432] <... clone resumed>, parent_tid=[435], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 435 [pid 297] umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 293] close(3 [pid 432] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 433] <... chdir resumed>) = 0 [pid 432] <... futex resumed>) = 0 [pid 297] lstat("./3/binderfs", [pid 293] <... close resumed>) = 0 [pid 432] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 297] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 293] rmdir("./4" [pid 433] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 297] unlink("./3/binderfs") = 0 [pid 297] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 293] <... rmdir resumed>) = 0 [pid 433] <... prctl resumed>) = 0 [pid 293] mkdir("./5", 0777 [pid 433] setpgid(0, 0./strace-static-x86_64: Process 434 attached [pid 434] set_robust_list(0x7f6005c4e9e0, 24 [pid 433] <... setpgid resumed>) = 0 [pid 293] <... mkdir resumed>) = 0 [pid 433] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 293] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 434] <... set_robust_list resumed>) = 0 [pid 434] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL) = 0 [pid 293] <... openat resumed>) = 3 ./strace-static-x86_64: Process 435 attached [pid 433] <... openat resumed>) = 3 [pid 298] <... umount2 resumed>) = 0 [pid 293] ioctl(3, LOOP_CLR_FD [pid 435] set_robust_list(0x7f600e02f9e0, 24 [pid 433] write(3, "1000", 4 [pid 435] <... set_robust_list resumed>) = 0 [pid 293] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 433] <... write resumed>) = 4 [pid 293] close(3 [pid 433] close(3 [pid 435] memfd_create("syzkaller", 0 [pid 433] <... close resumed>) = 0 [pid 298] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 293] <... close resumed>) = 0 [pid 433] symlink("/dev/binderfs", "./binderfs" [pid 293] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 435] <... memfd_create resumed>) = 3 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] lstat("./3/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 293] <... clone resumed>, child_tidptr=0x5555572875d0) = 436 ./strace-static-x86_64: Process 436 attached [pid 435] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 433] <... symlink resumed>) = 0 [pid 298] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 433] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 435] <... mmap resumed>) = 0x7f6005c0f000 [pid 433] <... futex resumed>) = 0 [pid 298] openat(AT_FDCWD, "./3/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 434] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... openat resumed>) = 4 [pid 434] <... futex resumed>) = 1 [pid 421] <... futex resumed>) = 0 [pid 298] fstat(4, [pid 434] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 421] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 425] <... futex resumed>) = 0 [pid 421] <... futex resumed>) = 1 [ 21.025593][ T422] ext4 filesystem being mounted at /root/syzkaller.IrUvXE/3/file1 supports timestamps until 2038 (0x7fffffff) [ 21.032047][ T425] ext4 filesystem being mounted at /root/syzkaller.qF1bbv/3/file1 supports timestamps until 2038 (0x7fffffff) [pid 298] getdents64(4, [pid 425] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 421] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 436] set_robust_list(0x5555572875e0, 24 [pid 435] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 433] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 425] <... open resumed>) = 5 [pid 298] getdents64(4, [pid 436] <... set_robust_list resumed>) = 0 [pid 425] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 433] <... mmap resumed>) = 0x7f600e00f000 [pid 425] <... futex resumed>) = 1 [pid 421] <... futex resumed>) = 0 [pid 298] <... getdents64 resumed>0x555557290660 /* 0 entries */, 32768) = 0 [pid 433] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE [pid 425] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 421] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] close(4 [pid 433] <... mprotect resumed>) = 0 [pid 425] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 421] <... futex resumed>) = 0 [pid 433] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 425] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 421] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... close resumed>) = 0 ./strace-static-x86_64: Process 437 attached [pid 436] chdir("./5" [pid 435] <... write resumed>) = 262144 [pid 425] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 298] rmdir("./3/file1" [pid 437] set_robust_list(0x7f600e02f9e0, 24 [pid 436] <... chdir resumed>) = 0 [pid 435] munmap(0x7f6005c0f000, 262144 [pid 433] <... clone resumed>, parent_tid=[437], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 437 [pid 425] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 433] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 425] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 421] <... futex resumed>) = 0 [pid 298] <... rmdir resumed>) = 0 [pid 437] <... set_robust_list resumed>) = 0 [pid 436] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 435] <... munmap resumed>) = 0 [pid 433] <... futex resumed>) = 0 [pid 421] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] getdents64(3, [pid 436] <... prctl resumed>) = 0 [pid 435] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 433] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 425] <... futex resumed>) = 0 [pid 421] <... futex resumed>) = 1 [pid 436] setpgid(0, 0 [pid 435] <... openat resumed>) = 4 [pid 421] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... getdents64 resumed>0x555557288620 /* 0 entries */, 32768) = 0 [pid 425] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 436] <... setpgid resumed>) = 0 [pid 435] ioctl(4, LOOP_SET_FD, 3 [pid 298] close(3) = 0 [pid 437] memfd_create("syzkaller", 0) = 3 [pid 437] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 [pid 437] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 437] munmap(0x7f6005c0f000, 262144) = 0 [pid 437] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4 [pid 437] ioctl(4, LOOP_SET_FD, 3 [pid 436] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 435] <... ioctl resumed>) = 0 [pid 425] <... write resumed>) = 262144 [pid 298] rmdir("./3" [pid 437] <... ioctl resumed>) = 0 [pid 298] <... rmdir resumed>) = 0 [pid 298] mkdir("./4", 0777 [pid 425] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 437] close(3) = 0 [pid 437] mkdir("./file1", 0777 [pid 298] <... mkdir resumed>) = 0 [pid 425] <... futex resumed>) = 1 [pid 421] <... futex resumed>) = 0 [pid 421] exit_group(0 [pid 425] ????( [pid 298] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 434] <... futex resumed>) = ? [pid 425] <... ???? resumed>) = ? [pid 421] <... exit_group resumed>) = ? [pid 436] <... openat resumed>) = 3 [pid 437] <... mkdir resumed>) = 0 [pid 435] close(3 [pid 434] +++ exited with 0 +++ [pid 425] +++ exited with 0 +++ [pid 421] +++ exited with 0 +++ [pid 298] <... openat resumed>) = 3 [pid 297] <... umount2 resumed>) = 0 [pid 297] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=421, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 298] ioctl(3, LOOP_CLR_FD [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] lstat("./3/file1", [pid 298] close(3 [pid 297] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] <... close resumed>) = 0 [pid 297] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 297] openat(AT_FDCWD, "./3/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY./strace-static-x86_64: Process 438 attached [pid 298] <... clone resumed>, child_tidptr=0x5555572875d0) = 438 [pid 297] <... openat resumed>) = 4 [pid 297] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] getdents64(4, [pid 295] fstat(3, [pid 438] set_robust_list(0x5555572875e0, 24 [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 438] <... set_robust_list resumed>) = 0 [pid 297] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 295] getdents64(3, [pid 297] getdents64(4, [pid 438] chdir("./4" [pid 297] <... getdents64 resumed>0x555557290660 /* 0 entries */, 32768) = 0 [pid 295] <... getdents64 resumed>0x555557288620 /* 4 entries */, 32768) = 112 [pid 297] close(4 [pid 295] umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 438] <... chdir resumed>) = 0 [pid 297] <... close resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] rmdir("./3/file1" [pid 295] lstat("./3/binderfs", [pid 438] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 297] <... rmdir resumed>) = 0 [pid 295] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 297] getdents64(3, [pid 295] unlink("./3/binderfs" [pid 297] <... getdents64 resumed>0x555557288620 /* 0 entries */, 32768) = 0 [pid 436] write(3, "1000", 4) = 4 [pid 436] close(3 [pid 295] <... unlink resumed>) = 0 [pid 438] setpgid(0, 0 [pid 297] close(3 [pid 438] <... setpgid resumed>) = 0 [pid 295] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... close resumed>) = 0 [pid 436] <... close resumed>) = 0 [pid 297] rmdir("./3" [pid 436] symlink("/dev/binderfs", "./binderfs") = 0 [pid 297] <... rmdir resumed>) = 0 [pid 436] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 436] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 436] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 436] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 297] mkdir("./4", 0777 [pid 436] <... clone resumed>, parent_tid=[439], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 439 [pid 436] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 436] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 297] <... mkdir resumed>) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 3 [pid 297] ioctl(3, LOOP_CLR_FD [pid 435] <... close resumed>) = 0 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] close(3 [pid 437] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 435] mkdir("./file1", 0777) = 0 ./strace-static-x86_64: Process 439 attached [pid 438] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 297] <... close resumed>) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 440 attached [pid 439] set_robust_list(0x7f600e02f9e0, 24 [pid 438] <... openat resumed>) = 3 [pid 439] <... set_robust_list resumed>) = 0 [pid 438] write(3, "1000", 4 [pid 297] <... clone resumed>, child_tidptr=0x5555572875d0) = 440 [pid 438] <... write resumed>) = 4 [pid 438] close(3 [pid 440] set_robust_list(0x5555572875e0, 24 [pid 439] memfd_create("syzkaller", 0 [pid 438] <... close resumed>) = 0 [pid 440] <... set_robust_list resumed>) = 0 [pid 438] symlink("/dev/binderfs", "./binderfs" [pid 439] <... memfd_create resumed>) = 3 [pid 439] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 438] <... symlink resumed>) = 0 [pid 440] chdir("./4" [pid 439] <... mmap resumed>) = 0x7f6005c0f000 [pid 438] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 435] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 438] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 438] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 438] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[441], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 441 [pid 438] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 438] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 440] <... chdir resumed>) = 0 ./strace-static-x86_64: Process 441 attached [pid 439] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 441] set_robust_list(0x7f600e02f9e0, 24 [pid 440] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 440] setpgid(0, 0) = 0 [pid 440] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 441] <... set_robust_list resumed>) = 0 [pid 439] <... write resumed>) = 262144 [pid 439] munmap(0x7f6005c0f000, 262144) = 0 [pid 441] memfd_create("syzkaller", 0 [pid 439] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 441] <... memfd_create resumed>) = 3 [pid 439] ioctl(4, LOOP_SET_FD, 3 [pid 440] <... openat resumed>) = 3 [pid 440] write(3, "1000", 4) = 4 [pid 440] close(3) = 0 [ 21.100471][ T435] loop3: detected capacity change from 0 to 512 [ 21.105979][ T437] loop1: detected capacity change from 0 to 512 [pid 440] symlink("/dev/binderfs", "./binderfs") = 0 [pid 440] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 440] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 440] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 440] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[444], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 444 [pid 440] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 440] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 444 attached [pid 444] set_robust_list(0x7f600e02f9e0, 24) = 0 [pid 444] memfd_create("syzkaller", 0) = 3 [pid 444] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 [pid 444] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 439] <... ioctl resumed>) = 0 [pid 441] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 [pid 439] close(3 [pid 444] munmap(0x7f6005c0f000, 262144) = 0 [pid 444] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 444] ioctl(4, LOOP_SET_FD, 3 [pid 441] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 439] <... close resumed>) = 0 [pid 441] <... write resumed>) = 262144 [pid 439] mkdir("./file1", 0777 [pid 437] <... mount resumed>) = 0 [pid 437] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 437] chdir("./file1") = 0 [pid 437] ioctl(4, LOOP_CLR_FD) = 0 [pid 437] close(4 [pid 444] <... ioctl resumed>) = 0 [pid 441] munmap(0x7f6005c0f000, 262144 [pid 439] <... mkdir resumed>) = 0 [pid 295] <... umount2 resumed>) = 0 [pid 441] <... munmap resumed>) = 0 [ 21.143130][ T439] loop0: detected capacity change from 0 to 512 [ 21.152898][ T437] EXT4-fs (loop1): 1 orphan inode deleted [ 21.158450][ T437] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 21.170190][ T437] ext4 filesystem being mounted at /root/syzkaller.6GNILo/4/file1 supports timestamps until 2038 (0x7fffffff) [ 21.171222][ T444] loop4: detected capacity change from 0 to 512 [pid 439] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 437] <... close resumed>) = 0 [pid 437] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 433] <... futex resumed>) = 0 [pid 433] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 433] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 437] <... futex resumed>) = 1 [pid 437] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 437] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 433] <... futex resumed>) = 0 [pid 433] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 433] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 433] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6005c2e000 [pid 433] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 433] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[447], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 447 [pid 433] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 433] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 437] <... futex resumed>) = 1 [pid 437] fallocate(4, 0, 35143, 7) = 0 [pid 437] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 437] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 447 attached [pid 447] set_robust_list(0x7f6005c4e9e0, 24) = 0 [pid 447] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL) = 0 [pid 447] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 433] <... futex resumed>) = 0 [pid 433] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 433] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 437] <... futex resumed>) = 0 [pid 437] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 5 [pid 437] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 433] <... futex resumed>) = 0 [pid 433] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 433] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 437] <... futex resumed>) = 1 [pid 437] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096) = -1 EBADF (Bad file descriptor) [pid 437] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 433] <... futex resumed>) = 0 [pid 433] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 433] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 437] <... futex resumed>) = 1 [pid 437] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 441] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 295] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 444] close(3 [pid 441] <... openat resumed>) = 4 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 444] <... close resumed>) = 0 [pid 441] ioctl(4, LOOP_SET_FD, 3 [pid 295] lstat("./3/file1", [pid 437] <... write resumed>) = 262144 [pid 437] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 433] <... futex resumed>) = 0 [pid 433] exit_group(0) = ? [pid 437] <... futex resumed>) = ? [pid 437] +++ exited with 0 +++ [pid 447] <... futex resumed>) = ? [pid 447] +++ exited with 0 +++ [pid 433] +++ exited with 0 +++ [pid 295] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 435] <... mount resumed>) = 0 [pid 435] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 435] chdir("./file1") = 0 [pid 435] ioctl(4, LOOP_CLR_FD) = 0 [pid 435] close(4 [pid 444] mkdir("./file1", 0777 [pid 441] <... ioctl resumed>) = 0 [pid 295] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=433, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 444] <... mkdir resumed>) = 0 [pid 444] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./3/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... openat resumed>) = 4 [pid 295] fstat(4, [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 441] close(3 [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 294] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 441] <... close resumed>) = 0 [pid 295] getdents64(4, [pid 441] mkdir("./file1", 0777 [pid 295] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 294] <... openat resumed>) = 3 [pid 295] getdents64(4, [pid 294] fstat(3, [pid 441] <... mkdir resumed>) = 0 [pid 295] <... getdents64 resumed>0x555557290660 /* 0 entries */, 32768) = 0 [pid 294] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] close(4 [pid 441] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 295] <... close resumed>) = 0 [pid 294] getdents64(3, 0x555557288620 /* 4 entries */, 32768) = 112 [pid 295] rmdir("./3/file1") = 0 [pid 295] getdents64(3, [pid 294] umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] lstat("./4/binderfs", [pid 295] <... getdents64 resumed>0x555557288620 /* 0 entries */, 32768) = 0 [pid 294] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 294] unlink("./4/binderfs" [pid 295] close(3 [pid 294] <... unlink resumed>) = 0 [pid 295] <... close resumed>) = 0 [pid 294] umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] rmdir("./3") = 0 [pid 295] mkdir("./4", 0777) = 0 [pid 435] <... close resumed>) = 0 [pid 295] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 3 [pid 435] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 432] <... futex resumed>) = 0 [pid 432] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 432] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 435] <... futex resumed>) = 1 [pid 435] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 295] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 295] close(3) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 435] <... open resumed>) = 4 [pid 435] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 432] <... futex resumed>) = 0 [pid 432] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 432] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 432] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6005c2e000 [pid 432] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 295] <... clone resumed>, child_tidptr=0x5555572875d0) = 448 [pid 432] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[449], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 449 [pid 432] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 432] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 435] <... futex resumed>) = 1 [pid 435] fallocate(4, 0, 35143, 7) = 0 [pid 435] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 435] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 448 attached [pid 448] set_robust_list(0x5555572875e0, 24) = 0 [pid 448] chdir("./4") = 0 [pid 448] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 448] setpgid(0, 0) = 0 [pid 448] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 448] write(3, "1000", 4) = 4 [pid 448] close(3) = 0 [pid 448] symlink("/dev/binderfs", "./binderfs") = 0 [pid 448] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 448] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 ./strace-static-x86_64: Process 449 attached [pid 449] set_robust_list(0x7f6005c4e9e0, 24 [pid 448] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE [pid 449] <... set_robust_list resumed>) = 0 [pid 449] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 448] <... mprotect resumed>) = 0 [pid 449] <... mount resumed>) = 0 [pid 448] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 449] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 432] <... futex resumed>) = 0 [pid 432] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 432] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 435] <... futex resumed>) = 0 [pid 435] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 5 [pid 435] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 432] <... futex resumed>) = 0 [pid 435] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 432] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 435] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 432] <... futex resumed>) = 0 [pid 435] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 432] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 435] <... futex resumed>) = 0 [pid 432] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 435] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 432] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 21.192297][ T435] EXT4-fs (loop3): 1 orphan inode deleted [ 21.198023][ T435] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 21.210017][ T435] ext4 filesystem being mounted at /root/syzkaller.2mSqAy/4/file1 supports timestamps until 2038 (0x7fffffff) [ 21.222410][ T441] loop5: detected capacity change from 0 to 512 [pid 432] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] <... umount2 resumed>) = 0 [pid 294] umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] lstat("./4/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 294] umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] openat(AT_FDCWD, "./4/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 294] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 294] getdents64(4, 0x555557290660 /* 2 entries */, 32768) = 48 [pid 294] getdents64(4, 0x555557290660 /* 0 entries */, 32768) = 0 [pid 294] close(4) = 0 [pid 294] rmdir("./4/file1") = 0 [pid 294] getdents64(3, 0x555557288620 /* 0 entries */, 32768) = 0 [pid 294] close(3) = 0 [pid 294] rmdir("./4") = 0 [pid 294] mkdir("./5", 0777) = 0 [pid 294] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 294] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 294] close(3) = 0 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 456 attached , child_tidptr=0x5555572875d0) = 456 [pid 456] set_robust_list(0x5555572875e0, 24 [pid 449] <... futex resumed>) = 1 [pid 435] <... write resumed>) = 262144 [pid 449] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 448] <... clone resumed>, parent_tid=[457], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 457 [pid 435] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 448] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 435] <... futex resumed>) = 1 [pid 432] <... futex resumed>) = 0 [pid 448] <... futex resumed>) = 0 [pid 435] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [ 21.253708][ T444] EXT4-fs (loop4): 1 orphan inode deleted [ 21.259256][ T444] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 21.271199][ T439] EXT4-fs (loop0): 1 orphan inode deleted [ 21.288881][ T439] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [pid 432] exit_group(0./strace-static-x86_64: Process 457 attached [pid 456] <... set_robust_list resumed>) = 0 [pid 449] <... futex resumed>) = ? [pid 448] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 435] <... futex resumed>) = ? [pid 432] <... exit_group resumed>) = ? [pid 457] set_robust_list(0x7f600e02f9e0, 24 [pid 456] chdir("./5" [pid 449] +++ exited with 0 +++ [pid 444] <... mount resumed>) = 0 [pid 435] +++ exited with 0 +++ [pid 432] +++ exited with 0 +++ [pid 457] <... set_robust_list resumed>) = 0 [pid 456] <... chdir resumed>) = 0 [pid 444] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=432, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 439] <... mount resumed>) = 0 [pid 439] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 439] chdir("./file1") = 0 [pid 439] ioctl(4, LOOP_CLR_FD) = 0 [pid 439] close(4 [pid 457] memfd_create("syzkaller", 0 [pid 456] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 444] <... openat resumed>) = 3 [pid 456] <... prctl resumed>) = 0 [pid 444] chdir("./file1" [pid 457] <... memfd_create resumed>) = 3 [pid 456] setpgid(0, 0 [pid 444] <... chdir resumed>) = 0 [pid 456] <... setpgid resumed>) = 0 [pid 444] ioctl(4, LOOP_CLR_FD [pid 457] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 456] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 457] <... mmap resumed>) = 0x7f6005c0f000 [pid 444] <... ioctl resumed>) = 0 [pid 444] close(4 [pid 439] <... close resumed>) = 0 [pid 439] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 436] <... futex resumed>) = 0 [pid 436] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 436] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 439] <... futex resumed>) = 1 [pid 439] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 457] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 444] <... close resumed>) = 0 [pid 444] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 456] <... openat resumed>) = 3 [pid 444] <... futex resumed>) = 1 [pid 440] <... futex resumed>) = 0 [pid 440] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 440] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 457] <... write resumed>) = 262144 [pid 456] write(3, "1000", 4 [pid 444] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 441] <... mount resumed>) = 0 [pid 296] umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 456] <... write resumed>) = 4 [pid 457] munmap(0x7f6005c0f000, 262144 [pid 456] close(3 [pid 444] <... open resumed>) = 4 [pid 441] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 456] <... close resumed>) = 0 [pid 444] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 440] <... futex resumed>) = 0 [pid 444] fallocate(4, 0, 35143, 7 [pid 440] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 444] <... fallocate resumed>) = 0 [pid 440] <... futex resumed>) = 0 [pid 444] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 440] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 444] <... futex resumed>) = 0 [pid 440] <... futex resumed>) = 0 [pid 444] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 440] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6005c2e000 [pid 440] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 440] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[459], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 459 [pid 440] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 440] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 456] symlink("/dev/binderfs", "./binderfs" [pid 296] <... openat resumed>) = 3 [pid 457] <... munmap resumed>) = 0 [pid 456] <... symlink resumed>) = 0 [pid 441] <... openat resumed>) = 3 [pid 296] fstat(3, [pid 457] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 456] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 441] chdir("./file1" [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 456] <... futex resumed>) = 0 [pid 296] getdents64(3, [pid 457] <... openat resumed>) = 4 [pid 456] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 441] <... chdir resumed>) = 0 [pid 296] <... getdents64 resumed>0x555557288620 /* 4 entries */, 32768) = 112 [pid 456] <... mmap resumed>) = 0x7f600e00f000 [pid 456] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE [ 21.291832][ T444] ext4 filesystem being mounted at /root/syzkaller.IrUvXE/4/file1 supports timestamps until 2038 (0x7fffffff) [ 21.313575][ T441] EXT4-fs (loop5): 1 orphan inode deleted [ 21.319120][ T441] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 21.330650][ T439] ext4 filesystem being mounted at /root/syzkaller.SN8fLk/5/file1 supports timestamps until 2038 (0x7fffffff) [ 21.331632][ T441] ext4 filesystem being mounted at /root/syzkaller.kumyKI/4/file1 supports timestamps until 2038 (0x7fffffff) [pid 296] umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 457] ioctl(4, LOOP_SET_FD, 3 [pid 456] <... mprotect resumed>) = 0 [pid 441] ioctl(4, LOOP_CLR_FD [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 456] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 296] lstat("./4/binderfs", [pid 439] <... open resumed>) = 4 [pid 439] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 436] <... futex resumed>) = 0 [pid 436] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 436] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 436] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6005c2e000 [pid 436] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 436] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[460], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 460 [pid 436] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 436] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 439] <... futex resumed>) = 1 [pid 439] fallocate(4, 0, 35143, 7) = 0 [pid 439] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 439] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 459 attached [pid 459] set_robust_list(0x7f6005c4e9e0, 24) = 0 [pid 459] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL) = 0 [pid 459] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 440] <... futex resumed>) = 0 [pid 440] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 444] <... futex resumed>) = 0 [pid 440] <... futex resumed>) = 1 [pid 444] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 440] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 444] <... open resumed>) = 5 [pid 444] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 440] <... futex resumed>) = 0 [pid 444] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 440] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 444] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 440] <... futex resumed>) = 0 [pid 444] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 440] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 444] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 444] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 440] <... futex resumed>) = 0 [pid 444] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 440] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 444] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 440] <... futex resumed>) = 0 [pid 444] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 440] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 444] <... write resumed>) = 262144 [pid 444] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 440] <... futex resumed>) = 0 [pid 444] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 440] exit_group(0 [pid 444] <... futex resumed>) = ? [pid 440] <... exit_group resumed>) = ? [pid 444] +++ exited with 0 +++ [pid 459] <... futex resumed>) = ? [pid 296] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 296] unlink("./4/binderfs" [pid 456] <... clone resumed>, parent_tid=[461], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 461 ./strace-static-x86_64: Process 460 attached [pid 460] set_robust_list(0x7f6005c4e9e0, 24) = 0 [pid 460] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0 [pid 460] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 436] <... futex resumed>) = 0 [pid 436] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 296] <... unlink resumed>) = 0 [pid 456] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 436] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 456] <... futex resumed>) = 0 [pid 296] umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 456] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 439] <... futex resumed>) = 0 [pid 457] <... ioctl resumed>) = 0 [pid 441] <... ioctl resumed>) = 0 [pid 457] close(3 [pid 441] close(4 [pid 439] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 457] <... close resumed>) = 0 [pid 441] <... close resumed>) = 0 [pid 439] <... open resumed>) = 5 [pid 439] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 436] <... futex resumed>) = 0 [pid 439] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 436] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 457] mkdir("./file1", 0777 [pid 441] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 439] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 436] <... futex resumed>) = 0 [pid 457] <... mkdir resumed>) = 0 [pid 441] <... futex resumed>) = 1 [pid 439] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 438] <... futex resumed>) = 0 [pid 436] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 439] <... futex resumed>) = 0 [pid 436] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 439] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 436] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 457] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 441] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 438] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 436] <... futex resumed>) = 0 [pid 436] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 439] <... write resumed>) = 262144 [pid 439] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 436] <... futex resumed>) = 0 [pid 436] exit_group(0) = ? [pid 439] <... futex resumed>) = ? [pid 439] +++ exited with 0 +++ [pid 460] <... futex resumed>) = ? [pid 441] <... open resumed>) = 4 [pid 438] <... futex resumed>) = 0 [pid 438] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 459] +++ exited with 0 +++ [pid 441] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 440] +++ exited with 0 +++ [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=440, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 441] <... futex resumed>) = 1 [pid 438] <... futex resumed>) = 0 [pid 297] restart_syscall(<... resuming interrupted clone ...> [pid 438] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 460] +++ exited with 0 +++ [pid 438] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 436] +++ exited with 0 +++ ./strace-static-x86_64: Process 461 attached [pid 438] <... futex resumed>) = 0 [pid 438] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 293] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=436, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 438] <... mmap resumed>) = 0x7f6005c2e000 [pid 293] restart_syscall(<... resuming interrupted clone ...> [pid 438] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE [pid 461] set_robust_list(0x7f600e02f9e0, 24 [pid 438] <... mprotect resumed>) = 0 [pid 297] <... restart_syscall resumed>) = 0 [pid 293] <... restart_syscall resumed>) = 0 [pid 438] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 461] <... set_robust_list resumed>) = 0 [pid 461] memfd_create("syzkaller", 0 [pid 438] <... clone resumed>, parent_tid=[462], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 462 [pid 438] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 438] <... futex resumed>) = 0 [pid 293] umount2("./5", MNT_DETACH|UMOUNT_NOFOLLOW [pid 461] <... memfd_create resumed>) = 3 [pid 438] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 293] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 293] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] <... openat resumed>) = 3 [pid 293] <... openat resumed>) = 3 [pid 297] fstat(3, [pid 293] fstat(3, [pid 297] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 293] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 461] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 297] getdents64(3, [pid 293] getdents64(3, [pid 461] <... mmap resumed>) = 0x7f6005c0f000 [pid 461] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 441] fallocate(4, 0, 35143, 7 [pid 297] <... getdents64 resumed>0x555557288620 /* 4 entries */, 32768) = 112 [pid 293] <... getdents64 resumed>0x555557288620 /* 4 entries */, 32768) = 112 [pid 297] umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 293] umount2("./5/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] lstat("./4/binderfs", [pid 293] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 293] lstat("./5/binderfs", [pid 297] unlink("./4/binderfs" [pid 293] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 ./strace-static-x86_64: Process 462 attached [pid 462] set_robust_list(0x7f6005c4e9e0, 24) = 0 [pid 462] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 297] <... unlink resumed>) = 0 [pid 293] unlink("./5/binderfs" [pid 462] <... mount resumed>) = 0 [pid 297] umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 293] <... unlink resumed>) = 0 [pid 293] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 462] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 438] <... futex resumed>) = 0 [pid 441] <... fallocate resumed>) = 0 [pid 438] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 441] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 438] <... futex resumed>) = 0 [pid 438] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 441] <... futex resumed>) = 0 [pid 462] <... futex resumed>) = 1 [pid 441] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 462] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 5 [pid 462] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 438] <... futex resumed>) = 0 [pid 438] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 438] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 462] <... futex resumed>) = 1 [pid 462] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 441] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 441] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096) = -1 EBADF (Bad file descriptor) [pid 441] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 461] <... write resumed>) = 262144 [pid 441] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 461] munmap(0x7f6005c0f000, 262144) = 0 [pid 461] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4 [ 21.365481][ T457] loop2: detected capacity change from 0 to 512 [ 21.403069][ T457] EXT4-fs (loop2): 1 orphan inode deleted [pid 461] ioctl(4, LOOP_SET_FD, 3 [pid 438] <... futex resumed>) = 0 [pid 461] <... ioctl resumed>) = 0 [pid 461] close(3) = 0 [pid 461] mkdir("./file1", 0777) = 0 [pid 461] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 438] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 441] <... futex resumed>) = 0 [pid 438] <... futex resumed>) = 1 [pid 441] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 438] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... umount2 resumed>) = 0 [pid 297] <... umount2 resumed>) = 0 [pid 297] umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 293] <... umount2 resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 293] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] lstat("./4/file1", [pid 296] lstat("./4/file1", [pid 293] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 293] lstat("./5/file1", [pid 297] umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 293] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 293] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] openat(AT_FDCWD, "./4/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] openat(AT_FDCWD, "./4/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 293] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... openat resumed>) = 4 [pid 296] <... openat resumed>) = 4 [pid 293] openat(AT_FDCWD, "./5/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] fstat(4, [pid 296] fstat(4, [pid 293] <... openat resumed>) = 4 [pid 297] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 293] fstat(4, [pid 441] <... write resumed>) = 262144 [pid 297] getdents64(4, [pid 296] getdents64(4, [pid 293] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 441] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 296] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 293] getdents64(4, [pid 441] <... futex resumed>) = 1 [pid 438] <... futex resumed>) = 0 [pid 297] getdents64(4, [pid 296] getdents64(4, [pid 293] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 441] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 438] exit_group(0 [pid 297] <... getdents64 resumed>0x555557290660 /* 0 entries */, 32768) = 0 [pid 296] <... getdents64 resumed>0x555557290660 /* 0 entries */, 32768) = 0 [pid 462] <... futex resumed>) = ? [pid 441] <... futex resumed>) = ? [pid 438] <... exit_group resumed>) = ? [pid 297] close(4 [pid 296] close(4 [pid 293] getdents64(4, [pid 462] +++ exited with 0 +++ [pid 441] +++ exited with 0 +++ [pid 438] +++ exited with 0 +++ [pid 297] <... close resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 297] rmdir("./4/file1" [pid 296] rmdir("./4/file1" [pid 293] <... getdents64 resumed>0x555557290660 /* 0 entries */, 32768) = 0 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=438, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 298] restart_syscall(<... resuming interrupted clone ...> [pid 297] <... rmdir resumed>) = 0 [pid 293] close(4 [pid 297] getdents64(3, [pid 293] <... close resumed>) = 0 [pid 296] <... rmdir resumed>) = 0 [pid 297] <... getdents64 resumed>0x555557288620 /* 0 entries */, 32768) = 0 [pid 296] getdents64(3, [pid 293] rmdir("./5/file1" [pid 298] <... restart_syscall resumed>) = 0 [pid 296] <... getdents64 resumed>0x555557288620 /* 0 entries */, 32768) = 0 [pid 293] <... rmdir resumed>) = 0 [pid 293] getdents64(3, 0x555557288620 /* 0 entries */, 32768) = 0 [pid 293] close(3 [pid 297] close(3 [pid 293] <... close resumed>) = 0 [pid 297] <... close resumed>) = 0 [pid 296] close(3 [pid 293] rmdir("./5" [pid 297] rmdir("./4" [pid 296] <... close resumed>) = 0 [pid 293] <... rmdir resumed>) = 0 [pid 298] umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... rmdir resumed>) = 0 [pid 296] rmdir("./4" [pid 293] mkdir("./6", 0777 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] mkdir("./5", 0777 [pid 296] <... rmdir resumed>) = 0 [pid 293] <... mkdir resumed>) = 0 [pid 298] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] <... mkdir resumed>) = 0 [pid 296] mkdir("./5", 0777 [pid 293] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 298] <... openat resumed>) = 3 [pid 297] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 293] <... openat resumed>) = 3 [pid 298] fstat(3, [pid 297] <... openat resumed>) = 3 [pid 293] ioctl(3, LOOP_CLR_FD [pid 297] ioctl(3, LOOP_CLR_FD [pid 293] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 293] close(3 [pid 297] close(3 [pid 293] <... close resumed>) = 0 [pid 297] <... close resumed>) = 0 [pid 293] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] <... mkdir resumed>) = 0 [pid 298] getdents64(3, [pid 296] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 293] <... clone resumed>, child_tidptr=0x5555572875d0) = 465 [pid 298] <... getdents64 resumed>0x555557288620 /* 4 entries */, 32768) = 112 [pid 297] <... clone resumed>, child_tidptr=0x5555572875d0) = 466 [pid 296] <... openat resumed>) = 3 [pid 298] umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] ioctl(3, LOOP_CLR_FD [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] lstat("./4/binderfs", [pid 296] close(3 [pid 298] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 296] <... close resumed>) = 0 [pid 298] unlink("./4/binderfs") = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 466 attached ./strace-static-x86_64: Process 465 attached [pid 296] <... clone resumed>, child_tidptr=0x5555572875d0) = 467 [pid 465] set_robust_list(0x5555572875e0, 24 [pid 466] set_robust_list(0x5555572875e0, 24) = 0 [pid 466] chdir("./5") = 0 [pid 466] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 466] setpgid(0, 0 [pid 465] <... set_robust_list resumed>) = 0 [pid 465] chdir("./6") = 0 [pid 465] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 466] <... setpgid resumed>) = 0 [pid 465] setpgid(0, 0 [pid 466] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 465] <... setpgid resumed>) = 0 [pid 466] <... openat resumed>) = 3 [pid 465] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 466] write(3, "1000", 4) = 4 [pid 465] <... openat resumed>) = 3 [pid 466] close(3) = 0 [pid 466] symlink("/dev/binderfs", "./binderfs") = 0 [pid 465] write(3, "1000", 4) = 4 [pid 465] close(3) = 0 [pid 465] symlink("/dev/binderfs", "./binderfs") = 0 [pid 465] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 465] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 465] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 465] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[469], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 469 ./strace-static-x86_64: Process 469 attached [pid 465] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 465] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 466] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 466] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 466] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 466] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 469] set_robust_list(0x7f600e02f9e0, 24) = 0 [pid 466] <... clone resumed>, parent_tid=[470], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 470 [pid 466] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 466] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 467 attached [pid 467] set_robust_list(0x5555572875e0, 24) = 0 [pid 467] chdir("./5") = 0 [pid 467] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 469] memfd_create("syzkaller", 0 [pid 467] setpgid(0, 0) = 0 [pid 467] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC./strace-static-x86_64: Process 470 attached [pid 469] <... memfd_create resumed>) = 3 [pid 469] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 470] set_robust_list(0x7f600e02f9e0, 24 [pid 467] <... openat resumed>) = 3 [pid 467] write(3, "1000", 4) = 4 [pid 467] close(3) = 0 [pid 467] symlink("/dev/binderfs", "./binderfs" [pid 470] <... set_robust_list resumed>) = 0 [pid 469] <... mmap resumed>) = 0x7f6005c0f000 [pid 467] <... symlink resumed>) = 0 [pid 467] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 467] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 467] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [ 21.408614][ T457] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 21.415373][ T461] loop1: detected capacity change from 0 to 512 [ 21.419755][ T457] ext4 filesystem being mounted at /root/syzkaller.qF1bbv/4/file1 supports timestamps until 2038 (0x7fffffff) [pid 467] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[471], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 471 [pid 467] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 467] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 471 attached [pid 470] memfd_create("syzkaller", 0 [pid 469] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 457] <... mount resumed>) = 0 [pid 471] set_robust_list(0x7f600e02f9e0, 24 [pid 470] <... memfd_create resumed>) = 3 [pid 469] <... write resumed>) = 262144 [pid 457] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 298] <... umount2 resumed>) = 0 [pid 471] <... set_robust_list resumed>) = 0 [pid 470] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 469] munmap(0x7f6005c0f000, 262144 [pid 457] <... openat resumed>) = 3 [pid 298] umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] lstat("./4/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] openat(AT_FDCWD, "./4/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 298] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] getdents64(4, 0x555557290660 /* 2 entries */, 32768) = 48 [pid 298] getdents64(4, 0x555557290660 /* 0 entries */, 32768) = 0 [pid 298] close(4) = 0 [pid 298] rmdir("./4/file1" [pid 470] <... mmap resumed>) = 0x7f6005c0f000 [pid 298] <... rmdir resumed>) = 0 [pid 469] <... munmap resumed>) = 0 [pid 298] getdents64(3, 0x555557288620 /* 0 entries */, 32768) = 0 [pid 298] close(3) = 0 [pid 298] rmdir("./4" [pid 471] memfd_create("syzkaller", 0 [pid 469] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 457] chdir("./file1" [pid 298] <... rmdir resumed>) = 0 [pid 471] <... memfd_create resumed>) = 3 [pid 470] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 469] <... openat resumed>) = 4 [pid 457] <... chdir resumed>) = 0 [pid 298] mkdir("./5", 0777) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 3 [pid 298] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 298] close(3) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555572875d0) = 473 [pid 469] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 473 attached [pid 461] <... mount resumed>) = 0 [pid 471] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 [pid 473] set_robust_list(0x5555572875e0, 24 [pid 471] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 461] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 473] <... set_robust_list resumed>) = 0 [pid 473] chdir("./5" [pid 461] <... openat resumed>) = 3 [pid 473] <... chdir resumed>) = 0 [pid 461] chdir("./file1" [pid 473] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 461] <... chdir resumed>) = 0 [pid 473] <... prctl resumed>) = 0 [pid 461] ioctl(4, LOOP_CLR_FD [pid 473] setpgid(0, 0) = 0 [pid 461] <... ioctl resumed>) = 0 [pid 473] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 471] <... write resumed>) = 262144 [pid 461] close(4 [pid 473] <... openat resumed>) = 3 [pid 473] write(3, "1000", 4 [pid 461] <... close resumed>) = 0 [pid 473] <... write resumed>) = 4 [pid 471] munmap(0x7f6005c0f000, 262144 [pid 470] <... write resumed>) = 262144 [pid 469] <... ioctl resumed>) = 0 [pid 457] ioctl(4, LOOP_CLR_FD [pid 470] munmap(0x7f6005c0f000, 262144 [pid 473] close(3 [pid 471] <... munmap resumed>) = 0 [pid 461] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 473] <... close resumed>) = 0 [pid 470] <... munmap resumed>) = 0 [pid 470] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 473] symlink("/dev/binderfs", "./binderfs" [pid 456] <... futex resumed>) = 0 [pid 456] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 471] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 471] ioctl(4, LOOP_SET_FD, 3 [pid 470] ioctl(4, LOOP_SET_FD, 3 [pid 473] <... symlink resumed>) = 0 [pid 456] <... futex resumed>) = 0 [ 21.478525][ T461] EXT4-fs (loop1): 1 orphan inode deleted [ 21.484586][ T461] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 21.502163][ T461] ext4 filesystem being mounted at /root/syzkaller.6GNILo/5/file1 supports timestamps until 2038 (0x7fffffff) [ 21.508860][ T469] loop0: detected capacity change from 0 to 512 [pid 473] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 461] <... futex resumed>) = 1 [pid 456] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 473] <... futex resumed>) = 0 [pid 473] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 470] <... ioctl resumed>) = 0 [pid 461] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 473] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 457] <... ioctl resumed>) = 0 [pid 473] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 457] close(4) = 0 ./strace-static-x86_64: Process 474 attached [pid 473] <... clone resumed>, parent_tid=[474], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 474 [pid 461] <... open resumed>) = 4 [pid 474] set_robust_list(0x7f600e02f9e0, 24 [pid 473] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 461] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 473] <... futex resumed>) = 0 [pid 473] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 456] <... futex resumed>) = 0 [pid 456] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 456] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 456] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6005c2e000 [pid 456] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 456] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[475], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 475 [pid 456] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 456] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 457] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 475 attached [pid 470] close(3 [pid 475] set_robust_list(0x7f6005c4e9e0, 24 [pid 471] <... ioctl resumed>) = 0 [pid 475] <... set_robust_list resumed>) = 0 [pid 474] <... set_robust_list resumed>) = 0 [pid 470] <... close resumed>) = 0 [pid 469] close(3 [pid 461] <... futex resumed>) = 1 [pid 475] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 471] close(3 [pid 448] <... futex resumed>) = 0 [pid 475] <... mount resumed>) = 0 [pid 448] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 448] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 457] <... futex resumed>) = 1 [pid 457] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 475] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 474] memfd_create("syzkaller", 0 [pid 471] <... close resumed>) = 0 [pid 470] mkdir("./file1", 0777 [pid 469] <... close resumed>) = 0 [pid 461] fallocate(4, 0, 35143, 7 [pid 475] <... futex resumed>) = 1 [pid 470] <... mkdir resumed>) = 0 [pid 457] <... open resumed>) = 4 [pid 456] <... futex resumed>) = 0 [pid 475] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 461] <... fallocate resumed>) = 0 [pid 456] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 475] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 470] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 456] <... futex resumed>) = 0 [pid 475] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 461] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 457] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 456] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 475] <... open resumed>) = 5 [pid 475] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 461] <... futex resumed>) = 0 [pid 475] <... futex resumed>) = 1 [pid 456] <... futex resumed>) = 0 [pid 475] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 461] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 456] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 456] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 461] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 461] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096) = -1 EBADF (Bad file descriptor) [pid 461] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 474] <... memfd_create resumed>) = 3 [pid 471] mkdir("./file1", 0777 [pid 469] mkdir("./file1", 0777 [pid 461] <... futex resumed>) = 1 [pid 456] <... futex resumed>) = 0 [pid 457] <... futex resumed>) = 1 [pid 456] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 448] <... futex resumed>) = 0 [pid 456] <... futex resumed>) = 0 [pid 448] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 456] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 448] <... futex resumed>) = 0 [pid 474] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 471] <... mkdir resumed>) = 0 [pid 469] <... mkdir resumed>) = 0 [pid 461] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 457] fallocate(4, 0, 35143, 7 [pid 448] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 474] <... mmap resumed>) = 0x7f6005c0f000 [pid 471] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 469] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 448] <... futex resumed>) = 0 [pid 448] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 474] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 457] <... fallocate resumed>) = 0 [pid 448] <... mmap resumed>) = 0x7f6005c2e000 [pid 457] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 448] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE [pid 457] <... futex resumed>) = 0 [pid 448] <... mprotect resumed>) = 0 [pid 457] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 448] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[478], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 478 [pid 448] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 474] <... write resumed>) = 262144 [pid 448] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 474] munmap(0x7f6005c0f000, 262144) = 0 [pid 474] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 4 [pid 474] ioctl(4, LOOP_SET_FD, 3 [pid 461] <... write resumed>) = 262144 ./strace-static-x86_64: Process 478 attached [ 21.535969][ T471] loop3: detected capacity change from 0 to 512 [ 21.542598][ T470] loop4: detected capacity change from 0 to 512 [ 21.563950][ T470] EXT4-fs (loop4): 1 orphan inode deleted [ 21.569495][ T470] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 21.578997][ T474] loop5: detected capacity change from 0 to 512 [pid 461] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 474] <... ioctl resumed>) = 0 [pid 474] close(3) = 0 [pid 474] mkdir("./file1", 0777) = 0 [pid 474] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 478] set_robust_list(0x7f6005c4e9e0, 24 [pid 461] <... futex resumed>) = 1 [pid 456] <... futex resumed>) = 0 [pid 478] <... set_robust_list resumed>) = 0 [pid 461] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 456] exit_group(0 [pid 478] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL) = 0 [pid 475] <... futex resumed>) = ? [pid 461] <... futex resumed>) = ? [pid 456] <... exit_group resumed>) = ? [pid 478] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 475] +++ exited with 0 +++ [pid 461] +++ exited with 0 +++ [pid 456] +++ exited with 0 +++ [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=456, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 294] umount2("./5", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 294] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 294] getdents64(3, 0x555557288620 /* 4 entries */, 32768) = 112 [pid 294] umount2("./5/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] lstat("./5/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 478] <... futex resumed>) = 1 [pid 448] <... futex resumed>) = 0 [pid 294] unlink("./5/binderfs" [pid 478] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 448] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] <... unlink resumed>) = 0 [pid 294] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 457] <... futex resumed>) = 0 [pid 448] <... futex resumed>) = 1 [pid 457] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 448] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 457] <... open resumed>) = 5 [pid 457] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 448] <... futex resumed>) = 0 [pid 457] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 448] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 457] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 448] <... futex resumed>) = 0 [pid 448] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 457] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096) = -1 EBADF (Bad file descriptor) [pid 457] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 448] <... futex resumed>) = 0 [pid 457] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 448] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 457] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 448] <... futex resumed>) = 0 [ 21.587349][ T470] ext4 filesystem being mounted at /root/syzkaller.IrUvXE/5/file1 supports timestamps until 2038 (0x7fffffff) [ 21.607368][ T469] EXT4-fs (loop0): 1 orphan inode deleted [ 21.614379][ T469] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 21.625761][ T469] ext4 filesystem being mounted at /root/syzkaller.SN8fLk/6/file1 supports timestamps until 2038 (0x7fffffff) [pid 457] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 448] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 469] <... mount resumed>) = 0 [pid 457] <... write resumed>) = 262144 [pid 457] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 448] <... futex resumed>) = 0 [pid 469] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 457] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 448] exit_group(0 [pid 478] <... futex resumed>) = ? [pid 457] <... futex resumed>) = ? [pid 448] <... exit_group resumed>) = ? [pid 478] +++ exited with 0 +++ [pid 457] +++ exited with 0 +++ [pid 448] +++ exited with 0 +++ [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=448, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 295] umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 295] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] getdents64(3, 0x555557288620 /* 4 entries */, 32768) = 112 [pid 295] umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] lstat("./4/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 295] unlink("./4/binderfs") = 0 [pid 295] umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 470] <... mount resumed>) = 0 [pid 470] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 470] chdir("./file1") = 0 [pid 470] ioctl(4, LOOP_CLR_FD) = 0 [pid 470] close(4) = 0 [pid 470] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 466] <... futex resumed>) = 0 [pid 466] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 466] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 470] <... futex resumed>) = 1 [pid 470] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 470] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 469] <... openat resumed>) = 3 [pid 466] <... futex resumed>) = 0 [pid 466] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 466] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 466] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6005c2e000 [pid 466] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 466] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[485], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 485 [pid 466] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 466] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 470] <... futex resumed>) = 1 [pid 470] fallocate(4, 0, 35143, 7) = 0 [pid 470] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 470] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 485 attached [pid 485] set_robust_list(0x7f6005c4e9e0, 24 [pid 469] chdir("./file1") = 0 [pid 485] <... set_robust_list resumed>) = 0 [pid 294] <... umount2 resumed>) = 0 [pid 294] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] lstat("./5/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 294] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] openat(AT_FDCWD, "./5/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 294] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 294] getdents64(4, 0x555557290660 /* 2 entries */, 32768) = 48 [pid 294] getdents64(4, 0x555557290660 /* 0 entries */, 32768) = 0 [pid 294] close(4) = 0 [pid 294] rmdir("./5/file1") = 0 [pid 294] getdents64(3, 0x555557288620 /* 0 entries */, 32768) = 0 [pid 294] close(3) = 0 [ 21.638058][ T471] EXT4-fs (loop3): 1 orphan inode deleted [ 21.639254][ T474] EXT4-fs (loop5): 1 orphan inode deleted [ 21.645500][ T471] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 21.649462][ T474] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [pid 294] rmdir("./5") = 0 [pid 294] mkdir("./6", 0777) = 0 [pid 294] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 474] <... mount resumed>) = 0 [pid 469] ioctl(4, LOOP_CLR_FD [pid 294] <... openat resumed>) = 3 [pid 485] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 294] ioctl(3, LOOP_CLR_FD [pid 485] <... mount resumed>) = 0 [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 485] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] close(3 [pid 485] <... futex resumed>) = 1 [pid 466] <... futex resumed>) = 0 [pid 294] <... close resumed>) = 0 [pid 485] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 466] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 470] <... futex resumed>) = 0 [pid 466] <... futex resumed>) = 1 [pid 470] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 466] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] <... clone resumed>, child_tidptr=0x5555572875d0) = 486 [pid 470] <... open resumed>) = 5 [pid 470] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 466] <... futex resumed>) = 0 [pid 470] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 466] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 470] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 466] <... futex resumed>) = 0 [pid 470] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 466] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 470] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 470] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 466] <... futex resumed>) = 0 [pid 470] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 466] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 470] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 466] <... futex resumed>) = 0 [pid 470] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 466] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 486 attached [pid 474] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 471] <... mount resumed>) = 0 [pid 469] <... ioctl resumed>) = 0 [pid 486] set_robust_list(0x5555572875e0, 24 [pid 474] <... openat resumed>) = 3 [pid 471] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 470] <... write resumed>) = 262144 [pid 469] close(4 [pid 486] <... set_robust_list resumed>) = 0 [pid 474] chdir("./file1" [pid 471] <... openat resumed>) = 3 [pid 470] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 469] <... close resumed>) = 0 [pid 486] chdir("./6" [pid 474] <... chdir resumed>) = 0 [pid 471] chdir("./file1" [pid 469] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 466] <... futex resumed>) = 0 [pid 470] <... futex resumed>) = 1 [pid 486] <... chdir resumed>) = 0 [pid 474] ioctl(4, LOOP_CLR_FD [pid 471] <... chdir resumed>) = 0 [pid 469] <... futex resumed>) = 1 [pid 465] <... futex resumed>) = 0 [pid 486] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 474] <... ioctl resumed>) = 0 [pid 471] ioctl(4, LOOP_CLR_FD [pid 470] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 469] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 466] exit_group(0 [pid 465] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 486] <... prctl resumed>) = 0 [pid 485] <... futex resumed>) = ? [pid 474] close(4 [pid 471] <... ioctl resumed>) = 0 [pid 470] <... futex resumed>) = ? [pid 469] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 466] <... exit_group resumed>) = ? [pid 465] <... futex resumed>) = 0 [pid 486] setpgid(0, 0 [pid 485] +++ exited with 0 +++ [pid 474] <... close resumed>) = 0 [pid 471] close(4 [pid 470] +++ exited with 0 +++ [pid 469] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 465] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 486] <... setpgid resumed>) = 0 [pid 474] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 471] <... close resumed>) = 0 [pid 466] +++ exited with 0 +++ [pid 486] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 474] <... futex resumed>) = 1 [pid 471] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=466, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 486] <... openat resumed>) = 3 [pid 474] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 473] <... futex resumed>) = 0 [pid 471] <... futex resumed>) = 1 [pid 469] <... open resumed>) = 4 [pid 467] <... futex resumed>) = 0 [pid 486] write(3, "1000", 4 [pid 473] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 471] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 469] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 467] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 486] <... write resumed>) = 4 [pid 474] <... futex resumed>) = 0 [pid 473] <... futex resumed>) = 1 [pid 471] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 469] <... futex resumed>) = 1 [pid 467] <... futex resumed>) = 0 [pid 465] <... futex resumed>) = 0 [pid 486] close(3 [pid 474] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 473] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 471] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 469] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 467] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 465] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] umount2("./5", MNT_DETACH|UMOUNT_NOFOLLOW [pid 486] <... close resumed>) = 0 [pid 486] symlink("/dev/binderfs", "./binderfs" [pid 471] <... open resumed>) = 4 [pid 469] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 465] <... futex resumed>) = 0 [pid 486] <... symlink resumed>) = 0 [pid 474] <... open resumed>) = 4 [pid 471] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 469] fallocate(4, 0, 35143, 7 [pid 465] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 486] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 474] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 471] <... futex resumed>) = 1 [pid 469] <... fallocate resumed>) = 0 [pid 467] <... futex resumed>) = 0 [pid 465] <... futex resumed>) = 0 [pid 297] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 486] <... futex resumed>) = 0 [pid 474] <... futex resumed>) = 1 [pid 473] <... futex resumed>) = 0 [pid 471] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 469] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 467] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 465] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 297] <... openat resumed>) = 3 [pid 486] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 474] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 473] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 471] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 469] <... futex resumed>) = 0 [pid 467] <... futex resumed>) = 0 [pid 465] <... mmap resumed>) = 0x7f6005c2e000 [pid 297] fstat(3, [pid 486] <... mmap resumed>) = 0x7f600e00f000 [pid 474] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 473] <... futex resumed>) = 0 [pid 471] fallocate(4, 0, 35143, 7 [pid 469] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 467] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 465] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE [pid 297] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 486] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE [pid 474] fallocate(4, 0, 35143, 7 [pid 473] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 471] <... fallocate resumed>) = 0 [pid 467] <... futex resumed>) = 0 [pid 465] <... mprotect resumed>) = 0 [pid 297] getdents64(3, [pid 486] <... mprotect resumed>) = 0 [pid 474] <... fallocate resumed>) = 0 [pid 473] <... futex resumed>) = 0 [pid 471] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 467] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 465] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 297] <... getdents64 resumed>0x555557288620 /* 4 entries */, 32768) = 112 [pid 486] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 474] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 473] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 471] <... futex resumed>) = 0 [pid 467] <... mmap resumed>) = 0x7f6005c2e000 [pid 297] umount2("./5/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 474] <... futex resumed>) = 0 [pid 473] <... mmap resumed>) = 0x7f6005c2e000 [pid 471] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 467] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE [pid 465] <... clone resumed>, parent_tid=[487], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 487 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 486] <... clone resumed>, parent_tid=[488], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 488 [pid 474] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 473] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE [pid 467] <... mprotect resumed>) = 0 [pid 465] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] lstat("./5/binderfs", [pid 486] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 473] <... mprotect resumed>) = 0 [pid 467] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 465] <... futex resumed>) = 0 [pid 297] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 486] <... futex resumed>) = 0 [pid 473] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 465] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] unlink("./5/binderfs" [pid 486] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 467] <... clone resumed>, parent_tid=[489], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 489 [pid 297] <... unlink resumed>) = 0 [pid 473] <... clone resumed>, parent_tid=[490], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 490 [pid 467] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 473] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 467] <... futex resumed>) = 0 ./strace-static-x86_64: Process 490 attached ./strace-static-x86_64: Process 489 attached ./strace-static-x86_64: Process 488 attached ./strace-static-x86_64: Process 487 attached [pid 473] <... futex resumed>) = 0 [pid 467] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 490] set_robust_list(0x7f6005c4e9e0, 24 [pid 489] set_robust_list(0x7f6005c4e9e0, 24 [pid 488] set_robust_list(0x7f600e02f9e0, 24 [pid 487] set_robust_list(0x7f6005c4e9e0, 24 [pid 490] <... set_robust_list resumed>) = 0 [pid 489] <... set_robust_list resumed>) = 0 [pid 488] <... set_robust_list resumed>) = 0 [pid 487] <... set_robust_list resumed>) = 0 [pid 473] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 490] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 489] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 488] memfd_create("syzkaller", 0 [pid 487] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 490] <... mount resumed>) = 0 [pid 489] <... mount resumed>) = 0 [pid 488] <... memfd_create resumed>) = 3 [pid 487] <... mount resumed>) = 0 [pid 490] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 489] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 488] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 487] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 490] <... futex resumed>) = 1 [pid 489] <... futex resumed>) = 1 [pid 488] <... mmap resumed>) = 0x7f6005c0f000 [pid 487] <... futex resumed>) = 1 [pid 467] <... futex resumed>) = 0 [pid 465] <... futex resumed>) = 0 [pid 490] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 489] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 488] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 487] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 473] <... futex resumed>) = 0 [pid 467] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 465] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 488] <... write resumed>) = 262144 [pid 488] munmap(0x7f6005c0f000, 262144) = 0 [pid 473] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 467] <... futex resumed>) = 1 [pid 465] <... futex resumed>) = 1 [pid 295] <... umount2 resumed>) = 0 [pid 488] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 474] <... futex resumed>) = 0 [pid 473] <... futex resumed>) = 1 [pid 471] <... futex resumed>) = 0 [pid 469] <... futex resumed>) = 0 [pid 467] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 465] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 488] <... openat resumed>) = 4 [pid 474] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 473] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 471] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 469] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [ 21.679177][ T474] ext4 filesystem being mounted at /root/syzkaller.kumyKI/5/file1 supports timestamps until 2038 (0x7fffffff) [ 21.690831][ T471] ext4 filesystem being mounted at /root/syzkaller.2mSqAy/5/file1 supports timestamps until 2038 (0x7fffffff) [pid 488] ioctl(4, LOOP_SET_FD, 3 [pid 474] <... open resumed>) = 5 [pid 471] <... open resumed>) = 5 [pid 469] <... open resumed>) = 5 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 474] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 471] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 469] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] lstat("./4/file1", [pid 474] <... futex resumed>) = 1 [pid 473] <... futex resumed>) = 0 [pid 471] <... futex resumed>) = 1 [pid 469] <... futex resumed>) = 1 [pid 467] <... futex resumed>) = 0 [pid 465] <... futex resumed>) = 0 [pid 295] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 474] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 473] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 471] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 469] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 467] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 465] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 474] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 473] <... futex resumed>) = 0 [pid 471] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 488] <... ioctl resumed>) = 0 [pid 469] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 467] <... futex resumed>) = 0 [pid 465] <... futex resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 474] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 473] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 471] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 469] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 467] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 465] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] openat(AT_FDCWD, "./4/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 474] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 471] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 469] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 295] <... openat resumed>) = 4 [pid 488] close(3 [pid 474] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 471] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 469] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] fstat(4, [pid 488] <... close resumed>) = 0 [pid 474] <... futex resumed>) = 1 [pid 473] <... futex resumed>) = 0 [pid 471] <... futex resumed>) = 1 [pid 469] <... futex resumed>) = 1 [pid 467] <... futex resumed>) = 0 [pid 465] <... futex resumed>) = 0 [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 488] mkdir("./file1", 0777 [pid 474] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 473] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 471] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 469] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 467] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 465] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] getdents64(4, [pid 474] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 473] <... futex resumed>) = 0 [pid 471] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 469] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 467] <... futex resumed>) = 0 [pid 465] <... futex resumed>) = 0 [pid 295] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 474] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 473] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 471] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 469] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 467] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 465] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] getdents64(4, [pid 488] <... mkdir resumed>) = 0 [pid 474] <... write resumed>) = 262144 [pid 488] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 295] <... getdents64 resumed>0x555557290660 /* 0 entries */, 32768) = 0 [pid 474] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 474] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 473] <... futex resumed>) = 0 [pid 295] close(4 [pid 473] exit_group(0 [pid 471] <... write resumed>) = 262144 [pid 469] <... write resumed>) = 262144 [pid 471] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 469] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 471] <... futex resumed>) = 1 [pid 469] <... futex resumed>) = 1 [pid 471] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 469] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 297] <... umount2 resumed>) = 0 [pid 490] <... futex resumed>) = ? [pid 474] <... futex resumed>) = ? [pid 473] <... exit_group resumed>) = ? [pid 467] <... futex resumed>) = 0 [pid 465] <... futex resumed>) = 0 [pid 297] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... close resumed>) = 0 [pid 490] +++ exited with 0 +++ [pid 474] +++ exited with 0 +++ [pid 473] +++ exited with 0 +++ [pid 467] exit_group(0 [pid 465] exit_group(0 [pid 295] rmdir("./4/file1" [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] lstat("./5/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./5/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 487] <... futex resumed>) = ? [pid 465] <... exit_group resumed>) = ? [pid 297] <... openat resumed>) = 4 [pid 297] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] <... rmdir resumed>) = 0 [pid 487] +++ exited with 0 +++ [pid 297] getdents64(4, [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=473, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 489] <... futex resumed>) = ? [pid 471] <... futex resumed>) = ? [pid 469] <... futex resumed>) = ? [pid 467] <... exit_group resumed>) = ? [pid 297] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 295] getdents64(3, [pid 297] getdents64(4, 0x555557290660 /* 0 entries */, 32768) = 0 [pid 297] close(4) = 0 [pid 297] rmdir("./5/file1") = 0 [pid 297] getdents64(3, 0x555557288620 /* 0 entries */, 32768) = 0 [pid 297] close(3) = 0 [pid 297] rmdir("./5" [pid 489] +++ exited with 0 +++ [pid 297] <... rmdir resumed>) = 0 [pid 295] <... getdents64 resumed>0x555557288620 /* 0 entries */, 32768) = 0 [pid 297] mkdir("./6", 0777 [pid 471] +++ exited with 0 +++ [pid 469] +++ exited with 0 +++ [pid 467] +++ exited with 0 +++ [pid 465] +++ exited with 0 +++ [pid 297] <... mkdir resumed>) = 0 [pid 295] close(3 [pid 298] umount2("./5", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=467, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... openat resumed>) = 3 [pid 295] <... close resumed>) = 0 [pid 298] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] ioctl(3, LOOP_CLR_FD [pid 295] rmdir("./4" [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 293] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=465, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 298] <... openat resumed>) = 3 [pid 297] close(3) = 0 [pid 296] umount2("./5", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... rmdir resumed>) = 0 [pid 298] fstat(3, [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 293] restart_syscall(<... resuming interrupted clone ...> [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] mkdir("./5", 0777 [pid 298] getdents64(3, [pid 297] <... clone resumed>, child_tidptr=0x5555572875d0) = 492 [pid 293] <... restart_syscall resumed>) = 0 [pid 298] <... getdents64 resumed>0x555557288620 /* 4 entries */, 32768) = 112 [pid 296] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] <... mkdir resumed>) = 0 [pid 296] <... openat resumed>) = 3 [pid 298] umount2("./5/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] fstat(3, [pid 295] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] <... openat resumed>) = 3 [pid 298] lstat("./5/binderfs", [pid 296] getdents64(3, [pid 295] ioctl(3, LOOP_CLR_FD [pid 296] <... getdents64 resumed>0x555557288620 /* 4 entries */, 32768) = 112 [pid 298] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 293] umount2("./6", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] unlink("./5/binderfs" [pid 296] umount2("./5/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 293] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... unlink resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] close(3 [pid 293] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] lstat("./5/binderfs", [pid 293] <... openat resumed>) = 3 [pid 296] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 293] fstat(3, [pid 296] unlink("./5/binderfs" [pid 293] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] <... unlink resumed>) = 0 [pid 293] getdents64(3, [pid 296] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... close resumed>) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 293] <... getdents64 resumed>0x555557288620 /* 4 entries */, 32768) = 112 [pid 293] umount2("./6/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 492 attached [pid 492] set_robust_list(0x5555572875e0, 24 [pid 293] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 293] lstat("./6/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 492] <... set_robust_list resumed>) = 0 [pid 293] unlink("./6/binderfs" [pid 492] chdir("./6" [pid 293] <... unlink resumed>) = 0 [pid 293] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 492] <... chdir resumed>) = 0 [pid 492] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 492] setpgid(0, 0) = 0 [pid 492] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 492] write(3, "1000", 4) = 4 [pid 492] close(3) = 0 [pid 492] symlink("/dev/binderfs", "./binderfs") = 0 [pid 492] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 295] <... clone resumed>, child_tidptr=0x5555572875d0) = 494 [pid 492] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 492] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 492] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[495], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 495 [pid 492] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 492] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 495 attached [pid 495] set_robust_list(0x7f600e02f9e0, 24) = 0 [pid 495] memfd_create("syzkaller", 0) = 3 [pid 495] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 [pid 495] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144./strace-static-x86_64: Process 494 attached [pid 494] set_robust_list(0x5555572875e0, 24) = 0 [pid 494] chdir("./5") = 0 [pid 494] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 495] <... write resumed>) = 262144 [pid 495] munmap(0x7f6005c0f000, 262144) = 0 [pid 495] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [ 21.735951][ T488] loop1: detected capacity change from 0 to 512 [pid 495] ioctl(4, LOOP_SET_FD, 3 [pid 494] <... prctl resumed>) = 0 [pid 495] <... ioctl resumed>) = 0 [pid 495] close(3) = 0 [pid 495] mkdir("./file1", 0777) = 0 [pid 495] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 494] setpgid(0, 0) = 0 [pid 494] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 494] write(3, "1000", 4) = 4 [pid 494] close(3) = 0 [pid 494] symlink("/dev/binderfs", "./binderfs") = 0 [pid 494] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 494] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 494] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 494] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[496], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 496 [pid 494] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 494] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 496 attached [pid 496] set_robust_list(0x7f600e02f9e0, 24) = 0 [pid 496] memfd_create("syzkaller", 0) = 3 [pid 496] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 [pid 496] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 496] munmap(0x7f6005c0f000, 262144) = 0 [pid 496] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 4 [pid 496] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 496] close(3) = 0 [pid 298] <... umount2 resumed>) = 0 [pid 488] <... mount resumed>) = 0 [pid 298] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... umount2 resumed>) = 0 [pid 293] <... umount2 resumed>) = 0 [pid 488] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 293] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] lstat("./5/file1", [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 488] <... openat resumed>) = 3 [pid 293] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 488] chdir("./file1" [pid 296] lstat("./5/file1", [pid 293] lstat("./6/file1", [pid 488] <... chdir resumed>) = 0 [pid 298] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 488] ioctl(4, LOOP_CLR_FD [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 293] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 488] <... ioctl resumed>) = 0 [pid 298] openat(AT_FDCWD, "./5/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 293] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 488] close(4 [pid 298] <... openat resumed>) = 4 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] fstat(4, [pid 296] openat(AT_FDCWD, "./5/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 293] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 488] <... close resumed>) = 0 [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 488] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... openat resumed>) = 4 [pid 293] openat(AT_FDCWD, "./6/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 488] <... futex resumed>) = 1 [pid 298] getdents64(4, [pid 296] fstat(4, [pid 488] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 293] <... openat resumed>) = 4 [pid 486] <... futex resumed>) = 0 [pid 298] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 293] fstat(4, [pid 486] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] getdents64(4, [pid 296] getdents64(4, [pid 486] <... futex resumed>) = 1 [pid 298] <... getdents64 resumed>0x555557290660 /* 0 entries */, 32768) = 0 [pid 293] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 486] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 293] getdents64(4, [pid 298] close(4 [pid 488] <... futex resumed>) = 0 [pid 296] getdents64(4, [pid 298] <... close resumed>) = 0 [pid 293] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 488] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 298] rmdir("./5/file1" [pid 296] <... getdents64 resumed>0x555557290660 /* 0 entries */, 32768) = 0 [pid 293] getdents64(4, [pid 298] <... rmdir resumed>) = 0 [pid 296] close(4 [pid 293] <... getdents64 resumed>0x555557290660 /* 0 entries */, 32768) = 0 [pid 298] getdents64(3, [pid 296] <... close resumed>) = 0 [pid 293] close(4 [pid 488] <... open resumed>) = 4 [pid 298] <... getdents64 resumed>0x555557288620 /* 0 entries */, 32768) = 0 [pid 296] rmdir("./5/file1" [pid 293] <... close resumed>) = 0 [pid 488] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] close(3 [pid 488] <... futex resumed>) = 1 [pid 486] <... futex resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 296] <... rmdir resumed>) = 0 [pid 293] rmdir("./6/file1" [pid 488] fallocate(4, 0, 35143, 7 [pid 486] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] rmdir("./5" [pid 296] getdents64(3, [pid 486] <... futex resumed>) = 0 [pid 293] <... rmdir resumed>) = 0 [pid 486] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... rmdir resumed>) = 0 [pid 486] <... futex resumed>) = 0 [pid 293] getdents64(3, [pid 486] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] mkdir("./6", 0777 [pid 296] <... getdents64 resumed>0x555557288620 /* 0 entries */, 32768) = 0 [pid 293] <... getdents64 resumed>0x555557288620 /* 0 entries */, 32768) = 0 [pid 486] <... mmap resumed>) = 0x7f6005c2e000 [pid 486] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE [pid 298] <... mkdir resumed>) = 0 [pid 488] <... fallocate resumed>) = 0 [pid 296] close(3 [pid 293] close(3 [pid 486] <... mprotect resumed>) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 488] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 486] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 298] <... openat resumed>) = 3 [pid 296] <... close resumed>) = 0 [pid 293] <... close resumed>) = 0 [pid 293] rmdir("./6" [pid 296] rmdir("./5" [pid 486] <... clone resumed>, parent_tid=[497], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 497 [pid 298] ioctl(3, LOOP_CLR_FD [pid 496] mkdir("./file1", 0777 [pid 293] <... rmdir resumed>) = 0 [pid 486] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... rmdir resumed>) = 0 [pid 486] <... futex resumed>) = 0 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 293] mkdir("./7", 0777 [pid 296] mkdir("./6", 0777 [pid 486] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 496] <... mkdir resumed>) = 0 [pid 496] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 293] <... mkdir resumed>) = 0 [pid 298] close(3 [pid 296] <... mkdir resumed>) = 0 [pid 293] openat(AT_FDCWD, "/dev/loop0", O_RDWR./strace-static-x86_64: Process 497 attached [pid 497] set_robust_list(0x7f6005c4e9e0, 24) = 0 [pid 497] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 488] <... futex resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 293] <... openat resumed>) = 3 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] <... openat resumed>) = 3 [pid 293] ioctl(3, LOOP_CLR_FD [pid 497] <... mount resumed>) = 0 [pid 497] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... clone resumed>, child_tidptr=0x5555572875d0) = 498 [pid 296] ioctl(3, LOOP_CLR_FD [pid 293] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 293] close(3 [pid 296] close(3 [pid 293] <... close resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 293] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 488] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 296] <... clone resumed>, child_tidptr=0x5555572875d0) = 500 [pid 293] <... clone resumed>, child_tidptr=0x5555572875d0) = 499 [pid 486] <... futex resumed>) = 0 [pid 486] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 488] <... futex resumed>) = 0 [pid 486] <... futex resumed>) = 1 [pid 488] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 486] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 488] <... open resumed>) = 5 [pid 488] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 486] <... futex resumed>) = 0 [pid 488] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 486] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 488] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 486] <... futex resumed>) = 0 [pid 488] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 486] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 488] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 488] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 486] <... futex resumed>) = 0 [pid 488] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 486] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 488] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 486] <... futex resumed>) = 0 [pid 488] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 486] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 488] <... write resumed>) = 262144 [pid 488] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 486] <... futex resumed>) = 0 [pid 488] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 486] exit_group(0 [pid 488] <... futex resumed>) = ? [pid 486] <... exit_group resumed>) = ? [pid 488] +++ exited with 0 +++ [pid 497] <... futex resumed>) = ? [pid 497] +++ exited with 0 +++ [pid 486] +++ exited with 0 +++ [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=486, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 294] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 294] umount2("./6", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 294] fstat(3, ./strace-static-x86_64: Process 498 attached {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 498] set_robust_list(0x5555572875e0, 24) = 0 [pid 498] chdir("./6") = 0 [pid 294] getdents64(3, [pid 498] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 498] setpgid(0, 0 [pid 294] <... getdents64 resumed>0x555557288620 /* 4 entries */, 32768) = 112 [pid 498] <... setpgid resumed>) = 0 [pid 294] umount2("./6/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 498] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [ 21.784068][ T488] EXT4-fs (loop1): 1 orphan inode deleted [ 21.784193][ T495] loop4: detected capacity change from 0 to 512 [ 21.793911][ T488] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 21.805856][ T496] loop2: detected capacity change from 0 to 512 [ 21.807144][ T488] ext4 filesystem being mounted at /root/syzkaller.6GNILo/6/file1 supports timestamps until 2038 (0x7fffffff) [pid 294] lstat("./6/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 294] unlink("./6/binderfs" [pid 498] <... openat resumed>) = 3 [pid 498] write(3, "1000", 4) = 4 [pid 294] <... unlink resumed>) = 0 [pid 498] close(3 [pid 294] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 498] <... close resumed>) = 0 [pid 498] symlink("/dev/binderfs", "./binderfs") = 0 [pid 498] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 498] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 498] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 498] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID./strace-static-x86_64: Process 499 attached [pid 499] set_robust_list(0x5555572875e0, 24 [pid 498] <... clone resumed>, parent_tid=[504], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 504 [pid 498] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 498] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 499] <... set_robust_list resumed>) = 0 [pid 499] chdir("./7") = 0 [pid 499] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 499] setpgid(0, 0) = 0 [pid 499] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 499] write(3, "1000", 4) = 4 [pid 499] close(3) = 0 [pid 499] symlink("/dev/binderfs", "./binderfs") = 0 ./strace-static-x86_64: Process 500 attached [pid 500] set_robust_list(0x5555572875e0, 24) = 0 [pid 500] chdir("./6" [pid 499] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] <... umount2 resumed>) = 0 [pid 499] <... futex resumed>) = 0 [pid 499] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 499] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 500] <... chdir resumed>) = 0 [pid 499] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 500] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 500] setpgid(0, 0) = 0 [pid 500] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 294] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 499] <... clone resumed>, parent_tid=[505], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 505 [pid 294] lstat("./6/file1", [pid 499] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 499] <... futex resumed>) = 0 [pid 499] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 500] <... openat resumed>) = 3 [pid 500] write(3, "1000", 4) = 4 [pid 500] close(3) = 0 [pid 500] symlink("/dev/binderfs", "./binderfs") = 0 [pid 294] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 500] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] openat(AT_FDCWD, "./6/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 500] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 294] <... openat resumed>) = 4 [pid 500] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE [pid 294] fstat(4, [pid 500] <... mprotect resumed>) = 0 [pid 294] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 500] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 294] getdents64(4, [pid 500] <... clone resumed>, parent_tid=[506], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 506 [pid 500] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 500] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 504 attached [pid 504] set_robust_list(0x7f600e02f9e0, 24) = 0 [pid 504] memfd_create("syzkaller", 0) = 3 [pid 504] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 [pid 504] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144./strace-static-x86_64: Process 506 attached [pid 506] set_robust_list(0x7f600e02f9e0, 24) = 0 [pid 506] memfd_create("syzkaller", 0) = 3 [pid 506] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 [pid 504] <... write resumed>) = 262144 [pid 504] munmap(0x7f6005c0f000, 262144) = 0 [pid 504] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 4 [pid 504] ioctl(4, LOOP_SET_FD, 3 [pid 506] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 506] munmap(0x7f6005c0f000, 262144) = 0 [pid 506] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 506] ioctl(4, LOOP_SET_FD, 3 [pid 294] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 294] getdents64(4, 0x555557290660 /* 0 entries */, 32768) = 0 [pid 504] <... ioctl resumed>) = 0 [pid 504] close(3) = 0 [pid 504] mkdir("./file1", 0777 [pid 294] close(4 [pid 504] <... mkdir resumed>) = 0 [pid 294] <... close resumed>) = 0 [pid 504] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 294] rmdir("./6/file1") = 0 [pid 294] getdents64(3, 0x555557288620 /* 0 entries */, 32768) = 0 [pid 294] close(3 [pid 506] <... ioctl resumed>) = 0 [pid 506] close(3) = 0 [pid 506] mkdir("./file1", 0777 [pid 294] <... close resumed>) = 0 [pid 506] <... mkdir resumed>) = 0 [pid 506] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [ 21.872481][ T495] EXT4-fs (loop4): 1 orphan inode deleted [ 21.876267][ T504] loop5: detected capacity change from 0 to 512 [ 21.878052][ T495] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 21.886408][ T506] loop3: detected capacity change from 0 to 512 [ 21.904389][ T495] ext4 filesystem being mounted at /root/syzkaller.IrUvXE/6/file1 supports timestamps until 2038 (0x7fffffff) [ 21.905282][ T496] EXT4-fs (loop2): 1 orphan inode deleted [pid 294] rmdir("./6") = 0 [pid 495] <... mount resumed>) = 0 [pid 495] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 495] chdir("./file1") = 0 [pid 495] ioctl(4, LOOP_CLR_FD) = 0 [pid 294] mkdir("./7", 0777 [pid 495] close(4) = 0 [pid 495] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 492] <... futex resumed>) = 0 [pid 492] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 492] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 495] <... futex resumed>) = 1 [pid 495] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 294] <... mkdir resumed>) = 0 ./strace-static-x86_64: Process 505 attached [pid 505] set_robust_list(0x7f600e02f9e0, 24) = 0 [pid 505] memfd_create("syzkaller", 0) = 3 [pid 505] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 [pid 505] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 505] munmap(0x7f6005c0f000, 262144) = 0 [pid 505] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 505] ioctl(4, LOOP_SET_FD, 3 [pid 495] <... open resumed>) = 4 [pid 294] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 505] <... ioctl resumed>) = 0 [pid 505] close(3) = 0 [pid 505] mkdir("./file1", 0777) = 0 [pid 505] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 495] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 492] <... futex resumed>) = 0 [pid 495] fallocate(4, 0, 35143, 7 [pid 492] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 495] <... fallocate resumed>) = 0 [pid 492] <... futex resumed>) = 0 [pid 495] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 492] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 495] <... futex resumed>) = 0 [pid 492] <... futex resumed>) = 0 [pid 495] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 492] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6005c2e000 [pid 492] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 492] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[510], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 510 [pid 492] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 492] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 510 attached [pid 510] set_robust_list(0x7f6005c4e9e0, 24) = 0 [pid 510] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL) = 0 [pid 510] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 492] <... futex resumed>) = 0 [pid 492] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 495] <... futex resumed>) = 0 [pid 492] <... futex resumed>) = 1 [pid 495] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 492] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 495] <... open resumed>) = 5 [pid 495] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 492] <... futex resumed>) = 0 [pid 495] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 492] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 495] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 492] <... futex resumed>) = 0 [pid 495] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 492] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 495] <... futex resumed>) = 0 [pid 492] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 495] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 492] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 492] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 510] <... futex resumed>) = 1 [ 21.926758][ T505] loop0: detected capacity change from 0 to 512 [ 21.929645][ T496] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 21.944123][ T496] ext4 filesystem being mounted at /root/syzkaller.qF1bbv/5/file1 supports timestamps until 2038 (0x7fffffff) [ 21.944264][ T504] EXT4-fs (loop5): 1 orphan inode deleted [ 21.962532][ T506] EXT4-fs (loop3): 1 orphan inode deleted [pid 510] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 496] <... mount resumed>) = 0 [pid 496] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 496] chdir("./file1") = 0 [pid 496] ioctl(4, LOOP_CLR_FD) = 0 [pid 495] <... write resumed>) = 262144 [pid 495] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 492] <... futex resumed>) = 0 [pid 492] exit_group(0) = ? [pid 496] close(4 [pid 495] <... futex resumed>) = ? [pid 495] +++ exited with 0 +++ [pid 294] <... openat resumed>) = 3 [pid 294] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 294] close(3) = 0 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555572875d0) = 513 [pid 496] <... close resumed>) = 0 [pid 496] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 510] <... futex resumed>) = ? [pid 510] +++ exited with 0 +++ [pid 492] +++ exited with 0 +++ [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=492, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 297] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 297] umount2("./6", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 297] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] getdents64(3, 0x555557288620 /* 4 entries */, 32768) = 112 [pid 297] umount2("./6/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] lstat("./6/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 297] unlink("./6/binderfs") = 0 [pid 297] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 496] <... futex resumed>) = 1 [pid 494] <... futex resumed>) = 0 [pid 297] <... umount2 resumed>) = 0 [pid 496] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 494] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 494] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 496] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 297] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 496] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] lstat("./6/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./6/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 496] <... open resumed>) = 4 [pid 297] <... openat resumed>) = 4 [pid 297] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] getdents64(4, 0x555557290660 /* 2 entries */, 32768) = 48 [pid 297] getdents64(4, 0x555557290660 /* 0 entries */, 32768) = 0 [pid 496] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 494] <... futex resumed>) = 0 [pid 494] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 496] fallocate(4, 0, 35143, 7 [pid 494] <... futex resumed>) = 0 [pid 494] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 494] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 297] close(4 [pid 494] <... mmap resumed>) = 0x7f6005c2e000 [pid 297] <... close resumed>) = 0 [pid 494] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE [pid 297] rmdir("./6/file1" [pid 496] <... fallocate resumed>) = 0 [pid 494] <... mprotect resumed>) = 0 [pid 297] <... rmdir resumed>) = 0 [pid 494] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 297] getdents64(3, [pid 496] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... getdents64 resumed>0x555557288620 /* 0 entries */, 32768) = 0 [pid 494] <... clone resumed>, parent_tid=[515], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 515 [pid 297] close(3 [pid 496] <... futex resumed>) = 0 [pid 494] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... close resumed>) = 0 [pid 494] <... futex resumed>) = 0 [pid 297] rmdir("./6" [pid 496] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 494] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] <... rmdir resumed>) = 0 [pid 297] mkdir("./7", 0777) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 3 [pid 297] ioctl(3, LOOP_CLR_FD) = 0 [pid 297] close(3) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555572875d0) = 516 ./strace-static-x86_64: Process 513 attached [pid 513] set_robust_list(0x5555572875e0, 24) = 0 [pid 513] chdir("./7") = 0 [pid 513] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 513] setpgid(0, 0) = 0 [pid 513] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 513] write(3, "1000", 4) = 4 [pid 513] close(3) = 0 [pid 513] symlink("/dev/binderfs", "./binderfs"./strace-static-x86_64: Process 515 attached ./strace-static-x86_64: Process 516 attached ) = 0 [pid 516] set_robust_list(0x5555572875e0, 24 [pid 515] set_robust_list(0x7f6005c4e9e0, 24 [pid 513] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 516] <... set_robust_list resumed>) = 0 [pid 515] <... set_robust_list resumed>) = 0 [pid 513] <... futex resumed>) = 0 [pid 515] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL) = 0 [ 21.968076][ T506] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [pid 516] chdir("./7" [pid 515] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 513] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 516] <... chdir resumed>) = 0 [pid 515] <... futex resumed>) = 1 [pid 513] <... mmap resumed>) = 0x7f600e00f000 [pid 494] <... futex resumed>) = 0 [pid 516] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 515] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 513] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE [pid 505] <... mount resumed>) = 0 [ 22.004618][ T505] EXT4-fs (loop0): 1 orphan inode deleted [ 22.010417][ T505] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 22.021959][ T505] ext4 filesystem being mounted at /root/syzkaller.SN8fLk/7/file1 supports timestamps until 2038 (0x7fffffff) [ 22.022771][ T504] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [pid 494] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 516] <... prctl resumed>) = 0 [pid 513] <... mprotect resumed>) = 0 [pid 506] <... mount resumed>) = 0 [pid 505] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 494] <... futex resumed>) = 1 [pid 516] setpgid(0, 0 [pid 513] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 505] <... openat resumed>) = 3 [pid 494] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 516] <... setpgid resumed>) = 0 [pid 505] chdir("./file1" [pid 516] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 513] <... clone resumed>, parent_tid=[518], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 518 [pid 505] <... chdir resumed>) = 0 [pid 516] <... openat resumed>) = 3 [pid 513] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 505] ioctl(4, LOOP_CLR_FD [pid 516] write(3, "1000", 4 [pid 513] <... futex resumed>) = 0 [pid 505] <... ioctl resumed>) = 0 [pid 516] <... write resumed>) = 4 [pid 513] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 505] close(4 [pid 516] close(3 [pid 505] <... close resumed>) = 0 [pid 516] <... close resumed>) = 0 [pid 505] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 516] symlink("/dev/binderfs", "./binderfs" [pid 505] <... futex resumed>) = 1 [pid 499] <... futex resumed>) = 0 [pid 516] <... symlink resumed>) = 0 [pid 505] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 499] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 516] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 499] <... futex resumed>) = 0 [pid 516] <... futex resumed>) = 0 [pid 499] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 516] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 516] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 516] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[519], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 519 [pid 516] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 516] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 506] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 506] chdir("./file1") = 0 [pid 506] ioctl(4, LOOP_CLR_FD) = 0 [pid 506] close(4 [pid 496] <... futex resumed>) = 0 [pid 506] <... close resumed>) = 0 [pid 506] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 496] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 500] <... futex resumed>) = 0 [pid 500] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 500] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 505] <... open resumed>) = 4 [pid 506] <... futex resumed>) = 1 [pid 496] <... open resumed>) = 5 [pid 506] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 496] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 494] <... futex resumed>) = 0 [pid 506] <... open resumed>) = 4 [pid 494] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 505] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 496] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 506] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 496] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 494] <... futex resumed>) = 0 [pid 505] <... futex resumed>) = 1 [pid 499] <... futex resumed>) = 0 [pid 494] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 506] <... futex resumed>) = 1 [pid 505] fallocate(4, 0, 35143, 7 [pid 500] <... futex resumed>) = 0 [pid 499] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 496] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 504] <... mount resumed>) = 0 [pid 504] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 504] chdir("./file1") = 0 [pid 504] ioctl(4, LOOP_CLR_FD) = 0 [pid 504] close(4) = 0 [pid 504] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 498] <... futex resumed>) = 0 [pid 498] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 498] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 500] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 506] fallocate(4, 0, 35143, 7 [pid 500] <... futex resumed>) = 0 [pid 499] <... futex resumed>) = 0 [pid 496] <... futex resumed>) = 0 [pid 494] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 505] <... fallocate resumed>) = 0 [pid 500] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 494] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 499] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 506] <... fallocate resumed>) = 0 [pid 500] <... futex resumed>) = 0 [pid 494] <... futex resumed>) = 0 [pid 505] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 499] <... futex resumed>) = 0 [pid 496] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 500] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 494] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 499] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 500] <... mmap resumed>) = 0x7f6005c2e000 [pid 499] <... mmap resumed>) = 0x7f6005c2e000 [pid 504] <... futex resumed>) = 1 [pid 504] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000./strace-static-x86_64: Process 518 attached [pid 518] set_robust_list(0x7f600e02f9e0, 24) = 0 [pid 518] memfd_create("syzkaller", 0) = 3 [pid 518] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 [pid 500] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE [pid 506] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 505] <... futex resumed>) = 0 [pid 500] <... mprotect resumed>) = 0 [pid 499] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE [pid 500] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 499] <... mprotect resumed>) = 0 [pid 506] <... futex resumed>) = 0 [pid 505] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 499] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 500] <... clone resumed>, parent_tid=[520], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 520 [pid 506] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 500] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 499] <... clone resumed>, parent_tid=[521], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 521 [pid 518] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 499] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 500] <... futex resumed>) = 0 [pid 500] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 499] <... futex resumed>) = 0 [pid 499] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 496] <... write resumed>) = 262144 [pid 496] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 504] <... open resumed>) = 4 [pid 518] <... write resumed>) = 262144 [pid 496] <... futex resumed>) = 1 [pid 494] <... futex resumed>) = 0 [pid 504] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 521 attached ./strace-static-x86_64: Process 520 attached ./strace-static-x86_64: Process 519 attached [pid 518] munmap(0x7f6005c0f000, 262144 [pid 494] exit_group(0) = ? [pid 521] set_robust_list(0x7f6005c4e9e0, 24 [pid 518] <... munmap resumed>) = 0 [pid 515] <... futex resumed>) = ? [pid 521] <... set_robust_list resumed>) = 0 [pid 518] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 515] +++ exited with 0 +++ [pid 521] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 518] <... openat resumed>) = 4 [pid 521] <... mount resumed>) = 0 [pid 518] ioctl(4, LOOP_SET_FD, 3 [pid 504] <... futex resumed>) = 1 [pid 498] <... futex resumed>) = 0 [pid 521] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 521] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 496] +++ exited with 0 +++ [pid 494] +++ exited with 0 +++ [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=494, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 295] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 295] umount2("./5", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 295] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] getdents64(3, 0x555557288620 /* 4 entries */, 32768) = 112 [pid 295] umount2("./5/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] lstat("./5/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 295] unlink("./5/binderfs") = 0 [pid 295] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 519] set_robust_list(0x7f600e02f9e0, 24) = 0 [pid 519] memfd_create("syzkaller", 0) = 3 [pid 519] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 [pid 519] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 520] set_robust_list(0x7f6005c4e9e0, 24) = 0 [pid 520] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 504] fallocate(4, 0, 35143, 7 [pid 499] <... futex resumed>) = 0 [pid 498] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 499] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 498] <... futex resumed>) = 0 [pid 505] <... futex resumed>) = 0 [pid 499] <... futex resumed>) = 1 [pid 498] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 505] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 499] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 498] <... futex resumed>) = 0 [pid 505] <... open resumed>) = 5 [pid 498] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 505] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 520] <... mount resumed>) = 0 [pid 498] <... mmap resumed>) = 0x7f6005c2e000 [pid 505] <... futex resumed>) = 1 [pid 505] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 499] <... futex resumed>) = 0 [pid 498] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE [pid 504] <... fallocate resumed>) = 0 [pid 499] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 498] <... mprotect resumed>) = 0 [pid 505] <... futex resumed>) = 0 [pid 504] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 499] <... futex resumed>) = 1 [pid 498] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 518] <... ioctl resumed>) = 0 [pid 505] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 520] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 505] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 504] <... futex resumed>) = 0 [pid 499] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 505] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 499] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 498] <... clone resumed>, parent_tid=[522], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 522 [pid 505] <... futex resumed>) = 0 [pid 504] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 499] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 505] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 499] <... futex resumed>) = 0 [pid 498] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 520] <... futex resumed>) = 1 [pid 520] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 519] <... write resumed>) = 262144 [pid 519] munmap(0x7f6005c0f000, 262144) = 0 [pid 519] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [ 22.033870][ T506] ext4 filesystem being mounted at /root/syzkaller.2mSqAy/6/file1 supports timestamps until 2038 (0x7fffffff) [ 22.046254][ T504] ext4 filesystem being mounted at /root/syzkaller.kumyKI/6/file1 supports timestamps until 2038 (0x7fffffff) [ 22.088860][ T518] loop1: detected capacity change from 0 to 512 [pid 519] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 522 attached [pid 518] close(3 [pid 505] <... write resumed>) = 262144 [pid 500] <... futex resumed>) = 0 [pid 499] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 498] <... futex resumed>) = 0 [pid 500] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 522] set_robust_list(0x7f6005c4e9e0, 24 [pid 518] <... close resumed>) = 0 [pid 505] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 498] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 519] <... ioctl resumed>) = 0 [pid 519] close(3) = 0 [pid 519] mkdir("./file1", 0777 [pid 500] <... futex resumed>) = 1 [pid 506] <... futex resumed>) = 0 [pid 518] mkdir("./file1", 0777 [pid 505] <... futex resumed>) = 1 [pid 500] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 506] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 499] <... futex resumed>) = 0 [pid 499] exit_group(0 [pid 506] <... open resumed>) = 5 [pid 499] <... exit_group resumed>) = ? [pid 521] <... futex resumed>) = ? [pid 506] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 521] +++ exited with 0 +++ [pid 506] <... futex resumed>) = 1 [pid 500] <... futex resumed>) = 0 [pid 505] +++ exited with 0 +++ [pid 499] +++ exited with 0 +++ [pid 293] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=499, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 500] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 506] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 500] <... futex resumed>) = 0 [pid 506] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 500] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 506] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 500] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 293] restart_syscall(<... resuming interrupted clone ...> [pid 506] <... futex resumed>) = 0 [pid 500] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 519] <... mkdir resumed>) = 0 [pid 506] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 500] <... futex resumed>) = 0 [pid 519] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 293] <... restart_syscall resumed>) = 0 [pid 293] umount2("./7", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 293] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 293] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 293] getdents64(3, 0x555557288620 /* 4 entries */, 32768) = 112 [pid 293] umount2("./7/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 293] lstat("./7/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 293] unlink("./7/binderfs") = 0 [pid 293] umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 522] <... set_robust_list resumed>) = 0 [pid 500] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 522] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL) = 0 [pid 522] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 498] <... futex resumed>) = 0 [pid 498] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 498] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 522] <... futex resumed>) = 1 [pid 522] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 504] <... futex resumed>) = 0 [pid 504] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 518] <... mkdir resumed>) = 0 [pid 506] <... write resumed>) = 262144 [pid 504] <... open resumed>) = 5 [pid 518] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 506] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 504] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 498] <... futex resumed>) = 0 [pid 498] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 498] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 506] <... futex resumed>) = 1 [pid 295] <... umount2 resumed>) = 0 [pid 500] <... futex resumed>) = 0 [pid 504] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 506] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 504] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 500] exit_group(0 [pid 504] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 520] <... futex resumed>) = ? [pid 506] <... futex resumed>) = ? [pid 504] <... futex resumed>) = 1 [pid 500] <... exit_group resumed>) = ? [pid 498] <... futex resumed>) = 0 [pid 520] +++ exited with 0 +++ [pid 506] +++ exited with 0 +++ [pid 504] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 504] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 500] +++ exited with 0 +++ [pid 498] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] lstat("./5/file1", [pid 504] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 498] <... futex resumed>) = 0 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=500, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 295] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] umount2("./6", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 498] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... openat resumed>) = 3 [pid 296] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] getdents64(3, 0x555557288620 /* 4 entries */, 32768) = 112 [pid 296] umount2("./6/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] lstat("./6/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 296] unlink("./6/binderfs") = 0 [pid 296] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./5/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 504] <... write resumed>) = 262144 [pid 295] fstat(4, [pid 504] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 504] <... futex resumed>) = 1 [pid 498] <... futex resumed>) = 0 [pid 295] getdents64(4, [pid 504] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 498] exit_group(0 [pid 295] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 522] <... futex resumed>) = ? [pid 504] <... futex resumed>) = ? [pid 498] <... exit_group resumed>) = ? [pid 295] getdents64(4, 0x555557290660 /* 0 entries */, 32768) = 0 [pid 504] +++ exited with 0 +++ [pid 295] close(4) = 0 [pid 295] rmdir("./5/file1") = 0 [pid 522] +++ exited with 0 +++ [pid 498] +++ exited with 0 +++ [pid 295] getdents64(3, 0x555557288620 /* 0 entries */, 32768) = 0 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=498, si_uid=0, si_status=0, si_utime=0, si_stime=7} --- [pid 295] close(3 [pid 298] umount2("./6", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... close resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] rmdir("./5" [pid 298] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] <... rmdir resumed>) = 0 [pid 298] <... openat resumed>) = 3 [pid 295] mkdir("./6", 0777 [pid 298] fstat(3, [pid 295] <... mkdir resumed>) = 0 [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 298] getdents64(3, [pid 295] <... openat resumed>) = 3 [pid 298] <... getdents64 resumed>0x555557288620 /* 4 entries */, 32768) = 112 [pid 295] ioctl(3, LOOP_CLR_FD [pid 298] umount2("./6/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] close(3 [pid 298] lstat("./6/binderfs", [pid 295] <... close resumed>) = 0 [pid 298] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] unlink("./6/binderfs"./strace-static-x86_64: Process 525 attached ) = 0 [pid 295] <... clone resumed>, child_tidptr=0x5555572875d0) = 525 [pid 298] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 525] set_robust_list(0x5555572875e0, 24) = 0 [pid 525] chdir("./6") = 0 [pid 525] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 525] setpgid(0, 0) = 0 [pid 525] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 525] write(3, "1000", 4) = 4 [pid 525] close(3) = 0 [pid 525] symlink("/dev/binderfs", "./binderfs") = 0 [pid 525] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 525] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 525] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 525] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[527], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 527 [pid 525] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 525] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 527 attached [pid 527] set_robust_list(0x7f600e02f9e0, 24) = 0 [pid 527] memfd_create("syzkaller", 0) = 3 [pid 527] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 [ 22.100965][ T519] loop4: detected capacity change from 0 to 512 [pid 527] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 527] munmap(0x7f6005c0f000, 262144) = 0 [pid 527] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 4 [pid 527] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 527] close(3) = 0 [pid 527] mkdir("./file1", 0777) = 0 [pid 527] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 293] <... umount2 resumed>) = 0 [pid 293] umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 293] lstat("./7/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 293] umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 293] openat(AT_FDCWD, "./7/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 293] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 293] getdents64(4, 0x555557290660 /* 2 entries */, 32768) = 48 [pid 293] getdents64(4, 0x555557290660 /* 0 entries */, 32768) = 0 [pid 293] close(4) = 0 [pid 293] rmdir("./7/file1") = 0 [pid 293] getdents64(3, 0x555557288620 /* 0 entries */, 32768) = 0 [pid 293] close(3) = 0 [pid 293] rmdir("./7") = 0 [pid 293] mkdir("./8", 0777) = 0 [pid 293] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 293] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 293] close(3) = 0 [pid 293] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555572875d0) = 529 [ 22.137291][ T518] EXT4-fs (loop1): 1 orphan inode deleted [ 22.139558][ T527] loop2: detected capacity change from 0 to 512 [ 22.143309][ T519] EXT4-fs (loop4): 1 orphan inode deleted [ 22.162020][ T518] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 22.165885][ T519] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. ./strace-static-x86_64: Process 529 attached [pid 298] <... umount2 resumed>) = 0 [pid 296] <... umount2 resumed>) = 0 [pid 529] set_robust_list(0x5555572875e0, 24 [pid 296] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 529] <... set_robust_list resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 529] chdir("./8" [pid 296] lstat("./6/file1", [pid 529] <... chdir resumed>) = 0 [pid 296] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 529] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 296] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 529] <... prctl resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 529] setpgid(0, 0 [pid 296] openat(AT_FDCWD, "./6/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 529] <... setpgid resumed>) = 0 [pid 296] <... openat resumed>) = 4 [pid 529] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 296] fstat(4, [pid 529] <... openat resumed>) = 3 [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 529] write(3, "1000", 4 [pid 296] getdents64(4, [pid 529] <... write resumed>) = 4 [pid 296] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 529] close(3 [pid 296] getdents64(4, [pid 529] <... close resumed>) = 0 [pid 296] <... getdents64 resumed>0x555557290660 /* 0 entries */, 32768) = 0 [pid 529] symlink("/dev/binderfs", "./binderfs" [pid 518] <... mount resumed>) = 0 [pid 298] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] close(4 [pid 529] <... symlink resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 529] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] rmdir("./6/file1" [pid 529] <... futex resumed>) = 0 [pid 296] <... rmdir resumed>) = 0 [pid 529] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 296] getdents64(3, [pid 529] <... mmap resumed>) = 0x7f600e00f000 [pid 296] <... getdents64 resumed>0x555557288620 /* 0 entries */, 32768) = 0 [pid 529] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE [pid 296] close(3 [pid 529] <... mprotect resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 529] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 296] rmdir("./6") = 0 [pid 529] <... clone resumed>, parent_tid=[532], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 532 [pid 296] mkdir("./7", 0777 [pid 529] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... mkdir resumed>) = 0 [pid 529] <... futex resumed>) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 529] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 296] <... openat resumed>) = 3 [pid 296] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 296] close(3) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555572875d0) = 533 ./strace-static-x86_64: Process 533 attached ./strace-static-x86_64: Process 532 attached [pid 519] <... mount resumed>) = 0 [pid 518] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 532] set_robust_list(0x7f600e02f9e0, 24 [pid 519] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 518] <... openat resumed>) = 3 [pid 298] lstat("./6/file1", [pid 532] <... set_robust_list resumed>) = 0 [pid 519] <... openat resumed>) = 3 [pid 518] chdir("./file1" [pid 298] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 532] memfd_create("syzkaller", 0 [pid 519] chdir("./file1" [pid 518] <... chdir resumed>) = 0 [pid 298] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 533] set_robust_list(0x5555572875e0, 24 [pid 532] <... memfd_create resumed>) = 3 [pid 519] <... chdir resumed>) = 0 [pid 518] ioctl(4, LOOP_CLR_FD [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 533] <... set_robust_list resumed>) = 0 [pid 532] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 519] ioctl(4, LOOP_CLR_FD [pid 518] <... ioctl resumed>) = 0 [pid 298] openat(AT_FDCWD, "./6/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 532] <... mmap resumed>) = 0x7f6005c0f000 [pid 519] <... ioctl resumed>) = 0 [pid 518] close(4 [pid 298] <... openat resumed>) = 4 [pid 533] chdir("./7" [pid 532] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 519] close(4 [pid 518] <... close resumed>) = 0 [pid 298] fstat(4, [pid 533] <... chdir resumed>) = 0 [pid 532] <... write resumed>) = 262144 [pid 519] <... close resumed>) = 0 [pid 518] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 532] munmap(0x7f6005c0f000, 262144 [pid 519] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 518] <... futex resumed>) = 1 [pid 513] <... futex resumed>) = 0 [pid 298] getdents64(4, [pid 532] <... munmap resumed>) = 0 [pid 519] <... futex resumed>) = 1 [pid 518] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 516] <... futex resumed>) = 0 [pid 513] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 532] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 519] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 518] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 516] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 513] <... futex resumed>) = 0 [pid 298] getdents64(4, [pid 532] <... openat resumed>) = 4 [pid 519] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 518] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 516] <... futex resumed>) = 0 [pid 513] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... getdents64 resumed>0x555557290660 /* 0 entries */, 32768) = 0 [ 22.173825][ T518] ext4 filesystem being mounted at /root/syzkaller.6GNILo/7/file1 supports timestamps until 2038 (0x7fffffff) [ 22.195975][ T519] ext4 filesystem being mounted at /root/syzkaller.IrUvXE/7/file1 supports timestamps until 2038 (0x7fffffff) [ 22.209338][ T527] EXT4-fs (loop2): 1 orphan inode deleted [ 22.222813][ T527] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [pid 532] ioctl(4, LOOP_SET_FD, 3 [pid 519] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 516] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] close(4 [pid 533] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 519] <... open resumed>) = 4 [pid 518] <... open resumed>) = 4 [pid 298] <... close resumed>) = 0 [pid 533] <... prctl resumed>) = 0 [pid 519] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 518] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] rmdir("./6/file1" [pid 533] setpgid(0, 0 [pid 519] <... futex resumed>) = 1 [pid 518] <... futex resumed>) = 1 [pid 516] <... futex resumed>) = 0 [pid 513] <... futex resumed>) = 0 [pid 298] <... rmdir resumed>) = 0 [pid 533] <... setpgid resumed>) = 0 [pid 519] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 518] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 516] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 513] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] getdents64(3, [pid 533] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 519] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 518] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 516] <... futex resumed>) = 0 [pid 513] <... futex resumed>) = 0 [pid 298] <... getdents64 resumed>0x555557288620 /* 0 entries */, 32768) = 0 [pid 533] <... openat resumed>) = 3 [pid 516] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 519] fallocate(4, 0, 35143, 7 [pid 513] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 518] fallocate(4, 0, 35143, 7 [pid 298] close(3 [pid 533] write(3, "1000", 4 [pid 516] <... futex resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 519] <... fallocate resumed>) = 0 [pid 513] <... futex resumed>) = 0 [pid 298] rmdir("./6" [pid 533] <... write resumed>) = 4 [pid 519] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 518] <... fallocate resumed>) = 0 [pid 516] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 513] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] <... rmdir resumed>) = 0 [pid 533] close(3 [pid 519] <... futex resumed>) = 0 [pid 518] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 516] <... mmap resumed>) = 0x7f6005c2e000 [pid 513] <... mmap resumed>) = 0x7f6005c2e000 [pid 298] mkdir("./7", 0777 [pid 533] <... close resumed>) = 0 [pid 519] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 518] <... futex resumed>) = 0 [pid 516] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE [pid 513] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE [pid 298] <... mkdir resumed>) = 0 [pid 516] <... mprotect resumed>) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 513] <... mprotect resumed>) = 0 [pid 533] symlink("/dev/binderfs", "./binderfs" [pid 518] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 516] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 513] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 298] <... openat resumed>) = 3 [pid 298] ioctl(3, LOOP_CLR_FD [pid 533] <... symlink resumed>) = 0 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] close(3) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 533] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 513] <... clone resumed>, parent_tid=[534], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 534 [pid 533] <... futex resumed>) = 0 [pid 516] <... clone resumed>, parent_tid=[535], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 535 [pid 298] <... clone resumed>, child_tidptr=0x5555572875d0) = 536 [pid 533] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 516] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 513] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 533] <... mmap resumed>) = 0x7f600e00f000 [pid 516] <... futex resumed>) = 0 [pid 513] <... futex resumed>) = 0 [pid 533] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE [pid 516] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 513] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 533] <... mprotect resumed>) = 0 [pid 533] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID./strace-static-x86_64: Process 536 attached ./strace-static-x86_64: Process 535 attached ./strace-static-x86_64: Process 534 attached [pid 532] <... ioctl resumed>) = 0 [pid 536] set_robust_list(0x5555572875e0, 24 [pid 535] set_robust_list(0x7f6005c4e9e0, 24 [pid 534] set_robust_list(0x7f6005c4e9e0, 24 [pid 533] <... clone resumed>, parent_tid=[537], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 537 [pid 532] close(3./strace-static-x86_64: Process 537 attached [pid 533] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 533] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 537] set_robust_list(0x7f600e02f9e0, 24) = 0 [pid 537] memfd_create("syzkaller", 0) = 3 [pid 537] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 [pid 534] <... set_robust_list resumed>) = 0 [pid 536] <... set_robust_list resumed>) = 0 [pid 535] <... set_robust_list resumed>) = 0 [pid 534] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 532] <... close resumed>) = 0 [pid 535] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 534] <... mount resumed>) = 0 [pid 535] <... mount resumed>) = 0 [pid 534] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 535] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 534] <... futex resumed>) = 1 [pid 513] <... futex resumed>) = 0 [pid 535] <... futex resumed>) = 1 [pid 516] <... futex resumed>) = 0 [pid 535] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 534] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 516] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 513] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 516] <... futex resumed>) = 1 [pid 519] <... futex resumed>) = 0 [pid 513] <... futex resumed>) = 1 [pid 518] <... futex resumed>) = 0 [pid 519] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 518] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 516] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 513] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 519] <... open resumed>) = 5 [pid 518] <... open resumed>) = 5 [pid 519] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 518] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 519] <... futex resumed>) = 1 [pid 516] <... futex resumed>) = 0 [pid 516] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 519] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 518] <... futex resumed>) = 1 [pid 516] <... futex resumed>) = 0 [pid 513] <... futex resumed>) = 0 [pid 519] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 518] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 516] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 513] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 519] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 518] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 516] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 513] <... futex resumed>) = 0 [pid 519] <... futex resumed>) = 0 [pid 518] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 513] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 519] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 516] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 518] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 516] <... futex resumed>) = 0 [pid 537] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 537] munmap(0x7f6005c0f000, 262144) = 0 [pid 537] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 537] ioctl(4, LOOP_SET_FD, 3 [pid 536] chdir("./7" [pid 532] mkdir("./file1", 0777 [pid 527] <... mount resumed>) = 0 [pid 519] <... write resumed>) = 262144 [pid 518] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 516] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 537] <... ioctl resumed>) = 0 [pid 537] close(3 [pid 536] <... chdir resumed>) = 0 [pid 537] <... close resumed>) = 0 [pid 537] mkdir("./file1", 0777) = 0 [pid 532] <... mkdir resumed>) = 0 [pid 519] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 518] <... futex resumed>) = 1 [pid 516] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 519] <... futex resumed>) = 0 [pid 518] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 516] exit_group(0 [pid 513] <... futex resumed>) = 0 [pid 536] prctl(PR_SET_PDEATHSIG, SIGKILL [ 22.225867][ T532] loop0: detected capacity change from 0 to 512 [ 22.245732][ T527] ext4 filesystem being mounted at /root/syzkaller.qF1bbv/6/file1 supports timestamps until 2038 (0x7fffffff) [ 22.266979][ T537] loop3: detected capacity change from 0 to 512 [pid 537] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 513] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 518] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 516] <... exit_group resumed>) = ? [pid 535] <... futex resumed>) = ? [pid 513] <... futex resumed>) = 0 [pid 518] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 535] +++ exited with 0 +++ [pid 513] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 527] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 527] chdir("./file1") = 0 [pid 527] ioctl(4, LOOP_CLR_FD) = 0 [pid 527] close(4) = 0 [pid 519] +++ exited with 0 +++ [pid 516] +++ exited with 0 +++ [pid 527] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 525] <... futex resumed>) = 0 [pid 525] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 525] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 527] <... futex resumed>) = 1 [pid 527] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 527] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 525] <... futex resumed>) = 0 [pid 525] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 525] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 525] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6005c2e000 [pid 525] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 525] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[539], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 539 [pid 525] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 525] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 527] <... futex resumed>) = 1 [pid 527] fallocate(4, 0, 35143, 7) = 0 [pid 527] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 527] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 532] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 536] <... prctl resumed>) = 0 [pid 536] setpgid(0, 0) = 0 [pid 536] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 536] write(3, "1000", 4) = 4 [pid 536] close(3) = 0 [pid 536] symlink("/dev/binderfs", "./binderfs") = 0 [pid 536] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 536] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 536] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 536] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[540], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 540 [pid 536] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 536] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 540 attached [pid 540] set_robust_list(0x7f600e02f9e0, 24) = 0 [pid 540] memfd_create("syzkaller", 0) = 3 [pid 540] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 [pid 540] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 540] munmap(0x7f6005c0f000, 262144) = 0 [pid 540] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 4 [pid 540] ioctl(4, LOOP_SET_FD, 3 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=516, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 540] <... ioctl resumed>) = 0 [pid 540] close(3) = 0 [pid 297] umount2("./7", MNT_DETACH|UMOUNT_NOFOLLOW [pid 540] mkdir("./file1", 0777) = 0 [pid 540] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 297] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] getdents64(3, 0x555557288620 /* 4 entries */, 32768) = 112 [pid 297] umount2("./7/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 539 attached [pid 539] set_robust_list(0x7f6005c4e9e0, 24) = 0 [pid 539] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL) = 0 [pid 539] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 525] <... futex resumed>) = 0 [pid 525] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 527] <... futex resumed>) = 0 [pid 525] <... futex resumed>) = 1 [pid 527] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 525] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 527] <... open resumed>) = 5 [pid 527] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 525] <... futex resumed>) = 0 [pid 527] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 525] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 527] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 525] <... futex resumed>) = 0 [pid 527] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 525] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 527] <... futex resumed>) = 0 [pid 525] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 527] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 525] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 518] <... write resumed>) = 262144 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 525] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 539] <... futex resumed>) = 1 [pid 297] lstat("./7/binderfs", [pid 539] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 297] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 297] unlink("./7/binderfs") = 0 [pid 518] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 527] <... write resumed>) = 262144 [pid 518] <... futex resumed>) = 1 [pid 513] <... futex resumed>) = 0 [pid 513] exit_group(0) = ? [pid 534] <... futex resumed>) = 231 [pid 534] +++ exited with 0 +++ [pid 527] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 525] <... futex resumed>) = 0 [pid 525] exit_group(0) = ? [pid 527] <... futex resumed>) = ? [pid 527] +++ exited with 0 +++ [pid 539] <... futex resumed>) = ? [pid 539] +++ exited with 0 +++ [pid 525] +++ exited with 0 +++ [pid 518] +++ exited with 0 +++ [pid 513] +++ exited with 0 +++ [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=525, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 295] umount2("./6", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 295] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] getdents64(3, 0x555557288620 /* 4 entries */, 32768) = 112 [pid 295] umount2("./6/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] lstat("./6/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 295] unlink("./6/binderfs") = 0 [pid 295] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=513, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 294] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 294] umount2("./7", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 294] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 294] getdents64(3, 0x555557288620 /* 4 entries */, 32768) = 112 [pid 294] umount2("./7/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] lstat("./7/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 294] unlink("./7/binderfs") = 0 [pid 294] umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 537] <... mount resumed>) = 0 [pid 537] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 537] chdir("./file1") = 0 [pid 537] ioctl(4, LOOP_CLR_FD) = 0 [pid 537] close(4) = 0 [pid 537] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 533] <... futex resumed>) = 0 [ 22.284147][ T540] loop5: detected capacity change from 0 to 512 [ 22.300823][ T537] EXT4-fs (loop3): 1 orphan inode deleted [ 22.307492][ T537] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 22.319647][ T537] ext4 filesystem being mounted at /root/syzkaller.2mSqAy/7/file1 supports timestamps until 2038 (0x7fffffff) [ 22.322468][ T540] EXT4-fs (loop5): 1 orphan inode deleted [pid 537] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 533] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 537] <... futex resumed>) = 0 [pid 533] <... futex resumed>) = 1 [pid 537] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 533] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 540] <... mount resumed>) = 0 [pid 540] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 540] chdir("./file1") = 0 [pid 540] ioctl(4, LOOP_CLR_FD) = 0 [pid 540] close(4) = 0 [pid 540] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 536] <... futex resumed>) = 0 [pid 536] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 536] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 540] <... futex resumed>) = 1 [pid 540] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 540] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 536] <... futex resumed>) = 0 [pid 536] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 536] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 536] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6005c2e000 [pid 536] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 536] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[547], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 547 [pid 536] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 536] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 540] <... futex resumed>) = 1 [pid 540] fallocate(4, 0, 35143, 7) = 0 [pid 537] <... open resumed>) = 4 [pid 540] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 540] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 537] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... umount2 resumed>) = 0 [pid 537] <... futex resumed>) = 1 [pid 533] <... futex resumed>) = 0 [pid 533] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 533] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 533] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6005c2e000 [pid 533] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE [pid 537] fallocate(4, 0, 35143, 7 [pid 533] <... mprotect resumed>) = 0 [pid 537] <... fallocate resumed>) = 0 [pid 533] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[548], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 548 [pid 537] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 533] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 537] <... futex resumed>) = 0 [pid 533] <... futex resumed>) = 0 [pid 537] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 533] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] lstat("./7/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./7/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 297] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] getdents64(4, 0x555557290660 /* 2 entries */, 32768) = 48 [pid 297] getdents64(4, 0x555557290660 /* 0 entries */, 32768) = 0 [pid 297] close(4) = 0 [pid 297] rmdir("./7/file1") = 0 [pid 297] getdents64(3, 0x555557288620 /* 0 entries */, 32768) = 0 [pid 297] close(3) = 0 [pid 297] rmdir("./7") = 0 [pid 297] mkdir("./8", 0777) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 3 [pid 297] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 297] close(3) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555572875d0) = 549 [ 22.338486][ T540] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 22.350197][ T540] ext4 filesystem being mounted at /root/syzkaller.kumyKI/7/file1 supports timestamps until 2038 (0x7fffffff) [ 22.353033][ T532] EXT4-fs (loop0): 1 orphan inode deleted [ 22.368996][ T532] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. ./strace-static-x86_64: Process 548 attached [pid 548] set_robust_list(0x7f6005c4e9e0, 24) = 0 [pid 548] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL) = 0 [pid 548] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 533] <... futex resumed>) = 0 [pid 533] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 537] <... futex resumed>) = 0 [pid 533] <... futex resumed>) = 1 [pid 537] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 533] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 537] <... open resumed>) = 5 [pid 537] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 533] <... futex resumed>) = 0 [pid 537] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 533] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 537] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 533] <... futex resumed>) = 0 [pid 537] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 533] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 537] <... futex resumed>) = 0 [pid 533] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 537] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 533] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 533] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 537] <... write resumed>) = 262144 [pid 537] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 533] <... futex resumed>) = 0 [pid 533] exit_group(0) = ? [pid 537] +++ exited with 0 +++ [pid 548] <... futex resumed>) = ? ./strace-static-x86_64: Process 549 attached [pid 549] set_robust_list(0x5555572875e0, 24) = 0 [pid 549] chdir("./8") = 0 [pid 549] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 549] setpgid(0, 0) = 0 [pid 549] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 ./strace-static-x86_64: Process 547 attached [pid 549] write(3, "1000", 4 [pid 548] +++ exited with 0 +++ [pid 533] +++ exited with 0 +++ [pid 532] <... mount resumed>) = 0 [pid 549] <... write resumed>) = 4 [pid 547] set_robust_list(0x7f6005c4e9e0, 24 [pid 532] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=533, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 549] close(3 [pid 547] <... set_robust_list resumed>) = 0 [pid 532] <... openat resumed>) = 3 [pid 532] chdir("./file1") = 0 [pid 532] ioctl(4, LOOP_CLR_FD) = 0 [pid 532] close(4 [pid 296] umount2("./7", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 296] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] getdents64(3, 0x555557288620 /* 4 entries */, 32768) = 112 [pid 296] umount2("./7/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] lstat("./7/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 296] unlink("./7/binderfs") = 0 [pid 296] umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... umount2 resumed>) = 0 [pid 532] <... close resumed>) = 0 [pid 532] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 532] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 295] <... umount2 resumed>) = 0 [pid 529] <... futex resumed>) = 0 [pid 547] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 529] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 294] umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 529] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 547] <... mount resumed>) = 0 [pid 294] lstat("./7/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 294] umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] openat(AT_FDCWD, "./7/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 549] <... close resumed>) = 0 [pid 549] symlink("/dev/binderfs", "./binderfs" [pid 532] <... futex resumed>) = 0 [pid 295] lstat("./6/file1", [pid 294] fstat(4, [pid 295] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 294] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] getdents64(4, [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 295] openat(AT_FDCWD, "./6/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] getdents64(4, [pid 295] <... openat resumed>) = 4 [pid 294] <... getdents64 resumed>0x555557290660 /* 0 entries */, 32768) = 0 [pid 295] fstat(4, [pid 294] close(4 [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 294] <... close resumed>) = 0 [pid 295] getdents64(4, [pid 294] rmdir("./7/file1" [pid 295] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 294] <... rmdir resumed>) = 0 [pid 295] getdents64(4, [pid 294] getdents64(3, [pid 295] <... getdents64 resumed>0x555557290660 /* 0 entries */, 32768) = 0 [pid 294] <... getdents64 resumed>0x555557288620 /* 0 entries */, 32768) = 0 [pid 295] close(4 [pid 294] close(3 [pid 295] <... close resumed>) = 0 [pid 294] <... close resumed>) = 0 [pid 295] rmdir("./6/file1" [pid 294] rmdir("./7" [pid 295] <... rmdir resumed>) = 0 [pid 294] <... rmdir resumed>) = 0 [pid 295] getdents64(3, [pid 294] mkdir("./8", 0777 [pid 549] <... symlink resumed>) = 0 [pid 547] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 532] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 295] <... getdents64 resumed>0x555557288620 /* 0 entries */, 32768) = 0 [pid 294] <... mkdir resumed>) = 0 [pid 549] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 547] <... futex resumed>) = 1 [pid 536] <... futex resumed>) = 0 [pid 532] <... open resumed>) = 4 [pid 549] <... futex resumed>) = 0 [pid 547] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 536] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 532] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 549] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 540] <... futex resumed>) = 0 [pid 536] <... futex resumed>) = 1 [pid 532] <... futex resumed>) = 1 [pid 529] <... futex resumed>) = 0 [pid 295] close(3 [pid 294] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 549] <... mmap resumed>) = 0x7f600e00f000 [pid 540] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 536] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 532] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 529] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 549] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE [pid 540] <... open resumed>) = 5 [pid 295] <... close resumed>) = 0 [pid 294] <... openat resumed>) = 3 [pid 529] <... futex resumed>) = 0 [pid 549] <... mprotect resumed>) = 0 [pid 540] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 532] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 549] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 540] <... futex resumed>) = 1 [pid 536] <... futex resumed>) = 0 [pid 529] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] rmdir("./6" [pid 294] ioctl(3, LOOP_CLR_FD [pid 540] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 536] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 532] fallocate(4, 0, 35143, 7 [pid 529] <... futex resumed>) = 0 [pid 549] <... clone resumed>, parent_tid=[550], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 550 [pid 540] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 536] <... futex resumed>) = 0 [pid 532] <... fallocate resumed>) = 0 [pid 529] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 549] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 540] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 536] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 532] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 529] <... mmap resumed>) = 0x7f6005c2e000 [pid 295] <... rmdir resumed>) = 0 [pid 294] close(3 [pid 549] <... futex resumed>) = 0 [pid 540] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 532] <... futex resumed>) = 0 [pid 529] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE [pid 295] mkdir("./7", 0777 [pid 294] <... close resumed>) = 0 [pid 549] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 540] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 532] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 540] <... futex resumed>) = 1 [pid 536] <... futex resumed>) = 0 [pid 529] <... mprotect resumed>) = 0 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 540] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 536] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 529] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 295] <... mkdir resumed>) = 0 [pid 540] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 536] <... futex resumed>) = 0 [pid 540] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 536] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] openat(AT_FDCWD, "/dev/loop2", O_RDWR./strace-static-x86_64: Process 552 attached ./strace-static-x86_64: Process 551 attached ./strace-static-x86_64: Process 550 attached [pid 529] <... clone resumed>, parent_tid=[552], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 552 [pid 529] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] <... clone resumed>, child_tidptr=0x5555572875d0) = 551 [pid 529] <... futex resumed>) = 0 [pid 295] <... openat resumed>) = 3 [pid 529] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] ioctl(3, LOOP_CLR_FD [pid 540] <... write resumed>) = 262144 [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 540] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] close(3 [pid 540] <... futex resumed>) = 1 [pid 536] <... futex resumed>) = 0 [pid 540] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 295] <... close resumed>) = 0 [pid 536] exit_group(0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 536] <... exit_group resumed>) = ? [pid 552] set_robust_list(0x7f6005c4e9e0, 24) = 0 [pid 552] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0 [pid 547] <... futex resumed>) = ? [pid 540] <... futex resumed>) = ? [pid 552] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 540] +++ exited with 0 +++ [pid 552] <... futex resumed>) = 1 [pid 529] <... futex resumed>) = 0 [pid 295] <... clone resumed>, child_tidptr=0x5555572875d0) = 553 [pid 552] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 529] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 532] <... futex resumed>) = 0 [pid 529] <... futex resumed>) = 1 [pid 532] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 529] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 547] +++ exited with 0 +++ [pid 536] +++ exited with 0 +++ [pid 532] <... open resumed>) = 5 [pid 532] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=536, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 532] <... futex resumed>) = 1 [pid 529] <... futex resumed>) = 0 [pid 298] restart_syscall(<... resuming interrupted clone ...> [pid 532] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 529] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... restart_syscall resumed>) = 0 [pid 532] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 529] <... futex resumed>) = 0 [pid 532] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 529] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 532] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 298] umount2("./7", MNT_DETACH|UMOUNT_NOFOLLOW [pid 551] set_robust_list(0x5555572875e0, 24 [pid 532] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 551] <... set_robust_list resumed>) = 0 [pid 532] <... futex resumed>) = 1 [pid 529] <... futex resumed>) = 0 [pid 298] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 551] chdir("./8" [pid 532] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 529] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... openat resumed>) = 3 [pid 551] <... chdir resumed>) = 0 [pid 532] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 529] <... futex resumed>) = 0 [pid 298] fstat(3, [pid 551] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 532] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 529] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] getdents64(3, 0x555557288620 /* 4 entries */, 32768) = 112 [pid 298] umount2("./7/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 551] <... prctl resumed>) = 0 [pid 532] <... write resumed>) = 262144 [pid 298] lstat("./7/binderfs", [pid 551] setpgid(0, 0 [pid 532] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 550] set_robust_list(0x7f600e02f9e0, 24 [pid 551] <... setpgid resumed>) = 0 [pid 532] <... futex resumed>) = 1 [pid 529] <... futex resumed>) = 0 [pid 298] unlink("./7/binderfs" [pid 551] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 550] <... set_robust_list resumed>) = 0 [pid 532] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 529] exit_group(0 [pid 298] <... unlink resumed>) = 0 [pid 552] <... futex resumed>) = ? [pid 551] <... openat resumed>) = 3 [pid 532] <... futex resumed>) = ? [pid 529] <... exit_group resumed>) = ? [pid 298] umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 552] +++ exited with 0 +++ ./strace-static-x86_64: Process 553 attached [pid 553] set_robust_list(0x5555572875e0, 24) = 0 [ 22.381277][ T532] ext4 filesystem being mounted at /root/syzkaller.SN8fLk/8/file1 supports timestamps until 2038 (0x7fffffff) [pid 553] chdir("./7") = 0 [pid 553] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 553] setpgid(0, 0) = 0 [pid 553] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 532] +++ exited with 0 +++ [pid 529] +++ exited with 0 +++ [pid 553] write(3, "1000", 4 [pid 551] write(3, "1000", 4 [pid 293] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=529, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 551] <... write resumed>) = 4 [pid 293] restart_syscall(<... resuming interrupted clone ...> [pid 551] close(3) = 0 [pid 551] symlink("/dev/binderfs", "./binderfs" [pid 553] <... write resumed>) = 4 [pid 551] <... symlink resumed>) = 0 [pid 551] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 551] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 553] close(3 [pid 550] memfd_create("syzkaller", 0 [pid 293] <... restart_syscall resumed>) = 0 [pid 553] <... close resumed>) = 0 [pid 551] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE [pid 550] <... memfd_create resumed>) = 3 [pid 553] symlink("/dev/binderfs", "./binderfs" [pid 551] <... mprotect resumed>) = 0 [pid 550] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 553] <... symlink resumed>) = 0 [pid 551] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 550] <... mmap resumed>) = 0x7f6005c0f000 [pid 293] umount2("./8", MNT_DETACH|UMOUNT_NOFOLLOW [pid 553] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 550] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 293] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 551] <... clone resumed>, parent_tid=[554], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 554 [pid 293] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 551] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 293] <... openat resumed>) = 3 [pid 551] <... futex resumed>) = 0 [pid 293] fstat(3, [pid 551] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 293] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 293] getdents64(3, [pid 553] <... futex resumed>) = 0 [pid 293] <... getdents64 resumed>0x555557288620 /* 4 entries */, 32768) = 112 [pid 293] umount2("./8/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 293] lstat("./8/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 553] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 293] unlink("./8/binderfs" [pid 553] <... mmap resumed>) = 0x7f600e00f000 [pid 293] <... unlink resumed>) = 0 ./strace-static-x86_64: Process 554 attached [pid 553] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE [pid 550] <... write resumed>) = 262144 [pid 554] set_robust_list(0x7f600e02f9e0, 24 [pid 553] <... mprotect resumed>) = 0 [pid 554] <... set_robust_list resumed>) = 0 [pid 553] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 550] munmap(0x7f6005c0f000, 262144 [pid 554] memfd_create("syzkaller", 0 [pid 293] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 555 attached [pid 554] <... memfd_create resumed>) = 3 [pid 553] <... clone resumed>, parent_tid=[555], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 555 [pid 550] <... munmap resumed>) = 0 [pid 554] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 553] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 554] <... mmap resumed>) = 0x7f6005c0f000 [pid 553] <... futex resumed>) = 0 [pid 550] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 555] set_robust_list(0x7f600e02f9e0, 24 [pid 554] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 553] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 554] <... write resumed>) = 262144 [pid 550] <... openat resumed>) = 4 [pid 550] ioctl(4, LOOP_SET_FD, 3 [pid 555] <... set_robust_list resumed>) = 0 [pid 296] <... umount2 resumed>) = 0 [pid 554] munmap(0x7f6005c0f000, 262144 [pid 550] <... ioctl resumed>) = 0 [pid 554] <... munmap resumed>) = 0 [pid 550] close(3 [pid 555] memfd_create("syzkaller", 0 [pid 296] umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 554] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 550] <... close resumed>) = 0 [pid 554] <... openat resumed>) = 4 [pid 550] mkdir("./file1", 0777 [pid 554] ioctl(4, LOOP_SET_FD, 3 [pid 550] <... mkdir resumed>) = 0 [pid 554] <... ioctl resumed>) = 0 [pid 550] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 298] <... umount2 resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 554] close(3) = 0 [pid 554] mkdir("./file1", 0777 [pid 298] umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] lstat("./7/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] lstat("./7/file1", [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] openat(AT_FDCWD, "./7/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 298] umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] fstat(4, [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] openat(AT_FDCWD, "./7/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] getdents64(4, 0x555557290660 /* 2 entries */, 32768) = 48 [pid 298] <... openat resumed>) = 4 [pid 296] getdents64(4, 0x555557290660 /* 0 entries */, 32768) = 0 [pid 298] fstat(4, [pid 296] close(4 [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] <... close resumed>) = 0 [pid 298] getdents64(4, [pid 296] rmdir("./7/file1" [pid 298] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 554] <... mkdir resumed>) = 0 [pid 554] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 298] getdents64(4, [pid 296] <... rmdir resumed>) = 0 [pid 298] <... getdents64 resumed>0x555557290660 /* 0 entries */, 32768) = 0 [pid 296] getdents64(3, [pid 298] close(4 [pid 296] <... getdents64 resumed>0x555557288620 /* 0 entries */, 32768) = 0 [pid 298] <... close resumed>) = 0 [pid 298] rmdir("./7/file1" [pid 296] close(3 [pid 298] <... rmdir resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 298] getdents64(3, 0x555557288620 /* 0 entries */, 32768) = 0 [pid 296] rmdir("./7" [pid 555] <... memfd_create resumed>) = 3 [pid 555] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 [pid 296] <... rmdir resumed>) = 0 [pid 298] close(3 [pid 296] mkdir("./8", 0777 [pid 298] <... close resumed>) = 0 [pid 296] <... mkdir resumed>) = 0 [pid 298] rmdir("./7" [pid 296] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 298] <... rmdir resumed>) = 0 [pid 298] mkdir("./8", 0777 [pid 296] <... openat resumed>) = 3 [pid 298] <... mkdir resumed>) = 0 [pid 296] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 298] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 296] close(3 [pid 298] <... openat resumed>) = 3 [pid 296] <... close resumed>) = 0 [pid 555] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 555] munmap(0x7f6005c0f000, 262144) = 0 [pid 555] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 4 [pid 555] ioctl(4, LOOP_SET_FD, 3 [pid 298] ioctl(3, LOOP_CLR_FD [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] close(3) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] <... clone resumed>, child_tidptr=0x5555572875d0) = 558 [pid 298] <... clone resumed>, child_tidptr=0x5555572875d0) = 559 ./strace-static-x86_64: Process 558 attached [pid 558] set_robust_list(0x5555572875e0, 24) = 0 [pid 293] <... umount2 resumed>) = 0 [pid 293] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 293] lstat("./8/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 293] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 293] openat(AT_FDCWD, "./8/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 293] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 293] getdents64(4, 0x555557290660 /* 2 entries */, 32768) = 48 [pid 293] getdents64(4, 0x555557290660 /* 0 entries */, 32768) = 0 [pid 293] close(4) = 0 [pid 293] rmdir("./8/file1") = 0 [pid 293] getdents64(3, 0x555557288620 /* 0 entries */, 32768) = 0 [pid 293] close(3) = 0 [pid 293] rmdir("./8") = 0 [pid 293] mkdir("./9", 0777) = 0 [pid 293] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 293] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 293] close(3) = 0 [pid 293] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555572875d0) = 560 [ 22.445530][ T550] loop4: detected capacity change from 0 to 512 [ 22.453421][ T554] loop1: detected capacity change from 0 to 512 [ 22.467594][ T555] loop2: detected capacity change from 0 to 512 [ 22.475074][ T550] EXT4-fs (loop4): 1 orphan inode deleted [pid 558] chdir("./8") = 0 [pid 558] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 558] setpgid(0, 0) = 0 [pid 558] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 558] write(3, "1000", 4) = 4 [pid 558] close(3) = 0 [pid 558] symlink("/dev/binderfs", "./binderfs"./strace-static-x86_64: Process 559 attached ./strace-static-x86_64: Process 560 attached [pid 555] <... ioctl resumed>) = 0 [pid 558] <... symlink resumed>) = 0 [pid 558] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 558] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 558] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 558] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[563], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 563 [pid 558] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 558] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 560] set_robust_list(0x5555572875e0, 24 [pid 559] set_robust_list(0x5555572875e0, 24 [pid 560] <... set_robust_list resumed>) = 0 [pid 559] <... set_robust_list resumed>) = 0 [pid 555] close(3 [pid 560] chdir("./9") = 0 [pid 560] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 560] setpgid(0, 0 [pid 559] chdir("./8" [pid 555] <... close resumed>) = 0 [pid 550] <... mount resumed>) = 0 [pid 560] <... setpgid resumed>) = 0 [pid 560] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 560] write(3, "1000", 4) = 4 ./strace-static-x86_64: Process 563 attached [pid 560] close(3 [pid 563] set_robust_list(0x7f600e02f9e0, 24 [pid 560] <... close resumed>) = 0 [pid 563] <... set_robust_list resumed>) = 0 [pid 560] symlink("/dev/binderfs", "./binderfs" [pid 563] memfd_create("syzkaller", 0 [pid 560] <... symlink resumed>) = 0 [pid 563] <... memfd_create resumed>) = 3 [pid 560] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 563] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 560] <... futex resumed>) = 0 [pid 563] <... mmap resumed>) = 0x7f6005c0f000 [pid 560] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 563] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 560] <... mmap resumed>) = 0x7f600e00f000 [pid 560] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 560] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[564], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 564 [pid 560] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 560] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 563] <... write resumed>) = 262144 [pid 563] munmap(0x7f6005c0f000, 262144) = 0 [pid 559] <... chdir resumed>) = 0 [pid 555] mkdir("./file1", 0777 [pid 554] <... mount resumed>) = 0 [pid 550] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY./strace-static-x86_64: Process 564 attached [pid 563] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 559] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 555] <... mkdir resumed>) = 0 [pid 554] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 550] <... openat resumed>) = 3 [pid 559] <... prctl resumed>) = 0 [pid 555] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 554] <... openat resumed>) = 3 [pid 550] chdir("./file1" [pid 564] set_robust_list(0x7f600e02f9e0, 24 [pid 559] setpgid(0, 0 [pid 554] chdir("./file1" [pid 550] <... chdir resumed>) = 0 [pid 564] <... set_robust_list resumed>) = 0 [pid 563] <... openat resumed>) = 4 [pid 559] <... setpgid resumed>) = 0 [pid 554] <... chdir resumed>) = 0 [pid 550] ioctl(4, LOOP_CLR_FD [pid 564] memfd_create("syzkaller", 0 [pid 563] ioctl(4, LOOP_SET_FD, 3 [ 22.491704][ T550] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 22.504410][ T554] EXT4-fs (loop1): 1 orphan inode deleted [ 22.510145][ T554] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 22.521279][ T550] ext4 filesystem being mounted at /root/syzkaller.IrUvXE/8/file1 supports timestamps until 2038 (0x7fffffff) [ 22.533114][ T554] ext4 filesystem being mounted at /root/syzkaller.6GNILo/8/file1 supports timestamps until 2038 (0x7fffffff) [pid 559] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 554] ioctl(4, LOOP_CLR_FD [pid 550] <... ioctl resumed>) = 0 [pid 564] <... memfd_create resumed>) = 3 [pid 559] <... openat resumed>) = 3 [pid 559] write(3, "1000", 4 [pid 554] <... ioctl resumed>) = 0 [pid 550] close(4 [pid 564] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 563] <... ioctl resumed>) = 0 [pid 559] <... write resumed>) = 4 [pid 554] close(4 [pid 550] <... close resumed>) = 0 [pid 564] <... mmap resumed>) = 0x7f6005c0f000 [pid 563] close(3 [pid 559] close(3 [pid 554] <... close resumed>) = 0 [pid 550] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 564] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 563] <... close resumed>) = 0 [pid 559] <... close resumed>) = 0 [pid 554] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 550] <... futex resumed>) = 1 [pid 549] <... futex resumed>) = 0 [pid 564] <... write resumed>) = 262144 [pid 563] mkdir("./file1", 0777 [pid 559] symlink("/dev/binderfs", "./binderfs" [pid 554] <... futex resumed>) = 1 [pid 551] <... futex resumed>) = 0 [pid 550] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 549] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 564] munmap(0x7f6005c0f000, 262144 [pid 563] <... mkdir resumed>) = 0 [pid 559] <... symlink resumed>) = 0 [pid 554] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 551] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 550] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 549] <... futex resumed>) = 0 [pid 564] <... munmap resumed>) = 0 [pid 563] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 559] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 554] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 551] <... futex resumed>) = 0 [pid 550] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 549] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 564] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 559] <... futex resumed>) = 0 [pid 554] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 551] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 550] <... open resumed>) = 4 [pid 564] <... openat resumed>) = 4 [pid 559] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 550] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 554] <... open resumed>) = 4 [pid 564] ioctl(4, LOOP_SET_FD, 3 [pid 559] <... mmap resumed>) = 0x7f600e00f000 [pid 554] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 550] <... futex resumed>) = 1 [pid 549] <... futex resumed>) = 0 [pid 559] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE [pid 554] <... futex resumed>) = 1 [pid 551] <... futex resumed>) = 0 [pid 550] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 549] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 559] <... mprotect resumed>) = 0 [pid 554] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 551] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 550] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 549] <... futex resumed>) = 0 [pid 559] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 554] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 551] <... futex resumed>) = 0 [pid 550] fallocate(4, 0, 35143, 7 [pid 549] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 554] fallocate(4, 0, 35143, 7 [pid 551] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 550] <... fallocate resumed>) = 0 [pid 549] <... futex resumed>) = 0 [pid 564] <... ioctl resumed>) = 0 [pid 559] <... clone resumed>, parent_tid=[566], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 566 [pid 554] <... fallocate resumed>) = 0 [pid 550] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 549] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 559] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 554] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 551] <... futex resumed>) = 0 [pid 550] <... futex resumed>) = 0 [pid 549] <... mmap resumed>) = 0x7f6005c2e000 [pid 564] close(3 [pid 559] <... futex resumed>) = 0 [pid 554] <... futex resumed>) = 0 [pid 551] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 550] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 549] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE [pid 564] <... close resumed>) = 0 [pid 559] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 554] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 551] <... mmap resumed>) = 0x7f6005c2e000 [pid 549] <... mprotect resumed>) = 0 [pid 564] mkdir("./file1", 0777 [pid 551] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE [pid 549] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 564] <... mkdir resumed>) = 0 [pid 551] <... mprotect resumed>) = 0 [pid 564] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 549] <... clone resumed>, parent_tid=[568], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 568 [pid 551] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 549] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 551] <... clone resumed>, parent_tid=[570], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 570 [pid 549] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 551] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 551] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 566 attached [pid 566] set_robust_list(0x7f600e02f9e0, 24) = 0 [pid 566] memfd_create("syzkaller", 0) = 3 [pid 566] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 ./strace-static-x86_64: Process 570 attached ./strace-static-x86_64: Process 568 attached [pid 570] set_robust_list(0x7f6005c4e9e0, 24 [pid 568] set_robust_list(0x7f6005c4e9e0, 24 [pid 570] <... set_robust_list resumed>) = 0 [pid 570] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 568] <... set_robust_list resumed>) = 0 [pid 570] <... mount resumed>) = 0 [pid 568] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 570] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 551] <... futex resumed>) = 0 [pid 570] <... futex resumed>) = 1 [pid 551] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 554] <... futex resumed>) = 0 [pid 551] <... futex resumed>) = 1 [pid 554] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 551] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 554] <... open resumed>) = 5 [pid 554] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 551] <... futex resumed>) = 0 [pid 554] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 551] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 554] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 551] <... futex resumed>) = 0 [pid 554] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 551] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 554] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 554] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 551] <... futex resumed>) = 0 [pid 554] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 551] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 554] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 551] <... futex resumed>) = 0 [pid 554] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 551] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 570] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 568] <... mount resumed>) = 0 [pid 554] <... write resumed>) = 262144 [pid 554] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 551] <... futex resumed>) = 0 [pid 554] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 551] exit_group(0 [pid 554] <... futex resumed>) = ? [pid 551] <... exit_group resumed>) = ? [pid 554] +++ exited with 0 +++ [pid 570] <... futex resumed>) = ? [pid 568] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 566] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [ 22.547832][ T563] loop3: detected capacity change from 0 to 512 [ 22.561603][ T564] loop0: detected capacity change from 0 to 512 [ 22.573656][ T555] EXT4-fs (loop2): 1 orphan inode deleted [ 22.579376][ T555] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [pid 570] +++ exited with 0 +++ [pid 568] <... futex resumed>) = 1 [pid 551] +++ exited with 0 +++ [pid 549] <... futex resumed>) = 0 [pid 549] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 550] <... futex resumed>) = 0 [pid 549] <... futex resumed>) = 1 [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=551, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 550] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 549] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 550] <... open resumed>) = 5 [pid 550] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 549] <... futex resumed>) = 0 [pid 550] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 549] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] umount2("./8", MNT_DETACH|UMOUNT_NOFOLLOW [pid 550] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 549] <... futex resumed>) = 0 [pid 550] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 549] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 550] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 550] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 568] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 550] <... futex resumed>) = 1 [pid 549] <... futex resumed>) = 0 [pid 294] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 550] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 549] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 550] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 549] <... futex resumed>) = 0 [pid 294] <... openat resumed>) = 3 [pid 550] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 549] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 550] <... write resumed>) = 262144 [pid 294] fstat(3, [pid 550] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 550] <... futex resumed>) = 1 [pid 549] <... futex resumed>) = 0 [pid 294] getdents64(3, [pid 550] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 549] exit_group(0 [pid 568] <... futex resumed>) = ? [pid 566] munmap(0x7f6005c0f000, 262144 [pid 550] <... futex resumed>) = ? [pid 549] <... exit_group resumed>) = ? [pid 568] +++ exited with 0 +++ [pid 566] <... munmap resumed>) = 0 [pid 550] +++ exited with 0 +++ [pid 549] +++ exited with 0 +++ [pid 294] <... getdents64 resumed>0x555557288620 /* 4 entries */, 32768) = 112 [pid 566] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 4 [pid 566] ioctl(4, LOOP_SET_FD, 3 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=549, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 294] umount2("./8/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] umount2("./8", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] lstat("./8/binderfs", [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 566] <... ioctl resumed>) = 0 [pid 566] close(3) = 0 [pid 566] mkdir("./file1", 0777 [pid 294] unlink("./8/binderfs" [pid 297] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] <... unlink resumed>) = 0 [pid 297] <... openat resumed>) = 3 [pid 294] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 566] <... mkdir resumed>) = 0 [pid 566] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 297] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] getdents64(3, 0x555557288620 /* 4 entries */, 32768) = 112 [pid 297] umount2("./8/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] lstat("./8/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 297] unlink("./8/binderfs") = 0 [ 22.598683][ T563] EXT4-fs (loop3): 1 orphan inode deleted [ 22.610641][ T564] EXT4-fs (loop0): 1 orphan inode deleted [ 22.619146][ T566] loop5: detected capacity change from 0 to 512 [ 22.625556][ T563] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 22.636719][ T564] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [pid 297] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 563] <... mount resumed>) = 0 [pid 563] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 563] chdir("./file1") = 0 [pid 563] ioctl(4, LOOP_CLR_FD) = 0 [pid 563] close(4) = 0 [pid 563] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 558] <... futex resumed>) = 0 [pid 558] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 558] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 563] <... futex resumed>) = 1 [pid 563] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 563] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 558] <... futex resumed>) = 0 [pid 558] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 558] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 558] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6005c2e000 [pid 558] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 558] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[575], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 575 [pid 558] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 558] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 563] <... futex resumed>) = 1 [pid 563] fallocate(4, 0, 35143, 7) = 0 [pid 563] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 563] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 575 attached [pid 575] set_robust_list(0x7f6005c4e9e0, 24) = 0 [pid 575] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL) = 0 [pid 575] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 558] <... futex resumed>) = 0 [pid 558] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 558] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 563] <... futex resumed>) = 0 [pid 563] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 5 [pid 563] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 558] <... futex resumed>) = 0 [pid 558] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 558] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 563] <... futex resumed>) = 1 [pid 563] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096) = -1 EBADF (Bad file descriptor) [pid 563] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 558] <... futex resumed>) = 0 [pid 558] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 558] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 563] <... futex resumed>) = 1 [pid 563] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190) = 262144 [pid 563] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 558] <... futex resumed>) = 0 [pid 558] exit_group(0) = ? [pid 563] <... futex resumed>) = ? [pid 563] +++ exited with 0 +++ [pid 575] <... futex resumed>) = ? [pid 575] +++ exited with 0 +++ [pid 558] +++ exited with 0 +++ [pid 555] <... mount resumed>) = 0 [pid 555] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 555] chdir("./file1") = 0 [pid 555] ioctl(4, LOOP_CLR_FD) = 0 [pid 555] close(4) = 0 [pid 555] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 553] <... futex resumed>) = 0 [pid 553] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 553] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 555] <... futex resumed>) = 1 [pid 555] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 555] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 553] <... futex resumed>) = 0 [pid 553] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 553] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 553] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6005c2e000 [pid 553] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 553] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[576], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 576 [pid 553] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 553] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 555] <... futex resumed>) = 1 [pid 555] fallocate(4, 0, 35143, 7) = 0 [pid 555] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 555] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 576 attached [pid 576] set_robust_list(0x7f6005c4e9e0, 24) = 0 [pid 576] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL) = 0 [pid 576] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 553] <... futex resumed>) = 0 [pid 553] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 553] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 555] <... futex resumed>) = 0 [pid 555] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 5 [pid 555] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 553] <... futex resumed>) = 0 [pid 553] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 553] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 555] <... futex resumed>) = 1 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=558, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 555] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096) = -1 EBADF (Bad file descriptor) [pid 555] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 553] <... futex resumed>) = 0 [pid 553] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 553] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 555] <... futex resumed>) = 1 [pid 555] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 294] <... umount2 resumed>) = 0 [pid 294] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./8", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] lstat("./8/file1", [pid 296] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] <... openat resumed>) = 3 [pid 294] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] fstat(3, [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 294] openat(AT_FDCWD, "./8/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] getdents64(3, [pid 294] <... openat resumed>) = 4 [pid 296] <... getdents64 resumed>0x555557288620 /* 4 entries */, 32768) = 112 [pid 294] fstat(4, [pid 296] umount2("./8/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] getdents64(4, [pid 296] lstat("./8/binderfs", [pid 294] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 296] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 294] getdents64(4, [pid 296] unlink("./8/binderfs" [pid 294] <... getdents64 resumed>0x555557290660 /* 0 entries */, 32768) = 0 [pid 296] <... unlink resumed>) = 0 [pid 294] close(4 [pid 296] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... close resumed>) = 0 [pid 294] rmdir("./8/file1") = 0 [pid 294] getdents64(3, 0x555557288620 /* 0 entries */, 32768) = 0 [pid 294] close(3) = 0 [pid 294] rmdir("./8") = 0 [pid 294] mkdir("./9", 0777) = 0 [pid 294] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 294] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 294] close(3) = 0 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555572875d0) = 578 [pid 555] <... write resumed>) = 262144 [pid 555] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 553] <... futex resumed>) = 0 [pid 553] exit_group(0) = ? [pid 555] <... futex resumed>) = ? [pid 555] +++ exited with 0 +++ [pid 576] <... futex resumed>) = ? [pid 576] +++ exited with 0 +++ [pid 553] +++ exited with 0 +++ [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=553, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 295] umount2("./7", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 295] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] getdents64(3, 0x555557288620 /* 4 entries */, 32768) = 112 [pid 295] umount2("./7/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] lstat("./7/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 295] unlink("./7/binderfs") = 0 [pid 295] umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 578 attached [ 22.653335][ T555] ext4 filesystem being mounted at /root/syzkaller.qF1bbv/7/file1 supports timestamps until 2038 (0x7fffffff) [ 22.665788][ T563] ext4 filesystem being mounted at /root/syzkaller.2mSqAy/8/file1 supports timestamps until 2038 (0x7fffffff) [ 22.671686][ T564] ext4 filesystem being mounted at /root/syzkaller.SN8fLk/9/file1 supports timestamps until 2038 (0x7fffffff) [pid 578] set_robust_list(0x5555572875e0, 24 [pid 564] <... mount resumed>) = 0 [pid 297] <... umount2 resumed>) = 0 [pid 297] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] lstat("./8/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./8/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 297] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] getdents64(4, 0x555557290660 /* 2 entries */, 32768) = 48 [pid 297] getdents64(4, 0x555557290660 /* 0 entries */, 32768) = 0 [pid 297] close(4) = 0 [pid 297] rmdir("./8/file1") = 0 [pid 578] <... set_robust_list resumed>) = 0 [pid 297] getdents64(3, 0x555557288620 /* 0 entries */, 32768) = 0 [pid 297] close(3) = 0 [pid 578] chdir("./9" [pid 297] rmdir("./8" [pid 578] <... chdir resumed>) = 0 [pid 297] <... rmdir resumed>) = 0 [pid 297] mkdir("./9", 0777) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 3 [pid 297] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 297] close(3) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555572875d0) = 579 [pid 578] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 564] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 296] <... umount2 resumed>) = 0 [pid 296] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... umount2 resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] lstat("./8/file1", [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] lstat("./7/file1", [pid 296] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] openat(AT_FDCWD, "./8/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... openat resumed>) = 4 [pid 295] openat(AT_FDCWD, "./7/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] fstat(4, [pid 295] <... openat resumed>) = 4 [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] fstat(4, [pid 296] getdents64(4, [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 295] getdents64(4, [pid 296] getdents64(4, [pid 295] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 296] <... getdents64 resumed>0x555557290660 /* 0 entries */, 32768) = 0 [pid 295] getdents64(4, [pid 296] close(4 [pid 295] <... getdents64 resumed>0x555557290660 /* 0 entries */, 32768) = 0 [pid 296] <... close resumed>) = 0 [pid 295] close(4 [pid 296] rmdir("./8/file1" [pid 295] <... close resumed>) = 0 [pid 296] <... rmdir resumed>) = 0 [pid 295] rmdir("./7/file1" [pid 578] setpgid(0, 0 [pid 296] getdents64(3, [pid 295] <... rmdir resumed>) = 0 [pid 296] <... getdents64 resumed>0x555557288620 /* 0 entries */, 32768) = 0 [pid 295] getdents64(3, [pid 296] close(3 [pid 295] <... getdents64 resumed>0x555557288620 /* 0 entries */, 32768) = 0 [pid 296] <... close resumed>) = 0 [pid 295] close(3 [pid 296] rmdir("./8" [pid 295] <... close resumed>) = 0 [pid 578] <... setpgid resumed>) = 0 [pid 296] <... rmdir resumed>) = 0 [pid 295] rmdir("./7" [pid 296] mkdir("./9", 0777 [pid 295] <... rmdir resumed>) = 0 [pid 578] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 296] <... mkdir resumed>) = 0 [pid 295] mkdir("./8", 0777 [pid 296] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 295] <... mkdir resumed>) = 0 [pid 296] <... openat resumed>) = 3 [pid 295] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 296] ioctl(3, LOOP_CLR_FD [pid 295] <... openat resumed>) = 3 [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 295] ioctl(3, LOOP_CLR_FD [pid 296] close(3 [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] <... close resumed>) = 0 [pid 295] close(3 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] <... close resumed>) = 0 [pid 578] <... openat resumed>) = 3 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 578] write(3, "1000", 4 [pid 296] <... clone resumed>, child_tidptr=0x5555572875d0) = 580 [pid 295] <... clone resumed>, child_tidptr=0x5555572875d0) = 581 ./strace-static-x86_64: Process 579 attached [pid 579] set_robust_list(0x5555572875e0, 24) = 0 [pid 579] chdir("./9") = 0 [pid 579] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 579] setpgid(0, 0) = 0 [pid 579] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 ./strace-static-x86_64: Process 581 attached [pid 581] set_robust_list(0x5555572875e0, 24 [pid 579] write(3, "1000", 4) = 4 [pid 581] <... set_robust_list resumed>) = 0 [pid 579] close(3 [pid 581] chdir("./8" [pid 579] <... close resumed>) = 0 [pid 579] symlink("/dev/binderfs", "./binderfs") = 0 [pid 581] <... chdir resumed>) = 0 [pid 581] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 581] setpgid(0, 0./strace-static-x86_64: Process 580 attached ) = 0 [pid 581] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 580] set_robust_list(0x5555572875e0, 24 [pid 579] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 579] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 578] <... write resumed>) = 4 [pid 579] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE [pid 581] <... openat resumed>) = 3 [pid 578] close(3 [pid 580] <... set_robust_list resumed>) = 0 [pid 580] chdir("./9" [pid 579] <... mprotect resumed>) = 0 [pid 581] write(3, "1000", 4 [pid 580] <... chdir resumed>) = 0 [pid 579] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 581] <... write resumed>) = 4 [pid 580] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 581] close(3 [pid 580] <... prctl resumed>) = 0 [pid 581] <... close resumed>) = 0 [pid 580] setpgid(0, 0 [pid 579] <... clone resumed>, parent_tid=[582], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 582 [pid 581] symlink("/dev/binderfs", "./binderfs" [pid 580] <... setpgid resumed>) = 0 [pid 581] <... symlink resumed>) = 0 [pid 580] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 579] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 581] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 580] <... openat resumed>) = 3 [pid 579] <... futex resumed>) = 0 [pid 581] <... futex resumed>) = 0 [pid 580] write(3, "1000", 4 [pid 579] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 578] <... close resumed>) = 0 [pid 581] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 580] <... write resumed>) = 4 [pid 578] symlink("/dev/binderfs", "./binderfs" [pid 581] <... mmap resumed>) = 0x7f600e00f000 [pid 580] close(3 [pid 581] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE [pid 580] <... close resumed>) = 0 [pid 578] <... symlink resumed>) = 0 [pid 581] <... mprotect resumed>) = 0 [pid 580] symlink("/dev/binderfs", "./binderfs" [pid 581] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 580] <... symlink resumed>) = 0 [pid 578] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 581] <... clone resumed>, parent_tid=[583], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 583 [pid 580] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 581] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 580] <... futex resumed>) = 0 [pid 578] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 581] <... futex resumed>) = 0 [pid 580] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 578] <... mmap resumed>) = 0x7f600e00f000 [pid 581] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 580] <... mmap resumed>) = 0x7f600e00f000 [pid 580] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE [pid 578] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE [pid 580] <... mprotect resumed>) = 0 [pid 578] <... mprotect resumed>) = 0 [pid 580] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 578] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 580] <... clone resumed>, parent_tid=[584], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 584 [pid 580] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 580] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 582 attached [pid 582] set_robust_list(0x7f600e02f9e0, 24) = 0 [pid 578] <... clone resumed>, parent_tid=[585], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 585 [pid 578] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 578] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 582] memfd_create("syzkaller", 0) = 3 [pid 582] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 ./strace-static-x86_64: Process 583 attached [pid 583] set_robust_list(0x7f600e02f9e0, 24) = 0 [pid 583] memfd_create("syzkaller", 0) = 3 [pid 583] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 ./strace-static-x86_64: Process 584 attached [pid 584] set_robust_list(0x7f600e02f9e0, 24./strace-static-x86_64: Process 585 attached ) = 0 [pid 582] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 585] set_robust_list(0x7f600e02f9e0, 24 [pid 584] memfd_create("syzkaller", 0 [pid 585] <... set_robust_list resumed>) = 0 [pid 584] <... memfd_create resumed>) = 3 [pid 585] memfd_create("syzkaller", 0 [pid 584] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 582] <... write resumed>) = 262144 [pid 585] <... memfd_create resumed>) = 3 [pid 584] <... mmap resumed>) = 0x7f6005c0f000 [pid 583] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 564] <... openat resumed>) = 3 [pid 585] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 582] munmap(0x7f6005c0f000, 262144 [pid 564] chdir("./file1" [pid 585] <... mmap resumed>) = 0x7f6005c0f000 [pid 582] <... munmap resumed>) = 0 [pid 582] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 564] <... chdir resumed>) = 0 [pid 584] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 582] <... openat resumed>) = 4 [pid 564] ioctl(4, LOOP_CLR_FD [pid 585] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 583] <... write resumed>) = 262144 [pid 582] ioctl(4, LOOP_SET_FD, 3 [pid 564] <... ioctl resumed>) = 0 [ 22.707983][ T566] EXT4-fs (loop5): 1 orphan inode deleted [ 22.718136][ T566] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [pid 564] close(4) = 0 [pid 584] <... write resumed>) = 262144 [pid 564] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 585] <... write resumed>) = 262144 [pid 583] munmap(0x7f6005c0f000, 262144 [pid 582] <... ioctl resumed>) = 0 [pid 564] <... futex resumed>) = 1 [pid 560] <... futex resumed>) = 0 [pid 564] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 560] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 564] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 560] <... futex resumed>) = 0 [pid 564] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 560] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 564] <... open resumed>) = 4 [pid 584] munmap(0x7f6005c0f000, 262144 [pid 564] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 584] <... munmap resumed>) = 0 [pid 564] <... futex resumed>) = 1 [pid 560] <... futex resumed>) = 0 [pid 564] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 560] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 584] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 564] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 560] <... futex resumed>) = 0 [pid 584] <... openat resumed>) = 4 [pid 564] fallocate(4, 0, 35143, 7 [pid 560] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 584] ioctl(4, LOOP_SET_FD, 3 [pid 564] <... fallocate resumed>) = 0 [pid 560] <... futex resumed>) = 0 [pid 585] munmap(0x7f6005c0f000, 262144 [pid 583] <... munmap resumed>) = 0 [pid 582] close(3 [pid 564] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 585] <... munmap resumed>) = 0 [pid 583] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 582] <... close resumed>) = 0 [pid 585] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 583] <... openat resumed>) = 4 [pid 582] mkdir("./file1", 0777 [pid 585] <... openat resumed>) = 4 [pid 583] ioctl(4, LOOP_SET_FD, 3 [pid 582] <... mkdir resumed>) = 0 [pid 585] ioctl(4, LOOP_SET_FD, 3 [pid 584] <... ioctl resumed>) = 0 [pid 583] <... ioctl resumed>) = 0 [pid 582] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 564] <... futex resumed>) = 0 [pid 560] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 583] close(3 [pid 585] <... ioctl resumed>) = 0 [pid 583] <... close resumed>) = 0 [pid 585] close(3 [pid 583] mkdir("./file1", 0777 [pid 585] <... close resumed>) = 0 [pid 583] <... mkdir resumed>) = 0 [pid 564] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 560] <... mmap resumed>) = 0x7f6005c2e000 [pid 585] mkdir("./file1", 0777 [pid 583] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 585] <... mkdir resumed>) = 0 [pid 584] close(3 [pid 560] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE [pid 585] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 584] <... close resumed>) = 0 [pid 560] <... mprotect resumed>) = 0 [pid 560] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 566] <... mount resumed>) = 0 [pid 584] mkdir("./file1", 0777 [pid 566] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 560] <... clone resumed>, parent_tid=[586], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 586 [pid 566] <... openat resumed>) = 3 [pid 566] chdir("./file1") = 0 [pid 566] ioctl(4, LOOP_CLR_FD) = 0 [pid 566] close(4) = 0 [pid 566] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 560] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 560] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 559] <... futex resumed>) = 0 [pid 566] <... futex resumed>) = 1 [pid 559] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 566] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 559] <... futex resumed>) = 0 [pid 584] <... mkdir resumed>) = 0 [pid 559] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 586 attached [pid 584] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 566] <... open resumed>) = 4 [pid 566] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 559] <... futex resumed>) = 0 [pid 559] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 559] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 559] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 586] set_robust_list(0x7f6005c4e9e0, 24 [pid 566] fallocate(4, 0, 35143, 7 [pid 559] <... mmap resumed>) = 0x7f6005c2e000 [pid 566] <... fallocate resumed>) = 0 [pid 559] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE [pid 566] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 559] <... mprotect resumed>) = 0 [ 22.759182][ T582] loop4: detected capacity change from 0 to 512 [ 22.766274][ T566] ext4 filesystem being mounted at /root/syzkaller.kumyKI/8/file1 supports timestamps until 2038 (0x7fffffff) [ 22.771583][ T584] loop3: detected capacity change from 0 to 512 [ 22.779638][ T583] loop2: detected capacity change from 0 to 512 [ 22.790534][ T585] loop1: detected capacity change from 0 to 512 [pid 559] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 566] <... futex resumed>) = 0 [pid 586] <... set_robust_list resumed>) = 0 [pid 566] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 593 attached [pid 593] set_robust_list(0x7f6005c4e9e0, 24) = 0 [pid 593] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 586] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 559] <... clone resumed>, parent_tid=[593], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 593 [pid 586] <... mount resumed>) = 0 [pid 559] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 560] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 560] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 564] <... futex resumed>) = 0 [pid 560] <... futex resumed>) = 1 [pid 564] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 560] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 564] <... open resumed>) = 5 [pid 564] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 560] <... futex resumed>) = 0 [pid 564] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 560] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 564] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 560] <... futex resumed>) = 0 [pid 564] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 560] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 564] <... futex resumed>) = 0 [pid 560] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 564] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [ 22.810646][ T585] EXT4-fs (loop1): 1 orphan inode deleted [ 22.810937][ T582] EXT4-fs (loop4): 1 orphan inode deleted [ 22.816525][ T585] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 22.825887][ T584] EXT4-fs (loop3): 1 orphan inode deleted [ 22.834154][ T583] EXT4-fs (loop2): 1 orphan inode deleted [ 22.838985][ T584] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [pid 560] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 560] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 593] <... futex resumed>) = 0 [pid 586] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 564] <... write resumed>) = 262144 [pid 559] <... futex resumed>) = 1 [pid 593] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 586] <... futex resumed>) = 0 [pid 564] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 559] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 585] <... mount resumed>) = 0 [pid 585] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 585] chdir("./file1") = 0 [pid 585] ioctl(4, LOOP_CLR_FD) = 0 [pid 585] close(4) = 0 [pid 585] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 578] <... futex resumed>) = 0 [pid 578] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 578] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 585] <... futex resumed>) = 1 [pid 585] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 585] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 578] <... futex resumed>) = 0 [pid 578] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 578] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 578] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6005c2e000 [pid 578] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 578] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[596], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 596 [pid 578] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 578] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 585] <... futex resumed>) = 1 [pid 585] fallocate(4, 0, 35143, 7) = 0 [pid 585] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 585] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 560] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 560] exit_group(0) = ? [pid 593] <... mount resumed>) = 0 [pid 586] +++ exited with 0 +++ [pid 564] <... futex resumed>) = ? [pid 593] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 564] +++ exited with 0 +++ [pid 560] +++ exited with 0 +++ [pid 593] <... futex resumed>) = 1 [pid 559] <... futex resumed>) = 0 [pid 593] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 559] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 566] <... futex resumed>) = 0 [pid 559] <... futex resumed>) = 1 [pid 566] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 559] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 566] <... open resumed>) = 5 [pid 566] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 293] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=560, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 566] <... futex resumed>) = 1 [pid 559] <... futex resumed>) = 0 [pid 293] restart_syscall(<... resuming interrupted clone ...> [pid 566] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 293] <... restart_syscall resumed>) = 0 [pid 293] umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 293] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 293] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 293] getdents64(3, 0x555557288620 /* 4 entries */, 32768) = 112 [pid 293] umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 293] lstat("./9/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 566] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 559] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 293] unlink("./9/binderfs" [pid 566] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 559] <... futex resumed>) = 0 [pid 293] <... unlink resumed>) = 0 [pid 566] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 559] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 293] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 566] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 559] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 559] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 566] <... futex resumed>) = 0 [pid 559] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 566] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190) = 262144 [pid 293] <... umount2 resumed>) = 0 [pid 566] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 559] <... futex resumed>) = 0 [pid 566] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 559] exit_group(0 [pid 566] <... futex resumed>) = ? [pid 559] <... exit_group resumed>) = ? [pid 593] <... futex resumed>) = 231 [pid 566] +++ exited with 0 +++ [pid 593] +++ exited with 0 +++ [pid 559] +++ exited with 0 +++ [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=559, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 298] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 298] umount2("./8", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 298] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] getdents64(3, 0x555557288620 /* 4 entries */, 32768) = 112 [pid 298] umount2("./8/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] lstat("./8/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 298] unlink("./8/binderfs") = 0 [pid 298] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 293] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 293] lstat("./9/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 293] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 293] openat(AT_FDCWD, "./9/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 293] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 293] getdents64(4, 0x555557290660 /* 2 entries */, 32768) = 48 [pid 293] getdents64(4, 0x555557290660 /* 0 entries */, 32768) = 0 [pid 293] close(4) = 0 [pid 293] rmdir("./9/file1") = 0 [pid 293] getdents64(3, 0x555557288620 /* 0 entries */, 32768) = 0 [pid 293] close(3) = 0 [pid 293] rmdir("./9") = 0 [pid 293] mkdir("./10", 0777) = 0 [pid 293] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 293] ioctl(3, LOOP_CLR_FD) = 0 [ 22.843926][ T583] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 22.859632][ T582] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 22.866753][ T585] ext4 filesystem being mounted at /root/syzkaller.6GNILo/9/file1 supports timestamps until 2038 (0x7fffffff) [ 22.876938][ T584] ext4 filesystem being mounted at /root/syzkaller.2mSqAy/9/file1 supports timestamps until 2038 (0x7fffffff) [ 22.887689][ T583] ext4 filesystem being mounted at /root/syzkaller.qF1bbv/8/file1 supports timestamps until 2038 (0x7fffffff) [pid 293] close(3 [pid 583] <... mount resumed>) = 0 [pid 583] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 583] chdir("./file1") = 0 [pid 583] ioctl(4, LOOP_CLR_FD) = 0 [pid 583] close(4) = 0 [pid 583] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 583] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 584] <... mount resumed>) = 0 [pid 584] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 584] chdir("./file1") = 0 [pid 584] ioctl(4, LOOP_CLR_FD) = 0 [pid 584] close(4) = 0 [pid 584] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 584] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 581] <... futex resumed>) = 0 [pid 580] <... futex resumed>) = 0 [pid 581] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 580] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 581] <... futex resumed>) = 1 [pid 583] <... futex resumed>) = 0 [pid 581] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 580] <... futex resumed>) = 1 [pid 583] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 580] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 583] <... open resumed>) = 4 [pid 583] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 581] <... futex resumed>) = 0 [pid 583] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 581] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 583] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 581] <... futex resumed>) = 0 [pid 583] fallocate(4, 0, 35143, 7 [pid 581] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 581] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6005c2e000 [pid 583] <... fallocate resumed>) = 0 [pid 581] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE [pid 583] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 581] <... mprotect resumed>) = 0 [pid 583] <... futex resumed>) = 0 [pid 583] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 581] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID./strace-static-x86_64: Process 597 attached , parent_tid=[597], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 597 [pid 597] set_robust_list(0x7f6005c4e9e0, 24 [pid 581] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 597] <... set_robust_list resumed>) = 0 [pid 581] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 597] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 584] <... futex resumed>) = 0 [pid 597] <... mount resumed>) = 0 [pid 597] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 581] <... futex resumed>) = 0 [pid 584] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 581] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 597] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 583] <... futex resumed>) = 0 [pid 581] <... futex resumed>) = 1 [pid 583] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 581] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 583] <... open resumed>) = 5 [pid 583] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 581] <... futex resumed>) = 0 [pid 583] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 581] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 583] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 581] <... futex resumed>) = 0 [pid 583] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 581] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 583] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 583] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 581] <... futex resumed>) = 0 [pid 583] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 581] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 583] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 581] <... futex resumed>) = 0 [pid 583] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 581] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 596 attached [pid 584] <... open resumed>) = 4 [pid 582] <... mount resumed>) = 0 [pid 596] set_robust_list(0x7f6005c4e9e0, 24 [pid 584] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 596] <... set_robust_list resumed>) = 0 [pid 584] <... futex resumed>) = 1 [pid 583] <... write resumed>) = 262144 [pid 580] <... futex resumed>) = 0 [pid 596] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 584] fallocate(4, 0, 35143, 7 [pid 583] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 580] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 596] <... mount resumed>) = 0 [pid 596] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 584] <... fallocate resumed>) = 0 [pid 583] <... futex resumed>) = 1 [pid 580] <... futex resumed>) = 0 [pid 596] <... futex resumed>) = 1 [pid 581] <... futex resumed>) = 0 [pid 578] <... futex resumed>) = 0 [pid 584] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 583] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 580] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 584] <... futex resumed>) = 0 [pid 580] <... futex resumed>) = 0 [pid 584] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 580] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6005c2e000 [pid 580] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 580] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[598], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 598 [pid 580] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 580] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 596] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 581] exit_group(0 [pid 578] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 585] <... futex resumed>) = 0 [pid 583] <... futex resumed>) = ? [pid 597] <... futex resumed>) = 0 [pid 581] <... exit_group resumed>) = ? [pid 583] +++ exited with 0 +++ [pid 582] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 582] chdir("./file1") = 0 [pid 582] ioctl(4, LOOP_CLR_FD) = 0 [pid 582] close(4) = 0 [pid 582] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 579] <... futex resumed>) = 0 [pid 579] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 579] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 582] <... futex resumed>) = 1 [pid 582] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 585] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 578] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 585] <... open resumed>) = 5 [pid 585] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 578] <... futex resumed>) = 0 [pid 585] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 578] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 585] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 578] <... futex resumed>) = 0 [pid 585] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 578] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 585] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 585] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 578] <... futex resumed>) = 0 [pid 585] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 578] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 585] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 578] <... futex resumed>) = 0 [pid 585] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 578] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 582] <... open resumed>) = 4 [pid 582] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 579] <... futex resumed>) = 0 [pid 579] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 579] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 579] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6005c2e000 [pid 579] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 579] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[599], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 599 [pid 579] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 579] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 582] <... futex resumed>) = 1 [pid 582] fallocate(4, 0, 35143, 7 [pid 585] <... write resumed>) = 262144 [pid 585] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 578] <... futex resumed>) = 0 [pid 585] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 578] exit_group(0 [pid 596] <... futex resumed>) = ? [pid 585] <... futex resumed>) = ? [pid 578] <... exit_group resumed>) = ? [pid 597] +++ exited with 0 +++ [pid 596] +++ exited with 0 +++ [pid 585] +++ exited with 0 +++ [pid 581] +++ exited with 0 +++ [pid 578] +++ exited with 0 +++ [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=581, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=578, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 295] restart_syscall(<... resuming interrupted clone ...> [pid 294] restart_syscall(<... resuming interrupted clone ...> [pid 295] <... restart_syscall resumed>) = 0 [pid 294] <... restart_syscall resumed>) = 0 [pid 294] umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 599 attached ./strace-static-x86_64: Process 598 attached [pid 298] <... umount2 resumed>) = 0 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 293] <... close resumed>) = 0 [pid 294] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 293] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 599] set_robust_list(0x7f6005c4e9e0, 24 [pid 598] set_robust_list(0x7f6005c4e9e0, 24 [pid 298] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./8", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... openat resumed>) = 3 [pid 294] fstat(3, [pid 293] <... clone resumed>, child_tidptr=0x5555572875d0) = 600 [pid 294] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 294] getdents64(3, [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... getdents64 resumed>0x555557288620 /* 4 entries */, 32768) = 112 [pid 599] <... set_robust_list resumed>) = 0 [pid 598] <... set_robust_list resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] lstat("./9/binderfs", [pid 582] <... fallocate resumed>) = 0 [pid 294] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 582] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] unlink("./9/binderfs"./strace-static-x86_64: Process 600 attached [pid 599] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 598] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 582] <... futex resumed>) = 0 [pid 298] lstat("./8/file1", [pid 295] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] <... unlink resumed>) = 0 [pid 582] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] <... openat resumed>) = 3 [pid 294] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 600] set_robust_list(0x5555572875e0, 24 [pid 599] <... mount resumed>) = 0 [pid 598] <... mount resumed>) = 0 [pid 298] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] fstat(3, [pid 600] <... set_robust_list resumed>) = 0 [pid 599] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 598] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 599] <... futex resumed>) = 1 [pid 579] <... futex resumed>) = 0 [pid 598] <... futex resumed>) = 1 [pid 580] <... futex resumed>) = 0 [pid 298] openat(AT_FDCWD, "./8/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] getdents64(3, [pid 580] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 579] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 584] <... futex resumed>) = 0 [pid 582] <... futex resumed>) = 0 [pid 580] <... futex resumed>) = 1 [pid 579] <... futex resumed>) = 1 [pid 584] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 582] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 580] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 579] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 584] <... open resumed>) = 5 [pid 582] <... open resumed>) = 5 [pid 584] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 582] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 580] <... futex resumed>) = 0 [pid 584] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 582] <... futex resumed>) = 1 [pid 580] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 579] <... futex resumed>) = 0 [pid 584] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 582] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 580] <... futex resumed>) = 0 [pid 579] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 584] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 582] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 580] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 579] <... futex resumed>) = 0 [pid 298] <... openat resumed>) = 4 [pid 295] <... getdents64 resumed>0x555557288620 /* 4 entries */, 32768) = 112 [pid 584] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 582] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 579] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] fstat(4, [pid 584] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 582] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 584] <... futex resumed>) = 1 [pid 582] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 580] <... futex resumed>) = 0 [pid 295] umount2("./8/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] getdents64(4, [pid 584] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 582] <... futex resumed>) = 1 [pid 580] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 579] <... futex resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 600] chdir("./10" [pid 599] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 598] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 584] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 582] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 580] <... futex resumed>) = 0 [pid 579] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 295] lstat("./8/binderfs", [pid 600] <... chdir resumed>) = 0 [pid 584] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 582] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 580] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 579] <... futex resumed>) = 0 [pid 298] getdents64(4, [pid 295] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 600] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 584] <... write resumed>) = 262144 [pid 582] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 579] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... getdents64 resumed>0x555557290660 /* 0 entries */, 32768) = 0 [pid 295] unlink("./8/binderfs" [pid 600] <... prctl resumed>) = 0 [pid 584] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 582] <... write resumed>) = 262144 [pid 298] close(4 [pid 584] <... futex resumed>) = 1 [pid 582] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 580] <... futex resumed>) = 0 [pid 295] <... unlink resumed>) = 0 [pid 584] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 582] <... futex resumed>) = 1 [ 22.919836][ T582] ext4 filesystem being mounted at /root/syzkaller.IrUvXE/9/file1 supports timestamps until 2038 (0x7fffffff) [pid 580] exit_group(0 [pid 579] <... futex resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 295] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 598] <... futex resumed>) = ? [pid 584] <... futex resumed>) = ? [pid 582] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 580] <... exit_group resumed>) = ? [pid 579] exit_group(0 [pid 600] setpgid(0, 0 [pid 599] <... futex resumed>) = ? [pid 598] +++ exited with 0 +++ [pid 584] +++ exited with 0 +++ [pid 582] <... futex resumed>) = ? [pid 580] +++ exited with 0 +++ [pid 579] <... exit_group resumed>) = ? [pid 298] rmdir("./8/file1" [pid 600] <... setpgid resumed>) = 0 [pid 599] +++ exited with 0 +++ [pid 582] +++ exited with 0 +++ [pid 579] +++ exited with 0 +++ [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=580, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 298] <... rmdir resumed>) = 0 [pid 296] umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] getdents64(3, [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] <... getdents64 resumed>0x555557288620 /* 0 entries */, 32768) = 0 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=579, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 296] <... openat resumed>) = 3 [pid 298] close(3 [pid 297] umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] fstat(3, [pid 298] <... close resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] rmdir("./8" [pid 297] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] getdents64(3, 0x555557288620 /* 4 entries */, 32768) = 112 [pid 296] umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] <... rmdir resumed>) = 0 [pid 297] <... openat resumed>) = 3 [pid 296] lstat("./9/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 298] mkdir("./9", 0777 [pid 297] fstat(3, [pid 296] unlink("./9/binderfs") = 0 [pid 600] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 298] <... mkdir resumed>) = 0 [pid 297] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 297] getdents64(3, [pid 600] <... openat resumed>) = 3 [pid 298] <... openat resumed>) = 3 [pid 297] <... getdents64 resumed>0x555557288620 /* 4 entries */, 32768) = 112 [pid 297] umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] lstat("./9/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 297] unlink("./9/binderfs" [pid 600] write(3, "1000", 4 [pid 298] ioctl(3, LOOP_CLR_FD [pid 297] <... unlink resumed>) = 0 [pid 297] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 600] <... write resumed>) = 4 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 600] close(3 [pid 298] close(3 [pid 600] <... close resumed>) = 0 [pid 600] symlink("/dev/binderfs", "./binderfs" [pid 298] <... close resumed>) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 600] <... symlink resumed>) = 0 [pid 600] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... clone resumed>, child_tidptr=0x5555572875d0) = 601 [pid 600] <... futex resumed>) = 0 [pid 600] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0./strace-static-x86_64: Process 601 attached ) = 0x7f600e00f000 [pid 296] <... umount2 resumed>) = 0 [pid 295] <... umount2 resumed>) = 0 [pid 294] <... umount2 resumed>) = 0 [pid 296] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 600] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] lstat("./8/file1", [pid 294] lstat("./9/file1", [pid 600] <... mprotect resumed>) = 0 [pid 295] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 294] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 600] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 295] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 600] <... clone resumed>, parent_tid=[602], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 602 [pid 295] openat(AT_FDCWD, "./8/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] openat(AT_FDCWD, "./9/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 600] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] lstat("./9/file1", [pid 295] <... openat resumed>) = 4 [pid 294] <... openat resumed>) = 4 [pid 600] <... futex resumed>) = 0 [pid 296] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] fstat(4, [pid 294] fstat(4, [pid 600] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 296] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 294] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] getdents64(4, [pid 294] getdents64(4, [pid 295] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 294] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 296] openat(AT_FDCWD, "./9/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] getdents64(4, [pid 294] getdents64(4, [pid 296] <... openat resumed>) = 4 [pid 295] <... getdents64 resumed>0x555557290660 /* 0 entries */, 32768) = 0 [pid 294] <... getdents64 resumed>0x555557290660 /* 0 entries */, 32768) = 0 [pid 296] fstat(4, [pid 295] close(4 [pid 294] close(4 [pid 601] set_robust_list(0x5555572875e0, 24 [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] <... close resumed>) = 0 [pid 294] <... close resumed>) = 0 [pid 601] <... set_robust_list resumed>) = 0 [pid 296] getdents64(4, [pid 295] rmdir("./8/file1" [pid 294] rmdir("./9/file1" [pid 601] chdir("./9" [pid 297] <... umount2 resumed>) = 0 [pid 296] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 295] <... rmdir resumed>) = 0 [pid 294] <... rmdir resumed>) = 0 [pid 601] <... chdir resumed>) = 0 [pid 297] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] getdents64(4, [pid 295] getdents64(3, [pid 294] getdents64(3, [pid 601] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... getdents64 resumed>0x555557290660 /* 0 entries */, 32768) = 0 [pid 295] <... getdents64 resumed>0x555557288620 /* 0 entries */, 32768) = 0 [pid 294] <... getdents64 resumed>0x555557288620 /* 0 entries */, 32768) = 0 [pid 601] <... prctl resumed>) = 0 [pid 297] lstat("./9/file1", [pid 296] close(4 [pid 295] close(3 [pid 294] close(3 [pid 601] setpgid(0, 0 [pid 297] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] <... close resumed>) = 0 [pid 295] <... close resumed>) = 0 [pid 294] <... close resumed>) = 0 [pid 601] <... setpgid resumed>) = 0 [pid 297] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] rmdir("./9/file1" [pid 295] rmdir("./8" [pid 294] rmdir("./9"./strace-static-x86_64: Process 602 attached [pid 601] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... rmdir resumed>) = 0 [pid 295] <... rmdir resumed>) = 0 [pid 294] <... rmdir resumed>) = 0 [pid 602] set_robust_list(0x7f600e02f9e0, 24 [pid 601] <... openat resumed>) = 3 [pid 297] openat(AT_FDCWD, "./9/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] getdents64(3, [pid 295] mkdir("./9", 0777 [pid 294] mkdir("./10", 0777 [pid 602] <... set_robust_list resumed>) = 0 [pid 601] write(3, "1000", 4 [pid 297] <... openat resumed>) = 4 [pid 296] <... getdents64 resumed>0x555557288620 /* 0 entries */, 32768) = 0 [pid 295] <... mkdir resumed>) = 0 [pid 294] <... mkdir resumed>) = 0 [pid 602] memfd_create("syzkaller", 0 [pid 601] <... write resumed>) = 4 [pid 297] fstat(4, [pid 296] close(3 [pid 295] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 294] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 602] <... memfd_create resumed>) = 3 [pid 601] close(3 [pid 297] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] <... close resumed>) = 0 [pid 295] <... openat resumed>) = 3 [pid 294] <... openat resumed>) = 3 [pid 602] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 601] <... close resumed>) = 0 [pid 297] getdents64(4, [pid 296] rmdir("./9" [pid 295] ioctl(3, LOOP_CLR_FD [pid 294] ioctl(3, LOOP_CLR_FD [pid 602] <... mmap resumed>) = 0x7f6005c0f000 [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 602] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 601] symlink("/dev/binderfs", "./binderfs" [pid 297] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 296] <... rmdir resumed>) = 0 [pid 295] close(3 [pid 294] close(3 [pid 602] <... write resumed>) = 262144 [pid 601] <... symlink resumed>) = 0 [pid 297] getdents64(4, [pid 296] mkdir("./10", 0777 [pid 295] <... close resumed>) = 0 [pid 294] <... close resumed>) = 0 [pid 601] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... getdents64 resumed>0x555557290660 /* 0 entries */, 32768) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 601] <... futex resumed>) = 0 [pid 297] close(4 [pid 296] <... mkdir resumed>) = 0 [pid 601] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 297] <... close resumed>) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 295] <... clone resumed>, child_tidptr=0x5555572875d0) = 603 [pid 294] <... clone resumed>, child_tidptr=0x5555572875d0) = 604 [pid 602] munmap(0x7f6005c0f000, 262144 [pid 601] <... mmap resumed>) = 0x7f600e00f000 [pid 297] rmdir("./9/file1" [pid 296] <... openat resumed>) = 3 [pid 602] <... munmap resumed>) = 0 [pid 602] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 601] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE [pid 297] <... rmdir resumed>) = 0 [pid 296] ioctl(3, LOOP_CLR_FD [pid 602] <... openat resumed>) = 4 [pid 601] <... mprotect resumed>) = 0 [pid 297] getdents64(3, [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 602] ioctl(4, LOOP_SET_FD, 3 [pid 297] <... getdents64 resumed>0x555557288620 /* 0 entries */, 32768) = 0 [pid 296] close(3 [pid 297] close(3./strace-static-x86_64: Process 604 attached [pid 601] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 297] <... close resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 297] rmdir("./9" [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 601] <... clone resumed>, parent_tid=[605], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 605 ./strace-static-x86_64: Process 603 attached [pid 297] <... rmdir resumed>) = 0 [pid 603] set_robust_list(0x5555572875e0, 24) = 0 [pid 603] chdir("./9" [pid 601] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] mkdir("./10", 0777 [pid 296] <... clone resumed>, child_tidptr=0x5555572875d0) = 606 [pid 601] <... futex resumed>) = 0 [pid 603] <... chdir resumed>) = 0 [pid 603] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 603] setpgid(0, 0) = 0 [pid 603] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 297] <... mkdir resumed>) = 0 [pid 601] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 297] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 603] <... openat resumed>) = 3 [pid 297] <... openat resumed>) = 3 [pid 297] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 297] close(3 [pid 603] write(3, "1000", 4 [pid 297] <... close resumed>) = 0 [pid 603] <... write resumed>) = 4 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 603] close(3) = 0 [pid 603] symlink("/dev/binderfs", "./binderfs") = 0 [pid 603] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 603] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 297] <... clone resumed>, child_tidptr=0x5555572875d0) = 607 [pid 603] <... mmap resumed>) = 0x7f600e00f000 [pid 603] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 603] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[608], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 608 [pid 603] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 603] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 606 attached [pid 606] set_robust_list(0x5555572875e0, 24) = 0 [pid 606] chdir("./10") = 0 [pid 606] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 606] setpgid(0, 0) = 0 [pid 604] set_robust_list(0x5555572875e0, 24 [pid 606] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 604] <... set_robust_list resumed>) = 0 [pid 606] <... openat resumed>) = 3 [pid 606] write(3, "1000", 4) = 4 [pid 606] close(3) = 0 [pid 606] symlink("/dev/binderfs", "./binderfs") = 0 [pid 604] chdir("./10") = 0 [pid 606] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 606] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 606] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 606] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 604] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 606] <... clone resumed>, parent_tid=[609], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 609 [pid 606] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 606] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 602] <... ioctl resumed>) = 0 [pid 602] close(3) = 0 [pid 602] mkdir("./file1", 0777 [pid 604] <... prctl resumed>) = 0 [pid 604] setpgid(0, 0) = 0 [pid 602] <... mkdir resumed>) = 0 ./strace-static-x86_64: Process 608 attached [pid 608] set_robust_list(0x7f600e02f9e0, 24) = 0 [pid 604] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 608] memfd_create("syzkaller", 0 [pid 602] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 604] <... openat resumed>) = 3 [pid 604] write(3, "1000", 4) = 4 [pid 604] close(3 [pid 608] <... memfd_create resumed>) = 3 [pid 604] <... close resumed>) = 0 [pid 608] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 604] symlink("/dev/binderfs", "./binderfs" [pid 608] <... mmap resumed>) = 0x7f6005c0f000 [pid 604] <... symlink resumed>) = 0 [pid 604] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 604] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 604] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE./strace-static-x86_64: Process 607 attached ./strace-static-x86_64: Process 605 attached ) = 0 [pid 604] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID./strace-static-x86_64: Process 609 attached [pid 609] set_robust_list(0x7f600e02f9e0, 24) = 0 [pid 609] memfd_create("syzkaller", 0 [pid 604] <... clone resumed>, parent_tid=[610], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 610 [pid 608] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 607] set_robust_list(0x5555572875e0, 24 [pid 605] set_robust_list(0x7f600e02f9e0, 24 [pid 604] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 609] <... memfd_create resumed>) = 3 [pid 604] <... futex resumed>) = 0 [pid 609] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 [pid 607] <... set_robust_list resumed>) = 0 [pid 604] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 605] <... set_robust_list resumed>) = 0 ./strace-static-x86_64: Process 610 attached [pid 607] chdir("./10" [pid 605] memfd_create("syzkaller", 0 [pid 610] set_robust_list(0x7f600e02f9e0, 24 [pid 607] <... chdir resumed>) = 0 [pid 605] <... memfd_create resumed>) = 3 [pid 610] <... set_robust_list resumed>) = 0 [pid 609] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 607] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 605] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 607] <... prctl resumed>) = 0 [pid 605] <... mmap resumed>) = 0x7f6005c0f000 [pid 608] <... write resumed>) = 262144 [pid 607] setpgid(0, 0 [pid 608] munmap(0x7f6005c0f000, 262144) = 0 [pid 608] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 4 [pid 608] ioctl(4, LOOP_SET_FD, 3 [pid 607] <... setpgid resumed>) = 0 [pid 607] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 607] write(3, "1000", 4 [pid 610] memfd_create("syzkaller", 0 [pid 607] <... write resumed>) = 4 [pid 605] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 607] close(3 [pid 609] <... write resumed>) = 262144 [pid 607] <... close resumed>) = 0 [pid 605] <... write resumed>) = 262144 [pid 610] <... memfd_create resumed>) = 3 [pid 607] symlink("/dev/binderfs", "./binderfs" [pid 609] munmap(0x7f6005c0f000, 262144) = 0 [pid 609] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 609] ioctl(4, LOOP_SET_FD, 3 [pid 610] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 607] <... symlink resumed>) = 0 [pid 605] munmap(0x7f6005c0f000, 262144 [pid 607] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 607] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 610] <... mmap resumed>) = 0x7f6005c0f000 [pid 609] <... ioctl resumed>) = 0 [pid 608] <... ioctl resumed>) = 0 [pid 607] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE [pid 605] <... munmap resumed>) = 0 [ 23.038069][ T602] loop0: detected capacity change from 0 to 512 [ 23.065226][ T608] loop2: detected capacity change from 0 to 512 [ 23.073607][ T609] loop3: detected capacity change from 0 to 512 [ 23.081335][ T602] EXT4-fs (loop0): 1 orphan inode deleted [pid 610] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 609] close(3 [pid 608] close(3 [pid 607] <... mprotect resumed>) = 0 [pid 605] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 4 [pid 610] <... write resumed>) = 262144 [pid 609] <... close resumed>) = 0 [pid 608] <... close resumed>) = 0 [pid 607] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 605] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 613 attached [pid 610] munmap(0x7f6005c0f000, 262144 [pid 609] mkdir("./file1", 0777 [pid 608] mkdir("./file1", 0777 [pid 602] <... mount resumed>) = 0 [pid 610] <... munmap resumed>) = 0 [pid 609] <... mkdir resumed>) = 0 [pid 608] <... mkdir resumed>) = 0 [pid 607] <... clone resumed>, parent_tid=[613], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 613 [pid 602] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 610] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 609] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 608] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 607] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 602] <... openat resumed>) = 3 [pid 610] <... openat resumed>) = 4 [pid 607] <... futex resumed>) = 0 [pid 602] chdir("./file1" [pid 605] <... ioctl resumed>) = 0 [pid 610] ioctl(4, LOOP_SET_FD, 3 [pid 607] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 605] close(3 [pid 602] <... chdir resumed>) = 0 [pid 605] <... close resumed>) = 0 [pid 602] ioctl(4, LOOP_CLR_FD) = 0 [pid 605] mkdir("./file1", 0777 [pid 602] close(4) = 0 [pid 602] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 600] <... futex resumed>) = 0 [pid 602] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 600] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 602] <... open resumed>) = 4 [pid 600] <... futex resumed>) = 0 [pid 602] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 600] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 602] <... futex resumed>) = 0 [pid 600] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 602] fallocate(4, 0, 35143, 7 [pid 600] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 602] <... fallocate resumed>) = 0 [pid 600] <... futex resumed>) = 0 [pid 602] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 600] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 602] <... futex resumed>) = 0 [pid 600] <... futex resumed>) = 0 [pid 602] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 600] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6005c2e000 [pid 600] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 600] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[616], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 616 [pid 600] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 600] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 613] set_robust_list(0x7f600e02f9e0, 24) = 0 [pid 613] memfd_create("syzkaller", 0) = 3 [pid 613] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 [pid 610] <... ioctl resumed>) = 0 [ 23.087313][ T602] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 23.098693][ T602] ext4 filesystem being mounted at /root/syzkaller.SN8fLk/10/file1 supports timestamps until 2038 (0x7fffffff) [ 23.101911][ T605] loop5: detected capacity change from 0 to 512 [ 23.117435][ T610] loop1: detected capacity change from 0 to 512 ./strace-static-x86_64: Process 616 attached [pid 616] set_robust_list(0x7f6005c4e9e0, 24) = 0 [pid 616] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0 [pid 616] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 600] <... futex resumed>) = 0 [pid 600] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 602] <... futex resumed>) = 0 [pid 600] <... futex resumed>) = 1 [pid 602] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 600] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 602] <... open resumed>) = 5 [pid 602] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 600] <... futex resumed>) = 0 [pid 602] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 600] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 602] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 600] <... futex resumed>) = 0 [pid 602] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 600] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 602] <... futex resumed>) = 0 [pid 600] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 602] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 600] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 600] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 616] <... futex resumed>) = 1 [pid 616] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 605] <... mkdir resumed>) = 0 [pid 605] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 610] close(3) = 0 [pid 610] mkdir("./file1", 0777) = 0 [pid 610] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 613] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 613] munmap(0x7f6005c0f000, 262144) = 0 [pid 613] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 613] ioctl(4, LOOP_SET_FD, 3 [pid 602] <... write resumed>) = 262144 [pid 602] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 600] <... futex resumed>) = 0 [pid 602] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 600] exit_group(0 [pid 602] <... futex resumed>) = ? [pid 600] <... exit_group resumed>) = ? [pid 602] +++ exited with 0 +++ [pid 613] <... ioctl resumed>) = 0 [pid 613] close(3) = 0 [pid 613] mkdir("./file1", 0777 [pid 616] <... futex resumed>) = ? [pid 613] <... mkdir resumed>) = 0 [pid 613] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 616] +++ exited with 0 +++ [pid 600] +++ exited with 0 +++ [pid 293] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=600, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 293] umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 293] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 293] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 293] getdents64(3, 0x555557288620 /* 4 entries */, 32768) = 112 [pid 609] <... mount resumed>) = 0 [pid 609] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 609] chdir("./file1") = 0 [pid 609] ioctl(4, LOOP_CLR_FD) = 0 [pid 609] close(4) = 0 [pid 609] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 606] <... futex resumed>) = 0 [pid 606] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 606] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 609] <... futex resumed>) = 1 [pid 609] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 609] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 606] <... futex resumed>) = 0 [pid 606] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 606] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 606] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6005c2e000 [pid 606] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 606] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[621], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 621 [pid 606] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 606] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 609] <... futex resumed>) = 1 [pid 609] fallocate(4, 0, 35143, 7) = 0 [pid 609] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 609] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 293] umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 293] lstat("./10/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 293] unlink("./10/binderfs") = 0 [ 23.133173][ T609] EXT4-fs (loop3): 1 orphan inode deleted [ 23.139631][ T613] loop4: detected capacity change from 0 to 512 [ 23.148041][ T609] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 23.159826][ T609] ext4 filesystem being mounted at /root/syzkaller.2mSqAy/10/file1 supports timestamps until 2038 (0x7fffffff) [ 23.162427][ T608] EXT4-fs (loop2): 1 orphan inode deleted [pid 293] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 621 attached [pid 608] <... mount resumed>) = 0 [pid 621] set_robust_list(0x7f6005c4e9e0, 24 [ 23.178388][ T608] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 23.179249][ T610] EXT4-fs (loop1): 1 orphan inode deleted [ 23.192428][ T608] ext4 filesystem being mounted at /root/syzkaller.qF1bbv/9/file1 supports timestamps until 2038 (0x7fffffff) [ 23.201126][ T605] EXT4-fs (loop5): 1 orphan inode deleted [ 23.206475][ T610] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 23.223070][ T610] ext4 filesystem being mounted at /root/syzkaller.6GNILo/10/file1 supports timestamps until 2038 (0x7fffffff) [pid 608] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 621] <... set_robust_list resumed>) = 0 [pid 610] <... mount resumed>) = 0 [pid 608] <... openat resumed>) = 3 [pid 606] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 621] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 610] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 608] chdir("./file1" [pid 606] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 621] <... mount resumed>) = 0 [pid 610] <... openat resumed>) = 3 [pid 609] <... futex resumed>) = 0 [pid 608] <... chdir resumed>) = 0 [pid 606] <... futex resumed>) = 1 [pid 621] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 610] chdir("./file1" [pid 609] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 608] ioctl(4, LOOP_CLR_FD [pid 606] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 621] <... futex resumed>) = 0 [pid 610] <... chdir resumed>) = 0 [pid 609] <... open resumed>) = 5 [pid 608] <... ioctl resumed>) = 0 [pid 621] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 610] ioctl(4, LOOP_CLR_FD [pid 609] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 608] close(4 [pid 610] <... ioctl resumed>) = 0 [pid 609] <... futex resumed>) = 1 [pid 608] <... close resumed>) = 0 [pid 606] <... futex resumed>) = 0 [pid 610] close(4 [pid 609] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 608] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 606] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 610] <... close resumed>) = 0 [pid 609] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 608] <... futex resumed>) = 1 [pid 606] <... futex resumed>) = 0 [pid 603] <... futex resumed>) = 0 [pid 610] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 609] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 608] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 606] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 603] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 610] <... futex resumed>) = 1 [pid 609] <... futex resumed>) = 0 [pid 606] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 604] <... futex resumed>) = 0 [pid 603] <... futex resumed>) = 0 [pid 610] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 609] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 606] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 604] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 603] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 606] <... futex resumed>) = 0 [pid 604] <... futex resumed>) = 0 [pid 606] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 604] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 610] <... open resumed>) = 4 [pid 608] <... open resumed>) = 4 [pid 610] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 608] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 604] <... futex resumed>) = 0 [pid 610] fallocate(4, 0, 35143, 7 [pid 608] <... futex resumed>) = 1 [pid 604] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 603] <... futex resumed>) = 0 [pid 613] <... mount resumed>) = 0 [pid 610] <... fallocate resumed>) = 0 [pid 608] fallocate(4, 0, 35143, 7 [pid 604] <... futex resumed>) = 0 [pid 603] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 613] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 610] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 608] <... fallocate resumed>) = 0 [pid 604] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 603] <... futex resumed>) = 0 [pid 613] chdir("./file1" [pid 608] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 603] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 608] <... futex resumed>) = 0 [pid 603] <... futex resumed>) = 0 [pid 613] <... chdir resumed>) = 0 [pid 608] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 603] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 613] ioctl(4, LOOP_CLR_FD) = 0 [pid 610] <... futex resumed>) = 0 [pid 609] <... write resumed>) = 262144 [pid 608] <... mount resumed>) = 0 [pid 604] <... futex resumed>) = 0 [pid 613] close(4 [pid 610] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 609] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 608] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 604] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 609] <... futex resumed>) = 1 [pid 608] <... futex resumed>) = 1 [pid 603] <... futex resumed>) = 0 [pid 606] <... futex resumed>) = 0 [pid 604] <... mmap resumed>) = 0x7f6005c2e000 [pid 606] exit_group(0 [pid 604] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE [pid 621] <... futex resumed>) = ? [pid 606] <... exit_group resumed>) = ? [pid 604] <... mprotect resumed>) = 0 [pid 621] +++ exited with 0 +++ [pid 604] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[627], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 627 [pid 604] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 604] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 608] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 603] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 609] +++ exited with 0 +++ [pid 606] +++ exited with 0 +++ [pid 603] <... futex resumed>) = 0 [pid 603] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=606, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 608] <... open resumed>) = 5 [pid 296] umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW [pid 608] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 608] <... futex resumed>) = 1 [pid 603] <... futex resumed>) = 0 [pid 296] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 608] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 603] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... openat resumed>) = 3 [pid 608] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 603] <... futex resumed>) = 0 [pid 296] fstat(3, [pid 608] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 603] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 608] <... futex resumed>) = 0 [pid 603] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 296] getdents64(3, [pid 608] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 603] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... getdents64 resumed>0x555557288620 /* 4 entries */, 32768) = 112 [pid 603] <... futex resumed>) = 0 [pid 296] umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 603] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] lstat("./10/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 296] unlink("./10/binderfs") = 0 [pid 296] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 627 attached [pid 627] set_robust_list(0x7f6005c4e9e0, 24) = 0 [pid 627] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL) = 0 [pid 627] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 627] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 604] <... futex resumed>) = 0 [pid 604] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 605] <... mount resumed>) = 0 [pid 605] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 610] <... futex resumed>) = 0 [pid 604] <... futex resumed>) = 1 [pid 610] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 604] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 610] <... open resumed>) = 5 [pid 610] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 605] chdir("./file1" [pid 610] <... futex resumed>) = 1 [pid 604] <... futex resumed>) = 0 [pid 604] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 610] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 604] <... futex resumed>) = 0 [pid 605] <... chdir resumed>) = 0 [pid 605] ioctl(4, LOOP_CLR_FD) = 0 [pid 605] close(4) = 0 [pid 610] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 604] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 610] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 608] <... write resumed>) = 262144 [pid 610] <... futex resumed>) = 1 [pid 604] <... futex resumed>) = 0 [pid 604] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 610] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 608] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 604] <... futex resumed>) = 0 [pid 605] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 604] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 601] <... futex resumed>) = 0 [pid 601] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 601] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 605] <... futex resumed>) = 1 [pid 605] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 605] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 601] <... futex resumed>) = 0 [pid 601] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 601] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 610] <... write resumed>) = 262144 [pid 601] <... futex resumed>) = 0 [pid 601] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6005c2e000 [pid 601] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE [pid 610] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 608] <... futex resumed>) = 1 [pid 603] <... futex resumed>) = 0 [pid 601] <... mprotect resumed>) = 0 [pid 603] exit_group(0 [pid 610] <... futex resumed>) = 1 [pid 601] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 604] <... futex resumed>) = 0 [pid 603] <... exit_group resumed>) = ? [pid 604] exit_group(0) = ? [pid 627] <... futex resumed>) = 231 [pid 601] <... clone resumed>, parent_tid=[628], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 628 [pid 627] +++ exited with 0 +++ [pid 601] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 601] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 605] <... futex resumed>) = 1 [pid 605] fallocate(4, 0, 35143, 7 [pid 610] +++ exited with 0 +++ [pid 605] <... fallocate resumed>) = 0 [pid 604] +++ exited with 0 +++ [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=604, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 294] restart_syscall(<... resuming interrupted clone ...> [pid 605] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 605] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 294] <... restart_syscall resumed>) = 0 [pid 294] umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 294] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 294] getdents64(3, 0x555557288620 /* 4 entries */, 32768) = 112 [pid 294] umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] lstat("./10/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 294] unlink("./10/binderfs" [pid 608] +++ exited with 0 +++ [pid 603] +++ exited with 0 +++ [pid 294] <... unlink resumed>) = 0 [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=603, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 294] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 295] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] getdents64(3, 0x555557288620 /* 4 entries */, 32768) = 112 [pid 295] umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] lstat("./9/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 295] unlink("./9/binderfs") = 0 [pid 295] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 613] <... close resumed>) = 0 ./strace-static-x86_64: Process 628 attached [pid 293] <... umount2 resumed>) = 0 [pid 293] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 613] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 293] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 613] <... futex resumed>) = 1 [pid 607] <... futex resumed>) = 0 [pid 293] lstat("./10/file1", [pid 607] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 293] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 613] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 607] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 293] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 613] <... open resumed>) = 4 [pid 293] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 613] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 293] openat(AT_FDCWD, "./10/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 613] <... futex resumed>) = 1 [pid 607] <... futex resumed>) = 0 [pid 607] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 613] fallocate(4, 0, 35143, 7 [pid 293] <... openat resumed>) = 4 [pid 607] <... futex resumed>) = 0 [pid 293] fstat(4, [pid 613] <... fallocate resumed>) = 0 [pid 607] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 293] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 607] <... futex resumed>) = 0 [pid 613] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 293] getdents64(4, [pid 607] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6005c2e000 [pid 613] <... futex resumed>) = 0 [pid 607] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE [pid 293] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 613] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 607] <... mprotect resumed>) = 0 [pid 293] getdents64(4, [pid 607] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 293] <... getdents64 resumed>0x555557290660 /* 0 entries */, 32768) = 0 [pid 607] <... clone resumed>, parent_tid=[630], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 630 [pid 293] close(4 [pid 607] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 293] <... close resumed>) = 0 [pid 607] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 293] rmdir("./10/file1") = 0 [pid 293] getdents64(3, 0x555557288620 /* 0 entries */, 32768) = 0 [ 23.224884][ T613] EXT4-fs (loop4): 1 orphan inode deleted [ 23.235036][ T605] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 23.241253][ T613] ext4 filesystem being mounted at /root/syzkaller.IrUvXE/10/file1 supports timestamps until 2038 (0x7fffffff) [ 23.258494][ T605] ext4 filesystem being mounted at /root/syzkaller.kumyKI/9/file1 supports timestamps until 2038 (0x7fffffff) [pid 293] close(3) = 0 [pid 293] rmdir("./10" [pid 628] set_robust_list(0x7f6005c4e9e0, 24 [pid 293] <... rmdir resumed>) = 0 [pid 628] <... set_robust_list resumed>) = 0 [pid 293] mkdir("./11", 0777) = 0 [pid 293] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 628] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 293] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 293] close(3) = 0 [pid 293] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555572875d0) = 631 ./strace-static-x86_64: Process 631 attached [pid 631] set_robust_list(0x5555572875e0, 24) = 0 [pid 631] chdir("./11") = 0 [pid 631] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 631] setpgid(0, 0) = 0 [pid 631] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 631] write(3, "1000", 4) = 4 [pid 631] close(3) = 0 [pid 631] symlink("/dev/binderfs", "./binderfs") = 0 [pid 631] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 631] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 631] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 631] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[632], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 632 [pid 631] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 631] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 632 attached [pid 632] set_robust_list(0x7f600e02f9e0, 24) = 0 [pid 632] memfd_create("syzkaller", 0) = 3 [pid 632] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 [pid 628] <... mount resumed>) = 0 [pid 632] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 628] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 632] <... write resumed>) = 262144 [pid 632] munmap(0x7f6005c0f000, 262144) = 0 [pid 632] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 632] ioctl(4, LOOP_SET_FD, 3 [pid 628] <... futex resumed>) = 1 [pid 601] <... futex resumed>) = 0 [pid 601] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 605] <... futex resumed>) = 0 [pid 601] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 605] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 5 [pid 605] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 601] <... futex resumed>) = 0 [pid 605] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 601] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 605] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 601] <... futex resumed>) = 0 [pid 605] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 601] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 605] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 605] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 601] <... futex resumed>) = 0 [pid 632] <... ioctl resumed>) = 0 [pid 632] close(3) = 0 [pid 632] mkdir("./file1", 0777 [pid 605] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 601] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 632] <... mkdir resumed>) = 0 [pid 632] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 601] <... futex resumed>) = 0 [pid 601] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 605] <... write resumed>) = 262144 [pid 605] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 601] <... futex resumed>) = 0 [pid 605] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 601] exit_group(0) = ? [pid 605] <... futex resumed>) = ? [pid 605] +++ exited with 0 +++ [pid 294] <... umount2 resumed>) = 0 [pid 294] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] lstat("./10/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 294] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] openat(AT_FDCWD, "./10/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 294] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 294] getdents64(4, 0x555557290660 /* 2 entries */, 32768) = 48 [pid 294] getdents64(4, 0x555557290660 /* 0 entries */, 32768) = 0 [pid 294] close(4) = 0 [pid 294] rmdir("./10/file1") = 0 [pid 294] getdents64(3, 0x555557288620 /* 0 entries */, 32768) = 0 [pid 294] close(3) = 0 [pid 628] +++ exited with 0 +++ [pid 601] +++ exited with 0 +++ [pid 294] rmdir("./10" [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=601, si_uid=0, si_status=0, si_utime=0, si_stime=7} --- [pid 294] <... rmdir resumed>) = 0 [pid 298] umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] mkdir("./11", 0777 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 298] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] getdents64(3, 0x555557288620 /* 4 entries */, 32768) = 112 [pid 294] <... mkdir resumed>) = 0 [pid 298] umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = 0 [pid 294] <... openat resumed>) = 3 [pid 298] lstat("./9/binderfs", [pid 296] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] ioctl(3, LOOP_CLR_FD [pid 298] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 298] unlink("./9/binderfs") = 0 [pid 298] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 294] close(3 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... close resumed>) = 0 [pid 296] lstat("./10/file1", [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 294] <... clone resumed>, child_tidptr=0x5555572875d0) = 634 [pid 296] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 634 attached [pid 296] openat(AT_FDCWD, "./10/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 634] set_robust_list(0x5555572875e0, 24) = 0 [pid 634] chdir("./11") = 0 [pid 634] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 296] <... openat resumed>) = 4 ./strace-static-x86_64: Process 630 attached [pid 634] <... prctl resumed>) = 0 [pid 296] fstat(4, [pid 630] set_robust_list(0x7f6005c4e9e0, 24 [pid 634] setpgid(0, 0) = 0 [pid 634] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 634] write(3, "1000", 4) = 4 [pid 634] close(3) = 0 [pid 634] symlink("/dev/binderfs", "./binderfs") = 0 [pid 634] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 634] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 634] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 634] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[636], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 636 [pid 634] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 634] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 636 attached [pid 636] set_robust_list(0x7f600e02f9e0, 24) = 0 [pid 636] memfd_create("syzkaller", 0) = 3 [pid 636] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 [pid 636] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 636] munmap(0x7f6005c0f000, 262144) = 0 [pid 636] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4 [pid 636] ioctl(4, LOOP_SET_FD, 3 [pid 632] <... mount resumed>) = 0 [pid 630] <... set_robust_list resumed>) = 0 [pid 607] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 630] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 607] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] getdents64(4, [pid 630] <... mount resumed>) = 0 [pid 613] <... futex resumed>) = 0 [pid 607] <... futex resumed>) = 1 [pid 296] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 630] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 613] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 607] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] getdents64(4, [pid 630] <... futex resumed>) = 0 [pid 613] <... open resumed>) = 5 [pid 296] <... getdents64 resumed>0x555557290660 /* 0 entries */, 32768) = 0 [pid 630] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 613] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] close(4 [pid 613] <... futex resumed>) = 1 [pid 607] <... futex resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 613] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 607] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] rmdir("./10/file1" [pid 613] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 607] <... futex resumed>) = 0 [pid 296] <... rmdir resumed>) = 0 [pid 613] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 607] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] getdents64(3, [pid 613] <... futex resumed>) = 0 [pid 607] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 296] <... getdents64 resumed>0x555557288620 /* 0 entries */, 32768) = 0 [pid 613] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 607] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] close(3 [pid 607] <... futex resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 607] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] rmdir("./10") = 0 [pid 296] mkdir("./11", 0777) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 296] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 296] close(3) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 637 attached [pid 636] <... ioctl resumed>) = 0 [pid 296] <... clone resumed>, child_tidptr=0x5555572875d0) = 637 [pid 636] close(3 [pid 637] set_robust_list(0x5555572875e0, 24 [pid 636] <... close resumed>) = 0 [pid 613] <... write resumed>) = 262144 [pid 613] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 607] <... futex resumed>) = 0 [pid 613] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 607] exit_group(0 [pid 630] <... futex resumed>) = ? [pid 613] <... futex resumed>) = ? [pid 607] <... exit_group resumed>) = ? [pid 637] <... set_robust_list resumed>) = 0 [pid 636] mkdir("./file1", 0777 [pid 630] +++ exited with 0 +++ [pid 613] +++ exited with 0 +++ [pid 607] +++ exited with 0 +++ [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=607, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 297] restart_syscall(<... resuming interrupted clone ...> [pid 632] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 632] chdir("./file1") = 0 [pid 632] ioctl(4, LOOP_CLR_FD) = 0 [pid 632] close(4) = 0 [pid 632] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 632] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 631] <... futex resumed>) = 0 [pid 297] <... restart_syscall resumed>) = 0 [pid 636] <... mkdir resumed>) = 0 [pid 631] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW [pid 631] <... futex resumed>) = 1 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 297] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] getdents64(3, 0x555557288620 /* 4 entries */, 32768) = 112 [pid 297] umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] lstat("./10/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 297] unlink("./10/binderfs" [pid 632] <... futex resumed>) = 0 [pid 631] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] <... unlink resumed>) = 0 [pid 637] chdir("./11" [pid 297] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 637] <... chdir resumed>) = 0 [pid 632] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 636] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 637] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 637] setpgid(0, 0 [pid 632] <... open resumed>) = 4 [pid 632] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 631] <... futex resumed>) = 0 [pid 637] <... setpgid resumed>) = 0 [pid 631] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 637] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 631] <... futex resumed>) = 0 [pid 637] <... openat resumed>) = 3 [pid 631] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 637] write(3, "1000", 4 [pid 631] <... futex resumed>) = 0 [pid 631] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6005c2e000 [pid 631] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 637] <... write resumed>) = 4 [pid 631] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 637] close(3) = 0 [pid 637] symlink("/dev/binderfs", "./binderfs") = 0 [pid 632] fallocate(4, 0, 35143, 7 [pid 631] <... clone resumed>, parent_tid=[638], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 638 [pid 637] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 637] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 631] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 637] <... mmap resumed>) = 0x7f600e00f000 [pid 631] <... futex resumed>) = 0 [pid 637] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE [pid 631] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 637] <... mprotect resumed>) = 0 [pid 637] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[639], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 639 [pid 637] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 637] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 638 attached [pid 638] set_robust_list(0x7f6005c4e9e0, 24) = 0 [pid 638] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL./strace-static-x86_64: Process 639 attached [pid 639] set_robust_list(0x7f600e02f9e0, 24) = 0 [pid 639] memfd_create("syzkaller", 0) = 3 [pid 639] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 [pid 638] <... mount resumed>) = 0 [pid 638] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 631] <... futex resumed>) = 0 [pid 638] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 631] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 638] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 631] <... futex resumed>) = 0 [pid 638] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 631] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 638] <... open resumed>) = 5 [pid 638] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 631] <... futex resumed>) = 0 [pid 638] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 631] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 638] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 631] <... futex resumed>) = 0 [pid 638] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 631] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 638] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 638] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 631] <... futex resumed>) = 0 [pid 638] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 631] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 638] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 631] <... futex resumed>) = 0 [pid 638] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 631] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 638] <... write resumed>) = 262144 [pid 632] <... fallocate resumed>) = 0 [pid 298] <... umount2 resumed>) = 0 [pid 295] <... umount2 resumed>) = 0 [pid 638] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 631] <... futex resumed>) = 0 [pid 638] <... futex resumed>) = 1 [pid 638] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] lstat("./9/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] lstat("./9/file1", [pid 298] openat(AT_FDCWD, "./9/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] <... openat resumed>) = 4 [pid 295] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] fstat(4, [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] openat(AT_FDCWD, "./9/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] getdents64(4, [pid 295] <... openat resumed>) = 4 [pid 298] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 295] fstat(4, [pid 298] getdents64(4, [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] <... getdents64 resumed>0x555557290660 /* 0 entries */, 32768) = 0 [pid 295] getdents64(4, [pid 298] close(4 [pid 295] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 298] <... close resumed>) = 0 [pid 295] getdents64(4, [pid 298] rmdir("./9/file1" [pid 295] <... getdents64 resumed>0x555557290660 /* 0 entries */, 32768) = 0 [ 23.329700][ T632] loop0: detected capacity change from 0 to 512 [ 23.354370][ T632] EXT4-fs (loop0): 1 orphan inode deleted [ 23.360009][ T632] ext4 filesystem being mounted at /root/syzkaller.SN8fLk/11/file1 supports timestamps until 2038 (0x7fffffff) [ 23.370451][ T636] loop1: detected capacity change from 0 to 512 [pid 632] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... rmdir resumed>) = 0 [pid 295] close(4 [pid 632] <... futex resumed>) = 0 [pid 631] exit_group(0 [pid 298] getdents64(3, [pid 295] <... close resumed>) = 0 [pid 631] <... exit_group resumed>) = ? [pid 298] <... getdents64 resumed>0x555557288620 /* 0 entries */, 32768) = 0 [pid 295] rmdir("./9/file1" [pid 298] close(3 [pid 295] <... rmdir resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 295] getdents64(3, [pid 298] rmdir("./9" [pid 295] <... getdents64 resumed>0x555557288620 /* 0 entries */, 32768) = 0 [pid 298] <... rmdir resumed>) = 0 [pid 295] close(3 [pid 298] mkdir("./10", 0777 [pid 295] <... close resumed>) = 0 [pid 298] <... mkdir resumed>) = 0 [pid 297] <... umount2 resumed>) = 0 [pid 295] rmdir("./9" [pid 638] <... futex resumed>) = ? [pid 297] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 638] +++ exited with 0 +++ [pid 298] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... rmdir resumed>) = 0 [pid 298] <... openat resumed>) = 3 [pid 295] mkdir("./10", 0777 [pid 298] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 295] <... mkdir resumed>) = 0 [pid 298] close(3 [pid 295] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 298] <... close resumed>) = 0 [pid 295] <... openat resumed>) = 3 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 298] <... clone resumed>, child_tidptr=0x5555572875d0) = 642 [pid 295] close(3) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555572875d0) = 643 [pid 297] lstat("./10/file1", [pid 639] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 639] munmap(0x7f6005c0f000, 262144) = 0 [pid 639] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 639] ioctl(4, LOOP_SET_FD, 3 [pid 632] +++ exited with 0 +++ [pid 631] +++ exited with 0 +++ [pid 297] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 293] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=631, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 639] <... ioctl resumed>) = 0 [pid 639] close(3) = 0 [pid 639] mkdir("./file1", 0777 [pid 297] openat(AT_FDCWD, "./10/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 293] umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW [pid 639] <... mkdir resumed>) = 0 [pid 297] fstat(4, [pid 293] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 639] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 297] getdents64(4, [pid 293] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 293] <... openat resumed>) = 3 [pid 293] fstat(3, [pid 297] getdents64(4, [pid 293] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] <... getdents64 resumed>0x555557290660 /* 0 entries */, 32768) = 0 [pid 293] getdents64(3, [pid 297] close(4./strace-static-x86_64: Process 642 attached ) = 0 [pid 293] <... getdents64 resumed>0x555557288620 /* 4 entries */, 32768) = 112 [pid 642] set_robust_list(0x5555572875e0, 24) = 0 [pid 642] chdir("./10") = 0 [pid 642] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 642] setpgid(0, 0) = 0 [pid 642] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 297] rmdir("./10/file1" [pid 293] umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 642] write(3, "1000", 4) = 4 [pid 642] close(3) = 0 [pid 642] symlink("/dev/binderfs", "./binderfs" [pid 297] <... rmdir resumed>) = 0 [pid 293] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] getdents64(3, [pid 293] lstat("./11/binderfs", [pid 297] <... getdents64 resumed>0x555557288620 /* 0 entries */, 32768) = 0 [pid 293] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 293] unlink("./11/binderfs" [pid 297] close(3 [pid 293] <... unlink resumed>) = 0 [pid 297] <... close resumed>) = 0 [pid 293] umount2("./11/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] rmdir("./10" [pid 642] <... symlink resumed>) = 0 [pid 642] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 642] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 642] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE [pid 297] <... rmdir resumed>) = 0 [pid 297] mkdir("./11", 0777 [pid 642] <... mprotect resumed>) = 0 [pid 642] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[644], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 644 [pid 642] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... mkdir resumed>) = 0 [pid 642] <... futex resumed>) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 642] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 297] <... openat resumed>) = 3 [pid 297] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 297] close(3) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555572875d0) = 645 ./strace-static-x86_64: Process 643 attached [pid 636] <... mount resumed>) = 0 [pid 643] set_robust_list(0x5555572875e0, 24 [pid 636] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 643] <... set_robust_list resumed>) = 0 [pid 643] chdir("./10") = 0 [pid 643] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 643] setpgid(0, 0) = 0 [pid 643] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 643] write(3, "1000", 4) = 4 [pid 643] close(3) = 0 [pid 643] symlink("/dev/binderfs", "./binderfs" [pid 636] <... openat resumed>) = 3 [pid 643] <... symlink resumed>) = 0 [pid 636] chdir("./file1" [pid 643] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 636] <... chdir resumed>) = 0 [pid 643] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 636] ioctl(4, LOOP_CLR_FD [pid 643] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE./strace-static-x86_64: Process 644 attached ) = 0 [pid 636] <... ioctl resumed>) = 0 [pid 644] set_robust_list(0x7f600e02f9e0, 24 [pid 643] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 636] close(4 [pid 644] <... set_robust_list resumed>) = 0 [pid 636] <... close resumed>) = 0 [pid 643] <... clone resumed>, parent_tid=[647], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 647 [pid 643] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 636] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 643] <... futex resumed>) = 0 [pid 643] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 636] <... futex resumed>) = 1 [pid 634] <... futex resumed>) = 0 [pid 634] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 636] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 634] <... futex resumed>) = 0 [pid 644] memfd_create("syzkaller", 0 [pid 634] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 647 attached [pid 636] <... open resumed>) = 4 [pid 644] <... memfd_create resumed>) = 3 [pid 636] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 647] set_robust_list(0x7f600e02f9e0, 24 [pid 644] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 636] <... futex resumed>) = 1 [pid 634] <... futex resumed>) = 0 [pid 644] <... mmap resumed>) = 0x7f6005c0f000 [pid 636] fallocate(4, 0, 35143, 7 [pid 634] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 634] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 634] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 636] <... fallocate resumed>) = 0 [pid 634] <... mmap resumed>) = 0x7f6005c2e000 [pid 636] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 634] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE [pid 636] <... futex resumed>) = 0 [pid 634] <... mprotect resumed>) = 0 [pid 636] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 634] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[648], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 648 [pid 634] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 634] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 647] <... set_robust_list resumed>) = 0 [pid 647] memfd_create("syzkaller", 0) = 3 [pid 644] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 647] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0./strace-static-x86_64: Process 645 attached ) = 0x7f6005c0f000 [pid 293] <... umount2 resumed>) = 0 [pid 293] umount2("./11/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 645] set_robust_list(0x5555572875e0, 24) = 0 [pid 293] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 293] lstat("./11/file1", [pid 645] chdir("./11" [pid 293] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 645] <... chdir resumed>) = 0 [pid 293] umount2("./11/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 645] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 293] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 645] <... prctl resumed>) = 0 [pid 293] openat(AT_FDCWD, "./11/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 645] setpgid(0, 0 [pid 293] <... openat resumed>) = 4 [pid 645] <... setpgid resumed>) = 0 [pid 293] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 293] getdents64(4, [pid 645] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 644] <... write resumed>) = 262144 [pid 293] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 647] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 647] munmap(0x7f6005c0f000, 262144) = 0 [pid 647] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 4 [ 23.403186][ T636] EXT4-fs (loop1): 1 orphan inode deleted [ 23.409157][ T636] ext4 filesystem being mounted at /root/syzkaller.6GNILo/11/file1 supports timestamps until 2038 (0x7fffffff) [ 23.414656][ T639] loop3: detected capacity change from 0 to 512 [pid 647] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 648 attached [pid 645] <... openat resumed>) = 3 [pid 644] munmap(0x7f6005c0f000, 262144 [pid 293] getdents64(4, [pid 647] <... ioctl resumed>) = 0 [pid 647] close(3) = 0 [pid 647] mkdir("./file1", 0777 [pid 293] <... getdents64 resumed>0x555557290660 /* 0 entries */, 32768) = 0 [pid 647] <... mkdir resumed>) = 0 [pid 647] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 293] close(4 [pid 645] write(3, "1000", 4 [pid 293] <... close resumed>) = 0 [pid 645] <... write resumed>) = 4 [pid 644] <... munmap resumed>) = 0 [pid 293] rmdir("./11/file1" [pid 648] set_robust_list(0x7f6005c4e9e0, 24 [pid 645] close(3 [pid 644] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 293] <... rmdir resumed>) = 0 [pid 645] <... close resumed>) = 0 [pid 293] getdents64(3, [pid 648] <... set_robust_list resumed>) = 0 [pid 645] symlink("/dev/binderfs", "./binderfs" [pid 644] <... openat resumed>) = 4 [pid 293] <... getdents64 resumed>0x555557288620 /* 0 entries */, 32768) = 0 [pid 648] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 293] close(3 [pid 645] <... symlink resumed>) = 0 [pid 644] ioctl(4, LOOP_SET_FD, 3 [pid 648] <... mount resumed>) = 0 [pid 293] <... close resumed>) = 0 [pid 645] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 293] rmdir("./11") = 0 [pid 645] <... futex resumed>) = 0 [pid 645] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 293] mkdir("./12", 0777) = 0 [pid 293] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 645] <... mmap resumed>) = 0x7f600e00f000 [pid 293] <... openat resumed>) = 3 [pid 293] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 293] close(3) = 0 [pid 293] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555572875d0) = 650 ./strace-static-x86_64: Process 650 attached [pid 650] set_robust_list(0x5555572875e0, 24) = 0 [pid 650] chdir("./12" [pid 645] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE [pid 648] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 645] <... mprotect resumed>) = 0 [pid 648] <... futex resumed>) = 1 [pid 645] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 634] <... futex resumed>) = 0 [pid 648] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 634] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 634] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 636] <... futex resumed>) = 0 [pid 645] <... clone resumed>, parent_tid=[651], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 651 [pid 636] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 645] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 636] <... open resumed>) = 5 [pid 645] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 636] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 634] <... futex resumed>) = 0 [pid 636] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 634] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 636] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 634] <... futex resumed>) = 0 [pid 636] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 634] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 636] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 636] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 634] <... futex resumed>) = 0 [pid 636] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 634] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 636] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 634] <... futex resumed>) = 0 [pid 636] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 634] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 650] <... chdir resumed>) = 0 [pid 650] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 650] setpgid(0, 0) = 0 [pid 650] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 650] write(3, "1000", 4) = 4 [pid 650] close(3) = 0 [pid 650] symlink("/dev/binderfs", "./binderfs" [pid 636] <... write resumed>) = 262144 [pid 636] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 634] <... futex resumed>) = 0 [pid 636] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 634] exit_group(0 [pid 648] <... futex resumed>) = ? [pid 636] <... futex resumed>) = ? [pid 634] <... exit_group resumed>) = ? [pid 648] +++ exited with 0 +++ [pid 650] <... symlink resumed>) = 0 [pid 650] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 636] +++ exited with 0 +++ [pid 634] +++ exited with 0 +++ [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=634, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 294] restart_syscall(<... resuming interrupted clone ...> [pid 650] <... futex resumed>) = 0 [pid 650] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 294] <... restart_syscall resumed>) = 0 [pid 294] umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 294] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 294] getdents64(3, 0x555557288620 /* 4 entries */, 32768) = 112 [pid 294] umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] lstat("./11/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 294] unlink("./11/binderfs") = 0 [pid 294] umount2("./11/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 650] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 650] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[652], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 652 [pid 650] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 650] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 644] <... ioctl resumed>) = 0 [pid 644] close(3) = 0 [pid 644] mkdir("./file1", 0777) = 0 [pid 644] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue"./strace-static-x86_64: Process 651 attached [pid 651] set_robust_list(0x7f600e02f9e0, 24) = 0 [pid 651] memfd_create("syzkaller", 0) = 3 [pid 651] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 [ 23.457524][ T647] loop2: detected capacity change from 0 to 512 [ 23.468636][ T644] loop5: detected capacity change from 0 to 512 [ 23.496778][ T639] EXT4-fs (loop3): 1 orphan inode deleted [pid 651] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144./strace-static-x86_64: Process 652 attached ) = 262144 [pid 639] <... mount resumed>) = 0 [pid 652] set_robust_list(0x7f600e02f9e0, 24 [pid 651] munmap(0x7f6005c0f000, 262144 [pid 639] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 652] <... set_robust_list resumed>) = 0 [pid 651] <... munmap resumed>) = 0 [pid 639] <... openat resumed>) = 3 [pid 652] memfd_create("syzkaller", 0 [pid 651] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 639] chdir("./file1" [pid 652] <... memfd_create resumed>) = 3 [pid 639] <... chdir resumed>) = 0 [pid 652] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 [pid 639] ioctl(4, LOOP_CLR_FD [pid 652] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 651] <... openat resumed>) = 4 [pid 652] <... write resumed>) = 262144 [pid 651] ioctl(4, LOOP_SET_FD, 3 [pid 639] <... ioctl resumed>) = 0 [pid 652] munmap(0x7f6005c0f000, 262144 [pid 639] close(4 [pid 652] <... munmap resumed>) = 0 [pid 639] <... close resumed>) = 0 [pid 652] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 639] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 652] <... openat resumed>) = 4 [pid 652] ioctl(4, LOOP_SET_FD, 3 [pid 639] <... futex resumed>) = 1 [pid 637] <... futex resumed>) = 0 [pid 637] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] <... umount2 resumed>) = 0 [pid 637] <... futex resumed>) = 0 [ 23.507169][ T639] ext4 filesystem being mounted at /root/syzkaller.2mSqAy/11/file1 supports timestamps until 2038 (0x7fffffff) [ 23.530288][ T651] loop4: detected capacity change from 0 to 512 [ 23.530685][ T652] loop0: detected capacity change from 0 to 512 [ 23.543414][ T647] EXT4-fs (loop2): 1 orphan inode deleted [pid 637] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 639] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 294] umount2("./11/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] lstat("./11/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 294] umount2("./11/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 639] <... open resumed>) = 4 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 639] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] openat(AT_FDCWD, "./11/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 294] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 294] getdents64(4, 0x555557290660 /* 2 entries */, 32768) = 48 [pid 294] getdents64(4, 0x555557290660 /* 0 entries */, 32768) = 0 [pid 294] close(4) = 0 [pid 294] rmdir("./11/file1" [pid 639] <... futex resumed>) = 1 [pid 637] <... futex resumed>) = 0 [pid 637] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] <... rmdir resumed>) = 0 [pid 637] <... futex resumed>) = 0 [pid 637] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 637] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6005c2e000 [pid 294] getdents64(3, [pid 637] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE [pid 294] <... getdents64 resumed>0x555557288620 /* 0 entries */, 32768) = 0 [pid 637] <... mprotect resumed>) = 0 [pid 294] close(3 [pid 637] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 294] <... close resumed>) = 0 ./strace-static-x86_64: Process 657 attached [pid 294] rmdir("./11" [pid 637] <... clone resumed>, parent_tid=[657], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 657 [pid 657] set_robust_list(0x7f6005c4e9e0, 24) = 0 [pid 657] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 294] <... rmdir resumed>) = 0 [pid 637] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 639] fallocate(4, 0, 35143, 7 [pid 294] mkdir("./12", 0777 [pid 637] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 657] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 657] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL) = 0 [pid 657] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 294] <... mkdir resumed>) = 0 [pid 637] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 294] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 637] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 657] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 637] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 657] <... open resumed>) = 5 [pid 294] <... openat resumed>) = 3 [pid 657] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 637] <... futex resumed>) = 0 [pid 637] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] ioctl(3, LOOP_CLR_FD [pid 637] <... futex resumed>) = 0 [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 637] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] close(3) = 0 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 657] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096) = -1 EBADF (Bad file descriptor) [pid 657] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 637] <... futex resumed>) = 0 [pid 657] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 637] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 294] <... clone resumed>, child_tidptr=0x5555572875d0) = 658 [pid 637] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 657] <... write resumed>) = 262144 [pid 657] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 637] <... futex resumed>) = 0 [ 23.549682][ T647] ext4 filesystem being mounted at /root/syzkaller.qF1bbv/10/file1 supports timestamps until 2038 (0x7fffffff) [ 23.568927][ T639] EXT4-fs error (device loop3): ext4_map_blocks:602: inode #3: block 9: comm syz-executor362: lblock 0 mapped to illegal pblock 9 (length 1) [ 23.594386][ T644] EXT4-fs (loop5): 1 orphan inode deleted [pid 657] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 651] <... ioctl resumed>) = 0 [pid 651] close(3) = 0 [pid 651] mkdir("./file1", 0777) = 0 [pid 651] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue"./strace-static-x86_64: Process 658 attached [pid 658] set_robust_list(0x5555572875e0, 24) = 0 [pid 658] chdir("./12") = 0 [pid 658] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 658] setpgid(0, 0) = 0 [pid 658] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 658] write(3, "1000", 4) = 4 [pid 658] close(3) = 0 [pid 658] symlink("/dev/binderfs", "./binderfs") = 0 [pid 658] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 658] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f600e00f000 [pid 658] mprotect(0x7f600e010000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 658] clone(child_stack=0x7f600e02f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[659], tls=0x7f600e02f700, child_tidptr=0x7f600e02f9d0) = 659 [pid 658] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 658] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 652] <... ioctl resumed>) = 0 [pid 652] close(3) = 0 [pid 652] mkdir("./file1", 0777) = 0 [pid 652] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 647] <... mount resumed>) = 0 [pid 647] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 647] chdir("./file1") = 0 [pid 647] ioctl(4, LOOP_CLR_FD) = 0 [pid 647] close(4) = 0 [pid 647] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 647] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 643] <... futex resumed>) = 0 [pid 643] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 643] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 647] <... futex resumed>) = 0 [pid 647] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 647] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 643] <... futex resumed>) = 0 [pid 647] fallocate(4, 0, 35143, 7 [pid 643] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 643] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 647] <... fallocate resumed>) = 0 [pid 647] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 643] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6005c2e000 [pid 647] <... futex resumed>) = 0 [pid 643] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE [pid 647] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 643] <... mprotect resumed>) = 0 [pid 643] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[661], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 661 [pid 643] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 643] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 659 attached [pid 659] set_robust_list(0x7f600e02f9e0, 24) = 0 [pid 659] memfd_create("syzkaller", 0) = 3 [pid 659] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6005c0f000 [ 23.600825][ T639] EXT4-fs error (device loop3) in ext4_reserve_inode_write:5808: Out of memory [ 23.626393][ T639] EXT4-fs error (device loop3): ext4_dirty_inode:6012: inode #16: comm syz-executor362: mark_inode_dirty error [ 23.644103][ T644] ext4 filesystem being mounted at /root/syzkaller.kumyKI/10/file1 supports timestamps until 2038 (0x7fffffff) [pid 659] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144./strace-static-x86_64: Process 661 attached [pid 661] set_robust_list(0x7f6005c4e9e0, 24) = 0 [pid 661] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL) = 0 [pid 659] <... write resumed>) = 262144 [pid 661] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 643] <... futex resumed>) = 0 [pid 643] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 643] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 661] <... futex resumed>) = 1 [pid 661] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 659] munmap(0x7f6005c0f000, 262144) = 0 [pid 659] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4 [pid 659] ioctl(4, LOOP_SET_FD, 3 [pid 647] <... futex resumed>) = 0 [pid 647] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 5 [pid 647] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 643] <... futex resumed>) = 0 [pid 647] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 643] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 647] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 643] <... futex resumed>) = 0 [pid 647] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 643] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 647] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 647] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 643] <... futex resumed>) = 0 [pid 647] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 643] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 647] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 643] <... futex resumed>) = 0 [pid 647] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 643] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 659] <... ioctl resumed>) = 0 [pid 659] close(3) = 0 [pid 659] mkdir("./file1", 0777) = 0 [pid 659] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 647] <... write resumed>) = 262144 [pid 647] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 643] <... futex resumed>) = 0 [pid 647] <... futex resumed>) = 1 [pid 643] exit_group(0 [pid 661] <... futex resumed>) = 230 [pid 643] <... exit_group resumed>) = ? [pid 661] +++ exited with 0 +++ [pid 647] +++ exited with 0 +++ [pid 643] +++ exited with 0 +++ [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=643, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 295] umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 295] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] getdents64(3, 0x555557288620 /* 4 entries */, 32768) = 112 [pid 295] umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] lstat("./10/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 295] unlink("./10/binderfs") = 0 [ 23.657912][ T652] EXT4-fs (loop0): 1 orphan inode deleted [ 23.660782][ T659] loop1: detected capacity change from 0 to 512 [ 23.678323][ T639] ------------[ cut here ]------------ [ 23.689981][ T639] kernel BUG at fs/ext4/ext4.h:3355! [ 23.692227][ T651] EXT4-fs (loop4): 1 orphan inode deleted [ 23.695277][ T639] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 23.706640][ T639] CPU: 1 PID: 639 Comm: syz-executor362 Not tainted 5.15.106-syzkaller-00249-g19c0ed55a470 #0 [ 23.716716][ T639] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 [ 23.726706][ T639] RIP: 0010:ext4_mb_find_by_goal+0xdf4/0xe30 [ 23.732517][ T639] Code: c6 ff e9 b5 fb ff ff e8 6a 0a 85 ff 49 bc 00 00 00 00 00 fc ff df e9 6f f7 ff ff e8 56 0a 85 ff e9 51 f7 ff ff e8 4c 0a 85 ff <0f> 0b e8 55 03 d0 02 e8 40 0a 85 ff 0f 0b e8 39 0a 85 ff 0f 0b e8 [ 23.751959][ T639] RSP: 0018:ffffc900013a7180 EFLAGS: 00010293 [ 23.757861][ T639] RAX: ffffffff81eae174 RBX: 0000000000000001 RCX: ffff888118cb2780 [ 23.766670][ T639] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001 [ 23.774461][ T639] RBP: ffffc900013a7290 R08: ffffffff81ead4ab R09: ffffed102410398a [ 23.782302][ T639] R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff11022c81879 [ 23.790093][ T639] R13: 0000000000000001 R14: 1ffff92000274e40 R15: ffff88811640c3c8 [ 23.797895][ T639] FS: 00007f600e02f700(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 23.806658][ T639] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 23.813084][ T639] CR2: 00007f600e0d4958 CR3: 000000010cacf000 CR4: 00000000003506a0 [ 23.820895][ T639] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 23.828704][ T639] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 23.836517][ T639] Call Trace: [ 23.839644][ T639] [ 23.842422][ T639] ? ext4_handle_error+0x5c9/0x780 [ 23.847367][ T639] ? stack_trace_snprint+0xf0/0xf0 [ 23.852315][ T639] ? ext4_mb_use_inode_pa+0x6e0/0x6e0 [ 23.857525][ T639] ext4_mb_regular_allocator+0x247/0x3810 [ 23.863078][ T639] ? ext4_alloc_file_blocks+0x3d5/0xcd0 [ 23.868457][ T639] ? vfs_fallocate+0x492/0x570 [ 23.873125][ T639] ? do_syscall_64+0x3d/0xb0 [ 23.877507][ T639] ? entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 23.883572][ T639] ? ext4_mb_normalize_request+0x1830/0x1830 [ 23.889381][ T639] ? ext4_mb_new_blocks+0xd97/0x43f0 [ 23.894498][ T639] ? kmem_cache_alloc+0xf5/0x200 [ 23.899272][ T639] ext4_mb_new_blocks+0xe3c/0x43f0 [ 23.904228][ T639] ? __kasan_kmalloc+0x9/0x10 [ 23.908735][ T639] ? __kmalloc+0x13a/0x270 [ 23.912987][ T639] ? ext4_mb_pa_callback+0xd0/0xd0 [ 23.917941][ T639] ? ext4_ext_search_right+0x4f5/0x900 [ 23.924096][ T639] ? ext4_inode_to_goal_block+0x35c/0x4b0 [ 23.929650][ T639] ? ext4_ext_find_goal+0x117/0x200 [ 23.934683][ T639] ext4_ext_map_blocks+0x1a0d/0x7250 [ 23.939809][ T639] ? debug_smp_processor_id+0x17/0x20 [ 23.945021][ T639] ? ext4_ext_release+0x10/0x10 [ 23.949708][ T639] ? __down_read_common+0xbc6/0x1190 [ 23.954820][ T639] ? __kasan_slab_free+0x11/0x20 [ 23.959598][ T639] ? slab_free_freelist_hook+0xbd/0x190 [ 23.964973][ T639] ? downgrade_write+0x2d0/0x2d0 [ 23.969751][ T639] ? mb_cache_entry_create+0x4de/0x7e0 [ 23.975044][ T639] ? _raw_read_unlock+0x25/0x40 [ 23.979730][ T639] ext4_map_blocks+0xaa7/0x1e30 [ 23.984508][ T639] ? ext4_xattr_get+0x34d/0x810 [ 23.989191][ T639] ? ext4_xattr_security_get+0x32/0x40 [ 23.994484][ T639] ? ext4_issue_zeroout+0x250/0x250 [ 23.999519][ T639] ? ext4_journal_check_start+0x16c/0x230 [ 24.005074][ T639] ? ext4_alloc_file_blocks+0x3ad/0xcd0 [ 24.010455][ T639] ext4_alloc_file_blocks+0x3d5/0xcd0 [ 24.015666][ T639] ? trace_ext4_fallocate_enter+0x160/0x160 [ 24.021395][ T639] ext4_fallocate+0xbe7/0x1f90 [ 24.025994][ T639] ? avc_policy_seqno+0x1b/0x70 [ 24.030678][ T639] ? selinux_file_permission+0x2c4/0x570 [ 24.036154][ T639] ? ext4_ext_truncate+0x240/0x240 [ 24.041096][ T639] ? fsnotify_perm+0x6a/0x5d0 [ 24.045609][ T639] vfs_fallocate+0x492/0x570 [ 24.050035][ T639] __x64_sys_fallocate+0xc0/0x110 [ 24.054894][ T639] do_syscall_64+0x3d/0xb0 [ 24.059146][ T639] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 24.064874][ T639] RIP: 0033:0x7f600e0837e9 [ 24.069132][ T639] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 71 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 24.088570][ T639] RSP: 002b:00007f600e02f2f8 EFLAGS: 00000246 ORIG_RAX: 000000000000011d [ 24.096819][ T639] RAX: ffffffffffffffda RBX: 00007f600e1097a0 RCX: 00007f600e0837e9 [ 24.104637][ T639] RDX: 0000000000008947 RSI: 0000000000000000 RDI: 0000000000000004 [ 24.112449][ T639] RBP: 00007f600e0d657c R08: 0000000000000000 R09: 0000000000000000 [ 24.120249][ T639] R10: 0000000000000007 R11: 0000000000000246 R12: 00007f600e0d5578 [ 24.128077][ T639] R13: 0031656c69662f2e R14: 6f6f6c2f7665642f R15: 00007f600e1097a8 [ 24.135881][ T639] [ 24.138745][ T639] Modules linked in: [ 24.144457][ T651] ext4 filesystem being mounted at /root/syzkaller.IrUvXE/11/file1 supports timestamps until 2038 (0x7fffffff) [ 24.155243][ T659] EXT4-fs (loop1): 1 orphan inode deleted [pid 295] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 652] <... mount resumed>) = 0 [pid 651] <... mount resumed>) = 0 [pid 644] <... mount resumed>) = 0 [pid 659] <... mount resumed>) = 0 [pid 659] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 659] chdir("./file1") = 0 [pid 659] ioctl(4, LOOP_CLR_FD) = 0 [pid 659] close(4 [pid 652] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 651] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 644] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 659] <... close resumed>) = 0 [pid 659] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 658] <... futex resumed>) = 0 [pid 658] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 658] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 659] <... futex resumed>) = 1 [pid 659] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 659] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 658] <... futex resumed>) = 0 [pid 658] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 658] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 658] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6005c2e000 [pid 658] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 658] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[667], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 667 [pid 658] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 658] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 659] <... futex resumed>) = 1 [pid 659] fallocate(4, 0, 35143, 7) = 0 [pid 659] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 659] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 652] <... openat resumed>) = 3 [pid 651] <... openat resumed>) = 3 [pid 644] <... openat resumed>) = 3 [pid 652] chdir("./file1" [pid 651] chdir("./file1" [pid 644] chdir("./file1" [pid 652] <... chdir resumed>) = 0 [pid 651] <... chdir resumed>) = 0 [pid 644] <... chdir resumed>) = 0 [pid 652] ioctl(4, LOOP_CLR_FD [pid 651] ioctl(4, LOOP_CLR_FD [pid 644] ioctl(4, LOOP_CLR_FD [pid 652] <... ioctl resumed>) = 0 [pid 651] <... ioctl resumed>) = 0 [pid 644] <... ioctl resumed>) = 0 [ 24.156357][ T652] ext4 filesystem being mounted at /root/syzkaller.SN8fLk/12/file1 supports timestamps until 2038 (0x7fffffff) [ 24.162426][ T659] ext4 filesystem being mounted at /root/syzkaller.6GNILo/12/file1 supports timestamps until 2038 (0x7fffffff) [ 24.173993][ T639] ---[ end trace 0da7a39c4d7bdfca ]--- [ 24.194613][ T639] RIP: 0010:ext4_mb_find_by_goal+0xdf4/0xe30 [pid 652] close(4 [pid 651] close(4 [pid 644] close(4 [pid 652] <... close resumed>) = 0 [pid 651] <... close resumed>) = 0 [pid 644] <... close resumed>) = 0 [pid 652] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 651] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 644] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 652] <... futex resumed>) = 1 [pid 651] <... futex resumed>) = 1 [pid 650] <... futex resumed>) = 0 [pid 644] <... futex resumed>) = 1 [pid 652] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 651] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 650] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 644] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 652] <... open resumed>) = 4 [pid 650] <... futex resumed>) = 0 [pid 652] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 650] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 652] <... futex resumed>) = 0 [pid 650] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 652] fallocate(4, 0, 35143, 7 [pid 650] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 652] <... fallocate resumed>) = 0 [pid 650] <... futex resumed>) = 0 [pid 652] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 650] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 652] <... futex resumed>) = 0 [pid 650] <... futex resumed>) = 0 [pid 652] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 650] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6005c2e000 [pid 650] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 650] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[668], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 668 [pid 650] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 650] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 645] <... futex resumed>) = 0 [pid 642] <... futex resumed>) = 0 [pid 642] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 645] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 642] <... futex resumed>) = 1 ./strace-static-x86_64: Process 667 attached ./strace-static-x86_64: Process 668 attached [pid 651] <... futex resumed>) = 0 [pid 645] <... futex resumed>) = 1 [pid 644] <... futex resumed>) = 0 [pid 642] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 651] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 645] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 667] set_robust_list(0x7f6005c4e9e0, 24 [pid 644] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 668] set_robust_list(0x7f6005c4e9e0, 24 [pid 644] <... open resumed>) = 4 [pid 668] <... set_robust_list resumed>) = 0 [pid 651] <... open resumed>) = 4 [pid 667] <... set_robust_list resumed>) = 0 [pid 668] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 667] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 644] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 651] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 668] <... mount resumed>) = 0 [pid 667] <... mount resumed>) = 0 [pid 651] <... futex resumed>) = 1 [pid 644] <... futex resumed>) = 1 [pid 645] <... futex resumed>) = 0 [pid 642] <... futex resumed>) = 0 [pid 295] <... umount2 resumed>) = 0 [pid 645] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 642] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 667] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 651] fallocate(4, 0, 35143, 7 [pid 645] <... futex resumed>) = 0 [pid 644] fallocate(4, 0, 35143, 7 [pid 642] <... futex resumed>) = 0 [pid 668] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 651] <... fallocate resumed>) = 0 [pid 644] <... fallocate resumed>) = 0 [pid 645] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 642] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 668] <... futex resumed>) = 1 [pid 667] <... futex resumed>) = 1 [pid 658] <... futex resumed>) = 0 [pid 650] <... futex resumed>) = 0 [pid 645] <... futex resumed>) = 0 [pid 644] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 658] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 650] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 659] <... futex resumed>) = 0 [pid 658] <... futex resumed>) = 1 [pid 652] <... futex resumed>) = 0 [pid 650] <... futex resumed>) = 1 [pid 642] <... futex resumed>) = 0 [pid 668] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 667] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 659] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 658] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 652] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 651] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 650] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 645] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 644] <... futex resumed>) = 0 [pid 642] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 295] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 659] <... open resumed>) = 5 [pid 652] <... open resumed>) = 5 [pid 645] <... mmap resumed>) = 0x7f6005c2e000 [pid 642] <... mmap resumed>) = 0x7f6005c2e000 [pid 644] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 651] <... futex resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 659] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 652] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 651] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 645] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE [pid 642] mprotect(0x7f6005c2f000, 131072, PROT_READ|PROT_WRITE [pid 295] lstat("./10/file1", [pid 659] <... futex resumed>) = 1 [pid 658] <... futex resumed>) = 0 [pid 658] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 652] <... futex resumed>) = 1 [pid 650] <... futex resumed>) = 0 [pid 642] <... mprotect resumed>) = 0 [pid 659] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 658] <... futex resumed>) = 0 [pid 652] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 650] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 645] <... mprotect resumed>) = 0 [pid 642] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 659] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 658] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 652] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 650] <... futex resumed>) = 0 [pid 295] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 659] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 652] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 650] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 645] clone(child_stack=0x7f6005c4e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 295] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 652] <... write resumed>) = -1 EBADF (Bad file descriptor) ./strace-static-x86_64: Process 669 attached [pid 652] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 659] <... futex resumed>) = 1 [pid 658] <... futex resumed>) = 0 [pid 659] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 652] <... futex resumed>) = 1 [pid 650] <... futex resumed>) = 0 [pid 645] <... clone resumed>, parent_tid=[670], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 670 [pid 642] <... clone resumed>, parent_tid=[669], tls=0x7f6005c4e700, child_tidptr=0x7f6005c4e9d0) = 669 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 669] set_robust_list(0x7f6005c4e9e0, 24) = 0 [pid 658] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 652] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 650] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 659] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 645] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 658] <... futex resumed>) = 0 [pid 642] futex(0x7f600e1097b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] openat(AT_FDCWD, "./10/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 669] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL) = 0 [pid 669] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 669] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 670 attached [pid 670] set_robust_list(0x7f6005c4e9e0, 24) = 0 [pid 670] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL) = 0 [pid 670] futex(0x7f600e1097bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 670] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 650] <... futex resumed>) = 0 [pid 659] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 658] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 645] <... futex resumed>) = 1 [pid 650] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 642] <... futex resumed>) = 1 [pid 645] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 642] futex(0x7f600e1097bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 645] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 642] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 295] <... openat resumed>) = 4 [pid 645] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 642] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] fstat(4, [pid 659] <... write resumed>) = 262144 [pid 659] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 652] <... write resumed>) = 262144 [pid 651] <... futex resumed>) = 0 [pid 645] <... futex resumed>) = 1 [pid 644] <... futex resumed>) = 0 [pid 642] <... futex resumed>) = 1 [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 651] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 645] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 644] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 642] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] getdents64(4, [pid 651] <... open resumed>) = 5 [pid 644] <... open resumed>) = 5 [pid 651] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 644] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 295] <... getdents64 resumed>0x555557290660 /* 2 entries */, 32768) = 48 [pid 642] <... futex resumed>) = 0 [pid 651] <... futex resumed>) = 1 [pid 645] <... futex resumed>) = 0 [pid 659] <... futex resumed>) = 1 [pid 658] <... futex resumed>) = 0 [pid 652] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 644] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 295] getdents64(4, [pid 658] exit_group(0 [pid 670] <... futex resumed>) = 0 [pid 669] <... futex resumed>) = 0 [pid 659] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 652] <... futex resumed>) = 1 [pid 651] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 650] <... futex resumed>) = 0 [pid 645] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 642] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... getdents64 resumed>0x555557290660 /* 0 entries */, 32768) = 0 [pid 670] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 669] futex(0x7f600e1097b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 667] <... futex resumed>) = ? [pid 659] <... futex resumed>) = ? [pid 658] <... exit_group resumed>) = ? [pid 652] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 651] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 650] exit_group(0 [pid 645] <... futex resumed>) = 0 [pid 644] <... futex resumed>) = 0 [pid 642] <... futex resumed>) = 1 [ 24.200439][ T639] Code: c6 ff e9 b5 fb ff ff e8 6a 0a 85 ff 49 bc 00 00 00 00 00 fc ff df e9 6f f7 ff ff e8 56 0a 85 ff e9 51 f7 ff ff e8 4c 0a 85 ff <0f> 0b e8 55 03 d0 02 e8 40 0a 85 ff 0f 0b e8 39 0a 85 ff 0f 0b e8 [ 24.224017][ T639] RSP: 0018:ffffc900013a7180 EFLAGS: 00010293 [ 24.233388][ T639] RAX: ffffffff81eae174 RBX: 0000000000000001 RCX: ffff888118cb2780 [pid 295] close(4 [pid 667] +++ exited with 0 +++ [pid 659] +++ exited with 0 +++ [pid 658] +++ exited with 0 +++ [pid 651] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 650] <... exit_group resumed>) = ? [pid 645] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 644] write(0, "\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48\xb7\x71\xb3\xc3\xb8\x06\x60\x1d\x4b\x7a\x5f\x1e\x7c\xb6\x0a\x34\xda\x12\xb2\x6f\xad\xc9\x46\xcc\xd2\x3b\x6a\xfb\x12\xc1\xce\xe6\x20\x8b\xb8\xae\x2e\x2b\x32\x28\xe7\xeb\x78\x4c\x60\x8b\x9a\x07\xad\x74\x7b\x94\x3a\x77\x03\xd8\xca\xcb\x26\xad\x1e\x02\xca\x87"..., 4096 [pid 642] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] <... close resumed>) = 0 [pid 651] <... futex resumed>) = 0 [pid 645] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=658, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 668] <... futex resumed>) = ? [pid 645] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 651] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 668] +++ exited with 0 +++ [pid 652] <... futex resumed>) = ? [pid 645] <... futex resumed>) = 0 [pid 644] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 295] rmdir("./10/file1" [pid 645] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 644] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 652] +++ exited with 0 +++ [pid 650] +++ exited with 0 +++ [pid 295] <... rmdir resumed>) = 0 [pid 644] <... futex resumed>) = 1 [pid 642] <... futex resumed>) = 0 [pid 642] futex(0x7f600e1097a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 642] futex(0x7f600e1097ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 644] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5d\x0f\x1b\xc7\x13\x63\xce\x46\xd7\xd6\x8a\x9a\x08\x09\x94\xde\x4f\x56\xb8\x75\x79\xb6\x4c\x51\x1a\xae\x21\xa9\x1e\xb2\xdb\x3a\x04\x37\xf8\x48"..., 22455190 [pid 295] getdents64(3, [pid 294] umount2("./12", MNT_DETACH|UMOUNT_NOFOLLOW [pid 293] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=650, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 651] <... write resumed>) = 262144 [pid 644] <... write resumed>) = 262144 [pid 295] <... getdents64 resumed>0x555557288620 /* 0 entries */, 32768) = 0 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 293] umount2("./12", MNT_DETACH|UMOUNT_NOFOLLOW [pid 651] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 644] futex(0x7f600e1097ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] close(3 [pid 294] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 293] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 651] <... futex resumed>) = 1 [pid 645] <... futex resumed>) = 0 [pid 644] <... futex resumed>) = 1 [pid 642] <... futex resumed>) = 0 [pid 651] futex(0x7f600e1097a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 645] exit_group(0 [pid 642] exit_group(0 [pid 295] <... close resumed>) = 0 [pid 294] <... openat resumed>) = 3 [pid 293] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 645] <... exit_group resumed>) = ? [pid 642] <... exit_group resumed>) = ? [pid 670] <... futex resumed>) = ? [pid 295] rmdir("./10" [pid 294] fstat(3, [pid 293] <... openat resumed>) = 3 [pid 669] <... futex resumed>) = ? [pid 651] <... futex resumed>) = ? [pid 644] +++ exited with 0 +++ [pid 295] <... rmdir resumed>) = 0 [pid 294] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 293] fstat(3, [pid 670] +++ exited with 0 +++ [pid 669] +++ exited with 0 +++ [pid 642] +++ exited with 0 +++ [pid 651] +++ exited with 0 +++ [pid 645] +++ exited with 0 +++ [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=642, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 298] umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 298] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] getdents64(3, 0x555557288620 /* 4 entries */, 32768) = 112 [pid 298] umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] lstat("./10/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 298] unlink("./10/binderfs") = 0 [pid 298] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=645, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 293] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] mkdir("./11", 0777 [pid 294] getdents64(3, [pid 293] getdents64(3, [pid 295] <... mkdir resumed>) = 0 [pid 294] <... getdents64 resumed>0x555557288620 /* 4 entries */, 32768) = 112 [pid 297] umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 293] <... getdents64 resumed>0x555557288620 /* 4 entries */, 32768) = 112 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] umount2("./12/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] <... openat resumed>) = 3 [pid 293] umount2("./12/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... openat resumed>) = 3 [ 24.254148][ T639] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001 [ 24.273963][ T639] RBP: ffffc900013a7290 R08: ffffffff81ead4ab R09: ffffed102410398a [ 24.284372][ T639] R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff11022c81879 [ 24.292549][ T639] R13: 0000000000000001 R14: 1ffff92000274e40 R15: ffff88811640c3c8 [ 24.300733][ T639] FS: 00007f600e02f700(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [pid 295] ioctl(3, LOOP_CLR_FD [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] fstat(3, [pid 293] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 294] lstat("./12/binderfs", [pid 293] lstat("./12/binderfs", [pid 297] getdents64(3, [pid 295] close(3 [pid 294] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 297] <... getdents64 resumed>0x555557288620 /* 4 entries */, 32768) = 112 [pid 295] <... close resumed>) = 0 [pid 294] unlink("./12/binderfs" [pid 297] umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 294] <... unlink resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] umount2("./12/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] lstat("./11/binderfs", [pid 295] <... clone resumed>, child_tidptr=0x5555572875d0) = 672 [pid 293] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 ./strace-static-x86_64: Process 672 attached [pid 297] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 297] unlink("./11/binderfs") = 0 [pid 297] umount2("./11/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 672] set_robust_list(0x5555572875e0, 24 [pid 298] <... umount2 resumed>) = 0 [pid 293] unlink("./12/binderfs" [pid 298] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] lstat("./10/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] openat(AT_FDCWD, "./10/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 298] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] getdents64(4, 0x555557290660 /* 2 entries */, 32768) = 48 [pid 298] getdents64(4, 0x555557290660 /* 0 entries */, 32768) = 0 [pid 298] close(4) = 0 [pid 298] rmdir("./10/file1") = 0 [pid 298] getdents64(3, 0x555557288620 /* 0 entries */, 32768) = 0 [pid 298] close(3) = 0 [pid 298] rmdir("./10") = 0 [pid 298] mkdir("./11", 0777) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 3 [pid 298] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 298] close(3) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555572875d0) = 673 ./strace-static-x86_64: Process 673 attached [pid 672] <... set_robust_list resumed>) = 0 [pid 293] <... unlink resumed>) = 0 [ 24.319485][ T639] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 24.326400][ T639] CR2: 00005555572872b8 CR3: 000000010cacf000 CR4: 00000000003506a0 [ 24.335187][ T639] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 24.343360][ T639] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 24.351697][ T639] Kernel panic - not syncing: Fatal exception [ 24.357764][ T639] Kernel Offset: disabled [ 24.361898][ T639] Rebooting in 86400 seconds..