./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1892310446 <...> Warning: Permanently added '10.128.1.146' (ECDSA) to the list of known hosts. execve("./syz-executor1892310446", ["./syz-executor1892310446"], 0x7ffde75ead80 /* 10 vars */) = 0 brk(NULL) = 0x555555762000 brk(0x555555762c40) = 0x555555762c40 arch_prctl(ARCH_SET_FS, 0x555555762300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 set_tid_address(0x5555557625d0) = 4997 set_robust_list(0x5555557625e0, 24) = 0 rt_sigaction(SIGRTMIN, {sa_handler=0x7f8bd6663470, sa_mask=[], sa_flags=SA_RESTORER|SA_SIGINFO, sa_restorer=0x7f8bd6663b40}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=0x7f8bd6663510, sa_mask=[], sa_flags=SA_RESTORER|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f8bd6663b40}, NULL, 8) = 0 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor1892310446", 4096) = 28 brk(0x555555783c40) = 0x555555783c40 brk(0x555555784000) = 0x555555784000 mprotect(0x7f8bd6726000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 chmod("/dev/raw-gadget", 0666) = 0 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 4998 attached , child_tidptr=0x5555557625d0) = 4998 [pid 4998] set_robust_list(0x5555557625e0, 24) = 0 [pid 4998] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 4998] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 4998] setsid() = 1 [pid 4998] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 4998] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 4998] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 4998] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 4998] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 4998] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 4998] unshare(CLONE_NEWNS) = 0 [pid 4998] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 4998] unshare(CLONE_NEWIPC) = 0 [pid 4998] unshare(CLONE_NEWCGROUP) = 0 [pid 4998] unshare(CLONE_NEWUTS) = 0 [pid 4998] unshare(CLONE_SYSVSEM) = 0 [pid 4998] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 4998] write(3, "16777216", 8) = 8 [pid 4998] close(3) = 0 [pid 4998] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 4998] write(3, "536870912", 9) = 9 [pid 4998] close(3) = 0 [pid 4998] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 4998] write(3, "1024", 4) = 4 [pid 4998] close(3) = 0 [pid 4998] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 4998] write(3, "8192", 4) = 4 [pid 4998] close(3) = 0 [pid 4998] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 4998] write(3, "1024", 4) = 4 [pid 4998] close(3) = 0 [pid 4998] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 4998] write(3, "1024", 4) = 4 [pid 4998] close(3) = 0 [pid 4998] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 4998] write(3, "1024 1048576 500 1024", 21) = 21 [pid 4998] close(3) = 0 [pid 4998] getpid() = 1 [pid 4998] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 4998] futex(0x7f8bd672c7a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5008] <... futex resumed>) = 0 [pid 4998] <... futex resumed>) = 1 [pid 5008] memfd_create("syzkaller", 0 [pid 4998] futex(0x7f8bd672c7ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5008] <... memfd_create resumed>) = 3 [pid 5008] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8bce22f000 [pid 5008] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576 [pid 5008] munmap(0x7f8bce22f000, 1048576) = 0 [pid 5008] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5008] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5008] close(3) = 0 [pid 5008] mkdir("./file0", 0777) = 0 [pid 5008] mount("/dev/loop0", "./file0", "ext4", MS_SYNCHRONOUS|MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0 [pid 5008] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5008] chdir("./file0") = 0 [pid 5008] ioctl(4, LOOP_CLR_FD) = 0 [pid 5008] close(4) = 0 [pid 5008] futex(0x7f8bd672c7ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 4998] <... futex resumed>) = 0 [pid 4998] futex(0x7f8bd672c7a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 4998] futex(0x7f8bd672c7ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5008] <... futex resumed>) = 1 [pid 5008] openat(AT_FDCWD, "memory.current", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 5008] futex(0x7f8bd672c7ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 4998] <... futex resumed>) = 0 [pid 4998] futex(0x7f8bd672c7a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 4998] futex(0x7f8bd672c7ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5008] <... futex resumed>) = 1 [pid 5008] pwritev(4, [{iov_base="\xef", iov_len=1}], 1, 0) = 1 [pid 5008] futex(0x7f8bd672c7ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 4998] <... futex resumed>) = 0 [pid 4998] futex(0x7f8bd672c7a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 4998] futex(0x7f8bd672c7ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5008] <... futex resumed>) = 1 [pid 5008] mmap(0x20000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 5008] futex(0x7f8bd672c7ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 4998] <... futex resumed>) = 0 [pid 4998] futex(0x7f8bd672c7a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 4998] futex(0x7f8bd672c7bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 4998] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8bce30e000 [ 42.764175][ T5008] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=5008 'syz-executor189' [ 42.783470][ T5008] loop0: detected capacity change from 0 to 2048 [ 42.798943][ T5008] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [pid 4998] mprotect(0x7f8bce30f000, 131072, PROT_READ|PROT_WRITE [pid 5008] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000040} --- [pid 4998] <... mprotect resumed>) = 0 [pid 5008] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000040} --- [pid 4998] clone(child_stack=0x7f8bce32e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 5008] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000040} --- ./strace-static-x86_64: Process 5012 attached [pid 5008] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000040} --- [pid 4998] <... clone resumed>, parent_tid=[3], tls=0x7f8bce32e700, child_tidptr=0x7f8bce32e9d0) = 3 [pid 5012] set_robust_list(0x7f8bce32e9e0, 24 [pid 4998] futex(0x7f8bd672c7b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5008] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000040} --- [pid 5012] <... set_robust_list resumed>) = 0 [pid 4998] <... futex resumed>) = 0 [pid 4998] futex(0x7f8bd672c7bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5008] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000040} --- [pid 5008] sendfile(-1, -1, 0x20000040, 0) = -1 EBADF (Bad file descriptor) [pid 5008] futex(0x7f8bd672c7ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5008] futex(0x7f8bd672c7a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5012] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000180} --- [pid 5012] sendmsg(4, 0x20000180, MSG_DONTWAIT|MSG_EOR) = -1 ENOTSOCK (Socket operation on non-socket) [pid 5012] futex(0x7f8bd672c7bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 4998] <... futex resumed>) = 0 [pid 4998] exit_group(1) = ? [pid 5012] <... futex resumed>) = ? [pid 5008] <... futex resumed>) = ? [pid 5008] +++ exited with 1 +++ [ 42.830250][ T5008] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1097: group 0, block bitmap and bg descriptor inconsistent: 25 vs 150994969 free clusters [ 42.863769][ T1090] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 42.865826][ T41] ------------[ cut here ]------------ [ 42.879702][ T41] kernel BUG at fs/ext4/inode.c:2587! [ 42.885569][ T41] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 42.891636][ T41] CPU: 1 PID: 41 Comm: kworker/u4:2 Not tainted 6.4.0-rc4-syzkaller-00051-g48b1320a674e #0 [ 42.901609][ T41] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023 [ 42.911655][ T41] Workqueue: writeback wb_workfn (flush-7:0) [ 42.917752][ T41] RIP: 0010:ext4_do_writepages+0x25db/0x3290 [ 42.923745][ T41] Code: 00 fc ff df 44 89 64 24 24 48 c1 ea 03 80 3c 02 00 0f 84 4b e8 ff ff 48 8b 3c 24 e8 ef 84 a9 ff e9 3d e8 ff ff e8 d5 bb 56 ff <0f> 0b e8 ce bb 56 ff 48 8b 84 24 b0 00 00 00 48 8d 78 40 48 89 f8 [ 42.943349][ T41] RSP: 0018:ffffc90000b274a8 EFLAGS: 00010293 [ 42.949409][ T41] RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 [ 42.957374][ T41] RDX: ffff8880152c0000 RSI: ffffffff822d884b RDI: 0000000000000007 [ 42.965338][ T41] RBP: ffff888078374650 R08: 0000000000000007 R09: 0000000000000000 [ 42.973301][ T41] R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000001 [ 42.981349][ T41] R13: ffffc90000b276a8 R14: ffff8880783748b0 R15: 0000000000000000 [ 42.989315][ T41] FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 [ 42.998239][ T41] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 43.004810][ T41] CR2: 0000000020000180 CR3: 000000001e3ca000 CR4: 0000000000350ee0 [ 43.012790][ T41] Call Trace: [ 43.016069][ T41] [ 43.018999][ T41] ? die+0x32/0x90 [ 43.022726][ T41] ? do_trap+0x1b2/0x3f0 [ 43.026967][ T41] ? ext4_do_writepages+0x25db/0x3290 [ 43.032344][ T41] ? ext4_do_writepages+0x25db/0x3290 [ 43.037717][ T41] ? do_error_trap+0xb1/0x170 [ 43.042392][ T41] ? ext4_do_writepages+0x25db/0x3290 [ 43.047773][ T41] ? handle_invalid_op+0x2c/0x30 [ 43.052704][ T41] ? ext4_do_writepages+0x25db/0x3290 [ 43.058077][ T41] ? exc_invalid_op+0x2f/0x50 [ 43.062762][ T41] ? asm_exc_invalid_op+0x1a/0x20 [ 43.067818][ T41] ? ext4_do_writepages+0x25db/0x3290 [ 43.073190][ T41] ? ext4_do_writepages+0x25db/0x3290 [ 43.078564][ T41] ? ext4_do_writepages+0x25db/0x3290 [ 43.083941][ T41] ? __lock_acquire+0x1987/0x5f30 [ 43.088993][ T41] ? __ext4_mark_inode_dirty+0x800/0x800 [ 43.094631][ T41] ext4_writepages+0x304/0x770 [ 43.099395][ T41] ? ext4_normal_submit_inode_data_buffers+0x1a0/0x1a0 [ 43.106252][ T41] ? ext4_normal_submit_inode_data_buffers+0x1a0/0x1a0 [ 43.113105][ T41] do_writepages+0x1a8/0x640 [ 43.117693][ T41] ? writeback_set_ratelimit+0x150/0x150 [ 43.123321][ T41] ? lock_downgrade+0x690/0x690 [ 43.128175][ T41] ? writeback_sb_inodes+0x3b6/0xe70 [ 43.133459][ T41] ? lock_downgrade+0x690/0x690 [ 43.138309][ T41] __writeback_single_inode+0x121/0xdb0 [ 43.143853][ T41] ? wbc_attach_and_unlock_inode+0x4a3/0x910 [ 43.149835][ T41] writeback_sb_inodes+0x54d/0xe70 [ 43.154950][ T41] ? sync_inode_metadata+0xe0/0xe0 [ 43.160082][ T41] ? rcu_is_watching+0x12/0xb0 [ 43.164849][ T41] ? queue_io+0x386/0x4e0 [ 43.169179][ T41] wb_writeback+0x294/0xa50 [ 43.173683][ T41] ? __writeback_inodes_wb+0x280/0x280 [ 43.179142][ T41] ? lock_downgrade+0x690/0x690 [ 43.183995][ T41] ? mark_held_locks+0x9f/0xe0 [ 43.188753][ T41] ? _raw_spin_unlock_irq+0x23/0x50 [ 43.193952][ T41] wb_workfn+0x2a5/0xfc0 [ 43.198202][ T41] ? inode_wait_for_writeback+0x40/0x40 [ 43.203750][ T41] ? lock_sync+0x190/0x190 [ 43.208293][ T41] ? lock_downgrade+0x690/0x690 [ 43.213181][ T41] ? _raw_spin_unlock_irq+0x23/0x50 [ 43.218579][ T41] process_one_work+0x99a/0x15e0 [ 43.223528][ T41] ? pwq_dec_nr_in_flight+0x2a0/0x2a0 [ 43.228911][ T41] ? spin_bug+0x1c0/0x1c0 [ 43.233248][ T41] ? _raw_spin_lock_irq+0x45/0x50 [ 43.238281][ T41] worker_thread+0x67d/0x10c0 [ 43.242963][ T41] ? process_one_work+0x15e0/0x15e0 [ 43.248162][ T41] kthread+0x344/0x440 [ 43.252229][ T41] ? kthread_complete_and_exit+0x40/0x40 [ 43.257864][ T41] ret_from_fork+0x1f/0x30 [ 43.262286][ T41] [ 43.265325][ T41] Modules linked in: [ 43.273167][ T41] ---[ end trace 0000000000000000 ]--- [ 43.278992][ T41] RIP: 0010:ext4_do_writepages+0x25db/0x3290 [ 43.284980][ T41] Code: 00 fc ff df 44 89 64 24 24 48 c1 ea 03 80 3c 02 00 0f 84 4b e8 ff ff 48 8b 3c 24 e8 ef 84 a9 ff e9 3d e8 ff ff e8 d5 bb 56 ff <0f> 0b e8 ce bb 56 ff 48 8b 84 24 b0 00 00 00 48 8d 78 40 48 89 f8 [ 43.307065][ T41] RSP: 0018:ffffc90000b274a8 EFLAGS: 00010293 [ 43.315448][ T41] RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 [ 43.323426][ T41] RDX: ffff8880152c0000 RSI: ffffffff822d884b RDI: 0000000000000007 [ 43.331575][ T41] RBP: ffff888078374650 R08: 0000000000000007 R09: 0000000000000000 [ 43.340384][ T41] R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000001 [ 43.348558][ T41] R13: ffffc90000b276a8 R14: ffff8880783748b0 R15: 0000000000000000 [ 43.356888][ T41] FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 [ 43.366009][ T41] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 43.372677][ T41] CR2: 0000000020000180 CR3: 000000001e3ca000 CR4: 0000000000350ee0 [ 43.381561][ T41] Kernel panic - not syncing: Fatal exception [ 43.387785][ T41] Kernel Offset: disabled [ 43.392097][ T41] Rebooting in 86400 seconds..