./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3695705231 <...> Warning: Permanently added '10.128.1.172' (ED25519) to the list of known hosts. execve("./syz-executor3695705231", ["./syz-executor3695705231"], 0x7fff5a2d5330 /* 10 vars */) = 0 brk(NULL) = 0x555556e0f000 brk(0x555556e0fd40) = 0x555556e0fd40 arch_prctl(ARCH_SET_FS, 0x555556e0f3c0) = 0 set_tid_address(0x555556e0f690) = 5033 set_robust_list(0x555556e0f6a0, 24) = 0 rseq(0x555556e0fce0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor3695705231", 4096) = 28 getrandom("\xec\x6c\x19\xff\x0d\xff\x25\x1e", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555556e0fd40 brk(0x555556e30d40) = 0x555556e30d40 brk(0x555556e31000) = 0x555556e31000 mprotect(0x7f4381058000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 mkdir("./syzkaller.F1Lso8", 0700) = 0 chmod("./syzkaller.F1Lso8", 0777) = 0 chdir("./syzkaller.F1Lso8") = 0 mkdir("./0", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5034 attached , child_tidptr=0x555556e0f690) = 5034 [pid 5034] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5034] chdir("./0") = 0 [pid 5034] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5034] setpgid(0, 0) = 0 [pid 5034] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5034] write(3, "1000", 4) = 4 [pid 5034] close(3) = 0 [pid 5034] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5034] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5034] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5034] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5034] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5034] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5034] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5034] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0} => {parent_tid=[5036]}, 88) = 5036 [pid 5034] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5034] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5034] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5034] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5034] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE./strace-static-x86_64: Process 5036 attached [pid 5036] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053) = 0 [pid 5034] <... mprotect resumed>) = 0 [pid 5036] set_robust_list(0x7f4380f929a0, 24) = 0 [pid 5034] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5036] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5034] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5036] memfd_create("syzkaller", 0 [pid 5034] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} => {parent_tid=[5037]}, 88) = 5037 [pid 5034] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5034] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5034] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5037 attached [pid 5037] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5036] <... memfd_create resumed>) = 3 [pid 5037] <... rseq resumed>) = 0 [pid 5036] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5037] set_robust_list(0x7f4380f719a0, 24) = 0 [pid 5037] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5037] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5036] <... mmap resumed>) = 0x7f4378b51000 [pid 5037] <... open resumed>) = 4 [pid 5036] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5037] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5037] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5034] <... futex resumed>) = 0 [pid 5034] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5037] <... futex resumed>) = 0 [pid 5037] fallocate(4, 0, 35143, 7 [pid 5034] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5036] <... write resumed>) = 262144 [pid 5036] munmap(0x7f4378b51000, 262144) = 0 [pid 5036] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5036] ioctl(5, LOOP_SET_FD, 3 [pid 5037] <... fallocate resumed>) = 0 [pid 5037] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5037] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5036] <... ioctl resumed>) = 0 [pid 5034] <... futex resumed>) = 0 [pid 5036] close(3 [pid 5034] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5036] <... close resumed>) = 0 [pid 5034] <... futex resumed>) = 1 [pid 5037] <... futex resumed>) = 0 [pid 5036] mkdir("./file1", 0777 [pid 5034] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5037] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5036] <... mkdir resumed>) = 0 [pid 5036] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5037] <... mount resumed>) = 0 [pid 5037] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5034] <... futex resumed>) = 0 [pid 5037] <... futex resumed>) = 1 [pid 5034] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5037] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5034] <... futex resumed>) = 0 [pid 5034] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5037] <... open resumed>) = 3 [pid 5037] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5034] <... futex resumed>) = 0 [ 46.803729][ T5036] syz-executor369[5036]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 46.816537][ T28] audit: type=1800 audit(1694162014.949:2): pid=5037 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor369" name="bus" dev="sda1" ino=1930 res=0 errno=0 [ 46.842834][ T5036] loop0: detected capacity change from 0 to 512 [pid 5037] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5034] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5037] <... write resumed>) = 262144 [pid 5034] <... futex resumed>) = 0 [pid 5037] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5034] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5037] <... futex resumed>) = 0 [pid 5034] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5037] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5036] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5036] ioctl(5, LOOP_CLR_FD) = 0 [pid 5036] close(5) = 0 [pid 5036] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5036] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5034] exit_group(0) = ? [pid 5036] <... futex resumed>) = ? [pid 5036] +++ exited with 0 +++ [pid 5037] <... futex resumed>) = ? [pid 5037] +++ exited with 0 +++ [pid 5034] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5034, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./0/bus") = 0 umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./0/binderfs") = 0 umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./0/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./0/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./0") = 0 mkdir("./1", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5039 attached , child_tidptr=0x555556e0f690) = 5039 [pid 5039] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5039] chdir("./1") = 0 [pid 5039] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5039] setpgid(0, 0) = 0 [pid 5039] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5039] write(3, "1000", 4) = 4 [pid 5039] close(3) = 0 [pid 5039] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5039] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5039] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5039] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5039] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5039] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5039] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5039] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5040 attached [pid 5040] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5039] <... clone3 resumed> => {parent_tid=[5040]}, 88) = 5040 [pid 5040] <... rseq resumed>) = 0 [pid 5039] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5039] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5040] set_robust_list(0x7f4380f929a0, 24) = 0 [pid 5039] <... futex resumed>) = 0 [pid 5040] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5039] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5039] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5040] memfd_create("syzkaller", 0 [pid 5039] <... mmap resumed>) = 0x7f4380f51000 [pid 5040] <... memfd_create resumed>) = 3 [pid 5039] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5040] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4378b51000 [pid 5039] <... mprotect resumed>) = 0 [pid 5039] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5039] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0}./strace-static-x86_64: Process 5041 attached [pid 5041] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5039] <... clone3 resumed> => {parent_tid=[5041]}, 88) = 5041 [pid 5041] <... rseq resumed>) = 0 [pid 5039] rt_sigprocmask(SIG_SETMASK, [], [pid 5041] set_robust_list(0x7f4380f719a0, 24 [pid 5039] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5041] <... set_robust_list resumed>) = 0 [pid 5039] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5041] rt_sigprocmask(SIG_SETMASK, [], [pid 5039] <... futex resumed>) = 0 [pid 5041] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5039] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5041] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [ 46.854183][ T5036] EXT4-fs error (device loop0): __ext4_fill_super:5473: comm syz-executor369: inode #2: comm syz-executor369: iget: illegal inode # [ 46.869089][ T5036] EXT4-fs (loop0): get root inode failed [ 46.874844][ T5036] EXT4-fs (loop0): mount failed [pid 5040] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5041] <... open resumed>) = 4 [pid 5041] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5039] <... futex resumed>) = 0 [pid 5039] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5039] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5041] <... futex resumed>) = 1 [pid 5041] fallocate(4, 0, 35143, 7) = 0 [pid 5041] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5039] <... futex resumed>) = 0 [pid 5041] <... futex resumed>) = 1 [pid 5039] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5041] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5039] <... futex resumed>) = 0 [pid 5041] <... mount resumed>) = 0 [pid 5039] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5041] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5039] <... futex resumed>) = 0 [pid 5039] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5039] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5041] <... futex resumed>) = 1 [pid 5041] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 5 [pid 5041] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5039] <... futex resumed>) = 0 [pid 5039] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5041] <... futex resumed>) = 1 [pid 5039] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5041] write(5, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190) = -1 ENOSPC (No space left on device) [pid 5041] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5039] <... futex resumed>) = 0 [pid 5041] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5040] <... write resumed>) = 262144 [pid 5040] munmap(0x7f4378b51000, 262144) = 0 [pid 5040] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 6 [pid 5040] ioctl(6, LOOP_SET_FD, 3) = 0 [pid 5040] close(3) = 0 [pid 5040] mkdir("./file1", 0777) = 0 [ 46.931599][ T28] audit: type=1800 audit(1694162015.069:3): pid=5041 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor369" name="bus" dev="sda1" ino=1930 res=0 errno=0 [ 46.961397][ T5040] loop0: detected capacity change from 0 to 512 [pid 5040] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue") = 0 [pid 5040] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5040] chdir("./file1") = 0 [pid 5040] ioctl(6, LOOP_CLR_FD) = 0 [pid 5040] close(6) = 0 [pid 5040] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5040] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5039] exit_group(0 [pid 5041] <... futex resumed>) = ? [pid 5039] <... exit_group resumed>) = ? [pid 5041] +++ exited with 0 +++ [pid 5040] <... futex resumed>) = ? [pid 5040] +++ exited with 0 +++ [pid 5039] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5039, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./1/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./1/bus") = 0 umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./1/binderfs") = 0 [ 46.980142][ T5040] EXT4-fs (loop0): 1 orphan inode deleted [ 46.986098][ T5040] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 46.999299][ T5040] ext4 filesystem being mounted at /root/syzkaller.F1Lso8/1/file1 supports timestamps until 2038-01-19 (0x7fffffff) umount2("./1/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./1/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./1/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./1/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./1/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./1/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./1") = 0 mkdir("./2", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556e0f690) = 5045 ./strace-static-x86_64: Process 5045 attached [pid 5045] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5045] chdir("./2") = 0 [pid 5045] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5045] setpgid(0, 0) = 0 [pid 5045] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5045] write(3, "1000", 4) = 4 [pid 5045] close(3) = 0 [pid 5045] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5045] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5045] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5045] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5045] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5045] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5045] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5045] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0} => {parent_tid=[5046]}, 88) = 5046 [pid 5045] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ./strace-static-x86_64: Process 5046 attached [pid 5045] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5045] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5045] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5045] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5045] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [ 47.026505][ T5033] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [pid 5045] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0}./strace-static-x86_64: Process 5047 attached [pid 5047] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5045] <... clone3 resumed> => {parent_tid=[5047]}, 88) = 5047 [pid 5045] rt_sigprocmask(SIG_SETMASK, [], [pid 5047] <... rseq resumed>) = 0 [pid 5045] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5047] set_robust_list(0x7f4380f719a0, 24) = 0 [pid 5045] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5047] rt_sigprocmask(SIG_SETMASK, [], [pid 5045] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5047] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5047] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 3 [pid 5047] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5045] <... futex resumed>) = 0 [pid 5045] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5047] <... futex resumed>) = 1 [pid 5045] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5047] fallocate(3, 0, 35143, 7) = 0 [pid 5047] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5045] <... futex resumed>) = 0 [pid 5047] <... futex resumed>) = 1 [pid 5045] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5047] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5045] <... futex resumed>) = 0 [pid 5047] <... mount resumed>) = 0 [pid 5045] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5047] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5045] <... futex resumed>) = 0 [pid 5045] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5045] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5047] <... futex resumed>) = 1 [pid 5047] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 4 [pid 5047] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5045] <... futex resumed>) = 0 [pid 5045] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5047] <... futex resumed>) = 1 [pid 5045] <... futex resumed>) = 0 [pid 5045] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5047] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 22455190) = -1 ENOSPC (No space left on device) [pid 5047] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5045] <... futex resumed>) = 0 [pid 5047] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5046] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053) = 0 [pid 5046] set_robust_list(0x7f4380f929a0, 24) = 0 [pid 5046] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5046] memfd_create("syzkaller", 0) = 5 [pid 5046] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4378b51000 [pid 5046] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 5046] munmap(0x7f4378b51000, 262144) = 0 [pid 5046] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 6 [pid 5046] ioctl(6, LOOP_SET_FD, 5) = 0 [pid 5046] close(5) = 0 [pid 5046] mkdir("./file1", 0777) = 0 [ 47.085893][ T28] audit: type=1800 audit(1694162015.209:4): pid=5047 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor369" name="bus" dev="sda1" ino=1930 res=0 errno=0 [ 47.106852][ T5046] loop0: detected capacity change from 0 to 512 [pid 5046] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue") = 0 [pid 5046] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 5 [pid 5046] chdir("./file1") = 0 [pid 5046] ioctl(6, LOOP_CLR_FD) = 0 [pid 5046] close(6) = 0 [pid 5046] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5046] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5045] exit_group(0 [pid 5047] <... futex resumed>) = ? [pid 5046] <... futex resumed>) = ? [pid 5045] <... exit_group resumed>) = ? [pid 5046] +++ exited with 0 +++ [pid 5047] +++ exited with 0 +++ [pid 5045] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5045, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./2/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./2/bus") = 0 umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./2/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./2/binderfs") = 0 [ 47.134872][ T5046] EXT4-fs (loop0): 1 orphan inode deleted [ 47.140682][ T5046] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 47.153363][ T5046] ext4 filesystem being mounted at /root/syzkaller.F1Lso8/2/file1 supports timestamps until 2038-01-19 (0x7fffffff) umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./2/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./2/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./2/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./2") = 0 mkdir("./3", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5050 attached , child_tidptr=0x555556e0f690) = 5050 [pid 5050] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5050] chdir("./3") = 0 [pid 5050] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5050] setpgid(0, 0) = 0 [pid 5050] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5050] write(3, "1000", 4) = 4 [pid 5050] close(3) = 0 [pid 5050] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5050] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5050] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5050] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5050] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5050] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5050] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5050] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0} => {parent_tid=[5051]}, 88) = 5051 [pid 5050] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5050] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5050] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 ./strace-static-x86_64: Process 5051 attached [pid 5050] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5050] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5051] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053) = 0 [pid 5051] set_robust_list(0x7f4380f929a0, 24) = 0 [pid 5051] rt_sigprocmask(SIG_SETMASK, [], [pid 5050] <... mprotect resumed>) = 0 [pid 5050] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5050] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} [pid 5051] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5051] memfd_create("syzkaller", 0./strace-static-x86_64: Process 5052 attached [pid 5050] <... clone3 resumed> => {parent_tid=[5052]}, 88) = 5052 [pid 5052] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5050] rt_sigprocmask(SIG_SETMASK, [], [pid 5052] <... rseq resumed>) = 0 [pid 5052] set_robust_list(0x7f4380f719a0, 24 [pid 5050] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5052] <... set_robust_list resumed>) = 0 [pid 5051] <... memfd_create resumed>) = 3 [pid 5050] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5052] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5050] <... futex resumed>) = 0 [ 47.191660][ T5033] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [pid 5052] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5050] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5052] <... open resumed>) = 4 [pid 5051] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5052] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5050] <... futex resumed>) = 0 [pid 5052] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5050] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5052] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5050] <... futex resumed>) = 0 [pid 5052] fallocate(4, 0, 35143, 7 [pid 5050] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5051] <... mmap resumed>) = 0x7f4378b51000 [pid 5051] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 5051] munmap(0x7f4378b51000, 262144) = 0 [pid 5051] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5051] ioctl(5, LOOP_SET_FD, 3 [pid 5052] <... fallocate resumed>) = 0 [pid 5051] <... ioctl resumed>) = 0 [pid 5052] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5051] close(3 [pid 5052] <... futex resumed>) = 1 [pid 5050] <... futex resumed>) = 0 [pid 5051] <... close resumed>) = 0 [pid 5052] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5050] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5052] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5051] mkdir("./file1", 0777 [pid 5050] <... futex resumed>) = 0 [pid 5052] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL) = 0 [pid 5050] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5052] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5050] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5052] <... futex resumed>) = 0 [pid 5050] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5052] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5050] <... futex resumed>) = 0 [pid 5052] <... open resumed>) = 3 [pid 5050] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5052] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5050] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5052] <... futex resumed>) = 0 [pid 5050] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5052] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5050] <... futex resumed>) = 0 [pid 5050] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5051] <... mkdir resumed>) = 0 [pid 5051] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5052] <... write resumed>) = 262144 [pid 5052] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5050] <... futex resumed>) = 0 [pid 5052] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5051] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 5051] ioctl(5, LOOP_CLR_FD) = 0 [pid 5051] close(5) = 0 [pid 5051] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5051] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5050] exit_group(0 [pid 5051] <... futex resumed>) = ? [pid 5050] <... exit_group resumed>) = ? [pid 5051] +++ exited with 0 +++ [pid 5052] <... futex resumed>) = ? [pid 5052] +++ exited with 0 +++ [pid 5050] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5050, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./3/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./3/bus") = 0 umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./3/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./3/binderfs") = 0 umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./3/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./3/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./3/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./3") = 0 mkdir("./4", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5053 attached , child_tidptr=0x555556e0f690) = 5053 [pid 5053] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5053] chdir("./4") = 0 [pid 5053] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5053] setpgid(0, 0) = 0 [pid 5053] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5053] write(3, "1000", 4) = 4 [pid 5053] close(3) = 0 [pid 5053] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5053] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5053] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5053] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5053] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5053] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5053] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5053] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0} => {parent_tid=[5054]}, 88) = 5054 [pid 5053] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5053] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5053] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5053] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5053] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5053] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5053] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0}./strace-static-x86_64: Process 5055 attached => {parent_tid=[5055]}, 88) = 5055 [pid 5055] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5053] rt_sigprocmask(SIG_SETMASK, [], [pid 5055] <... rseq resumed>) = 0 [pid 5053] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5055] set_robust_list(0x7f4380f719a0, 24 [pid 5053] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5055] <... set_robust_list resumed>) = 0 [pid 5055] rt_sigprocmask(SIG_SETMASK, [], [pid 5053] <... futex resumed>) = 0 [pid 5055] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5053] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [ 47.239795][ T28] audit: type=1800 audit(1694162015.379:5): pid=5052 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor369" name="bus" dev="sda1" ino=1930 res=0 errno=0 [ 47.249102][ T5051] loop0: detected capacity change from 0 to 512 [ 47.275821][ T5051] EXT4-fs (loop0): VFS: Can't find ext4 filesystem [pid 5055] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000./strace-static-x86_64: Process 5054 attached ) = 3 [pid 5054] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053) = 0 [pid 5054] set_robust_list(0x7f4380f929a0, 24) = 0 [pid 5054] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5054] memfd_create("syzkaller", 0) = 4 [pid 5054] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4378b51000 [pid 5054] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 5054] munmap(0x7f4378b51000, 262144) = 0 [pid 5054] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5054] ioctl(5, LOOP_SET_FD, 4 [pid 5055] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5054] <... ioctl resumed>) = 0 [pid 5055] <... futex resumed>) = 1 [pid 5054] close(4 [pid 5053] <... futex resumed>) = 0 [pid 5055] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5054] <... close resumed>) = 0 [pid 5053] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5055] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5054] mkdir("./file1", 0777 [pid 5055] fallocate(3, 0, 35143, 7 [pid 5054] <... mkdir resumed>) = 0 [pid 5053] <... futex resumed>) = 0 [pid 5054] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5053] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5055] <... fallocate resumed>) = 0 [pid 5055] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5053] <... futex resumed>) = 0 [pid 5055] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5053] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5055] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5053] <... futex resumed>) = 0 [pid 5055] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5053] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5055] <... mount resumed>) = 0 [pid 5055] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5055] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5053] <... futex resumed>) = 0 [pid 5053] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5055] <... futex resumed>) = 0 [pid 5055] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5053] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5055] <... open resumed>) = 4 [pid 5055] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5053] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5055] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5053] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5055] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5053] <... futex resumed>) = 0 [pid 5055] write(4, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [ 47.316490][ T28] audit: type=1800 audit(1694162015.449:6): pid=5055 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor369" name="bus" dev="sda1" ino=1930 res=0 errno=0 [ 47.337482][ T5054] loop0: detected capacity change from 0 to 512 [pid 5053] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5055] <... write resumed>) = 262144 [pid 5055] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5055] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5053] <... futex resumed>) = 0 [ 47.364367][ T5054] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:477: comm syz-executor369: Invalid block bitmap block 2 in block_group 0 [ 47.381268][ T5054] EXT4-fs error (device loop0) in ext4_mb_clear_bb:6627: Corrupt filesystem [ 47.390470][ T5054] EXT4-fs error (device loop0) in ext4_reserve_inode_write:5752: Corrupt filesystem [ 47.400163][ T5054] EXT4-fs error (device loop0): __ext4_ext_dirty:202: inode #16: comm syz-executor369: mark_inode_dirty error [ 47.412100][ T5054] EXT4-fs error (device loop0) in ext4_reserve_inode_write:5752: Corrupt filesystem [ 47.421781][ T5054] EXT4-fs error (device loop0): __ext4_ext_dirty:202: inode #16: comm syz-executor369: mark_inode_dirty error [ 47.433742][ T5054] EXT4-fs error (device loop0) in ext4_reserve_inode_write:5752: Corrupt filesystem [ 47.443305][ T5054] EXT4-fs error (device loop0): ext4_truncate:4184: inode #16: comm syz-executor369: mark_inode_dirty error [ 47.455106][ T5054] EXT4-fs error (device loop0): ext4_evict_inode:260: comm syz-executor369: couldn't truncate inode 16 (err -117) [pid 5054] <... mount resumed>) = 0 [pid 5054] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 6 [pid 5054] chdir("./file1") = 0 [pid 5054] ioctl(5, LOOP_CLR_FD) = 0 [pid 5054] close(5) = 0 [pid 5054] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5053] exit_group(0 [pid 5054] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5053] <... exit_group resumed>) = ? [pid 5054] <... futex resumed>) = ? [pid 5054] +++ exited with 0 +++ [pid 5055] <... futex resumed>) = ? [pid 5055] +++ exited with 0 +++ [pid 5053] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5053, si_uid=0, si_status=0, si_utime=0, si_stime=13 /* 0.13 s */} --- umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./4/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./4/bus") = 0 umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./4/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./4/binderfs") = 0 [ 47.467323][ T5054] EXT4-fs (loop0): 1 orphan inode deleted [ 47.473031][ T5054] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 47.485167][ T5054] ext4 filesystem being mounted at /root/syzkaller.F1Lso8/4/file1 supports timestamps until 2038-01-19 (0x7fffffff) umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./4/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./4/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./4/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./4") = 0 mkdir("./5", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5059 attached , child_tidptr=0x555556e0f690) = 5059 [pid 5059] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5059] chdir("./5") = 0 [pid 5059] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5059] setpgid(0, 0) = 0 [pid 5059] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5059] write(3, "1000", 4) = 4 [pid 5059] close(3) = 0 [pid 5059] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5059] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5059] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5059] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5059] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5059] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5059] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5059] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5060 attached [pid 5060] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5059] <... clone3 resumed> => {parent_tid=[5060]}, 88) = 5060 [pid 5060] <... rseq resumed>) = 0 [pid 5059] rt_sigprocmask(SIG_SETMASK, [], [pid 5060] set_robust_list(0x7f4380f929a0, 24 [pid 5059] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5060] <... set_robust_list resumed>) = 0 [pid 5059] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5060] rt_sigprocmask(SIG_SETMASK, [], [pid 5059] <... futex resumed>) = 0 [pid 5060] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5059] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5060] memfd_create("syzkaller", 0 [pid 5059] <... futex resumed>) = 0 [pid 5059] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5060] <... memfd_create resumed>) = 3 [pid 5060] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5059] <... mmap resumed>) = 0x7f4380f51000 [pid 5059] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5060] <... mmap resumed>) = 0x7f4378b51000 [pid 5059] <... mprotect resumed>) = 0 [pid 5060] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5059] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5059] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0}./strace-static-x86_64: Process 5061 attached [pid 5061] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053) = 0 [pid 5061] set_robust_list(0x7f4380f719a0, 24) = 0 [pid 5061] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5061] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5059] <... clone3 resumed> => {parent_tid=[5061]}, 88) = 5061 [pid 5060] <... write resumed>) = 262144 [pid 5059] rt_sigprocmask(SIG_SETMASK, [], [pid 5060] munmap(0x7f4378b51000, 262144 [pid 5059] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5059] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5061] <... futex resumed>) = 0 [pid 5059] <... futex resumed>) = 1 [pid 5061] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [ 47.521735][ T5033] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 47.531712][ T5033] EXT4-fs error (device loop0) in ext4_reserve_inode_write:5752: Corrupt filesystem [ 47.542120][ T5033] EXT4-fs error (device loop0): ext4_quota_off:7131: inode #3: comm syz-executor369: mark_inode_dirty error [pid 5059] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5061] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5060] <... munmap resumed>) = 0 [pid 5061] <... futex resumed>) = 1 [pid 5059] <... futex resumed>) = 0 [pid 5060] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5059] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5061] fallocate(4, 0, 35143, 7 [pid 5060] <... openat resumed>) = 5 [pid 5059] <... futex resumed>) = 0 [pid 5059] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5060] ioctl(5, LOOP_SET_FD, 3 [pid 5061] <... fallocate resumed>) = 0 [pid 5061] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5060] <... ioctl resumed>) = 0 [pid 5061] <... futex resumed>) = 1 [pid 5060] close(3 [pid 5059] <... futex resumed>) = 0 [pid 5061] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5060] <... close resumed>) = 0 [pid 5059] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5061] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5060] mkdir("./file1", 0777 [pid 5059] <... futex resumed>) = 0 [pid 5061] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5060] <... mkdir resumed>) = 0 [pid 5059] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5061] <... mount resumed>) = 0 [pid 5061] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5059] <... futex resumed>) = 0 [pid 5061] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5059] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5061] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5059] <... futex resumed>) = 0 [pid 5061] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5060] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5059] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5061] <... open resumed>) = 3 [pid 5061] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5059] <... futex resumed>) = 0 [pid 5061] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5059] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5061] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5059] <... futex resumed>) = 0 [pid 5061] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5059] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5061] <... write resumed>) = 262144 [pid 5061] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5060] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5061] <... futex resumed>) = 1 [pid 5059] <... futex resumed>) = 0 [pid 5061] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5060] ioctl(5, LOOP_CLR_FD) = 0 [pid 5060] close(5) = 0 [pid 5060] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5060] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5059] exit_group(0) = ? [pid 5061] <... futex resumed>) = ? [pid 5061] +++ exited with 0 +++ [pid 5060] <... futex resumed>) = ? [pid 5060] +++ exited with 0 +++ [pid 5059] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5059, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- umount2("./5", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./5/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./5/bus") = 0 umount2("./5/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./5/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./5/binderfs") = 0 umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./5/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./5/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./5/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./5") = 0 mkdir("./6", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5062 attached , child_tidptr=0x555556e0f690) = 5062 [pid 5062] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5062] chdir("./6") = 0 [pid 5062] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5062] setpgid(0, 0) = 0 [pid 5062] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5062] write(3, "1000", 4) = 4 [pid 5062] close(3) = 0 [pid 5062] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5062] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5062] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5062] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5062] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5062] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5062] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5062] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5063 attached => {parent_tid=[5063]}, 88) = 5063 [pid 5063] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053) = 0 [pid 5062] rt_sigprocmask(SIG_SETMASK, [], [pid 5063] set_robust_list(0x7f4380f929a0, 24 [pid 5062] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5062] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5063] <... set_robust_list resumed>) = 0 [pid 5063] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5063] memfd_create("syzkaller", 0) = 3 [pid 5063] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4378b72000 [pid 5062] <... futex resumed>) = 0 [pid 5062] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5062] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4378b51000 [pid 5062] mprotect(0x7f4378b52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5062] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5062] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4378b71990, parent_tid=0x7f4378b71990, exit_signal=0, stack=0x7f4378b51000, stack_size=0x20300, tls=0x7f4378b716c0} => {parent_tid=[5064]}, 88) = 5064 [pid 5062] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5062] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5062] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5063] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 5063] munmap(0x7f4378b72000, 262144./strace-static-x86_64: Process 5064 attached [ 47.596421][ T28] audit: type=1800 audit(1694162015.729:7): pid=5061 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor369" name="bus" dev="sda1" ino=1930 res=0 errno=0 [ 47.599784][ T5060] loop0: detected capacity change from 0 to 512 [ 47.632549][ T5060] EXT4-fs warning (device loop0): read_mmp_block:114: Error -117 while reading MMP block 8 [pid 5064] rseq(0x7f4378b71fe0, 0x20, 0, 0x53053053 [pid 5063] <... munmap resumed>) = 0 [pid 5063] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5064] <... rseq resumed>) = 0 [pid 5064] set_robust_list(0x7f4378b719a0, 24) = 0 [pid 5064] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5063] <... openat resumed>) = 4 [pid 5064] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5063] ioctl(4, LOOP_SET_FD, 3 [pid 5064] <... open resumed>) = 5 [pid 5063] <... ioctl resumed>) = 0 [pid 5063] close(3) = 0 [pid 5063] mkdir("./file1", 0777) = 0 [pid 5063] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5064] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5062] <... futex resumed>) = 0 [pid 5062] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5062] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5064] <... futex resumed>) = 1 [pid 5064] fallocate(5, 0, 35143, 7) = 0 [pid 5064] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5064] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5062] <... futex resumed>) = 0 [pid 5062] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5064] <... futex resumed>) = 0 [pid 5062] <... futex resumed>) = 1 [pid 5064] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL) = 0 [pid 5062] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5064] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5062] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5064] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5062] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5064] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5062] <... futex resumed>) = 0 [pid 5064] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5062] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5064] <... open resumed>) = 3 [pid 5064] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5062] <... futex resumed>) = 0 [pid 5064] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5062] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5064] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5062] <... futex resumed>) = 0 [pid 5064] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [ 47.679684][ T5063] loop0: detected capacity change from 0 to 512 [ 47.680121][ T28] audit: type=1800 audit(1694162015.819:8): pid=5064 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor369" name="bus" dev="sda1" ino=1930 res=0 errno=0 [pid 5062] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5064] <... write resumed>) = 262144 [pid 5064] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5062] <... futex resumed>) = 0 [pid 5064] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5063] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5063] ioctl(4, LOOP_CLR_FD) = 0 [pid 5063] close(4) = 0 [pid 5063] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5063] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5062] exit_group(0 [pid 5064] <... futex resumed>) = ? [pid 5062] <... exit_group resumed>) = ? [pid 5064] +++ exited with 0 +++ [pid 5063] <... futex resumed>) = ? [pid 5063] +++ exited with 0 +++ [pid 5062] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5062, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- umount2("./6", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./6/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./6/bus") = 0 umount2("./6/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./6/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./6/binderfs") = 0 umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./6/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./6/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./6/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./6") = 0 mkdir("./7", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5067 attached , child_tidptr=0x555556e0f690) = 5067 [pid 5067] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5067] chdir("./7") = 0 [pid 5067] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5067] setpgid(0, 0) = 0 [pid 5067] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5067] write(3, "1000", 4) = 4 [pid 5067] close(3) = 0 [pid 5067] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5067] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5067] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5067] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5067] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5067] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5067] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5067] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5068 attached [pid 5068] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5067] <... clone3 resumed> => {parent_tid=[5068]}, 88) = 5068 [pid 5068] <... rseq resumed>) = 0 [pid 5067] rt_sigprocmask(SIG_SETMASK, [], [pid 5068] set_robust_list(0x7f4380f929a0, 24) = 0 [pid 5067] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5068] rt_sigprocmask(SIG_SETMASK, [], [pid 5067] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5068] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5067] <... futex resumed>) = 0 [pid 5067] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5067] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5068] memfd_create("syzkaller", 0 [pid 5067] <... mmap resumed>) = 0x7f4380f51000 [pid 5067] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5068] <... memfd_create resumed>) = 3 [pid 5067] <... mprotect resumed>) = 0 [pid 5068] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5067] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5068] <... mmap resumed>) = 0x7f4378b51000 [pid 5067] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5067] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0}./strace-static-x86_64: Process 5069 attached => {parent_tid=[5069]}, 88) = 5069 [pid 5067] rt_sigprocmask(SIG_SETMASK, [], [pid 5069] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5067] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5069] <... rseq resumed>) = 0 [pid 5067] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5068] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5069] set_robust_list(0x7f4380f719a0, 24 [pid 5067] <... futex resumed>) = 0 [pid 5069] <... set_robust_list resumed>) = 0 [pid 5067] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5069] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5069] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [ 47.722129][ T5065] EXT4-fs warning (device loop0): kmmpd:167: kmmpd being stopped since MMP feature has been disabled. [ 47.733261][ T5063] EXT4-fs error (device loop0): __ext4_fill_super:5473: comm syz-executor369: inode #2: comm syz-executor369: iget: illegal inode # [ 47.747303][ T5063] EXT4-fs (loop0): get root inode failed [ 47.753024][ T5063] EXT4-fs (loop0): mount failed [pid 5068] <... write resumed>) = 262144 [pid 5068] munmap(0x7f4378b51000, 262144 [pid 5069] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5069] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5068] <... munmap resumed>) = 0 [pid 5068] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5067] <... futex resumed>) = 0 [pid 5067] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5069] <... futex resumed>) = 0 [pid 5069] fallocate(4, 0, 35143, 7 [pid 5068] <... openat resumed>) = 5 [pid 5068] ioctl(5, LOOP_SET_FD, 3 [pid 5067] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5068] <... ioctl resumed>) = 0 [pid 5068] close(3) = 0 [pid 5068] mkdir("./file1", 0777 [pid 5069] <... fallocate resumed>) = 0 [pid 5069] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5067] <... futex resumed>) = 0 [pid 5067] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5067] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5069] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5068] <... mkdir resumed>) = 0 [pid 5069] <... mount resumed>) = 0 [pid 5068] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5069] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5067] <... futex resumed>) = 0 [pid 5067] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5067] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5069] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 3 [pid 5069] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5067] <... futex resumed>) = 0 [pid 5067] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5067] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5069] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190) = 262144 [pid 5069] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5067] <... futex resumed>) = 0 [ 47.812725][ T28] audit: type=1800 audit(1694162015.949:9): pid=5069 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor369" name="bus" dev="sda1" ino=1930 res=0 errno=0 [ 47.836237][ T5068] loop0: detected capacity change from 0 to 512 [pid 5069] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5068] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5068] ioctl(5, LOOP_CLR_FD) = 0 [pid 5068] close(5) = 0 [pid 5068] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5068] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5067] exit_group(0 [pid 5069] <... futex resumed>) = ? [pid 5068] <... futex resumed>) = ? [pid 5067] <... exit_group resumed>) = ? [pid 5069] +++ exited with 0 +++ [pid 5068] +++ exited with 0 +++ [pid 5067] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5067, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./7", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./7/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./7/bus") = 0 umount2("./7/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./7/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./7/binderfs") = 0 umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./7/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./7/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./7/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./7") = 0 [ 47.857210][ T5068] EXT4-fs warning (device loop0): read_mmp_block:114: Error -117 while reading MMP block 8 mkdir("./8", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5070 attached , child_tidptr=0x555556e0f690) = 5070 [pid 5070] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5070] chdir("./8") = 0 [pid 5070] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5070] setpgid(0, 0) = 0 [pid 5070] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5070] write(3, "1000", 4) = 4 [pid 5070] close(3) = 0 [pid 5070] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5070] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5070] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5070] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5070] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5070] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5070] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5070] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5071 attached [pid 5071] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053) = 0 [pid 5071] set_robust_list(0x7f4380f929a0, 24) = 0 [pid 5071] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5071] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5070] <... clone3 resumed> => {parent_tid=[5071]}, 88) = 5071 [pid 5070] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5070] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5071] <... futex resumed>) = 0 [pid 5070] <... futex resumed>) = 1 [pid 5071] memfd_create("syzkaller", 0) = 3 [pid 5071] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5070] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5071] <... mmap resumed>) = 0x7f4378b72000 [pid 5070] <... futex resumed>) = 0 [pid 5070] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4378b51000 [pid 5070] mprotect(0x7f4378b52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5070] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5071] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5070] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4378b71990, parent_tid=0x7f4378b71990, exit_signal=0, stack=0x7f4378b51000, stack_size=0x20300, tls=0x7f4378b716c0} => {parent_tid=[5072]}, 88) = 5072 [pid 5070] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5070] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5070] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5072 attached [pid 5072] rseq(0x7f4378b71fe0, 0x20, 0, 0x53053053) = 0 [pid 5072] set_robust_list(0x7f4378b719a0, 24) = 0 [pid 5072] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5071] <... write resumed>) = 262144 [pid 5072] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 5071] munmap(0x7f4378b72000, 262144 [pid 5072] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5072] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5071] <... munmap resumed>) = 0 [pid 5070] <... futex resumed>) = 0 [pid 5070] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5072] <... futex resumed>) = 0 [pid 5072] fallocate(4, 0, 35143, 7 [pid 5071] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5070] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5071] <... openat resumed>) = 5 [pid 5071] ioctl(5, LOOP_SET_FD, 3 [pid 5072] <... fallocate resumed>) = 0 [pid 5071] <... ioctl resumed>) = 0 [pid 5071] close(3) = 0 [pid 5071] mkdir("./file1", 0777 [pid 5072] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5070] <... futex resumed>) = 0 [pid 5070] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5070] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5072] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5071] <... mkdir resumed>) = 0 [pid 5071] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5072] <... mount resumed>) = 0 [pid 5072] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5070] <... futex resumed>) = 0 [pid 5072] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5070] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5070] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5072] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5072] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 3 [pid 5072] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5070] <... futex resumed>) = 0 [pid 5070] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5070] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5072] <... futex resumed>) = 1 [pid 5072] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190) = 262144 [pid 5072] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5070] <... futex resumed>) = 0 [pid 5072] <... futex resumed>) = 1 [ 47.930390][ T28] audit: type=1800 audit(1694162016.069:10): pid=5072 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor369" name="bus" dev="sda1" ino=1930 res=0 errno=0 [ 47.954571][ T5071] loop0: detected capacity change from 0 to 512 [pid 5072] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5071] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5071] ioctl(5, LOOP_CLR_FD) = 0 [pid 5071] close(5) = 0 [pid 5071] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5071] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5070] exit_group(0) = ? [pid 5072] <... futex resumed>) = ? [pid 5071] <... futex resumed>) = ? [pid 5072] +++ exited with 0 +++ [pid 5071] +++ exited with 0 +++ [pid 5070] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5070, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./8", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./8/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./8/bus") = 0 umount2("./8/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./8/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./8/binderfs") = 0 umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./8/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./8/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./8/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./8") = 0 mkdir("./9", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5073 attached , child_tidptr=0x555556e0f690) = 5073 [pid 5073] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5073] chdir("./9") = 0 [pid 5073] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5073] setpgid(0, 0) = 0 [pid 5073] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5073] write(3, "1000", 4) = 4 [pid 5073] close(3) = 0 [pid 5073] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5073] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5073] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5073] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5073] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5073] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5073] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5073] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5074 attached => {parent_tid=[5074]}, 88) = 5074 [pid 5073] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5073] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5073] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5073] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5073] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5074] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053) = 0 [pid 5074] set_robust_list(0x7f4380f929a0, 24) = 0 [pid 5074] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5074] memfd_create("syzkaller", 0) = 3 [ 47.977059][ T5071] EXT4-fs warning (device loop0): read_mmp_block:114: Error -117 while reading MMP block 8 [pid 5074] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4378b51000 [pid 5073] <... mprotect resumed>) = 0 [pid 5073] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5074] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5073] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5073] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0}./strace-static-x86_64: Process 5075 attached => {parent_tid=[5075]}, 88) = 5075 [pid 5075] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5073] rt_sigprocmask(SIG_SETMASK, [], [pid 5075] <... rseq resumed>) = 0 [pid 5073] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] set_robust_list(0x7f4380f719a0, 24 [pid 5073] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... set_robust_list resumed>) = 0 [pid 5073] <... futex resumed>) = 0 [pid 5075] rt_sigprocmask(SIG_SETMASK, [], [pid 5073] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5075] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5074] <... write resumed>) = 262144 [pid 5074] munmap(0x7f4378b51000, 262144 [pid 5075] <... open resumed>) = 4 [pid 5074] <... munmap resumed>) = 0 [pid 5074] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5074] ioctl(5, LOOP_SET_FD, 3 [pid 5075] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5073] <... futex resumed>) = 0 [pid 5075] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5073] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5073] <... futex resumed>) = 0 [pid 5075] fallocate(4, 0, 35143, 7 [pid 5073] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] <... ioctl resumed>) = 0 [pid 5074] close(3) = 0 [pid 5074] mkdir("./file1", 0777) = 0 [pid 5074] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5075] <... fallocate resumed>) = 0 [pid 5075] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5073] <... futex resumed>) = 0 [pid 5073] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5073] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] <... futex resumed>) = 1 [pid 5075] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL) = 0 [pid 5075] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5073] <... futex resumed>) = 0 [pid 5073] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... futex resumed>) = 1 [pid 5073] <... futex resumed>) = 0 [pid 5073] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 3 [pid 5075] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5073] <... futex resumed>) = 0 [pid 5073] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5073] <... futex resumed>) = 0 [pid 5073] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5075] <... write resumed>) = 262144 [pid 5075] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5073] <... futex resumed>) = 0 [pid 5075] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5074] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5074] ioctl(5, LOOP_CLR_FD) = 0 [pid 5074] close(5) = 0 [pid 5074] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5074] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5073] exit_group(0 [pid 5075] <... futex resumed>) = ? [pid 5074] <... futex resumed>) = ? [pid 5074] +++ exited with 0 +++ [pid 5073] <... exit_group resumed>) = ? [pid 5075] +++ exited with 0 +++ [pid 5073] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5073, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./9/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./9/bus") = 0 umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./9/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./9/binderfs") = 0 umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./9/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./9/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./9/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./9") = 0 mkdir("./10", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5076 attached , child_tidptr=0x555556e0f690) = 5076 [pid 5076] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5076] chdir("./10") = 0 [pid 5076] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5076] setpgid(0, 0) = 0 [ 48.049697][ T28] audit: type=1800 audit(1694162016.189:11): pid=5075 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor369" name="bus" dev="sda1" ino=1930 res=0 errno=0 [ 48.057550][ T5074] loop0: detected capacity change from 0 to 512 [ 48.087530][ T5074] EXT4-fs warning (device loop0): read_mmp_block:114: Error -117 while reading MMP block 8 [pid 5076] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5076] write(3, "1000", 4) = 4 [pid 5076] close(3) = 0 [pid 5076] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5076] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5076] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5076] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5076] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5076] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5076] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5076] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0} => {parent_tid=[5077]}, 88) = 5077 [pid 5076] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5076] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5076] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5076] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5076] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE./strace-static-x86_64: Process 5077 attached ) = 0 [pid 5077] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053) = 0 [pid 5076] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5077] set_robust_list(0x7f4380f929a0, 24 [pid 5076] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5077] <... set_robust_list resumed>) = 0 [pid 5077] rt_sigprocmask(SIG_SETMASK, [], [pid 5076] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} [pid 5077] <... rt_sigprocmask resumed>NULL, 8) = 0 ./strace-static-x86_64: Process 5078 attached [pid 5077] memfd_create("syzkaller", 0 [pid 5078] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053) = 0 [pid 5078] set_robust_list(0x7f4380f719a0, 24) = 0 [pid 5078] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5078] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5077] <... memfd_create resumed>) = 3 [pid 5076] <... clone3 resumed> => {parent_tid=[5078]}, 88) = 5078 [pid 5077] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4378b51000 [pid 5077] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5076] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5076] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5078] <... futex resumed>) = 0 [pid 5076] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 5078] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] <... write resumed>) = 262144 [pid 5078] <... futex resumed>) = 1 [pid 5077] munmap(0x7f4378b51000, 262144 [pid 5076] <... futex resumed>) = 0 [pid 5078] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5077] <... munmap resumed>) = 0 [pid 5076] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5078] <... futex resumed>) = 0 [pid 5076] <... futex resumed>) = 1 [pid 5078] fallocate(4, 0, 35143, 7 [pid 5076] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5077] <... openat resumed>) = 5 [pid 5077] ioctl(5, LOOP_SET_FD, 3 [pid 5078] <... fallocate resumed>) = 0 [pid 5077] <... ioctl resumed>) = 0 [pid 5078] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5077] close(3 [pid 5078] <... futex resumed>) = 1 [pid 5077] <... close resumed>) = 0 [pid 5076] <... futex resumed>) = 0 [pid 5078] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5077] mkdir("./file1", 0777 [pid 5076] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5077] <... mkdir resumed>) = 0 [pid 5076] <... futex resumed>) = 0 [pid 5078] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5077] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5076] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] <... mount resumed>) = 0 [pid 5078] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5076] <... futex resumed>) = 0 [pid 5076] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5076] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 3 [pid 5078] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5076] <... futex resumed>) = 0 [pid 5076] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5076] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5078] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190) = 262144 [pid 5078] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5076] <... futex resumed>) = 0 [pid 5078] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5077] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5077] ioctl(5, LOOP_CLR_FD) = 0 [pid 5077] close(5) = 0 [pid 5077] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5077] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5076] exit_group(0 [pid 5078] <... futex resumed>) = ? [pid 5078] +++ exited with 0 +++ [pid 5077] <... futex resumed>) = ? [pid 5077] +++ exited with 0 +++ [pid 5076] <... exit_group resumed>) = ? [pid 5076] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5076, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./10/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./10/bus") = 0 umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./10/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./10/binderfs") = 0 umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./10/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./10/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./10/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./10") = 0 mkdir("./11", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556e0f690) = 5079 ./strace-static-x86_64: Process 5079 attached [pid 5079] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5079] chdir("./11") = 0 [pid 5079] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5079] setpgid(0, 0) = 0 [pid 5079] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5079] write(3, "1000", 4) = 4 [pid 5079] close(3) = 0 [pid 5079] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5079] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5079] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5079] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5079] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5079] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5079] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5079] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0} => {parent_tid=[5080]}, 88) = 5080 [pid 5079] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5079] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 ./strace-static-x86_64: Process 5080 attached [pid 5079] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5080] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5079] <... futex resumed>) = 0 [pid 5080] <... rseq resumed>) = 0 [pid 5079] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5079] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5080] set_robust_list(0x7f4380f929a0, 24) = 0 [pid 5079] <... mprotect resumed>) = 0 [pid 5080] rt_sigprocmask(SIG_SETMASK, [], [pid 5079] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5080] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5079] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} [pid 5080] memfd_create("syzkaller", 0 [pid 5079] <... clone3 resumed> => {parent_tid=[5081]}, 88) = 5081 [pid 5079] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5079] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5079] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5081 attached [pid 5081] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053) = 0 [pid 5081] set_robust_list(0x7f4380f719a0, 24) = 0 [pid 5081] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5081] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5080] <... memfd_create resumed>) = 4 [pid 5080] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5081] <... open resumed>) = 3 [pid 5081] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5080] <... mmap resumed>) = 0x7f4378b51000 [pid 5081] <... futex resumed>) = 1 [pid 5079] <... futex resumed>) = 0 [pid 5081] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5079] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5081] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5081] fallocate(3, 0, 35143, 7 [pid 5079] <... futex resumed>) = 0 [pid 5079] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5080] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 5080] munmap(0x7f4378b51000, 262144 [pid 5081] <... fallocate resumed>) = 0 [ 48.149698][ T5077] loop0: detected capacity change from 0 to 512 [ 48.167163][ T5077] EXT4-fs warning (device loop0): read_mmp_block:114: Error -117 while reading MMP block 8 [pid 5081] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5080] <... munmap resumed>) = 0 [pid 5081] <... futex resumed>) = 1 [pid 5080] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5079] <... futex resumed>) = 0 [pid 5081] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5080] <... openat resumed>) = 5 [pid 5080] ioctl(5, LOOP_SET_FD, 4 [pid 5079] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5081] <... futex resumed>) = 0 [pid 5079] <... futex resumed>) = 1 [pid 5081] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5079] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5081] <... mount resumed>) = 0 [pid 5081] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5079] <... futex resumed>) = 0 [pid 5079] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5081] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5079] <... futex resumed>) = 0 [pid 5079] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5081] <... open resumed>) = 6 [pid 5081] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5081] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5080] <... ioctl resumed>) = 0 [pid 5080] close(4) = 0 [pid 5080] mkdir("./file1", 0777 [pid 5079] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5079] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5081] <... futex resumed>) = 0 [pid 5081] write(6, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5079] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5081] <... write resumed>) = 262144 [pid 5081] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5079] <... futex resumed>) = 0 [pid 5081] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5080] <... mkdir resumed>) = 0 [pid 5080] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue") = -1 EINVAL (Invalid argument) [pid 5080] ioctl(5, LOOP_CLR_FD) = 0 [pid 5080] close(5) = 0 [pid 5080] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5080] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5079] exit_group(0 [pid 5081] <... futex resumed>) = ? [pid 5080] <... futex resumed>) = ? [pid 5081] +++ exited with 0 +++ [pid 5079] <... exit_group resumed>) = ? [pid 5080] +++ exited with 0 +++ [pid 5079] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5079, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./11/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./11/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./11/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./11/bus") = 0 umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./11/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./11/binderfs") = 0 umount2("./11/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./11/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./11/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./11/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./11/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./11") = 0 mkdir("./12", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 [ 48.231937][ T5080] loop0: detected capacity change from 0 to 512 [ 48.249405][ T5080] EXT4-fs (loop0): VFS: Can't find ext4 filesystem clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556e0f690) = 5082 ./strace-static-x86_64: Process 5082 attached [pid 5082] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5082] chdir("./12") = 0 [pid 5082] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5082] setpgid(0, 0) = 0 [pid 5082] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5082] write(3, "1000", 4) = 4 [pid 5082] close(3) = 0 [pid 5082] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5082] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5082] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5082] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5082] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5082] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5082] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5082] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0} => {parent_tid=[5083]}, 88) = 5083 [pid 5082] rt_sigprocmask(SIG_SETMASK, [], ./strace-static-x86_64: Process 5083 attached [pid 5083] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5082] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5083] <... rseq resumed>) = 0 [pid 5083] set_robust_list(0x7f4380f929a0, 24 [pid 5082] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5082] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5082] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5082] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5083] <... set_robust_list resumed>) = 0 [pid 5082] <... mprotect resumed>) = 0 [pid 5082] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5082] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0}./strace-static-x86_64: Process 5084 attached => {parent_tid=[5084]}, 88) = 5084 [pid 5083] rt_sigprocmask(SIG_SETMASK, [], [pid 5084] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5083] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5082] rt_sigprocmask(SIG_SETMASK, [], [pid 5084] <... rseq resumed>) = 0 [pid 5082] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5084] set_robust_list(0x7f4380f719a0, 24 [pid 5082] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5084] <... set_robust_list resumed>) = 0 [pid 5082] <... futex resumed>) = 0 [pid 5084] rt_sigprocmask(SIG_SETMASK, [], [pid 5082] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5083] memfd_create("syzkaller", 0 [pid 5084] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5084] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 3 [pid 5083] <... memfd_create resumed>) = 4 [pid 5084] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5083] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5082] <... futex resumed>) = 0 [pid 5084] <... futex resumed>) = 1 [pid 5084] fallocate(3, 0, 35143, 7 [pid 5082] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5082] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5083] <... mmap resumed>) = 0x7f4378b51000 [pid 5083] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5084] <... fallocate resumed>) = 0 [pid 5083] <... write resumed>) = 262144 [pid 5084] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5083] munmap(0x7f4378b51000, 262144 [pid 5084] <... futex resumed>) = 1 [pid 5082] <... futex resumed>) = 0 [pid 5084] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5083] <... munmap resumed>) = 0 [pid 5082] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5084] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5084] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5083] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5082] <... futex resumed>) = 0 [pid 5082] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5084] <... mount resumed>) = 0 [pid 5083] <... openat resumed>) = 5 [pid 5084] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5083] ioctl(5, LOOP_SET_FD, 4 [pid 5084] <... futex resumed>) = 1 [pid 5084] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5082] <... futex resumed>) = 0 [pid 5083] <... ioctl resumed>) = 0 [pid 5082] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5084] <... futex resumed>) = 0 [pid 5083] close(4 [pid 5082] <... futex resumed>) = 1 [pid 5083] <... close resumed>) = 0 [pid 5084] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 4 [pid 5083] mkdir("./file1", 0777 [pid 5082] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5084] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5082] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5084] <... futex resumed>) = 0 [pid 5084] write(4, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5082] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5083] <... mkdir resumed>) = 0 [pid 5082] <... futex resumed>) = 0 [pid 5083] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5082] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5084] <... write resumed>) = 262144 [pid 5084] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5083] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 5084] <... futex resumed>) = 1 [pid 5082] <... futex resumed>) = 0 [pid 5084] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5083] ioctl(5, LOOP_CLR_FD) = 0 [pid 5083] close(5) = 0 [pid 5083] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5082] exit_group(0 [pid 5084] <... futex resumed>) = ? [pid 5083] <... futex resumed>) = ? [pid 5082] <... exit_group resumed>) = ? [pid 5084] +++ exited with 0 +++ [pid 5083] +++ exited with 0 +++ [pid 5082] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5082, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./12", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./12/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./12/bus") = 0 umount2("./12/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./12/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./12/binderfs") = 0 umount2("./12/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./12/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./12/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./12/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./12/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./12") = 0 mkdir("./13", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5085 attached , child_tidptr=0x555556e0f690) = 5085 [pid 5085] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5085] chdir("./13") = 0 [pid 5085] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5085] setpgid(0, 0) = 0 [pid 5085] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5085] write(3, "1000", 4) = 4 [pid 5085] close(3) = 0 [pid 5085] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5085] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5085] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5085] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5085] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5085] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5085] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5085] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5086 attached => {parent_tid=[5086]}, 88) = 5086 [pid 5085] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5085] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5085] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5085] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5085] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5086] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5085] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5085] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} [pid 5086] <... rseq resumed>) = 0 ./strace-static-x86_64: Process 5087 attached [pid 5086] set_robust_list(0x7f4380f929a0, 24 [pid 5085] <... clone3 resumed> => {parent_tid=[5087]}, 88) = 5087 [pid 5087] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5086] <... set_robust_list resumed>) = 0 [pid 5085] rt_sigprocmask(SIG_SETMASK, [], [pid 5087] <... rseq resumed>) = 0 [pid 5086] rt_sigprocmask(SIG_SETMASK, [], [pid 5085] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5087] set_robust_list(0x7f4380f719a0, 24 [pid 5086] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5085] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5087] <... set_robust_list resumed>) = 0 [pid 5085] <... futex resumed>) = 0 [pid 5087] rt_sigprocmask(SIG_SETMASK, [], [pid 5085] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5087] <... rt_sigprocmask resumed>NULL, 8) = 0 [ 48.316400][ T5083] loop0: detected capacity change from 0 to 512 [ 48.329182][ T5083] EXT4-fs (loop0): VFS: Can't find ext4 filesystem [pid 5087] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 3 [pid 5086] memfd_create("syzkaller", 0 [pid 5087] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5086] <... memfd_create resumed>) = 4 [pid 5085] <... futex resumed>) = 0 [pid 5087] <... futex resumed>) = 1 [pid 5085] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5087] fallocate(3, 0, 35143, 7 [pid 5085] <... futex resumed>) = 0 [pid 5085] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5086] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5087] <... fallocate resumed>) = 0 [pid 5087] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5085] <... futex resumed>) = 0 [pid 5087] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5085] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5087] <... futex resumed>) = 0 [pid 5087] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL) = 0 [pid 5087] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5087] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5085] <... futex resumed>) = 1 [pid 5086] <... mmap resumed>) = 0x7f4378b51000 [pid 5085] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 5085] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5087] <... futex resumed>) = 0 [pid 5085] <... futex resumed>) = 1 [pid 5087] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5085] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5087] <... open resumed>) = 5 [pid 5087] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5085] <... futex resumed>) = 0 [pid 5087] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5085] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5087] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5087] write(5, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190) = -1 ENOSPC (No space left on device) [pid 5085] <... futex resumed>) = 0 [pid 5087] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5085] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5087] <... futex resumed>) = 0 [pid 5085] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5087] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5086] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 5086] munmap(0x7f4378b51000, 262144) = 0 [pid 5086] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 6 [pid 5086] ioctl(6, LOOP_SET_FD, 4) = 0 [pid 5086] close(4) = 0 [pid 5086] mkdir("./file1", 0777) = 0 [ 48.390283][ T5086] loop0: detected capacity change from 0 to 512 [ 48.411125][ T5086] EXT4-fs (loop0): 1 orphan inode deleted [ 48.416846][ T5086] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [pid 5086] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue") = 0 [pid 5086] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 4 [pid 5086] chdir("./file1") = 0 [pid 5086] ioctl(6, LOOP_CLR_FD) = 0 [pid 5086] close(6) = 0 [pid 5086] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5086] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5085] exit_group(0 [pid 5087] <... futex resumed>) = ? [pid 5085] <... exit_group resumed>) = ? [pid 5087] +++ exited with 0 +++ [pid 5086] <... futex resumed>) = ? [pid 5086] +++ exited with 0 +++ [pid 5085] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5085, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- umount2("./13", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./13/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./13/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./13/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./13/bus") = 0 umount2("./13/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./13/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./13/binderfs") = 0 [ 48.429919][ T5086] ext4 filesystem being mounted at /root/syzkaller.F1Lso8/13/file1 supports timestamps until 2038-01-19 (0x7fffffff) umount2("./13/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./13/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./13/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./13/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./13/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./13/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./13") = 0 mkdir("./14", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5091 attached , child_tidptr=0x555556e0f690) = 5091 [pid 5091] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5091] chdir("./14") = 0 [pid 5091] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5091] setpgid(0, 0) = 0 [pid 5091] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5091] write(3, "1000", 4) = 4 [pid 5091] close(3) = 0 [pid 5091] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5091] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5091] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5091] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5091] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5091] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5091] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5091] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5092 attached => {parent_tid=[5092]}, 88) = 5092 [pid 5092] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053) = 0 [pid 5091] rt_sigprocmask(SIG_SETMASK, [], [pid 5092] set_robust_list(0x7f4380f929a0, 24) = 0 [pid 5091] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5092] rt_sigprocmask(SIG_SETMASK, [], [pid 5091] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5092] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5091] <... futex resumed>) = 0 [pid 5092] memfd_create("syzkaller", 0 [pid 5091] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5091] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5092] <... memfd_create resumed>) = 3 [pid 5091] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5092] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4378b51000 [pid 5091] <... mprotect resumed>) = 0 [pid 5091] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5091] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} => {parent_tid=[5093]}, 88) = 5093 [pid 5091] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ./strace-static-x86_64: Process 5093 attached [pid 5091] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5091] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5093] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053) = 0 [pid 5093] set_robust_list(0x7f4380f719a0, 24) = 0 [pid 5093] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5093] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5092] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5093] <... open resumed>) = 4 [pid 5092] <... write resumed>) = 262144 [pid 5092] munmap(0x7f4378b51000, 262144) = 0 [pid 5092] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5092] ioctl(5, LOOP_SET_FD, 3 [ 48.468577][ T5033] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [pid 5093] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5091] <... futex resumed>) = 0 [pid 5093] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5091] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5092] <... ioctl resumed>) = 0 [pid 5093] <... futex resumed>) = 0 [pid 5091] <... futex resumed>) = 1 [pid 5093] fallocate(4, 0, 35143, 7 [pid 5092] close(3 [pid 5091] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5092] <... close resumed>) = 0 [pid 5092] mkdir("./file1", 0777) = 0 [pid 5092] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5093] <... fallocate resumed>) = 0 [pid 5093] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5091] <... futex resumed>) = 0 [pid 5093] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5091] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5093] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5091] <... futex resumed>) = 0 [pid 5093] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5091] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5093] <... mount resumed>) = 0 [pid 5093] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5091] <... futex resumed>) = 0 [pid 5091] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5091] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5093] <... futex resumed>) = 1 [pid 5093] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 3 [pid 5093] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5091] <... futex resumed>) = 0 [pid 5093] <... futex resumed>) = 1 [pid 5091] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5093] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5091] <... futex resumed>) = 0 [pid 5091] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5093] <... write resumed>) = 262144 [pid 5093] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5091] <... futex resumed>) = 0 [pid 5093] <... futex resumed>) = 1 [pid 5093] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5092] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5092] ioctl(5, LOOP_CLR_FD) = 0 [pid 5092] close(5) = 0 [pid 5092] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5092] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5091] exit_group(0 [pid 5092] <... futex resumed>) = ? [pid 5091] <... exit_group resumed>) = ? [pid 5093] <... futex resumed>) = ? [pid 5092] +++ exited with 0 +++ [pid 5093] +++ exited with 0 +++ [pid 5091] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5091, si_uid=0, si_status=0, si_utime=0, si_stime=6 /* 0.06 s */} --- umount2("./14", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./14/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./14/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./14/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./14/bus") = 0 umount2("./14/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./14/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./14/binderfs") = 0 umount2("./14/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./14/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./14/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./14/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./14/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./14") = 0 [ 48.515053][ T5092] loop0: detected capacity change from 0 to 512 [ 48.537563][ T5092] EXT4-fs error (device loop0): __ext4_fill_super:5473: comm syz-executor369: inode #2: comm syz-executor369: iget: illegal inode # [ 48.552122][ T5092] EXT4-fs (loop0): get root inode failed [ 48.558285][ T5092] EXT4-fs (loop0): mount failed mkdir("./15", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5095 attached , child_tidptr=0x555556e0f690) = 5095 [pid 5095] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5095] chdir("./15") = 0 [pid 5095] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5095] setpgid(0, 0) = 0 [pid 5095] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5095] write(3, "1000", 4) = 4 [pid 5095] close(3) = 0 [pid 5095] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5095] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5095] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5095] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5095] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5095] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5095] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5095] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5096 attached [pid 5096] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053) = 0 [pid 5096] set_robust_list(0x7f4380f929a0, 24) = 0 [pid 5096] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5096] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5095] <... clone3 resumed> => {parent_tid=[5096]}, 88) = 5096 [pid 5095] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5095] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5096] <... futex resumed>) = 0 [pid 5096] memfd_create("syzkaller", 0 [pid 5095] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5096] <... memfd_create resumed>) = 3 [pid 5096] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4378b72000 [pid 5095] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4378b51000 [pid 5095] mprotect(0x7f4378b52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5095] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5095] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4378b71990, parent_tid=0x7f4378b71990, exit_signal=0, stack=0x7f4378b51000, stack_size=0x20300, tls=0x7f4378b716c0}./strace-static-x86_64: Process 5097 attached [pid 5097] rseq(0x7f4378b71fe0, 0x20, 0, 0x53053053) = 0 [pid 5097] set_robust_list(0x7f4378b719a0, 24) = 0 [pid 5097] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5097] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5096] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5095] <... clone3 resumed> => {parent_tid=[5097]}, 88) = 5097 [pid 5096] <... write resumed>) = 262144 [pid 5095] rt_sigprocmask(SIG_SETMASK, [], [pid 5096] munmap(0x7f4378b72000, 262144 [pid 5095] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5095] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5097] <... futex resumed>) = 0 [pid 5095] <... futex resumed>) = 1 [pid 5097] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5096] <... munmap resumed>) = 0 [pid 5095] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5097] <... open resumed>) = 4 [pid 5097] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5096] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5095] <... futex resumed>) = 0 [pid 5097] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5096] <... openat resumed>) = 5 [pid 5097] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5095] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5096] ioctl(5, LOOP_SET_FD, 3 [pid 5097] fallocate(4, 0, 35143, 7 [pid 5095] <... futex resumed>) = 0 [pid 5095] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5096] <... ioctl resumed>) = 0 [pid 5096] close(3) = 0 [pid 5096] mkdir("./file1", 0777) = 0 [pid 5096] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5097] <... fallocate resumed>) = 0 [pid 5097] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5095] <... futex resumed>) = 0 [pid 5095] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5095] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5097] <... futex resumed>) = 1 [pid 5097] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL) = 0 [pid 5097] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5095] <... futex resumed>) = 0 [pid 5095] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5095] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5097] <... futex resumed>) = 1 [pid 5097] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 3 [pid 5097] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5095] <... futex resumed>) = 0 [pid 5097] <... futex resumed>) = 1 [pid 5097] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5095] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 48.626684][ T5096] loop0: detected capacity change from 0 to 512 [ 48.650157][ T5096] EXT4-fs (loop0): 1 orphan inode deleted [ 48.655986][ T5096] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [pid 5095] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5097] <... write resumed>) = 262144 [pid 5097] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5095] <... futex resumed>) = 0 [pid 5097] <... futex resumed>) = 1 [pid 5097] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5096] <... mount resumed>) = 0 [pid 5096] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 6 [pid 5096] chdir("./file1") = 0 [pid 5096] ioctl(5, LOOP_CLR_FD) = 0 [pid 5096] close(5) = 0 [pid 5096] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5096] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5095] exit_group(0 [pid 5097] <... futex resumed>) = ? [pid 5096] <... futex resumed>) = ? [pid 5096] +++ exited with 0 +++ [pid 5095] <... exit_group resumed>) = ? [pid 5097] +++ exited with 0 +++ [pid 5095] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5095, si_uid=0, si_status=0, si_utime=0, si_stime=6 /* 0.06 s */} --- umount2("./15", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./15/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./15/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./15/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./15/bus") = 0 umount2("./15/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./15/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./15/binderfs") = 0 [ 48.668940][ T5096] ext4 filesystem being mounted at /root/syzkaller.F1Lso8/15/file1 supports timestamps until 2038-01-19 (0x7fffffff) umount2("./15/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./15/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./15/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./15/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./15/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./15/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./15") = 0 mkdir("./16", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556e0f690) = 5100 ./strace-static-x86_64: Process 5100 attached [pid 5100] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5100] chdir("./16") = 0 [pid 5100] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5100] setpgid(0, 0) = 0 [pid 5100] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5100] write(3, "1000", 4) = 4 [pid 5100] close(3) = 0 [pid 5100] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5100] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5100] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5100] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5100] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5100] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5100] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5100] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5101 attached => {parent_tid=[5101]}, 88) = 5101 [pid 5100] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5100] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5100] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5101] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5100] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5101] <... rseq resumed>) = 0 [pid 5101] set_robust_list(0x7f4380f929a0, 24 [pid 5100] <... mmap resumed>) = 0x7f4380f51000 [pid 5101] <... set_robust_list resumed>) = 0 [pid 5100] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5101] rt_sigprocmask(SIG_SETMASK, [], [pid 5100] <... mprotect resumed>) = 0 [pid 5101] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5100] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5101] memfd_create("syzkaller", 0 [pid 5100] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5100] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} [pid 5101] <... memfd_create resumed>) = 3 [pid 5100] <... clone3 resumed> => {parent_tid=[5102]}, 88) = 5102 ./strace-static-x86_64: Process 5102 attached [pid 5102] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053) = 0 [pid 5102] set_robust_list(0x7f4380f719a0, 24) = 0 [pid 5102] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5102] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5101] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4378b51000 [pid 5100] rt_sigprocmask(SIG_SETMASK, [], [pid 5101] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5100] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5100] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5102] <... futex resumed>) = 0 [pid 5100] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5102] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 5101] <... write resumed>) = 262144 [pid 5102] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5100] <... futex resumed>) = 0 [pid 5102] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5101] munmap(0x7f4378b51000, 262144 [pid 5100] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5102] <... futex resumed>) = 0 [pid 5100] <... futex resumed>) = 1 [pid 5102] fallocate(4, 0, 35143, 7 [pid 5100] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5101] <... munmap resumed>) = 0 [pid 5101] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [ 48.701117][ T5033] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 48.711168][ T5033] EXT4-fs error (device loop0) in ext4_reserve_inode_write:5752: Corrupt filesystem [ 48.720811][ T5033] EXT4-fs error (device loop0): ext4_quota_off:7131: inode #3: comm syz-executor369: mark_inode_dirty error [pid 5101] ioctl(5, LOOP_SET_FD, 3 [pid 5102] <... fallocate resumed>) = 0 [pid 5102] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5101] <... ioctl resumed>) = 0 [pid 5102] <... futex resumed>) = 1 [pid 5102] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5101] close(3) = 0 [pid 5101] mkdir("./file1", 0777) = 0 [pid 5100] <... futex resumed>) = 0 [pid 5100] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5101] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5102] <... futex resumed>) = 0 [pid 5100] <... futex resumed>) = 1 [pid 5102] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL) = 0 [pid 5100] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5102] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5102] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5100] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5100] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5102] <... futex resumed>) = 0 [pid 5100] <... futex resumed>) = 1 [pid 5102] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 3 [pid 5100] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5102] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5102] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5100] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5100] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5102] <... futex resumed>) = 0 [pid 5100] <... futex resumed>) = 1 [pid 5102] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5100] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5102] <... write resumed>) = 262144 [pid 5102] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5102] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5100] <... futex resumed>) = 0 [pid 5101] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5101] ioctl(5, LOOP_CLR_FD) = 0 [pid 5101] close(5) = 0 [pid 5101] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5100] exit_group(0 [pid 5102] <... futex resumed>) = ? [pid 5100] <... exit_group resumed>) = ? [pid 5102] +++ exited with 0 +++ [pid 5101] <... futex resumed>) = ? [pid 5101] +++ exited with 0 +++ [pid 5100] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5100, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./16", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./16/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./16/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./16/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./16/bus") = 0 umount2("./16/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./16/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./16/binderfs") = 0 umount2("./16/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./16/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./16/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./16/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./16/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./16") = 0 mkdir("./17", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556e0f690) = 5103 ./strace-static-x86_64: Process 5103 attached [pid 5103] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5103] chdir("./17") = 0 [pid 5103] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5103] setpgid(0, 0) = 0 [pid 5103] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5103] write(3, "1000", 4) = 4 [pid 5103] close(3) = 0 [pid 5103] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5103] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5103] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5103] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5103] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5103] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5103] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5103] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5104 attached [ 48.774292][ T5101] loop0: detected capacity change from 0 to 512 [ 48.797258][ T5101] EXT4-fs warning (device loop0): read_mmp_block:114: Error -117 while reading MMP block 8 [pid 5104] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053) = 0 [pid 5104] set_robust_list(0x7f4380f929a0, 24) = 0 [pid 5104] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5104] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5103] <... clone3 resumed> => {parent_tid=[5104]}, 88) = 5104 [pid 5103] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5103] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5104] <... futex resumed>) = 0 [pid 5103] <... futex resumed>) = 1 [pid 5104] memfd_create("syzkaller", 0 [pid 5103] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5104] <... memfd_create resumed>) = 3 [pid 5103] <... futex resumed>) = 0 [pid 5104] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5103] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5104] <... mmap resumed>) = 0x7f4378b51000 [pid 5103] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5104] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5103] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5103] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0}./strace-static-x86_64: Process 5105 attached [pid 5105] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5103] <... clone3 resumed> => {parent_tid=[5105]}, 88) = 5105 [pid 5105] <... rseq resumed>) = 0 [pid 5103] rt_sigprocmask(SIG_SETMASK, [], [pid 5105] set_robust_list(0x7f4380f719a0, 24 [pid 5103] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5105] <... set_robust_list resumed>) = 0 [pid 5103] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5105] rt_sigprocmask(SIG_SETMASK, [], [pid 5103] <... futex resumed>) = 0 [pid 5105] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5103] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5105] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 5105] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5103] <... futex resumed>) = 0 [pid 5105] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5103] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5105] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5103] <... futex resumed>) = 0 [pid 5105] fallocate(4, 0, 35143, 7 [pid 5103] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5104] <... write resumed>) = 262144 [pid 5104] munmap(0x7f4378b51000, 262144) = 0 [pid 5104] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5104] ioctl(5, LOOP_SET_FD, 3 [pid 5105] <... fallocate resumed>) = 0 [pid 5105] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5104] <... ioctl resumed>) = 0 [pid 5105] <... futex resumed>) = 1 [pid 5104] close(3 [pid 5103] <... futex resumed>) = 0 [pid 5105] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5104] <... close resumed>) = 0 [pid 5103] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5104] mkdir("./file1", 0777 [pid 5103] <... futex resumed>) = 0 [pid 5103] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5104] <... mkdir resumed>) = 0 [pid 5105] <... mount resumed>) = 0 [pid 5104] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5105] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5103] <... futex resumed>) = 0 [pid 5105] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5103] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5105] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5103] <... futex resumed>) = 0 [pid 5105] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5103] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5105] <... open resumed>) = 3 [pid 5105] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5103] <... futex resumed>) = 0 [pid 5105] <... futex resumed>) = 1 [pid 5103] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5105] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5103] <... futex resumed>) = 0 [pid 5103] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5105] <... write resumed>) = 262144 [pid 5105] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5103] <... futex resumed>) = 0 [pid 5105] <... futex resumed>) = 1 [pid 5105] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5104] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5104] ioctl(5, LOOP_CLR_FD) = 0 [pid 5104] close(5) = 0 [pid 5104] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5104] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5103] exit_group(0 [pid 5105] <... futex resumed>) = ? [pid 5104] <... futex resumed>) = ? [pid 5105] +++ exited with 0 +++ [pid 5104] +++ exited with 0 +++ [pid 5103] <... exit_group resumed>) = ? [pid 5103] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5103, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./17", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./17/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./17/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./17/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./17/bus") = 0 umount2("./17/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./17/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./17/binderfs") = 0 umount2("./17/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./17/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./17/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./17/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [ 48.864901][ T5104] loop0: detected capacity change from 0 to 512 [ 48.878331][ T5106] EXT4-fs warning (device loop0): kmmpd:167: kmmpd being stopped since MMP feature has been disabled. [ 48.878649][ T5104] EXT4-fs error (device loop0): __ext4_fill_super:5473: comm syz-executor369: inode #2: comm syz-executor369: iget: illegal inode # [ 48.903424][ T5104] EXT4-fs (loop0): get root inode failed [ 48.909139][ T5104] EXT4-fs (loop0): mount failed newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./17/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./17") = 0 mkdir("./18", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5108 attached , child_tidptr=0x555556e0f690) = 5108 [pid 5108] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5108] chdir("./18") = 0 [pid 5108] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5108] setpgid(0, 0) = 0 [pid 5108] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5108] write(3, "1000", 4) = 4 [pid 5108] close(3) = 0 [pid 5108] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5108] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5108] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5108] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5108] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5108] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5108] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5108] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5109 attached => {parent_tid=[5109]}, 88) = 5109 [pid 5108] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5108] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5109] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5108] <... futex resumed>) = 0 [pid 5109] <... rseq resumed>) = 0 [pid 5108] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5109] set_robust_list(0x7f4380f929a0, 24 [pid 5108] <... futex resumed>) = 0 [pid 5109] <... set_robust_list resumed>) = 0 [pid 5108] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5109] rt_sigprocmask(SIG_SETMASK, [], [pid 5108] <... mmap resumed>) = 0x7f4380f51000 [pid 5109] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5109] memfd_create("syzkaller", 0) = 3 [pid 5109] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4378b51000 [pid 5108] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5108] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5108] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} => {parent_tid=[5110]}, 88) = 5110 ./strace-static-x86_64: Process 5110 attached [pid 5108] rt_sigprocmask(SIG_SETMASK, [], [pid 5110] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5108] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5108] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5110] <... rseq resumed>) = 0 [pid 5110] set_robust_list(0x7f4380f719a0, 24) = 0 [pid 5110] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5110] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5108] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5109] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5110] <... open resumed>) = 4 [pid 5110] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5109] <... write resumed>) = 262144 [pid 5110] <... futex resumed>) = 1 [pid 5109] munmap(0x7f4378b51000, 262144 [pid 5110] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5108] <... futex resumed>) = 0 [pid 5109] <... munmap resumed>) = 0 [pid 5108] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5110] <... futex resumed>) = 0 [pid 5109] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5108] <... futex resumed>) = 1 [pid 5110] fallocate(4, 0, 35143, 7 [pid 5109] <... openat resumed>) = 5 [pid 5108] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5109] ioctl(5, LOOP_SET_FD, 3 [pid 5110] <... fallocate resumed>) = 0 [pid 5109] <... ioctl resumed>) = 0 [pid 5110] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5109] close(3 [pid 5110] <... futex resumed>) = 1 [pid 5109] <... close resumed>) = 0 [pid 5108] <... futex resumed>) = 0 [pid 5110] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5109] mkdir("./file1", 0777 [pid 5110] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5109] <... mkdir resumed>) = 0 [pid 5108] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5110] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5109] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5110] <... mount resumed>) = 0 [pid 5108] <... futex resumed>) = 0 [pid 5110] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5108] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5110] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5108] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5108] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5110] <... futex resumed>) = 0 [pid 5110] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 3 [pid 5110] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5110] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5108] <... futex resumed>) = 1 [pid 5108] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 5108] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5110] <... futex resumed>) = 0 [pid 5110] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5108] <... futex resumed>) = 1 [pid 5108] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5110] <... write resumed>) = 262144 [pid 5110] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5108] <... futex resumed>) = 0 [pid 5110] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5109] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5109] ioctl(5, LOOP_CLR_FD) = 0 [pid 5109] close(5) = 0 [pid 5109] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5109] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5108] exit_group(0) = ? [pid 5110] <... futex resumed>) = ? [pid 5110] +++ exited with 0 +++ [pid 5109] <... futex resumed>) = ? [pid 5109] +++ exited with 0 +++ [pid 5108] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5108, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./18", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./18/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./18/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./18/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./18/bus") = 0 umount2("./18/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./18/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./18/binderfs") = 0 umount2("./18/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./18/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./18/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./18/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./18/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./18") = 0 mkdir("./19", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5111 attached , child_tidptr=0x555556e0f690) = 5111 [pid 5111] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5111] chdir("./19") = 0 [pid 5111] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5111] setpgid(0, 0) = 0 [pid 5111] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5111] write(3, "1000", 4) = 4 [pid 5111] close(3) = 0 [pid 5111] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5111] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5111] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5111] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5111] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5111] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5111] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5111] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5112 attached => {parent_tid=[5112]}, 88) = 5112 [pid 5112] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5111] rt_sigprocmask(SIG_SETMASK, [], [pid 5112] <... rseq resumed>) = 0 [pid 5112] set_robust_list(0x7f4380f929a0, 24 [pid 5111] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5112] <... set_robust_list resumed>) = 0 [pid 5111] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5112] rt_sigprocmask(SIG_SETMASK, [], [pid 5111] <... futex resumed>) = 0 [pid 5112] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5111] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5111] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5111] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5112] memfd_create("syzkaller", 0 [pid 5111] <... mprotect resumed>) = 0 [pid 5112] <... memfd_create resumed>) = 3 [pid 5112] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5111] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5112] <... mmap resumed>) = 0x7f4378b51000 [pid 5112] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5111] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5111] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} => {parent_tid=[5113]}, 88) = 5113 [pid 5111] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5111] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5111] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5113 attached [pid 5113] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053) = 0 [pid 5113] set_robust_list(0x7f4380f719a0, 24) = 0 [pid 5113] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5113] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5112] <... write resumed>) = 262144 [pid 5112] munmap(0x7f4378b51000, 262144 [pid 5113] <... open resumed>) = 4 [pid 5112] <... munmap resumed>) = 0 [pid 5112] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [ 48.980475][ T5109] loop0: detected capacity change from 0 to 512 [ 48.997356][ T5109] EXT4-fs warning (device loop0): read_mmp_block:114: Error -117 while reading MMP block 8 [pid 5112] ioctl(5, LOOP_SET_FD, 3 [pid 5113] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5112] <... ioctl resumed>) = 0 [pid 5113] <... futex resumed>) = 1 [pid 5112] close(3 [pid 5111] <... futex resumed>) = 0 [pid 5111] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5111] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5113] fallocate(4, 0, 35143, 7 [pid 5112] <... close resumed>) = 0 [pid 5112] mkdir("./file1", 0777) = 0 [pid 5112] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5113] <... fallocate resumed>) = 0 [pid 5113] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5111] <... futex resumed>) = 0 [pid 5113] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5111] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5111] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5113] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5113] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL) = 0 [pid 5113] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5111] <... futex resumed>) = 0 [pid 5111] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5111] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5113] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 3 [pid 5113] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5111] <... futex resumed>) = 0 [pid 5111] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5111] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [ 49.047404][ T5112] loop0: detected capacity change from 0 to 512 [ 49.074378][ T5114] EXT4-fs warning (device loop0): kmmpd:167: kmmpd being stopped since MMP feature has been disabled. [pid 5113] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190) = 262144 [pid 5113] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5113] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5111] <... futex resumed>) = 0 [pid 5112] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5112] ioctl(5, LOOP_CLR_FD) = 0 [pid 5112] close(5) = 0 [pid 5112] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5111] exit_group(0 [pid 5112] <... futex resumed>) = 0 [pid 5112] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5113] <... futex resumed>) = ? [pid 5112] <... futex resumed>) = ? [pid 5111] <... exit_group resumed>) = ? [pid 5113] +++ exited with 0 +++ [pid 5112] +++ exited with 0 +++ [pid 5111] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5111, si_uid=0, si_status=0, si_utime=0, si_stime=6 /* 0.06 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./19", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./19/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./19/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./19/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./19/bus") = 0 umount2("./19/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./19/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./19/binderfs") = 0 umount2("./19/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./19/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./19/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./19/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./19/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./19") = 0 mkdir("./20", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5116 attached , child_tidptr=0x555556e0f690) = 5116 [pid 5116] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5116] chdir("./20") = 0 [pid 5116] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5116] setpgid(0, 0) = 0 [pid 5116] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5116] write(3, "1000", 4) = 4 [pid 5116] close(3) = 0 [pid 5116] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5116] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5116] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5116] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5116] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5116] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5116] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5116] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0} => {parent_tid=[5117]}, 88) = 5117 [pid 5116] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5116] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5116] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5116] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0./strace-static-x86_64: Process 5117 attached ) = 0x7f4380f51000 [pid 5117] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5116] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5117] <... rseq resumed>) = 0 [pid 5117] set_robust_list(0x7f4380f929a0, 24) = 0 [pid 5116] <... mprotect resumed>) = 0 [pid 5116] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5117] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5117] memfd_create("syzkaller", 0) = 3 [pid 5116] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5117] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5116] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} [pid 5117] <... mmap resumed>) = 0x7f4378b51000 [pid 5116] <... clone3 resumed> => {parent_tid=[5118]}, 88) = 5118 [pid 5116] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5116] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5116] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5118 attached [ 49.074967][ T5112] EXT4-fs error (device loop0): __ext4_fill_super:5473: comm syz-executor369: inode #2: comm syz-executor369: iget: illegal inode # [ 49.099398][ T5112] EXT4-fs (loop0): get root inode failed [ 49.105195][ T5112] EXT4-fs (loop0): mount failed [pid 5117] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5118] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5117] <... write resumed>) = 262144 [pid 5118] <... rseq resumed>) = 0 [pid 5118] set_robust_list(0x7f4380f719a0, 24) = 0 [pid 5117] munmap(0x7f4378b51000, 262144 [pid 5118] rt_sigprocmask(SIG_SETMASK, [], [pid 5117] <... munmap resumed>) = 0 [pid 5118] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5117] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5118] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5117] <... openat resumed>) = 4 [pid 5117] ioctl(4, LOOP_SET_FD, 3 [pid 5118] <... open resumed>) = 5 [pid 5118] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5116] <... futex resumed>) = 0 [pid 5118] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5116] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5118] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5116] <... futex resumed>) = 0 [pid 5118] fallocate(5, 0, 35143, 7 [pid 5116] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5117] <... ioctl resumed>) = 0 [pid 5117] close(3) = 0 [pid 5117] mkdir("./file1", 0777) = 0 [pid 5117] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5118] <... fallocate resumed>) = 0 [pid 5118] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5116] <... futex resumed>) = 0 [pid 5118] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5116] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5118] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5116] <... futex resumed>) = 0 [pid 5118] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5116] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5118] <... mount resumed>) = 0 [pid 5118] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5116] <... futex resumed>) = 0 [pid 5118] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5116] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5118] <... open resumed>) = 3 [pid 5116] <... futex resumed>) = 0 [pid 5118] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5116] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5118] <... futex resumed>) = 0 [pid 5116] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5118] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5116] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5118] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5116] <... futex resumed>) = 0 [pid 5118] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5116] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5118] <... write resumed>) = 262144 [pid 5118] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5116] <... futex resumed>) = 0 [pid 5118] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5117] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 5117] ioctl(4, LOOP_CLR_FD) = 0 [pid 5117] close(4) = 0 [pid 5117] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5116] exit_group(0 [pid 5118] <... futex resumed>) = ? [pid 5116] <... exit_group resumed>) = ? [pid 5118] +++ exited with 0 +++ [pid 5117] +++ exited with 0 +++ [pid 5116] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5116, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./20", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./20", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./20/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./20/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./20/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./20/bus") = 0 umount2("./20/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./20/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./20/binderfs") = 0 umount2("./20/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./20/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./20/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./20/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./20/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./20") = 0 mkdir("./21", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5119 attached , child_tidptr=0x555556e0f690) = 5119 [pid 5119] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5119] chdir("./21") = 0 [pid 5119] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5119] setpgid(0, 0) = 0 [pid 5119] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5119] write(3, "1000", 4) = 4 [pid 5119] close(3) = 0 [pid 5119] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5119] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5119] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5119] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5119] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5119] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5119] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5119] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5120 attached => {parent_tid=[5120]}, 88) = 5120 [pid 5120] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5119] rt_sigprocmask(SIG_SETMASK, [], [pid 5120] <... rseq resumed>) = 0 [pid 5120] set_robust_list(0x7f4380f929a0, 24 [pid 5119] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5120] <... set_robust_list resumed>) = 0 [pid 5119] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5119] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5119] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5119] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5119] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5119] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0}./strace-static-x86_64: Process 5121 attached => {parent_tid=[5121]}, 88) = 5121 [pid 5119] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5119] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5119] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5120] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 49.174446][ T5117] loop0: detected capacity change from 0 to 512 [ 49.189016][ T5117] EXT4-fs (loop0): Magic mismatch, very weird! [pid 5121] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5120] memfd_create("syzkaller", 0) = 3 [pid 5120] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4378b51000 [pid 5120] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5121] <... rseq resumed>) = 0 [pid 5121] set_robust_list(0x7f4380f719a0, 24) = 0 [pid 5121] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5121] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 5121] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5119] <... futex resumed>) = 0 [pid 5121] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5119] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5121] <... futex resumed>) = 0 [pid 5119] <... futex resumed>) = 1 [pid 5121] fallocate(4, 0, 35143, 7 [pid 5119] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5120] <... write resumed>) = 262144 [pid 5120] munmap(0x7f4378b51000, 262144) = 0 [pid 5120] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5120] ioctl(5, LOOP_SET_FD, 3 [pid 5121] <... fallocate resumed>) = 0 [pid 5120] <... ioctl resumed>) = 0 [pid 5121] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5120] close(3 [pid 5121] <... futex resumed>) = 1 [pid 5121] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5119] <... futex resumed>) = 0 [pid 5119] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5121] <... futex resumed>) = 0 [pid 5119] <... futex resumed>) = 1 [pid 5121] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5119] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5120] <... close resumed>) = 0 [pid 5120] mkdir("./file1", 0777 [pid 5121] <... mount resumed>) = 0 [pid 5121] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5119] <... futex resumed>) = 0 [pid 5119] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5121] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5119] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5120] <... mkdir resumed>) = 0 [pid 5121] <... open resumed>) = 3 [pid 5120] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5121] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5119] <... futex resumed>) = 0 [pid 5119] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5119] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5121] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190) = 262144 [pid 5121] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5119] <... futex resumed>) = 0 [pid 5121] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5120] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 5120] ioctl(5, LOOP_CLR_FD) = 0 [pid 5120] close(5) = 0 [pid 5120] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5120] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5119] exit_group(0 [pid 5121] <... futex resumed>) = ? [pid 5121] +++ exited with 0 +++ [pid 5120] <... futex resumed>) = ? [pid 5120] +++ exited with 0 +++ [pid 5119] <... exit_group resumed>) = ? [pid 5119] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5119, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./21", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./21", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./21/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./21/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./21/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./21/bus") = 0 umount2("./21/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./21/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./21/binderfs") = 0 umount2("./21/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./21/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./21/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./21/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./21/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./21") = 0 mkdir("./22", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5122 attached [pid 5122] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5122] chdir("./22") = 0 [pid 5122] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5122] setpgid(0, 0 [pid 5033] <... clone resumed>, child_tidptr=0x555556e0f690) = 5122 [pid 5122] <... setpgid resumed>) = 0 [pid 5122] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5122] write(3, "1000", 4) = 4 [pid 5122] close(3) = 0 [pid 5122] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5122] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5122] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5122] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5122] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5122] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5122] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5122] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5123 attached [pid 5123] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5122] <... clone3 resumed> => {parent_tid=[5123]}, 88) = 5123 [pid 5123] <... rseq resumed>) = 0 [pid 5122] rt_sigprocmask(SIG_SETMASK, [], [pid 5123] set_robust_list(0x7f4380f929a0, 24 [pid 5122] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5123] <... set_robust_list resumed>) = 0 [pid 5122] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5123] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5122] <... futex resumed>) = 0 [pid 5123] memfd_create("syzkaller", 0 [pid 5122] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5122] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5123] <... memfd_create resumed>) = 3 [pid 5122] <... mmap resumed>) = 0x7f4380f51000 [pid 5123] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4378b51000 [pid 5122] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5123] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5122] <... mprotect resumed>) = 0 [pid 5122] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5122] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} => {parent_tid=[5124]}, 88) = 5124 [pid 5122] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5122] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5122] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5123] <... write resumed>) = 262144 [pid 5123] munmap(0x7f4378b51000, 262144./strace-static-x86_64: Process 5124 attached [pid 5124] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053) = 0 [ 49.244028][ T5120] loop0: detected capacity change from 0 to 512 [ 49.272060][ T5120] EXT4-fs (loop0): VFS: Can't find ext4 filesystem [pid 5124] set_robust_list(0x7f4380f719a0, 24 [pid 5123] <... munmap resumed>) = 0 [pid 5123] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5123] ioctl(4, LOOP_SET_FD, 3 [pid 5124] <... set_robust_list resumed>) = 0 [pid 5124] rt_sigprocmask(SIG_SETMASK, [], [pid 5123] <... ioctl resumed>) = 0 [pid 5124] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5124] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5123] close(3) = 0 [pid 5123] mkdir("./file1", 0777 [pid 5124] <... open resumed>) = 3 [pid 5123] <... mkdir resumed>) = 0 [pid 5123] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5124] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5122] <... futex resumed>) = 0 [pid 5124] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5122] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5124] <... futex resumed>) = 0 [pid 5122] <... futex resumed>) = 1 [pid 5122] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5124] fallocate(3, 0, 35143, 7) = 0 [pid 5124] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5122] <... futex resumed>) = 0 [pid 5122] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5122] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5124] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL) = 0 [pid 5124] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5122] <... futex resumed>) = 0 [pid 5124] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5122] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5124] <... futex resumed>) = 0 [pid 5122] <... futex resumed>) = 1 [pid 5124] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5122] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5124] <... open resumed>) = 5 [pid 5124] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5122] <... futex resumed>) = 0 [pid 5124] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5122] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5122] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5124] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5124] write(5, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190) = 262144 [pid 5124] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5124] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5122] <... futex resumed>) = 0 [ 49.322826][ T5123] loop0: detected capacity change from 0 to 512 [ 49.341825][ T5125] EXT4-fs warning (device loop0): kmmpd:167: kmmpd being stopped since MMP feature has been disabled. [ 49.350303][ T5123] EXT4-fs error (device loop0): __ext4_fill_super:5473: comm syz-executor369: inode #2: comm syz-executor369: iget: illegal inode # [ 49.367387][ T5123] EXT4-fs (loop0): get root inode failed [pid 5123] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5123] ioctl(4, LOOP_CLR_FD) = 0 [pid 5123] close(4) = 0 [pid 5123] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5123] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5122] exit_group(0 [pid 5124] <... futex resumed>) = ? [pid 5123] <... futex resumed>) = ? [pid 5122] <... exit_group resumed>) = ? [pid 5124] +++ exited with 0 +++ [pid 5123] +++ exited with 0 +++ [pid 5122] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5122, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./22", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./22", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./22/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./22/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./22/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./22/bus") = 0 umount2("./22/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./22/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./22/binderfs") = 0 umount2("./22/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./22/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./22/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./22/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./22/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./22") = 0 [ 49.373023][ T5123] EXT4-fs (loop0): mount failed mkdir("./23", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5127 attached , child_tidptr=0x555556e0f690) = 5127 [pid 5127] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5127] chdir("./23") = 0 [pid 5127] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5127] setpgid(0, 0) = 0 [pid 5127] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5127] write(3, "1000", 4) = 4 [pid 5127] close(3) = 0 [pid 5127] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5127] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5127] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5127] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5127] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5127] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5127] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5127] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5128 attached [pid 5128] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5127] <... clone3 resumed> => {parent_tid=[5128]}, 88) = 5128 [pid 5127] rt_sigprocmask(SIG_SETMASK, [], [pid 5128] <... rseq resumed>) = 0 [pid 5127] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5128] set_robust_list(0x7f4380f929a0, 24) = 0 [pid 5127] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5128] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5127] <... futex resumed>) = 0 [pid 5128] memfd_create("syzkaller", 0 [pid 5127] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5127] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5128] <... memfd_create resumed>) = 3 [pid 5127] <... mmap resumed>) = 0x7f4380f51000 [pid 5128] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5127] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5128] <... mmap resumed>) = 0x7f4378b51000 [pid 5128] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5127] <... mprotect resumed>) = 0 [pid 5127] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5127] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0}./strace-static-x86_64: Process 5129 attached => {parent_tid=[5129]}, 88) = 5129 [pid 5127] rt_sigprocmask(SIG_SETMASK, [], [pid 5129] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053) = 0 [pid 5129] set_robust_list(0x7f4380f719a0, 24) = 0 [pid 5129] rt_sigprocmask(SIG_SETMASK, [], [pid 5128] <... write resumed>) = 262144 [pid 5127] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5129] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5127] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5129] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5127] <... futex resumed>) = 0 [pid 5129] <... open resumed>) = 4 [pid 5127] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5128] munmap(0x7f4378b51000, 262144 [pid 5129] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5128] <... munmap resumed>) = 0 [pid 5129] <... futex resumed>) = 1 [pid 5128] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5127] <... futex resumed>) = 0 [pid 5129] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5127] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5129] <... futex resumed>) = 0 [pid 5127] <... futex resumed>) = 1 [pid 5129] fallocate(4, 0, 35143, 7 [pid 5128] <... openat resumed>) = 5 [pid 5127] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5128] ioctl(5, LOOP_SET_FD, 3 [pid 5129] <... fallocate resumed>) = 0 [pid 5129] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5127] <... futex resumed>) = 0 [pid 5129] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5128] <... ioctl resumed>) = 0 [pid 5127] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5128] close(3) = 0 [pid 5128] mkdir("./file1", 0777 [pid 5129] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5127] <... futex resumed>) = 0 [pid 5127] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5129] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5128] <... mkdir resumed>) = 0 [pid 5128] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5129] <... mount resumed>) = 0 [pid 5129] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5127] <... futex resumed>) = 0 [pid 5129] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5127] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5129] <... futex resumed>) = 0 [pid 5127] <... futex resumed>) = 1 [pid 5129] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 3 [pid 5127] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5129] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5127] <... futex resumed>) = 0 [pid 5129] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5127] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5127] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5129] <... write resumed>) = 262144 [pid 5129] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5127] <... futex resumed>) = 0 [pid 5129] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5128] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5128] ioctl(5, LOOP_CLR_FD) = 0 [pid 5128] close(5) = 0 [pid 5128] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5128] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5127] exit_group(0 [pid 5128] <... futex resumed>) = ? [pid 5128] +++ exited with 0 +++ [pid 5127] <... exit_group resumed>) = ? [pid 5129] <... futex resumed>) = ? [pid 5129] +++ exited with 0 +++ [pid 5127] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5127, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./23", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./23", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./23/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./23/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./23/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./23/bus") = 0 umount2("./23/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./23/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./23/binderfs") = 0 umount2("./23/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./23/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./23/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./23/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./23/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./23") = 0 mkdir("./24", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5130 attached , child_tidptr=0x555556e0f690) = 5130 [pid 5130] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5130] chdir("./24") = 0 [pid 5130] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5130] setpgid(0, 0) = 0 [pid 5130] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5130] write(3, "1000", 4) = 4 [pid 5130] close(3) = 0 [pid 5130] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5130] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5130] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5130] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5130] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5130] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5130] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5130] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5131 attached => {parent_tid=[5131]}, 88) = 5131 [pid 5130] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5130] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5130] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5130] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5131] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053) = 0 [pid 5130] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5131] set_robust_list(0x7f4380f929a0, 24 [pid 5130] <... mprotect resumed>) = 0 [pid 5131] <... set_robust_list resumed>) = 0 [pid 5131] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5131] memfd_create("syzkaller", 0 [pid 5130] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5131] <... memfd_create resumed>) = 3 [pid 5131] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5130] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5130] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} [pid 5131] <... mmap resumed>) = 0x7f4378b51000 [pid 5130] <... clone3 resumed> => {parent_tid=[5132]}, 88) = 5132 [pid 5130] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5130] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5130] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5132 attached [ 49.441010][ T5128] loop0: detected capacity change from 0 to 512 [ 49.457013][ T5128] EXT4-fs warning (device loop0): read_mmp_block:114: Error -117 while reading MMP block 8 [pid 5131] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5132] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053) = 0 [pid 5132] set_robust_list(0x7f4380f719a0, 24) = 0 [pid 5132] rt_sigprocmask(SIG_SETMASK, [], [pid 5131] <... write resumed>) = 262144 [pid 5132] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5131] munmap(0x7f4378b51000, 262144 [pid 5132] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 5131] <... munmap resumed>) = 0 [pid 5131] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5131] ioctl(5, LOOP_SET_FD, 3 [pid 5132] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5130] <... futex resumed>) = 0 [pid 5132] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5130] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5132] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5130] <... futex resumed>) = 0 [pid 5132] fallocate(4, 0, 35143, 7 [pid 5130] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5131] <... ioctl resumed>) = 0 [pid 5131] close(3) = 0 [pid 5131] mkdir("./file1", 0777) = 0 [pid 5131] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5132] <... fallocate resumed>) = 0 [pid 5132] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5130] <... futex resumed>) = 0 [pid 5132] <... futex resumed>) = 1 [pid 5130] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5130] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5132] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL) = 0 [pid 5132] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5130] <... futex resumed>) = 0 [pid 5130] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5132] <... futex resumed>) = 1 [pid 5130] <... futex resumed>) = 0 [pid 5132] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5130] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5132] <... open resumed>) = 3 [pid 5132] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5132] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5130] <... futex resumed>) = 0 [pid 5130] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5132] <... futex resumed>) = 0 [pid 5130] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5132] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190) = 262144 [pid 5132] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5130] <... futex resumed>) = 0 [pid 5132] <... futex resumed>) = 1 [pid 5132] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5131] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5131] ioctl(5, LOOP_CLR_FD) = 0 [pid 5131] close(5) = 0 [pid 5131] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5130] exit_group(0 [pid 5132] <... futex resumed>) = ? [pid 5131] <... futex resumed>) = ? [pid 5130] <... exit_group resumed>) = ? [pid 5132] +++ exited with 0 +++ [pid 5131] +++ exited with 0 +++ [pid 5130] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5130, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- umount2("./24", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./24", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./24/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./24/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./24/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./24/bus") = 0 umount2("./24/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./24/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./24/binderfs") = 0 umount2("./24/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./24/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./24/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./24/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./24/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 [ 49.536283][ T5131] loop0: detected capacity change from 0 to 512 [ 49.550393][ T5131] EXT4-fs error (device loop0): ext4_map_blocks:577: inode #3: block 9: comm syz-executor369: lblock 0 mapped to illegal pblock 9 (length 1) [ 49.565020][ T5131] EXT4-fs warning (device loop0): ext4_enable_quotas:7078: Failed to enable quota tracking (type=0, err=-117, ino=3). Please run e2fsck to fix. [ 49.580466][ T5131] EXT4-fs (loop0): mount failed rmdir("./24") = 0 mkdir("./25", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5135 attached , child_tidptr=0x555556e0f690) = 5135 [pid 5135] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5135] chdir("./25") = 0 [pid 5135] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5135] setpgid(0, 0) = 0 [pid 5135] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5135] write(3, "1000", 4) = 4 [pid 5135] close(3) = 0 [pid 5135] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5135] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5135] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5135] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5135] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5135] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5135] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5135] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0} => {parent_tid=[5136]}, 88) = 5136 ./strace-static-x86_64: Process 5136 attached [pid 5135] rt_sigprocmask(SIG_SETMASK, [], [pid 5136] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053) = 0 [pid 5135] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5136] set_robust_list(0x7f4380f929a0, 24) = 0 [pid 5135] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5136] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5135] <... futex resumed>) = 0 [pid 5136] memfd_create("syzkaller", 0) = 3 [pid 5135] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5136] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5135] <... futex resumed>) = 0 [pid 5135] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5136] <... mmap resumed>) = 0x7f4378b72000 [pid 5136] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5135] <... mmap resumed>) = 0x7f4378b51000 [pid 5135] mprotect(0x7f4378b52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5135] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5135] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4378b71990, parent_tid=0x7f4378b71990, exit_signal=0, stack=0x7f4378b51000, stack_size=0x20300, tls=0x7f4378b716c0}./strace-static-x86_64: Process 5137 attached => {parent_tid=[5137]}, 88) = 5137 [pid 5137] rseq(0x7f4378b71fe0, 0x20, 0, 0x53053053 [pid 5135] rt_sigprocmask(SIG_SETMASK, [], [pid 5137] <... rseq resumed>) = 0 [pid 5135] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5137] set_robust_list(0x7f4378b719a0, 24 [pid 5135] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5137] <... set_robust_list resumed>) = 0 [pid 5135] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5137] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5136] <... write resumed>) = 262144 [pid 5136] munmap(0x7f4378b72000, 262144 [pid 5137] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 5136] <... munmap resumed>) = 0 [pid 5137] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5135] <... futex resumed>) = 0 [pid 5137] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5135] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5137] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5135] <... futex resumed>) = 0 [pid 5137] fallocate(4, 0, 35143, 7 [pid 5135] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5136] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5136] ioctl(5, LOOP_SET_FD, 3 [pid 5137] <... fallocate resumed>) = 0 [pid 5137] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5135] <... futex resumed>) = 0 [pid 5137] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5136] <... ioctl resumed>) = 0 [pid 5135] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5137] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5136] close(3 [pid 5137] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5136] <... close resumed>) = 0 [pid 5135] <... futex resumed>) = 0 [pid 5137] <... mount resumed>) = 0 [pid 5136] mkdir("./file1", 0777 [pid 5135] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5137] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5136] <... mkdir resumed>) = 0 [pid 5135] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5137] <... futex resumed>) = 0 [pid 5135] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5137] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5135] <... futex resumed>) = 0 [pid 5137] <... open resumed>) = 3 [pid 5136] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5137] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5135] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5137] <... futex resumed>) = 0 [pid 5135] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5137] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5135] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5135] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5137] <... write resumed>) = 262144 [pid 5137] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5135] <... futex resumed>) = 0 [pid 5137] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5136] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5136] ioctl(5, LOOP_CLR_FD) = 0 [pid 5136] close(5) = 0 [pid 5136] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5136] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5135] exit_group(0 [pid 5137] <... futex resumed>) = ? [pid 5136] <... futex resumed>) = ? [pid 5135] <... exit_group resumed>) = ? [pid 5137] +++ exited with 0 +++ [pid 5136] +++ exited with 0 +++ [pid 5135] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5135, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- umount2("./25", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./25", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./25/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./25/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./25/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./25/bus") = 0 umount2("./25/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./25/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./25/binderfs") = 0 umount2("./25/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./25/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./25/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./25/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./25/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./25") = 0 mkdir("./26", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556e0f690) = 5138 ./strace-static-x86_64: Process 5138 attached [pid 5138] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5138] chdir("./26") = 0 [pid 5138] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5138] setpgid(0, 0) = 0 [pid 5138] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5138] write(3, "1000", 4) = 4 [pid 5138] close(3) = 0 [pid 5138] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5138] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5138] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5138] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5138] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5138] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [ 49.646791][ T5136] loop0: detected capacity change from 0 to 512 [ 49.672724][ T5136] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 49.683547][ T5136] EXT4-fs (loop0): group descriptors corrupted! [pid 5138] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5138] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0} => {parent_tid=[5139]}, 88) = 5139 [pid 5138] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5138] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5138] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5138] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5138] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5138] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5138] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0}./strace-static-x86_64: Process 5139 attached ./strace-static-x86_64: Process 5140 attached [pid 5140] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5139] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5138] <... clone3 resumed> => {parent_tid=[5140]}, 88) = 5140 [pid 5140] <... rseq resumed>) = 0 [pid 5139] <... rseq resumed>) = 0 [pid 5140] set_robust_list(0x7f4380f719a0, 24 [pid 5139] set_robust_list(0x7f4380f929a0, 24 [pid 5140] <... set_robust_list resumed>) = 0 [pid 5139] <... set_robust_list resumed>) = 0 [pid 5140] rt_sigprocmask(SIG_SETMASK, [], [pid 5139] rt_sigprocmask(SIG_SETMASK, [], [pid 5140] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5139] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5140] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5139] memfd_create("syzkaller", 0 [pid 5138] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5139] <... memfd_create resumed>) = 3 [pid 5138] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5140] <... futex resumed>) = 0 [pid 5139] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5138] <... futex resumed>) = 1 [pid 5140] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 5139] <... mmap resumed>) = 0x7f4378b51000 [pid 5138] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5140] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5138] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5140] <... futex resumed>) = 0 [pid 5140] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5138] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5140] <... futex resumed>) = 0 [pid 5138] <... futex resumed>) = 1 [pid 5140] fallocate(4, 0, 35143, 7 [pid 5138] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5139] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 5139] munmap(0x7f4378b51000, 262144) = 0 [pid 5139] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5139] ioctl(5, LOOP_SET_FD, 3 [pid 5140] <... fallocate resumed>) = 0 [pid 5140] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5140] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5138] <... futex resumed>) = 0 [pid 5139] <... ioctl resumed>) = 0 [pid 5138] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5140] <... futex resumed>) = 0 [pid 5138] <... futex resumed>) = 1 [pid 5140] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5139] close(3 [pid 5138] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5140] <... mount resumed>) = 0 [pid 5139] <... close resumed>) = 0 [pid 5139] mkdir("./file1", 0777 [pid 5140] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5139] <... mkdir resumed>) = 0 [pid 5140] <... futex resumed>) = 1 [pid 5138] <... futex resumed>) = 0 [pid 5140] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5138] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5140] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5138] <... futex resumed>) = 0 [pid 5140] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5139] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5138] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5140] <... open resumed>) = 3 [pid 5140] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5140] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5138] <... futex resumed>) = 0 [pid 5138] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5140] <... futex resumed>) = 0 [pid 5138] <... futex resumed>) = 1 [pid 5140] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5138] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5140] <... write resumed>) = 262144 [pid 5140] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5140] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5138] <... futex resumed>) = 0 [pid 5139] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5139] ioctl(5, LOOP_CLR_FD) = 0 [pid 5139] close(5) = 0 [pid 5139] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5139] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5138] exit_group(0 [pid 5140] <... futex resumed>) = ? [pid 5139] <... futex resumed>) = ? [pid 5138] <... exit_group resumed>) = ? [pid 5140] +++ exited with 0 +++ [pid 5139] +++ exited with 0 +++ [pid 5138] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5138, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- umount2("./26", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./26", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [ 49.743947][ T5139] loop0: detected capacity change from 0 to 512 [ 49.758384][ T5141] EXT4-fs warning (device loop0): kmmpd:167: kmmpd being stopped since MMP feature has been disabled. [ 49.769568][ T5139] EXT4-fs error (device loop0): __ext4_fill_super:5473: comm syz-executor369: inode #2: comm syz-executor369: iget: illegal inode # [ 49.783502][ T5139] EXT4-fs (loop0): get root inode failed [ 49.789364][ T5139] EXT4-fs (loop0): mount failed newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./26/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./26/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./26/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./26/bus") = 0 umount2("./26/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./26/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./26/binderfs") = 0 umount2("./26/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./26/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./26/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./26/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./26/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./26") = 0 mkdir("./27", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5143 attached , child_tidptr=0x555556e0f690) = 5143 [pid 5143] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5143] chdir("./27") = 0 [pid 5143] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5143] setpgid(0, 0) = 0 [pid 5143] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5143] write(3, "1000", 4) = 4 [pid 5143] close(3) = 0 [pid 5143] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5143] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5143] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5143] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5143] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5143] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5143] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5143] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5144 attached [pid 5144] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053) = 0 [pid 5144] set_robust_list(0x7f4380f929a0, 24) = 0 [pid 5144] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5144] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5143] <... clone3 resumed> => {parent_tid=[5144]}, 88) = 5144 [pid 5143] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5143] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5144] <... futex resumed>) = 0 [pid 5143] <... futex resumed>) = 1 [pid 5144] memfd_create("syzkaller", 0 [pid 5143] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5143] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5144] <... memfd_create resumed>) = 3 [pid 5143] <... mmap resumed>) = 0x7f4380f51000 [pid 5143] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5144] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5143] <... mprotect resumed>) = 0 [pid 5144] <... mmap resumed>) = 0x7f4378b51000 [pid 5143] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5144] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5143] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5143] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} => {parent_tid=[5145]}, 88) = 5145 ./strace-static-x86_64: Process 5145 attached [pid 5144] <... write resumed>) = 262144 [pid 5145] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5144] munmap(0x7f4378b51000, 262144 [pid 5145] <... rseq resumed>) = 0 [pid 5143] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5143] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5143] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5145] set_robust_list(0x7f4380f719a0, 24) = 0 [pid 5145] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5145] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5144] <... munmap resumed>) = 0 [pid 5144] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5144] ioctl(5, LOOP_SET_FD, 3 [pid 5145] <... open resumed>) = 4 [pid 5145] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5144] <... ioctl resumed>) = 0 [pid 5143] <... futex resumed>) = 0 [pid 5144] close(3 [pid 5145] fallocate(4, 0, 35143, 7 [pid 5144] <... close resumed>) = 0 [pid 5143] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5144] mkdir("./file1", 0777) = 0 [pid 5144] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5143] <... futex resumed>) = 0 [pid 5143] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5145] <... fallocate resumed>) = 0 [pid 5145] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5145] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5143] <... futex resumed>) = 0 [pid 5143] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5145] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5143] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5145] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL) = 0 [pid 5145] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5143] <... futex resumed>) = 0 [pid 5143] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5145] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5143] <... futex resumed>) = 0 [pid 5145] <... open resumed>) = 3 [pid 5143] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5145] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5145] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5143] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5143] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5145] <... futex resumed>) = 0 [pid 5145] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5143] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5145] <... write resumed>) = 262144 [pid 5145] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5145] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5143] <... futex resumed>) = 0 [pid 5144] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5144] ioctl(5, LOOP_CLR_FD) = 0 [pid 5144] close(5) = 0 [pid 5144] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5144] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5143] exit_group(0 [pid 5145] <... futex resumed>) = ? [pid 5145] +++ exited with 0 +++ [pid 5143] <... exit_group resumed>) = ? [pid 5144] <... futex resumed>) = ? [pid 5144] +++ exited with 0 +++ [pid 5143] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5143, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- umount2("./27", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./27", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./27/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./27/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./27/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./27/bus") = 0 umount2("./27/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./27/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./27/binderfs") = 0 umount2("./27/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./27/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./27/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./27/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./27/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./27") = 0 mkdir("./28", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556e0f690) = 5146 ./strace-static-x86_64: Process 5146 attached [pid 5146] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5146] chdir("./28") = 0 [pid 5146] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5146] setpgid(0, 0) = 0 [pid 5146] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5146] write(3, "1000", 4) = 4 [pid 5146] close(3) = 0 [pid 5146] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5146] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5146] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5146] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5146] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5146] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5146] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5146] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5147 attached [pid 5147] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5146] <... clone3 resumed> => {parent_tid=[5147]}, 88) = 5147 [pid 5147] <... rseq resumed>) = 0 [pid 5146] rt_sigprocmask(SIG_SETMASK, [], [pid 5147] set_robust_list(0x7f4380f929a0, 24) = 0 [pid 5146] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5147] rt_sigprocmask(SIG_SETMASK, [], [pid 5146] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5147] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5146] <... futex resumed>) = 0 [pid 5146] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5146] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5146] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5147] memfd_create("syzkaller", 0 [pid 5146] <... mprotect resumed>) = 0 [pid 5147] <... memfd_create resumed>) = 3 [pid 5147] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5146] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5147] <... mmap resumed>) = 0x7f4378b51000 [pid 5146] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5146] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0}./strace-static-x86_64: Process 5148 attached [pid 5148] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053) = 0 [pid 5146] <... clone3 resumed> => {parent_tid=[5148]}, 88) = 5148 [pid 5148] set_robust_list(0x7f4380f719a0, 24 [pid 5146] rt_sigprocmask(SIG_SETMASK, [], [pid 5148] <... set_robust_list resumed>) = 0 [pid 5146] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5148] rt_sigprocmask(SIG_SETMASK, [], [pid 5146] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5148] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5146] <... futex resumed>) = 0 [pid 5148] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5146] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5148] <... open resumed>) = 4 [pid 5148] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5146] <... futex resumed>) = 0 [pid 5146] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5146] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5148] <... futex resumed>) = 1 [pid 5148] fallocate(4, 0, 35143, 7 [pid 5147] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 5147] munmap(0x7f4378b51000, 262144) = 0 [pid 5147] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [ 49.859688][ T5144] loop0: detected capacity change from 0 to 512 [ 49.877335][ T5144] EXT4-fs warning (device loop0): read_mmp_block:114: Error -117 while reading MMP block 8 [pid 5147] ioctl(5, LOOP_SET_FD, 3 [pid 5148] <... fallocate resumed>) = 0 [pid 5148] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5147] <... ioctl resumed>) = 0 [pid 5146] <... futex resumed>) = 0 [pid 5148] <... futex resumed>) = 1 [pid 5146] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5148] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5146] <... futex resumed>) = 0 [pid 5147] close(3 [pid 5148] <... mount resumed>) = 0 [pid 5146] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5147] <... close resumed>) = 0 [pid 5148] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5148] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5146] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5146] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5148] <... futex resumed>) = 0 [pid 5146] <... futex resumed>) = 1 [pid 5148] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5146] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5148] <... open resumed>) = 3 [pid 5148] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5146] <... futex resumed>) = 0 [pid 5148] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5146] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5148] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5146] <... futex resumed>) = 0 [pid 5148] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5147] mkdir("./file1", 0777 [pid 5146] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5148] <... write resumed>) = 262144 [pid 5147] <... mkdir resumed>) = 0 [pid 5148] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5147] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5148] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5146] <... futex resumed>) = 0 [pid 5147] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 5147] ioctl(5, LOOP_CLR_FD) = 0 [pid 5147] close(5) = 0 [pid 5147] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5147] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5146] exit_group(0 [pid 5148] <... futex resumed>) = ? [pid 5147] <... futex resumed>) = ? [pid 5148] +++ exited with 0 +++ [pid 5147] +++ exited with 0 +++ [pid 5146] <... exit_group resumed>) = ? [pid 5146] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5146, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./28", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./28", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./28/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./28/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./28/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./28/bus") = 0 umount2("./28/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./28/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./28/binderfs") = 0 umount2("./28/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./28/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./28/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./28/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./28/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./28") = 0 mkdir("./29", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556e0f690) = 5149 ./strace-static-x86_64: Process 5149 attached [pid 5149] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5149] chdir("./29") = 0 [pid 5149] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5149] setpgid(0, 0) = 0 [pid 5149] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5149] write(3, "1000", 4) = 4 [pid 5149] close(3) = 0 [pid 5149] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5149] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5149] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5149] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5149] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5149] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5149] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5149] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5150 attached [pid 5150] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5149] <... clone3 resumed> => {parent_tid=[5150]}, 88) = 5150 [ 49.937266][ T5147] loop0: detected capacity change from 0 to 512 [ 49.953254][ T5147] EXT4-fs (loop0): VFS: Can't find ext4 filesystem [pid 5150] <... rseq resumed>) = 0 [pid 5149] rt_sigprocmask(SIG_SETMASK, [], [pid 5150] set_robust_list(0x7f4380f929a0, 24 [pid 5149] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5150] <... set_robust_list resumed>) = 0 [pid 5149] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5150] rt_sigprocmask(SIG_SETMASK, [], [pid 5149] <... futex resumed>) = 0 [pid 5150] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5149] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5150] memfd_create("syzkaller", 0 [pid 5149] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5149] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5150] <... memfd_create resumed>) = 3 [pid 5149] <... mprotect resumed>) = 0 [pid 5150] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5149] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5150] <... mmap resumed>) = 0x7f4378b51000 [pid 5149] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5149] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} [pid 5150] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144./strace-static-x86_64: Process 5151 attached [pid 5151] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053) = 0 [pid 5151] set_robust_list(0x7f4380f719a0, 24) = 0 [pid 5151] rt_sigprocmask(SIG_SETMASK, [], [pid 5149] <... clone3 resumed> => {parent_tid=[5151]}, 88) = 5151 [pid 5151] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5149] rt_sigprocmask(SIG_SETMASK, [], [pid 5151] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5149] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5149] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5151] <... futex resumed>) = 0 [pid 5149] <... futex resumed>) = 1 [pid 5151] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5149] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5151] <... open resumed>) = 4 [pid 5151] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5151] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5150] <... write resumed>) = 262144 [pid 5150] munmap(0x7f4378b51000, 262144 [pid 5149] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5149] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5151] <... futex resumed>) = 0 [pid 5149] <... futex resumed>) = 1 [pid 5151] fallocate(4, 0, 35143, 7 [pid 5149] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5150] <... munmap resumed>) = 0 [pid 5150] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5150] ioctl(5, LOOP_SET_FD, 3 [pid 5151] <... fallocate resumed>) = 0 [pid 5151] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5151] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5150] <... ioctl resumed>) = 0 [pid 5149] <... futex resumed>) = 0 [pid 5150] close(3 [pid 5149] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5150] <... close resumed>) = 0 [pid 5151] <... futex resumed>) = 0 [pid 5150] mkdir("./file1", 0777 [pid 5149] <... futex resumed>) = 1 [pid 5151] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL) = 0 [pid 5150] <... mkdir resumed>) = 0 [pid 5149] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5150] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5151] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5151] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5149] <... futex resumed>) = 0 [pid 5149] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5151] <... futex resumed>) = 0 [pid 5149] <... futex resumed>) = 1 [pid 5151] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5149] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5151] <... open resumed>) = 3 [pid 5151] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5149] <... futex resumed>) = 0 [pid 5151] <... futex resumed>) = 1 [pid 5149] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5151] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5149] <... futex resumed>) = 0 [pid 5149] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5151] <... write resumed>) = 262144 [pid 5151] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5149] <... futex resumed>) = 0 [pid 5151] <... futex resumed>) = 1 [pid 5151] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5150] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5150] ioctl(5, LOOP_CLR_FD) = 0 [pid 5150] close(5) = 0 [pid 5150] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5150] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5149] exit_group(0) = ? [pid 5150] <... futex resumed>) = ? [pid 5150] +++ exited with 0 +++ [pid 5151] <... futex resumed>) = ? [pid 5151] +++ exited with 0 +++ [pid 5149] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5149, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./29", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./29", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./29/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./29/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./29/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./29/bus") = 0 umount2("./29/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./29/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./29/binderfs") = 0 umount2("./29/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./29/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./29/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./29/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./29/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./29") = 0 mkdir("./30", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5152 attached , child_tidptr=0x555556e0f690) = 5152 [pid 5152] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5152] chdir("./30") = 0 [pid 5152] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5152] setpgid(0, 0) = 0 [pid 5152] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5152] write(3, "1000", 4) = 4 [pid 5152] close(3) = 0 [pid 5152] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5152] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5152] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5152] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5152] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5152] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5152] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5152] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0} => {parent_tid=[5153]}, 88) = 5153 [pid 5152] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5152] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5152] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5152] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [ 50.009467][ T5150] loop0: detected capacity change from 0 to 512 [ 50.027004][ T5150] EXT4-fs warning (device loop0): read_mmp_block:114: Error -117 while reading MMP block 8 [pid 5152] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE./strace-static-x86_64: Process 5153 attached [pid 5153] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053) = 0 [pid 5152] <... mprotect resumed>) = 0 [pid 5153] set_robust_list(0x7f4380f929a0, 24) = 0 [pid 5153] rt_sigprocmask(SIG_SETMASK, [], [pid 5152] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5153] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5152] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5152] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0}./strace-static-x86_64: Process 5154 attached [pid 5153] memfd_create("syzkaller", 0 [pid 5152] <... clone3 resumed> => {parent_tid=[5154]}, 88) = 5154 [pid 5154] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5153] <... memfd_create resumed>) = 3 [pid 5154] <... rseq resumed>) = 0 [pid 5153] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5154] set_robust_list(0x7f4380f719a0, 24) = 0 [pid 5153] <... mmap resumed>) = 0x7f4378b51000 [pid 5152] rt_sigprocmask(SIG_SETMASK, [], [pid 5154] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5152] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5154] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL) = -1 EAGAIN (Resource temporarily unavailable) [pid 5152] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5154] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5152] <... futex resumed>) = 0 [pid 5152] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5154] <... open resumed>) = 4 [pid 5153] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5154] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5152] <... futex resumed>) = 0 [pid 5152] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5152] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5154] fallocate(4, 0, 35143, 7 [pid 5153] <... write resumed>) = 262144 [pid 5153] munmap(0x7f4378b51000, 262144) = 0 [pid 5153] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5153] ioctl(5, LOOP_SET_FD, 3) = 0 [pid 5153] close(3) = 0 [pid 5153] mkdir("./file1", 0777 [pid 5152] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5152] futex(0x7f438105e6ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5152] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4378b70000 [pid 5152] mprotect(0x7f4378b71000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5152] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5152] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4378b90990, parent_tid=0x7f4378b90990, exit_signal=0, stack=0x7f4378b70000, stack_size=0x20300, tls=0x7f4378b906c0}./strace-static-x86_64: Process 5155 attached [pid 5155] rseq(0x7f4378b90fe0, 0x20, 0, 0x53053053 [pid 5152] <... clone3 resumed> => {parent_tid=[5155]}, 88) = 5155 [pid 5155] <... rseq resumed>) = 0 [pid 5152] rt_sigprocmask(SIG_SETMASK, [], [pid 5155] set_robust_list(0x7f4378b909a0, 24 [pid 5152] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5155] <... set_robust_list resumed>) = 0 [pid 5152] futex(0x7f438105e6e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5155] rt_sigprocmask(SIG_SETMASK, [], [pid 5152] <... futex resumed>) = 0 [pid 5155] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5152] futex(0x7f438105e6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [ 50.108233][ T5153] loop0: detected capacity change from 0 to 512 [pid 5155] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5154] <... fallocate resumed>) = 0 [pid 5153] <... mkdir resumed>) = 0 [pid 5154] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5153] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5154] <... futex resumed>) = 0 [pid 5155] <... mount resumed>) = 0 [pid 5154] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5155] futex(0x7f438105e6ec, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5155] futex(0x7f438105e6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5152] <... futex resumed>) = 0 [pid 5152] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5152] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5154] <... futex resumed>) = 0 [pid 5154] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 3 [pid 5154] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5152] <... futex resumed>) = 0 [pid 5154] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5152] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5154] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5152] <... futex resumed>) = 0 [pid 5154] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5152] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5154] <... write resumed>) = 262144 [pid 5154] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5154] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5152] <... futex resumed>) = 0 [pid 5153] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5153] ioctl(5, LOOP_CLR_FD) = 0 [pid 5153] close(5) = 0 [pid 5153] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5153] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5152] exit_group(0 [pid 5154] <... futex resumed>) = ? [pid 5152] <... exit_group resumed>) = ? [pid 5154] +++ exited with 0 +++ [pid 5155] <... futex resumed>) = ? [pid 5155] +++ exited with 0 +++ [pid 5153] <... futex resumed>) = ? [pid 5153] +++ exited with 0 +++ [pid 5152] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5152, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./30", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./30", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./30/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./30/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./30/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./30/bus") = 0 umount2("./30/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./30/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./30/binderfs") = 0 umount2("./30/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./30/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [ 50.193021][ T5153] EXT4-fs error (device loop0): __ext4_fill_super:5473: comm syz-executor369: inode #2: comm syz-executor369: iget: illegal inode # [ 50.207297][ T5153] EXT4-fs (loop0): get root inode failed [ 50.213000][ T5153] EXT4-fs (loop0): mount failed umount2("./30/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./30/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./30/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./30") = 0 mkdir("./31", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5158 attached , child_tidptr=0x555556e0f690) = 5158 [pid 5158] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5158] chdir("./31") = 0 [pid 5158] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5158] setpgid(0, 0) = 0 [pid 5158] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5158] write(3, "1000", 4) = 4 [pid 5158] close(3) = 0 [pid 5158] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5158] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5158] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5158] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5158] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5158] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5158] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5158] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5159 attached => {parent_tid=[5159]}, 88) = 5159 [pid 5159] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053) = 0 [pid 5158] rt_sigprocmask(SIG_SETMASK, [], [pid 5159] set_robust_list(0x7f4380f929a0, 24 [pid 5158] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5159] <... set_robust_list resumed>) = 0 [pid 5158] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5159] rt_sigprocmask(SIG_SETMASK, [], [pid 5158] <... futex resumed>) = 0 [pid 5159] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5158] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5159] memfd_create("syzkaller", 0 [pid 5158] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5159] <... memfd_create resumed>) = 3 [pid 5158] <... mmap resumed>) = 0x7f4380f51000 [pid 5159] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5158] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5159] <... mmap resumed>) = 0x7f4378b51000 [pid 5158] <... mprotect resumed>) = 0 [pid 5159] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5158] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5158] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0}./strace-static-x86_64: Process 5160 attached => {parent_tid=[5160]}, 88) = 5160 [pid 5160] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5158] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5158] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5160] <... rseq resumed>) = 0 [pid 5159] <... write resumed>) = 262144 [pid 5158] <... futex resumed>) = 0 [pid 5159] munmap(0x7f4378b51000, 262144 [pid 5158] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5159] <... munmap resumed>) = 0 [pid 5160] set_robust_list(0x7f4380f719a0, 24 [pid 5159] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5160] <... set_robust_list resumed>) = 0 [pid 5160] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5160] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5159] <... openat resumed>) = 4 [pid 5159] ioctl(4, LOOP_SET_FD, 3 [pid 5160] <... open resumed>) = 5 [pid 5160] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5159] <... ioctl resumed>) = 0 [pid 5160] <... futex resumed>) = 1 [pid 5158] <... futex resumed>) = 0 [pid 5159] close(3 [pid 5158] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5160] fallocate(5, 0, 35143, 7 [pid 5159] <... close resumed>) = 0 [pid 5158] <... futex resumed>) = 0 [pid 5159] mkdir("./file1", 0777 [pid 5158] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5159] <... mkdir resumed>) = 0 [pid 5159] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5160] <... fallocate resumed>) = 0 [pid 5160] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5158] <... futex resumed>) = 0 [pid 5160] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL) = -1 EAGAIN (Resource temporarily unavailable) [pid 5158] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5160] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5158] <... futex resumed>) = 0 [pid 5158] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5160] <... mount resumed>) = 0 [pid 5160] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5158] <... futex resumed>) = 0 [pid 5160] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5158] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5160] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5158] <... futex resumed>) = 0 [pid 5160] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5158] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5160] <... open resumed>) = 3 [pid 5160] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5158] <... futex resumed>) = 0 [pid 5158] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5160] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5158] <... futex resumed>) = 0 [pid 5158] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5160] <... write resumed>) = 262144 [pid 5160] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5160] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5158] <... futex resumed>) = 0 [pid 5159] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5159] ioctl(4, LOOP_CLR_FD) = 0 [pid 5159] close(4) = 0 [pid 5159] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5159] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5158] exit_group(0) = ? [pid 5159] <... futex resumed>) = ? [pid 5159] +++ exited with 0 +++ [pid 5160] <... futex resumed>) = ? [pid 5160] +++ exited with 0 +++ [pid 5158] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5158, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./31", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./31", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./31/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./31/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./31/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./31/bus") = 0 umount2("./31/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./31/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./31/binderfs") = 0 umount2("./31/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./31/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./31/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./31/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./31/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./31") = 0 mkdir("./32", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5161 attached , child_tidptr=0x555556e0f690) = 5161 [pid 5161] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5161] chdir("./32") = 0 [pid 5161] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5161] setpgid(0, 0) = 0 [pid 5161] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5161] write(3, "1000", 4) = 4 [pid 5161] close(3) = 0 [pid 5161] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5161] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5161] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5161] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5161] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5161] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5161] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5161] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5162 attached => {parent_tid=[5162]}, 88) = 5162 [pid 5162] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5161] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5162] <... rseq resumed>) = 0 [pid 5161] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5162] set_robust_list(0x7f4380f929a0, 24 [pid 5161] <... futex resumed>) = 0 [pid 5162] <... set_robust_list resumed>) = 0 [pid 5161] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5162] rt_sigprocmask(SIG_SETMASK, [], [pid 5161] <... futex resumed>) = 0 [pid 5161] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5162] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5161] <... mmap resumed>) = 0x7f4380f51000 [pid 5162] memfd_create("syzkaller", 0 [pid 5161] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5162] <... memfd_create resumed>) = 3 [pid 5161] <... mprotect resumed>) = 0 [pid 5162] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4378b51000 [pid 5161] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5162] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5161] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5161] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} => {parent_tid=[5163]}, 88) = 5163 [pid 5161] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5161] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5163 attached ) = 0 [pid 5163] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053) = 0 [pid 5161] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5163] set_robust_list(0x7f4380f719a0, 24) = 0 [pid 5163] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 50.280100][ T5159] loop0: detected capacity change from 0 to 512 [ 50.297704][ T5159] EXT4-fs warning (device loop0): read_mmp_block:114: Error -117 while reading MMP block 8 [pid 5163] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5162] <... write resumed>) = 262144 [pid 5162] munmap(0x7f4378b51000, 262144 [pid 5163] <... open resumed>) = 4 [pid 5163] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5162] <... munmap resumed>) = 0 [pid 5161] <... futex resumed>) = 0 [pid 5163] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5161] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5163] <... futex resumed>) = 0 [pid 5161] <... futex resumed>) = 1 [pid 5163] fallocate(4, 0, 35143, 7 [pid 5161] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5162] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5162] ioctl(5, LOOP_SET_FD, 3) = 0 [pid 5162] close(3) = 0 [pid 5162] mkdir("./file1", 0777) = 0 [pid 5162] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5163] <... fallocate resumed>) = 0 [pid 5163] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5163] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5161] <... futex resumed>) = 0 [pid 5161] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5163] <... futex resumed>) = 0 [pid 5161] <... futex resumed>) = 1 [pid 5163] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL) = 0 [pid 5161] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5163] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5161] <... futex resumed>) = 0 [pid 5163] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5161] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5163] <... open resumed>) = 3 [pid 5161] <... futex resumed>) = 0 [pid 5163] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5161] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5163] <... futex resumed>) = 0 [pid 5161] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5163] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5161] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5163] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5161] <... futex resumed>) = 0 [pid 5163] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5161] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5163] <... write resumed>) = 262144 [pid 5163] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5161] <... futex resumed>) = 0 [pid 5163] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5162] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5162] ioctl(5, LOOP_CLR_FD) = 0 [pid 5162] close(5) = 0 [pid 5162] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5162] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5161] exit_group(0 [pid 5163] <... futex resumed>) = ? [pid 5161] <... exit_group resumed>) = ? [pid 5162] <... futex resumed>) = ? [pid 5162] +++ exited with 0 +++ [pid 5163] +++ exited with 0 +++ [pid 5161] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5161, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- umount2("./32", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./32", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./32/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./32/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./32/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./32/bus") = 0 umount2("./32/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./32/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./32/binderfs") = 0 umount2("./32/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./32/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./32/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./32/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./32/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./32") = 0 mkdir("./33", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556e0f690) = 5164 ./strace-static-x86_64: Process 5164 attached [pid 5164] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5164] chdir("./33") = 0 [pid 5164] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5164] setpgid(0, 0) = 0 [pid 5164] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5164] write(3, "1000", 4) = 4 [pid 5164] close(3) = 0 [pid 5164] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5164] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5164] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5164] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5164] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5164] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5164] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5164] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5165 attached => {parent_tid=[5165]}, 88) = 5165 [pid 5165] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5164] rt_sigprocmask(SIG_SETMASK, [], [pid 5165] <... rseq resumed>) = 0 [pid 5164] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5165] set_robust_list(0x7f4380f929a0, 24 [pid 5164] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5165] <... set_robust_list resumed>) = 0 [pid 5164] <... futex resumed>) = 0 [pid 5165] rt_sigprocmask(SIG_SETMASK, [], [pid 5164] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5165] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5164] <... futex resumed>) = 0 [pid 5164] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5165] memfd_create("syzkaller", 0 [pid 5164] <... mmap resumed>) = 0x7f4380f51000 [pid 5164] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5165] <... memfd_create resumed>) = 3 [pid 5164] <... mprotect resumed>) = 0 [pid 5165] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5164] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5165] <... mmap resumed>) = 0x7f4378b51000 [pid 5164] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5164] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0}./strace-static-x86_64: Process 5166 attached => {parent_tid=[5166]}, 88) = 5166 [pid 5166] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5164] rt_sigprocmask(SIG_SETMASK, [], [pid 5166] <... rseq resumed>) = 0 [pid 5166] set_robust_list(0x7f4380f719a0, 24 [pid 5164] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5166] <... set_robust_list resumed>) = 0 [pid 5164] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5166] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5164] <... futex resumed>) = 0 [pid 5166] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5164] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5166] <... open resumed>) = 4 [pid 5165] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5166] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5164] <... futex resumed>) = 0 [pid 5164] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5166] <... futex resumed>) = 1 [pid 5164] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5166] fallocate(4, 0, 35143, 7 [pid 5165] <... write resumed>) = 262144 [pid 5165] munmap(0x7f4378b51000, 262144) = 0 [pid 5165] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [ 50.367512][ T5162] loop0: detected capacity change from 0 to 512 [ 50.389794][ T5162] EXT4-fs warning (device loop0): read_mmp_block:114: Error -117 while reading MMP block 8 [pid 5165] ioctl(5, LOOP_SET_FD, 3) = 0 [pid 5166] <... fallocate resumed>) = 0 [pid 5165] close(3 [pid 5166] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5165] <... close resumed>) = 0 [pid 5166] <... futex resumed>) = 1 [pid 5165] mkdir("./file1", 0777 [pid 5166] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5164] <... futex resumed>) = 0 [pid 5164] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5164] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5166] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5165] <... mkdir resumed>) = 0 [pid 5166] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5165] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5166] <... mount resumed>) = 0 [pid 5166] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5164] <... futex resumed>) = 0 [pid 5164] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5164] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5166] <... futex resumed>) = 1 [pid 5166] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 3 [pid 5166] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5164] <... futex resumed>) = 0 [pid 5164] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5164] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5166] <... futex resumed>) = 1 [pid 5166] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190) = 262144 [pid 5166] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5164] <... futex resumed>) = 0 [pid 5166] <... futex resumed>) = 1 [pid 5166] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5165] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5165] ioctl(5, LOOP_CLR_FD) = 0 [pid 5165] close(5) = 0 [pid 5165] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5165] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5164] exit_group(0) = ? [pid 5166] <... futex resumed>) = ? [pid 5165] <... futex resumed>) = ? [pid 5166] +++ exited with 0 +++ [pid 5165] +++ exited with 0 +++ [pid 5164] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5164, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- umount2("./33", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./33", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./33/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./33/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./33/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./33/bus") = 0 umount2("./33/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./33/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./33/binderfs") = 0 umount2("./33/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./33/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./33/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./33/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./33/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./33") = 0 mkdir("./34", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5167 attached , child_tidptr=0x555556e0f690) = 5167 [pid 5167] set_robust_list(0x555556e0f6a0, 24) = 0 [ 50.446585][ T5165] loop0: detected capacity change from 0 to 512 [ 50.457265][ T5165] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 50.467861][ T5165] EXT4-fs (loop0): group descriptors corrupted! [pid 5167] chdir("./34") = 0 [pid 5167] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5167] setpgid(0, 0) = 0 [pid 5167] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5167] write(3, "1000", 4) = 4 [pid 5167] close(3) = 0 [pid 5167] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5167] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5167] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5167] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5167] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5167] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5167] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5167] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5168 attached [pid 5168] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5167] <... clone3 resumed> => {parent_tid=[5168]}, 88) = 5168 [pid 5168] <... rseq resumed>) = 0 [pid 5167] rt_sigprocmask(SIG_SETMASK, [], [pid 5168] set_robust_list(0x7f4380f929a0, 24 [pid 5167] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5168] <... set_robust_list resumed>) = 0 [pid 5167] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5168] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5167] <... futex resumed>) = 0 [pid 5167] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5168] memfd_create("syzkaller", 0 [pid 5167] <... futex resumed>) = 0 [pid 5167] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5168] <... memfd_create resumed>) = 3 [pid 5168] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5167] <... mmap resumed>) = 0x7f4380f51000 [pid 5167] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5168] <... mmap resumed>) = 0x7f4378b51000 [pid 5167] <... mprotect resumed>) = 0 [pid 5168] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5167] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5167] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0}./strace-static-x86_64: Process 5169 attached [pid 5169] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5167] <... clone3 resumed> => {parent_tid=[5169]}, 88) = 5169 [pid 5169] <... rseq resumed>) = 0 [pid 5167] rt_sigprocmask(SIG_SETMASK, [], [pid 5169] set_robust_list(0x7f4380f719a0, 24) = 0 [pid 5169] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5167] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5169] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL) = -1 EAGAIN (Resource temporarily unavailable) [pid 5167] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5169] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5167] <... futex resumed>) = 0 [pid 5169] <... open resumed>) = 4 [pid 5169] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5169] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5168] <... write resumed>) = 262144 [pid 5167] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5168] munmap(0x7f4378b51000, 262144 [pid 5167] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5167] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5169] <... futex resumed>) = 0 [pid 5167] <... futex resumed>) = 1 [pid 5167] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5169] fallocate(4, 0, 35143, 7 [pid 5168] <... munmap resumed>) = 0 [pid 5168] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5168] ioctl(5, LOOP_SET_FD, 3) = 0 [pid 5168] close(3) = 0 [pid 5168] mkdir("./file1", 0777) = 0 [pid 5168] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5169] <... fallocate resumed>) = 0 [pid 5169] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5167] <... futex resumed>) = 0 [pid 5169] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5167] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5169] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5167] <... futex resumed>) = 0 [pid 5167] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5169] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL) = 0 [pid 5169] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5167] <... futex resumed>) = 0 [pid 5169] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5167] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5169] <... futex resumed>) = 0 [pid 5167] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5169] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 3 [pid 5169] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5167] <... futex resumed>) = 0 [pid 5167] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5167] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5169] <... futex resumed>) = 1 [pid 5169] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190) = 262144 [pid 5169] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5167] <... futex resumed>) = 0 [pid 5169] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5168] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5168] ioctl(5, LOOP_CLR_FD) = 0 [pid 5168] close(5) = 0 [pid 5168] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5168] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5167] exit_group(0 [pid 5169] <... futex resumed>) = ? [pid 5168] <... futex resumed>) = ? [pid 5169] +++ exited with 0 +++ [pid 5168] +++ exited with 0 +++ [pid 5167] <... exit_group resumed>) = ? [pid 5167] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5167, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- umount2("./34", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./34", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./34/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./34/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./34/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./34/bus") = 0 umount2("./34/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./34/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./34/binderfs") = 0 umount2("./34/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./34/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./34/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./34/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./34/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./34") = 0 mkdir("./35", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5170 attached , child_tidptr=0x555556e0f690) = 5170 [pid 5170] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5170] chdir("./35") = 0 [pid 5170] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5170] setpgid(0, 0) = 0 [pid 5170] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5170] write(3, "1000", 4) = 4 [pid 5170] close(3) = 0 [pid 5170] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5170] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5170] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5170] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5170] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5170] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5170] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5170] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0} => {parent_tid=[5171]}, 88) = 5171 [pid 5170] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5170] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5170] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5170] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5170] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE) = 0 ./strace-static-x86_64: Process 5171 attached [pid 5171] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053) = 0 [pid 5171] set_robust_list(0x7f4380f929a0, 24) = 0 [pid 5170] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5171] rt_sigprocmask(SIG_SETMASK, [], [pid 5170] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5171] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5171] memfd_create("syzkaller", 0 [pid 5170] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0}./strace-static-x86_64: Process 5172 attached [pid 5171] <... memfd_create resumed>) = 3 [pid 5172] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5171] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5170] <... clone3 resumed> => {parent_tid=[5172]}, 88) = 5172 [pid 5172] <... rseq resumed>) = 0 [pid 5171] <... mmap resumed>) = 0x7f4378b51000 [pid 5172] set_robust_list(0x7f4380f719a0, 24 [pid 5171] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5170] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5172] <... set_robust_list resumed>) = 0 [pid 5170] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5172] rt_sigprocmask(SIG_SETMASK, [], [pid 5170] <... futex resumed>) = 0 [pid 5172] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5170] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5172] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 5172] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5171] <... write resumed>) = 262144 [pid 5170] <... futex resumed>) = 0 [pid 5170] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5172] <... futex resumed>) = 1 [pid 5170] <... futex resumed>) = 0 [pid 5172] fallocate(4, 0, 35143, 7 [pid 5170] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [ 50.547885][ T5168] loop0: detected capacity change from 0 to 512 [ 50.567110][ T5168] EXT4-fs warning (device loop0): read_mmp_block:114: Error -117 while reading MMP block 8 [pid 5171] munmap(0x7f4378b51000, 262144) = 0 [pid 5171] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5171] ioctl(5, LOOP_SET_FD, 3 [pid 5172] <... fallocate resumed>) = 0 [pid 5171] <... ioctl resumed>) = 0 [pid 5172] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5172] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5170] <... futex resumed>) = 0 [pid 5170] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5172] <... futex resumed>) = 0 [pid 5172] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL) = 0 [pid 5172] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5172] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5170] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 5170] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5172] <... futex resumed>) = 0 [pid 5172] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 6 [pid 5172] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5172] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5170] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 5170] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5172] <... futex resumed>) = 0 [pid 5170] <... futex resumed>) = 1 [pid 5172] write(6, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5170] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5171] close(3) = 0 [pid 5171] mkdir("./file1", 0777) = 0 [pid 5171] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5172] <... write resumed>) = 262144 [pid 5172] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5170] <... futex resumed>) = 0 [pid 5172] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5171] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 5171] ioctl(5, LOOP_CLR_FD) = 0 [pid 5171] close(5) = 0 [pid 5171] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5171] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5170] exit_group(0 [pid 5171] <... futex resumed>) = ? [pid 5171] +++ exited with 0 +++ [pid 5170] <... exit_group resumed>) = ? [pid 5172] <... futex resumed>) = ? [pid 5172] +++ exited with 0 +++ [pid 5170] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5170, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- umount2("./35", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./35", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./35/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./35/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./35/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./35/bus") = 0 umount2("./35/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./35/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./35/binderfs") = 0 umount2("./35/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./35/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./35/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./35/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./35/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./35") = 0 mkdir("./36", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 [ 50.629841][ T5171] loop0: detected capacity change from 0 to 512 [ 50.647567][ T5171] EXT4-fs (loop0): VFS: Can't find ext4 filesystem clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556e0f690) = 5173 ./strace-static-x86_64: Process 5173 attached [pid 5173] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5173] chdir("./36") = 0 [pid 5173] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5173] setpgid(0, 0) = 0 [pid 5173] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5173] write(3, "1000", 4) = 4 [pid 5173] close(3) = 0 [pid 5173] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5173] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5173] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5173] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5173] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5173] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5173] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5173] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5174 attached => {parent_tid=[5174]}, 88) = 5174 [pid 5173] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5173] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5173] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5173] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5174] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5173] <... mmap resumed>) = 0x7f4380f51000 [pid 5173] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5174] <... rseq resumed>) = 0 [pid 5173] <... mprotect resumed>) = 0 [pid 5173] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5174] set_robust_list(0x7f4380f929a0, 24 [pid 5173] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5173] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} [pid 5174] <... set_robust_list resumed>) = 0 [pid 5174] rt_sigprocmask(SIG_SETMASK, [], ./strace-static-x86_64: Process 5175 attached [pid 5173] <... clone3 resumed> => {parent_tid=[5175]}, 88) = 5175 [pid 5173] rt_sigprocmask(SIG_SETMASK, [], [pid 5175] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5174] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5173] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5173] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5173] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5175] <... rseq resumed>) = 0 [pid 5175] set_robust_list(0x7f4380f719a0, 24) = 0 [pid 5175] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5174] memfd_create("syzkaller", 0 [pid 5175] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 3 [pid 5174] <... memfd_create resumed>) = 4 [pid 5175] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5173] <... futex resumed>) = 0 [pid 5175] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5173] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5175] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5173] <... futex resumed>) = 0 [pid 5175] fallocate(3, 0, 35143, 7 [pid 5173] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5174] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4378b51000 [pid 5174] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 5174] munmap(0x7f4378b51000, 262144) = 0 [pid 5175] <... fallocate resumed>) = 0 [pid 5174] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5175] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5174] <... openat resumed>) = 5 [pid 5175] <... futex resumed>) = 1 [pid 5173] <... futex resumed>) = 0 [pid 5175] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5174] ioctl(5, LOOP_SET_FD, 4 [pid 5173] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5175] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5173] <... futex resumed>) = 0 [pid 5175] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5173] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5175] <... mount resumed>) = 0 [pid 5175] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5173] <... futex resumed>) = 0 [pid 5173] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5173] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5175] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 6 [pid 5174] <... ioctl resumed>) = 0 [pid 5175] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5174] close(4 [pid 5175] <... futex resumed>) = 1 [pid 5173] <... futex resumed>) = 0 [pid 5174] <... close resumed>) = 0 [pid 5175] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5173] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5174] mkdir("./file1", 0777 [pid 5175] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5174] <... mkdir resumed>) = 0 [pid 5173] <... futex resumed>) = 0 [pid 5175] write(6, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5174] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5173] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5175] <... write resumed>) = 262144 [pid 5175] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5173] <... futex resumed>) = 0 [pid 5175] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5174] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5174] ioctl(5, LOOP_CLR_FD) = 0 [pid 5174] close(5) = 0 [pid 5174] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5173] exit_group(0 [pid 5175] <... futex resumed>) = ? [pid 5173] <... exit_group resumed>) = ? [pid 5175] +++ exited with 0 +++ [pid 5174] +++ exited with 0 +++ [pid 5173] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5173, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- umount2("./36", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./36", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./36/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./36/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./36/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./36/bus") = 0 umount2("./36/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./36/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./36/binderfs") = 0 umount2("./36/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./36/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./36/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./36/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./36/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./36") = 0 mkdir("./37", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5176 attached , child_tidptr=0x555556e0f690) = 5176 [pid 5176] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5176] chdir("./37") = 0 [pid 5176] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5176] setpgid(0, 0) = 0 [pid 5176] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5176] write(3, "1000", 4) = 4 [pid 5176] close(3) = 0 [pid 5176] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5176] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5176] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5176] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5176] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5176] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5176] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5176] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5177 attached [pid 5177] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5176] <... clone3 resumed> => {parent_tid=[5177]}, 88) = 5177 [pid 5177] <... rseq resumed>) = 0 [pid 5176] rt_sigprocmask(SIG_SETMASK, [], [pid 5177] set_robust_list(0x7f4380f929a0, 24) = 0 [pid 5176] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5177] rt_sigprocmask(SIG_SETMASK, [], [pid 5176] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5177] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5176] <... futex resumed>) = 0 [pid 5177] memfd_create("syzkaller", 0 [pid 5176] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5176] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5177] <... memfd_create resumed>) = 3 [pid 5176] <... mmap resumed>) = 0x7f4380f51000 [pid 5176] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5177] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5176] <... mprotect resumed>) = 0 [pid 5177] <... mmap resumed>) = 0x7f4378b51000 [pid 5176] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5177] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5176] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5176] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} => {parent_tid=[5178]}, 88) = 5178 [pid 5176] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5176] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5176] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5178 attached [pid 5178] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053) = 0 [pid 5178] set_robust_list(0x7f4380f719a0, 24) = 0 [pid 5178] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5177] <... write resumed>) = 262144 [pid 5177] munmap(0x7f4378b51000, 262144) = 0 [pid 5177] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5177] ioctl(4, LOOP_SET_FD, 3 [ 50.715379][ T5174] loop0: detected capacity change from 0 to 512 [ 50.726951][ T5174] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 50.736663][ T5174] EXT4-fs (loop0): group descriptors corrupted! [pid 5178] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5 [pid 5178] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5178] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5176] <... futex resumed>) = 0 [pid 5176] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5178] <... futex resumed>) = 0 [pid 5176] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5178] fallocate(5, 0, 35143, 7 [pid 5177] <... ioctl resumed>) = 0 [pid 5177] close(3) = 0 [pid 5177] mkdir("./file1", 0777) = 0 [pid 5177] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5178] <... fallocate resumed>) = 0 [pid 5178] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5176] <... futex resumed>) = 0 [pid 5178] <... futex resumed>) = 1 [pid 5176] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5178] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5176] <... futex resumed>) = 0 [pid 5176] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5178] <... mount resumed>) = 0 [pid 5178] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5176] <... futex resumed>) = 0 [pid 5178] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5176] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5176] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5178] <... open resumed>) = 3 [pid 5178] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5176] <... futex resumed>) = 0 [pid 5176] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5176] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5178] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190) = 262144 [ 50.791711][ T5177] loop0: detected capacity change from 0 to 512 [ 50.808945][ T5179] EXT4-fs warning (device loop0): kmmpd:167: kmmpd being stopped since MMP feature has been disabled. [ 50.820274][ T5177] EXT4-fs error (device loop0): __ext4_fill_super:5473: comm syz-executor369: inode #2: comm syz-executor369: iget: illegal inode # [ 50.834699][ T5177] EXT4-fs (loop0): get root inode failed [pid 5178] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5176] <... futex resumed>) = 0 [pid 5178] <... futex resumed>) = 1 [pid 5177] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5178] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5177] ioctl(4, LOOP_CLR_FD) = 0 [pid 5177] close(4) = 0 [pid 5177] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5177] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5176] exit_group(0 [pid 5178] <... futex resumed>) = ? [pid 5177] <... futex resumed>) = ? [pid 5178] +++ exited with 0 +++ [pid 5177] +++ exited with 0 +++ [pid 5176] <... exit_group resumed>) = ? [pid 5176] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5176, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- umount2("./37", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./37", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./37/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./37/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./37/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./37/bus") = 0 umount2("./37/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./37/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./37/binderfs") = 0 umount2("./37/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./37/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./37/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./37/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./37/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./37") = 0 mkdir("./38", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5181 attached , child_tidptr=0x555556e0f690) = 5181 [pid 5181] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5181] chdir("./38") = 0 [pid 5181] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5181] setpgid(0, 0) = 0 [pid 5181] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5181] write(3, "1000", 4) = 4 [pid 5181] close(3) = 0 [pid 5181] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5181] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5181] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5181] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5181] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5181] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5181] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5181] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5182 attached => {parent_tid=[5182]}, 88) = 5182 [pid 5182] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053) = 0 [pid 5181] rt_sigprocmask(SIG_SETMASK, [], [pid 5182] set_robust_list(0x7f4380f929a0, 24 [pid 5181] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5182] <... set_robust_list resumed>) = 0 [pid 5181] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5182] rt_sigprocmask(SIG_SETMASK, [], [pid 5181] <... futex resumed>) = 0 [pid 5182] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5181] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5182] memfd_create("syzkaller", 0 [pid 5181] <... futex resumed>) = 0 [pid 5181] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5181] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5182] <... memfd_create resumed>) = 3 [pid 5181] <... mprotect resumed>) = 0 [pid 5182] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4378b51000 [pid 5181] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5181] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} => {parent_tid=[5183]}, 88) = 5183 [pid 5181] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5181] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5181] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5183 attached [pid 5182] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 5182] munmap(0x7f4378b51000, 262144) = 0 [pid 5182] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5182] ioctl(4, LOOP_SET_FD, 3 [ 50.840433][ T5177] EXT4-fs (loop0): mount failed [pid 5183] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053) = 0 [pid 5182] <... ioctl resumed>) = 0 [pid 5183] set_robust_list(0x7f4380f719a0, 24) = 0 [pid 5182] close(3 [pid 5183] rt_sigprocmask(SIG_SETMASK, [], [pid 5182] <... close resumed>) = 0 [pid 5183] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5182] mkdir("./file1", 0777 [pid 5183] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5182] <... mkdir resumed>) = 0 [pid 5182] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5183] <... open resumed>) = 3 [pid 5183] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5181] <... futex resumed>) = 0 [pid 5183] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5181] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5183] <... futex resumed>) = 0 [pid 5181] <... futex resumed>) = 1 [pid 5183] fallocate(3, 0, 35143, 7 [pid 5181] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5183] <... fallocate resumed>) = 0 [pid 5183] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5183] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5181] <... futex resumed>) = 0 [pid 5181] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5183] <... futex resumed>) = 0 [pid 5181] <... futex resumed>) = 1 [pid 5183] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5181] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5183] <... mount resumed>) = 0 [pid 5183] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5181] <... futex resumed>) = 0 [pid 5183] <... futex resumed>) = 1 [pid 5181] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5183] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5181] <... futex resumed>) = 0 [pid 5183] <... open resumed>) = 5 [pid 5181] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5183] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5181] <... futex resumed>) = 0 [pid 5183] write(5, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5181] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5181] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5183] <... write resumed>) = 262144 [pid 5183] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5181] <... futex resumed>) = 0 [ 50.882482][ T5182] loop0: detected capacity change from 0 to 512 [ 50.901810][ T5184] EXT4-fs warning (device loop0): kmmpd:167: kmmpd being stopped since MMP feature has been disabled. [ 50.902456][ T5182] EXT4-fs error (device loop0): __ext4_fill_super:5473: comm syz-executor369: inode #2: comm syz-executor369: iget: illegal inode # [pid 5183] <... futex resumed>) = 1 [pid 5183] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5182] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5182] ioctl(4, LOOP_CLR_FD) = 0 [pid 5182] close(4) = 0 [pid 5182] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5182] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5181] exit_group(0) = ? [pid 5182] <... futex resumed>) = ? [pid 5182] +++ exited with 0 +++ [pid 5183] <... futex resumed>) = ? [pid 5183] +++ exited with 0 +++ [pid 5181] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5181, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- umount2("./38", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./38", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./38/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./38/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./38/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./38/bus") = 0 umount2("./38/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./38/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./38/binderfs") = 0 umount2("./38/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./38/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./38/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./38/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./38/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./38") = 0 mkdir("./39", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556e0f690) = 5186 ./strace-static-x86_64: Process 5186 attached [pid 5186] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5186] chdir("./39") = 0 [pid 5186] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5186] setpgid(0, 0) = 0 [pid 5186] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5186] write(3, "1000", 4) = 4 [pid 5186] close(3) = 0 [pid 5186] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5186] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5186] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5186] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5186] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5186] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5186] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5186] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5187 attached [pid 5187] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5186] <... clone3 resumed> => {parent_tid=[5187]}, 88) = 5187 [pid 5187] <... rseq resumed>) = 0 [pid 5186] rt_sigprocmask(SIG_SETMASK, [], [pid 5187] set_robust_list(0x7f4380f929a0, 24 [pid 5186] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5186] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5187] <... set_robust_list resumed>) = 0 [pid 5187] rt_sigprocmask(SIG_SETMASK, [], [pid 5186] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5187] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5187] memfd_create("syzkaller", 0 [pid 5186] <... futex resumed>) = 0 [pid 5186] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5187] <... memfd_create resumed>) = 3 [pid 5186] <... mmap resumed>) = 0x7f4380f51000 [pid 5186] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5187] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4378b51000 [pid 5186] <... mprotect resumed>) = 0 [pid 5186] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5187] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5186] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5186] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0}./strace-static-x86_64: Process 5188 attached [pid 5188] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053) = 0 [pid 5188] set_robust_list(0x7f4380f719a0, 24 [pid 5186] <... clone3 resumed> => {parent_tid=[5188]}, 88) = 5188 [pid 5186] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5188] <... set_robust_list resumed>) = 0 [pid 5186] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5188] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5188] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5186] <... futex resumed>) = 0 [pid 5186] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5188] <... open resumed>) = 4 [pid 5188] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5187] <... write resumed>) = 262144 [pid 5186] <... futex resumed>) = 0 [pid 5188] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5186] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5188] <... futex resumed>) = 0 [pid 5186] <... futex resumed>) = 1 [pid 5188] fallocate(4, 0, 35143, 7 [pid 5186] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5187] munmap(0x7f4378b51000, 262144) = 0 [pid 5187] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [ 50.927853][ T5182] EXT4-fs (loop0): get root inode failed [ 50.933591][ T5182] EXT4-fs (loop0): mount failed [pid 5187] ioctl(5, LOOP_SET_FD, 3 [pid 5188] <... fallocate resumed>) = 0 [pid 5188] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5186] <... futex resumed>) = 0 [pid 5188] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5186] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5188] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5186] <... futex resumed>) = 0 [pid 5188] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5186] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5188] <... mount resumed>) = 0 [pid 5188] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5187] <... ioctl resumed>) = 0 [pid 5186] <... futex resumed>) = 0 [pid 5186] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5186] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5187] close(3) = 0 [pid 5187] mkdir("./file1", 0777) = 0 [pid 5187] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5188] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 3 [pid 5188] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5186] <... futex resumed>) = 0 [pid 5186] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5186] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5188] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190) = 262144 [pid 5187] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 5187] ioctl(5, LOOP_CLR_FD [pid 5188] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5187] <... ioctl resumed>) = 0 [pid 5186] <... futex resumed>) = 0 [pid 5188] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5187] close(5) = 0 [pid 5187] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5187] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5186] exit_group(0 [pid 5188] <... futex resumed>) = ? [pid 5187] <... futex resumed>) = ? [pid 5186] <... exit_group resumed>) = ? [pid 5188] +++ exited with 0 +++ [pid 5187] +++ exited with 0 +++ [pid 5186] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5186, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- umount2("./39", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./39", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./39/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./39/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./39/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./39/bus") = 0 umount2("./39/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./39/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./39/binderfs") = 0 umount2("./39/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./39/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./39/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./39/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./39/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./39") = 0 mkdir("./40", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5189 attached , child_tidptr=0x555556e0f690) = 5189 [pid 5189] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5189] chdir("./40") = 0 [pid 5189] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5189] setpgid(0, 0) = 0 [pid 5189] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [ 50.994079][ T5187] loop0: detected capacity change from 0 to 512 [ 51.007821][ T5187] EXT4-fs (loop0): VFS: Can't find ext4 filesystem [pid 5189] write(3, "1000", 4) = 4 [pid 5189] close(3) = 0 [pid 5189] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5189] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5189] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5189] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5189] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5189] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5189] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5189] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5190 attached => {parent_tid=[5190]}, 88) = 5190 [pid 5189] rt_sigprocmask(SIG_SETMASK, [], [pid 5190] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053) = 0 [pid 5189] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5190] set_robust_list(0x7f4380f929a0, 24 [pid 5189] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5190] <... set_robust_list resumed>) = 0 [pid 5189] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5190] rt_sigprocmask(SIG_SETMASK, [], [pid 5189] <... futex resumed>) = 0 [pid 5190] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5189] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5190] memfd_create("syzkaller", 0 [pid 5189] <... mmap resumed>) = 0x7f4380f51000 [pid 5189] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5190] <... memfd_create resumed>) = 3 [pid 5190] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5189] <... mprotect resumed>) = 0 [pid 5190] <... mmap resumed>) = 0x7f4378b51000 [pid 5189] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5190] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5189] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5189] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0}./strace-static-x86_64: Process 5191 attached [pid 5191] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5189] <... clone3 resumed> => {parent_tid=[5191]}, 88) = 5191 [pid 5189] rt_sigprocmask(SIG_SETMASK, [], [pid 5191] <... rseq resumed>) = 0 [pid 5191] set_robust_list(0x7f4380f719a0, 24 [pid 5189] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5191] <... set_robust_list resumed>) = 0 [pid 5191] rt_sigprocmask(SIG_SETMASK, [], [pid 5189] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5191] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5191] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5189] <... futex resumed>) = 0 [pid 5189] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5191] <... open resumed>) = 4 [pid 5191] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5189] <... futex resumed>) = 0 [pid 5189] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5189] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5191] fallocate(4, 0, 35143, 7 [pid 5190] <... write resumed>) = 262144 [pid 5190] munmap(0x7f4378b51000, 262144) = 0 [pid 5190] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5190] ioctl(5, LOOP_SET_FD, 3) = 0 [pid 5190] close(3) = 0 [pid 5190] mkdir("./file1", 0777 [pid 5191] <... fallocate resumed>) = 0 [pid 5190] <... mkdir resumed>) = 0 [pid 5191] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5190] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5191] <... futex resumed>) = 1 [pid 5189] <... futex resumed>) = 0 [pid 5189] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5189] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5191] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL) = 0 [pid 5191] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5189] <... futex resumed>) = 0 [pid 5191] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5189] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5191] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5189] <... futex resumed>) = 0 [pid 5191] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5189] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5191] <... open resumed>) = 3 [pid 5191] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5189] <... futex resumed>) = 0 [pid 5191] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5189] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5191] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5189] <... futex resumed>) = 0 [pid 5191] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5189] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5191] <... write resumed>) = 262144 [pid 5191] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5191] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5189] <... futex resumed>) = 0 [pid 5190] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5190] ioctl(5, LOOP_CLR_FD) = 0 [pid 5190] close(5) = 0 [pid 5190] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5190] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5189] exit_group(0 [pid 5191] <... futex resumed>) = ? [pid 5189] <... exit_group resumed>) = ? [pid 5190] <... futex resumed>) = ? [pid 5190] +++ exited with 0 +++ [pid 5191] +++ exited with 0 +++ [pid 5189] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5189, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- umount2("./40", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./40", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./40/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./40/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./40/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./40/bus") = 0 umount2("./40/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./40/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./40/binderfs") = 0 umount2("./40/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./40/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./40/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./40/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./40/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./40") = 0 mkdir("./41", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5192 attached , child_tidptr=0x555556e0f690) = 5192 [pid 5192] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5192] chdir("./41") = 0 [pid 5192] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5192] setpgid(0, 0) = 0 [pid 5192] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5192] write(3, "1000", 4) = 4 [pid 5192] close(3) = 0 [pid 5192] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5192] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5192] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5192] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [ 51.072169][ T5190] loop0: detected capacity change from 0 to 512 [ 51.088037][ T5190] EXT4-fs warning (device loop0): read_mmp_block:114: Error -117 while reading MMP block 8 [pid 5192] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5192] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5192] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5192] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5193 attached [pid 5193] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5192] <... clone3 resumed> => {parent_tid=[5193]}, 88) = 5193 [pid 5193] <... rseq resumed>) = 0 [pid 5192] rt_sigprocmask(SIG_SETMASK, [], [pid 5193] set_robust_list(0x7f4380f929a0, 24 [pid 5192] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5193] <... set_robust_list resumed>) = 0 [pid 5192] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5193] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5192] <... futex resumed>) = 0 [pid 5192] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5193] memfd_create("syzkaller", 0) = 3 [pid 5192] <... futex resumed>) = 0 [pid 5193] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5192] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5193] <... mmap resumed>) = 0x7f4378b72000 [pid 5192] <... mmap resumed>) = 0x7f4378b51000 [pid 5193] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5192] mprotect(0x7f4378b52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5192] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5192] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4378b71990, parent_tid=0x7f4378b71990, exit_signal=0, stack=0x7f4378b51000, stack_size=0x20300, tls=0x7f4378b716c0}./strace-static-x86_64: Process 5194 attached => {parent_tid=[5194]}, 88) = 5194 [pid 5194] rseq(0x7f4378b71fe0, 0x20, 0, 0x53053053) = 0 [pid 5194] set_robust_list(0x7f4378b719a0, 24) = 0 [pid 5194] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5193] <... write resumed>) = 262144 [pid 5192] rt_sigprocmask(SIG_SETMASK, [], [pid 5194] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5193] munmap(0x7f4378b72000, 262144 [pid 5192] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5192] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5194] <... futex resumed>) = 0 [pid 5194] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5192] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5193] <... munmap resumed>) = 0 [pid 5193] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5193] ioctl(5, LOOP_SET_FD, 3 [pid 5194] <... open resumed>) = 4 [pid 5193] <... ioctl resumed>) = 0 [pid 5193] close(3) = 0 [pid 5193] mkdir("./file1", 0777 [pid 5194] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5192] <... futex resumed>) = 0 [pid 5194] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5192] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5192] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5194] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5193] <... mkdir resumed>) = 0 [pid 5194] fallocate(4, 0, 35143, 7 [pid 5193] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5194] <... fallocate resumed>) = 0 [pid 5194] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5192] <... futex resumed>) = 0 [pid 5192] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5194] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5192] <... futex resumed>) = 0 [pid 5194] <... mount resumed>) = 0 [pid 5192] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5194] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5192] <... futex resumed>) = 0 [pid 5192] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5194] <... futex resumed>) = 1 [pid 5192] <... futex resumed>) = 0 [pid 5194] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5192] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5194] <... open resumed>) = 3 [pid 5194] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5194] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5192] <... futex resumed>) = 0 [pid 5192] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5194] <... futex resumed>) = 0 [pid 5194] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5192] <... futex resumed>) = 1 [pid 5192] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5194] <... write resumed>) = 262144 [pid 5194] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5192] <... futex resumed>) = 0 [pid 5194] <... futex resumed>) = 1 [pid 5194] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5193] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 5193] ioctl(5, LOOP_CLR_FD) = 0 [pid 5193] close(5) = 0 [pid 5193] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5193] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5192] exit_group(0 [pid 5194] <... futex resumed>) = ? [pid 5193] <... futex resumed>) = ? [pid 5192] <... exit_group resumed>) = ? [pid 5194] +++ exited with 0 +++ [pid 5193] +++ exited with 0 +++ [pid 5192] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5192, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- umount2("./41", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./41", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./41/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./41/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./41/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./41/bus") = 0 umount2("./41/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./41/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./41/binderfs") = 0 umount2("./41/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./41/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./41/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./41/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./41/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./41") = 0 mkdir("./42", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 [ 51.165563][ T5193] loop0: detected capacity change from 0 to 512 [ 51.183133][ T5193] EXT4-fs warning (device loop0): ext4_enable_quotas:7078: Failed to enable quota tracking (type=0, err=-22, ino=3). Please run e2fsck to fix. [ 51.202538][ T5193] EXT4-fs (loop0): mount failed clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556e0f690) = 5197 ./strace-static-x86_64: Process 5197 attached [pid 5197] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5197] chdir("./42") = 0 [pid 5197] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5197] setpgid(0, 0) = 0 [pid 5197] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5197] write(3, "1000", 4) = 4 [pid 5197] close(3) = 0 [pid 5197] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5197] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5197] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5197] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5197] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5197] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5197] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5197] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5198 attached => {parent_tid=[5198]}, 88) = 5198 [pid 5198] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053) = 0 [pid 5198] set_robust_list(0x7f4380f929a0, 24 [pid 5197] rt_sigprocmask(SIG_SETMASK, [], [pid 5198] <... set_robust_list resumed>) = 0 [pid 5198] rt_sigprocmask(SIG_SETMASK, [], [pid 5197] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5198] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5198] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5197] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5198] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5197] <... futex resumed>) = 0 [pid 5197] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5198] memfd_create("syzkaller", 0 [pid 5197] <... futex resumed>) = 0 [pid 5197] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5198] <... memfd_create resumed>) = 3 [pid 5197] <... mmap resumed>) = 0x7f4380f51000 [pid 5198] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4378b51000 [pid 5197] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5197] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5197] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} => {parent_tid=[5199]}, 88) = 5199 [pid 5197] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5197] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5197] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5199 attached [pid 5199] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053) = 0 [pid 5199] set_robust_list(0x7f4380f719a0, 24) = 0 [pid 5199] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5199] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 5198] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5199] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5197] <... futex resumed>) = 0 [pid 5197] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5197] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5199] <... futex resumed>) = 1 [pid 5199] fallocate(4, 0, 35143, 7 [pid 5198] <... write resumed>) = 262144 [pid 5198] munmap(0x7f4378b51000, 262144) = 0 [pid 5199] <... fallocate resumed>) = 0 [pid 5198] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5199] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5197] <... futex resumed>) = 0 [pid 5197] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5198] <... openat resumed>) = 5 [pid 5197] <... futex resumed>) = 0 [pid 5197] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5199] <... futex resumed>) = 1 [pid 5199] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL) = 0 [pid 5198] ioctl(5, LOOP_SET_FD, 3 [pid 5199] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5197] <... futex resumed>) = 0 [pid 5197] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5197] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5199] <... futex resumed>) = 1 [pid 5199] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 6 [pid 5199] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5197] <... futex resumed>) = 0 [pid 5199] write(6, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5197] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5197] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5198] <... ioctl resumed>) = 0 [pid 5198] close(3) = 0 [pid 5198] mkdir("./file1", 0777) = 0 [pid 5198] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5199] <... write resumed>) = -1 EIO (Input/output error) [pid 5199] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5199] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5197] <... futex resumed>) = 0 [pid 5198] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 5198] ioctl(5, LOOP_CLR_FD) = 0 [pid 5198] close(5) = 0 [pid 5198] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5198] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5197] exit_group(0 [pid 5199] <... futex resumed>) = ? [pid 5197] <... exit_group resumed>) = ? [pid 5198] <... futex resumed>) = ? [pid 5198] +++ exited with 0 +++ [pid 5199] +++ exited with 0 +++ [pid 5197] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5197, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- umount2("./42", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./42", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./42/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./42/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./42/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./42/bus") = 0 umount2("./42/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./42/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./42/binderfs") = 0 umount2("./42/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./42/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./42/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./42/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./42/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./42") = 0 mkdir("./43", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556e0f690) = 5200 ./strace-static-x86_64: Process 5200 attached [pid 5200] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5200] chdir("./43") = 0 [pid 5200] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5200] setpgid(0, 0) = 0 [pid 5200] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5200] write(3, "1000", 4) = 4 [pid 5200] close(3) = 0 [pid 5200] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5200] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5200] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5200] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5200] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5200] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5200] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [ 51.273783][ T5198] loop0: detected capacity change from 0 to 512 [ 51.282262][ T5199] I/O error, dev loop0, sector 248 op 0x1:(WRITE) flags 0x800 phys_seg 1 prio class 2 [ 51.294967][ T5199] Buffer I/O error on dev loop0, logical block 31, lost async page write [ 51.305556][ T5198] EXT4-fs (loop0): VFS: Can't find ext4 filesystem [pid 5200] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5201 attached => {parent_tid=[5201]}, 88) = 5201 [pid 5201] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053) = 0 [pid 5201] set_robust_list(0x7f4380f929a0, 24) = 0 [pid 5201] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5201] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5200] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5200] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5200] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5200] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5200] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5200] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5200] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} [pid 5201] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5201] memfd_create("syzkaller", 0) = 3 [pid 5201] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0./strace-static-x86_64: Process 5202 attached [pid 5200] <... clone3 resumed> => {parent_tid=[5202]}, 88) = 5202 [pid 5202] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5200] rt_sigprocmask(SIG_SETMASK, [], [pid 5202] <... rseq resumed>) = 0 [pid 5200] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5202] set_robust_list(0x7f4380f719a0, 24 [pid 5200] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5202] <... set_robust_list resumed>) = 0 [pid 5200] <... futex resumed>) = 0 [pid 5202] rt_sigprocmask(SIG_SETMASK, [], [pid 5200] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5202] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5202] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5201] <... mmap resumed>) = 0x7f4378b51000 [pid 5202] <... open resumed>) = 4 [pid 5201] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5202] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5200] <... futex resumed>) = 0 [pid 5202] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5200] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5202] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5200] <... futex resumed>) = 0 [pid 5202] fallocate(4, 0, 35143, 7 [pid 5200] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5201] <... write resumed>) = 262144 [pid 5201] munmap(0x7f4378b51000, 262144) = 0 [pid 5201] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5201] ioctl(5, LOOP_SET_FD, 3 [pid 5202] <... fallocate resumed>) = 0 [pid 5201] <... ioctl resumed>) = 0 [pid 5201] close(3) = 0 [pid 5201] mkdir("./file1", 0777 [pid 5202] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5201] <... mkdir resumed>) = 0 [pid 5202] <... futex resumed>) = 1 [pid 5201] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5200] <... futex resumed>) = 0 [pid 5202] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5200] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5202] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5202] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL) = 0 [pid 5200] <... futex resumed>) = 0 [pid 5202] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5202] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5200] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 5200] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5202] <... futex resumed>) = 0 [pid 5200] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5202] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 3 [pid 5202] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5200] <... futex resumed>) = 0 [pid 5202] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5200] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5202] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5202] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5200] <... futex resumed>) = 0 [pid 5200] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5202] <... write resumed>) = 262144 [pid 5202] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5200] <... futex resumed>) = 0 [pid 5202] <... futex resumed>) = 1 [pid 5202] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5201] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5201] ioctl(5, LOOP_CLR_FD) = 0 [pid 5201] close(5) = 0 [pid 5201] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5201] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5200] exit_group(0) = ? [pid 5202] <... futex resumed>) = ? [pid 5202] +++ exited with 0 +++ [pid 5201] <... futex resumed>) = ? [pid 5201] +++ exited with 0 +++ [pid 5200] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5200, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./43", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./43", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./43/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./43/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./43/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./43/bus") = 0 umount2("./43/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./43/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./43/binderfs") = 0 umount2("./43/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./43/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./43/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./43/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./43/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./43") = 0 mkdir("./44", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5203 attached [pid 5203] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5203] chdir("./44") = 0 [pid 5203] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5203] setpgid(0, 0) = 0 [pid 5203] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5203] write(3, "1000", 4) = 4 [pid 5203] close(3) = 0 [pid 5203] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5203] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5033] <... clone resumed>, child_tidptr=0x555556e0f690) = 5203 [pid 5203] <... futex resumed>) = 0 [pid 5203] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5203] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5203] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5203] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5203] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5203] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5204 attached [pid 5204] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053) = 0 [pid 5204] set_robust_list(0x7f4380f929a0, 24) = 0 [pid 5204] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5204] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5203] <... clone3 resumed> => {parent_tid=[5204]}, 88) = 5204 [pid 5203] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5203] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5204] <... futex resumed>) = 0 [pid 5203] <... futex resumed>) = 1 [pid 5204] memfd_create("syzkaller", 0 [pid 5203] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5204] <... memfd_create resumed>) = 3 [pid 5203] <... futex resumed>) = 0 [pid 5204] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [ 51.378957][ T5201] loop0: detected capacity change from 0 to 512 [ 51.397117][ T5201] EXT4-fs warning (device loop0): read_mmp_block:114: Error -117 while reading MMP block 8 [pid 5203] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5204] <... mmap resumed>) = 0x7f4378b51000 [pid 5204] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5203] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5203] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5203] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0}./strace-static-x86_64: Process 5205 attached => {parent_tid=[5205]}, 88) = 5205 [pid 5205] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053) = 0 [pid 5203] rt_sigprocmask(SIG_SETMASK, [], [pid 5205] set_robust_list(0x7f4380f719a0, 24) = 0 [pid 5204] <... write resumed>) = 262144 [pid 5203] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5203] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5205] rt_sigprocmask(SIG_SETMASK, [], [pid 5203] <... futex resumed>) = 0 [pid 5205] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5203] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5205] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5204] munmap(0x7f4378b51000, 262144) = 0 [pid 5205] <... open resumed>) = 4 [pid 5205] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5204] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5203] <... futex resumed>) = 0 [pid 5205] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5203] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5205] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5203] <... futex resumed>) = 0 [pid 5205] fallocate(4, 0, 35143, 7 [pid 5203] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5204] <... openat resumed>) = 5 [pid 5204] ioctl(5, LOOP_SET_FD, 3 [pid 5205] <... fallocate resumed>) = 0 [pid 5204] <... ioctl resumed>) = 0 [pid 5205] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5204] close(3) = 0 [pid 5204] mkdir("./file1", 0777 [pid 5205] <... futex resumed>) = 1 [pid 5203] <... futex resumed>) = 0 [pid 5205] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5203] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5203] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5205] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5205] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5204] <... mkdir resumed>) = 0 [pid 5204] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5205] <... mount resumed>) = 0 [pid 5205] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5203] <... futex resumed>) = 0 [pid 5205] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5203] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5205] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5203] <... futex resumed>) = 0 [pid 5205] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5203] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5205] <... open resumed>) = 3 [pid 5205] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5203] <... futex resumed>) = 0 [pid 5203] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5203] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5205] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190) = 262144 [pid 5205] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5205] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5203] <... futex resumed>) = 0 [pid 5204] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5204] ioctl(5, LOOP_CLR_FD) = 0 [pid 5204] close(5) = 0 [pid 5204] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5204] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5203] exit_group(0) = ? [pid 5204] <... futex resumed>) = ? [pid 5205] <... futex resumed>) = ? [pid 5204] +++ exited with 0 +++ [pid 5205] +++ exited with 0 +++ [pid 5203] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5203, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- umount2("./44", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./44", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./44/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./44/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./44/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./44/bus") = 0 umount2("./44/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./44/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./44/binderfs") = 0 umount2("./44/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./44/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./44/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./44/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./44/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./44") = 0 mkdir("./45", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556e0f690) = 5206 ./strace-static-x86_64: Process 5206 attached [pid 5206] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5206] chdir("./45") = 0 [pid 5206] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5206] setpgid(0, 0) = 0 [pid 5206] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5206] write(3, "1000", 4) = 4 [pid 5206] close(3) = 0 [pid 5206] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5206] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5206] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5206] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5206] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5206] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5206] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5206] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5207 attached [pid 5207] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053) = 0 [pid 5207] set_robust_list(0x7f4380f929a0, 24) = 0 [pid 5207] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5207] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5206] <... clone3 resumed> => {parent_tid=[5207]}, 88) = 5207 [pid 5206] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5206] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5207] <... futex resumed>) = 0 [pid 5206] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5207] memfd_create("syzkaller", 0 [pid 5206] <... futex resumed>) = 0 [pid 5206] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5206] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5207] <... memfd_create resumed>) = 3 [pid 5207] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4378b51000 [ 51.468729][ T5204] loop0: detected capacity change from 0 to 512 [ 51.487983][ T5204] EXT4-fs warning (device loop0): read_mmp_block:114: Error -117 while reading MMP block 8 [pid 5207] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5206] <... mprotect resumed>) = 0 [pid 5207] <... write resumed>) = 262144 [pid 5206] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5207] munmap(0x7f4378b51000, 262144 [pid 5206] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5206] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0}./strace-static-x86_64: Process 5208 attached => {parent_tid=[5208]}, 88) = 5208 [pid 5208] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053) = 0 [pid 5206] rt_sigprocmask(SIG_SETMASK, [], [pid 5208] set_robust_list(0x7f4380f719a0, 24 [pid 5206] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5208] <... set_robust_list resumed>) = 0 [pid 5208] rt_sigprocmask(SIG_SETMASK, [], [pid 5206] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5208] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5208] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5206] <... futex resumed>) = 0 [pid 5207] <... munmap resumed>) = 0 [pid 5206] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5208] <... open resumed>) = 4 [pid 5208] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5207] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5208] <... futex resumed>) = 1 [pid 5206] <... futex resumed>) = 0 [pid 5206] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5207] <... openat resumed>) = 5 [pid 5208] fallocate(4, 0, 35143, 7 [pid 5207] ioctl(5, LOOP_SET_FD, 3 [pid 5206] <... futex resumed>) = 0 [pid 5206] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5208] <... fallocate resumed>) = 0 [pid 5207] <... ioctl resumed>) = 0 [pid 5208] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5207] close(3 [pid 5206] <... futex resumed>) = 0 [pid 5208] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5207] <... close resumed>) = 0 [pid 5206] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5208] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5207] mkdir("./file1", 0777 [pid 5206] <... futex resumed>) = 0 [pid 5208] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5206] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5208] <... mount resumed>) = 0 [pid 5208] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5206] <... futex resumed>) = 0 [pid 5208] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5206] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5208] <... futex resumed>) = 0 [pid 5206] <... futex resumed>) = 1 [pid 5208] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5206] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5208] <... open resumed>) = 3 [pid 5207] <... mkdir resumed>) = 0 [pid 5208] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5207] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5208] <... futex resumed>) = 1 [pid 5206] <... futex resumed>) = 0 [pid 5206] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5206] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5208] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190) = 262144 [pid 5207] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 5207] ioctl(5, LOOP_CLR_FD) = 0 [pid 5207] close(5) = 0 [pid 5207] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5207] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5208] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5206] <... futex resumed>) = 0 [pid 5208] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5206] exit_group(0 [pid 5208] <... futex resumed>) = ? [pid 5207] <... futex resumed>) = ? [pid 5206] <... exit_group resumed>) = ? [pid 5208] +++ exited with 0 +++ [pid 5207] +++ exited with 0 +++ [pid 5206] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5206, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./45", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./45", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./45/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./45/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./45/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./45/bus") = 0 umount2("./45/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./45/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./45/binderfs") = 0 umount2("./45/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./45/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./45/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./45/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./45/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./45") = 0 mkdir("./46", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5209 attached [pid 5209] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5209] chdir("./46") = 0 [pid 5209] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5209] setpgid(0, 0) = 0 [pid 5209] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5033] <... clone resumed>, child_tidptr=0x555556e0f690) = 5209 [pid 5209] <... openat resumed>) = 3 [pid 5209] write(3, "1000", 4) = 4 [pid 5209] close(3) = 0 [pid 5209] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5209] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5209] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5209] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5209] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5209] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5209] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5209] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5210 attached => {parent_tid=[5210]}, 88) = 5210 [pid 5210] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5209] rt_sigprocmask(SIG_SETMASK, [], [pid 5210] <... rseq resumed>) = 0 [pid 5209] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5209] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5210] set_robust_list(0x7f4380f929a0, 24 [pid 5209] <... futex resumed>) = 0 [pid 5210] <... set_robust_list resumed>) = 0 [pid 5209] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5210] rt_sigprocmask(SIG_SETMASK, [], [pid 5209] <... futex resumed>) = 0 [pid 5210] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5210] memfd_create("syzkaller", 0 [ 51.554670][ T5207] loop0: detected capacity change from 0 to 512 [ 51.576934][ T5207] EXT4-fs (loop0): VFS: Can't find ext4 filesystem [pid 5209] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5210] <... memfd_create resumed>) = 3 [pid 5209] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5210] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5209] <... mprotect resumed>) = 0 [pid 5210] <... mmap resumed>) = 0x7f4378b51000 [pid 5209] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5210] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5209] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5209] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} => {parent_tid=[5211]}, 88) = 5211 [pid 5209] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ./strace-static-x86_64: Process 5211 attached [pid 5209] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5211] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053) = 0 [pid 5211] set_robust_list(0x7f4380f719a0, 24 [pid 5209] <... futex resumed>) = 0 [pid 5211] <... set_robust_list resumed>) = 0 [pid 5209] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5211] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5211] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5210] <... write resumed>) = 262144 [pid 5210] munmap(0x7f4378b51000, 262144) = 0 [pid 5210] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5211] <... open resumed>) = 4 [pid 5210] <... openat resumed>) = 5 [pid 5211] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5209] <... futex resumed>) = 0 [pid 5209] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5209] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5210] ioctl(5, LOOP_SET_FD, 3 [pid 5211] fallocate(4, 0, 35143, 7 [pid 5210] <... ioctl resumed>) = 0 [pid 5210] close(3) = 0 [pid 5210] mkdir("./file1", 0777 [pid 5211] <... fallocate resumed>) = 0 [pid 5210] <... mkdir resumed>) = 0 [pid 5210] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5211] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5209] <... futex resumed>) = 0 [pid 5211] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5209] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5211] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5209] <... futex resumed>) = 0 [pid 5209] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5211] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL) = 0 [pid 5211] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5211] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5209] <... futex resumed>) = 0 [pid 5209] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5211] <... futex resumed>) = 0 [pid 5209] <... futex resumed>) = 1 [pid 5209] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5211] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 3 [pid 5211] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5209] <... futex resumed>) = 0 [pid 5211] <... futex resumed>) = 1 [pid 5209] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5211] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5209] <... futex resumed>) = 0 [pid 5209] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5211] <... write resumed>) = 262144 [pid 5211] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5209] <... futex resumed>) = 0 [pid 5211] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5210] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5210] ioctl(5, LOOP_CLR_FD) = 0 [pid 5210] close(5) = 0 [pid 5210] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5209] exit_group(0 [pid 5211] <... futex resumed>) = ? [pid 5209] <... exit_group resumed>) = ? [pid 5211] +++ exited with 0 +++ [pid 5210] +++ exited with 0 +++ [pid 5209] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5209, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./46", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./46", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./46/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./46/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./46/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./46/bus") = 0 umount2("./46/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./46/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./46/binderfs") = 0 umount2("./46/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./46/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./46/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./46/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./46/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./46") = 0 mkdir("./47", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556e0f690) = 5212 ./strace-static-x86_64: Process 5212 attached [pid 5212] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5212] chdir("./47") = 0 [pid 5212] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5212] setpgid(0, 0) = 0 [pid 5212] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5212] write(3, "1000", 4) = 4 [pid 5212] close(3) = 0 [pid 5212] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5212] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5212] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5212] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5212] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5212] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5212] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5212] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5213 attached [pid 5213] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5212] <... clone3 resumed> => {parent_tid=[5213]}, 88) = 5213 [pid 5213] <... rseq resumed>) = 0 [pid 5212] rt_sigprocmask(SIG_SETMASK, [], [pid 5213] set_robust_list(0x7f4380f929a0, 24 [pid 5212] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5213] <... set_robust_list resumed>) = 0 [pid 5212] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5213] rt_sigprocmask(SIG_SETMASK, [], [pid 5212] <... futex resumed>) = 0 [pid 5213] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5212] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5213] memfd_create("syzkaller", 0 [pid 5212] <... futex resumed>) = 0 [pid 5213] <... memfd_create resumed>) = 3 [pid 5212] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5213] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5212] <... mmap resumed>) = 0x7f4380f51000 [pid 5213] <... mmap resumed>) = 0x7f4378b51000 [pid 5212] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5213] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5212] <... mprotect resumed>) = 0 [pid 5212] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5212] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} => {parent_tid=[5214]}, 88) = 5214 [pid 5212] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5212] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 51.647578][ T5210] loop0: detected capacity change from 0 to 512 [ 51.677039][ T5210] EXT4-fs warning (device loop0): read_mmp_block:114: Error -117 while reading MMP block 8 [pid 5212] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5214 attached [pid 5213] <... write resumed>) = 262144 [pid 5213] munmap(0x7f4378b51000, 262144) = 0 [pid 5213] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5213] ioctl(4, LOOP_SET_FD, 3 [pid 5214] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5213] <... ioctl resumed>) = 0 [pid 5214] <... rseq resumed>) = 0 [pid 5213] close(3 [pid 5214] set_robust_list(0x7f4380f719a0, 24 [pid 5213] <... close resumed>) = 0 [pid 5214] <... set_robust_list resumed>) = 0 [pid 5213] mkdir("./file1", 0777 [pid 5214] rt_sigprocmask(SIG_SETMASK, [], [pid 5213] <... mkdir resumed>) = 0 [pid 5214] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5213] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5214] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 3 [pid 5214] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5212] <... futex resumed>) = 0 [pid 5212] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5212] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5214] fallocate(3, 0, 35143, 7) = 0 [pid 5214] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5212] <... futex resumed>) = 0 [pid 5214] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5212] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5214] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5212] <... futex resumed>) = 0 [pid 5214] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5212] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5214] <... mount resumed>) = 0 [pid 5214] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5212] <... futex resumed>) = 0 [pid 5214] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL) = -1 EAGAIN (Resource temporarily unavailable) [pid 5212] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5214] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5212] <... futex resumed>) = 0 [pid 5212] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5214] <... open resumed>) = 5 [pid 5214] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5212] <... futex resumed>) = 0 [pid 5214] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL) = -1 EAGAIN (Resource temporarily unavailable) [pid 5212] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5214] write(5, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5212] <... futex resumed>) = 0 [pid 5212] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5214] <... write resumed>) = 262144 [pid 5214] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5214] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5212] <... futex resumed>) = 0 [pid 5213] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5213] ioctl(4, LOOP_CLR_FD) = 0 [pid 5213] close(4) = 0 [pid 5213] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5213] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5212] exit_group(0) = ? [pid 5213] <... futex resumed>) = ? [pid 5213] +++ exited with 0 +++ [pid 5214] <... futex resumed>) = ? [pid 5214] +++ exited with 0 +++ [pid 5212] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5212, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./47", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./47", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./47/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./47/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./47/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./47/bus") = 0 umount2("./47/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./47/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./47/binderfs") = 0 umount2("./47/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./47/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./47/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./47/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./47/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./47") = 0 mkdir("./48", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556e0f690) = 5215 ./strace-static-x86_64: Process 5215 attached [pid 5215] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5215] chdir("./48") = 0 [pid 5215] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5215] setpgid(0, 0) = 0 [pid 5215] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5215] write(3, "1000", 4) = 4 [pid 5215] close(3) = 0 [pid 5215] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5215] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5215] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5215] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5215] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5215] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5215] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [ 51.730912][ T5213] loop0: detected capacity change from 0 to 512 [ 51.757176][ T5213] EXT4-fs warning (device loop0): read_mmp_block:114: Error -117 while reading MMP block 8 [pid 5215] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5216 attached => {parent_tid=[5216]}, 88) = 5216 [pid 5215] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5216] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5215] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5216] <... rseq resumed>) = 0 [pid 5216] set_robust_list(0x7f4380f929a0, 24 [pid 5215] <... futex resumed>) = 0 [pid 5216] <... set_robust_list resumed>) = 0 [pid 5215] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5216] rt_sigprocmask(SIG_SETMASK, [], [pid 5215] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5216] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5216] memfd_create("syzkaller", 0 [pid 5215] <... mmap resumed>) = 0x7f4380f51000 [pid 5215] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5216] <... memfd_create resumed>) = 3 [pid 5215] <... mprotect resumed>) = 0 [pid 5216] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4378b51000 [pid 5216] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5215] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5215] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0}./strace-static-x86_64: Process 5217 attached [pid 5216] <... write resumed>) = 262144 [pid 5217] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053) = 0 [pid 5216] munmap(0x7f4378b51000, 262144 [pid 5215] <... clone3 resumed> => {parent_tid=[5217]}, 88) = 5217 [pid 5217] set_robust_list(0x7f4380f719a0, 24 [pid 5215] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5217] <... set_robust_list resumed>) = 0 [pid 5215] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5217] rt_sigprocmask(SIG_SETMASK, [], [pid 5215] <... futex resumed>) = 0 [pid 5217] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5217] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5216] <... munmap resumed>) = 0 [pid 5215] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5217] <... open resumed>) = 4 [pid 5216] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5216] ioctl(5, LOOP_SET_FD, 3 [pid 5217] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5215] <... futex resumed>) = 0 [pid 5215] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5217] fallocate(4, 0, 35143, 7 [pid 5215] <... futex resumed>) = 0 [pid 5215] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5216] <... ioctl resumed>) = 0 [pid 5216] close(3) = 0 [pid 5216] mkdir("./file1", 0777) = 0 [pid 5216] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5217] <... fallocate resumed>) = 0 [pid 5217] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5215] <... futex resumed>) = 0 [pid 5217] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5215] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5217] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5215] <... futex resumed>) = 0 [pid 5217] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5215] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5217] <... mount resumed>) = 0 [pid 5217] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5215] <... futex resumed>) = 0 [pid 5217] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5215] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5217] <... open resumed>) = 3 [pid 5215] <... futex resumed>) = 0 [pid 5217] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5215] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5217] <... futex resumed>) = 0 [pid 5215] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5217] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5215] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 51.828209][ T28] kauditd_printk_skb: 39 callbacks suppressed [ 51.828223][ T28] audit: type=1800 audit(1694162019.969:50): pid=5217 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor369" name="bus" dev="sda1" ino=1930 res=0 errno=0 [ 51.828718][ T5216] loop0: detected capacity change from 0 to 512 [pid 5215] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5217] <... write resumed>) = 262144 [pid 5217] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5215] <... futex resumed>) = 0 [pid 5217] <... futex resumed>) = 1 [pid 5217] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5216] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5216] ioctl(5, LOOP_CLR_FD) = 0 [pid 5216] close(5) = 0 [pid 5216] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5216] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5215] exit_group(0 [pid 5217] <... futex resumed>) = ? [pid 5216] <... futex resumed>) = ? [pid 5215] <... exit_group resumed>) = ? [pid 5216] +++ exited with 0 +++ [pid 5217] +++ exited with 0 +++ [pid 5215] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5215, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./48", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./48", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./48/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./48/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./48/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./48/bus") = 0 umount2("./48/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./48/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./48/binderfs") = 0 umount2("./48/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./48/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./48/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./48/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./48/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./48") = 0 mkdir("./49", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556e0f690) = 5218 ./strace-static-x86_64: Process 5218 attached [pid 5218] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5218] chdir("./49") = 0 [pid 5218] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5218] setpgid(0, 0) = 0 [pid 5218] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5218] write(3, "1000", 4) = 4 [pid 5218] close(3) = 0 [pid 5218] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5218] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5218] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5218] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5218] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5218] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5218] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5218] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5219 attached => {parent_tid=[5219]}, 88) = 5219 [pid 5218] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5218] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5218] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5218] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5219] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5218] <... mmap resumed>) = 0x7f4380f51000 [pid 5219] <... rseq resumed>) = 0 [pid 5219] set_robust_list(0x7f4380f929a0, 24) = 0 [pid 5219] rt_sigprocmask(SIG_SETMASK, [], [ 51.869066][ T5216] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 51.879296][ T5216] EXT4-fs (loop0): group descriptors corrupted! [pid 5218] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5219] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5218] <... mprotect resumed>) = 0 [pid 5218] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5218] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0}./strace-static-x86_64: Process 5220 attached => {parent_tid=[5220]}, 88) = 5220 [pid 5220] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5219] memfd_create("syzkaller", 0 [pid 5218] rt_sigprocmask(SIG_SETMASK, [], [pid 5220] <... rseq resumed>) = 0 [pid 5218] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5220] set_robust_list(0x7f4380f719a0, 24 [pid 5218] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5220] <... set_robust_list resumed>) = 0 [pid 5218] <... futex resumed>) = 0 [pid 5220] rt_sigprocmask(SIG_SETMASK, [], [pid 5219] <... memfd_create resumed>) = 3 [pid 5218] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5220] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5219] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5220] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5219] <... mmap resumed>) = 0x7f4378b51000 [pid 5220] <... open resumed>) = 4 [pid 5220] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5218] <... futex resumed>) = 0 [pid 5218] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5220] <... futex resumed>) = 1 [pid 5218] <... futex resumed>) = 0 [pid 5220] fallocate(4, 0, 35143, 7 [pid 5218] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5219] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 5219] munmap(0x7f4378b51000, 262144) = 0 [pid 5219] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5219] ioctl(5, LOOP_SET_FD, 3 [pid 5220] <... fallocate resumed>) = 0 [pid 5220] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5220] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5218] <... futex resumed>) = 0 [pid 5219] <... ioctl resumed>) = 0 [pid 5218] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5220] <... futex resumed>) = 0 [pid 5219] close(3 [pid 5218] <... futex resumed>) = 1 [pid 5220] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL) = 0 [pid 5219] <... close resumed>) = 0 [pid 5218] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5220] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5218] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5220] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5219] mkdir("./file1", 0777 [pid 5218] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5220] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5220] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5218] <... futex resumed>) = 0 [pid 5220] <... open resumed>) = 3 [pid 5220] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5218] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5220] <... futex resumed>) = 0 [pid 5220] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5218] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5218] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5220] <... futex resumed>) = 0 [pid 5218] <... futex resumed>) = 1 [pid 5220] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5218] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5219] <... mkdir resumed>) = 0 [pid 5219] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5220] <... write resumed>) = 262144 [pid 5220] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5220] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5218] <... futex resumed>) = 0 [pid 5219] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 5219] ioctl(5, LOOP_CLR_FD) = 0 [pid 5219] close(5) = 0 [pid 5219] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5219] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5218] exit_group(0 [pid 5220] <... futex resumed>) = ? [pid 5218] <... exit_group resumed>) = ? [pid 5220] +++ exited with 0 +++ [pid 5219] <... futex resumed>) = ? [pid 5219] +++ exited with 0 +++ [pid 5218] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5218, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- umount2("./49", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./49", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./49/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./49/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./49/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./49/bus") = 0 umount2("./49/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./49/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./49/binderfs") = 0 umount2("./49/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./49/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./49/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./49/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./49/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./49") = 0 mkdir("./50", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5221 attached , child_tidptr=0x555556e0f690) = 5221 [pid 5221] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5221] chdir("./50") = 0 [pid 5221] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5221] setpgid(0, 0) = 0 [pid 5221] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5221] write(3, "1000", 4) = 4 [pid 5221] close(3) = 0 [ 51.941468][ T28] audit: type=1800 audit(1694162020.079:51): pid=5220 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor369" name="bus" dev="sda1" ino=1930 res=0 errno=0 [ 51.947619][ T5219] loop0: detected capacity change from 0 to 512 [ 51.978267][ T5219] EXT4-fs (loop0): VFS: Can't find ext4 filesystem [pid 5221] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5221] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5221] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5221] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5221] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5221] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5221] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5221] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0} => {parent_tid=[5222]}, 88) = 5222 [pid 5221] rt_sigprocmask(SIG_SETMASK, [], ./strace-static-x86_64: Process 5222 attached NULL, 8) = 0 [pid 5222] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053) = 0 [pid 5221] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5222] set_robust_list(0x7f4380f929a0, 24) = 0 [pid 5221] <... futex resumed>) = 0 [pid 5222] rt_sigprocmask(SIG_SETMASK, [], [pid 5221] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5222] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5221] <... futex resumed>) = 0 [pid 5222] memfd_create("syzkaller", 0 [pid 5221] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5221] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5222] <... memfd_create resumed>) = 3 [pid 5222] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4378b51000 [pid 5221] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5221] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} => {parent_tid=[5223]}, 88) = 5223 [pid 5221] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5222] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5221] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5221] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5223 attached [pid 5223] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053) = 0 [pid 5223] set_robust_list(0x7f4380f719a0, 24) = 0 [pid 5223] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5223] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5222] <... write resumed>) = 262144 [pid 5222] munmap(0x7f4378b51000, 262144 [pid 5223] <... open resumed>) = 4 [pid 5223] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5222] <... munmap resumed>) = 0 [pid 5221] <... futex resumed>) = 0 [pid 5221] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5223] <... futex resumed>) = 1 [pid 5223] fallocate(4, 0, 35143, 7 [pid 5221] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5222] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5222] ioctl(5, LOOP_SET_FD, 3 [pid 5223] <... fallocate resumed>) = 0 [pid 5223] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5223] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5221] <... futex resumed>) = 0 [pid 5221] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5223] <... futex resumed>) = 0 [pid 5223] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL) = 0 [pid 5223] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5223] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5221] <... futex resumed>) = 1 [pid 5221] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 5221] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5223] <... futex resumed>) = 0 [pid 5223] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 6 [pid 5223] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5223] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5221] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 5221] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5223] <... futex resumed>) = 0 [pid 5223] write(6, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5222] <... ioctl resumed>) = 0 [pid 5221] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5222] close(3) = 0 [ 52.041036][ T28] audit: type=1800 audit(1694162020.179:52): pid=5223 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor369" name="bus" dev="sda1" ino=1930 res=0 errno=0 [ 52.048801][ T5222] loop0: detected capacity change from 0 to 512 [ 52.073349][ T5223] I/O error, dev loop0, sector 248 op 0x1:(WRITE) flags 0x800 phys_seg 1 prio class 2 [pid 5222] mkdir("./file1", 0777) = 0 [pid 5222] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5223] <... write resumed>) = -1 EIO (Input/output error) [pid 5223] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5221] <... futex resumed>) = 0 [pid 5223] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5222] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 5222] ioctl(5, LOOP_CLR_FD) = 0 [pid 5222] close(5) = 0 [pid 5222] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5222] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5221] exit_group(0 [pid 5223] <... futex resumed>) = ? [pid 5222] <... futex resumed>) = ? [pid 5221] <... exit_group resumed>) = ? [pid 5223] +++ exited with 0 +++ [pid 5222] +++ exited with 0 +++ [pid 5221] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5221, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./50", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./50", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./50/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./50/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./50/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./50/bus") = 0 umount2("./50/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./50/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./50/binderfs") = 0 umount2("./50/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./50/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./50/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./50/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./50/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./50") = 0 mkdir("./51", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556e0f690) = 5224 ./strace-static-x86_64: Process 5224 attached [pid 5224] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5224] chdir("./51") = 0 [pid 5224] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5224] setpgid(0, 0) = 0 [pid 5224] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5224] write(3, "1000", 4) = 4 [pid 5224] close(3) = 0 [pid 5224] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5224] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5224] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5224] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5224] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5224] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5224] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5224] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0} => {parent_tid=[5225]}, 88) = 5225 [pid 5224] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5224] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5225 attached ) = 0 [pid 5225] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5224] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5225] <... rseq resumed>) = 0 [pid 5225] set_robust_list(0x7f4380f929a0, 24) = 0 [pid 5224] <... futex resumed>) = 0 [pid 5225] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5224] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5225] memfd_create("syzkaller", 0 [pid 5224] <... mmap resumed>) = 0x7f4380f51000 [pid 5225] <... memfd_create resumed>) = 3 [ 52.083073][ T5223] Buffer I/O error on dev loop0, logical block 31, lost async page write [ 52.096644][ T5222] EXT4-fs (loop0): VFS: Can't find ext4 filesystem [pid 5224] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5225] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5224] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5224] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0}./strace-static-x86_64: Process 5226 attached [pid 5226] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5224] <... clone3 resumed> => {parent_tid=[5226]}, 88) = 5226 [pid 5225] <... mmap resumed>) = 0x7f4378b51000 [pid 5226] <... rseq resumed>) = 0 [pid 5224] rt_sigprocmask(SIG_SETMASK, [], [pid 5226] set_robust_list(0x7f4380f719a0, 24 [pid 5224] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5226] <... set_robust_list resumed>) = 0 [pid 5224] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5226] rt_sigprocmask(SIG_SETMASK, [], [pid 5224] <... futex resumed>) = 0 [pid 5226] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5224] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5226] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 5226] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5224] <... futex resumed>) = 0 [pid 5226] <... futex resumed>) = 1 [pid 5224] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5226] fallocate(4, 0, 35143, 7 [pid 5224] <... futex resumed>) = 0 [pid 5225] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5224] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5225] <... write resumed>) = 262144 [pid 5225] munmap(0x7f4378b51000, 262144) = 0 [pid 5225] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5225] ioctl(5, LOOP_SET_FD, 3 [pid 5226] <... fallocate resumed>) = 0 [pid 5226] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5224] <... futex resumed>) = 0 [pid 5226] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5224] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5226] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5224] <... futex resumed>) = 0 [pid 5226] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5224] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5226] <... mount resumed>) = 0 [pid 5226] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5224] <... futex resumed>) = 0 [pid 5226] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5224] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5226] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5224] <... futex resumed>) = 0 [pid 5226] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5224] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5226] <... open resumed>) = 6 [pid 5226] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5224] <... futex resumed>) = 0 [pid 5226] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5224] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5226] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5224] <... futex resumed>) = 0 [pid 5226] write(6, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5224] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5225] <... ioctl resumed>) = 0 [pid 5225] close(3) = 0 [pid 5225] mkdir("./file1", 0777) = 0 [ 52.155557][ T28] audit: type=1800 audit(1694162020.289:53): pid=5226 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor369" name="bus" dev="sda1" ino=1930 res=0 errno=0 [ 52.169486][ T5225] loop0: detected capacity change from 0 to 512 [ 52.182770][ T5226] I/O error, dev loop0, sector 248 op 0x1:(WRITE) flags 0x800 phys_seg 1 prio class 2 [ 52.182794][ T5226] Buffer I/O error on dev loop0, logical block 31, lost async page write [pid 5225] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5226] <... write resumed>) = -1 EIO (Input/output error) [pid 5226] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5226] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5224] <... futex resumed>) = 0 [pid 5225] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 5225] ioctl(5, LOOP_CLR_FD) = 0 [pid 5225] close(5) = 0 [pid 5225] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5225] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5224] exit_group(0) = ? [pid 5226] <... futex resumed>) = ? [pid 5225] <... futex resumed>) = ? [pid 5226] +++ exited with 0 +++ [pid 5225] +++ exited with 0 +++ [pid 5224] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5224, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- umount2("./51", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./51", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./51/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./51/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./51/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./51/bus") = 0 umount2("./51/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./51/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./51/binderfs") = 0 umount2("./51/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./51/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./51/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./51/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./51/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./51") = 0 mkdir("./52", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5227 attached , child_tidptr=0x555556e0f690) = 5227 [pid 5227] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5227] chdir("./52") = 0 [pid 5227] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [ 52.182814][ T5226] I/O error, dev loop0, sector 240 op 0x1:(WRITE) flags 0x800 phys_seg 1 prio class 2 [ 52.182834][ T5226] Buffer I/O error on dev loop0, logical block 30, lost async page write [ 52.182851][ T5226] I/O error, dev loop0, sector 232 op 0x1:(WRITE) flags 0x800 phys_seg 1 prio class 2 [ 52.228855][ T5226] Buffer I/O error on dev loop0, logical block 29, lost async page write [ 52.239335][ T5225] EXT4-fs (loop0): VFS: Can't find ext4 filesystem [pid 5227] setpgid(0, 0) = 0 [pid 5227] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5227] write(3, "1000", 4) = 4 [pid 5227] close(3) = 0 [pid 5227] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5227] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5227] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5227] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5227] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5227] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5227] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5227] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5228 attached [pid 5228] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053) = 0 [pid 5228] set_robust_list(0x7f4380f929a0, 24 [pid 5227] <... clone3 resumed> => {parent_tid=[5228]}, 88) = 5228 [pid 5228] <... set_robust_list resumed>) = 0 [pid 5227] rt_sigprocmask(SIG_SETMASK, [], [pid 5228] rt_sigprocmask(SIG_SETMASK, [], [pid 5227] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5228] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5227] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5228] memfd_create("syzkaller", 0 [pid 5227] <... futex resumed>) = 0 [pid 5228] <... memfd_create resumed>) = 3 [pid 5227] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5228] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5227] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5228] <... mmap resumed>) = 0x7f4378b72000 [pid 5227] <... mmap resumed>) = 0x7f4378b51000 [pid 5228] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5227] mprotect(0x7f4378b52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5227] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5227] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4378b71990, parent_tid=0x7f4378b71990, exit_signal=0, stack=0x7f4378b51000, stack_size=0x20300, tls=0x7f4378b716c0} [pid 5228] <... write resumed>) = 262144 [pid 5228] munmap(0x7f4378b72000, 262144) = 0 [pid 5228] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5228] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 5229 attached [pid 5227] <... clone3 resumed> => {parent_tid=[5229]}, 88) = 5229 [pid 5227] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5227] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5229] rseq(0x7f4378b71fe0, 0x20, 0, 0x53053053 [pid 5227] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5229] <... rseq resumed>) = 0 [pid 5228] <... ioctl resumed>) = 0 [pid 5228] close(3 [pid 5229] set_robust_list(0x7f4378b719a0, 24) = 0 [pid 5228] <... close resumed>) = 0 [pid 5229] rt_sigprocmask(SIG_SETMASK, [], [pid 5228] mkdir("./file1", 0777 [pid 5229] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5229] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5228] <... mkdir resumed>) = 0 [pid 5228] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5229] <... open resumed>) = 3 [pid 5229] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5229] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5227] <... futex resumed>) = 0 [pid 5227] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5229] <... futex resumed>) = 0 [pid 5227] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [ 52.306375][ T5228] loop0: detected capacity change from 0 to 512 [ 52.317470][ T28] audit: type=1800 audit(1694162020.449:54): pid=5229 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor369" name="bus" dev="sda1" ino=1931 res=0 errno=0 [ 52.349889][ T5228] EXT4-fs (loop0): 1 orphan inode deleted [pid 5229] fallocate(3, 0, 35143, 7) = 0 [pid 5229] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5227] <... futex resumed>) = 0 [pid 5227] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5227] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5229] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL) = 0 [pid 5229] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5227] <... futex resumed>) = 0 [pid 5227] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5227] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5229] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 5 [pid 5229] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5227] <... futex resumed>) = 0 [pid 5227] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5227] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5229] write(5, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5228] <... mount resumed>) = 0 [pid 5228] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 6 [pid 5228] chdir("./file1") = 0 [pid 5228] ioctl(4, LOOP_CLR_FD [pid 5229] <... write resumed>) = 262144 [pid 5228] <... ioctl resumed>) = 0 [pid 5229] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5227] <... futex resumed>) = 0 [pid 5229] <... futex resumed>) = 1 [pid 5229] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5228] close(4) = 0 [pid 5228] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5227] exit_group(0) = ? [pid 5229] <... futex resumed>) = ? [pid 5229] +++ exited with 0 +++ [pid 5228] +++ exited with 0 +++ [pid 5227] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5227, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./52", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./52", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./52/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./52/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./52/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./52/bus") = 0 umount2("./52/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./52/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./52/binderfs") = 0 [ 52.355633][ T5228] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 52.368291][ T5228] ext4 filesystem being mounted at /root/syzkaller.F1Lso8/52/file1 supports timestamps until 2038-01-19 (0x7fffffff) umount2("./52/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./52/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./52/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./52/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./52/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./52/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./52") = 0 mkdir("./53", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556e0f690) = 5232 ./strace-static-x86_64: Process 5232 attached [pid 5232] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5232] chdir("./53") = 0 [pid 5232] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5232] setpgid(0, 0) = 0 [pid 5232] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5232] write(3, "1000", 4) = 4 [pid 5232] close(3) = 0 [pid 5232] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5232] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5232] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5232] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5232] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5232] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5232] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5232] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5233 attached => {parent_tid=[5233]}, 88) = 5233 [pid 5233] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053) = 0 [pid 5232] rt_sigprocmask(SIG_SETMASK, [], [pid 5233] set_robust_list(0x7f4380f929a0, 24 [pid 5232] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5233] <... set_robust_list resumed>) = 0 [pid 5232] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5232] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5233] rt_sigprocmask(SIG_SETMASK, [], [pid 5232] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5233] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5233] memfd_create("syzkaller", 0 [pid 5232] <... mmap resumed>) = 0x7f4380f51000 [ 52.412970][ T5033] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 52.437912][ T5033] EXT4-fs error (device loop0) in ext4_reserve_inode_write:5752: Corrupt filesystem [ 52.447842][ T5033] EXT4-fs error (device loop0): ext4_quota_off:7131: inode #3: comm syz-executor369: mark_inode_dirty error [pid 5233] <... memfd_create resumed>) = 3 [pid 5232] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5233] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5232] <... mprotect resumed>) = 0 [pid 5233] <... mmap resumed>) = 0x7f4378b51000 [pid 5232] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5233] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5232] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} => {parent_tid=[5234]}, 88) = 5234 [pid 5232] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ./strace-static-x86_64: Process 5234 attached [pid 5232] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5234] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053) = 0 [pid 5234] set_robust_list(0x7f4380f719a0, 24) = 0 [pid 5234] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5234] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5232] <... futex resumed>) = 0 [pid 5232] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5234] <... open resumed>) = 4 [pid 5234] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5233] <... write resumed>) = 262144 [pid 5232] <... futex resumed>) = 0 [pid 5232] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5234] <... futex resumed>) = 1 [pid 5232] <... futex resumed>) = 0 [pid 5234] fallocate(4, 0, 35143, 7 [pid 5233] munmap(0x7f4378b51000, 262144 [pid 5232] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5233] <... munmap resumed>) = 0 [pid 5233] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5233] ioctl(5, LOOP_SET_FD, 3 [pid 5234] <... fallocate resumed>) = 0 [pid 5234] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5233] <... ioctl resumed>) = 0 [pid 5234] <... futex resumed>) = 1 [pid 5232] <... futex resumed>) = 0 [pid 5234] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5232] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5234] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5233] close(3 [pid 5232] <... futex resumed>) = 0 [pid 5234] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5232] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5233] <... close resumed>) = 0 [pid 5233] mkdir("./file1", 0777 [pid 5234] <... mount resumed>) = 0 [pid 5233] <... mkdir resumed>) = 0 [pid 5233] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5234] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5232] <... futex resumed>) = 0 [pid 5234] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5232] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5234] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5232] <... futex resumed>) = 0 [pid 5234] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5232] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5234] <... open resumed>) = 3 [pid 5234] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5234] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5232] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5232] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5234] <... futex resumed>) = 0 [pid 5232] <... futex resumed>) = 1 [pid 5234] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5232] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5234] <... write resumed>) = 262144 [pid 5234] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5234] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5232] <... futex resumed>) = 0 [ 52.500178][ T28] audit: type=1800 audit(1694162020.639:55): pid=5234 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor369" name="bus" dev="sda1" ino=1930 res=0 errno=0 [ 52.523427][ T5233] loop0: detected capacity change from 0 to 512 [pid 5233] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5233] ioctl(5, LOOP_CLR_FD) = 0 [pid 5233] close(5) = 0 [pid 5233] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5233] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5232] exit_group(0 [pid 5234] <... futex resumed>) = ? [pid 5234] +++ exited with 0 +++ [pid 5233] <... futex resumed>) = ? [pid 5233] +++ exited with 0 +++ [pid 5232] <... exit_group resumed>) = ? [pid 5232] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5232, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./53", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./53", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./53/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./53/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./53/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./53/bus") = 0 umount2("./53/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./53/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./53/binderfs") = 0 umount2("./53/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./53/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./53/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./53/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./53/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./53") = 0 mkdir("./54", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [ 52.537955][ T5233] EXT4-fs error (device loop0): __ext4_fill_super:5473: comm syz-executor369: inode #2: comm syz-executor369: iget: illegal inode # [ 52.544659][ T5235] EXT4-fs warning (device loop0): kmmpd:167: kmmpd being stopped since MMP feature has been disabled. [ 52.551740][ T5233] EXT4-fs (loop0): get root inode failed [ 52.568262][ T5233] EXT4-fs (loop0): mount failed close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556e0f690) = 5237 ./strace-static-x86_64: Process 5237 attached [pid 5237] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5237] chdir("./54") = 0 [pid 5237] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5237] setpgid(0, 0) = 0 [pid 5237] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5237] write(3, "1000", 4) = 4 [pid 5237] close(3) = 0 [pid 5237] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5237] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5237] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5237] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5237] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5237] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5237] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5237] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0} => {parent_tid=[5238]}, 88) = 5238 [pid 5237] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5237] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5237] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5237] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5237] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5237] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5237] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0}./strace-static-x86_64: Process 5238 attached ./strace-static-x86_64: Process 5239 attached [pid 5238] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5237] <... clone3 resumed> => {parent_tid=[5239]}, 88) = 5239 [pid 5239] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5238] <... rseq resumed>) = 0 [pid 5237] rt_sigprocmask(SIG_SETMASK, [], [pid 5239] <... rseq resumed>) = 0 [pid 5238] set_robust_list(0x7f4380f929a0, 24 [pid 5237] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5238] <... set_robust_list resumed>) = 0 [pid 5239] set_robust_list(0x7f4380f719a0, 24 [pid 5237] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5238] rt_sigprocmask(SIG_SETMASK, [], [pid 5239] <... set_robust_list resumed>) = 0 [pid 5237] <... futex resumed>) = 0 [pid 5238] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5239] rt_sigprocmask(SIG_SETMASK, [], [pid 5237] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5239] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5238] memfd_create("syzkaller", 0 [pid 5239] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 5238] <... memfd_create resumed>) = 3 [pid 5239] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5238] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5239] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5238] <... mmap resumed>) = 0x7f4378b51000 [pid 5238] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 5238] munmap(0x7f4378b51000, 262144) = 0 [pid 5238] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5238] ioctl(5, LOOP_SET_FD, 3 [pid 5237] <... futex resumed>) = 0 [pid 5237] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5239] <... futex resumed>) = 0 [pid 5237] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5239] fallocate(4, 0, 35143, 7 [pid 5238] <... ioctl resumed>) = 0 [pid 5238] close(3) = 0 [pid 5238] mkdir("./file1", 0777) = 0 [pid 5238] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5239] <... fallocate resumed>) = 0 [pid 5239] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5237] <... futex resumed>) = 0 [pid 5239] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5237] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5239] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5237] <... futex resumed>) = 0 [pid 5239] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5237] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5239] <... mount resumed>) = 0 [pid 5239] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5239] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5237] <... futex resumed>) = 0 [pid 5237] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5239] <... futex resumed>) = 0 [pid 5237] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5239] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 3 [pid 5239] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5237] <... futex resumed>) = 0 [pid 5239] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5237] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5237] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5239] <... write resumed>) = 262144 [pid 5239] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5239] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5237] <... futex resumed>) = 0 [pid 5238] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5238] ioctl(5, LOOP_CLR_FD) = 0 [pid 5238] close(5) = 0 [pid 5238] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5238] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5237] exit_group(0 [pid 5239] <... futex resumed>) = ? [pid 5238] <... futex resumed>) = ? [pid 5237] <... exit_group resumed>) = ? [ 52.631782][ T28] audit: type=1800 audit(1694162020.769:56): pid=5239 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor369" name="bus" dev="sda1" ino=1930 res=0 errno=0 [ 52.640683][ T5238] loop0: detected capacity change from 0 to 512 [ 52.669782][ T5238] EXT4-fs (loop0): failed to initialize system zone (-117) [ 52.677178][ T5238] EXT4-fs (loop0): mount failed [pid 5239] +++ exited with 0 +++ [pid 5238] +++ exited with 0 +++ [pid 5237] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5237, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./54", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./54", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./54/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./54/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./54/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./54/bus") = 0 umount2("./54/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./54/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./54/binderfs") = 0 umount2("./54/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./54/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./54/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./54/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./54/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./54") = 0 mkdir("./55", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5242 attached , child_tidptr=0x555556e0f690) = 5242 [pid 5242] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5242] chdir("./55") = 0 [pid 5242] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5242] setpgid(0, 0) = 0 [pid 5242] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5242] write(3, "1000", 4) = 4 [pid 5242] close(3) = 0 [pid 5242] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5242] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5242] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5242] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5242] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5242] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5242] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5242] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5243 attached [pid 5243] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053) = 0 [pid 5243] set_robust_list(0x7f4380f929a0, 24) = 0 [pid 5243] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5243] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5242] <... clone3 resumed> => {parent_tid=[5243]}, 88) = 5243 [pid 5242] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5242] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5243] <... futex resumed>) = 0 [pid 5242] <... futex resumed>) = 1 [pid 5243] memfd_create("syzkaller", 0) = 3 [pid 5242] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5243] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5242] <... futex resumed>) = 0 [pid 5243] <... mmap resumed>) = 0x7f4378b72000 [pid 5242] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4378b51000 [pid 5242] mprotect(0x7f4378b52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5242] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5243] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5242] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4378b71990, parent_tid=0x7f4378b71990, exit_signal=0, stack=0x7f4378b51000, stack_size=0x20300, tls=0x7f4378b716c0} => {parent_tid=[5244]}, 88) = 5244 [pid 5242] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5242] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5242] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5244 attached [pid 5244] rseq(0x7f4378b71fe0, 0x20, 0, 0x53053053) = 0 [pid 5244] set_robust_list(0x7f4378b719a0, 24) = 0 [pid 5244] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5244] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5243] <... write resumed>) = 262144 [pid 5244] <... open resumed>) = 4 [pid 5244] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5242] <... futex resumed>) = 0 [pid 5244] <... futex resumed>) = 1 [pid 5242] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5244] fallocate(4, 0, 35143, 7 [pid 5242] <... futex resumed>) = 0 [pid 5242] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5243] munmap(0x7f4378b72000, 262144) = 0 [pid 5243] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5243] ioctl(5, LOOP_SET_FD, 3 [pid 5244] <... fallocate resumed>) = 0 [pid 5243] <... ioctl resumed>) = 0 [pid 5244] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5243] close(3 [pid 5244] <... futex resumed>) = 1 [pid 5243] <... close resumed>) = 0 [pid 5242] <... futex resumed>) = 0 [pid 5244] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5243] mkdir("./file1", 0777 [pid 5244] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5242] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5244] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5243] <... mkdir resumed>) = 0 [pid 5242] <... futex resumed>) = 0 [pid 5244] <... mount resumed>) = 0 [pid 5243] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5242] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5244] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5242] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5244] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5242] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5244] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5242] <... futex resumed>) = 0 [pid 5244] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5242] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5244] <... open resumed>) = 3 [pid 5244] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5242] <... futex resumed>) = 0 [pid 5244] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5242] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5244] <... futex resumed>) = 0 [pid 5242] <... futex resumed>) = 1 [pid 5244] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5242] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5244] <... write resumed>) = 262144 [pid 5244] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5242] <... futex resumed>) = 0 [pid 5244] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5243] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5243] ioctl(5, LOOP_CLR_FD) = 0 [pid 5243] close(5) = 0 [pid 5243] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5243] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5242] exit_group(0 [pid 5244] <... futex resumed>) = ? [pid 5244] +++ exited with 0 +++ [pid 5242] <... exit_group resumed>) = ? [pid 5243] <... futex resumed>) = ? [pid 5243] +++ exited with 0 +++ [pid 5242] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5242, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./55", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./55", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./55/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./55/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./55/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./55/bus") = 0 umount2("./55/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./55/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./55/binderfs") = 0 umount2("./55/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./55/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./55/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./55/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./55/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./55") = 0 mkdir("./56", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5245 attached , child_tidptr=0x555556e0f690) = 5245 [pid 5245] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5245] chdir("./56") = 0 [pid 5245] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [ 52.740550][ T28] audit: type=1800 audit(1694162020.879:57): pid=5244 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor369" name="bus" dev="sda1" ino=1930 res=0 errno=0 [ 52.745515][ T5243] loop0: detected capacity change from 0 to 512 [ 52.774346][ T5243] EXT4-fs warning (device loop0): read_mmp_block:114: Error -117 while reading MMP block 8 [pid 5245] setpgid(0, 0) = 0 [pid 5245] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5245] write(3, "1000", 4) = 4 [pid 5245] close(3) = 0 [pid 5245] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5245] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5245] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5245] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5245] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5245] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5245] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5245] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5246 attached [pid 5246] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5245] <... clone3 resumed> => {parent_tid=[5246]}, 88) = 5246 [pid 5246] <... rseq resumed>) = 0 [pid 5245] rt_sigprocmask(SIG_SETMASK, [], [pid 5246] set_robust_list(0x7f4380f929a0, 24) = 0 [pid 5245] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5246] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5245] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5246] memfd_create("syzkaller", 0 [pid 5245] <... futex resumed>) = 0 [pid 5246] <... memfd_create resumed>) = 3 [pid 5245] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5246] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5245] <... futex resumed>) = 0 [pid 5246] <... mmap resumed>) = 0x7f4378b72000 [pid 5246] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5245] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4378b51000 [pid 5245] mprotect(0x7f4378b52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5245] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5245] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4378b71990, parent_tid=0x7f4378b71990, exit_signal=0, stack=0x7f4378b51000, stack_size=0x20300, tls=0x7f4378b716c0}./strace-static-x86_64: Process 5247 attached => {parent_tid=[5247]}, 88) = 5247 [pid 5245] rt_sigprocmask(SIG_SETMASK, [], [pid 5247] rseq(0x7f4378b71fe0, 0x20, 0, 0x53053053 [pid 5245] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5247] <... rseq resumed>) = 0 [pid 5247] set_robust_list(0x7f4378b719a0, 24 [pid 5245] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5247] <... set_robust_list resumed>) = 0 [pid 5247] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5247] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5245] <... futex resumed>) = 0 [pid 5246] <... write resumed>) = 262144 [pid 5245] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5246] munmap(0x7f4378b72000, 262144) = 0 [pid 5247] <... open resumed>) = 4 [pid 5247] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5247] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5246] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5246] ioctl(5, LOOP_SET_FD, 3 [pid 5245] <... futex resumed>) = 0 [pid 5245] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5246] <... ioctl resumed>) = 0 [pid 5245] <... futex resumed>) = 1 [pid 5247] <... futex resumed>) = 0 [pid 5247] fallocate(4, 0, 35143, 7 [pid 5246] close(3 [pid 5245] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5246] <... close resumed>) = 0 [pid 5246] mkdir("./file1", 0777) = 0 [pid 5246] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5247] <... fallocate resumed>) = 0 [pid 5247] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5247] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5245] <... futex resumed>) = 0 [pid 5245] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5247] <... futex resumed>) = 0 [pid 5245] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5247] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL) = 0 [pid 5247] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5245] <... futex resumed>) = 0 [pid 5247] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5245] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5247] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5245] <... futex resumed>) = 0 [pid 5247] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5245] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5247] <... open resumed>) = 3 [pid 5247] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5245] <... futex resumed>) = 0 [pid 5247] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL) = -1 EAGAIN (Resource temporarily unavailable) [pid 5245] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5247] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5245] <... futex resumed>) = 0 [pid 5245] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5247] <... write resumed>) = 262144 [ 52.839617][ T28] audit: type=1800 audit(1694162020.979:58): pid=5247 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor369" name="bus" dev="sda1" ino=1930 res=0 errno=0 [ 52.840506][ T5246] loop0: detected capacity change from 0 to 512 [ 52.878239][ T5248] EXT4-fs warning (device loop0): kmmpd:167: kmmpd being stopped since MMP feature has been disabled. [pid 5247] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5245] <... futex resumed>) = 0 [pid 5247] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5246] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5246] ioctl(5, LOOP_CLR_FD) = 0 [pid 5246] close(5) = 0 [pid 5246] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5245] exit_group(0 [pid 5247] <... futex resumed>) = ? [pid 5245] <... exit_group resumed>) = ? [pid 5247] +++ exited with 0 +++ [pid 5246] +++ exited with 0 +++ [pid 5245] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5245, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- umount2("./56", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./56", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./56/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./56/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./56/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./56/bus") = 0 umount2("./56/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./56/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./56/binderfs") = 0 umount2("./56/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./56/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./56/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./56/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./56/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./56") = 0 mkdir("./57", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556e0f690) = 5250 ./strace-static-x86_64: Process 5250 attached [pid 5250] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5250] chdir("./57") = 0 [pid 5250] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [ 52.882131][ T5246] EXT4-fs error (device loop0): __ext4_fill_super:5473: comm syz-executor369: inode #2: comm syz-executor369: iget: illegal inode # [ 52.903225][ T5246] EXT4-fs (loop0): get root inode failed [ 52.909246][ T5246] EXT4-fs (loop0): mount failed [pid 5250] setpgid(0, 0) = 0 [pid 5250] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5250] write(3, "1000", 4) = 4 [pid 5250] close(3) = 0 [pid 5250] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5250] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5250] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5250] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5250] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5250] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5250] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5250] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5251 attached [pid 5251] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5250] <... clone3 resumed> => {parent_tid=[5251]}, 88) = 5251 [pid 5251] <... rseq resumed>) = 0 [pid 5250] rt_sigprocmask(SIG_SETMASK, [], [pid 5251] set_robust_list(0x7f4380f929a0, 24 [pid 5250] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5251] <... set_robust_list resumed>) = 0 [pid 5250] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5251] rt_sigprocmask(SIG_SETMASK, [], [pid 5250] <... futex resumed>) = 0 [pid 5251] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5250] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5251] memfd_create("syzkaller", 0 [pid 5250] <... futex resumed>) = 0 [pid 5251] <... memfd_create resumed>) = 3 [pid 5250] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5251] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5250] <... mmap resumed>) = 0x7f4380f51000 [pid 5251] <... mmap resumed>) = 0x7f4378b51000 [pid 5250] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5251] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5250] <... mprotect resumed>) = 0 [pid 5250] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5250] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0}./strace-static-x86_64: Process 5252 attached [pid 5252] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5250] <... clone3 resumed> => {parent_tid=[5252]}, 88) = 5252 [pid 5252] <... rseq resumed>) = 0 [pid 5252] set_robust_list(0x7f4380f719a0, 24 [pid 5250] rt_sigprocmask(SIG_SETMASK, [], [pid 5252] <... set_robust_list resumed>) = 0 [pid 5250] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5252] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5250] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5252] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5251] <... write resumed>) = 262144 [pid 5250] <... futex resumed>) = 0 [pid 5250] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5251] munmap(0x7f4378b51000, 262144 [pid 5252] <... open resumed>) = 4 [pid 5251] <... munmap resumed>) = 0 [pid 5251] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5251] ioctl(5, LOOP_SET_FD, 3 [pid 5252] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5252] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5251] <... ioctl resumed>) = 0 [pid 5250] <... futex resumed>) = 0 [pid 5251] close(3 [pid 5250] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5251] <... close resumed>) = 0 [pid 5252] <... futex resumed>) = 0 [pid 5250] <... futex resumed>) = 1 [pid 5252] fallocate(4, 0, 35143, 7 [pid 5251] mkdir("./file1", 0777 [pid 5250] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5251] <... mkdir resumed>) = 0 [pid 5251] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5252] <... fallocate resumed>) = 0 [pid 5252] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5250] <... futex resumed>) = 0 [pid 5252] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5250] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5252] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5250] <... futex resumed>) = 0 [pid 5252] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5250] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5252] <... mount resumed>) = 0 [pid 5252] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5250] <... futex resumed>) = 0 [pid 5252] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5250] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5252] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5250] <... futex resumed>) = 0 [pid 5252] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5250] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5252] <... open resumed>) = 3 [pid 5252] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5250] <... futex resumed>) = 0 [pid 5252] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL) = -1 EAGAIN (Resource temporarily unavailable) [pid 5250] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5252] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5250] <... futex resumed>) = 0 [pid 5250] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5252] <... write resumed>) = 262144 [pid 5252] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5252] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5250] <... futex resumed>) = 0 [ 52.969207][ T28] audit: type=1800 audit(1694162021.109:59): pid=5252 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor369" name="bus" dev="sda1" ino=1930 res=0 errno=0 [ 52.971441][ T5251] loop0: detected capacity change from 0 to 512 [ 53.008256][ T5253] EXT4-fs warning (device loop0): kmmpd:167: kmmpd being stopped since MMP feature has been disabled. [pid 5251] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5251] ioctl(5, LOOP_CLR_FD) = 0 [pid 5251] close(5) = 0 [pid 5251] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5251] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5250] exit_group(0 [pid 5252] <... futex resumed>) = ? [pid 5251] <... futex resumed>) = ? [pid 5250] <... exit_group resumed>) = ? [pid 5252] +++ exited with 0 +++ [pid 5251] +++ exited with 0 +++ [pid 5250] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5250, si_uid=0, si_status=0, si_utime=0, si_stime=7 /* 0.07 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./57", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./57", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./57/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./57/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./57/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./57/bus") = 0 umount2("./57/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./57/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./57/binderfs") = 0 umount2("./57/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./57/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./57/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./57/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./57/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./57") = 0 mkdir("./58", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5255 attached , child_tidptr=0x555556e0f690) = 5255 [pid 5255] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5255] chdir("./58") = 0 [pid 5255] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5255] setpgid(0, 0) = 0 [pid 5255] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5255] write(3, "1000", 4) = 4 [pid 5255] close(3) = 0 [pid 5255] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5255] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5255] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5255] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5255] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5255] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5255] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5255] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5256 attached [pid 5256] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053) = 0 [pid 5255] <... clone3 resumed> => {parent_tid=[5256]}, 88) = 5256 [pid 5256] set_robust_list(0x7f4380f929a0, 24 [pid 5255] rt_sigprocmask(SIG_SETMASK, [], [pid 5256] <... set_robust_list resumed>) = 0 [pid 5255] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5256] rt_sigprocmask(SIG_SETMASK, [], [pid 5255] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5256] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5256] memfd_create("syzkaller", 0 [pid 5255] <... futex resumed>) = 0 [pid 5255] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5255] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5256] <... memfd_create resumed>) = 3 [pid 5255] <... mmap resumed>) = 0x7f4380f51000 [pid 5256] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4378b51000 [pid 5255] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5256] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5255] <... mprotect resumed>) = 0 [pid 5255] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5255] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} => {parent_tid=[5257]}, 88) = 5257 [pid 5255] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5255] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5255] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5257 attached [pid 5257] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053) = 0 [pid 5257] set_robust_list(0x7f4380f719a0, 24) = 0 [pid 5257] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5256] <... write resumed>) = 262144 [pid 5257] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 5257] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5257] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5255] <... futex resumed>) = 0 [pid 5255] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5257] <... futex resumed>) = 0 [pid 5257] fallocate(4, 0, 35143, 7 [pid 5255] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5256] munmap(0x7f4378b51000, 262144) = 0 [pid 5256] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [ 53.014442][ T5251] EXT4-fs error (device loop0): __ext4_fill_super:5473: comm syz-executor369: inode #2: comm syz-executor369: iget: illegal inode # [ 53.033583][ T5251] EXT4-fs (loop0): get root inode failed [ 53.039460][ T5251] EXT4-fs (loop0): mount failed [pid 5256] ioctl(5, LOOP_SET_FD, 3) = 0 [pid 5256] close(3) = 0 [pid 5256] mkdir("./file1", 0777 [pid 5257] <... fallocate resumed>) = 0 [pid 5257] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5257] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5255] <... futex resumed>) = 0 [pid 5255] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5257] <... futex resumed>) = 0 [pid 5257] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL) = 0 [pid 5257] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5257] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5255] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 5255] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5257] <... futex resumed>) = 0 [pid 5257] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 3 [pid 5257] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5257] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5255] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 5255] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5257] <... futex resumed>) = 0 [pid 5257] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5255] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5256] <... mkdir resumed>) = 0 [pid 5256] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue") = -1 EINVAL (Invalid argument) [pid 5256] ioctl(5, LOOP_CLR_FD) = 0 [pid 5256] close(5) = 0 [pid 5256] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5256] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5257] <... write resumed>) = 262144 [pid 5257] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5255] <... futex resumed>) = 0 [pid 5255] exit_group(0) = ? [pid 5256] <... futex resumed>) = ? [pid 5256] +++ exited with 0 +++ [pid 5257] <... futex resumed>) = ? [pid 5257] +++ exited with 0 +++ [pid 5255] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5255, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./58", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./58", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./58/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./58/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./58/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./58/bus") = 0 umount2("./58/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./58/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./58/binderfs") = 0 umount2("./58/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./58/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./58/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./58/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./58/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./58") = 0 mkdir("./59", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5258 attached , child_tidptr=0x555556e0f690) = 5258 [pid 5258] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5258] chdir("./59") = 0 [pid 5258] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5258] setpgid(0, 0) = 0 [pid 5258] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5258] write(3, "1000", 4) = 4 [pid 5258] close(3) = 0 [pid 5258] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5258] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5258] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5258] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5258] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5258] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5258] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5258] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5259 attached [pid 5259] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5258] <... clone3 resumed> => {parent_tid=[5259]}, 88) = 5259 [pid 5259] <... rseq resumed>) = 0 [pid 5258] rt_sigprocmask(SIG_SETMASK, [], [pid 5259] set_robust_list(0x7f4380f929a0, 24 [pid 5258] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5259] <... set_robust_list resumed>) = 0 [pid 5258] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5259] rt_sigprocmask(SIG_SETMASK, [], [pid 5258] <... futex resumed>) = 0 [pid 5259] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5258] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5259] memfd_create("syzkaller", 0 [pid 5258] <... futex resumed>) = 0 [pid 5258] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5259] <... memfd_create resumed>) = 3 [pid 5258] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5259] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4378b51000 [pid 5258] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5259] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5258] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5258] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} => {parent_tid=[5260]}, 88) = 5260 [pid 5258] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5258] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5258] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5260 attached [pid 5259] <... write resumed>) = 262144 [pid 5259] munmap(0x7f4378b51000, 262144) = 0 [pid 5259] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5259] ioctl(4, LOOP_SET_FD, 3 [pid 5260] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053) = 0 [pid 5260] set_robust_list(0x7f4380f719a0, 24) = 0 [pid 5260] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5260] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5 [pid 5260] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5258] <... futex resumed>) = 0 [pid 5260] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5258] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5260] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5258] <... futex resumed>) = 0 [pid 5260] fallocate(5, 0, 35143, 7 [ 53.079790][ T5256] loop0: detected capacity change from 0 to 512 [ 53.099185][ T5256] EXT4-fs (loop0): VFS: Can't find ext4 filesystem [pid 5258] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5259] <... ioctl resumed>) = 0 [pid 5259] close(3) = 0 [pid 5259] mkdir("./file1", 0777) = 0 [pid 5259] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5260] <... fallocate resumed>) = 0 [pid 5260] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5258] <... futex resumed>) = 0 [pid 5258] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5258] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5260] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL) = 0 [pid 5260] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5258] <... futex resumed>) = 0 [pid 5258] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5258] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5260] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 3 [pid 5260] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5258] <... futex resumed>) = 0 [pid 5258] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5258] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5260] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190) = 262144 [pid 5260] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5258] <... futex resumed>) = 0 [pid 5260] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5259] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5259] ioctl(4, LOOP_CLR_FD) = 0 [pid 5259] close(4) = 0 [pid 5259] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5259] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5258] exit_group(0) = ? [pid 5260] <... futex resumed>) = ? [pid 5259] <... futex resumed>) = ? [pid 5260] +++ exited with 0 +++ [pid 5259] +++ exited with 0 +++ [pid 5258] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5258, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./59", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./59", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./59/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./59/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./59/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./59/bus") = 0 umount2("./59/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./59/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./59/binderfs") = 0 umount2("./59/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./59/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./59/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./59/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./59/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./59") = 0 mkdir("./60", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5261 attached , child_tidptr=0x555556e0f690) = 5261 [pid 5261] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5261] chdir("./60") = 0 [pid 5261] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5261] setpgid(0, 0) = 0 [pid 5261] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5261] write(3, "1000", 4) = 4 [pid 5261] close(3) = 0 [pid 5261] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5261] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5261] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5261] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5261] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5261] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5261] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5261] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5262 attached [pid 5262] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5261] <... clone3 resumed> => {parent_tid=[5262]}, 88) = 5262 [pid 5262] <... rseq resumed>) = 0 [pid 5261] rt_sigprocmask(SIG_SETMASK, [], [pid 5262] set_robust_list(0x7f4380f929a0, 24 [pid 5261] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5262] <... set_robust_list resumed>) = 0 [pid 5261] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5262] rt_sigprocmask(SIG_SETMASK, [], [pid 5261] <... futex resumed>) = 0 [pid 5262] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5261] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5262] memfd_create("syzkaller", 0 [pid 5261] <... futex resumed>) = 0 [pid 5261] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5262] <... memfd_create resumed>) = 3 [pid 5261] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5262] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5261] <... mprotect resumed>) = 0 [pid 5262] <... mmap resumed>) = 0x7f4378b51000 [pid 5261] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5262] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5261] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5261] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} => {parent_tid=[5263]}, 88) = 5263 [pid 5261] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5261] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5261] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5263 attached [pid 5263] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053) = 0 [pid 5263] set_robust_list(0x7f4380f719a0, 24) = 0 [pid 5263] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5263] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 5263] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5262] <... write resumed>) = 262144 [pid 5263] <... futex resumed>) = 1 [pid 5261] <... futex resumed>) = 0 [pid 5261] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5261] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5263] fallocate(4, 0, 35143, 7 [pid 5262] munmap(0x7f4378b51000, 262144) = 0 [pid 5262] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [ 53.138228][ T5259] loop0: detected capacity change from 0 to 512 [ 53.157752][ T5259] EXT4-fs warning (device loop0): read_mmp_block:114: Error -117 while reading MMP block 8 [pid 5262] ioctl(5, LOOP_SET_FD, 3 [pid 5263] <... fallocate resumed>) = 0 [pid 5263] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5261] <... futex resumed>) = 0 [pid 5261] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5261] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5263] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL) = 0 [pid 5263] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5261] <... futex resumed>) = 0 [pid 5261] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5261] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5263] <... futex resumed>) = 1 [pid 5263] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 6 [pid 5263] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5261] <... futex resumed>) = 0 [pid 5261] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5261] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5263] <... futex resumed>) = 1 [pid 5263] write(6, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5262] <... ioctl resumed>) = 0 [pid 5262] close(3) = 0 [pid 5262] mkdir("./file1", 0777) = 0 [pid 5262] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5263] <... write resumed>) = 262144 [pid 5263] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5263] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5261] <... futex resumed>) = 0 [pid 5262] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 5262] ioctl(5, LOOP_CLR_FD) = 0 [pid 5262] close(5) = 0 [pid 5262] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5262] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5261] exit_group(0) = ? [pid 5262] <... futex resumed>) = ? [pid 5263] <... futex resumed>) = ? [pid 5263] +++ exited with 0 +++ [pid 5262] +++ exited with 0 +++ [pid 5261] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5261, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./60", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./60", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./60/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./60/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./60/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./60/bus") = 0 umount2("./60/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./60/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./60/binderfs") = 0 umount2("./60/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./60/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./60/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./60/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./60/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./60") = 0 mkdir("./61", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5264 attached , child_tidptr=0x555556e0f690) = 5264 [pid 5264] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5264] chdir("./61") = 0 [pid 5264] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5264] setpgid(0, 0) = 0 [pid 5264] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5264] write(3, "1000", 4) = 4 [pid 5264] close(3) = 0 [pid 5264] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5264] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5264] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5264] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5264] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5264] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5264] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5264] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5265 attached => {parent_tid=[5265]}, 88) = 5265 [pid 5264] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5264] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5264] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5264] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5264] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5264] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5264] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0}./strace-static-x86_64: Process 5266 attached [pid 5265] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5266] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5265] <... rseq resumed>) = 0 [pid 5264] <... clone3 resumed> => {parent_tid=[5266]}, 88) = 5266 [pid 5266] <... rseq resumed>) = 0 [pid 5265] set_robust_list(0x7f4380f929a0, 24 [pid 5264] rt_sigprocmask(SIG_SETMASK, [], [pid 5266] set_robust_list(0x7f4380f719a0, 24 [pid 5265] <... set_robust_list resumed>) = 0 [pid 5264] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5266] <... set_robust_list resumed>) = 0 [pid 5265] rt_sigprocmask(SIG_SETMASK, [], [pid 5264] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5265] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5264] <... futex resumed>) = 0 [pid 5264] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5266] rt_sigprocmask(SIG_SETMASK, [], [pid 5265] memfd_create("syzkaller", 0 [pid 5266] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5265] <... memfd_create resumed>) = 3 [pid 5266] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5265] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4378b51000 [pid 5265] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5266] <... open resumed>) = 4 [pid 5266] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5264] <... futex resumed>) = 0 [pid 5266] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5264] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5266] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5264] <... futex resumed>) = 0 [pid 5266] fallocate(4, 0, 35143, 7 [pid 5265] <... write resumed>) = 262144 [pid 5264] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5265] munmap(0x7f4378b51000, 262144) = 0 [ 53.203275][ T5262] loop0: detected capacity change from 0 to 512 [ 53.222364][ T5262] EXT4-fs (loop0): VFS: Can't find ext4 filesystem [pid 5265] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5265] ioctl(5, LOOP_SET_FD, 3 [pid 5266] <... fallocate resumed>) = 0 [pid 5266] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5264] <... futex resumed>) = 0 [pid 5266] <... futex resumed>) = 1 [pid 5264] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5266] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5264] <... futex resumed>) = 0 [pid 5266] <... mount resumed>) = 0 [pid 5264] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5266] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5264] <... futex resumed>) = 0 [pid 5264] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5266] <... futex resumed>) = 1 [pid 5264] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5266] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 6 [pid 5266] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5264] <... futex resumed>) = 0 [pid 5266] <... futex resumed>) = 1 [pid 5264] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5266] write(6, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5264] <... futex resumed>) = 0 [pid 5264] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5265] <... ioctl resumed>) = 0 [pid 5265] close(3) = 0 [pid 5265] mkdir("./file1", 0777) = 0 [pid 5265] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5266] <... write resumed>) = -1 EIO (Input/output error) [pid 5266] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5266] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5264] <... futex resumed>) = 0 [pid 5265] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 5265] ioctl(5, LOOP_CLR_FD) = 0 [pid 5265] close(5) = 0 [pid 5265] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5265] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5264] exit_group(0 [pid 5265] <... futex resumed>) = ? [pid 5264] <... exit_group resumed>) = ? [pid 5266] <... futex resumed>) = ? [pid 5265] +++ exited with 0 +++ [pid 5266] +++ exited with 0 +++ [pid 5264] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5264, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- umount2("./61", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./61", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./61/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./61/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./61/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./61/bus") = 0 umount2("./61/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./61/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./61/binderfs") = 0 umount2("./61/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./61/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./61/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./61/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./61/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./61") = 0 mkdir("./62", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [ 53.277720][ T5265] loop0: detected capacity change from 0 to 512 [ 53.283406][ T5266] I/O error, dev loop0, sector 248 op 0x1:(WRITE) flags 0x800 phys_seg 1 prio class 2 [ 53.294197][ T5266] Buffer I/O error on dev loop0, logical block 31, lost async page write [ 53.305586][ T5265] EXT4-fs (loop0): VFS: Can't find ext4 filesystem close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556e0f690) = 5267 ./strace-static-x86_64: Process 5267 attached [pid 5267] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5267] chdir("./62") = 0 [pid 5267] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5267] setpgid(0, 0) = 0 [pid 5267] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5267] write(3, "1000", 4) = 4 [pid 5267] close(3) = 0 [pid 5267] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5267] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5267] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5267] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5267] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5267] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5267] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5267] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5268 attached => {parent_tid=[5268]}, 88) = 5268 [pid 5267] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5267] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5267] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5267] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5268] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053) = 0 [pid 5267] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5268] set_robust_list(0x7f4380f929a0, 24 [pid 5267] <... mprotect resumed>) = 0 [pid 5268] <... set_robust_list resumed>) = 0 [pid 5267] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5267] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} [pid 5268] rt_sigprocmask(SIG_SETMASK, [], ./strace-static-x86_64: Process 5269 attached [pid 5269] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053) = 0 [pid 5267] <... clone3 resumed> => {parent_tid=[5269]}, 88) = 5269 [pid 5269] set_robust_list(0x7f4380f719a0, 24 [pid 5267] rt_sigprocmask(SIG_SETMASK, [], [pid 5269] <... set_robust_list resumed>) = 0 [pid 5268] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5267] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5269] rt_sigprocmask(SIG_SETMASK, [], [pid 5267] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5269] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5267] <... futex resumed>) = 0 [pid 5269] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5267] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5269] <... open resumed>) = 3 [pid 5268] memfd_create("syzkaller", 0 [pid 5269] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5268] <... memfd_create resumed>) = 4 [pid 5267] <... futex resumed>) = 0 [pid 5267] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5269] <... futex resumed>) = 1 [pid 5269] fallocate(3, 0, 35143, 7 [pid 5268] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5267] <... futex resumed>) = 0 [pid 5267] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5268] <... mmap resumed>) = 0x7f4378b51000 [pid 5268] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5269] <... fallocate resumed>) = 0 [pid 5268] <... write resumed>) = 262144 [pid 5268] munmap(0x7f4378b51000, 262144 [pid 5269] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5268] <... munmap resumed>) = 0 [pid 5267] <... futex resumed>) = 0 [pid 5269] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5268] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5267] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5269] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5267] <... futex resumed>) = 0 [pid 5269] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5267] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5269] <... mount resumed>) = 0 [pid 5268] <... openat resumed>) = 5 [pid 5268] ioctl(5, LOOP_SET_FD, 4 [pid 5269] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5267] <... futex resumed>) = 0 [pid 5267] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5269] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5267] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5268] <... ioctl resumed>) = 0 [pid 5269] <... open resumed>) = 6 [pid 5268] close(4 [pid 5269] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5267] <... futex resumed>) = 0 [pid 5267] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5269] write(6, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5268] <... close resumed>) = 0 [pid 5267] <... futex resumed>) = 0 [pid 5267] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5268] mkdir("./file1", 0777) = 0 [pid 5268] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5269] <... write resumed>) = 262144 [pid 5269] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5269] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5267] <... futex resumed>) = 0 [pid 5268] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 5268] ioctl(5, LOOP_CLR_FD) = 0 [pid 5268] close(5) = 0 [pid 5268] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5268] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5267] exit_group(0 [pid 5269] <... futex resumed>) = ? [pid 5267] <... exit_group resumed>) = ? [pid 5269] +++ exited with 0 +++ [pid 5268] <... futex resumed>) = ? [pid 5268] +++ exited with 0 +++ [pid 5267] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5267, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- umount2("./62", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./62", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./62/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./62/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./62/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./62/bus") = 0 umount2("./62/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./62/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./62/binderfs") = 0 umount2("./62/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./62/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./62/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./62/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./62/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./62") = 0 mkdir("./63", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5270 attached , child_tidptr=0x555556e0f690) = 5270 [pid 5270] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5270] chdir("./63") = 0 [pid 5270] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5270] setpgid(0, 0) = 0 [pid 5270] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5270] write(3, "1000", 4) = 4 [pid 5270] close(3) = 0 [pid 5270] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5270] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5270] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5270] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5270] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5270] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5270] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5270] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5271 attached [pid 5271] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5270] <... clone3 resumed> => {parent_tid=[5271]}, 88) = 5271 [pid 5271] <... rseq resumed>) = 0 [pid 5270] rt_sigprocmask(SIG_SETMASK, [], [pid 5271] set_robust_list(0x7f4380f929a0, 24 [pid 5270] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5271] <... set_robust_list resumed>) = 0 [pid 5270] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5271] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5270] <... futex resumed>) = 0 [pid 5271] memfd_create("syzkaller", 0 [pid 5270] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5270] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5271] <... memfd_create resumed>) = 3 [pid 5270] <... mmap resumed>) = 0x7f4380f51000 [pid 5271] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4378b51000 [pid 5270] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5271] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5270] <... mprotect resumed>) = 0 [pid 5270] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5270] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} => {parent_tid=[5272]}, 88) = 5272 [pid 5270] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5270] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5270] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5272 attached [pid 5271] <... write resumed>) = 262144 [pid 5271] munmap(0x7f4378b51000, 262144 [pid 5272] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053) = 0 [pid 5271] <... munmap resumed>) = 0 [pid 5271] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 53.389736][ T5268] loop0: detected capacity change from 0 to 512 [ 53.403776][ T5268] EXT4-fs (loop0): VFS: Can't find ext4 filesystem [pid 5271] ioctl(4, LOOP_SET_FD, 3 [pid 5272] set_robust_list(0x7f4380f719a0, 24) = 0 [pid 5272] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5271] <... ioctl resumed>) = 0 [pid 5272] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5 [pid 5271] close(3 [pid 5272] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5271] <... close resumed>) = 0 [pid 5272] <... futex resumed>) = 1 [pid 5271] mkdir("./file1", 0777 [pid 5270] <... futex resumed>) = 0 [pid 5272] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5270] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5272] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5271] <... mkdir resumed>) = 0 [pid 5270] <... futex resumed>) = 0 [pid 5272] fallocate(5, 0, 35143, 7 [pid 5271] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5270] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5272] <... fallocate resumed>) = 0 [pid 5272] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5270] <... futex resumed>) = 0 [pid 5272] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5270] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5272] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5270] <... futex resumed>) = 0 [pid 5272] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5270] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5272] <... mount resumed>) = 0 [pid 5272] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5272] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5270] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5270] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5272] <... futex resumed>) = 0 [pid 5272] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 3 [pid 5272] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5270] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5272] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5270] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5270] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5272] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5270] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5272] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190) = 262144 [pid 5272] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5272] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5270] <... futex resumed>) = 0 [ 53.442390][ T5271] loop0: detected capacity change from 0 to 512 [ 53.468693][ T5273] EXT4-fs warning (device loop0): kmmpd:167: kmmpd being stopped since MMP feature has been disabled. [pid 5271] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5271] ioctl(4, LOOP_CLR_FD) = 0 [pid 5271] close(4) = 0 [pid 5271] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5271] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5270] exit_group(0 [pid 5272] <... futex resumed>) = ? [pid 5272] +++ exited with 0 +++ [pid 5271] <... futex resumed>) = ? [pid 5270] <... exit_group resumed>) = ? [pid 5271] +++ exited with 0 +++ [pid 5270] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5270, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- umount2("./63", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./63", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./63/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./63/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./63/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./63/bus") = 0 umount2("./63/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./63/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./63/binderfs") = 0 umount2("./63/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./63/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./63/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./63/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./63/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./63") = 0 mkdir("./64", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556e0f690) = 5275 ./strace-static-x86_64: Process 5275 attached [pid 5275] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5275] chdir("./64") = 0 [pid 5275] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5275] setpgid(0, 0) = 0 [pid 5275] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5275] write(3, "1000", 4) = 4 [pid 5275] close(3) = 0 [pid 5275] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5275] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5275] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5275] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5275] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5275] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [ 53.477065][ T5271] EXT4-fs error (device loop0): __ext4_fill_super:5473: comm syz-executor369: inode #2: comm syz-executor369: iget: illegal inode # [ 53.493637][ T5271] EXT4-fs (loop0): get root inode failed [ 53.499316][ T5271] EXT4-fs (loop0): mount failed [pid 5275] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5275] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5276 attached => {parent_tid=[5276]}, 88) = 5276 [pid 5276] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5275] rt_sigprocmask(SIG_SETMASK, [], [pid 5276] <... rseq resumed>) = 0 [pid 5276] set_robust_list(0x7f4380f929a0, 24 [pid 5275] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5276] <... set_robust_list resumed>) = 0 [pid 5275] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5276] rt_sigprocmask(SIG_SETMASK, [], [pid 5275] <... futex resumed>) = 0 [pid 5276] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5275] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5276] memfd_create("syzkaller", 0 [pid 5275] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5276] <... memfd_create resumed>) = 3 [pid 5275] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5276] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5275] <... mprotect resumed>) = 0 [pid 5276] <... mmap resumed>) = 0x7f4378b51000 [pid 5275] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5276] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5275] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5275] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0}./strace-static-x86_64: Process 5277 attached => {parent_tid=[5277]}, 88) = 5277 [pid 5275] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5275] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5275] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5277] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053) = 0 [pid 5277] set_robust_list(0x7f4380f719a0, 24) = 0 [pid 5277] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5277] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 5277] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5275] <... futex resumed>) = 0 [pid 5275] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5277] fallocate(4, 0, 35143, 7 [pid 5275] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5276] <... write resumed>) = 262144 [pid 5276] munmap(0x7f4378b51000, 262144) = 0 [pid 5276] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5276] ioctl(5, LOOP_SET_FD, 3 [pid 5277] <... fallocate resumed>) = 0 [pid 5277] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5275] <... futex resumed>) = 0 [pid 5277] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5275] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5277] <... mount resumed>) = 0 [pid 5275] <... futex resumed>) = 0 [pid 5275] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5277] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5275] <... futex resumed>) = 0 [pid 5275] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5275] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5277] <... futex resumed>) = 1 [pid 5277] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 6 [pid 5277] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5275] <... futex resumed>) = 0 [pid 5275] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5275] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5277] <... futex resumed>) = 1 [pid 5277] write(6, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5276] <... ioctl resumed>) = 0 [pid 5276] close(3) = 0 [pid 5276] mkdir("./file1", 0777) = 0 [pid 5276] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5277] <... write resumed>) = -1 EIO (Input/output error) [pid 5277] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5275] <... futex resumed>) = 0 [pid 5277] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5276] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 5276] ioctl(5, LOOP_CLR_FD) = 0 [pid 5276] close(5) = 0 [pid 5276] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5275] exit_group(0 [pid 5276] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5277] <... futex resumed>) = ? [pid 5277] +++ exited with 0 +++ [pid 5276] <... futex resumed>) = ? [pid 5275] <... exit_group resumed>) = ? [pid 5276] +++ exited with 0 +++ [pid 5275] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5275, si_uid=0, si_status=0, si_utime=0, si_stime=6 /* 0.06 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./64", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./64", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./64/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./64/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./64/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./64/bus") = 0 umount2("./64/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./64/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./64/binderfs") = 0 umount2("./64/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./64/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./64/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./64/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./64/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./64") = 0 mkdir("./65", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5278 attached , child_tidptr=0x555556e0f690) = 5278 [pid 5278] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5278] chdir("./65") = 0 [pid 5278] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5278] setpgid(0, 0) = 0 [pid 5278] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5278] write(3, "1000", 4) = 4 [pid 5278] close(3) = 0 [pid 5278] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5278] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5278] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5278] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5278] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5278] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5278] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5278] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5279 attached [pid 5279] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053) = 0 [pid 5279] set_robust_list(0x7f4380f929a0, 24 [pid 5278] <... clone3 resumed> => {parent_tid=[5279]}, 88) = 5279 [pid 5278] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5279] <... set_robust_list resumed>) = 0 [pid 5279] rt_sigprocmask(SIG_SETMASK, [], [pid 5278] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5279] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5279] memfd_create("syzkaller", 0 [pid 5278] <... futex resumed>) = 0 [pid 5279] <... memfd_create resumed>) = 3 [pid 5279] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4378b72000 [pid 5278] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5279] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5278] <... futex resumed>) = 0 [pid 5278] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5279] <... write resumed>) = 262144 [pid 5278] <... mmap resumed>) = 0x7f4378b51000 [ 53.565914][ T5276] loop0: detected capacity change from 0 to 512 [ 53.573179][ T5277] I/O error, dev loop0, sector 248 op 0x1:(WRITE) flags 0x800 phys_seg 1 prio class 2 [ 53.583082][ T5277] Buffer I/O error on dev loop0, logical block 31, lost async page write [ 53.594464][ T5276] EXT4-fs (loop0): VFS: Can't find ext4 filesystem [pid 5279] munmap(0x7f4378b72000, 262144 [pid 5278] mprotect(0x7f4378b52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5278] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5278] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4378b71990, parent_tid=0x7f4378b71990, exit_signal=0, stack=0x7f4378b51000, stack_size=0x20300, tls=0x7f4378b716c0}./strace-static-x86_64: Process 5280 attached => {parent_tid=[5280]}, 88) = 5280 [pid 5280] rseq(0x7f4378b71fe0, 0x20, 0, 0x53053053 [pid 5278] rt_sigprocmask(SIG_SETMASK, [], [pid 5280] <... rseq resumed>) = 0 [pid 5278] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5278] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5280] set_robust_list(0x7f4378b719a0, 24 [pid 5278] <... futex resumed>) = 0 [pid 5280] <... set_robust_list resumed>) = 0 [pid 5280] rt_sigprocmask(SIG_SETMASK, [], [pid 5278] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5280] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5280] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5279] <... munmap resumed>) = 0 [pid 5279] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5279] ioctl(5, LOOP_SET_FD, 3 [pid 5280] <... open resumed>) = 4 [pid 5280] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5278] <... futex resumed>) = 0 [pid 5278] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5278] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5280] <... futex resumed>) = 1 [pid 5280] fallocate(4, 0, 35143, 7 [pid 5279] <... ioctl resumed>) = 0 [pid 5279] close(3) = 0 [pid 5279] mkdir("./file1", 0777 [pid 5280] <... fallocate resumed>) = 0 [pid 5280] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5280] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5279] <... mkdir resumed>) = 0 [pid 5278] <... futex resumed>) = 0 [pid 5279] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5278] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5280] <... futex resumed>) = 0 [pid 5278] <... futex resumed>) = 1 [pid 5280] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5278] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5280] <... mount resumed>) = 0 [pid 5280] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5280] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5278] <... futex resumed>) = 0 [pid 5278] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5280] <... futex resumed>) = 0 [pid 5280] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5278] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5280] <... open resumed>) = 3 [pid 5280] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5280] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5278] <... futex resumed>) = 0 [pid 5278] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5280] <... futex resumed>) = 0 [pid 5278] <... futex resumed>) = 1 [pid 5280] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5278] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5280] <... write resumed>) = 262144 [pid 5280] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5280] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5278] <... futex resumed>) = 0 [pid 5279] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5279] ioctl(5, LOOP_CLR_FD) = 0 [pid 5279] close(5) = 0 [pid 5279] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5279] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5278] exit_group(0 [pid 5280] <... futex resumed>) = ? [pid 5279] <... futex resumed>) = ? [pid 5279] +++ exited with 0 +++ [pid 5278] <... exit_group resumed>) = ? [pid 5280] +++ exited with 0 +++ [pid 5278] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5278, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- umount2("./65", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./65", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./65/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./65/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./65/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./65/bus") = 0 umount2("./65/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./65/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./65/binderfs") = 0 umount2("./65/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./65/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./65/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./65/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./65/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./65") = 0 mkdir("./66", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556e0f690) = 5281 ./strace-static-x86_64: Process 5281 attached [pid 5281] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5281] chdir("./66") = 0 [pid 5281] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5281] setpgid(0, 0) = 0 [pid 5281] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5281] write(3, "1000", 4) = 4 [pid 5281] close(3) = 0 [pid 5281] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5281] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5281] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5281] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5281] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5281] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5281] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5281] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5282 attached => {parent_tid=[5282]}, 88) = 5282 [pid 5282] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5281] rt_sigprocmask(SIG_SETMASK, [], [pid 5282] <... rseq resumed>) = 0 [pid 5282] set_robust_list(0x7f4380f929a0, 24) = 0 [pid 5281] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5282] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5282] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5281] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5281] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5282] <... futex resumed>) = 0 [pid 5282] memfd_create("syzkaller", 0) = 3 [pid 5282] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5281] <... futex resumed>) = 0 [pid 5282] <... mmap resumed>) = 0x7f4378b72000 [pid 5281] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4378b51000 [pid 5282] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5281] mprotect(0x7f4378b52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5281] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [ 53.650243][ T5279] loop0: detected capacity change from 0 to 512 [ 53.662602][ T5279] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 53.673908][ T5279] EXT4-fs (loop0): group descriptors corrupted! [pid 5281] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4378b71990, parent_tid=0x7f4378b71990, exit_signal=0, stack=0x7f4378b51000, stack_size=0x20300, tls=0x7f4378b716c0} => {parent_tid=[5283]}, 88) = 5283 ./strace-static-x86_64: Process 5283 attached [pid 5283] rseq(0x7f4378b71fe0, 0x20, 0, 0x53053053) = 0 [pid 5283] set_robust_list(0x7f4378b719a0, 24 [pid 5282] <... write resumed>) = 262144 [pid 5281] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5283] <... set_robust_list resumed>) = 0 [pid 5283] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5283] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5282] munmap(0x7f4378b72000, 262144 [pid 5281] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5283] <... futex resumed>) = 0 [pid 5281] <... futex resumed>) = 1 [pid 5283] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 5281] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5283] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5282] <... munmap resumed>) = 0 [pid 5281] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5283] <... futex resumed>) = 0 [pid 5283] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5281] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5283] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5282] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5281] <... futex resumed>) = 0 [pid 5283] fallocate(4, 0, 35143, 7 [pid 5282] <... openat resumed>) = 5 [pid 5282] ioctl(5, LOOP_SET_FD, 3 [pid 5281] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5283] <... fallocate resumed>) = 0 [pid 5282] <... ioctl resumed>) = 0 [pid 5282] close(3) = 0 [pid 5282] mkdir("./file1", 0777) = 0 [pid 5282] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5283] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5281] <... futex resumed>) = 0 [pid 5283] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5281] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5283] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5281] <... futex resumed>) = 0 [pid 5283] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5281] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5283] <... mount resumed>) = 0 [pid 5283] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5281] <... futex resumed>) = 0 [pid 5283] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5281] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5281] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5283] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5283] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 3 [pid 5283] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5281] <... futex resumed>) = 0 [pid 5283] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5281] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5283] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5283] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5281] <... futex resumed>) = 0 [pid 5281] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5283] <... write resumed>) = 262144 [pid 5283] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5281] <... futex resumed>) = 0 [pid 5283] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5282] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5282] ioctl(5, LOOP_CLR_FD) = 0 [pid 5282] close(5) = 0 [pid 5282] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5281] exit_group(0 [pid 5282] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5283] <... futex resumed>) = ? [pid 5282] <... futex resumed>) = ? [pid 5283] +++ exited with 0 +++ [pid 5282] +++ exited with 0 +++ [pid 5281] <... exit_group resumed>) = ? [pid 5281] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5281, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./66", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./66", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./66/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./66/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./66/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./66/bus") = 0 umount2("./66/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./66/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./66/binderfs") = 0 umount2("./66/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./66/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./66/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./66/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./66/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./66") = 0 mkdir("./67", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5284 attached , child_tidptr=0x555556e0f690) = 5284 [pid 5284] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5284] chdir("./67") = 0 [pid 5284] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5284] setpgid(0, 0) = 0 [pid 5284] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5284] write(3, "1000", 4) = 4 [pid 5284] close(3) = 0 [pid 5284] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5284] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5284] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5284] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5284] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5284] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5284] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5284] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0} => {parent_tid=[5285]}, 88) = 5285 [pid 5284] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5284] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5284] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5284] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5284] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5284] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5284] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0}./strace-static-x86_64: Process 5286 attached [pid 5286] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5284] <... clone3 resumed> => {parent_tid=[5286]}, 88) = 5286 [pid 5286] <... rseq resumed>) = 0 [pid 5284] rt_sigprocmask(SIG_SETMASK, [], [pid 5286] set_robust_list(0x7f4380f719a0, 24./strace-static-x86_64: Process 5285 attached ) = 0 [pid 5284] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5286] rt_sigprocmask(SIG_SETMASK, [], [pid 5284] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5286] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5284] <... futex resumed>) = 0 [pid 5286] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5284] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5286] <... open resumed>) = 3 [pid 5286] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5284] <... futex resumed>) = 0 [pid 5286] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5284] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5286] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5286] fallocate(3, 0, 35143, 7 [pid 5284] <... futex resumed>) = 0 [pid 5285] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5284] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5285] <... rseq resumed>) = 0 [pid 5285] set_robust_list(0x7f4380f929a0, 24) = 0 [pid 5285] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 53.740739][ T5282] loop0: detected capacity change from 0 to 512 [ 53.767043][ T5282] EXT4-fs warning (device loop0): read_mmp_block:114: Error -117 while reading MMP block 8 [pid 5285] memfd_create("syzkaller", 0) = 4 [pid 5285] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4378b51000 [pid 5285] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5286] <... fallocate resumed>) = 0 [pid 5286] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5286] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5284] <... futex resumed>) = 0 [pid 5284] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5286] <... futex resumed>) = 0 [pid 5286] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL) = 0 [pid 5284] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5286] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5284] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5286] <... futex resumed>) = 0 [pid 5284] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5286] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5284] <... futex resumed>) = 0 [pid 5286] <... open resumed>) = 5 [pid 5284] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5286] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5285] <... write resumed>) = 262144 [pid 5286] <... futex resumed>) = 1 [pid 5286] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5285] munmap(0x7f4378b51000, 262144 [pid 5284] <... futex resumed>) = 0 [pid 5284] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5286] <... futex resumed>) = 0 [pid 5284] <... futex resumed>) = 1 [pid 5286] write(5, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5284] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5286] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 5286] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5286] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5285] <... munmap resumed>) = 0 [pid 5284] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5285] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 6 [pid 5285] ioctl(6, LOOP_SET_FD, 4) = 0 [pid 5285] close(4) = 0 [pid 5285] mkdir("./file1", 0777) = 0 [ 53.830698][ T5285] loop0: detected capacity change from 0 to 512 [ 53.850385][ T5285] EXT4-fs (loop0): 1 orphan inode deleted [ 53.856321][ T5285] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [pid 5285] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue") = 0 [pid 5285] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 4 [pid 5285] chdir("./file1") = 0 [pid 5285] ioctl(6, LOOP_CLR_FD) = 0 [pid 5285] close(6) = 0 [pid 5285] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5284] exit_group(0 [pid 5285] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5284] <... exit_group resumed>) = ? [pid 5285] <... futex resumed>) = ? [pid 5285] +++ exited with 0 +++ [pid 5286] <... futex resumed>) = ? [pid 5286] +++ exited with 0 +++ [pid 5284] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5284, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- umount2("./67", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./67", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./67/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./67/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./67/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./67/bus") = 0 umount2("./67/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./67/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./67/binderfs") = 0 [ 53.868973][ T5285] ext4 filesystem being mounted at /root/syzkaller.F1Lso8/67/file1 supports timestamps until 2038-01-19 (0x7fffffff) umount2("./67/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./67/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./67/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./67/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./67/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./67/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./67") = 0 mkdir("./68", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5290 attached , child_tidptr=0x555556e0f690) = 5290 [pid 5290] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5290] chdir("./68") = 0 [pid 5290] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5290] setpgid(0, 0) = 0 [pid 5290] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5290] write(3, "1000", 4) = 4 [pid 5290] close(3) = 0 [pid 5290] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5290] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5290] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5290] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5290] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5290] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5290] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5290] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5291 attached [pid 5291] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5290] <... clone3 resumed> => {parent_tid=[5291]}, 88) = 5291 [pid 5291] <... rseq resumed>) = 0 [pid 5290] rt_sigprocmask(SIG_SETMASK, [], [pid 5291] set_robust_list(0x7f4380f929a0, 24) = 0 [pid 5290] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5290] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5291] rt_sigprocmask(SIG_SETMASK, [], [pid 5290] <... futex resumed>) = 0 [pid 5291] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5290] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5290] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5290] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5291] memfd_create("syzkaller", 0 [pid 5290] <... mprotect resumed>) = 0 [pid 5290] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5290] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0}./strace-static-x86_64: Process 5292 attached [pid 5291] <... memfd_create resumed>) = 3 [pid 5291] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5292] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5290] <... clone3 resumed> => {parent_tid=[5292]}, 88) = 5292 [pid 5292] <... rseq resumed>) = 0 [pid 5291] <... mmap resumed>) = 0x7f4378b51000 [pid 5290] rt_sigprocmask(SIG_SETMASK, [], [pid 5292] set_robust_list(0x7f4380f719a0, 24 [pid 5290] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5292] <... set_robust_list resumed>) = 0 [pid 5290] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5292] rt_sigprocmask(SIG_SETMASK, [], [pid 5290] <... futex resumed>) = 0 [pid 5292] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5290] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5292] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 5292] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5290] <... futex resumed>) = 0 [pid 5292] <... futex resumed>) = 1 [pid 5290] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5292] fallocate(4, 0, 35143, 7 [pid 5290] <... futex resumed>) = 0 [pid 5290] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5291] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 5292] <... fallocate resumed>) = 0 [pid 5292] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5291] munmap(0x7f4378b51000, 262144 [pid 5292] <... futex resumed>) = 1 [pid 5290] <... futex resumed>) = 0 [pid 5292] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5290] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5292] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5290] <... futex resumed>) = 0 [pid 5292] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5290] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5292] <... mount resumed>) = 0 [pid 5292] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5290] <... futex resumed>) = 0 [pid 5292] <... futex resumed>) = 1 [pid 5290] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5292] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5290] <... futex resumed>) = 0 [pid 5290] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5292] <... open resumed>) = 5 [pid 5292] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5290] <... futex resumed>) = 0 [pid 5291] <... munmap resumed>) = 0 [pid 5292] <... futex resumed>) = 1 [pid 5291] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5290] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5292] write(5, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5290] <... futex resumed>) = 0 [ 53.907269][ T5033] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [pid 5292] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 5290] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5292] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5290] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5292] <... futex resumed>) = 0 [pid 5292] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5291] <... openat resumed>) = 6 [pid 5291] ioctl(6, LOOP_SET_FD, 3) = 0 [pid 5291] close(3) = 0 [pid 5291] mkdir("./file1", 0777) = 0 [ 53.968226][ T5291] loop0: detected capacity change from 0 to 512 [ 53.989986][ T5291] EXT4-fs (loop0): 1 orphan inode deleted [ 53.995734][ T5291] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [pid 5291] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue") = 0 [pid 5291] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5291] chdir("./file1") = 0 [pid 5291] ioctl(6, LOOP_CLR_FD) = 0 [pid 5291] close(6) = 0 [pid 5291] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5291] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5290] exit_group(0 [pid 5291] <... futex resumed>) = ? [pid 5292] <... futex resumed>) = ? [pid 5290] <... exit_group resumed>) = ? [pid 5292] +++ exited with 0 +++ [pid 5291] +++ exited with 0 +++ [pid 5290] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5290, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./68", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./68", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./68/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./68/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./68/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./68/bus") = 0 umount2("./68/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./68/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./68/binderfs") = 0 [ 54.008907][ T5291] ext4 filesystem being mounted at /root/syzkaller.F1Lso8/68/file1 supports timestamps until 2038-01-19 (0x7fffffff) umount2("./68/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./68/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./68/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./68/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./68/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./68/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./68") = 0 mkdir("./69", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556e0f690) = 5295 ./strace-static-x86_64: Process 5295 attached [pid 5295] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5295] chdir("./69") = 0 [pid 5295] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5295] setpgid(0, 0) = 0 [pid 5295] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5295] write(3, "1000", 4) = 4 [pid 5295] close(3) = 0 [pid 5295] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5295] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 54.040524][ T5033] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [pid 5295] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5295] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5295] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5295] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5295] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5295] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0} => {parent_tid=[5296]}, 88) = 5296 ./strace-static-x86_64: Process 5296 attached [pid 5296] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5295] rt_sigprocmask(SIG_SETMASK, [], [pid 5296] <... rseq resumed>) = 0 [pid 5296] set_robust_list(0x7f4380f929a0, 24 [pid 5295] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5296] <... set_robust_list resumed>) = 0 [pid 5296] rt_sigprocmask(SIG_SETMASK, [], [pid 5295] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5296] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5295] <... futex resumed>) = 0 [pid 5295] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5295] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5296] memfd_create("syzkaller", 0 [pid 5295] <... mmap resumed>) = 0x7f4380f51000 [pid 5295] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5295] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5296] <... memfd_create resumed>) = 3 [pid 5295] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} [pid 5296] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4378b51000 ./strace-static-x86_64: Process 5297 attached [pid 5297] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5295] <... clone3 resumed> => {parent_tid=[5297]}, 88) = 5297 [pid 5297] <... rseq resumed>) = 0 [pid 5295] rt_sigprocmask(SIG_SETMASK, [], [pid 5297] set_robust_list(0x7f4380f719a0, 24 [pid 5295] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5297] <... set_robust_list resumed>) = 0 [pid 5295] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5297] rt_sigprocmask(SIG_SETMASK, [], [pid 5295] <... futex resumed>) = 0 [pid 5297] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5295] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5297] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 5297] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5295] <... futex resumed>) = 0 [pid 5297] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5295] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5297] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5295] <... futex resumed>) = 0 [pid 5297] fallocate(4, 0, 35143, 7 [pid 5296] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5295] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5296] <... write resumed>) = 262144 [pid 5296] munmap(0x7f4378b51000, 262144) = 0 [pid 5296] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5296] ioctl(5, LOOP_SET_FD, 3 [pid 5297] <... fallocate resumed>) = 0 [pid 5297] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5297] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5295] <... futex resumed>) = 0 [pid 5295] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5297] <... futex resumed>) = 0 [pid 5297] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL) = 0 [pid 5297] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5297] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5295] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 5295] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5297] <... futex resumed>) = 0 [pid 5297] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 6 [pid 5297] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5297] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5295] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 5295] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5297] <... futex resumed>) = 0 [pid 5297] write(6, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5295] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5296] <... ioctl resumed>) = 0 [pid 5296] close(3) = 0 [pid 5296] mkdir("./file1", 0777) = 0 [pid 5296] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5297] <... write resumed>) = 262144 [pid 5297] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5295] <... futex resumed>) = 0 [pid 5297] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5296] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 5296] ioctl(5, LOOP_CLR_FD) = 0 [pid 5296] close(5) = 0 [pid 5296] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5296] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5295] exit_group(0 [pid 5297] <... futex resumed>) = ? [pid 5296] <... futex resumed>) = ? [pid 5297] +++ exited with 0 +++ [pid 5296] +++ exited with 0 +++ [pid 5295] <... exit_group resumed>) = ? [pid 5295] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5295, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./69", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./69", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./69/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./69/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./69/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./69/bus") = 0 umount2("./69/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./69/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./69/binderfs") = 0 umount2("./69/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./69/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./69/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./69/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./69/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 [ 54.115767][ T5296] loop0: detected capacity change from 0 to 512 [ 54.131710][ T5296] EXT4-fs (loop0): VFS: Can't find ext4 filesystem rmdir("./69") = 0 mkdir("./70", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5298 attached , child_tidptr=0x555556e0f690) = 5298 [pid 5298] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5298] chdir("./70") = 0 [pid 5298] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5298] setpgid(0, 0) = 0 [pid 5298] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5298] write(3, "1000", 4) = 4 [pid 5298] close(3) = 0 [pid 5298] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5298] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5298] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5298] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5298] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5298] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5298] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5298] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5299 attached => {parent_tid=[5299]}, 88) = 5299 [pid 5299] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5298] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5298] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5298] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5298] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5299] <... rseq resumed>) = 0 [pid 5298] <... mmap resumed>) = 0x7f4380f51000 [pid 5299] set_robust_list(0x7f4380f929a0, 24) = 0 [pid 5298] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5299] rt_sigprocmask(SIG_SETMASK, [], [pid 5298] <... mprotect resumed>) = 0 [pid 5299] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5298] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5299] memfd_create("syzkaller", 0 [pid 5298] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0}./strace-static-x86_64: Process 5300 attached [pid 5299] <... memfd_create resumed>) = 3 [pid 5299] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4378b51000 [pid 5300] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5298] <... clone3 resumed> => {parent_tid=[5300]}, 88) = 5300 [pid 5300] <... rseq resumed>) = 0 [pid 5299] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5298] rt_sigprocmask(SIG_SETMASK, [], [pid 5300] set_robust_list(0x7f4380f719a0, 24) = 0 [pid 5298] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5300] rt_sigprocmask(SIG_SETMASK, [], [pid 5298] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5300] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5298] <... futex resumed>) = 0 [pid 5300] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5298] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5300] <... open resumed>) = 4 [pid 5300] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5298] <... futex resumed>) = 0 [pid 5298] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5298] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5300] fallocate(4, 0, 35143, 7 [pid 5299] <... write resumed>) = 262144 [pid 5299] munmap(0x7f4378b51000, 262144) = 0 [pid 5299] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5299] ioctl(5, LOOP_SET_FD, 3 [pid 5300] <... fallocate resumed>) = 0 [pid 5300] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5299] <... ioctl resumed>) = 0 [pid 5300] <... futex resumed>) = 1 [pid 5299] close(3 [pid 5298] <... futex resumed>) = 0 [pid 5300] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5299] <... close resumed>) = 0 [pid 5298] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5300] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5299] mkdir("./file1", 0777 [pid 5298] <... futex resumed>) = 0 [pid 5300] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5299] <... mkdir resumed>) = 0 [pid 5298] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5299] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5300] <... mount resumed>) = 0 [pid 5300] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5300] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5298] <... futex resumed>) = 0 [pid 5298] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5300] <... futex resumed>) = 0 [pid 5298] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5300] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 3 [pid 5300] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5298] <... futex resumed>) = 0 [pid 5300] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL) = -1 EAGAIN (Resource temporarily unavailable) [pid 5298] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5300] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5298] <... futex resumed>) = 0 [pid 5298] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5300] <... write resumed>) = 262144 [pid 5300] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5298] <... futex resumed>) = 0 [pid 5300] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5299] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5299] ioctl(5, LOOP_CLR_FD) = 0 [pid 5299] close(5) = 0 [pid 5299] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5298] exit_group(0 [pid 5299] <... futex resumed>) = 0 [pid 5299] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5300] <... futex resumed>) = ? [pid 5299] <... futex resumed>) = ? [pid 5298] <... exit_group resumed>) = ? [pid 5300] +++ exited with 0 +++ [pid 5299] +++ exited with 0 +++ [pid 5298] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5298, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- umount2("./70", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./70", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./70/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./70/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./70/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./70/bus") = 0 umount2("./70/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./70/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./70/binderfs") = 0 umount2("./70/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./70/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./70/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./70/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./70/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./70") = 0 mkdir("./71", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5301 attached , child_tidptr=0x555556e0f690) = 5301 [pid 5301] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5301] chdir("./71") = 0 [pid 5301] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5301] setpgid(0, 0) = 0 [pid 5301] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5301] write(3, "1000", 4) = 4 [pid 5301] close(3) = 0 [pid 5301] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5301] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5301] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5301] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5301] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5301] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5301] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5301] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5302 attached => {parent_tid=[5302]}, 88) = 5302 [pid 5302] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5301] rt_sigprocmask(SIG_SETMASK, [], [pid 5302] <... rseq resumed>) = 0 [pid 5302] set_robust_list(0x7f4380f929a0, 24 [pid 5301] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5302] <... set_robust_list resumed>) = 0 [pid 5301] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5302] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5301] <... futex resumed>) = 0 [pid 5302] memfd_create("syzkaller", 0 [pid 5301] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5301] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5302] <... memfd_create resumed>) = 3 [pid 5301] <... mmap resumed>) = 0x7f4380f51000 [pid 5302] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4378b51000 [pid 5301] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5302] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5301] <... mprotect resumed>) = 0 [ 54.219634][ T5299] loop0: detected capacity change from 0 to 512 [ 54.237294][ T5299] EXT4-fs warning (device loop0): read_mmp_block:114: Error -117 while reading MMP block 8 [pid 5301] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5302] <... write resumed>) = 262144 [pid 5301] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5301] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} => {parent_tid=[5303]}, 88) = 5303 [pid 5301] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5301] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5301] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5302] munmap(0x7f4378b51000, 262144) = 0 [pid 5302] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5302] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 5303 attached [pid 5303] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5302] <... ioctl resumed>) = 0 [pid 5302] close(3) = 0 [pid 5302] mkdir("./file1", 0777) = 0 [pid 5302] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5303] <... rseq resumed>) = 0 [pid 5303] set_robust_list(0x7f4380f719a0, 24) = 0 [pid 5303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5303] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 3 [pid 5303] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5301] <... futex resumed>) = 0 [pid 5301] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5301] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5303] fallocate(3, 0, 35143, 7) = 0 [pid 5303] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5301] <... futex resumed>) = 0 [pid 5303] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5301] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5303] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5301] <... futex resumed>) = 0 [pid 5303] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5301] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5303] <... mount resumed>) = 0 [pid 5303] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5301] <... futex resumed>) = 0 [pid 5301] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5303] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5301] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5303] <... open resumed>) = 5 [pid 5303] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5301] <... futex resumed>) = 0 [pid 5303] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL) = -1 EAGAIN (Resource temporarily unavailable) [pid 5301] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5303] write(5, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5301] <... futex resumed>) = 0 [pid 5301] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5303] <... write resumed>) = 262144 [pid 5303] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5303] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5301] <... futex resumed>) = 0 [ 54.280310][ T5302] loop0: detected capacity change from 0 to 512 [ 54.299549][ T5304] EXT4-fs warning (device loop0): kmmpd:167: kmmpd being stopped since MMP feature has been disabled. [ 54.300582][ T5302] EXT4-fs error (device loop0): __ext4_fill_super:5473: comm syz-executor369: inode #2: comm syz-executor369: iget: illegal inode # [ 54.324577][ T5302] EXT4-fs (loop0): get root inode failed [pid 5302] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5302] ioctl(4, LOOP_CLR_FD) = 0 [pid 5302] close(4) = 0 [pid 5302] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5302] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5301] exit_group(0 [pid 5303] <... futex resumed>) = ? [pid 5303] +++ exited with 0 +++ [pid 5301] <... exit_group resumed>) = ? [pid 5302] <... futex resumed>) = ? [pid 5302] +++ exited with 0 +++ [pid 5301] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5301, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./71", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./71", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./71/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./71/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./71/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./71/bus") = 0 umount2("./71/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./71/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./71/binderfs") = 0 umount2("./71/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./71/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./71/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./71/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./71/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./71") = 0 mkdir("./72", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5306 attached , child_tidptr=0x555556e0f690) = 5306 [pid 5306] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5306] chdir("./72") = 0 [pid 5306] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5306] setpgid(0, 0) = 0 [ 54.330279][ T5302] EXT4-fs (loop0): mount failed [pid 5306] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5306] write(3, "1000", 4) = 4 [pid 5306] close(3) = 0 [pid 5306] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5306] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5306] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5306] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5306] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5306] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5306] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5306] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5307 attached => {parent_tid=[5307]}, 88) = 5307 [pid 5307] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053) = 0 [pid 5306] rt_sigprocmask(SIG_SETMASK, [], [pid 5307] set_robust_list(0x7f4380f929a0, 24) = 0 [pid 5306] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5307] rt_sigprocmask(SIG_SETMASK, [], [pid 5306] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5307] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5306] <... futex resumed>) = 0 [pid 5307] memfd_create("syzkaller", 0 [pid 5306] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5306] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5307] <... memfd_create resumed>) = 3 [pid 5306] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5307] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5306] <... mprotect resumed>) = 0 [pid 5307] <... mmap resumed>) = 0x7f4378b51000 [pid 5306] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5307] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5306] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5306] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} => {parent_tid=[5308]}, 88) = 5308 [pid 5306] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5306] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5306] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5307] <... write resumed>) = 262144 [pid 5307] munmap(0x7f4378b51000, 262144) = 0 [pid 5307] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5307] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 5308 attached [pid 5308] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053) = 0 [pid 5308] set_robust_list(0x7f4380f719a0, 24) = 0 [pid 5308] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5308] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5 [pid 5308] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5308] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5307] <... ioctl resumed>) = 0 [pid 5306] <... futex resumed>) = 0 [pid 5307] close(3 [pid 5306] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5307] <... close resumed>) = 0 [pid 5308] <... futex resumed>) = 0 [pid 5306] <... futex resumed>) = 1 [pid 5308] fallocate(5, 0, 35143, 7 [pid 5307] mkdir("./file1", 0777 [pid 5306] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5307] <... mkdir resumed>) = 0 [pid 5307] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5308] <... fallocate resumed>) = 0 [pid 5308] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5306] <... futex resumed>) = 0 [pid 5308] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5306] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5308] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5306] <... futex resumed>) = 0 [pid 5308] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5306] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5308] <... mount resumed>) = 0 [pid 5308] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5306] <... futex resumed>) = 0 [pid 5308] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5306] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5308] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5306] <... futex resumed>) = 0 [pid 5308] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5306] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5308] <... open resumed>) = 3 [pid 5308] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5306] <... futex resumed>) = 0 [pid 5308] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5306] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5308] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5306] <... futex resumed>) = 0 [pid 5308] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5306] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5308] <... write resumed>) = 262144 [pid 5308] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5306] <... futex resumed>) = 0 [ 54.377710][ T5307] loop0: detected capacity change from 0 to 512 [ 54.412764][ T5309] EXT4-fs warning (device loop0): kmmpd:167: kmmpd being stopped since MMP feature has been disabled. [pid 5308] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5307] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5307] ioctl(4, LOOP_CLR_FD) = 0 [pid 5307] close(4) = 0 [pid 5307] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5307] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5306] exit_group(0) = ? [pid 5308] <... futex resumed>) = ? [pid 5308] +++ exited with 0 +++ [pid 5307] <... futex resumed>) = ? [pid 5307] +++ exited with 0 +++ [pid 5306] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5306, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- umount2("./72", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./72", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./72/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./72/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./72/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./72/bus") = 0 umount2("./72/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./72/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./72/binderfs") = 0 umount2("./72/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./72/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./72/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./72/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./72/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./72") = 0 mkdir("./73", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5311 attached , child_tidptr=0x555556e0f690) = 5311 [pid 5311] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5311] chdir("./73") = 0 [ 54.423778][ T5307] EXT4-fs error (device loop0): __ext4_fill_super:5473: comm syz-executor369: inode #2: comm syz-executor369: iget: illegal inode # [ 54.437977][ T5307] EXT4-fs (loop0): get root inode failed [ 54.443629][ T5307] EXT4-fs (loop0): mount failed [pid 5311] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5311] setpgid(0, 0) = 0 [pid 5311] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5311] write(3, "1000", 4) = 4 [pid 5311] close(3) = 0 [pid 5311] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5311] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5311] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5311] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5311] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5311] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5311] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5311] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5312 attached => {parent_tid=[5312]}, 88) = 5312 [pid 5312] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5311] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5311] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5311] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5311] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5311] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5312] <... rseq resumed>) = 0 [pid 5311] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5312] set_robust_list(0x7f4380f929a0, 24 [pid 5311] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5312] <... set_robust_list resumed>) = 0 [pid 5311] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} [pid 5312] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ./strace-static-x86_64: Process 5313 attached [pid 5312] memfd_create("syzkaller", 0 [pid 5313] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5312] <... memfd_create resumed>) = 3 [pid 5311] <... clone3 resumed> => {parent_tid=[5313]}, 88) = 5313 [pid 5313] <... rseq resumed>) = 0 [pid 5312] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5311] rt_sigprocmask(SIG_SETMASK, [], [pid 5313] set_robust_list(0x7f4380f719a0, 24 [pid 5312] <... mmap resumed>) = 0x7f4378b51000 [pid 5311] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5313] <... set_robust_list resumed>) = 0 [pid 5312] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5311] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5313] rt_sigprocmask(SIG_SETMASK, [], [pid 5311] <... futex resumed>) = 0 [pid 5313] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5311] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5313] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 5313] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5311] <... futex resumed>) = 0 [pid 5313] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5312] <... write resumed>) = 262144 [pid 5311] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5313] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5311] <... futex resumed>) = 0 [pid 5313] fallocate(4, 0, 35143, 7 [pid 5311] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5312] munmap(0x7f4378b51000, 262144) = 0 [pid 5312] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5312] ioctl(5, LOOP_SET_FD, 3 [pid 5313] <... fallocate resumed>) = 0 [pid 5313] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5311] <... futex resumed>) = 0 [pid 5313] <... futex resumed>) = 1 [pid 5311] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5313] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5311] <... futex resumed>) = 0 [pid 5312] <... ioctl resumed>) = 0 [pid 5312] close(3) = 0 [pid 5312] mkdir("./file1", 0777 [pid 5313] <... mount resumed>) = 0 [pid 5311] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5313] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5311] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5313] <... futex resumed>) = 0 [pid 5311] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5313] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5311] <... futex resumed>) = 0 [pid 5311] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5313] <... open resumed>) = 3 [pid 5313] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5311] <... futex resumed>) = 0 [pid 5313] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5311] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5311] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5313] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5312] <... mkdir resumed>) = 0 [pid 5312] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5313] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190) = 262144 [pid 5313] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5311] <... futex resumed>) = 0 [pid 5313] <... futex resumed>) = 1 [pid 5313] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5312] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 5312] ioctl(5, LOOP_CLR_FD) = 0 [pid 5312] close(5) = 0 [pid 5312] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5311] exit_group(0 [pid 5312] <... futex resumed>) = 0 [pid 5312] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5313] <... futex resumed>) = ? [pid 5311] <... exit_group resumed>) = ? [pid 5312] <... futex resumed>) = ? [pid 5313] +++ exited with 0 +++ [pid 5312] +++ exited with 0 +++ [pid 5311] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5311, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./73", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./73", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./73/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./73/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./73/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./73/bus") = 0 umount2("./73/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./73/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./73/binderfs") = 0 umount2("./73/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./73/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./73/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./73/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./73/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./73") = 0 mkdir("./74", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5314 attached , child_tidptr=0x555556e0f690) = 5314 [pid 5314] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5314] chdir("./74") = 0 [pid 5314] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5314] setpgid(0, 0) = 0 [pid 5314] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5314] write(3, "1000", 4) = 4 [pid 5314] close(3) = 0 [pid 5314] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5314] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5314] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5314] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [ 54.512123][ T5312] loop0: detected capacity change from 0 to 512 [ 54.527885][ T5312] EXT4-fs (loop0): VFS: Can't find ext4 filesystem [pid 5314] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5314] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5314] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5314] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5315 attached [pid 5315] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053) = 0 [pid 5314] <... clone3 resumed> => {parent_tid=[5315]}, 88) = 5315 [pid 5315] set_robust_list(0x7f4380f929a0, 24 [pid 5314] rt_sigprocmask(SIG_SETMASK, [], [pid 5315] <... set_robust_list resumed>) = 0 [pid 5314] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5315] rt_sigprocmask(SIG_SETMASK, [], [pid 5314] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5315] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5314] <... futex resumed>) = 0 [pid 5315] memfd_create("syzkaller", 0 [pid 5314] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5315] <... memfd_create resumed>) = 3 [pid 5314] <... futex resumed>) = 0 [pid 5315] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5314] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5315] <... mmap resumed>) = 0x7f4378b51000 [pid 5314] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5315] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5314] <... mprotect resumed>) = 0 [pid 5314] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5314] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0}./strace-static-x86_64: Process 5316 attached [pid 5316] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053) = 0 [pid 5314] <... clone3 resumed> => {parent_tid=[5316]}, 88) = 5316 [pid 5316] set_robust_list(0x7f4380f719a0, 24 [pid 5314] rt_sigprocmask(SIG_SETMASK, [], [pid 5316] <... set_robust_list resumed>) = 0 [pid 5314] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5316] rt_sigprocmask(SIG_SETMASK, [], [pid 5314] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5316] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5314] <... futex resumed>) = 0 [pid 5315] <... write resumed>) = 262144 [pid 5315] munmap(0x7f4378b51000, 262144 [pid 5316] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5314] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5315] <... munmap resumed>) = 0 [pid 5315] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5315] ioctl(5, LOOP_SET_FD, 3 [pid 5316] <... open resumed>) = 4 [pid 5316] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5315] <... ioctl resumed>) = 0 [pid 5315] close(3) = 0 [pid 5315] mkdir("./file1", 0777) = 0 [pid 5315] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5316] <... futex resumed>) = 1 [pid 5314] <... futex resumed>) = 0 [pid 5316] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5314] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5316] <... futex resumed>) = 0 [pid 5314] <... futex resumed>) = 1 [pid 5316] fallocate(4, 0, 35143, 7 [pid 5314] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5316] <... fallocate resumed>) = 0 [pid 5316] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5314] <... futex resumed>) = 0 [pid 5316] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5314] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5316] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5314] <... futex resumed>) = 0 [pid 5316] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5314] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5316] <... mount resumed>) = 0 [pid 5316] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5314] <... futex resumed>) = 0 [pid 5316] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5314] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5316] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5316] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5314] <... futex resumed>) = 0 [pid 5316] <... open resumed>) = 3 [pid 5314] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5316] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5314] <... futex resumed>) = 0 [pid 5316] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5314] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5316] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5316] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5314] <... futex resumed>) = 0 [pid 5314] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5316] <... write resumed>) = 262144 [pid 5316] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5314] <... futex resumed>) = 0 [pid 5316] <... futex resumed>) = 1 [pid 5316] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5315] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5315] ioctl(5, LOOP_CLR_FD) = 0 [pid 5315] close(5) = 0 [pid 5315] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5315] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5314] exit_group(0 [pid 5316] <... futex resumed>) = ? [pid 5315] <... futex resumed>) = ? [pid 5314] <... exit_group resumed>) = ? [pid 5316] +++ exited with 0 +++ [pid 5315] +++ exited with 0 +++ [pid 5314] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5314, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./74", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./74", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./74/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./74/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./74/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./74/bus") = 0 umount2("./74/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./74/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./74/binderfs") = 0 umount2("./74/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./74/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./74/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./74/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./74/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./74") = 0 mkdir("./75", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556e0f690) = 5319 ./strace-static-x86_64: Process 5319 attached [pid 5319] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5319] chdir("./75") = 0 [pid 5319] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5319] setpgid(0, 0) = 0 [pid 5319] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5319] write(3, "1000", 4) = 4 [ 54.590088][ T5315] loop0: detected capacity change from 0 to 512 [ 54.611184][ T5315] EXT4-fs error (device loop0): __ext4_fill_super:5473: comm syz-executor369: inode #2: comm syz-executor369: iget: illegal inode # [ 54.625537][ T5315] EXT4-fs (loop0): get root inode failed [ 54.631714][ T5315] EXT4-fs (loop0): mount failed [pid 5319] close(3) = 0 [pid 5319] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5319] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5319] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5319] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5319] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5319] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5319] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5319] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5320 attached => {parent_tid=[5320]}, 88) = 5320 [pid 5319] rt_sigprocmask(SIG_SETMASK, [], [pid 5320] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053) = 0 [pid 5320] set_robust_list(0x7f4380f929a0, 24) = 0 [pid 5320] rt_sigprocmask(SIG_SETMASK, [], [pid 5319] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5319] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5320] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5319] <... futex resumed>) = 0 [pid 5320] memfd_create("syzkaller", 0) = 3 [pid 5319] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5320] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5319] <... futex resumed>) = 0 [pid 5320] <... mmap resumed>) = 0x7f4378b72000 [pid 5319] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4378b51000 [pid 5319] mprotect(0x7f4378b52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5319] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5319] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4378b71990, parent_tid=0x7f4378b71990, exit_signal=0, stack=0x7f4378b51000, stack_size=0x20300, tls=0x7f4378b716c0}./strace-static-x86_64: Process 5321 attached [pid 5321] rseq(0x7f4378b71fe0, 0x20, 0, 0x53053053 [pid 5319] <... clone3 resumed> => {parent_tid=[5321]}, 88) = 5321 [pid 5321] <... rseq resumed>) = 0 [pid 5319] rt_sigprocmask(SIG_SETMASK, [], [pid 5321] set_robust_list(0x7f4378b719a0, 24 [pid 5319] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5321] <... set_robust_list resumed>) = 0 [pid 5319] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5321] rt_sigprocmask(SIG_SETMASK, [], [pid 5319] <... futex resumed>) = 0 [pid 5319] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5321] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5321] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 5320] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5321] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5320] <... write resumed>) = 262144 [pid 5319] <... futex resumed>) = 0 [pid 5321] fallocate(4, 0, 35143, 7 [pid 5320] munmap(0x7f4378b72000, 262144 [pid 5319] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5320] <... munmap resumed>) = 0 [pid 5319] <... futex resumed>) = 0 [pid 5319] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5320] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5320] ioctl(5, LOOP_SET_FD, 3 [pid 5321] <... fallocate resumed>) = 0 [pid 5321] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5319] <... futex resumed>) = 0 [pid 5321] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5319] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5321] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5319] <... futex resumed>) = 0 [pid 5319] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5321] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL) = 0 [pid 5320] <... ioctl resumed>) = 0 [pid 5320] close(3) = 0 [pid 5321] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5319] <... futex resumed>) = 0 [pid 5321] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5319] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5321] <... open resumed>) = 3 [pid 5320] mkdir("./file1", 0777 [pid 5319] <... futex resumed>) = 0 [pid 5321] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5319] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5321] <... futex resumed>) = 0 [pid 5319] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5321] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5320] <... mkdir resumed>) = 0 [pid 5319] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5321] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5321] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5319] <... futex resumed>) = 0 [pid 5320] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5319] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5321] <... write resumed>) = 262144 [pid 5321] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5321] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5319] <... futex resumed>) = 0 [pid 5320] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5320] ioctl(5, LOOP_CLR_FD) = 0 [pid 5320] close(5) = 0 [pid 5320] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5319] exit_group(0) = ? [pid 5320] +++ exited with 0 +++ [pid 5321] <... futex resumed>) = ? [pid 5321] +++ exited with 0 +++ [pid 5319] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5319, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- umount2("./75", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./75", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./75/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./75/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./75/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./75/bus") = 0 umount2("./75/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./75/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./75/binderfs") = 0 umount2("./75/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./75/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./75/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./75/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./75/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./75") = 0 mkdir("./76", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556e0f690) = 5322 [ 54.694786][ T5320] loop0: detected capacity change from 0 to 512 [ 54.719926][ T5320] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 54.729711][ T5320] EXT4-fs (loop0): group descriptors corrupted! ./strace-static-x86_64: Process 5322 attached [pid 5322] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5322] chdir("./76") = 0 [pid 5322] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5322] setpgid(0, 0) = 0 [pid 5322] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5322] write(3, "1000", 4) = 4 [pid 5322] close(3) = 0 [pid 5322] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5322] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5322] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5322] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5322] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5322] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5322] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5322] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5323 attached [pid 5323] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5322] <... clone3 resumed> => {parent_tid=[5323]}, 88) = 5323 [pid 5323] <... rseq resumed>) = 0 [pid 5322] rt_sigprocmask(SIG_SETMASK, [], [pid 5323] set_robust_list(0x7f4380f929a0, 24 [pid 5322] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5323] <... set_robust_list resumed>) = 0 [pid 5322] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5323] rt_sigprocmask(SIG_SETMASK, [], [pid 5322] <... futex resumed>) = 0 [pid 5323] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5322] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5323] memfd_create("syzkaller", 0 [pid 5322] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5322] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5323] <... memfd_create resumed>) = 3 [pid 5323] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5322] <... mprotect resumed>) = 0 [pid 5323] <... mmap resumed>) = 0x7f4378b51000 [pid 5322] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5323] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5322] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} => {parent_tid=[5324]}, 88) = 5324 ./strace-static-x86_64: Process 5324 attached [pid 5322] rt_sigprocmask(SIG_SETMASK, [], [pid 5324] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053) = 0 [pid 5324] set_robust_list(0x7f4380f719a0, 24) = 0 [pid 5324] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5324] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5322] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5322] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5324] <... futex resumed>) = 0 [pid 5323] <... write resumed>) = 262144 [pid 5322] <... futex resumed>) = 1 [pid 5324] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5322] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5323] munmap(0x7f4378b51000, 262144) = 0 [pid 5323] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5323] ioctl(5, LOOP_SET_FD, 3 [pid 5324] <... open resumed>) = 4 [pid 5324] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5323] <... ioctl resumed>) = 0 [pid 5324] <... futex resumed>) = 1 [pid 5323] close(3 [pid 5322] <... futex resumed>) = 0 [pid 5323] <... close resumed>) = 0 [pid 5323] mkdir("./file1", 0777 [pid 5324] fallocate(4, 0, 35143, 7 [pid 5323] <... mkdir resumed>) = 0 [pid 5322] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5323] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5322] <... futex resumed>) = 0 [pid 5322] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5324] <... fallocate resumed>) = 0 [pid 5324] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5322] <... futex resumed>) = 0 [pid 5324] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5322] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5324] <... mount resumed>) = 0 [pid 5322] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5324] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5322] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5324] <... futex resumed>) = 0 [pid 5322] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5324] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5322] <... futex resumed>) = 0 [pid 5324] <... open resumed>) = 3 [pid 5322] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5324] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5322] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5324] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5322] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5324] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5322] <... futex resumed>) = 0 [pid 5324] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5322] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5324] <... write resumed>) = 262144 [pid 5324] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5323] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5324] <... futex resumed>) = 1 [pid 5324] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5322] <... futex resumed>) = 0 [pid 5323] ioctl(5, LOOP_CLR_FD) = 0 [pid 5323] close(5) = 0 [pid 5323] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5323] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5322] exit_group(0 [pid 5324] <... futex resumed>) = ? [pid 5324] +++ exited with 0 +++ [pid 5323] <... futex resumed>) = ? [pid 5322] <... exit_group resumed>) = ? [pid 5323] +++ exited with 0 +++ [pid 5322] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5322, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./76", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./76", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./76/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./76/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./76/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./76/bus") = 0 umount2("./76/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./76/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./76/binderfs") = 0 umount2("./76/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./76/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./76/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./76/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./76/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./76") = 0 mkdir("./77", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556e0f690) = 5325 ./strace-static-x86_64: Process 5325 attached [pid 5325] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5325] chdir("./77") = 0 [pid 5325] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5325] setpgid(0, 0) = 0 [pid 5325] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5325] write(3, "1000", 4) = 4 [pid 5325] close(3) = 0 [pid 5325] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5325] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5325] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5325] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5325] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5325] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5325] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5325] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0} => {parent_tid=[5326]}, 88) = 5326 [pid 5325] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5325] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5325] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5325] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0./strace-static-x86_64: Process 5326 attached ) = 0x7f4380f51000 [pid 5326] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053) = 0 [pid 5325] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5326] set_robust_list(0x7f4380f929a0, 24 [pid 5325] <... mprotect resumed>) = 0 [pid 5326] <... set_robust_list resumed>) = 0 [pid 5326] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5325] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5326] memfd_create("syzkaller", 0 [pid 5325] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} [pid 5326] <... memfd_create resumed>) = 3 [pid 5326] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0./strace-static-x86_64: Process 5327 attached [pid 5325] <... clone3 resumed> => {parent_tid=[5327]}, 88) = 5327 [pid 5327] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5326] <... mmap resumed>) = 0x7f4378b51000 [pid 5325] rt_sigprocmask(SIG_SETMASK, [], [pid 5327] <... rseq resumed>) = 0 [pid 5327] set_robust_list(0x7f4380f719a0, 24 [pid 5325] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5327] <... set_robust_list resumed>) = 0 [pid 5325] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5327] rt_sigprocmask(SIG_SETMASK, [], [pid 5325] <... futex resumed>) = 0 [pid 5327] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5327] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5325] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5327] <... open resumed>) = 4 [pid 5327] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5325] <... futex resumed>) = 0 [pid 5327] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL) = -1 EAGAIN (Resource temporarily unavailable) [pid 5325] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5327] fallocate(4, 0, 35143, 7 [pid 5325] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5326] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 5327] <... fallocate resumed>) = 0 [pid 5327] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5326] munmap(0x7f4378b51000, 262144 [pid 5325] <... futex resumed>) = 0 [pid 5327] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [ 54.798182][ T5323] loop0: detected capacity change from 0 to 512 [ 54.817021][ T5323] EXT4-fs warning (device loop0): read_mmp_block:114: Error -117 while reading MMP block 8 [pid 5325] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5327] <... mount resumed>) = 0 [pid 5326] <... munmap resumed>) = 0 [pid 5325] <... futex resumed>) = 0 [pid 5326] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5325] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5327] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5326] <... openat resumed>) = 5 [pid 5326] ioctl(5, LOOP_SET_FD, 3 [pid 5325] <... futex resumed>) = 0 [pid 5327] <... futex resumed>) = 1 [pid 5325] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5327] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5325] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5327] <... open resumed>) = 6 [pid 5327] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5325] <... futex resumed>) = 0 [pid 5325] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5327] <... futex resumed>) = 1 [pid 5325] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5327] write(6, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5326] <... ioctl resumed>) = 0 [pid 5326] close(3) = 0 [pid 5326] mkdir("./file1", 0777) = 0 [pid 5326] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5327] <... write resumed>) = -1 EIO (Input/output error) [pid 5327] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5325] <... futex resumed>) = 0 [pid 5327] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5326] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 5326] ioctl(5, LOOP_CLR_FD) = 0 [pid 5326] close(5) = 0 [pid 5326] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5326] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5325] exit_group(0 [pid 5326] <... futex resumed>) = ? [pid 5325] <... exit_group resumed>) = ? [pid 5326] +++ exited with 0 +++ [pid 5327] <... futex resumed>) = ? [pid 5327] +++ exited with 0 +++ [pid 5325] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5325, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- umount2("./77", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./77", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./77/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./77/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./77/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./77/bus") = 0 umount2("./77/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./77/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./77/binderfs") = 0 umount2("./77/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./77/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./77/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./77/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./77/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./77") = 0 mkdir("./78", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556e0f690) = 5328 ./strace-static-x86_64: Process 5328 attached [pid 5328] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5328] chdir("./78") = 0 [pid 5328] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5328] setpgid(0, 0) = 0 [pid 5328] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5328] write(3, "1000", 4) = 4 [pid 5328] close(3) = 0 [pid 5328] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5328] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5328] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [ 54.879562][ T5326] loop0: detected capacity change from 0 to 512 [ 54.884114][ T5327] I/O error, dev loop0, sector 248 op 0x1:(WRITE) flags 0x800 phys_seg 1 prio class 2 [ 54.895747][ T5327] Buffer I/O error on dev loop0, logical block 31, lost async page write [ 54.907712][ T5326] EXT4-fs (loop0): VFS: Can't find ext4 filesystem [pid 5328] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5328] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5328] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5328] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5328] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5329 attached [pid 5329] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5328] <... clone3 resumed> => {parent_tid=[5329]}, 88) = 5329 [pid 5329] <... rseq resumed>) = 0 [pid 5328] rt_sigprocmask(SIG_SETMASK, [], [pid 5329] set_robust_list(0x7f4380f929a0, 24 [pid 5328] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5329] <... set_robust_list resumed>) = 0 [pid 5328] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5329] rt_sigprocmask(SIG_SETMASK, [], [pid 5328] <... futex resumed>) = 0 [pid 5329] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5328] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5329] memfd_create("syzkaller", 0 [pid 5328] <... futex resumed>) = 0 [pid 5329] <... memfd_create resumed>) = 3 [pid 5329] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4378b72000 [pid 5328] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5329] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5328] <... mmap resumed>) = 0x7f4378b51000 [pid 5328] mprotect(0x7f4378b52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5328] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5328] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4378b71990, parent_tid=0x7f4378b71990, exit_signal=0, stack=0x7f4378b51000, stack_size=0x20300, tls=0x7f4378b716c0}./strace-static-x86_64: Process 5330 attached [pid 5330] rseq(0x7f4378b71fe0, 0x20, 0, 0x53053053 [pid 5328] <... clone3 resumed> => {parent_tid=[5330]}, 88) = 5330 [pid 5330] <... rseq resumed>) = 0 [pid 5330] set_robust_list(0x7f4378b719a0, 24 [pid 5328] rt_sigprocmask(SIG_SETMASK, [], [pid 5330] <... set_robust_list resumed>) = 0 [pid 5328] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5330] rt_sigprocmask(SIG_SETMASK, [], [pid 5328] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5330] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5330] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5328] <... futex resumed>) = 0 [pid 5328] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5330] <... open resumed>) = 4 [pid 5330] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5328] <... futex resumed>) = 0 [pid 5328] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5330] <... futex resumed>) = 1 [pid 5328] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5330] fallocate(4, 0, 35143, 7 [pid 5329] <... write resumed>) = 262144 [pid 5329] munmap(0x7f4378b72000, 262144) = 0 [pid 5329] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5329] ioctl(5, LOOP_SET_FD, 3 [pid 5330] <... fallocate resumed>) = 0 [pid 5330] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5330] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5328] <... futex resumed>) = 0 [pid 5328] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5330] <... futex resumed>) = 0 [pid 5328] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5330] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL) = 0 [pid 5330] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5328] <... futex resumed>) = 0 [pid 5330] <... futex resumed>) = 1 [pid 5328] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5330] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5328] <... futex resumed>) = 0 [pid 5330] <... open resumed>) = 6 [pid 5328] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5330] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5328] <... futex resumed>) = 0 [pid 5328] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5330] <... futex resumed>) = 1 [pid 5328] <... futex resumed>) = 0 [pid 5330] write(6, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5328] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5329] <... ioctl resumed>) = 0 [pid 5329] close(3) = 0 [pid 5329] mkdir("./file1", 0777) = 0 [pid 5329] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5330] <... write resumed>) = -1 EIO (Input/output error) [pid 5330] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5328] <... futex resumed>) = 0 [pid 5330] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5329] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 5329] ioctl(5, LOOP_CLR_FD) = 0 [pid 5329] close(5) = 0 [pid 5329] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5329] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5328] exit_group(0) = ? [pid 5330] <... futex resumed>) = ? [pid 5329] <... futex resumed>) = ? [pid 5330] +++ exited with 0 +++ [pid 5329] +++ exited with 0 +++ [pid 5328] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5328, si_uid=0, si_status=0, si_utime=0, si_stime=6 /* 0.06 s */} --- umount2("./78", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./78", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./78/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./78/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./78/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./78/bus") = 0 umount2("./78/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./78/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./78/binderfs") = 0 umount2("./78/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./78/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./78/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./78/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./78/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./78") = 0 mkdir("./79", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556e0f690) = 5331 ./strace-static-x86_64: Process 5331 attached [pid 5331] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5331] chdir("./79") = 0 [pid 5331] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5331] setpgid(0, 0) = 0 [pid 5331] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5331] write(3, "1000", 4) = 4 [ 54.973986][ T5329] loop0: detected capacity change from 0 to 512 [ 54.980200][ T5330] I/O error, dev loop0, sector 248 op 0x1:(WRITE) flags 0x800 phys_seg 1 prio class 2 [ 54.989924][ T5330] Buffer I/O error on dev loop0, logical block 31, lost async page write [ 55.001325][ T5329] EXT4-fs (loop0): VFS: Can't find ext4 filesystem [pid 5331] close(3) = 0 [pid 5331] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5331] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5331] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5331] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5331] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5331] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5331] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5331] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5332 attached [pid 5332] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5331] <... clone3 resumed> => {parent_tid=[5332]}, 88) = 5332 [pid 5332] <... rseq resumed>) = 0 [pid 5331] rt_sigprocmask(SIG_SETMASK, [], [pid 5332] set_robust_list(0x7f4380f929a0, 24 [pid 5331] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5332] <... set_robust_list resumed>) = 0 [pid 5331] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5332] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5331] <... futex resumed>) = 0 [pid 5332] memfd_create("syzkaller", 0 [pid 5331] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5331] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5332] <... memfd_create resumed>) = 3 [pid 5332] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5331] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5332] <... mmap resumed>) = 0x7f4378b51000 [pid 5331] <... mprotect resumed>) = 0 [pid 5331] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5331] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} => {parent_tid=[5333]}, 88) = 5333 [pid 5331] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5331] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5332] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144./strace-static-x86_64: Process 5333 attached [pid 5331] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5333] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053) = 0 [pid 5333] set_robust_list(0x7f4380f719a0, 24) = 0 [pid 5333] rt_sigprocmask(SIG_SETMASK, [], [pid 5332] <... write resumed>) = 262144 [pid 5333] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5332] munmap(0x7f4378b51000, 262144 [pid 5333] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5332] <... munmap resumed>) = 0 [pid 5332] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5332] ioctl(4, LOOP_SET_FD, 3 [pid 5333] <... open resumed>) = 5 [pid 5333] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5332] <... ioctl resumed>) = 0 [pid 5333] <... futex resumed>) = 1 [pid 5331] <... futex resumed>) = 0 [pid 5333] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5331] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5333] <... futex resumed>) = 0 [pid 5331] <... futex resumed>) = 1 [pid 5333] fallocate(5, 0, 35143, 7 [pid 5331] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5332] close(3) = 0 [pid 5332] mkdir("./file1", 0777) = 0 [pid 5332] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5333] <... fallocate resumed>) = 0 [pid 5333] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5331] <... futex resumed>) = 0 [pid 5331] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5331] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5333] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL) = 0 [pid 5333] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5331] <... futex resumed>) = 0 [pid 5331] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5331] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5333] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 3 [pid 5333] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5331] <... futex resumed>) = 0 [pid 5331] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5331] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5333] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190) = 262144 [pid 5333] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5331] <... futex resumed>) = 0 [ 55.066565][ T5332] loop0: detected capacity change from 0 to 512 [ 55.082677][ T5332] EXT4-fs error (device loop0): ext4_map_blocks:577: inode #3: block 9: comm syz-executor369: lblock 0 mapped to illegal pblock 9 (length 1) [ 55.098220][ T5332] EXT4-fs warning (device loop0): ext4_enable_quotas:7078: Failed to enable quota tracking (type=0, err=-117, ino=3). Please run e2fsck to fix. [pid 5333] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5332] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5332] ioctl(4, LOOP_CLR_FD) = 0 [pid 5332] close(4) = 0 [pid 5332] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5332] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5331] exit_group(0 [pid 5333] <... futex resumed>) = ? [pid 5331] <... exit_group resumed>) = ? [pid 5333] +++ exited with 0 +++ [pid 5332] <... futex resumed>) = ? [pid 5332] +++ exited with 0 +++ [pid 5331] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5331, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- umount2("./79", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./79", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./79/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./79/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./79/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./79/bus") = 0 umount2("./79/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./79/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./79/binderfs") = 0 umount2("./79/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./79/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./79/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./79/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./79/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./79") = 0 mkdir("./80", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5336 attached , child_tidptr=0x555556e0f690) = 5336 [pid 5336] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5336] chdir("./80") = 0 [pid 5336] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [ 55.113993][ T5332] EXT4-fs (loop0): mount failed [pid 5336] setpgid(0, 0) = 0 [pid 5336] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5336] write(3, "1000", 4) = 4 [pid 5336] close(3) = 0 [pid 5336] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5336] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5336] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5336] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5336] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5336] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5336] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5336] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0} => {parent_tid=[5337]}, 88) = 5337 ./strace-static-x86_64: Process 5337 attached [pid 5336] rt_sigprocmask(SIG_SETMASK, [], [pid 5337] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5336] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5337] <... rseq resumed>) = 0 [pid 5337] set_robust_list(0x7f4380f929a0, 24) = 0 [pid 5337] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5336] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5336] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5336] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5337] memfd_create("syzkaller", 0 [pid 5336] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5336] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5337] <... memfd_create resumed>) = 3 [pid 5336] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0}./strace-static-x86_64: Process 5338 attached => {parent_tid=[5338]}, 88) = 5338 [pid 5338] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5336] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5336] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5336] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5338] <... rseq resumed>) = 0 [pid 5338] set_robust_list(0x7f4380f719a0, 24) = 0 [pid 5338] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5338] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5337] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4378b51000 [pid 5338] <... open resumed>) = 4 [pid 5338] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5336] <... futex resumed>) = 0 [pid 5336] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5336] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5338] <... futex resumed>) = 1 [pid 5338] fallocate(4, 0, 35143, 7 [pid 5337] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 5337] munmap(0x7f4378b51000, 262144) = 0 [pid 5337] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5337] ioctl(5, LOOP_SET_FD, 3 [pid 5338] <... fallocate resumed>) = 0 [pid 5338] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5337] <... ioctl resumed>) = 0 [pid 5336] <... futex resumed>) = 0 [pid 5338] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5336] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5338] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5336] <... futex resumed>) = 0 [pid 5337] close(3 [pid 5338] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5336] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5337] <... close resumed>) = 0 [pid 5337] mkdir("./file1", 0777) = 0 [pid 5337] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5338] <... mount resumed>) = 0 [pid 5338] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5338] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5336] <... futex resumed>) = 0 [pid 5336] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5338] <... futex resumed>) = 0 [pid 5336] <... futex resumed>) = 1 [pid 5338] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5336] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5338] <... open resumed>) = 3 [pid 5338] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5338] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5336] <... futex resumed>) = 0 [pid 5336] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5336] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5338] <... futex resumed>) = 0 [pid 5338] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190) = 262144 [pid 5338] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5336] <... futex resumed>) = 0 [pid 5338] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5337] <... mount resumed>) = 0 [pid 5337] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 6 [pid 5337] chdir("./file1") = 0 [pid 5337] ioctl(5, LOOP_CLR_FD) = 0 [pid 5337] close(5) = 0 [pid 5337] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5337] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5336] exit_group(0 [pid 5338] <... futex resumed>) = ? [pid 5337] <... futex resumed>) = ? [pid 5336] <... exit_group resumed>) = ? [pid 5338] +++ exited with 0 +++ [pid 5337] +++ exited with 0 +++ [pid 5336] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5336, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- umount2("./80", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./80", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./80/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./80/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./80/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./80/bus") = 0 umount2("./80/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./80/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./80/binderfs") = 0 [ 55.175763][ T5337] loop0: detected capacity change from 0 to 512 [ 55.191021][ T5337] EXT4-fs (loop0): 1 orphan inode deleted [ 55.196762][ T5337] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 55.209073][ T5337] ext4 filesystem being mounted at /root/syzkaller.F1Lso8/80/file1 supports timestamps until 2038-01-19 (0x7fffffff) umount2("./80/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./80/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./80/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./80/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./80/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./80/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./80") = 0 mkdir("./81", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5341 attached , child_tidptr=0x555556e0f690) = 5341 [pid 5341] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5341] chdir("./81") = 0 [pid 5341] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5341] setpgid(0, 0) = 0 [pid 5341] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5341] write(3, "1000", 4) = 4 [pid 5341] close(3) = 0 [pid 5341] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5341] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5341] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5341] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5341] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5341] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5341] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5341] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0} => {parent_tid=[5342]}, 88) = 5342 [pid 5341] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5341] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5341] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5341] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5341] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5341] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5341] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0}./strace-static-x86_64: Process 5342 attached ./strace-static-x86_64: Process 5343 attached [pid 5342] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5343] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5342] <... rseq resumed>) = 0 [pid 5343] <... rseq resumed>) = 0 [pid 5342] set_robust_list(0x7f4380f929a0, 24 [pid 5343] set_robust_list(0x7f4380f719a0, 24 [pid 5342] <... set_robust_list resumed>) = 0 [pid 5343] <... set_robust_list resumed>) = 0 [pid 5342] rt_sigprocmask(SIG_SETMASK, [], [pid 5343] rt_sigprocmask(SIG_SETMASK, [], [pid 5342] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5343] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5343] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5342] memfd_create("syzkaller", 0 [pid 5341] <... clone3 resumed> => {parent_tid=[5343]}, 88) = 5343 [pid 5341] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5341] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5341] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5343] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5343] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 3 [pid 5342] <... memfd_create resumed>) = 4 [pid 5342] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5343] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5341] <... futex resumed>) = 0 [pid 5343] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5341] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5343] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5342] <... mmap resumed>) = 0x7f4378b51000 [pid 5341] <... futex resumed>) = 0 [pid 5343] fallocate(3, 0, 35143, 7 [pid 5341] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5342] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 5342] munmap(0x7f4378b51000, 262144) = 0 [pid 5343] <... fallocate resumed>) = 0 [pid 5342] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5343] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5341] <... futex resumed>) = 0 [pid 5343] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [ 55.250218][ T5033] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 55.260306][ T5033] EXT4-fs error (device loop0) in ext4_reserve_inode_write:5752: Corrupt filesystem [ 55.270323][ T5033] EXT4-fs error (device loop0): ext4_quota_off:7131: inode #3: comm syz-executor369: mark_inode_dirty error [pid 5341] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5343] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5343] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5342] <... openat resumed>) = 5 [pid 5341] <... futex resumed>) = 0 [pid 5343] <... mount resumed>) = 0 [pid 5341] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5343] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5342] ioctl(5, LOOP_SET_FD, 4 [pid 5341] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5343] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5341] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5343] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5341] <... futex resumed>) = 0 [pid 5343] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5341] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5343] <... open resumed>) = 6 [pid 5343] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5341] <... futex resumed>) = 0 [pid 5343] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5341] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5342] <... ioctl resumed>) = 0 [pid 5342] close(4) = 0 [pid 5342] mkdir("./file1", 0777 [pid 5343] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5341] <... futex resumed>) = 0 [pid 5343] write(6, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5341] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5342] <... mkdir resumed>) = 0 [pid 5342] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5343] <... write resumed>) = 262144 [pid 5343] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5342] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 5343] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5341] <... futex resumed>) = 0 [pid 5342] ioctl(5, LOOP_CLR_FD) = 0 [pid 5342] close(5) = 0 [pid 5342] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5342] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5341] exit_group(0) = ? [pid 5343] <... futex resumed>) = ? [pid 5343] +++ exited with 0 +++ [pid 5342] <... futex resumed>) = ? [pid 5342] +++ exited with 0 +++ [pid 5341] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5341, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- umount2("./81", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./81", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./81/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./81/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./81/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./81/bus") = 0 umount2("./81/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./81/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./81/binderfs") = 0 umount2("./81/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./81/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./81/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./81/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./81/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./81") = 0 mkdir("./82", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556e0f690) = 5344 ./strace-static-x86_64: Process 5344 attached [pid 5344] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5344] chdir("./82") = 0 [pid 5344] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5344] setpgid(0, 0) = 0 [pid 5344] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5344] write(3, "1000", 4) = 4 [pid 5344] close(3) = 0 [pid 5344] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5344] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5344] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5344] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5344] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5344] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5344] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5344] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5345 attached => {parent_tid=[5345]}, 88) = 5345 [pid 5344] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 55.322756][ T5342] loop0: detected capacity change from 0 to 512 [ 55.335848][ T5342] EXT4-fs (loop0): VFS: Can't find ext4 filesystem [pid 5344] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5344] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5344] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5344] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5345] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5344] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5345] <... rseq resumed>) = 0 [pid 5345] set_robust_list(0x7f4380f929a0, 24 [pid 5344] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5345] <... set_robust_list resumed>) = 0 [pid 5345] rt_sigprocmask(SIG_SETMASK, [], [pid 5344] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} [pid 5345] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5345] memfd_create("syzkaller", 0./strace-static-x86_64: Process 5346 attached ) = 3 [pid 5345] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5346] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5345] <... mmap resumed>) = 0x7f4378b51000 [pid 5344] <... clone3 resumed> => {parent_tid=[5346]}, 88) = 5346 [pid 5346] <... rseq resumed>) = 0 [pid 5344] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5344] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5344] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5345] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5346] set_robust_list(0x7f4380f719a0, 24) = 0 [pid 5346] rt_sigprocmask(SIG_SETMASK, [], [pid 5345] <... write resumed>) = 262144 [pid 5345] munmap(0x7f4378b51000, 262144) = 0 [pid 5345] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5345] ioctl(4, LOOP_SET_FD, 3 [pid 5346] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5346] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5 [pid 5346] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5346] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5344] <... futex resumed>) = 0 [pid 5344] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5345] <... ioctl resumed>) = 0 [pid 5345] close(3) = 0 [pid 5345] mkdir("./file1", 0777 [pid 5346] <... futex resumed>) = 0 [pid 5344] <... futex resumed>) = 1 [pid 5346] fallocate(5, 0, 35143, 7 [pid 5344] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5345] <... mkdir resumed>) = 0 [pid 5345] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5346] <... fallocate resumed>) = 0 [pid 5346] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5344] <... futex resumed>) = 0 [pid 5344] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5344] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5346] <... futex resumed>) = 1 [pid 5346] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL) = 0 [pid 5346] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5344] <... futex resumed>) = 0 [pid 5346] <... futex resumed>) = 1 [pid 5344] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5346] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5344] <... futex resumed>) = 0 [pid 5346] <... open resumed>) = 3 [pid 5344] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5346] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5344] <... futex resumed>) = 0 [pid 5346] <... futex resumed>) = 1 [pid 5346] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5344] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5344] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5346] <... write resumed>) = 262144 [pid 5346] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5344] <... futex resumed>) = 0 [pid 5346] <... futex resumed>) = 1 [pid 5346] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5345] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 5345] ioctl(4, LOOP_CLR_FD) = 0 [pid 5345] close(4) = 0 [pid 5345] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5345] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5344] exit_group(0) = ? [pid 5345] <... futex resumed>) = ? [pid 5345] +++ exited with 0 +++ [pid 5346] <... futex resumed>) = ? [pid 5346] +++ exited with 0 +++ [pid 5344] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5344, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- umount2("./82", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./82", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./82/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./82/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./82/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./82/bus") = 0 umount2("./82/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./82/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./82/binderfs") = 0 umount2("./82/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./82/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./82/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./82/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./82/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./82") = 0 mkdir("./83", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 [ 55.396243][ T5345] loop0: detected capacity change from 0 to 512 [ 55.410552][ T5345] EXT4-fs error (device loop0): ext4_map_blocks:577: inode #3: block 9: comm syz-executor369: lblock 0 mapped to illegal pblock 9 (length 1) [ 55.425748][ T5345] EXT4-fs warning (device loop0): ext4_enable_quotas:7078: Failed to enable quota tracking (type=0, err=-22, ino=3). Please run e2fsck to fix. [ 55.441383][ T5345] EXT4-fs (loop0): mount failed clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5350 attached , child_tidptr=0x555556e0f690) = 5350 [pid 5350] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5350] chdir("./83") = 0 [pid 5350] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5350] setpgid(0, 0) = 0 [pid 5350] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5350] write(3, "1000", 4) = 4 [pid 5350] close(3) = 0 [pid 5350] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5350] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5350] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5350] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5350] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5350] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5350] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5350] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0} => {parent_tid=[5351]}, 88) = 5351 [pid 5350] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5350] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 ./strace-static-x86_64: Process 5351 attached [pid 5350] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5351] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5350] <... futex resumed>) = 0 [pid 5351] <... rseq resumed>) = 0 [pid 5350] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5351] set_robust_list(0x7f4380f929a0, 24 [pid 5350] <... mmap resumed>) = 0x7f4380f51000 [pid 5351] <... set_robust_list resumed>) = 0 [pid 5351] rt_sigprocmask(SIG_SETMASK, [], [pid 5350] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5351] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5351] memfd_create("syzkaller", 0 [pid 5350] <... mprotect resumed>) = 0 [pid 5351] <... memfd_create resumed>) = 3 [pid 5351] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4378b51000 [pid 5350] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5350] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0}./strace-static-x86_64: Process 5352 attached => {parent_tid=[5352]}, 88) = 5352 [pid 5352] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5350] rt_sigprocmask(SIG_SETMASK, [], [pid 5352] <... rseq resumed>) = 0 [pid 5352] set_robust_list(0x7f4380f719a0, 24 [pid 5350] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5350] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5352] <... set_robust_list resumed>) = 0 [pid 5350] <... futex resumed>) = 0 [pid 5350] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5352] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5351] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5352] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 5352] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5350] <... futex resumed>) = 0 [pid 5350] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5352] <... futex resumed>) = 1 [pid 5352] fallocate(4, 0, 35143, 7 [pid 5350] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5351] <... write resumed>) = 262144 [pid 5351] munmap(0x7f4378b51000, 262144 [pid 5352] <... fallocate resumed>) = 0 [pid 5352] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5352] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5350] <... futex resumed>) = 0 [pid 5351] <... munmap resumed>) = 0 [pid 5351] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5350] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5352] <... futex resumed>) = 0 [pid 5350] <... futex resumed>) = 1 [pid 5352] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5351] <... openat resumed>) = 5 [pid 5352] <... mount resumed>) = 0 [pid 5352] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5350] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5352] <... futex resumed>) = 0 [pid 5350] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5352] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5350] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5352] <... open resumed>) = 6 [pid 5350] <... futex resumed>) = 0 [pid 5352] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5350] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 5351] ioctl(5, LOOP_SET_FD, 3 [pid 5350] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5352] <... futex resumed>) = 0 [pid 5350] <... futex resumed>) = 0 [pid 5352] write(6, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5350] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5351] <... ioctl resumed>) = 0 [pid 5351] close(3) = 0 [pid 5351] mkdir("./file1", 0777) = 0 [pid 5351] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5352] <... write resumed>) = -1 EIO (Input/output error) [pid 5352] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5350] <... futex resumed>) = 0 [ 55.510989][ T5351] loop0: detected capacity change from 0 to 512 [ 55.514461][ T5352] I/O error, dev loop0, sector 248 op 0x1:(WRITE) flags 0x800 phys_seg 1 prio class 2 [ 55.520188][ T5035] Buffer I/O error on dev loop0, logical block 63, lost async page write [ 55.548117][ T5351] EXT4-fs error (device loop0): __ext4_fill_super:5473: inode #2: comm syz-executor369: iget: special inode unallocated [pid 5352] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5351] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5351] ioctl(5, LOOP_CLR_FD) = 0 [pid 5351] close(5) = 0 [pid 5351] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5351] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5350] exit_group(0 [pid 5352] <... futex resumed>) = ? [pid 5351] <... futex resumed>) = ? [pid 5350] <... exit_group resumed>) = ? [pid 5352] +++ exited with 0 +++ [pid 5351] +++ exited with 0 +++ [pid 5350] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5350, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./83", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./83", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./83/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./83/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./83/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./83/bus") = 0 umount2("./83/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./83/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./83/binderfs") = 0 umount2("./83/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./83/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./83/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./83/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./83/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./83") = 0 mkdir("./84", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556e0f690) = 5355 ./strace-static-x86_64: Process 5355 attached [pid 5355] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5355] chdir("./84") = 0 [pid 5355] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5355] setpgid(0, 0) = 0 [pid 5355] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5355] write(3, "1000", 4) = 4 [pid 5355] close(3) = 0 [pid 5355] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5355] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5355] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5355] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5355] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5355] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5355] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5355] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5356 attached [pid 5356] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053) = 0 [pid 5356] set_robust_list(0x7f4380f929a0, 24) = 0 [pid 5356] rt_sigprocmask(SIG_SETMASK, [], [pid 5355] <... clone3 resumed> => {parent_tid=[5356]}, 88) = 5356 [pid 5356] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5356] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5355] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5355] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5356] <... futex resumed>) = 0 [pid 5355] <... futex resumed>) = 1 [pid 5355] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5356] memfd_create("syzkaller", 0 [pid 5355] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5356] <... memfd_create resumed>) = 3 [pid 5355] <... mmap resumed>) = 0x7f4380f51000 [pid 5356] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4378b51000 [pid 5355] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5355] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5355] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0}./strace-static-x86_64: Process 5357 attached => {parent_tid=[5357]}, 88) = 5357 [pid 5357] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053) = 0 [pid 5355] rt_sigprocmask(SIG_SETMASK, [], [pid 5357] set_robust_list(0x7f4380f719a0, 24 [pid 5355] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5357] <... set_robust_list resumed>) = 0 [pid 5355] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5357] rt_sigprocmask(SIG_SETMASK, [], [pid 5355] <... futex resumed>) = 0 [pid 5357] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5355] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5357] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 5356] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5357] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5355] <... futex resumed>) = 0 [pid 5357] <... futex resumed>) = 1 [pid 5357] fallocate(4, 0, 35143, 7 [pid 5355] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5355] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5356] <... write resumed>) = 262144 [pid 5356] munmap(0x7f4378b51000, 262144) = 0 [pid 5356] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [ 55.561000][ T5351] EXT4-fs (loop0): get root inode failed [ 55.566975][ T5351] EXT4-fs (loop0): mount failed [pid 5356] ioctl(5, LOOP_SET_FD, 3 [pid 5357] <... fallocate resumed>) = 0 [pid 5356] <... ioctl resumed>) = 0 [pid 5357] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5356] close(3 [pid 5357] <... futex resumed>) = 1 [pid 5355] <... futex resumed>) = 0 [pid 5356] <... close resumed>) = 0 [pid 5357] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5355] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5356] mkdir("./file1", 0777 [pid 5357] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5355] <... futex resumed>) = 0 [pid 5357] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5356] <... mkdir resumed>) = 0 [pid 5355] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5357] <... mount resumed>) = 0 [pid 5356] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5357] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5355] <... futex resumed>) = 0 [pid 5355] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5355] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5357] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 3 [pid 5357] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5357] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5355] <... futex resumed>) = 0 [pid 5355] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5357] <... futex resumed>) = 0 [pid 5355] <... futex resumed>) = 1 [pid 5355] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5357] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190) = 262144 [pid 5357] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5355] <... futex resumed>) = 0 [pid 5357] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5356] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5356] ioctl(5, LOOP_CLR_FD) = 0 [pid 5356] close(5) = 0 [pid 5356] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5356] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5355] exit_group(0 [pid 5356] <... futex resumed>) = ? [pid 5357] <... futex resumed>) = ? [pid 5356] +++ exited with 0 +++ [pid 5357] +++ exited with 0 +++ [pid 5355] <... exit_group resumed>) = ? [pid 5355] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5355, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- umount2("./84", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./84", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./84/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./84/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./84/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./84/bus") = 0 umount2("./84/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./84/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./84/binderfs") = 0 umount2("./84/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./84/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./84/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./84/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./84/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./84") = 0 mkdir("./85", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556e0f690) = 5358 ./strace-static-x86_64: Process 5358 attached [pid 5358] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5358] chdir("./85") = 0 [pid 5358] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5358] setpgid(0, 0) = 0 [pid 5358] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5358] write(3, "1000", 4) = 4 [pid 5358] close(3) = 0 [pid 5358] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5358] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5358] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5358] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5358] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5358] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5358] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5358] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0} => {parent_tid=[5359]}, 88) = 5359 [pid 5358] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5358] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5358] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5358] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5358] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5358] rt_sigprocmask(SIG_BLOCK, ~[], ./strace-static-x86_64: Process 5359 attached [pid 5359] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053) = 0 [pid 5359] set_robust_list(0x7f4380f929a0, 24) = 0 [pid 5359] rt_sigprocmask(SIG_SETMASK, [], [pid 5358] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5359] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5358] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} [pid 5359] memfd_create("syzkaller", 0) = 3 ./strace-static-x86_64: Process 5360 attached [pid 5359] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5358] <... clone3 resumed> => {parent_tid=[5360]}, 88) = 5360 [pid 5360] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5359] <... mmap resumed>) = 0x7f4378b51000 [pid 5360] <... rseq resumed>) = 0 [pid 5360] set_robust_list(0x7f4380f719a0, 24) = 0 [pid 5360] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5360] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5358] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5358] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5360] <... futex resumed>) = 0 [pid 5360] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 5359] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5358] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5360] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5358] <... futex resumed>) = 0 [pid 5358] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5360] <... futex resumed>) = 1 [pid 5358] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [ 55.615670][ T5356] loop0: detected capacity change from 0 to 512 [ 55.637034][ T5356] EXT4-fs warning (device loop0): read_mmp_block:114: Error -117 while reading MMP block 8 [pid 5360] fallocate(4, 0, 35143, 7 [pid 5359] <... write resumed>) = 262144 [pid 5359] munmap(0x7f4378b51000, 262144 [pid 5360] <... fallocate resumed>) = 0 [pid 5360] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5359] <... munmap resumed>) = 0 [pid 5358] <... futex resumed>) = 0 [pid 5358] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5358] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5360] <... futex resumed>) = 1 [pid 5360] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5359] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5360] <... mount resumed>) = 0 [pid 5360] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5359] <... openat resumed>) = 5 [pid 5360] <... futex resumed>) = 1 [pid 5358] <... futex resumed>) = 0 [pid 5360] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5358] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5360] <... open resumed>) = 6 [pid 5358] <... futex resumed>) = 0 [pid 5359] ioctl(5, LOOP_SET_FD, 3 [pid 5358] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5360] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5358] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5360] <... futex resumed>) = 0 [pid 5358] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5360] write(6, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5358] <... futex resumed>) = 0 [pid 5360] <... write resumed>) = -1 EIO (Input/output error) [pid 5358] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5360] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5358] <... futex resumed>) = 0 [pid 5360] <... futex resumed>) = 1 [pid 5360] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5359] <... ioctl resumed>) = 0 [pid 5359] close(3) = 0 [pid 5359] mkdir("./file1", 0777) = 0 [pid 5359] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue") = 0 [pid 5359] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5359] chdir("./file1") = 0 [pid 5359] ioctl(5, LOOP_CLR_FD) = 0 [pid 5359] close(5) = 0 [pid 5359] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5359] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5358] exit_group(0 [pid 5359] <... futex resumed>) = ? [pid 5358] <... exit_group resumed>) = ? [pid 5360] <... futex resumed>) = ? [pid 5359] +++ exited with 0 +++ [pid 5360] +++ exited with 0 +++ [pid 5358] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5358, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./85", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./85", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./85/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./85/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./85/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./85/bus") = 0 umount2("./85/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./85/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./85/binderfs") = 0 [ 55.701073][ T5359] loop0: detected capacity change from 0 to 512 [ 55.719683][ T5359] EXT4-fs (loop0): 1 orphan inode deleted [ 55.725651][ T5359] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 55.738169][ T5359] ext4 filesystem being mounted at /root/syzkaller.F1Lso8/85/file1 supports timestamps until 2038-01-19 (0x7fffffff) umount2("./85/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./85/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./85/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./85/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./85/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./85/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./85") = 0 mkdir("./86", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5363 attached [pid 5363] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5033] <... clone resumed>, child_tidptr=0x555556e0f690) = 5363 [pid 5363] chdir("./86") = 0 [pid 5363] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5363] setpgid(0, 0) = 0 [pid 5363] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5363] write(3, "1000", 4) = 4 [pid 5363] close(3) = 0 [pid 5363] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5363] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5363] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5363] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5363] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5363] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5363] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5363] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0} => {parent_tid=[5364]}, 88) = 5364 [pid 5363] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5363] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5363] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5363] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5363] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5363] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5363] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} => {parent_tid=[5365]}, 88) = 5365 [pid 5363] rt_sigprocmask(SIG_SETMASK, [], ./strace-static-x86_64: Process 5365 attached NULL, 8) = 0 [pid 5365] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5363] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5365] <... rseq resumed>) = 0 [pid 5363] <... futex resumed>) = 0 [pid 5365] set_robust_list(0x7f4380f719a0, 24 [pid 5363] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5365] <... set_robust_list resumed>) = 0 [pid 5365] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5365] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 3 ./strace-static-x86_64: Process 5364 attached [pid 5365] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5363] <... futex resumed>) = 0 [pid 5365] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5363] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5365] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5363] <... futex resumed>) = 0 [pid 5365] fallocate(3, 0, 35143, 7 [pid 5363] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5365] <... fallocate resumed>) = 0 [pid 5365] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5363] <... futex resumed>) = 0 [pid 5363] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5364] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5363] <... futex resumed>) = 0 [pid 5364] <... rseq resumed>) = 0 [pid 5363] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5365] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5364] set_robust_list(0x7f4380f929a0, 24) = 0 [pid 5365] <... mount resumed>) = 0 [pid 5364] rt_sigprocmask(SIG_SETMASK, [], [pid 5365] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5364] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5365] <... futex resumed>) = 1 [pid 5363] <... futex resumed>) = 0 [pid 5365] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5364] memfd_create("syzkaller", 0 [pid 5363] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5363] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5365] <... open resumed>) = 4 [pid 5365] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5364] <... memfd_create resumed>) = 5 [pid 5365] <... futex resumed>) = 1 [pid 5363] <... futex resumed>) = 0 [pid 5365] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5364] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5363] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5363] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5365] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5364] <... mmap resumed>) = 0x7f4378b51000 [pid 5365] write(4, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190) = -1 ENOSPC (No space left on device) [pid 5364] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5365] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5363] <... futex resumed>) = 0 [pid 5365] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5364] <... write resumed>) = 262144 [pid 5364] munmap(0x7f4378b51000, 262144) = 0 [ 55.773590][ T5033] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [pid 5364] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 6 [pid 5364] ioctl(6, LOOP_SET_FD, 5) = 0 [pid 5364] close(5) = 0 [pid 5364] mkdir("./file1", 0777) = 0 [pid 5364] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue") = 0 [pid 5364] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 5 [pid 5364] chdir("./file1") = 0 [pid 5364] ioctl(6, LOOP_CLR_FD) = 0 [pid 5364] close(6) = 0 [pid 5364] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5363] exit_group(0 [pid 5364] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5365] <... futex resumed>) = ? [pid 5365] +++ exited with 0 +++ [pid 5364] <... futex resumed>) = ? [pid 5363] <... exit_group resumed>) = ? [pid 5364] +++ exited with 0 +++ [pid 5363] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5363, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- umount2("./86", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./86", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./86/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./86/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./86/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./86/bus") = 0 umount2("./86/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./86/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./86/binderfs") = 0 [ 55.834615][ T5364] loop0: detected capacity change from 0 to 512 [ 55.849531][ T5364] EXT4-fs (loop0): 1 orphan inode deleted [ 55.855273][ T5364] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 55.868239][ T5364] ext4 filesystem being mounted at /root/syzkaller.F1Lso8/86/file1 supports timestamps until 2038-01-19 (0x7fffffff) umount2("./86/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./86/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./86/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./86/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./86/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./86/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./86") = 0 mkdir("./87", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5368 attached , child_tidptr=0x555556e0f690) = 5368 [pid 5368] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5368] chdir("./87") = 0 [pid 5368] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5368] setpgid(0, 0) = 0 [pid 5368] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5368] write(3, "1000", 4) = 4 [pid 5368] close(3) = 0 [pid 5368] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5368] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5368] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5368] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5368] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5368] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5368] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5368] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5369 attached => {parent_tid=[5369]}, 88) = 5369 [pid 5369] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5368] rt_sigprocmask(SIG_SETMASK, [], [pid 5369] <... rseq resumed>) = 0 [pid 5368] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5369] set_robust_list(0x7f4380f929a0, 24 [pid 5368] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5369] <... set_robust_list resumed>) = 0 [pid 5368] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5368] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5368] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5369] rt_sigprocmask(SIG_SETMASK, [], [pid 5368] <... mprotect resumed>) = 0 [pid 5368] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5368] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0}./strace-static-x86_64: Process 5370 attached [pid 5370] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5368] <... clone3 resumed> => {parent_tid=[5370]}, 88) = 5370 [pid 5370] <... rseq resumed>) = 0 [pid 5368] rt_sigprocmask(SIG_SETMASK, [], [pid 5370] set_robust_list(0x7f4380f719a0, 24 [pid 5368] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5370] <... set_robust_list resumed>) = 0 [pid 5368] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5370] rt_sigprocmask(SIG_SETMASK, [], [pid 5368] <... futex resumed>) = 0 [pid 5370] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5368] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5370] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5369] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5370] <... open resumed>) = 3 [pid 5369] memfd_create("syzkaller", 0 [pid 5370] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5368] <... futex resumed>) = 0 [pid 5368] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5368] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5370] <... futex resumed>) = 1 [pid 5370] fallocate(3, 0, 35143, 7 [pid 5369] <... memfd_create resumed>) = 4 [pid 5369] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4378b51000 [pid 5369] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5370] <... fallocate resumed>) = 0 [pid 5370] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5370] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5368] <... futex resumed>) = 0 [pid 5368] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5368] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5369] <... write resumed>) = 262144 [pid 5369] munmap(0x7f4378b51000, 262144 [pid 5370] <... futex resumed>) = 0 [pid 5370] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL) = 0 [pid 5369] <... munmap resumed>) = 0 [pid 5369] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5370] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5369] <... openat resumed>) = 5 [pid 5370] <... futex resumed>) = 1 [pid 5368] <... futex resumed>) = 0 [pid 5368] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [ 55.897278][ T5033] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [pid 5370] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5369] ioctl(5, LOOP_SET_FD, 4 [pid 5368] <... futex resumed>) = 0 [pid 5370] <... open resumed>) = 6 [pid 5370] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5370] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5368] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5369] <... ioctl resumed>) = 0 [pid 5368] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5369] close(4 [pid 5368] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5369] <... close resumed>) = 0 [pid 5370] <... futex resumed>) = 0 [pid 5368] <... futex resumed>) = 1 [pid 5370] write(6, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5369] mkdir("./file1", 0777 [pid 5368] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5369] <... mkdir resumed>) = 0 [pid 5369] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5370] <... write resumed>) = 262144 [pid 5370] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5368] <... futex resumed>) = 0 [pid 5370] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5369] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 5369] ioctl(5, LOOP_CLR_FD) = 0 [pid 5369] close(5) = 0 [pid 5369] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5369] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5368] exit_group(0 [pid 5370] <... futex resumed>) = ? [pid 5369] <... futex resumed>) = ? [pid 5368] <... exit_group resumed>) = ? [pid 5369] +++ exited with 0 +++ [pid 5370] +++ exited with 0 +++ [pid 5368] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5368, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- umount2("./87", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./87", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./87/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./87/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./87/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./87/bus") = 0 umount2("./87/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./87/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./87/binderfs") = 0 umount2("./87/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./87/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./87/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./87/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./87/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./87") = 0 mkdir("./88", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5371 attached , child_tidptr=0x555556e0f690) = 5371 [pid 5371] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5371] chdir("./88") = 0 [pid 5371] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [ 55.955912][ T5369] loop0: detected capacity change from 0 to 512 [ 55.971815][ T5369] EXT4-fs (loop0): VFS: Can't find ext4 filesystem [pid 5371] setpgid(0, 0) = 0 [pid 5371] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5371] write(3, "1000", 4) = 4 [pid 5371] close(3) = 0 [pid 5371] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5371] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5371] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5371] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5371] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5371] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5371] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5371] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5372 attached [pid 5372] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5371] <... clone3 resumed> => {parent_tid=[5372]}, 88) = 5372 [pid 5372] <... rseq resumed>) = 0 [pid 5372] set_robust_list(0x7f4380f929a0, 24) = 0 [pid 5372] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5372] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5371] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5371] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5372] <... futex resumed>) = 0 [pid 5371] <... futex resumed>) = 1 [pid 5372] memfd_create("syzkaller", 0) = 3 [pid 5371] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5372] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5371] <... futex resumed>) = 0 [pid 5371] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5372] <... mmap resumed>) = 0x7f4378b72000 [pid 5371] <... mmap resumed>) = 0x7f4378b51000 [pid 5371] mprotect(0x7f4378b52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5371] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5371] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4378b71990, parent_tid=0x7f4378b71990, exit_signal=0, stack=0x7f4378b51000, stack_size=0x20300, tls=0x7f4378b716c0}./strace-static-x86_64: Process 5373 attached [pid 5373] rseq(0x7f4378b71fe0, 0x20, 0, 0x53053053 [pid 5372] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5371] <... clone3 resumed> => {parent_tid=[5373]}, 88) = 5373 [pid 5373] <... rseq resumed>) = 0 [pid 5373] set_robust_list(0x7f4378b719a0, 24 [pid 5371] rt_sigprocmask(SIG_SETMASK, [], [pid 5373] <... set_robust_list resumed>) = 0 [pid 5372] <... write resumed>) = 262144 [pid 5371] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5373] rt_sigprocmask(SIG_SETMASK, [], [pid 5371] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5373] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5371] <... futex resumed>) = 0 [pid 5373] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5371] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5372] munmap(0x7f4378b72000, 262144 [pid 5373] <... open resumed>) = 4 [pid 5372] <... munmap resumed>) = 0 [pid 5372] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5373] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5372] ioctl(5, LOOP_SET_FD, 3 [pid 5373] <... futex resumed>) = 1 [pid 5371] <... futex resumed>) = 0 [pid 5373] fallocate(4, 0, 35143, 7 [pid 5371] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5372] <... ioctl resumed>) = 0 [pid 5372] close(3) = 0 [pid 5372] mkdir("./file1", 0777) = 0 [pid 5372] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5371] <... futex resumed>) = 0 [pid 5371] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5373] <... fallocate resumed>) = 0 [pid 5373] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5371] <... futex resumed>) = 0 [pid 5371] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5371] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5373] <... futex resumed>) = 1 [pid 5373] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL) = 0 [pid 5373] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5371] <... futex resumed>) = 0 [pid 5371] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5371] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5373] <... futex resumed>) = 1 [pid 5373] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 3 [pid 5373] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5371] <... futex resumed>) = 0 [pid 5371] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5371] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5373] <... futex resumed>) = 1 [pid 5373] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190) = 262144 [pid 5373] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5371] <... futex resumed>) = 0 [pid 5373] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5372] <... mount resumed>) = 0 [pid 5372] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 6 [pid 5372] chdir("./file1") = 0 [pid 5372] ioctl(5, LOOP_CLR_FD) = 0 [pid 5372] close(5) = 0 [pid 5372] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5372] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5371] exit_group(0 [pid 5373] <... futex resumed>) = ? [pid 5372] <... futex resumed>) = ? [pid 5371] <... exit_group resumed>) = ? [pid 5373] +++ exited with 0 +++ [pid 5372] +++ exited with 0 +++ [pid 5371] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5371, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./88", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./88", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./88/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./88/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./88/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./88/bus") = 0 umount2("./88/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./88/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./88/binderfs") = 0 [ 56.035597][ T5372] loop0: detected capacity change from 0 to 512 [ 56.049271][ T5372] EXT4-fs (loop0): 1 orphan inode deleted [ 56.054975][ T5372] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 56.068734][ T5372] ext4 filesystem being mounted at /root/syzkaller.F1Lso8/88/file1 supports timestamps until 2038-01-19 (0x7fffffff) umount2("./88/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./88/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./88/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./88/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./88/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./88/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./88") = 0 mkdir("./89", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5376 attached [pid 5376] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5376] chdir("./89") = 0 [pid 5376] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5376] setpgid(0, 0) = 0 [pid 5376] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5376] write(3, "1000", 4) = 4 [pid 5376] close(3) = 0 [pid 5376] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5376] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5376] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5376] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5376] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5376] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5376] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5376] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5377 attached => {parent_tid=[5377]}, 88) = 5377 [pid 5377] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053) = 0 [pid 5376] rt_sigprocmask(SIG_SETMASK, [], [pid 5377] set_robust_list(0x7f4380f929a0, 24 [pid 5376] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5377] <... set_robust_list resumed>) = 0 [pid 5377] rt_sigprocmask(SIG_SETMASK, [], [pid 5376] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5377] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5376] <... futex resumed>) = 0 [pid 5033] <... clone resumed>, child_tidptr=0x555556e0f690) = 5376 [pid 5377] memfd_create("syzkaller", 0 [pid 5376] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5376] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5377] <... memfd_create resumed>) = 3 [pid 5376] <... mmap resumed>) = 0x7f4380f51000 [pid 5376] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5377] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4378b51000 [pid 5376] <... mprotect resumed>) = 0 [pid 5377] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5376] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5376] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0}./strace-static-x86_64: Process 5378 attached => {parent_tid=[5378]}, 88) = 5378 [pid 5376] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5376] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5376] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5378] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053) = 0 [pid 5377] <... write resumed>) = 262144 [pid 5378] set_robust_list(0x7f4380f719a0, 24 [pid 5377] munmap(0x7f4378b51000, 262144 [pid 5378] <... set_robust_list resumed>) = 0 [pid 5378] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5378] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5377] <... munmap resumed>) = 0 [pid 5377] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5377] ioctl(5, LOOP_SET_FD, 3 [pid 5378] <... open resumed>) = 4 [ 56.107602][ T5033] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 56.117613][ T5033] EXT4-fs error (device loop0) in ext4_reserve_inode_write:5752: Corrupt filesystem [ 56.127210][ T5033] EXT4-fs error (device loop0): ext4_quota_off:7131: inode #3: comm syz-executor369: mark_inode_dirty error [pid 5378] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5378] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5376] <... futex resumed>) = 0 [pid 5376] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5378] <... futex resumed>) = 0 [pid 5378] fallocate(4, 0, 35143, 7 [pid 5376] <... futex resumed>) = 1 [pid 5377] <... ioctl resumed>) = 0 [pid 5376] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5377] close(3) = 0 [pid 5377] mkdir("./file1", 0777) = 0 [pid 5378] <... fallocate resumed>) = 0 [pid 5377] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5378] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5376] <... futex resumed>) = 0 [pid 5378] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5376] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5378] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5378] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5376] <... futex resumed>) = 0 [pid 5376] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5378] <... mount resumed>) = 0 [pid 5378] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5376] <... futex resumed>) = 0 [pid 5376] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5378] <... futex resumed>) = 1 [pid 5376] <... futex resumed>) = 0 [pid 5376] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5378] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 3 [pid 5378] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5376] <... futex resumed>) = 0 [pid 5378] <... futex resumed>) = 1 [pid 5376] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5378] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5376] <... futex resumed>) = 0 [pid 5376] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5378] <... write resumed>) = 262144 [pid 5378] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5378] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5376] <... futex resumed>) = 0 [pid 5377] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5377] ioctl(5, LOOP_CLR_FD) = 0 [pid 5377] close(5) = 0 [pid 5377] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5377] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5376] exit_group(0 [pid 5378] <... futex resumed>) = ? [pid 5376] <... exit_group resumed>) = ? [pid 5378] +++ exited with 0 +++ [pid 5377] <... futex resumed>) = ? [pid 5377] +++ exited with 0 +++ [pid 5376] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5376, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- umount2("./89", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./89", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./89/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./89/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./89/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./89/bus") = 0 umount2("./89/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./89/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./89/binderfs") = 0 umount2("./89/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./89/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./89/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./89/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./89/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./89") = 0 mkdir("./90", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5379 attached , child_tidptr=0x555556e0f690) = 5379 [pid 5379] set_robust_list(0x555556e0f6a0, 24) = 0 [ 56.173294][ T5377] loop0: detected capacity change from 0 to 512 [ 56.188151][ T5377] EXT4-fs warning (device loop0): read_mmp_block:114: Error -117 while reading MMP block 8 [pid 5379] chdir("./90") = 0 [pid 5379] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5379] setpgid(0, 0) = 0 [pid 5379] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5379] write(3, "1000", 4) = 4 [pid 5379] close(3) = 0 [pid 5379] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5379] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5379] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5379] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5379] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5379] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5379] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5379] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5380 attached => {parent_tid=[5380]}, 88) = 5380 [pid 5379] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5379] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5379] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5379] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5379] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5380] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053) = 0 [pid 5379] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5380] set_robust_list(0x7f4380f929a0, 24) = 0 [pid 5379] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5380] rt_sigprocmask(SIG_SETMASK, [], [pid 5379] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0}./strace-static-x86_64: Process 5381 attached [pid 5380] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5379] <... clone3 resumed> => {parent_tid=[5381]}, 88) = 5381 [pid 5379] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5380] memfd_create("syzkaller", 0 [pid 5381] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053) = 0 [pid 5380] <... memfd_create resumed>) = 3 [pid 5381] set_robust_list(0x7f4380f719a0, 24 [pid 5380] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5381] <... set_robust_list resumed>) = 0 [pid 5379] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5381] rt_sigprocmask(SIG_SETMASK, [], [pid 5380] <... mmap resumed>) = 0x7f4378b51000 [pid 5379] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5381] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5381] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 5381] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5380] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5379] <... futex resumed>) = 0 [pid 5381] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5379] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5381] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5379] <... futex resumed>) = 0 [pid 5381] fallocate(4, 0, 35143, 7 [pid 5380] <... write resumed>) = 262144 [pid 5379] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5380] munmap(0x7f4378b51000, 262144) = 0 [pid 5380] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5380] ioctl(5, LOOP_SET_FD, 3 [pid 5381] <... fallocate resumed>) = 0 [pid 5381] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5379] <... futex resumed>) = 0 [pid 5381] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5379] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5381] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5379] <... futex resumed>) = 0 [pid 5381] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5379] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5381] <... mount resumed>) = 0 [pid 5381] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5379] <... futex resumed>) = 0 [pid 5379] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5379] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5381] <... futex resumed>) = 1 [pid 5381] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 6 [pid 5381] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5379] <... futex resumed>) = 0 [pid 5381] <... futex resumed>) = 1 [pid 5379] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5381] write(6, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5379] <... futex resumed>) = 0 [pid 5380] <... ioctl resumed>) = 0 [pid 5379] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5380] close(3) = 0 [pid 5380] mkdir("./file1", 0777) = 0 [pid 5380] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5381] <... write resumed>) = -1 EIO (Input/output error) [pid 5381] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5379] <... futex resumed>) = 0 [pid 5381] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5380] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5380] ioctl(5, LOOP_CLR_FD) = 0 [pid 5380] close(5) = 0 [pid 5380] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5380] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5379] exit_group(0 [pid 5381] <... futex resumed>) = ? [pid 5380] <... futex resumed>) = ? [pid 5379] <... exit_group resumed>) = ? [pid 5381] +++ exited with 0 +++ [pid 5380] +++ exited with 0 +++ [pid 5379] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5379, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- umount2("./90", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./90", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./90/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./90/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./90/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./90/bus") = 0 umount2("./90/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./90/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./90/binderfs") = 0 umount2("./90/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./90/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./90/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./90/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./90/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./90") = 0 mkdir("./91", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556e0f690) = 5384 ./strace-static-x86_64: Process 5384 attached [pid 5384] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5384] chdir("./91") = 0 [pid 5384] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5384] setpgid(0, 0) = 0 [pid 5384] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5384] write(3, "1000", 4) = 4 [pid 5384] close(3) = 0 [pid 5384] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5384] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 56.249783][ T5380] loop0: detected capacity change from 0 to 512 [ 56.268313][ T5380] EXT4-fs error (device loop0): __ext4_fill_super:5473: inode #2: comm syz-executor369: iget: special inode unallocated [ 56.281118][ T5380] EXT4-fs (loop0): get root inode failed [ 56.286763][ T5380] EXT4-fs (loop0): mount failed [pid 5384] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5384] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5384] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5384] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5384] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5384] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5385 attached [pid 5385] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5384] <... clone3 resumed> => {parent_tid=[5385]}, 88) = 5385 [pid 5385] <... rseq resumed>) = 0 [pid 5385] set_robust_list(0x7f4380f929a0, 24 [pid 5384] rt_sigprocmask(SIG_SETMASK, [], [pid 5385] <... set_robust_list resumed>) = 0 [pid 5384] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5385] rt_sigprocmask(SIG_SETMASK, [], [pid 5384] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5385] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5385] memfd_create("syzkaller", 0 [pid 5384] <... futex resumed>) = 0 [pid 5384] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5384] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5385] <... memfd_create resumed>) = 3 [pid 5384] <... mmap resumed>) = 0x7f4380f51000 [pid 5384] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5384] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5385] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5384] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5385] <... mmap resumed>) = 0x7f4378b51000 [pid 5384] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} => {parent_tid=[5386]}, 88) = 5386 [pid 5384] rt_sigprocmask(SIG_SETMASK, [], ./strace-static-x86_64: Process 5386 attached [pid 5385] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5384] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5386] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053) = 0 [pid 5386] set_robust_list(0x7f4380f719a0, 24 [pid 5384] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5384] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5386] <... set_robust_list resumed>) = 0 [pid 5386] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5386] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5385] <... write resumed>) = 262144 [pid 5385] munmap(0x7f4378b51000, 262144) = 0 [pid 5385] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5385] ioctl(5, LOOP_SET_FD, 3 [pid 5386] <... open resumed>) = 4 [pid 5386] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5386] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5384] <... futex resumed>) = 0 [pid 5385] <... ioctl resumed>) = 0 [pid 5384] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5386] <... futex resumed>) = 0 [pid 5385] close(3 [pid 5384] <... futex resumed>) = 1 [pid 5386] fallocate(4, 0, 35143, 7 [pid 5385] <... close resumed>) = 0 [pid 5384] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5385] mkdir("./file1", 0777) = 0 [pid 5385] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5386] <... fallocate resumed>) = 0 [pid 5386] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5384] <... futex resumed>) = 0 [pid 5386] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5384] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5386] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5384] <... futex resumed>) = 0 [pid 5386] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5384] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5386] <... mount resumed>) = 0 [pid 5386] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5384] <... futex resumed>) = 0 [pid 5386] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL) = -1 EAGAIN (Resource temporarily unavailable) [pid 5384] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5386] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 3 [pid 5384] <... futex resumed>) = 0 [pid 5386] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5384] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5386] <... futex resumed>) = 0 [pid 5384] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5386] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5384] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5386] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5386] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5384] <... futex resumed>) = 0 [pid 5384] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5386] <... write resumed>) = 262144 [pid 5386] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5384] <... futex resumed>) = 0 [pid 5386] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5385] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5385] ioctl(5, LOOP_CLR_FD) = 0 [pid 5385] close(5) = 0 [pid 5385] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5385] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5384] exit_group(0 [pid 5386] <... futex resumed>) = ? [pid 5384] <... exit_group resumed>) = ? [pid 5386] +++ exited with 0 +++ [pid 5385] <... futex resumed>) = ? [pid 5385] +++ exited with 0 +++ [pid 5384] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5384, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./91", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./91", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./91/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./91/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./91/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./91/bus") = 0 umount2("./91/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./91/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./91/binderfs") = 0 umount2("./91/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./91/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./91/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./91/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./91/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./91") = 0 mkdir("./92", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5387 attached , child_tidptr=0x555556e0f690) = 5387 [pid 5387] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5387] chdir("./92") = 0 [pid 5387] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5387] setpgid(0, 0) = 0 [pid 5387] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5387] write(3, "1000", 4) = 4 [pid 5387] close(3) = 0 [ 56.343904][ T5385] loop0: detected capacity change from 0 to 512 [ 56.367252][ T5385] EXT4-fs warning (device loop0): read_mmp_block:114: Error -117 while reading MMP block 8 [pid 5387] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5387] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5387] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5387] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5387] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5387] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5387] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5387] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5388 attached => {parent_tid=[5388]}, 88) = 5388 [pid 5387] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5387] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5387] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5387] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5388] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053) = 0 [pid 5388] set_robust_list(0x7f4380f929a0, 24 [pid 5387] <... mmap resumed>) = 0x7f4380f51000 [pid 5387] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5388] <... set_robust_list resumed>) = 0 [pid 5387] <... mprotect resumed>) = 0 [pid 5388] rt_sigprocmask(SIG_SETMASK, [], [pid 5387] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5387] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} [pid 5388] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5388] memfd_create("syzkaller", 0./strace-static-x86_64: Process 5389 attached [pid 5389] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5387] <... clone3 resumed> => {parent_tid=[5389]}, 88) = 5389 [pid 5389] <... rseq resumed>) = 0 [pid 5387] rt_sigprocmask(SIG_SETMASK, [], [pid 5389] set_robust_list(0x7f4380f719a0, 24 [pid 5387] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5389] <... set_robust_list resumed>) = 0 [pid 5387] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5389] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5387] <... futex resumed>) = 0 [pid 5389] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5387] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5389] <... open resumed>) = 4 [pid 5388] <... memfd_create resumed>) = 3 [pid 5389] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5388] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5389] <... futex resumed>) = 1 [pid 5388] <... mmap resumed>) = 0x7f4378b51000 [pid 5387] <... futex resumed>) = 0 [pid 5389] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5387] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5389] <... futex resumed>) = 0 [pid 5387] <... futex resumed>) = 1 [pid 5389] fallocate(4, 0, 35143, 7 [pid 5387] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5388] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 5388] munmap(0x7f4378b51000, 262144 [pid 5389] <... fallocate resumed>) = 0 [pid 5389] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5387] <... futex resumed>) = 0 [pid 5389] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5387] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5389] <... futex resumed>) = 0 [pid 5389] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL) = 0 [pid 5388] <... munmap resumed>) = 0 [pid 5387] <... futex resumed>) = 1 [pid 5387] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5389] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5387] <... futex resumed>) = 0 [pid 5387] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5387] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5389] <... futex resumed>) = 1 [pid 5388] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5389] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5388] <... openat resumed>) = 5 [pid 5389] <... open resumed>) = 6 [pid 5388] ioctl(5, LOOP_SET_FD, 3 [pid 5389] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5389] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5387] <... futex resumed>) = 0 [pid 5387] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5389] <... futex resumed>) = 0 [pid 5387] <... futex resumed>) = 1 [pid 5389] write(6, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5388] <... ioctl resumed>) = 0 [pid 5387] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5388] close(3) = 0 [pid 5388] mkdir("./file1", 0777) = 0 [pid 5388] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5389] <... write resumed>) = -1 EIO (Input/output error) [pid 5389] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5387] <... futex resumed>) = 0 [ 56.442826][ T5388] loop0: detected capacity change from 0 to 512 [ 56.452494][ T5389] blk_print_req_error: 129 callbacks suppressed [ 56.452502][ T5389] I/O error, dev loop0, sector 248 op 0x1:(WRITE) flags 0x800 phys_seg 1 prio class 2 [ 56.468973][ T5389] buffer_io_error: 129 callbacks suppressed [ 56.468983][ T5389] Buffer I/O error on dev loop0, logical block 31, lost async page write [pid 5389] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5388] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 5388] ioctl(5, LOOP_CLR_FD) = 0 [pid 5388] close(5) = 0 [pid 5388] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5388] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5387] exit_group(0) = ? [pid 5388] <... futex resumed>) = ? [pid 5389] <... futex resumed>) = ? [pid 5388] +++ exited with 0 +++ [pid 5389] +++ exited with 0 +++ [pid 5387] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5387, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./92", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./92", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./92/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./92/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./92/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./92/bus") = 0 umount2("./92/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./92/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./92/binderfs") = 0 umount2("./92/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./92/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./92/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./92/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./92/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./92") = 0 mkdir("./93", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5390 attached , child_tidptr=0x555556e0f690) = 5390 [pid 5390] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5390] chdir("./93") = 0 [pid 5390] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5390] setpgid(0, 0) = 0 [pid 5390] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [ 56.488167][ T5388] EXT4-fs (loop0): VFS: Can't find ext4 filesystem [pid 5390] write(3, "1000", 4) = 4 [pid 5390] close(3) = 0 [pid 5390] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5390] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5390] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5390] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5390] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5390] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5390] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5390] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5391 attached [pid 5391] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5390] <... clone3 resumed> => {parent_tid=[5391]}, 88) = 5391 [pid 5391] <... rseq resumed>) = 0 [pid 5390] rt_sigprocmask(SIG_SETMASK, [], [pid 5391] set_robust_list(0x7f4380f929a0, 24 [pid 5390] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5391] <... set_robust_list resumed>) = 0 [pid 5390] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5391] rt_sigprocmask(SIG_SETMASK, [], [pid 5390] <... futex resumed>) = 0 [pid 5390] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5391] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5390] <... futex resumed>) = 0 [pid 5391] memfd_create("syzkaller", 0 [pid 5390] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5391] <... memfd_create resumed>) = 3 [pid 5391] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5390] <... mmap resumed>) = 0x7f4380f51000 [pid 5391] <... mmap resumed>) = 0x7f4378b51000 [pid 5390] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5391] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5390] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5390] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0}./strace-static-x86_64: Process 5392 attached [pid 5392] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5390] <... clone3 resumed> => {parent_tid=[5392]}, 88) = 5392 [pid 5392] <... rseq resumed>) = 0 [pid 5390] rt_sigprocmask(SIG_SETMASK, [], [pid 5392] set_robust_list(0x7f4380f719a0, 24) = 0 [pid 5390] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5392] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5390] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5392] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5390] <... futex resumed>) = 0 [pid 5391] <... write resumed>) = 262144 [pid 5390] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5392] <... open resumed>) = 4 [pid 5392] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5391] munmap(0x7f4378b51000, 262144 [pid 5390] <... futex resumed>) = 0 [pid 5392] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5391] <... munmap resumed>) = 0 [pid 5390] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5392] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5391] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5390] <... futex resumed>) = 0 [pid 5390] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5392] fallocate(4, 0, 35143, 7 [pid 5391] <... openat resumed>) = 5 [pid 5391] ioctl(5, LOOP_SET_FD, 3 [pid 5392] <... fallocate resumed>) = 0 [pid 5391] <... ioctl resumed>) = 0 [pid 5391] close(3) = 0 [pid 5391] mkdir("./file1", 0777 [pid 5392] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5390] <... futex resumed>) = 0 [pid 5392] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5390] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5392] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5390] <... futex resumed>) = 0 [pid 5390] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5392] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL) = 0 [pid 5391] <... mkdir resumed>) = 0 [pid 5391] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5392] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5390] <... futex resumed>) = 0 [pid 5392] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5390] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5392] <... open resumed>) = 3 [pid 5390] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5392] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5390] <... futex resumed>) = 0 [pid 5390] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5392] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5390] <... futex resumed>) = 0 [pid 5390] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5392] <... write resumed>) = 262144 [pid 5392] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5390] <... futex resumed>) = 0 [pid 5392] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5391] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5391] ioctl(5, LOOP_CLR_FD) = 0 [pid 5391] close(5) = 0 [pid 5391] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5391] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5390] exit_group(0 [pid 5392] <... futex resumed>) = ? [pid 5390] <... exit_group resumed>) = ? [pid 5391] <... futex resumed>) = ? [pid 5392] +++ exited with 0 +++ [pid 5391] +++ exited with 0 +++ [pid 5390] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5390, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- umount2("./93", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./93", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./93/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./93/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./93/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./93/bus") = 0 umount2("./93/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./93/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./93/binderfs") = 0 umount2("./93/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./93/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./93/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./93/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./93/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./93") = 0 mkdir("./94", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5393 attached [pid 5393] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5393] chdir("./94") = 0 [pid 5033] <... clone resumed>, child_tidptr=0x555556e0f690) = 5393 [pid 5393] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5393] setpgid(0, 0) = 0 [pid 5393] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5393] write(3, "1000", 4) = 4 [pid 5393] close(3) = 0 [pid 5393] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5393] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5393] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5393] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5393] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5393] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5393] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5393] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0} => {parent_tid=[5394]}, 88) = 5394 [pid 5393] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5393] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5393] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5393] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 [pid 5393] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5393] rt_sigprocmask(SIG_BLOCK, ~[], ./strace-static-x86_64: Process 5394 attached [pid 5394] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5393] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5394] <... rseq resumed>) = 0 [pid 5394] set_robust_list(0x7f4380f929a0, 24 [pid 5393] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} [pid 5394] <... set_robust_list resumed>) = 0 [pid 5394] rt_sigprocmask(SIG_SETMASK, [], ./strace-static-x86_64: Process 5395 attached NULL, 8) = 0 [ 56.550290][ T5391] loop0: detected capacity change from 0 to 512 [ 56.567035][ T5391] EXT4-fs warning (device loop0): read_mmp_block:114: Error -117 while reading MMP block 8 [pid 5395] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5394] memfd_create("syzkaller", 0 [pid 5393] <... clone3 resumed> => {parent_tid=[5395]}, 88) = 5395 [pid 5395] <... rseq resumed>) = 0 [pid 5394] <... memfd_create resumed>) = 3 [pid 5393] rt_sigprocmask(SIG_SETMASK, [], [pid 5395] set_robust_list(0x7f4380f719a0, 24 [pid 5394] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5395] <... set_robust_list resumed>) = 0 [pid 5393] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5395] rt_sigprocmask(SIG_SETMASK, [], [pid 5394] <... mmap resumed>) = 0x7f4378b51000 [pid 5395] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5393] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5393] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5395] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 5394] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5395] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5393] <... futex resumed>) = 0 [pid 5395] <... futex resumed>) = 1 [pid 5393] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5395] fallocate(4, 0, 35143, 7 [pid 5393] <... futex resumed>) = 0 [pid 5393] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5394] <... write resumed>) = 262144 [pid 5394] munmap(0x7f4378b51000, 262144) = 0 [pid 5394] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5394] ioctl(5, LOOP_SET_FD, 3) = 0 [pid 5394] close(3) = 0 [pid 5394] mkdir("./file1", 0777) = 0 [pid 5395] <... fallocate resumed>) = 0 [pid 5395] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5395] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5393] <... futex resumed>) = 0 [pid 5393] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5395] <... futex resumed>) = 0 [pid 5394] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5393] <... futex resumed>) = 1 [pid 5395] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5393] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5395] <... mount resumed>) = 0 [pid 5395] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5393] <... futex resumed>) = 0 [pid 5393] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5395] <... futex resumed>) = 1 [pid 5393] <... futex resumed>) = 0 [pid 5395] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 3 [pid 5393] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5395] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5393] <... futex resumed>) = 0 [pid 5395] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5393] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5393] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5395] <... write resumed>) = 262144 [pid 5395] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5393] <... futex resumed>) = 0 [pid 5395] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5394] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5394] ioctl(5, LOOP_CLR_FD) = 0 [pid 5394] close(5) = 0 [pid 5394] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5394] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5393] exit_group(0 [pid 5395] <... futex resumed>) = ? [pid 5394] <... futex resumed>) = ? [pid 5393] <... exit_group resumed>) = ? [pid 5394] +++ exited with 0 +++ [pid 5395] +++ exited with 0 +++ [pid 5393] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5393, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- umount2("./94", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./94", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./94/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./94/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./94/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./94/bus") = 0 umount2("./94/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./94/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./94/binderfs") = 0 umount2("./94/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./94/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./94/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./94/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./94/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./94") = 0 mkdir("./95", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5396 attached , child_tidptr=0x555556e0f690) = 5396 [pid 5396] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5396] chdir("./95") = 0 [pid 5396] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5396] setpgid(0, 0) = 0 [pid 5396] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5396] write(3, "1000", 4) = 4 [pid 5396] close(3) = 0 [pid 5396] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5396] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5396] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5396] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5396] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5396] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5396] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5396] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5397 attached [pid 5397] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5396] <... clone3 resumed> => {parent_tid=[5397]}, 88) = 5397 [pid 5397] <... rseq resumed>) = 0 [pid 5396] rt_sigprocmask(SIG_SETMASK, [], [pid 5397] set_robust_list(0x7f4380f929a0, 24 [pid 5396] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5397] <... set_robust_list resumed>) = 0 [pid 5396] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5397] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5396] <... futex resumed>) = 0 [pid 5397] memfd_create("syzkaller", 0 [pid 5396] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5397] <... memfd_create resumed>) = 3 [pid 5397] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4378b72000 [pid 5397] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5396] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4378b51000 [ 56.639856][ T5394] loop0: detected capacity change from 0 to 512 [ 56.657006][ T5394] EXT4-fs warning (device loop0): read_mmp_block:114: Error -117 while reading MMP block 8 [pid 5396] mprotect(0x7f4378b52000, 131072, PROT_READ|PROT_WRITE [pid 5397] <... write resumed>) = 262144 [pid 5396] <... mprotect resumed>) = 0 [pid 5397] munmap(0x7f4378b72000, 262144 [pid 5396] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5396] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4378b71990, parent_tid=0x7f4378b71990, exit_signal=0, stack=0x7f4378b51000, stack_size=0x20300, tls=0x7f4378b716c0}./strace-static-x86_64: Process 5398 attached [pid 5398] rseq(0x7f4378b71fe0, 0x20, 0, 0x53053053 [pid 5396] <... clone3 resumed> => {parent_tid=[5398]}, 88) = 5398 [pid 5398] <... rseq resumed>) = 0 [pid 5396] rt_sigprocmask(SIG_SETMASK, [], [pid 5398] set_robust_list(0x7f4378b719a0, 24) = 0 [pid 5396] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5398] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5396] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5398] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5396] <... futex resumed>) = 0 [pid 5398] <... open resumed>) = 4 [pid 5396] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5398] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5398] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5396] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5397] <... munmap resumed>) = 0 [pid 5396] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5397] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5396] <... futex resumed>) = 1 [pid 5398] <... futex resumed>) = 0 [pid 5398] fallocate(4, 0, 35143, 7 [pid 5397] <... openat resumed>) = 5 [pid 5396] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5397] ioctl(5, LOOP_SET_FD, 3 [pid 5398] <... fallocate resumed>) = 0 [pid 5398] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5398] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5397] <... ioctl resumed>) = 0 [pid 5396] <... futex resumed>) = 0 [pid 5396] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5397] close(3 [pid 5398] <... futex resumed>) = 0 [pid 5396] <... futex resumed>) = 1 [pid 5398] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL) = 0 [pid 5398] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5398] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5397] <... close resumed>) = 0 [pid 5396] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 5397] mkdir("./file1", 0777 [pid 5396] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5398] <... futex resumed>) = 0 [pid 5396] <... futex resumed>) = 1 [pid 5398] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 3 [pid 5396] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5398] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5396] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5398] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5396] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5398] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5398] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5396] <... futex resumed>) = 0 [pid 5397] <... mkdir resumed>) = 0 [pid 5396] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5397] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5398] <... write resumed>) = 262144 [pid 5398] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5396] <... futex resumed>) = 0 [pid 5398] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5397] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 5397] ioctl(5, LOOP_CLR_FD) = 0 [pid 5397] close(5) = 0 [pid 5397] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5397] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5396] exit_group(0 [pid 5398] <... futex resumed>) = ? [pid 5397] <... futex resumed>) = ? [pid 5396] <... exit_group resumed>) = ? [pid 5397] +++ exited with 0 +++ [pid 5398] +++ exited with 0 +++ [pid 5396] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5396, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- umount2("./95", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./95", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./95/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./95/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./95/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./95/bus") = 0 umount2("./95/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./95/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./95/binderfs") = 0 umount2("./95/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./95/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./95/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./95/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./95/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./95") = 0 mkdir("./96", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556e0f690) = 5399 ./strace-static-x86_64: Process 5399 attached [pid 5399] set_robust_list(0x555556e0f6a0, 24) = 0 [ 56.725804][ T5397] loop0: detected capacity change from 0 to 512 [ 56.743479][ T5397] EXT4-fs (loop0): VFS: Can't find ext4 filesystem [pid 5399] chdir("./96") = 0 [pid 5399] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5399] setpgid(0, 0) = 0 [pid 5399] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5399] write(3, "1000", 4) = 4 [pid 5399] close(3) = 0 [pid 5399] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5399] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5399] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5399] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5399] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5399] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5399] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5399] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0} => {parent_tid=[5400]}, 88) = 5400 ./strace-static-x86_64: Process 5400 attached [pid 5400] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053) = 0 [pid 5400] set_robust_list(0x7f4380f929a0, 24) = 0 [pid 5400] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5400] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5399] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5399] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5400] <... futex resumed>) = 0 [pid 5400] memfd_create("syzkaller", 0) = 3 [pid 5400] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4378b72000 [pid 5399] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5400] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5399] <... futex resumed>) = 0 [pid 5399] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4378b51000 [pid 5399] mprotect(0x7f4378b52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5399] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5399] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4378b71990, parent_tid=0x7f4378b71990, exit_signal=0, stack=0x7f4378b51000, stack_size=0x20300, tls=0x7f4378b716c0}./strace-static-x86_64: Process 5401 attached => {parent_tid=[5401]}, 88) = 5401 [pid 5401] rseq(0x7f4378b71fe0, 0x20, 0, 0x53053053) = 0 [pid 5401] set_robust_list(0x7f4378b719a0, 24) = 0 [pid 5401] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5399] rt_sigprocmask(SIG_SETMASK, [], [pid 5401] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5400] <... write resumed>) = 262144 [pid 5399] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5400] munmap(0x7f4378b72000, 262144 [pid 5399] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5401] <... futex resumed>) = 0 [pid 5399] <... futex resumed>) = 1 [pid 5401] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5399] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5401] <... open resumed>) = 4 [pid 5400] <... munmap resumed>) = 0 [pid 5401] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5400] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5401] <... futex resumed>) = 1 [pid 5400] <... openat resumed>) = 5 [pid 5399] <... futex resumed>) = 0 [pid 5401] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5399] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5401] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5399] <... futex resumed>) = 0 [pid 5401] fallocate(4, 0, 35143, 7 [pid 5400] ioctl(5, LOOP_SET_FD, 3 [pid 5399] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5400] <... ioctl resumed>) = 0 [pid 5400] close(3) = 0 [pid 5400] mkdir("./file1", 0777) = 0 [pid 5400] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5401] <... fallocate resumed>) = 0 [pid 5401] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5401] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5399] <... futex resumed>) = 0 [pid 5399] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5401] <... futex resumed>) = 0 [pid 5399] <... futex resumed>) = 1 [pid 5401] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5399] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5401] <... mount resumed>) = 0 [pid 5401] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5399] <... futex resumed>) = 0 [pid 5401] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5399] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5401] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5399] <... futex resumed>) = 0 [pid 5401] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5399] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5401] <... open resumed>) = 3 [pid 5401] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5399] <... futex resumed>) = 0 [pid 5401] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5399] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5401] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5399] <... futex resumed>) = 0 [pid 5401] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5399] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5401] <... write resumed>) = 262144 [pid 5401] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5399] <... futex resumed>) = 0 [pid 5401] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5400] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5400] ioctl(5, LOOP_CLR_FD) = 0 [pid 5400] close(5) = 0 [pid 5400] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5400] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5399] exit_group(0 [pid 5401] <... futex resumed>) = ? [pid 5400] <... futex resumed>) = ? [pid 5399] <... exit_group resumed>) = ? [pid 5400] +++ exited with 0 +++ [pid 5401] +++ exited with 0 +++ [pid 5399] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5399, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- umount2("./96", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./96", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./96/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./96/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./96/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./96/bus") = 0 umount2("./96/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./96/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./96/binderfs") = 0 umount2("./96/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./96/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./96/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./96/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./96/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./96") = 0 mkdir("./97", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5402 attached [pid 5402] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5402] chdir("./97" [pid 5033] <... clone resumed>, child_tidptr=0x555556e0f690) = 5402 [pid 5402] <... chdir resumed>) = 0 [pid 5402] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5402] setpgid(0, 0) = 0 [pid 5402] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5402] write(3, "1000", 4) = 4 [pid 5402] close(3) = 0 [pid 5402] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5402] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5402] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5402] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5402] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5402] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5402] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5402] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0} => {parent_tid=[5403]}, 88) = 5403 ./strace-static-x86_64: Process 5403 attached [pid 5402] rt_sigprocmask(SIG_SETMASK, [], [pid 5403] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5402] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5403] <... rseq resumed>) = 0 [pid 5402] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5403] set_robust_list(0x7f4380f929a0, 24 [pid 5402] <... futex resumed>) = 0 [pid 5403] <... set_robust_list resumed>) = 0 [pid 5402] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5403] rt_sigprocmask(SIG_SETMASK, [], [pid 5402] <... futex resumed>) = 0 [pid 5403] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5402] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5403] memfd_create("syzkaller", 0 [pid 5402] <... mmap resumed>) = 0x7f4380f51000 [pid 5402] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5403] <... memfd_create resumed>) = 3 [pid 5403] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5402] <... mprotect resumed>) = 0 [pid 5403] <... mmap resumed>) = 0x7f4378b51000 [pid 5402] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5402] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} => {parent_tid=[5404]}, 88) = 5404 [pid 5402] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ./strace-static-x86_64: Process 5404 attached [pid 5403] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5402] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5404] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5402] <... futex resumed>) = 0 [ 56.821561][ T5400] loop0: detected capacity change from 0 to 512 [ 56.838047][ T5400] EXT4-fs warning (device loop0): read_mmp_block:114: Error -117 while reading MMP block 8 [pid 5402] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5404] <... rseq resumed>) = 0 [pid 5404] set_robust_list(0x7f4380f719a0, 24) = 0 [pid 5404] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5403] <... write resumed>) = 262144 [pid 5404] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 5403] munmap(0x7f4378b51000, 262144 [pid 5404] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5402] <... futex resumed>) = 0 [pid 5402] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5402] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5404] <... futex resumed>) = 1 [pid 5404] fallocate(4, 0, 35143, 7 [pid 5403] <... munmap resumed>) = 0 [pid 5403] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5403] ioctl(5, LOOP_SET_FD, 3) = 0 [pid 5403] close(3) = 0 [pid 5403] mkdir("./file1", 0777) = 0 [pid 5403] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5404] <... fallocate resumed>) = 0 [pid 5404] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5404] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5402] <... futex resumed>) = 0 [pid 5402] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5404] <... futex resumed>) = 0 [pid 5402] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5404] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL) = 0 [pid 5404] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5402] <... futex resumed>) = 0 [pid 5404] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5402] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5404] <... open resumed>) = 3 [pid 5402] <... futex resumed>) = 0 [pid 5404] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5402] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5404] <... futex resumed>) = 0 [pid 5402] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5404] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5402] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 56.903956][ T28] kauditd_printk_skb: 41 callbacks suppressed [ 56.903971][ T28] audit: type=1800 audit(1694162025.039:99): pid=5404 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor369" name="bus" dev="sda1" ino=1930 res=0 errno=0 [ 56.910042][ T5403] loop0: detected capacity change from 0 to 512 [pid 5402] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5404] <... write resumed>) = 262144 [pid 5404] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5402] <... futex resumed>) = 0 [pid 5404] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5403] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5403] ioctl(5, LOOP_CLR_FD) = 0 [pid 5403] close(5) = 0 [pid 5403] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5402] exit_group(0 [pid 5404] <... futex resumed>) = ? [pid 5403] +++ exited with 0 +++ [pid 5402] <... exit_group resumed>) = ? [pid 5404] +++ exited with 0 +++ [pid 5402] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5402, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- umount2("./97", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./97", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./97/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./97/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./97/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./97/bus") = 0 umount2("./97/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./97/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./97/binderfs") = 0 umount2("./97/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./97/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./97/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./97/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./97/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./97") = 0 mkdir("./98", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556e0f690) = 5405 ./strace-static-x86_64: Process 5405 attached [pid 5405] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5405] chdir("./98") = 0 [ 56.947413][ T5403] EXT4-fs warning (device loop0): read_mmp_block:114: Error -117 while reading MMP block 8 [pid 5405] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5405] setpgid(0, 0) = 0 [pid 5405] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5405] write(3, "1000", 4) = 4 [pid 5405] close(3) = 0 [pid 5405] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5405] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5405] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5405] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5405] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5405] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5405] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5405] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0} => {parent_tid=[5406]}, 88) = 5406 [pid 5405] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5405] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5405] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5405] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f51000 ./strace-static-x86_64: Process 5406 attached [pid 5405] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5405] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5405] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0}./strace-static-x86_64: Process 5407 attached [pid 5407] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053) = 0 [pid 5405] <... clone3 resumed> => {parent_tid=[5407]}, 88) = 5407 [pid 5407] set_robust_list(0x7f4380f719a0, 24 [pid 5405] rt_sigprocmask(SIG_SETMASK, [], [pid 5407] <... set_robust_list resumed>) = 0 [pid 5405] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5407] rt_sigprocmask(SIG_SETMASK, [], [pid 5405] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5407] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5405] <... futex resumed>) = 0 [pid 5407] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5405] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5406] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5407] <... open resumed>) = 3 [pid 5407] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5405] <... futex resumed>) = 0 [pid 5407] <... futex resumed>) = 1 [pid 5405] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5407] fallocate(3, 0, 35143, 7 [pid 5406] <... rseq resumed>) = 0 [pid 5405] <... futex resumed>) = 0 [pid 5405] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5406] set_robust_list(0x7f4380f929a0, 24) = 0 [pid 5406] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5406] memfd_create("syzkaller", 0) = 4 [pid 5406] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4378b51000 [pid 5406] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 5406] munmap(0x7f4378b51000, 262144) = 0 [pid 5406] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5406] ioctl(5, LOOP_SET_FD, 4) = 0 [pid 5406] close(4) = 0 [pid 5406] mkdir("./file1", 0777) = 0 [pid 5407] <... fallocate resumed>) = 0 [pid 5406] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5407] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5405] <... futex resumed>) = 0 [pid 5407] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5405] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5407] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5405] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5407] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL) = 0 [pid 5407] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5405] <... futex resumed>) = 0 [pid 5405] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5405] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5407] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 4 [pid 5407] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5407] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5405] <... futex resumed>) = 0 [pid 5405] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5405] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5407] <... futex resumed>) = 0 [pid 5407] write(4, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190) = 262144 [pid 5407] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5405] <... futex resumed>) = 0 [pid 5407] <... futex resumed>) = 1 [pid 5407] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5406] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5406] ioctl(5, LOOP_CLR_FD) = 0 [pid 5406] close(5) = 0 [pid 5406] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5406] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5405] exit_group(0 [pid 5406] <... futex resumed>) = ? [pid 5405] <... exit_group resumed>) = ? [pid 5406] +++ exited with 0 +++ [pid 5407] <... futex resumed>) = ? [pid 5407] +++ exited with 0 +++ [pid 5405] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5405, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- umount2("./98", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./98", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./98/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./98/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./98/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./98/bus") = 0 umount2("./98/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./98/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./98/binderfs") = 0 umount2("./98/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./98/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./98/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./98/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./98/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./98") = 0 mkdir("./99", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 [ 57.002369][ T28] audit: type=1800 audit(1694162025.139:100): pid=5407 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor369" name="bus" dev="sda1" ino=1930 res=0 errno=0 [ 57.017763][ T5406] loop0: detected capacity change from 0 to 512 [ 57.040097][ T5406] EXT4-fs warning (device loop0): read_mmp_block:114: Error -117 while reading MMP block 8 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5408 attached , child_tidptr=0x555556e0f690) = 5408 [pid 5408] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5408] chdir("./99") = 0 [pid 5408] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5408] setpgid(0, 0) = 0 [pid 5408] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5408] write(3, "1000", 4) = 4 [pid 5408] close(3) = 0 [pid 5408] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5408] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5408] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5408] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5408] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5408] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5408] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5408] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5409 attached => {parent_tid=[5409]}, 88) = 5409 [pid 5409] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053) = 0 [pid 5409] set_robust_list(0x7f4380f929a0, 24) = 0 [pid 5409] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5409] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5408] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5408] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5408] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5409] <... futex resumed>) = 0 [pid 5409] memfd_create("syzkaller", 0 [pid 5408] <... futex resumed>) = 0 [pid 5409] <... memfd_create resumed>) = 3 [pid 5408] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5409] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5408] <... mmap resumed>) = 0x7f4380f51000 [pid 5409] <... mmap resumed>) = 0x7f4378b51000 [pid 5408] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE [pid 5409] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5408] <... mprotect resumed>) = 0 [pid 5408] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5409] <... write resumed>) = 262144 [pid 5409] munmap(0x7f4378b51000, 262144) = 0 [pid 5409] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5409] ioctl(4, LOOP_SET_FD, 3 [pid 5408] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0} [pid 5409] <... ioctl resumed>) = 0 [pid 5409] close(3) = 0 [pid 5409] mkdir("./file1", 0777./strace-static-x86_64: Process 5410 attached ) = 0 [pid 5410] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053 [pid 5409] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5408] <... clone3 resumed> => {parent_tid=[5410]}, 88) = 5410 [pid 5410] <... rseq resumed>) = 0 [pid 5410] set_robust_list(0x7f4380f719a0, 24 [pid 5408] rt_sigprocmask(SIG_SETMASK, [], [pid 5410] <... set_robust_list resumed>) = 0 [pid 5410] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5410] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5408] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5408] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5410] <... futex resumed>) = 0 [pid 5410] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5408] <... futex resumed>) = 1 [pid 5410] <... open resumed>) = 3 [pid 5408] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5410] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5408] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5410] <... futex resumed>) = 0 [pid 5408] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5410] fallocate(3, 0, 35143, 7 [pid 5408] <... futex resumed>) = 0 [pid 5408] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5410] <... fallocate resumed>) = 0 [pid 5410] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5408] <... futex resumed>) = 0 [pid 5410] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5408] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5410] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5408] <... futex resumed>) = 0 [pid 5410] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5408] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5410] <... mount resumed>) = 0 [pid 5410] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5408] <... futex resumed>) = 0 [pid 5410] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL) = -1 EAGAIN (Resource temporarily unavailable) [pid 5408] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5410] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5408] <... futex resumed>) = 0 [pid 5410] <... open resumed>) = 5 [pid 5408] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5410] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5408] <... futex resumed>) = 0 [pid 5410] <... futex resumed>) = 1 [pid 5408] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [ 57.108963][ T5409] loop0: detected capacity change from 0 to 512 [ 57.119880][ T28] audit: type=1800 audit(1694162025.259:101): pid=5410 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor369" name="bus" dev="sda1" ino=1931 res=0 errno=0 [ 57.130639][ T5409] EXT4-fs (loop0): 1 orphan inode deleted [ 57.146585][ T5409] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [pid 5410] write(5, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190 [pid 5408] <... futex resumed>) = 0 [pid 5408] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5409] <... mount resumed>) = 0 [pid 5410] <... write resumed>) = 262144 [pid 5410] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5410] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5408] <... futex resumed>) = 0 [pid 5409] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 6 [pid 5409] chdir("./file1") = 0 [pid 5409] ioctl(4, LOOP_CLR_FD) = 0 [pid 5409] close(4) = 0 [pid 5409] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5409] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5408] exit_group(0 [pid 5410] <... futex resumed>) = ? [pid 5409] <... futex resumed>) = ? [pid 5408] <... exit_group resumed>) = ? [pid 5410] +++ exited with 0 +++ [pid 5409] +++ exited with 0 +++ [pid 5408] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5408, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./99", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./99", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./99/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./99/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./99/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./99/bus") = 0 umount2("./99/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./99/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./99/binderfs") = 0 [ 57.160194][ T5409] ext4 filesystem being mounted at /root/syzkaller.F1Lso8/99/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 57.201677][ T5033] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. umount2("./99/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./99/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./99/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./99/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./99/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./99/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./99") = 0 mkdir("./100", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556e0f690) = 5413 ./strace-static-x86_64: Process 5413 attached [pid 5413] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5413] chdir("./100") = 0 [pid 5413] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5413] setpgid(0, 0) = 0 [pid 5413] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5413] write(3, "1000", 4) = 4 [pid 5413] close(3) = 0 [pid 5413] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5413] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5413] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5413] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5413] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5413] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5413] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5413] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5414 attached [pid 5414] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053) = 0 [pid 5414] set_robust_list(0x7f4380f929a0, 24 [pid 5413] <... clone3 resumed> => {parent_tid=[5414]}, 88) = 5414 [pid 5414] <... set_robust_list resumed>) = 0 [pid 5413] rt_sigprocmask(SIG_SETMASK, [], [pid 5414] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5413] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5414] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5413] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5414] <... futex resumed>) = 0 [pid 5413] <... futex resumed>) = 1 [pid 5414] memfd_create("syzkaller", 0 [pid 5413] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5414] <... memfd_create resumed>) = 3 [ 57.211575][ T5033] EXT4-fs error (device loop0) in ext4_reserve_inode_write:5752: Corrupt filesystem [ 57.221672][ T5033] EXT4-fs error (device loop0): ext4_quota_off:7131: inode #3: comm syz-executor369: mark_inode_dirty error [pid 5414] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4378b72000 [pid 5413] <... futex resumed>) = 0 [pid 5414] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5413] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4378b51000 [pid 5413] mprotect(0x7f4378b52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5413] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5413] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4378b71990, parent_tid=0x7f4378b71990, exit_signal=0, stack=0x7f4378b51000, stack_size=0x20300, tls=0x7f4378b716c0}./strace-static-x86_64: Process 5415 attached [pid 5415] rseq(0x7f4378b71fe0, 0x20, 0, 0x53053053) = 0 [pid 5415] set_robust_list(0x7f4378b719a0, 24) = 0 [pid 5415] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5415] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5414] <... write resumed>) = 262144 [pid 5414] munmap(0x7f4378b72000, 262144 [pid 5413] <... clone3 resumed> => {parent_tid=[5415]}, 88) = 5415 [pid 5413] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5413] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5415] <... futex resumed>) = 0 [pid 5413] <... futex resumed>) = 1 [pid 5415] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 5414] <... munmap resumed>) = 0 [pid 5413] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5415] <... open resumed>) = 4 [pid 5414] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5414] ioctl(5, LOOP_SET_FD, 3 [pid 5415] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5413] <... futex resumed>) = 0 [pid 5415] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL) = -1 EAGAIN (Resource temporarily unavailable) [pid 5414] <... ioctl resumed>) = 0 [pid 5413] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5414] close(3 [pid 5413] <... futex resumed>) = 0 [pid 5414] <... close resumed>) = 0 [pid 5413] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5414] mkdir("./file1", 0777 [pid 5415] fallocate(4, 0, 35143, 7 [pid 5414] <... mkdir resumed>) = 0 [pid 5414] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5415] <... fallocate resumed>) = 0 [pid 5415] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5413] <... futex resumed>) = 0 [pid 5413] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5413] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5415] <... futex resumed>) = 1 [pid 5415] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL) = 0 [pid 5415] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5413] <... futex resumed>) = 0 [pid 5413] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5413] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5415] <... futex resumed>) = 1 [pid 5415] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c) = 3 [pid 5415] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5413] <... futex resumed>) = 0 [pid 5413] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5413] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5415] <... futex resumed>) = 1 [pid 5415] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190) = 262144 [pid 5415] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5413] <... futex resumed>) = 0 [ 57.279715][ T28] audit: type=1800 audit(1694162025.419:102): pid=5415 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor369" name="bus" dev="sda1" ino=1930 res=0 errno=0 [ 57.281869][ T5414] loop0: detected capacity change from 0 to 512 [pid 5415] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5414] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 5414] ioctl(5, LOOP_CLR_FD) = 0 [pid 5414] close(5) = 0 [pid 5414] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5413] exit_group(0 [pid 5415] <... futex resumed>) = ? [pid 5413] <... exit_group resumed>) = ? [pid 5415] +++ exited with 0 +++ [pid 5414] <... futex resumed>) = ? [pid 5414] +++ exited with 0 +++ [pid 5413] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5413, si_uid=0, si_status=0, si_utime=0, si_stime=6 /* 0.06 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./100", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./100", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./100/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./100/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./100/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./100/bus") = 0 umount2("./100/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./100/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./100/binderfs") = 0 umount2("./100/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./100/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./100/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./100/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./100/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./100") = 0 mkdir("./101", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [ 57.319526][ T5416] EXT4-fs warning (device loop0): kmmpd:167: kmmpd being stopped since MMP feature has been disabled. [ 57.322442][ T5414] EXT4-fs error (device loop0): __ext4_fill_super:5473: comm syz-executor369: inode #2: comm syz-executor369: iget: illegal inode # [ 57.344416][ T5414] EXT4-fs (loop0): get root inode failed [ 57.350095][ T5414] EXT4-fs (loop0): mount failed ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556e0f690) = 5418 ./strace-static-x86_64: Process 5418 attached [pid 5418] set_robust_list(0x555556e0f6a0, 24) = 0 [pid 5418] chdir("./101") = 0 [pid 5418] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5418] setpgid(0, 0) = 0 [pid 5418] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5418] write(3, "1000", 4) = 4 [pid 5418] close(3) = 0 [pid 5418] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5418] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5418] rt_sigaction(SIGRT_1, {sa_handler=0x7f4380ffbf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4380fed0e0}, NULL, 8) = 0 [pid 5418] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5418] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4380f72000 [pid 5418] mprotect(0x7f4380f73000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5418] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5418] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f92990, parent_tid=0x7f4380f92990, exit_signal=0, stack=0x7f4380f72000, stack_size=0x20300, tls=0x7f4380f926c0}./strace-static-x86_64: Process 5419 attached [pid 5419] rseq(0x7f4380f92fe0, 0x20, 0, 0x53053053 [pid 5418] <... clone3 resumed> => {parent_tid=[5419]}, 88) = 5419 [pid 5419] <... rseq resumed>) = 0 [pid 5419] set_robust_list(0x7f4380f929a0, 24 [pid 5418] rt_sigprocmask(SIG_SETMASK, [], [pid 5419] <... set_robust_list resumed>) = 0 [pid 5418] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5419] rt_sigprocmask(SIG_SETMASK, [], [pid 5418] futex(0x7f438105e6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5419] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5418] <... futex resumed>) = 0 [pid 5419] memfd_create("syzkaller", 0 [pid 5418] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5419] <... memfd_create resumed>) = 3 [pid 5418] <... futex resumed>) = 0 [pid 5418] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5419] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4378b51000 [pid 5418] <... mmap resumed>) = 0x7f4380f51000 [pid 5418] mprotect(0x7f4380f52000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5418] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5419] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 5418] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5418] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4380f71990, parent_tid=0x7f4380f71990, exit_signal=0, stack=0x7f4380f51000, stack_size=0x20300, tls=0x7f4380f716c0}./strace-static-x86_64: Process 5420 attached => {parent_tid=[5420]}, 88) = 5420 [pid 5418] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5418] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5418] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5419] <... write resumed>) = 262144 [pid 5420] rseq(0x7f4380f71fe0, 0x20, 0, 0x53053053) = 0 [pid 5419] munmap(0x7f4378b51000, 262144 [pid 5420] set_robust_list(0x7f4380f719a0, 24) = 0 [pid 5420] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5420] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 5419] <... munmap resumed>) = 0 [pid 5419] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5420] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5419] ioctl(5, LOOP_SET_FD, 3 [pid 5420] <... futex resumed>) = 1 [pid 5418] <... futex resumed>) = 0 [pid 5420] fallocate(4, 0, 35143, 7 [pid 5419] <... ioctl resumed>) = 0 [pid 5418] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5419] close(3 [pid 5418] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5419] <... close resumed>) = 0 [pid 5419] mkdir("./file1", 0777) = 0 [pid 5419] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 5420] <... fallocate resumed>) = 0 [pid 5420] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5420] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5418] <... futex resumed>) = 0 [pid 5418] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5420] <... futex resumed>) = 0 [pid 5418] <... futex resumed>) = 1 [pid 5420] mount("/dev/loop0", "./bus", NULL, MS_NOEXEC|MS_BIND|MS_SILENT, NULL [pid 5418] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5420] <... mount resumed>) = 0 [pid 5420] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5418] <... futex resumed>) = 0 [pid 5420] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5418] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5420] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5420] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|O_CLOEXEC|0x3c [pid 5418] <... futex resumed>) = 0 [pid 5420] <... open resumed>) = 3 [pid 5418] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5420] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5418] <... futex resumed>) = 0 [pid 5418] futex(0x7f438105e6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5418] futex(0x7f438105e6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5420] <... futex resumed>) = 1 [pid 5420] write(3, "\x00\xbf\xd1\x68\x73\x7b\x26\x9a\x7e\x32\xe9\x93\xce\x10\x60\x42\xaa\xa5\xc8\x9f\x1a\xa1\x52\xd7\xab\xe5\xbb\xaa\x9c\xac\x31\xb2\x75\x03\xdf\x50\x07\x14\xd7\x94\x63\x48\x62\xc1\xe6\x0c\x6e\x22\xf9\x25\x56\x71\x3c\x0f\xe9\xf4\xe1\xdc\x7d\x5c\xea\x09\x88\xba\xf0\x3e\xfe\xbb\x63\xbd\x7a\x59\x83\xf0\x81\xf8\x11\xf1\x97\xb7\x8a\x5f\x5e\x95\x83\x8c\xc9\x0e\x44\xd8\x37\x7d\x0e\x0d\xc5\xbf\xcc\xf5\xb2\x4d"..., 22455190) = 262144 [pid 5420] futex(0x7f438105e6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5418] <... futex resumed>) = 0 [pid 5420] <... futex resumed>) = 1 [ 57.419749][ T28] audit: type=1800 audit(1694162025.559:103): pid=5420 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor369" name="bus" dev="sda1" ino=1930 res=0 errno=0 [ 57.421796][ T5419] loop0: detected capacity change from 0 to 512 [ 57.461384][ T5419] EXT4-fs (loop0): 1 orphan inode deleted [pid 5420] futex(0x7f438105e6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5419] <... mount resumed>) = 0 [pid 5419] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 6 [pid 5419] chdir("./file1") = 0 [pid 5419] ioctl(5, LOOP_CLR_FD) = 0 [pid 5419] close(5) = 0 [pid 5419] futex(0x7f438105e6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5419] futex(0x7f438105e6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5418] exit_group(0) = ? [pid 5420] <... futex resumed>) = ? [pid 5420] +++ exited with 0 +++ [pid 5419] <... futex resumed>) = ? [pid 5419] +++ exited with 0 +++ [pid 5418] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5418, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- umount2("./101", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./101", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555556e10730 /* 5 entries */, 32768) = 136 umount2("./101/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./101/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./101/bus", {st_mode=S_IFREG|000, st_size=35150, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./101/bus") = 0 umount2("./101/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./101/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./101/binderfs") = 0 [ 57.467332][ T5419] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 57.479595][ T5419] ext4 filesystem being mounted at /root/syzkaller.F1Lso8/101/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 57.508489][ T5033] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. umount2("./101/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./101/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./101/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./101/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./101/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555556e18770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555556e18770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./101/file1") = 0 getdents64(3, 0x555556e10730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./101") = 0 mkdir("./102", 0777)