./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1486632918
<...>
Warning: Permanently added '10.128.0.48' (ED25519) to the list of known hosts.
execve("./syz-executor1486632918", ["./syz-executor1486632918"], 0x7ffc35fa2e90 /* 10 vars */) = 0
brk(NULL) = 0x555556592000
brk(0x555556592d00) = 0x555556592d00
arch_prctl(ARCH_SET_FS, 0x555556592380) = 0
set_tid_address(0x555556592650) = 5059
set_robust_list(0x555556592660, 24) = 0
rseq(0x555556592ca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor1486632918", 4096) = 28
getrandom("\x88\x66\xe9\xb1\xc0\xee\x8a\xc5", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x555556592d00
brk(0x5555565b3d00) = 0x5555565b3d00
brk(0x5555565b4000) = 0x5555565b4000
mprotect(0x7fef96f2d000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
mkdir("./syzkaller.I5LRXV", 0700) = 0
chmod("./syzkaller.I5LRXV", 0777) = 0
chdir("./syzkaller.I5LRXV") = 0
mkdir("./0", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5060 attached
, child_tidptr=0x555556592650) = 5060
[pid 5060] set_robust_list(0x555556592660, 24) = 0
[pid 5060] chdir("./0") = 0
[pid 5060] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5060] setpgid(0, 0) = 0
[pid 5060] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5060] write(3, "1000", 4) = 4
[pid 5060] close(3) = 0
[pid 5060] symlink("/dev/binderfs", "./binderfs") = 0
[pid 5060] memfd_create("syzkaller", 0) = 3
[pid 5060] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fef8ea5a000
[pid 5060] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid 5060] munmap(0x7fef8ea5a000, 138412032) = 0
[pid 5060] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 5060] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 5060] close(3) = 0
[pid 5060] mkdir("./file0", 0777) = 0
[ 73.069584][ T5060] loop0: detected capacity change from 0 to 2048
[ 73.084474][ T5060] =======================================================
[ 73.084474][ T5060] WARNING: The mand mount option has been deprecated and
[ 73.084474][ T5060] and is ignored by this kernel. Remove the mand
[ 73.084474][ T5060] option from the mount to silence this warning.
[ 73.084474][ T5060] =======================================================
[pid 5060] mount("/dev/loop0", "./file0", "udf", MS_NODEV|MS_MANDLOCK|MS_NOATIME|MS_REC|MS_POSIXACL, "iocharset=cp936,gid=forget,uid=forget,uid=00000000000000000000,gid=00000000000000000000,nostrict,uid"...) = 0
[pid 5060] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid 5060] chdir("./file0") = 0
[pid 5060] ioctl(4, LOOP_CLR_FD) = 0
[pid 5060] close(4) = 0
[ 73.123700][ T5060] UDF-fs: error (device loop0): udf_read_tagged: tag checksum failed, block 99: 0x27 != 0x4d
[ 73.136557][ T5060] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000)
[pid 5060] creat("./bus", 000) = 4
[pid 5060] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid 5060] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 5
[pid 5060] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0) = 0x20000000
[pid 5060] memfd_create("syzkaller", 0) = 6
[pid 5060] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fef8ea5a000
[pid 5060] write(6, "\xeb\x52\x90\x4e\x54\x46\x53\x20\x20\x20\x20\x00\x10\x01\x00\x00\x00\x00\x00\x00\x00\xf8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x80\x00\xff\x01\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x78\x5f\xaa\x3b\xd7\x0e\xce\x68\x00\x00\x00\x00\x0e\x1f\xbe\x71\x7c\xac\x22\xc0\x74\x0b\x56\xb4\x0e\xbb\x07\x00"..., 2097152) = 2097152
[pid 5060] munmap(0x7fef8ea5a000, 138412032) = 0
[pid 5060] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 5060] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 5060] ioctl(7, LOOP_CLR_FD) = 0
[pid 5060] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 5060] close(7) = 0
[pid 5060] close(6) = 0
[pid 5060] exit_group(0) = ?
[pid 5060] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5060, si_uid=0, si_status=0, si_utime=0, si_stime=10 /* 0.10 s */} ---
umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555565936f0 /* 4 entries */, 32768) = 112
umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./0/binderfs") = 0
[ 73.382355][ T5059] ==================================================================
[ 73.390493][ T5059] BUG: KASAN: use-after-free in udf_close_lvid+0x6a8/0x9a0
[ 73.397716][ T5059] Write of size 1 at addr ffff88808b7f61d8 by task syz-executor148/5059
[ 73.406046][ T5059]
[ 73.408398][ T5059] CPU: 1 PID: 5059 Comm: syz-executor148 Not tainted 6.6.0-syzkaller-15029-gbe3ca57cfb77 #0
[ 73.418473][ T5059] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023
[ 73.428601][ T5059] Call Trace:
[ 73.431885][ T5059]
[ 73.434818][ T5059] dump_stack_lvl+0x1e7/0x2d0
[ 73.439548][ T5059] ? nf_tcp_handle_invalid+0x650/0x650
[ 73.445011][ T5059] ? panic+0x850/0x850
[ 73.449085][ T5059] ? _printk+0xd5/0x120
[ 73.453246][ T5059] print_report+0x163/0x540
[ 73.457749][ T5059] ? __lock_acquire+0x7f70/0x7f70
[ 73.462776][ T5059] ? __virt_addr_valid+0x22f/0x2e0
[ 73.467890][ T5059] ? __phys_addr+0xba/0x170
[ 73.472393][ T5059] ? udf_close_lvid+0x6a8/0x9a0
[ 73.477248][ T5059] kasan_report+0x142/0x170
[ 73.481754][ T5059] ? udf_close_lvid+0x6a8/0x9a0
[ 73.486612][ T5059] udf_close_lvid+0x6a8/0x9a0
[ 73.491291][ T5059] ? udf_open_lvid+0x5b0/0x5b0
[ 73.496051][ T5059] ? iput+0x37e/0x8f0
[ 73.500033][ T5059] ? clear_inode+0x150/0x150
[ 73.504622][ T5059] ? module_put+0x136/0x2a0
[ 73.509121][ T5059] udf_put_super+0xcd/0x160
[ 73.513619][ T5059] ? udf_free_in_core_inode+0x30/0x30
[ 73.518992][ T5059] generic_shutdown_super+0x13a/0x2c0
[ 73.524375][ T5059] kill_block_super+0x44/0x90
[ 73.529052][ T5059] deactivate_locked_super+0xc1/0x130
[ 73.534437][ T5059] cleanup_mnt+0x426/0x4c0
[ 73.538854][ T5059] ? _raw_spin_unlock_irq+0x23/0x50
[ 73.544058][ T5059] task_work_run+0x24a/0x300
[ 73.548656][ T5059] ? task_work_cancel+0x2b0/0x2b0
[ 73.553684][ T5059] ? lockdep_hardirqs_on+0x98/0x140
[ 73.558887][ T5059] ? __x64_sys_umount+0x126/0x170
[ 73.563919][ T5059] ptrace_notify+0x2cd/0x380
[ 73.568621][ T5059] ? user_path_at_empty+0x4c/0x60
[ 73.573648][ T5059] ? do_notify_parent+0x10c0/0x10c0
[ 73.578872][ T5059] ? __x64_sys_umount+0x126/0x170
[ 73.583922][ T5059] ? path_umount+0xf40/0xf40
[ 73.588527][ T5059] ? syscall_enter_from_user_mode+0x32/0x230
[ 73.594539][ T5059] syscall_exit_to_user_mode+0x15c/0x280
[ 73.600182][ T5059] do_syscall_64+0x50/0x110
[ 73.604686][ T5059] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 73.610582][ T5059] RIP: 0033:0x7fef96e9a707
[ 73.614997][ T5059] Code: 09 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8
[ 73.634629][ T5059] RSP: 002b:00007ffdcddd38b8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a6
[ 73.643065][ T5059] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fef96e9a707
[ 73.651046][ T5059] RDX: 0000000000000000 RSI: 000000000000000a RDI: 00007ffdcddd3970
[ 73.659017][ T5059] RBP: 00007ffdcddd3970 R08: 0000000000000000 R09: 0000000000000000
[ 73.666986][ T5059] R10: 00000000ffffffff R11: 0000000000000206 R12: 00007ffdcddd49e0
[ 73.674960][ T5059] R13: 00005555565936c0 R14: 431bde82d7b634db R15: 00007ffdcddd4a00
[ 73.682947][ T5059]
[ 73.685963][ T5059]
[ 73.688287][ T5059] The buggy address belongs to the physical page:
[ 73.694694][ T5059] page:ffffea00022dfd80 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8b7f6
[ 73.704839][ T5059] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 73.711942][ T5059] page_type: 0xffffffff()
[ 73.716273][ T5059] raw: 00fff00000000000 ffffea00022dfd88 ffffea00022dfd88 0000000000000000
[ 73.724854][ T5059] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 73.733426][ T5059] page dumped because: kasan: bad access detected
[ 73.739933][ T5059] page_owner info is not present (never set?)
[ 73.745985][ T5059]
[ 73.748326][ T5059] Memory state around the buggy address:
[ 73.753963][ T5059] ffff88808b7f6080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 73.762034][ T5059] ffff88808b7f6100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 73.770088][ T5059] >ffff88808b7f6180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 73.778140][ T5059] ^
[ 73.785096][ T5059] ffff88808b7f6200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 73.793179][ T5059] ffff88808b7f6280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 73.801284][ T5059] ==================================================================
[ 73.810553][ T5059] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 73.817794][ T5059] CPU: 0 PID: 5059 Comm: syz-executor148 Not tainted 6.6.0-syzkaller-15029-gbe3ca57cfb77 #0
[ 73.828155][ T5059] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023
[ 73.838313][ T5059] Call Trace:
[ 73.841589][ T5059]
[ 73.844535][ T5059] dump_stack_lvl+0x1e7/0x2d0
[ 73.849255][ T5059] ? nf_tcp_handle_invalid+0x650/0x650
[ 73.854728][ T5059] ? panic+0x850/0x850
[ 73.858905][ T5059] ? vscnprintf+0x5d/0x80
[ 73.863255][ T5059] panic+0x349/0x850
[ 73.867177][ T5059] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 73.873368][ T5059] ? check_panic_on_warn+0x21/0xa0
[ 73.878496][ T5059] ? __memcpy_flushcache+0x2b0/0x2b0
[ 73.883817][ T5059] ? _raw_spin_unlock_irqrestore+0x12c/0x140
[ 73.889909][ T5059] ? _raw_spin_unlock+0x40/0x40
[ 73.894764][ T5059] ? print_report+0x4fb/0x540
[ 73.899442][ T5059] check_panic_on_warn+0x82/0xa0
[ 73.904423][ T5059] ? udf_close_lvid+0x6a8/0x9a0
[ 73.909272][ T5059] end_report+0x6e/0x130
[ 73.913514][ T5059] kasan_report+0x153/0x170
[ 73.918025][ T5059] ? udf_close_lvid+0x6a8/0x9a0
[ 73.922889][ T5059] udf_close_lvid+0x6a8/0x9a0
[ 73.927576][ T5059] ? udf_open_lvid+0x5b0/0x5b0
[ 73.932342][ T5059] ? iput+0x37e/0x8f0
[ 73.936328][ T5059] ? clear_inode+0x150/0x150
[ 73.940938][ T5059] ? module_put+0x136/0x2a0
[ 73.945446][ T5059] udf_put_super+0xcd/0x160
[ 73.949966][ T5059] ? udf_free_in_core_inode+0x30/0x30
[ 73.955469][ T5059] generic_shutdown_super+0x13a/0x2c0
[ 73.960873][ T5059] kill_block_super+0x44/0x90
[ 73.965557][ T5059] deactivate_locked_super+0xc1/0x130
[ 73.970942][ T5059] cleanup_mnt+0x426/0x4c0
[ 73.975449][ T5059] ? _raw_spin_unlock_irq+0x23/0x50
[ 73.980669][ T5059] task_work_run+0x24a/0x300
[ 73.985277][ T5059] ? task_work_cancel+0x2b0/0x2b0
[ 73.990314][ T5059] ? lockdep_hardirqs_on+0x98/0x140
[ 73.995522][ T5059] ? __x64_sys_umount+0x126/0x170
[ 74.000584][ T5059] ptrace_notify+0x2cd/0x380
[ 74.005289][ T5059] ? user_path_at_empty+0x4c/0x60
[ 74.010327][ T5059] ? do_notify_parent+0x10c0/0x10c0
[ 74.015560][ T5059] ? __x64_sys_umount+0x126/0x170
[ 74.020613][ T5059] ? path_umount+0xf40/0xf40
[ 74.025220][ T5059] ? syscall_enter_from_user_mode+0x32/0x230
[ 74.031215][ T5059] syscall_exit_to_user_mode+0x15c/0x280
[ 74.036883][ T5059] do_syscall_64+0x50/0x110
[ 74.041444][ T5059] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 74.047368][ T5059] RIP: 0033:0x7fef96e9a707
[ 74.051833][ T5059] Code: 09 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8
[ 74.071569][ T5059] RSP: 002b:00007ffdcddd38b8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a6
[ 74.080090][ T5059] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fef96e9a707
[ 74.088092][ T5059] RDX: 0000000000000000 RSI: 000000000000000a RDI: 00007ffdcddd3970
[ 74.096188][ T5059] RBP: 00007ffdcddd3970 R08: 0000000000000000 R09: 0000000000000000
[ 74.104226][ T5059] R10: 00000000ffffffff R11: 0000000000000206 R12: 00007ffdcddd49e0
[ 74.112482][ T5059] R13: 00005555565936c0 R14: 431bde82d7b634db R15: 00007ffdcddd4a00
[ 74.120674][ T5059]
[ 74.123932][ T5059] Kernel Offset: disabled
[ 74.128256][ T5059] Rebooting in 86400 seconds..