./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor757276056
<...>
Warning: Permanently added '10.128.0.92' (ED25519) to the list of known hosts.
execve("./syz-executor757276056", ["./syz-executor757276056"], 0x7ffe5c64ce00 /* 10 vars */) = 0
brk(NULL) = 0x555556bfd000
brk(0x555556bfdd00) = 0x555556bfdd00
arch_prctl(ARCH_SET_FS, 0x555556bfd380) = 0
set_tid_address(0x555556bfd650) = 5018
set_robust_list(0x555556bfd660, 24) = 0
rseq(0x555556bfdca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor757276056", 4096) = 27
getrandom("\x7d\x25\x98\x0b\xf1\x9b\xd9\x7d", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x555556bfdd00
brk(0x555556c1ed00) = 0x555556c1ed00
brk(0x555556c1f000) = 0x555556c1f000
mprotect(0x7fbac96e9000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
openat(AT_FDCWD, "/sys/kernel/debug/failslab/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_futex/ignore-private", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-highmem", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/min-order", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1) = 1
close(3) = 0
mkdir("./syzkaller.kdkfNS", 0700) = 0
chmod("./syzkaller.kdkfNS", 0777) = 0
chdir("./syzkaller.kdkfNS") = 0
mkdir("./0", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556bfd650) = 5019
./strace-static-x86_64: Process 5019 attached
[pid 5019] set_robust_list(0x555556bfd660, 24) = 0
[pid 5019] chdir("./0") = 0
[pid 5019] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5019] setpgid(0, 0) = 0
[pid 5019] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5019] write(3, "1000", 4) = 4
[pid 5019] close(3) = 0
[pid 5019] symlink("/dev/binderfs", "./binderfs") = 0
[pid 5019] memfd_create("syzkaller", 0) = 3
[pid 5019] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbac1231000
[ 44.159053][ T5019] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=5019 'syz-executor757'
[pid 5019] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216
[pid 5019] munmap(0x7fbac1231000, 16777216) = 0
[pid 5019] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 5019] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 5019] close(3) = 0
[pid 5019] mkdir("./bus", 0777) = 0
[ 44.272109][ T5019] loop0: detected capacity change from 0 to 32768
[ 44.283679][ T5019] BTRFS: device fsid 24c7a497-3402-47dd-bef8-82358f5f30e0 devid 1 transid 8 /dev/loop0 scanned by syz-executor757 (5019)
[ 44.302928][ T5019] BTRFS info (device loop0): using crc32c (crc32c-intel) checksum algorithm
[ 44.311875][ T5019] BTRFS info (device loop0): doing ref verification
[pid 5019] mount("/dev/loop0", "./bus", "btrfs", MS_DIRSYNC, "ref_verify,nossd,inode_cache,compress-force,space_cache=v2,degraded,noacl,") = 0
[pid 5019] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3
[pid 5019] chdir("./bus") = 0
[pid 5019] ioctl(4, LOOP_CLR_FD) = 0
[pid 5019] close(4) = 0
[pid 5019] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_LARGEFILE|O_NOATIME|FASYNC|0x3c, 000) = 4
[pid 5019] fallocate(4, 0, 0, 1048820) = 0
[pid 5019] open("./bus", O_RDWR|O_CREAT|O_NONBLOCK|O_DIRECT|O_NOFOLLOW|O_NOATIME, 000) = 5
[pid 5019] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6
[pid 5019] write(6, "12", 2) = 2
[ 44.318737][ T5019] BTRFS warning (device loop0): the 'inode_cache' option is deprecated and has no effect since 5.11
[ 44.329649][ T5019] BTRFS info (device loop0): force zlib compression, level 3
[ 44.337038][ T5019] BTRFS info (device loop0): allowing degraded mounts
[ 44.343882][ T5019] BTRFS info (device loop0): using free space tree
[ 44.361472][ T5019] BTRFS info (device loop0): auto enabling async discard
[pid 5019] pwritev2(5, [{iov_base="\x85\x2f\x62\x75\x73\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x72\x65\x66\x5f\x76\x65\x72\x69\x66\x79\x2c\x6e\x6f\x73\x73\x64\x2c\x69\x6e\x6f\x64\x65\x5f\x63\x61\x63\x68\x65\x2c\x63\x6f\x6d\x70\x72\x65\x73"..., iov_len=475136}, {iov_base=NULL, iov_len=0}], 2, 16384, RWF_NOWAIT) = -1 EAGAIN (Resource temporarily unavailable)
[pid 5019] exit_group(0) = ?
[pid 5019] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5019, si_uid=0, si_status=0, si_utime=0, si_stime=19 /* 0.19 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x555556bfe6f0 /* 4 entries */, 32768) = 104
umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./0/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./0/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x555556c06730 /* 2 entries */, 32768) = 48
getdents64(4, 0x555556c06730 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./0/bus") = 0
umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./0/binderfs") = 0
getdents64(3, 0x555556bfe6f0 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./0") = 0
mkdir("./1", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = 0
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556bfd650) = 5047
./strace-static-x86_64: Process 5047 attached
[pid 5047] set_robust_list(0x555556bfd660, 24) = 0
[pid 5047] chdir("./1") = 0
[pid 5047] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5047] setpgid(0, 0) = 0
[pid 5047] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5047] write(3, "1000", 4) = 4
[pid 5047] close(3) = 0
[pid 5047] symlink("/dev/binderfs", "./binderfs") = 0
[pid 5047] memfd_create("syzkaller", 0) = 3
[pid 5047] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbac1231000
[pid 5047] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216
[pid 5047] munmap(0x7fbac1231000, 16777216) = 0
[pid 5047] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 5047] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 5047] close(3) = 0
[pid 5047] mkdir("./bus", 0777) = 0
[ 44.650849][ T5047] loop0: detected capacity change from 0 to 32768
[ 44.660477][ T5047] BTRFS: device fsid 24c7a497-3402-47dd-bef8-82358f5f30e0 devid 1 transid 8 /dev/loop0 scanned by syz-executor757 (5047)
[ 44.676121][ T5047] BTRFS info (device loop0): using crc32c (crc32c-intel) checksum algorithm
[ 44.684922][ T5047] BTRFS info (device loop0): doing ref verification
[pid 5047] mount("/dev/loop0", "./bus", "btrfs", MS_DIRSYNC, "ref_verify,nossd,inode_cache,compress-force,space_cache=v2,degraded,noacl,") = 0
[pid 5047] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3
[pid 5047] chdir("./bus") = 0
[pid 5047] ioctl(4, LOOP_CLR_FD) = 0
[pid 5047] close(4) = 0
[pid 5047] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_LARGEFILE|O_NOATIME|FASYNC|0x3c, 000) = 4
[pid 5047] fallocate(4, 0, 0, 1048820) = 0
[pid 5047] open("./bus", O_RDWR|O_CREAT|O_NONBLOCK|O_DIRECT|O_NOFOLLOW|O_NOATIME, 000) = 5
[pid 5047] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6
[pid 5047] write(6, "12", 2) = 2
[pid 5047] pwritev2(5, [{iov_base="\x85\x2f\x62\x75\x73\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x72\x65\x66\x5f\x76\x65\x72\x69\x66\x79\x2c\x6e\x6f\x73\x73\x64\x2c\x69\x6e\x6f\x64\x65\x5f\x63\x61\x63\x68\x65\x2c\x63\x6f\x6d\x70\x72\x65\x73"..., iov_len=475136}, {iov_base=NULL, iov_len=0}], 2, 16384, RWF_NOWAIT) = -1 EAGAIN (Resource temporarily unavailable)
[pid 5047] exit_group(0) = ?
[pid 5047] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5047, si_uid=0, si_status=0, si_utime=3 /* 0.03 s */, si_stime=14 /* 0.14 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x555556bfe6f0 /* 4 entries */, 32768) = 104
[ 44.691543][ T5047] BTRFS warning (device loop0): the 'inode_cache' option is deprecated and has no effect since 5.11
[ 44.702350][ T5047] BTRFS info (device loop0): force zlib compression, level 3
[ 44.709821][ T5047] BTRFS info (device loop0): allowing degraded mounts
[ 44.716588][ T5047] BTRFS info (device loop0): using free space tree
[ 44.732452][ T5047] BTRFS info (device loop0): auto enabling async discard
umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./1/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./1/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x555556c06730 /* 2 entries */, 32768) = 48
getdents64(4, 0x555556c06730 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./1/bus") = 0
umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./1/binderfs") = 0
getdents64(3, 0x555556bfe6f0 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./1") = 0
mkdir("./2", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = 0
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5071 attached
, child_tidptr=0x555556bfd650) = 5071
[pid 5071] set_robust_list(0x555556bfd660, 24) = 0
[pid 5071] chdir("./2") = 0
[pid 5071] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5071] setpgid(0, 0) = 0
[pid 5071] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5071] write(3, "1000", 4) = 4
[pid 5071] close(3) = 0
[pid 5071] symlink("/dev/binderfs", "./binderfs") = 0
[pid 5071] memfd_create("syzkaller", 0) = 3
[pid 5071] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbac1231000
[pid 5071] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216
[pid 5071] munmap(0x7fbac1231000, 16777216) = 0
[pid 5071] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 5071] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 5071] close(3) = 0
[pid 5071] mkdir("./bus", 0777) = 0
[ 44.998758][ T5071] loop0: detected capacity change from 0 to 32768
[ 45.008240][ T5071] BTRFS: device fsid 24c7a497-3402-47dd-bef8-82358f5f30e0 devid 1 transid 8 /dev/loop0 scanned by syz-executor757 (5071)
[ 45.022732][ T5071] BTRFS info (device loop0): using crc32c (crc32c-intel) checksum algorithm
[ 45.031573][ T5071] BTRFS info (device loop0): doing ref verification
[ 45.038271][ T5071] BTRFS warning (device loop0): the 'inode_cache' option is deprecated and has no effect since 5.11
[pid 5071] mount("/dev/loop0", "./bus", "btrfs", MS_DIRSYNC, "ref_verify,nossd,inode_cache,compress-force,space_cache=v2,degraded,noacl,") = 0
[pid 5071] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3
[pid 5071] chdir("./bus") = 0
[pid 5071] ioctl(4, LOOP_CLR_FD) = 0
[pid 5071] close(4) = 0
[pid 5071] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_LARGEFILE|O_NOATIME|FASYNC|0x3c, 000) = 4
[pid 5071] fallocate(4, 0, 0, 1048820) = 0
[pid 5071] open("./bus", O_RDWR|O_CREAT|O_NONBLOCK|O_DIRECT|O_NOFOLLOW|O_NOATIME, 000) = 5
[pid 5071] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6
[pid 5071] write(6, "12", 2) = 2
[pid 5071] pwritev2(5, [{iov_base="\x85\x2f\x62\x75\x73\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x72\x65\x66\x5f\x76\x65\x72\x69\x66\x79\x2c\x6e\x6f\x73\x73\x64\x2c\x69\x6e\x6f\x64\x65\x5f\x63\x61\x63\x68\x65\x2c\x63\x6f\x6d\x70\x72\x65\x73"..., iov_len=475136}, {iov_base=NULL, iov_len=0}], 2, 16384, RWF_NOWAIT) = -1 EAGAIN (Resource temporarily unavailable)
[pid 5071] exit_group(0) = ?
[pid 5071] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5071, si_uid=0, si_status=0, si_utime=3 /* 0.03 s */, si_stime=16 /* 0.16 s */} ---
umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x555556bfe6f0 /* 4 entries */, 32768) = 104
[ 45.049200][ T5071] BTRFS info (device loop0): force zlib compression, level 3
[ 45.056581][ T5071] BTRFS info (device loop0): allowing degraded mounts
[ 45.063399][ T5071] BTRFS info (device loop0): using free space tree
[ 45.079025][ T5071] BTRFS info (device loop0): auto enabling async discard
umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./2/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./2/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x555556c06730 /* 2 entries */, 32768) = 48
getdents64(4, 0x555556c06730 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./2/bus") = 0
umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./2/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./2/binderfs") = 0
getdents64(3, 0x555556bfe6f0 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./2") = 0
mkdir("./3", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = 0
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556bfd650) = 5088
./strace-static-x86_64: Process 5088 attached
[pid 5088] set_robust_list(0x555556bfd660, 24) = 0
[pid 5088] chdir("./3") = 0
[pid 5088] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5088] setpgid(0, 0) = 0
[pid 5088] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5088] write(3, "1000", 4) = 4
[pid 5088] close(3) = 0
[pid 5088] symlink("/dev/binderfs", "./binderfs") = 0
[pid 5088] memfd_create("syzkaller", 0) = 3
[pid 5088] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbac1231000
[pid 5088] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216
[pid 5088] munmap(0x7fbac1231000, 16777216) = 0
[pid 5088] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 5088] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 5088] close(3) = 0
[pid 5088] mkdir("./bus", 0777) = 0
[ 45.350195][ T5088] loop0: detected capacity change from 0 to 32768
[ 45.359514][ T5088] BTRFS: device fsid 24c7a497-3402-47dd-bef8-82358f5f30e0 devid 1 transid 8 /dev/loop0 scanned by syz-executor757 (5088)
[ 45.374050][ T5088] BTRFS info (device loop0): using crc32c (crc32c-intel) checksum algorithm
[ 45.382863][ T5088] BTRFS info (device loop0): doing ref verification
[ 45.389486][ T5088] BTRFS warning (device loop0): the 'inode_cache' option is deprecated and has no effect since 5.11
[pid 5088] mount("/dev/loop0", "./bus", "btrfs", MS_DIRSYNC, "ref_verify,nossd,inode_cache,compress-force,space_cache=v2,degraded,noacl,") = 0
[pid 5088] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3
[pid 5088] chdir("./bus") = 0
[pid 5088] ioctl(4, LOOP_CLR_FD) = 0
[pid 5088] close(4) = 0
[pid 5088] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_LARGEFILE|O_NOATIME|FASYNC|0x3c, 000) = 4
[pid 5088] fallocate(4, 0, 0, 1048820) = 0
[pid 5088] open("./bus", O_RDWR|O_CREAT|O_NONBLOCK|O_DIRECT|O_NOFOLLOW|O_NOATIME, 000) = 5
[pid 5088] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6
[pid 5088] write(6, "12", 2) = 2
[ 45.400306][ T5088] BTRFS info (device loop0): force zlib compression, level 3
[ 45.407849][ T5088] BTRFS info (device loop0): allowing degraded mounts
[ 45.414717][ T5088] BTRFS info (device loop0): using free space tree
[ 45.430282][ T5088] BTRFS info (device loop0): auto enabling async discard
[ 45.458277][ T5088] FAULT_INJECTION: forcing a failure.
[ 45.458277][ T5088] name failslab, interval 1, probability 0, space 0, times 0
[ 45.471484][ T5088] CPU: 0 PID: 5088 Comm: syz-executor757 Not tainted 6.5.0-rc1-syzkaller-00152-g4b810bf037e5 #0
[ 45.481937][ T5088] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023
[ 45.492018][ T5088] Call Trace:
[ 45.495315][ T5088]
[ 45.498262][ T5088] dump_stack_lvl+0x125/0x1b0
[ 45.503004][ T5088] should_fail_ex+0x496/0x5b0
[ 45.507721][ T5088] should_failslab+0x9/0x20
[ 45.512261][ T5088] kmem_cache_alloc+0x33a/0x3b0
[ 45.517150][ T5088] split_extent_map+0x75/0xde0
[ 45.521950][ T5088] btrfs_dio_submit_io+0x408/0x720
[ 45.527172][ T5088] ? btrfs_migrate_folio+0xf0/0xf0
[ 45.532315][ T5088] iomap_dio_submit_bio+0x194/0x210
[ 45.537518][ T5088] iomap_dio_bio_iter+0x7ac/0x1460
[ 45.542639][ T5088] __iomap_dio_rw+0xd10/0x1da0
[ 45.547417][ T5088] ? iomap_dio_bio_end_io+0x600/0x600
[ 45.552821][ T5088] ? inode_maybe_inc_iversion+0x139/0x1a0
[ 45.558546][ T5088] btrfs_dio_write+0xb1/0xe0
[ 45.563139][ T5088] ? btrfs_dio_read+0xe0/0xe0
[ 45.567819][ T5088] ? iov_iter_alignment+0xe1/0x5e0
[ 45.572936][ T5088] btrfs_do_write_iter+0x995/0x11a0
[ 45.578151][ T5088] ? btrfs_fdatawrite_range+0x110/0x110
[ 45.583705][ T5088] do_iter_readv_writev+0x21e/0x3c0
[ 45.588911][ T5088] ? generic_copy_file_range+0x1d0/0x1d0
[ 45.594554][ T5088] ? bpf_lsm_file_permission+0x9/0x10
[ 45.599921][ T5088] ? security_file_permission+0x94/0x100
[ 45.605564][ T5088] do_iter_write+0x17f/0x830
[ 45.610169][ T5088] vfs_writev+0x221/0x700
[ 45.614498][ T5088] ? lock_acquire+0x1ae/0x510
[ 45.619215][ T5088] ? vfs_iter_write+0xb0/0xb0
[ 45.623895][ T5088] ? ptrace_stop.part.0+0x4b4/0x8f0
[ 45.629090][ T5088] ? spin_bug+0x1d0/0x1d0
[ 45.633420][ T5088] ? cgroup_update_frozen+0x144/0x6b0
[ 45.638795][ T5088] ? find_held_lock+0x2d/0x110
[ 45.643562][ T5088] ? do_pwritev+0x1af/0x260
[ 45.648063][ T5088] do_pwritev+0x1af/0x260
[ 45.652393][ T5088] ? do_writev+0x370/0x370
[ 45.656805][ T5088] ? _raw_spin_unlock_irq+0x23/0x50
[ 45.662039][ T5088] ? lockdep_hardirqs_on+0x7d/0x100
[ 45.667249][ T5088] __x64_sys_pwritev2+0xef/0x150
[ 45.672198][ T5088] do_syscall_64+0x38/0xb0
[ 45.676611][ T5088] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 45.682508][ T5088] RIP: 0033:0x7fbac9670329
[ 45.686916][ T5088] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 21 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 45.706720][ T5088] RSP: 002b:00007ffdf5dd38c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000148
[ 45.715129][ T5088] RAX: ffffffffffffffda RBX: 00007ffdf5dd3900 RCX: 00007fbac9670329
[ 45.723101][ T5088] RDX: 0000000000000002 RSI: 0000000020000240 RDI: 0000000000000005
[ 45.731084][ T5088] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000008
[ 45.739053][ T5088] R10: 0000000000004000 R11: 0000000000000246 R12: 00007ffdf5dd38fc
[ 45.747042][ T5088] R13: 0000000000000003 R14: 431bde82d7b634db R15: 00007ffdf5dd3940
[ 45.755034][ T5088]
[ 45.762543][ T5088] BTRFS warning (device loop0): direct IO failed ino 263 op 0x8801 offset 0x4000 len 4096 err no 9
[ 45.773975][ T5088] general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] PREEMPT SMP KASAN
[ 45.785707][ T5088] KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067]
[ 45.794099][ T5088] CPU: 1 PID: 5088 Comm: syz-executor757 Not tainted 6.5.0-rc1-syzkaller-00152-g4b810bf037e5 #0
[ 45.804517][ T5088] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023
[ 45.814557][ T5088] RIP: 0010:btrfs_finish_ordered_extent+0x3c/0x2a0
[ 45.821056][ T5088] Code: 55 44 89 c5 53 48 89 fb 48 83 ec 08 48 89 34 24 e8 39 d7 0c fe 48 8d 7b 60 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 33 02 00 00 4c 8b 6b 60 40 0f b6 ed 0f 1f 44 00
[ 45.840679][ T5088] RSP: 0018:ffffc90003d8f4b8 EFLAGS: 00010216
[ 45.846732][ T5088] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 45.854689][ T5088] RDX: 000000000000000c RSI: ffffffff83799767 RDI: 0000000000000060
[ 45.862642][ T5088] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[ 45.870681][ T5088] R10: 0000000000000009 R11: 0000000000000001 R12: ffff88814a7ac500
[ 45.878636][ T5088] R13: 0000000000004000 R14: 0000000000004000 R15: 0000000000001000
[ 45.886585][ T5088] FS: 0000555556bfd380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
[ 45.895503][ T5088] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 45.902075][ T5088] CR2: 00005573d1fa6c28 CR3: 0000000028d67000 CR4: 0000000000350ee0
[ 45.910032][ T5088] Call Trace:
[ 45.913292][ T5088]
[ 45.916227][ T5088] ? die_addr+0x3b/0xa0
[ 45.920399][ T5088] ? exc_general_protection+0x154/0x230
[ 45.925937][ T5088] ? asm_exc_general_protection+0x26/0x30
[ 45.931668][ T5088] ? btrfs_finish_ordered_extent+0x27/0x2a0
[ 45.937557][ T5088] ? btrfs_finish_ordered_extent+0x3c/0x2a0
[ 45.943473][ T5088] ? btrfs_finish_ordered_extent+0x27/0x2a0
[ 45.949355][ T5088] btrfs_dio_end_io+0x235/0x4b0
[ 45.954201][ T5088] btrfs_dio_submit_io+0x454/0x720
[ 45.959305][ T5088] ? btrfs_migrate_folio+0xf0/0xf0
[ 45.964406][ T5088] iomap_dio_submit_bio+0x194/0x210
[ 45.969593][ T5088] iomap_dio_bio_iter+0x7ac/0x1460
[ 45.974693][ T5088] __iomap_dio_rw+0xd10/0x1da0
[ 45.979444][ T5088] ? iomap_dio_bio_end_io+0x600/0x600
[ 45.984806][ T5088] ? inode_maybe_inc_iversion+0x139/0x1a0
[ 45.990530][ T5088] btrfs_dio_write+0xb1/0xe0
[ 45.995104][ T5088] ? btrfs_dio_read+0xe0/0xe0
[ 45.999766][ T5088] ? iov_iter_alignment+0xe1/0x5e0
[ 46.004873][ T5088] btrfs_do_write_iter+0x995/0x11a0
[ 46.010075][ T5088] ? btrfs_fdatawrite_range+0x110/0x110
[ 46.015606][ T5088] do_iter_readv_writev+0x21e/0x3c0
[ 46.020797][ T5088] ? generic_copy_file_range+0x1d0/0x1d0
[ 46.026444][ T5088] ? bpf_lsm_file_permission+0x9/0x10
[ 46.031803][ T5088] ? security_file_permission+0x94/0x100
[ 46.037438][ T5088] do_iter_write+0x17f/0x830
[ 46.042041][ T5088] vfs_writev+0x221/0x700
[ 46.046377][ T5088] ? lock_acquire+0x1ae/0x510
[ 46.051050][ T5088] ? vfs_iter_write+0xb0/0xb0
[ 46.055715][ T5088] ? ptrace_stop.part.0+0x4b4/0x8f0
[ 46.060900][ T5088] ? spin_bug+0x1d0/0x1d0
[ 46.065215][ T5088] ? cgroup_update_frozen+0x144/0x6b0
[ 46.070594][ T5088] ? find_held_lock+0x2d/0x110
[ 46.075341][ T5088] ? do_pwritev+0x1af/0x260
[ 46.079829][ T5088] do_pwritev+0x1af/0x260
[ 46.084146][ T5088] ? do_writev+0x370/0x370
[ 46.088551][ T5088] ? _raw_spin_unlock_irq+0x23/0x50
[ 46.093736][ T5088] ? lockdep_hardirqs_on+0x7d/0x100
[ 46.098919][ T5088] __x64_sys_pwritev2+0xef/0x150
[ 46.103845][ T5088] do_syscall_64+0x38/0xb0
[ 46.108266][ T5088] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 46.114145][ T5088] RIP: 0033:0x7fbac9670329
[ 46.118558][ T5088] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 21 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 46.138166][ T5088] RSP: 002b:00007ffdf5dd38c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000148
[ 46.146559][ T5088] RAX: ffffffffffffffda RBX: 00007ffdf5dd3900 RCX: 00007fbac9670329
[ 46.154518][ T5088] RDX: 0000000000000002 RSI: 0000000020000240 RDI: 0000000000000005
[ 46.162479][ T5088] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000008
[ 46.170433][ T5088] R10: 0000000000004000 R11: 0000000000000246 R12: 00007ffdf5dd38fc
[ 46.178419][ T5088] R13: 0000000000000003 R14: 431bde82d7b634db R15: 00007ffdf5dd3940
[ 46.186398][ T5088]
[ 46.189402][ T5088] Modules linked in:
[ 46.194052][ T5088] ---[ end trace 0000000000000000 ]---
[ 46.199856][ T5088] RIP: 0010:btrfs_finish_ordered_extent+0x3c/0x2a0
[ 46.206415][ T5088] Code: 55 44 89 c5 53 48 89 fb 48 83 ec 08 48 89 34 24 e8 39 d7 0c fe 48 8d 7b 60 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 33 02 00 00 4c 8b 6b 60 40 0f b6 ed 0f 1f 44 00
[ 46.226237][ T5088] RSP: 0018:ffffc90003d8f4b8 EFLAGS: 00010216
[ 46.232392][ T5088] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 46.240551][ T5088] RDX: 000000000000000c RSI: ffffffff83799767 RDI: 0000000000000060
[ 46.248566][ T5088] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[ 46.256574][ T5088] R10: 0000000000000009 R11: 0000000000000001 R12: ffff88814a7ac500
[ 46.264651][ T5088] R13: 0000000000004000 R14: 0000000000004000 R15: 0000000000001000
[ 46.272672][ T5088] FS: 0000555556bfd380(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
[ 46.281664][ T5088] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 46.288265][ T5088] CR2: 00005578708d1ed8 CR3: 0000000028d67000 CR4: 0000000000350ef0
[ 46.296243][ T5088] Kernel panic - not syncing: Fatal exception
[ 46.303003][ T5088] Kernel Offset: disabled
[ 46.307336][ T5088] Rebooting in 86400 seconds..