./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3859551184 <...> Warning: Permanently added '10.128.0.96' (ED25519) to the list of known hosts. execve("./syz-executor3859551184", ["./syz-executor3859551184"], 0x7ffeefcd7d40 /* 10 vars */) = 0 brk(NULL) = 0x555556398000 brk(0x555556398d00) = 0x555556398d00 arch_prctl(ARCH_SET_FS, 0x555556398380) = 0 set_tid_address(0x555556398650) = 301 set_robust_list(0x555556398660, 24) = 0 rseq(0x555556398ca0, 0x20, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor3859551184", 4096) = 28 getrandom("\xcd\x57\x56\x04\x3f\x13\xd9\x5b", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555556398d00 brk(0x5555563b9d00) = 0x5555563b9d00 brk(0x5555563ba000) = 0x5555563ba000 mprotect(0x7f4f5c53e000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556398650) = 302 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556398650) = 303 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556398650) = 304 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556398650) = 305 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556398650) = 306 ./strace-static-x86_64: Process 302 attached [pid 302] set_robust_list(0x555556398660, 24) = 0 [pid 302] mkdir("./syzkaller.QOoj9P", 0700) = 0 ./strace-static-x86_64: Process 306 attached [pid 306] set_robust_list(0x555556398660, 24) = 0 [pid 306] mkdir("./syzkaller.3uYnqo", 0700 [pid 302] chmod("./syzkaller.QOoj9P", 0777) = 0 [pid 302] chdir("./syzkaller.QOoj9P") = 0 [pid 302] unshare(CLONE_NEWPID) = 0 [pid 306] <... mkdir resumed>) = 0 [pid 302] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 306] chmod("./syzkaller.3uYnqo", 0777) = 0 [pid 306] chdir("./syzkaller.3uYnqo") = 0 [pid 306] unshare(CLONE_NEWPID) = 0 [pid 306] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 302] <... clone resumed>, child_tidptr=0x555556398650) = 307 [pid 306] <... clone resumed>, child_tidptr=0x555556398650) = 308 ./strace-static-x86_64: Process 307 attached [pid 307] set_robust_list(0x555556398660, 24) = 0 [pid 307] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 307] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 307] setsid() = 1 [pid 307] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 307] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 307] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 307] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 307] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 307] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 307] unshare(CLONE_NEWNS) = 0 [pid 307] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 307] unshare(CLONE_NEWIPC) = -1 EINVAL (Invalid argument) [pid 307] unshare(CLONE_NEWCGROUP) = 0 [pid 307] unshare(CLONE_NEWUTS) = 0 [pid 307] unshare(CLONE_SYSVSEM) = 0 [pid 307] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 307] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 307] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 307] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 307] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 307] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 307] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 307] getpid() = 1 [pid 307] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 308] set_robust_list(0x555556398660, 24./strace-static-x86_64: Process 304 attached ) = 0 ./strace-static-x86_64: Process 305 attached ./strace-static-x86_64: Process 303 attached [pid 308] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 308] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 303] set_robust_list(0x555556398660, 24 [pid 308] <... prctl resumed>) = 0 [pid 305] set_robust_list(0x555556398660, 24 [pid 304] set_robust_list(0x555556398660, 24 [pid 303] <... set_robust_list resumed>) = 0 [pid 308] setsid( [pid 305] <... set_robust_list resumed>) = 0 [pid 304] <... set_robust_list resumed>) = 0 [pid 303] mkdir("./syzkaller.kpJm6w", 0700 [pid 304] mkdir("./syzkaller.Khuq5n", 0700 [pid 308] <... setsid resumed>) = 1 [pid 305] mkdir("./syzkaller.kU6Q73", 0700 [pid 308] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 303] <... mkdir resumed>) = 0 [pid 308] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, [pid 304] <... mkdir resumed>) = 0 [pid 308] <... prlimit64 resumed>NULL) = 0 [pid 305] <... mkdir resumed>) = 0 [pid 308] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 304] chmod("./syzkaller.Khuq5n", 0777 [pid 305] chmod("./syzkaller.kU6Q73", 0777 [pid 303] chmod("./syzkaller.kpJm6w", 0777 [pid 308] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, [pid 304] <... chmod resumed>) = 0 [pid 308] <... prlimit64 resumed>NULL) = 0 [pid 303] <... chmod resumed>) = 0 [pid 305] <... chmod resumed>) = 0 [pid 308] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, [pid 304] chdir("./syzkaller.Khuq5n" [pid 303] chdir("./syzkaller.kpJm6w" [pid 308] <... prlimit64 resumed>NULL) = 0 [pid 304] <... chdir resumed>) = 0 [pid 303] <... chdir resumed>) = 0 [pid 308] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, [pid 305] chdir("./syzkaller.kU6Q73" [pid 304] unshare(CLONE_NEWPID [pid 308] <... prlimit64 resumed>NULL) = 0 [pid 304] <... unshare resumed>) = 0 [pid 308] unshare(CLONE_NEWNS) = 0 [pid 305] <... chdir resumed>) = 0 [pid 303] unshare(CLONE_NEWPID [pid 308] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL [pid 304] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 303] <... unshare resumed>) = 0 [pid 305] unshare(CLONE_NEWPID [pid 308] <... mount resumed>) = 0 [pid 303] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 308] unshare(CLONE_NEWIPC [pid 305] <... unshare resumed>) = 0 [pid 308] <... unshare resumed>) = -1 EINVAL (Invalid argument) [pid 304] <... clone resumed>, child_tidptr=0x555556398650) = 309 [pid 303] <... clone resumed>, child_tidptr=0x555556398650) = 310 [pid 305] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 308] unshare(CLONE_NEWCGROUP) = 0 [pid 308] unshare(CLONE_NEWUTS./strace-static-x86_64: Process 309 attached [ 34.339721][ T30] audit: type=1400 audit(1722726306.060:66): avc: denied { execmem } for pid=301 comm="syz-executor385" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 ) = 0 [pid 305] <... clone resumed>, child_tidptr=0x555556398650) = 311 [pid 309] set_robust_list(0x555556398660, 24) = 0 [pid 309] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) ./strace-static-x86_64: Process 310 attached [pid 310] set_robust_list(0x555556398660, 24) = 0 [pid 310] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL [pid 309] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 309] setsid() = 1 [pid 309] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 309] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 309] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, [pid 310] <... mount resumed>) = -1 EBUSY (Device or resource busy) [pid 309] <... prlimit64 resumed>NULL) = 0 [pid 309] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 309] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 309] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 309] unshare(CLONE_NEWNS) = 0 [pid 310] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 310] setsid() = 1 [pid 310] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 310] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 310] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 310] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 310] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 310] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 310] unshare(CLONE_NEWNS) = 0 [pid 309] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 309] unshare(CLONE_NEWIPC) = -1 EINVAL (Invalid argument) [pid 309] unshare(CLONE_NEWCGROUP) = 0 [pid 309] unshare(CLONE_NEWUTS) = 0 [pid 309] unshare(CLONE_SYSVSEM) = 0 [pid 309] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC [pid 310] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 309] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 310] unshare(CLONE_NEWIPC) = -1 EINVAL (Invalid argument) [pid 310] unshare(CLONE_NEWCGROUP) = 0 [pid 309] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 310] unshare(CLONE_NEWUTS) = 0 [pid 310] unshare(CLONE_SYSVSEM) = 0 [pid 310] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC [pid 309] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 310] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 309] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 310] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 309] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 310] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 309] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) ./strace-static-x86_64: Process 311 attached [pid 308] unshare(CLONE_SYSVSEM [pid 310] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 309] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 310] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 309] getpid() = 1 [pid 309] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 310] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC [pid 309] <... capset resumed>) = 0 [pid 310] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 309] unshare(CLONE_NEWNET [pid 310] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 310] getpid() = 1 [pid 310] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 311] set_robust_list(0x555556398660, 24 [pid 308] <... unshare resumed>) = 0 [pid 311] <... set_robust_list resumed>) = 0 [pid 308] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC [pid 311] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL [pid 308] <... openat resumed>) = -1 ENOENT (No such file or directory) [ 34.383830][ T30] audit: type=1400 audit(1722726306.060:67): avc: denied { mounton } for pid=307 comm="syz-executor385" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 34.408438][ T30] audit: type=1400 audit(1722726306.060:68): avc: denied { mount } for pid=307 comm="syz-executor385" name="/" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [pid 311] <... mount resumed>) = -1 EBUSY (Device or resource busy) [pid 308] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC [pid 311] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 308] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 311] <... prctl resumed>) = 0 [pid 311] setsid( [pid 308] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC [pid 311] <... setsid resumed>) = 1 [pid 308] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 311] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, [pid 308] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC [pid 311] <... prlimit64 resumed>NULL) = 0 [pid 311] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, [pid 308] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 311] <... prlimit64 resumed>NULL) = 0 [pid 308] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC [pid 311] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, [pid 308] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 311] <... prlimit64 resumed>NULL) = 0 [pid 311] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, [pid 308] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC [pid 311] <... prlimit64 resumed>NULL) = 0 [pid 308] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 311] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 308] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC [pid 311] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, [pid 308] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 311] <... prlimit64 resumed>NULL) = 0 [pid 311] unshare(CLONE_NEWNS [pid 308] getpid( [pid 311] <... unshare resumed>) = 0 [pid 308] <... getpid resumed>) = 1 [pid 308] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, [pid 311] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 308] <... capget resumed>{effective=1< [pid 308] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 311] <... unshare resumed>) = -1 EINVAL (Invalid argument) [pid 311] unshare(CLONE_NEWCGROUP [pid 308] <... capset resumed>) = 0 [pid 307] <... unshare resumed>) = 0 [pid 307] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC) = 3 [pid 307] write(3, "0 65535", 7) = 7 [pid 307] close(3) = 0 [ 34.432956][ T30] audit: type=1400 audit(1722726306.080:69): avc: denied { mounton } for pid=307 comm="syz-executor385" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [pid 307] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC [pid 311] <... unshare resumed>) = 0 [pid 308] unshare(CLONE_NEWNET [pid 311] unshare(CLONE_NEWUTS [pid 307] <... openat resumed>) = 3 [pid 307] write(3, "100000", 6) = 6 [pid 307] close(3) = 0 [pid 307] mkdir("./syz-tmp", 0777) = 0 [pid 307] mount("", "./syz-tmp", "tmpfs", 0, NULL) = 0 [pid 307] mkdir("./syz-tmp/newroot", 0777) = 0 [pid 307] mkdir("./syz-tmp/newroot/dev", 0700) = 0 [pid 307] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0 [pid 307] mkdir("./syz-tmp/newroot/proc", 0700) = 0 [pid 307] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL) = 0 [pid 307] mkdir("./syz-tmp/newroot/selinux", 0700) = 0 [pid 307] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = -1 ENOENT (No such file or directory) [pid 307] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0 [pid 307] mkdir("./syz-tmp/newroot/sys", 0700) = 0 [pid 307] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0 [pid 307] mkdir("./syz-tmp/pivot", 0777) = 0 [pid 307] pivot_root("./syz-tmp", "./syz-tmp/pivot") = 0 [pid 307] chdir("/") = 0 [pid 307] umount2("./pivot", MNT_DETACH [pid 311] <... unshare resumed>) = 0 [pid 307] <... umount2 resumed>) = 0 [pid 311] unshare(CLONE_SYSVSEM) = 0 [pid 307] chroot("./newroot") = 0 [pid 311] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC [pid 307] chdir("/") = 0 [pid 307] mkdir("/dev/binderfs", 0777) = 0 [pid 307] mount("binder", "/dev/binderfs", "binder", 0, NULL) = 0 [pid 307] mkdir("./0", 0777) = 0 [pid 307] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 311] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 311] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC [pid 307] <... clone resumed>, child_tidptr=0x555556398650) = 2 [pid 311] <... openat resumed>) = -1 ENOENT (No such file or directory) [ 34.487447][ T30] audit: type=1400 audit(1722726306.200:70): avc: denied { mounton } for pid=307 comm="syz-executor385" path="/root/syzkaller.QOoj9P/syz-tmp" dev="sda1" ino=1932 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 executing program [pid 311] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC./strace-static-x86_64: Process 312 attached [pid 312] set_robust_list(0x555556398660, 24) = 0 [pid 312] chdir("./0") = 0 [pid 312] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 312] setpgid(0, 0) = 0 [pid 312] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 312] write(3, "1000", 4) = 4 [pid 312] close(3) = 0 [pid 312] symlink("/dev/binderfs", "./binderfs") = 0 [pid 312] write(1, "executing program\n", 18) = 18 [pid 312] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=12, insns=0x20000180, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 311] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 311] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 311] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 311] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 311] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 311] getpid() = 1 [pid 311] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 309] <... unshare resumed>) = 0 [pid 309] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC) = 3 [pid 309] write(3, "0 65535", 7) = 7 [pid 309] close(3) = 0 [pid 309] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC) = 3 [pid 309] write(3, "100000", 6) = 6 [pid 309] close(3) = 0 [pid 309] mkdir("./syz-tmp", 0777 [pid 310] <... unshare resumed>) = 0 [pid 309] <... mkdir resumed>) = 0 [pid 310] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC [ 34.518191][ T30] audit: type=1400 audit(1722726306.200:71): avc: denied { mount } for pid=307 comm="syz-executor385" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 34.543596][ T30] audit: type=1400 audit(1722726306.200:72): avc: denied { mounton } for pid=307 comm="syz-executor385" path="/root/syzkaller.QOoj9P/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [pid 309] mount("", "./syz-tmp", "tmpfs", 0, NULL [pid 310] <... openat resumed>) = 3 [pid 309] <... mount resumed>) = 0 [pid 310] write(3, "0 65535", 7 [pid 309] mkdir("./syz-tmp/newroot", 0777 [pid 310] <... write resumed>) = 7 [pid 310] close(3 [pid 309] <... mkdir resumed>) = 0 [pid 310] <... close resumed>) = 0 [pid 309] mkdir("./syz-tmp/newroot/dev", 0700 [pid 310] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC) = 3 [pid 309] <... mkdir resumed>) = 0 [pid 310] write(3, "100000", 6 [pid 309] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 310] <... write resumed>) = 6 [pid 310] close(3 [pid 309] <... mount resumed>) = 0 [pid 310] <... close resumed>) = 0 [pid 309] mkdir("./syz-tmp/newroot/proc", 0700 [pid 310] mkdir("./syz-tmp", 0777 [pid 309] <... mkdir resumed>) = 0 [pid 310] <... mkdir resumed>) = 0 [pid 309] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL [pid 310] mount("", "./syz-tmp", "tmpfs", 0, NULL [pid 309] <... mount resumed>) = 0 [pid 310] <... mount resumed>) = 0 [pid 309] mkdir("./syz-tmp/newroot/selinux", 0700 [pid 310] mkdir("./syz-tmp/newroot", 0777 [pid 309] <... mkdir resumed>) = 0 [pid 310] <... mkdir resumed>) = 0 [pid 309] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 310] mkdir("./syz-tmp/newroot/dev", 0700 [pid 309] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 310] <... mkdir resumed>) = 0 [pid 309] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 310] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 309] <... mount resumed>) = 0 [pid 310] <... mount resumed>) = 0 [pid 309] mkdir("./syz-tmp/newroot/sys", 0700 [pid 310] mkdir("./syz-tmp/newroot/proc", 0700 [pid 309] <... mkdir resumed>) = 0 [pid 310] <... mkdir resumed>) = 0 [pid 309] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 310] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL [pid 309] <... mount resumed>) = 0 [pid 310] <... mount resumed>) = 0 [pid 309] mkdir("./syz-tmp/pivot", 0777 [pid 310] mkdir("./syz-tmp/newroot/selinux", 0700) = 0 [pid 309] <... mkdir resumed>) = 0 [pid 310] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 309] pivot_root("./syz-tmp", "./syz-tmp/pivot" [pid 310] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 309] <... pivot_root resumed>) = 0 [pid 310] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 309] chdir("/" [pid 310] <... mount resumed>) = 0 [pid 309] <... chdir resumed>) = 0 [pid 310] mkdir("./syz-tmp/newroot/sys", 0700 [pid 309] umount2("./pivot", MNT_DETACH [pid 310] <... mkdir resumed>) = 0 [pid 310] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 309] <... umount2 resumed>) = 0 [pid 310] <... mount resumed>) = 0 [pid 309] chroot("./newroot" [pid 310] mkdir("./syz-tmp/pivot", 0777 [pid 309] <... chroot resumed>) = 0 [pid 310] <... mkdir resumed>) = 0 [pid 309] chdir("/" [pid 310] pivot_root("./syz-tmp", "./syz-tmp/pivot" [pid 309] <... chdir resumed>) = 0 [pid 310] <... pivot_root resumed>) = 0 [pid 309] mkdir("/dev/binderfs", 0777 [pid 310] chdir("/" [pid 309] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 310] <... chdir resumed>) = 0 [pid 309] mount("binder", "/dev/binderfs", "binder", 0, NULL [pid 310] umount2("./pivot", MNT_DETACH [pid 309] <... mount resumed>) = 0 [pid 310] <... umount2 resumed>) = 0 [pid 309] mkdir("./0", 0777 [pid 310] chroot("./newroot") = 0 [pid 309] <... mkdir resumed>) = 0 [pid 310] chdir("/" [pid 309] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 310] <... chdir resumed>) = 0 [pid 310] mkdir("/dev/binderfs", 0777 [pid 309] <... clone resumed>, child_tidptr=0x555556398650) = 2 [pid 310] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 310] mount("binder", "/dev/binderfs", "binder", 0, NULL) = 0 [pid 310] mkdir("./0", 0777) = 0 [pid 310] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556398650) = 2 [ 34.618367][ T30] audit: type=1400 audit(1722726306.200:73): avc: denied { mount } for pid=307 comm="syz-executor385" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [pid 308] <... unshare resumed>) = 0 [pid 311] <... unshare resumed>) = 0 ./strace-static-x86_64: Process 313 attached [pid 313] set_robust_list(0x555556398660, 24) = 0 [pid 313] chdir("./0" [pid 311] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC) = 3 [pid 313] <... chdir resumed>) = 0 [pid 313] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 313] setpgid(0, 0) = 0 [pid 313] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 311] write(3, "0 65535", 7) = 7 [pid 311] close(3) = 0 [pid 311] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC) = 3 [pid 313] <... openat resumed>) = 3 [pid 311] write(3, "100000", 6) = 6 [pid 311] close(3) = 0 [pid 313] write(3, "1000", 4 [pid 311] mkdir("./syz-tmp", 0777 [pid 313] <... write resumed>) = 4 [pid 311] <... mkdir resumed>) = 0 [pid 313] close(3) = 0 [pid 313] symlink("/dev/binderfs", "./binderfs") = 0 [pid 313] write(1, "executing program\n", 18executing program ) = 18 ./strace-static-x86_64: Process 314 attached [pid 314] set_robust_list(0x555556398660, 24) = 0 [pid 314] chdir("./0") = 0 [pid 314] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 314] setpgid(0, 0) = 0 [pid 313] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=12, insns=0x20000180, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 314] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXECexecuting program ) = 3 [pid 314] write(3, "1000", 4) = 4 [pid 314] close(3) = 0 [pid 314] symlink("/dev/binderfs", "./binderfs") = 0 [pid 308] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC [pid 314] write(1, "executing program\n", 18) = 18 [pid 308] <... openat resumed>) = 3 [pid 314] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=12, insns=0x20000180, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 311] mount("", "./syz-tmp", "tmpfs", 0, NULL) = 0 [pid 308] write(3, "0 65535", 7) = 7 [pid 308] close(3) = 0 [pid 308] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC) = 3 [pid 308] write(3, "100000", 6) = 6 [pid 311] mkdir("./syz-tmp/newroot", 0777 [pid 308] close(3 [pid 311] <... mkdir resumed>) = 0 [pid 308] <... close resumed>) = 0 [pid 308] mkdir("./syz-tmp", 0777) = 0 [pid 311] mkdir("./syz-tmp/newroot/dev", 0700) = 0 [pid 311] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0 [pid 311] mkdir("./syz-tmp/newroot/proc", 0700) = 0 [pid 311] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL) = 0 [pid 308] mount("", "./syz-tmp", "tmpfs", 0, NULL) = 0 [pid 308] mkdir("./syz-tmp/newroot", 0777) = 0 [pid 311] mkdir("./syz-tmp/newroot/selinux", 0700) = 0 [pid 308] mkdir("./syz-tmp/newroot/dev", 0700) = 0 [pid 311] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = -1 ENOENT (No such file or directory) [pid 308] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0 [pid 311] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0 [pid 308] mkdir("./syz-tmp/newroot/proc", 0700 [pid 311] mkdir("./syz-tmp/newroot/sys", 0700 [pid 308] <... mkdir resumed>) = 0 [pid 311] <... mkdir resumed>) = 0 [pid 308] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL [pid 311] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 308] <... mount resumed>) = 0 [pid 311] <... mount resumed>) = 0 [pid 311] mkdir("./syz-tmp/pivot", 0777 [pid 308] mkdir("./syz-tmp/newroot/selinux", 0700 [pid 311] <... mkdir resumed>) = 0 [pid 308] <... mkdir resumed>) = 0 [pid 311] pivot_root("./syz-tmp", "./syz-tmp/pivot" [pid 308] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 311] <... pivot_root resumed>) = 0 [pid 308] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 311] chdir("/" [pid 308] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 311] <... chdir resumed>) = 0 [pid 308] <... mount resumed>) = 0 [ 34.676477][ T30] audit: type=1400 audit(1722726306.200:74): avc: denied { unmount } for pid=307 comm="syz-executor385" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [pid 311] umount2("./pivot", MNT_DETACH [pid 308] mkdir("./syz-tmp/newroot/sys", 0700) = 0 [pid 308] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0 [pid 308] mkdir("./syz-tmp/pivot", 0777) = 0 [pid 308] pivot_root("./syz-tmp", "./syz-tmp/pivot") = 0 [pid 308] chdir("/") = 0 [pid 308] umount2("./pivot", MNT_DETACH [pid 311] <... umount2 resumed>) = 0 [pid 311] chroot("./newroot" [pid 308] <... umount2 resumed>) = 0 [pid 311] <... chroot resumed>) = 0 [pid 308] chroot("./newroot" [pid 311] chdir("/" [pid 308] <... chroot resumed>) = 0 [pid 311] <... chdir resumed>) = 0 [pid 308] chdir("/" [pid 311] mkdir("/dev/binderfs", 0777 [pid 308] <... chdir resumed>) = 0 [pid 311] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 308] mkdir("/dev/binderfs", 0777 [pid 311] mount("binder", "/dev/binderfs", "binder", 0, NULL [pid 308] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 311] <... mount resumed>) = 0 [pid 308] mount("binder", "/dev/binderfs", "binder", 0, NULL [pid 311] mkdir("./0", 0777 [pid 308] <... mount resumed>) = 0 [pid 311] <... mkdir resumed>) = 0 [pid 308] mkdir("./0", 0777 [pid 311] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 308] <... mkdir resumed>) = 0 [pid 308] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 311] <... clone resumed>, child_tidptr=0x555556398650) = 2 [pid 308] <... clone resumed>, child_tidptr=0x555556398650) = 2 ./strace-static-x86_64: Process 316 attached [pid 316] set_robust_list(0x555556398660, 24) = 0 [pid 316] chdir("./0") = 0 [pid 316] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 316] setpgid(0, 0) = 0 [pid 316] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 316] write(3, "1000", 4) = 4 [pid 316] close(3) = 0 [pid 316] symlink("/dev/binderfs", "./binderfs") = 0 [pid 316] write(1, "executing program\n", 18./strace-static-x86_64: Process 315 attached [pid 315] set_robust_list(0x555556398660, 24) = 0 [pid 315] chdir("./0") = 0 [pid 315] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 315] setpgid(0, 0) = 0 [pid 315] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 315] write(3, "1000", 4) = 4 [pid 315] close(3) = 0 [pid 315] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 315] write(1, "executing program\n", 18) = 18 [pid 315] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=12, insns=0x20000180, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144executing program [pid 316] <... write resumed>) = 18 [ 34.727981][ T30] audit: type=1400 audit(1722726306.230:75): avc: denied { mounton } for pid=307 comm="syz-executor385" path="/dev/binderfs" dev="devtmpfs" ino=362 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 35.355128][ T313] syz-executor385[313] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 35.355346][ T314] syz-executor385[314] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 35.367462][ T315] syz-executor385[315] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 35.367661][ T316] syz-executor385[316] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [pid 316] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=12, insns=0x20000180, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 314] <... bpf resumed>) = 3 [pid 314] openat(AT_FDCWD, "/selinux/enforce", O_WRONLY [pid 315] <... bpf resumed>) = 3 [pid 315] openat(AT_FDCWD, "/selinux/enforce", O_WRONLY [pid 314] <... openat resumed>) = 4 [pid 315] <... openat resumed>) = 4 [pid 314] writev(4, [{iov_base="\f7", iov_len=2}], 1 [pid 312] <... bpf resumed>) = 3 [pid 313] <... bpf resumed>) = 3 [pid 315] writev(4, [{iov_base="\f7", iov_len=2}], 1 [pid 316] <... bpf resumed>) = 3 [pid 316] openat(AT_FDCWD, "/selinux/enforce", O_WRONLY [pid 312] <... openat resumed>) = 4 [pid 316] <... writev resumed>) = 2 [pid 315] <... write resumed>) = 18 [pid 314] <... write resumed>) = 18 [pid 313] writev(4, [{iov_base="\f7", iov_len=2}], 1 [pid 315] close(3 [pid 312] writev(4, [{iov_base="\f7", iov_len=2}], 1 [pid 316] write(4, "0x0000000000000000", 18) = 18 [pid 316] close(3) = 0 [pid 316] close(4[pid 315] <... close resumed>) = 0 [pid 314] close(4 [pid 316] close(6 [pid 315] close(5 [pid 313] <... write resumed>) = 18 [pid 312] <... write resumed>) = 18 [pid 316] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 315] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 314] <... close resumed>) = 0 [pid 313] close(3 [pid 312] close(3 [pid 316] close(7 [pid 315] close(6 [pid 313] <... close resumed>) = 0 [pid 316] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 315] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 312] <... close resumed>) = 0 [pid 313] close(4 [pid 316] close(8 [pid 315] close(7 [pid 314] close(5 [pid 312] close(4 [pid 316] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 315] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 313] <... close resumed>) = 0 [pid 316] close(9 [pid 315] close(8 [pid 314] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 313] close(5 [pid 312] <... close resumed>) = 0 [pid 316] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 315] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 314] close(6 [pid 313] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 312] close(5 [pid 316] close(10 [pid 315] close(9 [pid 314] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 313] close(6 [pid 312] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 316] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 315] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 314] close(7 [pid 313] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 312] close(6 [pid 316] close(11 [pid 315] close(10 [pid 314] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 313] close(7 [pid 312] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 316] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 315] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 314] close(8 [pid 313] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 312] close(7 [pid 316] close(12 [pid 315] close(11 [pid 314] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 313] close(8 [pid 312] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 316] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 315] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 314] close(9 [pid 313] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 312] close(8 [pid 316] close(13 [pid 315] close(12 [pid 314] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 313] close(9 [pid 312] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 316] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 315] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 314] close(10 [pid 313] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 316] close(14 [pid 315] close(13 [pid 314] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 313] close(10 [pid 312] close(9 [pid 316] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 315] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 314] close(11 [pid 313] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 312] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 316] close(15 [pid 315] close(14 [pid 314] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 316] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 315] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 314] close(12 [pid 313] close(11 [pid 312] close(10 [pid 316] close(16 [pid 315] close(15 [pid 314] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 313] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 316] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 315] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 314] close(13 [pid 312] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 316] close(17 [pid 315] close(16 [pid 314] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 313] close(12 [pid 312] close(11 [pid 316] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 315] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 314] close(14 [pid 313] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 316] close(18 [pid 315] close(17 [pid 314] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 313] close(13 [pid 312] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 316] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 315] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 314] close(15 [pid 313] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 312] close(12 [pid 316] close(19 [pid 315] close(18 [pid 314] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 313] close(14 [pid 312] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 316] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 315] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 314] close(16 [pid 313] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 312] close(13 [pid 316] close(20 [pid 315] close(19 [pid 314] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 313] close(15 [pid 312] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 316] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 316] close(21) = -1 EBADF (Bad file descriptor) [pid 316] close(22) = -1 EBADF (Bad file descriptor) [pid 316] close(23) = -1 EBADF (Bad file descriptor) [pid 316] close(24) = -1 EBADF (Bad file descriptor) [pid 316] close(25) = -1 EBADF (Bad file descriptor) [pid 316] close(26) = -1 EBADF (Bad file descriptor) [pid 316] close(27) = -1 EBADF (Bad file descriptor) [pid 316] close(28) = -1 EBADF (Bad file descriptor) [pid 315] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 314] close(17 [pid 313] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 312] close(14 [pid 316] close(29 [pid 315] close(20 [pid 314] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 313] close(16 [pid 312] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 316] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 315] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 314] close(18 [pid 313] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 312] close(15 [pid 316] exit_group(0 [pid 315] close(21 [pid 314] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 313] close(17 [pid 312] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 316] <... exit_group resumed>) = ? [pid 315] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 314] close(19 [pid 313] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 312] close(16 [pid 315] close(22) = -1 EBADF (Bad file descriptor) [pid 316] +++ exited with 0 +++ [pid 315] close(23 [pid 314] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 313] close(18 [pid 312] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 315] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 314] close(20 [pid 313] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 312] close(17 [pid 308] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 315] close(24 [pid 314] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 313] close(19 [pid 312] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 308] restart_syscall(<... resuming interrupted clone ...> [pid 315] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 314] close(21 [pid 313] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 312] close(18 [pid 315] close(25 [pid 314] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 313] close(20 [pid 312] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 315] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 314] close(22 [pid 313] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 315] close(26 [pid 314] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 312] close(19 [pid 315] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 314] close(23 [pid 313] close(21 [pid 312] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 315] close(27 [pid 314] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 313] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 312] close(20 [pid 315] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 314] close(24 [pid 313] close(22 [pid 312] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 315] close(28 [pid 314] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 313] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 312] close(21 [pid 315] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 314] close(25 [pid 313] close(23 [pid 312] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 315] close(29 [pid 314] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 313] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 312] close(22 [pid 308] <... restart_syscall resumed>) = 0 [pid 315] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 314] close(26 [pid 313] close(24 [pid 312] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 315] exit_group(0 [pid 314] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 313] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 312] close(23 [pid 315] <... exit_group resumed>) = ? [pid 314] close(27 [pid 313] close(25 [pid 312] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 315] +++ exited with 0 +++ [pid 314] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 313] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 312] close(24 [pid 308] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW [pid 314] close(28 [pid 313] close(26 [pid 312] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 311] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 311] restart_syscall(<... resuming interrupted clone ...> [ 35.379432][ T312] syz-executor385[312] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 35.402211][ T315] syz-executor385[315] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 35.415714][ T312] syz-executor385[312] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [pid 308] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 314] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 313] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 312] close(25 [pid 314] close(29 [pid 313] close(27 [pid 312] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 308] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 314] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 313] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 312] close(26 [pid 308] <... openat resumed>) = 3 [pid 314] exit_group(0 [pid 313] close(28 [pid 312] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 314] <... exit_group resumed>) = ? [pid 308] newfstatat(3, "", [pid 313] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 312] close(27 [pid 314] +++ exited with 0 +++ [pid 310] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 310] restart_syscall(<... resuming interrupted clone ...> [pid 308] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=60, ...}, AT_EMPTY_PATH) = 0 [pid 308] getdents64(3, 0x5555563996f0 /* 3 entries */, 32768) = 80 [pid 308] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 308] newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 308] unlink("./0/binderfs") = 0 [pid 308] getdents64(3, 0x5555563996f0 /* 0 entries */, 32768) = 0 [pid 308] close(3) = 0 [pid 308] rmdir("./0") = 0 [pid 308] mkdir("./1", 0777) = 0 [pid 308] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556398650) = 3 [pid 311] <... restart_syscall resumed>) = 0 [pid 310] <... restart_syscall resumed>) = 0 [pid 311] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW [pid 310] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW [pid 311] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 310] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 311] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 310] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 311] <... openat resumed>) = 3 [pid 310] <... openat resumed>) = 3 [pid 311] newfstatat(3, "", [pid 310] newfstatat(3, "", [pid 311] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=60, ...}, AT_EMPTY_PATH) = 0 [pid 310] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=60, ...}, AT_EMPTY_PATH) = 0 [pid 311] getdents64(3, [pid 310] getdents64(3, [pid 311] <... getdents64 resumed>0x5555563996f0 /* 3 entries */, 32768) = 80 [pid 310] <... getdents64 resumed>0x5555563996f0 /* 3 entries */, 32768) = 80 [pid 311] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 310] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 311] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 310] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 311] newfstatat(AT_FDCWD, "./0/binderfs", [pid 310] newfstatat(AT_FDCWD, "./0/binderfs", [pid 311] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 310] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 311] unlink("./0/binderfs" [pid 310] unlink("./0/binderfs" [pid 311] <... unlink resumed>) = 0 [pid 310] <... unlink resumed>) = 0 [pid 311] getdents64(3, [pid 310] getdents64(3, [pid 311] <... getdents64 resumed>0x5555563996f0 /* 0 entries */, 32768) = 0 [pid 310] <... getdents64 resumed>0x5555563996f0 /* 0 entries */, 32768) = 0 [pid 311] close(3 [pid 310] close(3 [pid 311] <... close resumed>) = 0 [pid 310] <... close resumed>) = 0 [pid 311] rmdir("./0" [pid 310] rmdir("./0" [pid 311] <... rmdir resumed>) = 0 [pid 310] <... rmdir resumed>) = 0 [pid 311] mkdir("./1", 0777 [pid 310] mkdir("./1", 0777 [pid 311] <... mkdir resumed>) = 0 [pid 310] <... mkdir resumed>) = 0 ./strace-static-x86_64: Process 318 attached [pid 313] close(29 [pid 312] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 311] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 310] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 320 attached ./strace-static-x86_64: Process 319 attached [pid 318] set_robust_list(0x555556398660, 24 [pid 313] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 312] close(28 [pid 320] set_robust_list(0x555556398660, 24 [pid 319] set_robust_list(0x555556398660, 24 [pid 318] <... set_robust_list resumed>) = 0 [pid 313] exit_group(0 [pid 312] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 311] <... clone resumed>, child_tidptr=0x555556398650) = 3 [pid 310] <... clone resumed>, child_tidptr=0x555556398650) = 3 [pid 319] <... set_robust_list resumed>) = 0 [pid 318] chdir("./1" [pid 312] close(29 [pid 313] <... exit_group resumed>) = ? [pid 320] <... set_robust_list resumed>) = 0 [pid 318] <... chdir resumed>) = 0 [pid 312] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 319] chdir("./1") = 0 [pid 319] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 319] setpgid(0, 0 [pid 313] +++ exited with 0 +++ [pid 319] <... setpgid resumed>) = 0 [pid 320] chdir("./1" [pid 319] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 318] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 312] exit_group(0executing program [pid 320] <... chdir resumed>) = 0 [pid 319] <... openat resumed>) = 3 [pid 318] <... prctl resumed>) = 0 [pid 312] <... exit_group resumed>) = ? [pid 309] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 319] write(3, "1000", 4 [pid 318] setpgid(0, 0 [pid 319] <... write resumed>) = 4 [pid 319] close(3) = 0 [pid 319] symlink("/dev/binderfs", "./binderfs") = 0 [pid 319] write(1, "executing program\n", 18) = 18 [pid 319] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=12, insns=0x20000180, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 320] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 318] <... setpgid resumed>) = 0 [pid 312] +++ exited with 0 +++ [pid 309] restart_syscall(<... resuming interrupted clone ...> [pid 320] <... prctl resumed>) = 0 [pid 318] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 309] <... restart_syscall resumed>) = 0 [pid 307] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=75} --- [pid 320] setpgid(0, 0 [pid 318] <... openat resumed>) = 3 [pid 307] restart_syscall(<... resuming interrupted clone ...> [pid 320] <... setpgid resumed>) = 0 [pid 318] write(3, "1000", 4 [pid 307] <... restart_syscall resumed>) = 0 [pid 320] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 318] <... write resumed>) = 4 [pid 309] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW [pid 320] <... openat resumed>) = 3 [pid 318] close(3 [pid 309] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 320] write(3, "1000", 4 [pid 318] <... close resumed>) = 0 [pid 309] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 307] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW [pid 320] <... write resumed>) = 4 [pid 318] symlink("/dev/binderfs", "./binderfs" [pid 309] <... openat resumed>) = 3 [pid 307] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 320] close(3 [pid 318] <... symlink resumed>) = 0 [pid 309] newfstatat(3, "", [pid 307] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORYexecuting program [pid 320] <... close resumed>) = 0 [pid 318] write(1, "executing program\n", 18 [pid 309] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=60, ...}, AT_EMPTY_PATH) = 0 [pid 307] <... openat resumed>) = 3 [pid 320] symlink("/dev/binderfs", "./binderfs" [pid 318] <... write resumed>) = 18 [pid 309] getdents64(3, [pid 307] newfstatat(3, "", [pid 320] <... symlink resumed>) = 0 [pid 318] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=12, insns=0x20000180, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 309] <... getdents64 resumed>0x5555563996f0 /* 3 entries */, 32768) = 80 [pid 307] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=60, ...}, AT_EMPTY_PATH) = 0 executing program [pid 320] write(1, "executing program\n", 18 [pid 319] <... bpf resumed>) = 3 [pid 318] <... bpf resumed>) = 3 [pid 309] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 307] getdents64(3, [pid 320] <... write resumed>) = 18 [pid 318] openat(AT_FDCWD, "/selinux/enforce", O_WRONLY [pid 309] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 307] <... getdents64 resumed>0x5555563996f0 /* 3 entries */, 32768) = 80 [pid 320] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=12, insns=0x20000180, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 318] <... openat resumed>) = 4 [pid 309] newfstatat(AT_FDCWD, "./0/binderfs", [pid 307] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 320] <... bpf resumed>) = 3 [pid 319] openat(AT_FDCWD, "/selinux/enforce", O_WRONLY [pid 318] writev(4, [{iov_base="\f7", iov_len=2}], 1 [pid 309] <... unlink resumed>) = 0 [pid 307] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 320] writev(4, [{iov_base="\f7", iov_len=2}], 1 [pid 309] <... getdents64 resumed>0x5555563996f0 /* 0 entries */, 32768) = 0 [pid 307] <... unlink resumed>) = 0 [pid 320] write(4, "0x0000000000000000", 18 [pid 319] <... write resumed>) = 18 [pid 318] <... close resumed>) = 0 [pid 309] close(3 [pid 307] getdents64(3, [pid 320] <... write resumed>) = 18 [pid 318] close(4 [pid 309] <... close resumed>) = 0 [pid 307] <... getdents64 resumed>0x5555563996f0 /* 0 entries */, 32768) = 0 [pid 320] close(3 [pid 318] <... close resumed>) = 0 [pid 309] rmdir("./0" [pid 307] close(3 [pid 320] <... close resumed>) = 0 [pid 318] close(5 [pid 309] <... rmdir resumed>) = 0 [pid 307] <... close resumed>) = 0 [pid 320] close(4 [pid 318] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 309] mkdir("./1", 0777 [pid 307] rmdir("./0" [pid 320] <... close resumed>) = 0 [pid 318] close(6 [pid 309] <... mkdir resumed>) = 0 [pid 307] <... rmdir resumed>) = 0 [pid 320] close(5 [pid 318] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 309] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 307] mkdir("./1", 0777 [pid 320] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 319] close(3 [pid 318] close(7 [pid 307] <... mkdir resumed>) = 0 [pid 318] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 309] <... clone resumed>, child_tidptr=0x555556398650) = 3 [pid 307] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 320] close(6 [pid 319] <... close resumed>) = 0 [pid 318] close(8) = -1 EBADF (Bad file descriptor) [pid 307] <... clone resumed>, child_tidptr=0x555556398650) = 3 [pid 318] close(9) = -1 EBADF (Bad file descriptor) [pid 318] close(10) = -1 EBADF (Bad file descriptor) [pid 318] close(11) = -1 EBADF (Bad file descriptor) [pid 318] close(12) = -1 EBADF (Bad file descriptor) [pid 318] close(13) = -1 EBADF (Bad file descriptor) [pid 318] close(14) = -1 EBADF (Bad file descriptor) [pid 318] close(15) = -1 EBADF (Bad file descriptor) [pid 318] close(16) = -1 EBADF (Bad file descriptor) [pid 318] close(17) = -1 EBADF (Bad file descriptor) [pid 318] close(18) = -1 EBADF (Bad file descriptor) [pid 318] close(19) = -1 EBADF (Bad file descriptor) [pid 318] close(20) = -1 EBADF (Bad file descriptor) [pid 318] close(21) = -1 EBADF (Bad file descriptor) [pid 318] close(22) = -1 EBADF (Bad file descriptor) [pid 318] close(23) = -1 EBADF (Bad file descriptor) [pid 318] close(24) = -1 EBADF (Bad file descriptor) [pid 318] close(25) = -1 EBADF (Bad file descriptor) [pid 318] close(26) = -1 EBADF (Bad file descriptor) [pid 318] close(27) = -1 EBADF (Bad file descriptor) [pid 318] close(28) = -1 EBADF (Bad file descriptor) [pid 318] close(29) = -1 EBADF (Bad file descriptor) [pid 318] exit_group(0) = ? ./strace-static-x86_64: Process 322 attached ./strace-static-x86_64: Process 321 attached [pid 320] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 319] close(4 [pid 318] +++ exited with 0 +++ [pid 322] set_robust_list(0x555556398660, 24) = 0 [pid 322] chdir("./1") = 0 [pid 322] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 322] setpgid(0, 0) = 0 [pid 322] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 321] set_robust_list(0x555556398660, 24 [pid 320] close(7 [pid 319] <... close resumed>) = 0 [pid 308] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 322] write(3, "1000", 4) = 4 [pid 322] close(3) = 0 [pid 322] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 322] write(1, "executing program\n", 18) = 18 [pid 320] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 321] <... set_robust_list resumed>) = 0 [pid 319] close(5 [pid 320] close(8) = -1 EBADF (Bad file descriptor) [pid 319] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 321] chdir("./1" [pid 320] close(9 [pid 319] close(6 [pid 322] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=12, insns=0x20000180, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 321] <... chdir resumed>) = 0 [pid 320] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 319] <... close resumed>) = -1 EBADF (Bad file descriptor) [ 35.416877][ T316] syz-executor385[316] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 35.489229][ T314] syz-executor385 (314) used greatest stack depth: 22176 bytes left [ 35.521121][ T319] syz-executor385[319] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [pid 322] <... bpf resumed>) = 3 [pid 321] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 320] close(10 [pid 319] close(7 [pid 321] <... prctl resumed>) = 0 [pid 320] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 319] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 322] openat(AT_FDCWD, "/selinux/enforce", O_WRONLY [pid 320] close(11 [pid 319] close(8 [pid 321] setpgid(0, 0 [pid 320] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 319] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 321] <... setpgid resumed>) = 0 [pid 320] close(12 [pid 319] close(9 [pid 320] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 322] <... openat resumed>) = 4 [pid 321] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 320] close(13 [pid 319] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 320] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 319] close(10 [pid 320] close(14 [pid 322] writev(4, [{iov_base="\f7", iov_len=2}], 1 [pid 320] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 319] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 321] <... openat resumed>) = 3 [pid 320] close(15 [pid 319] close(11 [pid 321] write(3, "1000", 4 [pid 320] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 319] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 321] <... write resumed>) = 4 [pid 320] close(16