./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1329245267 <...> Warning: Permanently added '10.128.1.187' (ED25519) to the list of known hosts. execve("./syz-executor1329245267", ["./syz-executor1329245267"], 0x7ffe31be0cb0 /* 10 vars */) = 0 brk(NULL) = 0x555589cb8000 brk(0x555589cb8d00) = 0x555589cb8d00 arch_prctl(ARCH_SET_FS, 0x555589cb8380) = 0 set_tid_address(0x555589cb8650) = 5218 set_robust_list(0x555589cb8660, 24) = 0 rseq(0x555589cb8ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor1329245267", 4096) = 28 getrandom("\x53\x5e\xd0\x69\x1d\x31\xff\x31", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555589cb8d00 brk(0x555589cd9d00) = 0x555589cd9d00 brk(0x555589cda000) = 0x555589cda000 mprotect(0x7fe4ec872000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 mkdir("./syzkaller.FSa1E9", 0700) = 0 chmod("./syzkaller.FSa1E9", 0777) = 0 chdir("./syzkaller.FSa1E9") = 0 mkdir("./0", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5219 attached [pid 5219] set_robust_list(0x555589cb8660, 24) = 0 [pid 5218] <... clone resumed>, child_tidptr=0x555589cb8650) = 5219 [pid 5219] chdir("./0") = 0 [pid 5219] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5219] setpgid(0, 0) = 0 [pid 5219] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5219] write(3, "1000", 4) = 4 [pid 5219] close(3) = 0 [pid 5219] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5219] write(1, "executing program\n", 18executing program ) = 18 [pid 5219] memfd_create("syzkaller", 0) = 3 [pid 5219] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe4e4200000 [pid 5219] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5219] munmap(0x7fe4e4200000, 138412032) = 0 [pid 5219] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5219] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5219] close(3) = 0 [pid 5219] close(4) = 0 [pid 5219] mkdir("./file0", 0777) = 0 [pid 5219] mount("/dev/loop0", "./file0", "jfs", 0, "") = 0 [pid 5219] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5219] chdir("./file0") = 0 [pid 5219] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5219] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 5219] mount("/dev/loop0", "./bus", NULL, MS_BIND|MS_PRIVATE, NULL) = 0 [pid 5219] mount(NULL, NULL, NULL, 0, "workdir=./file0,upperdir=./file2,,") = -1 EFAULT (Bad address) [ 54.693184][ T5219] loop0: detected capacity change from 0 to 32768 [pid 5219] open("./bus", O_RDONLY) = 5 [pid 5219] ioctl(5, LOOP_SET_STATUS, {lo_number=0, lo_offset=0x2c2c, lo_flags=0, lo_name="", ...}) = 0 [pid 5219] exit_group(0) = ? [pid 5219] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5219, si_uid=0, si_status=0, si_utime=5 /* 0.05 s */, si_stime=12 /* 0.12 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [ 54.780705][ T5219] loop0: detected capacity change from 32768 to 32745 getdents64(3, 0x555589cb96f0 /* 4 entries */, 32768) = 112 umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./0/binderfs") = 0 umount2("./0/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EBUSY (Device or resource busy) newfstatat(AT_FDCWD, "./0/file0", {st_mode=S_IFDIR|0755, st_size=256, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./0/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EBUSY (Device or resource busy) openat(AT_FDCWD, "./0/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0755, st_size=256, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555589cc1730 /* 8 entries */, 32768) = 232 umount2("./0/file0/bus", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./0/file0/bus", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/file0/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./0/file0/bus") = 0 umount2("./0/file0/file.cold", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/file0/file.cold", {st_mode=S_IFREG|0755, st_size=100, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./0/file0/file.cold") = 0 umount2("./0/file0/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EIO (Input/output error) newfstatat(AT_FDCWD, "./0/file0/file0", 0x7ffd9b6953e0, AT_SYMLINK_NOFOLLOW) = -1 EIO (Input/output error) exit_group(1) = ? +++ exited with 1 +++ [ 55.009054][ T5218] ERROR: (device loop0): diRead: i_ino != di_number [ 55.009054][ T5218] [ 55.018509][ T5218] ERROR: (device loop0): remounting filesystem as read-only [ 55.025991][ T5218] jfs_lookup: iget failed on inum 32 [ 55.032349][ T5218] ERROR: (device loop0): diRead: i_ino != di_number [ 55.032349][ T5218] [ 55.041591][ T5218] jfs_lookup: iget failed on inum 32 [ 59.763127][ T113] ------------[ cut here ]------------ [ 59.768683][ T113] UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:2780:24 [ 59.776367][ T113] index 4294967295 is out of range for type 's8[1365]' (aka 'signed char[1365]') [ 59.785548][ T113] CPU: 0 UID: 0 PID: 113 Comm: jfsCommit Not tainted 6.12.0-rc3-syzkaller-00013-geca631b8fe80 #0 [ 59.796131][ T113] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 59.806188][ T113] Call Trace: [ 59.809465][ T113] [ 59.812383][ T113] dump_stack_lvl+0x241/0x360 [ 59.817418][ T113] ? __pfx_dump_stack_lvl+0x10/0x10 [ 59.822604][ T113] ? __pfx__printk+0x10/0x10 [ 59.827183][ T113] ? lock_metapage+0x2fa/0x370 [ 59.831935][ T113] __ubsan_handle_out_of_bounds+0x121/0x150 [ 59.837815][ T113] ? folio_mark_accessed+0x6f6/0x11b0 [ 59.843185][ T113] ? __pfx_reacquire_held_locks+0x10/0x10 [ 59.848892][ T113] dbJoin+0x2ed/0x310 [ 59.852865][ T113] ? do_read_cache_folio+0x77a/0x850 [ 59.858135][ T113] dbFreeBits+0x4db/0xd90 [ 59.862463][ T113] dbFree+0x35b/0x680 [ 59.866446][ T113] txFreeMap+0x96a/0xd50 [ 59.870674][ T113] ? _raw_spin_unlock+0x28/0x50 [ 59.875509][ T113] ? __mark_inode_dirty+0x5b2/0xe90 [ 59.880698][ T113] xtTruncate+0xe65/0x3270 [ 59.885110][ T113] ? __pfx_xtTruncate+0x10/0x10 [ 59.889959][ T113] jfs_free_zero_link+0x46e/0x6e0 [ 59.894980][ T113] ? inode_wait_for_writeback+0x111/0x2a0 [ 59.900687][ T113] ? __pfx_jfs_free_zero_link+0x10/0x10 [ 59.906225][ T113] jfs_evict_inode+0x35f/0x440 [ 59.910977][ T113] ? __pfx_jfs_evict_inode+0x10/0x10 [ 59.916245][ T113] evict+0x4e8/0x9b0 [ 59.920142][ T113] ? __pfx_evict+0x10/0x10 [ 59.924570][ T113] ? iput+0x713/0xa50 [ 59.928551][ T113] txUpdateMap+0x931/0xb10 [ 59.933044][ T113] ? __pfx_txUpdateMap+0x10/0x10 [ 59.937966][ T113] ? __wake_up_common_lock+0x18c/0x1e0 [ 59.943418][ T113] jfs_lazycommit+0x49a/0xb80 [ 59.948079][ T113] ? _raw_spin_unlock_irqrestore+0x8f/0x140 [ 59.953972][ T113] ? lockdep_hardirqs_on+0x99/0x150 [ 59.959163][ T113] ? __pfx_jfs_lazycommit+0x10/0x10 [ 59.964348][ T113] ? __pfx_default_wake_function+0x10/0x10 [ 59.970155][ T113] ? __kthread_parkme+0x169/0x1d0 [ 59.975184][ T113] ? __pfx_jfs_lazycommit+0x10/0x10 [ 59.980369][ T113] kthread+0x2f0/0x390 [ 59.984509][ T113] ? __pfx_jfs_lazycommit+0x10/0x10 [ 59.989690][ T113] ? __pfx_kthread+0x10/0x10 [ 59.994263][ T113] ret_from_fork+0x4b/0x80 [ 59.998665][ T113] ? __pfx_kthread+0x10/0x10 [ 60.003236][ T113] ret_from_fork_asm+0x1a/0x30 [ 60.007999][ T113] [ 60.011234][ T113] ---[ end trace ]--- [ 60.015409][ T113] Kernel panic - not syncing: UBSAN: panic_on_warn set ... [ 60.022598][ T113] CPU: 0 UID: 0 PID: 113 Comm: jfsCommit Not tainted 6.12.0-rc3-syzkaller-00013-geca631b8fe80 #0 [ 60.033090][ T113] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 60.043144][ T113] Call Trace: [ 60.046415][ T113] [ 60.049340][ T113] dump_stack_lvl+0x241/0x360 [ 60.054018][ T113] ? __pfx_dump_stack_lvl+0x10/0x10 [ 60.059208][ T113] ? __pfx__printk+0x10/0x10 [ 60.063791][ T113] ? lockdep_hardirqs_on+0x99/0x150 [ 60.068989][ T113] ? vscnprintf+0x5d/0x90 [ 60.073320][ T113] panic+0x349/0x880 [ 60.077208][ T113] ? check_panic_on_warn+0x21/0xb0 [ 60.082315][ T113] ? __pfx_panic+0x10/0x10 [ 60.086719][ T113] ? _printk+0xd5/0x120 [ 60.090883][ T113] ? __pfx__printk+0x10/0x10 [ 60.095471][ T113] check_panic_on_warn+0x86/0xb0 [ 60.100405][ T113] __ubsan_handle_out_of_bounds+0x141/0x150 [ 60.106294][ T113] ? folio_mark_accessed+0x6f6/0x11b0 [ 60.111659][ T113] ? __pfx_reacquire_held_locks+0x10/0x10 [ 60.117374][ T113] dbJoin+0x2ed/0x310 [ 60.121352][ T113] ? do_read_cache_folio+0x77a/0x850 [ 60.126632][ T113] dbFreeBits+0x4db/0xd90 [ 60.130964][ T113] dbFree+0x35b/0x680 [ 60.134948][ T113] txFreeMap+0x96a/0xd50 [ 60.139183][ T113] ? _raw_spin_unlock+0x28/0x50 [ 60.144030][ T113] ? __mark_inode_dirty+0x5b2/0xe90 [ 60.149230][ T113] xtTruncate+0xe65/0x3270 [ 60.153660][ T113] ? __pfx_xtTruncate+0x10/0x10 [ 60.158525][ T113] jfs_free_zero_link+0x46e/0x6e0 [ 60.163548][ T113] ? inode_wait_for_writeback+0x111/0x2a0 [ 60.169265][ T113] ? __pfx_jfs_free_zero_link+0x10/0x10 [ 60.174826][ T113] jfs_evict_inode+0x35f/0x440 [ 60.179585][ T113] ? __pfx_jfs_evict_inode+0x10/0x10 [ 60.184870][ T113] evict+0x4e8/0x9b0 [ 60.188771][ T113] ? __pfx_evict+0x10/0x10 [ 60.193184][ T113] ? iput+0x713/0xa50 [ 60.197159][ T113] txUpdateMap+0x931/0xb10 [ 60.201576][ T113] ? __pfx_txUpdateMap+0x10/0x10 [ 60.206507][ T113] ? __wake_up_common_lock+0x18c/0x1e0 [ 60.211972][ T113] jfs_lazycommit+0x49a/0xb80 [ 60.216643][ T113] ? _raw_spin_unlock_irqrestore+0x8f/0x140 [ 60.222536][ T113] ? lockdep_hardirqs_on+0x99/0x150 [ 60.227739][ T113] ? __pfx_jfs_lazycommit+0x10/0x10 [ 60.232936][ T113] ? __pfx_default_wake_function+0x10/0x10 [ 60.238746][ T113] ? __kthread_parkme+0x169/0x1d0 [ 60.243774][ T113] ? __pfx_jfs_lazycommit+0x10/0x10 [ 60.248966][ T113] kthread+0x2f0/0x390 [ 60.253029][ T113] ? __pfx_jfs_lazycommit+0x10/0x10 [ 60.258219][ T113] ? __pfx_kthread+0x10/0x10 [ 60.262806][ T113] ret_from_fork+0x4b/0x80 [ 60.267221][ T113] ? __pfx_kthread+0x10/0x10 [ 60.271803][ T113] ret_from_fork_asm+0x1a/0x30 [ 60.276574][ T113] [ 60.279846][ T113] Kernel Offset: disabled [ 60.284201][ T113] Rebooting in 86400 seconds..