./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3881325073 <...> Warning: Permanently added '10.128.0.3' (ED25519) to the list of known hosts. execve("./syz-executor3881325073", ["./syz-executor3881325073"], 0x7ffc0f620b60 /* 10 vars */) = 0 brk(NULL) = 0x55556a2b3000 brk(0x55556a2b3d00) = 0x55556a2b3d00 arch_prctl(ARCH_SET_FS, 0x55556a2b3380) = 0 set_tid_address(0x55556a2b3650) = 5819 set_robust_list(0x55556a2b3660, 24) = 0 rseq(0x55556a2b3ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor3881325073", 4096) = 28 getrandom("\xab\x99\x62\x30\xc0\x05\xd1\x4e", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55556a2b3d00 brk(0x55556a2d4d00) = 0x55556a2d4d00 brk(0x55556a2d5000) = 0x55556a2d5000 mprotect(0x7fd4f25da000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 mkdir("/syzcgroup", 0777) = 0 mkdir("/syzcgroup/unified", 0777) = 0 mount("none", "/syzcgroup/unified", "cgroup2", 0, NULL) = 0 chmod("/syzcgroup/unified", 0777) = 0 [ 57.771210][ T29] audit: type=1400 audit(1737028449.609:88): avc: denied { execmem } for pid=5819 comm="syz-executor388" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 openat(AT_FDCWD, "/syzcgroup/unified/cgroup.subtree_control", O_WRONLY) = 3 write(3, "+cpu", 4) = 4 write(3, "+io", 3) = 3 write(3, "+pids", 5) = 5 close(3) = 0 [ 57.807079][ T29] audit: type=1400 audit(1737028449.649:89): avc: denied { mounton } for pid=5819 comm="syz-executor388" path="/syzcgroup/unified" dev="sda1" ino=1927 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 57.830119][ T29] audit: type=1400 audit(1737028449.649:90): avc: denied { mount } for pid=5819 comm="syz-executor388" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 mkdir("/syzcgroup/net", 0777) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "net") = -1 EINVAL (Invalid argument) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio") = 0 umount2("/syzcgroup/net", 0) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "devices") = 0 umount2("/syzcgroup/net", 0) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "blkio") = 0 umount2("/syzcgroup/net", 0) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "freezer") = 0 umount2("/syzcgroup/net", 0) = 0 [ 57.907961][ T5819] cgroup: Unknown subsys name 'net' [ 57.926171][ T29] audit: type=1400 audit(1737028449.769:91): avc: denied { unmount } for pid=5819 comm="syz-executor388" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = 0 chmod("/syzcgroup/net", 0777) = 0 mkdir("/syzcgroup/cpu", 0777) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset") = -1 EINVAL (Invalid argument) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct") = 0 umount2("/syzcgroup/cpu", 0) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "hugetlb") = 0 umount2("/syzcgroup/cpu", 0) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "rlimit") = -1 EINVAL (Invalid argument) mount("none", "/syzcgroup/cpu", "cgroup", 0, "memory") = 0 umount2("/syzcgroup/cpu", 0) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct,hugetlb,memory") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct,hugetlb,memory") = ? ERESTARTNOINTR (To be restarted) [ 58.066833][ T5819] cgroup: Unknown subsys name 'cpuset' [ 58.077377][ T5819] cgroup: Unknown subsys name 'rlimit' mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct,hugetlb,memory") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct,hugetlb,memory") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct,hugetlb,memory") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct,hugetlb,memory") = 0 chmod("/syzcgroup/cpu", 0777) = 0 openat(AT_FDCWD, "/syzcgroup/cpu/cgroup.clone_children", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/syzcgroup/cpu/cpuset.memory_pressure_enabled", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/proc/self/make-it-fail", O_WRONLY) = 3 close(3) = 0 openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_WRONLY) = 3 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/failslab/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3 write(3, "N", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_futex/ignore-private", O_WRONLY|O_CLOEXEC) = 3 write(3, "N", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-highmem", O_WRONLY|O_CLOEXEC) = 3 write(3, "N", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3 write(3, "N", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/min-order", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5820 attached [pid 5820] set_robust_list(0x55556a2b3660, 24 [pid 5819] <... clone resumed>, child_tidptr=0x55556a2b3650) = 5820 [pid 5820] <... set_robust_list resumed>) = 0 [pid 5820] mkdir("./syzkaller.4RpDbx", 0700 [pid 5819] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5820] <... mkdir resumed>) = 0 ./strace-static-x86_64: Process 5821 attached [pid 5819] <... clone resumed>, child_tidptr=0x55556a2b3650) = 5821 [pid 5821] set_robust_list(0x55556a2b3660, 24 [pid 5820] chmod("./syzkaller.4RpDbx", 0777 [pid 5821] <... set_robust_list resumed>) = 0 [pid 5820] <... chmod resumed>) = 0 [pid 5819] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5821] mkdir("./syzkaller.QRLq2l", 0700 [pid 5820] chdir("./syzkaller.4RpDbx"./strace-static-x86_64: Process 5822 attached [pid 5821] <... mkdir resumed>) = 0 [pid 5820] <... chdir resumed>) = 0 [pid 5820] unshare(CLONE_NEWPID [pid 5822] set_robust_list(0x55556a2b3660, 24 [pid 5821] chmod("./syzkaller.QRLq2l", 0777 [pid 5819] <... clone resumed>, child_tidptr=0x55556a2b3650) = 5822 [pid 5819] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5822] <... set_robust_list resumed>) = 0 [pid 5821] <... chmod resumed>) = 0 [pid 5820] <... unshare resumed>) = 0 [pid 5822] mkdir("./syzkaller.6Yy9kK", 0700 [pid 5820] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5821] chdir("./syzkaller.QRLq2l") = 0 [pid 5821] unshare(CLONE_NEWPID) = 0 [pid 5821] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5824 attached ./strace-static-x86_64: Process 5823 attached ./strace-static-x86_64: Process 5825 attached [pid 5819] <... clone resumed>, child_tidptr=0x55556a2b3650) = 5824 [pid 5822] <... mkdir resumed>) = 0 [pid 5820] <... clone resumed>, child_tidptr=0x55556a2b3650) = 5823 [pid 5819] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5824] set_robust_list(0x55556a2b3660, 24 [pid 5823] set_robust_list(0x55556a2b3660, 24 [pid 5825] set_robust_list(0x55556a2b3660, 24 [pid 5821] <... clone resumed>, child_tidptr=0x55556a2b3650) = 5825 [pid 5824] <... set_robust_list resumed>) = 0 [pid 5823] <... set_robust_list resumed>) = 0 [pid 5822] chmod("./syzkaller.6Yy9kK", 0777./strace-static-x86_64: Process 5826 attached [pid 5823] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5826] set_robust_list(0x55556a2b3660, 24 [pid 5825] <... set_robust_list resumed>) = 0 [pid 5822] <... chmod resumed>) = 0 [pid 5826] <... set_robust_list resumed>) = 0 [pid 5819] <... clone resumed>, child_tidptr=0x55556a2b3650) = 5826 [pid 5825] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5824] mkdir("./syzkaller.yYfQDR", 0700 [pid 5823] <... prctl resumed>) = 0 [pid 5822] chdir("./syzkaller.6Yy9kK" [pid 5826] mkdir("./syzkaller.cFET9a", 0700 [pid 5825] <... prctl resumed>) = 0 [pid 5823] getppid( [pid 5822] <... chdir resumed>) = 0 [pid 5823] <... getppid resumed>) = 0 [pid 5825] getppid( [pid 5824] <... mkdir resumed>) = 0 [pid 5823] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, [pid 5822] unshare(CLONE_NEWPID [pid 5824] chmod("./syzkaller.yYfQDR", 0777 [pid 5826] <... mkdir resumed>) = 0 [pid 5825] <... getppid resumed>) = 0 [pid 5823] <... prlimit64 resumed>NULL) = 0 [pid 5822] <... unshare resumed>) = 0 [pid 5826] chmod("./syzkaller.cFET9a", 0777 [pid 5824] <... chmod resumed>) = 0 [pid 5825] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, [pid 5823] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, [pid 5822] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5826] <... chmod resumed>) = 0 [pid 5825] <... prlimit64 resumed>NULL) = 0 [pid 5823] <... prlimit64 resumed>NULL) = 0 [pid 5826] chdir("./syzkaller.cFET9a") = 0 [pid 5824] chdir("./syzkaller.yYfQDR" [pid 5826] unshare(CLONE_NEWPID) = 0 [pid 5824] <... chdir resumed>) = 0 [pid 5826] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5827 attached [pid 5825] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, [pid 5823] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, [pid 5827] set_robust_list(0x55556a2b3660, 24 [pid 5825] <... prlimit64 resumed>NULL) = 0 [pid 5823] <... prlimit64 resumed>NULL) = 0 [pid 5827] <... set_robust_list resumed>) = 0 [pid 5825] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, [pid 5823] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, [pid 5822] <... clone resumed>, child_tidptr=0x55556a2b3650) = 5827 [pid 5827] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5825] <... prlimit64 resumed>NULL) = 0 [pid 5823] <... prlimit64 resumed>NULL) = 0 ./strace-static-x86_64: Process 5828 attached [pid 5827] <... prctl resumed>) = 0 [pid 5826] <... clone resumed>, child_tidptr=0x55556a2b3650) = 5828 [pid 5825] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, [pid 5824] unshare(CLONE_NEWPID [pid 5823] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, [pid 5828] set_robust_list(0x55556a2b3660, 24 [pid 5827] getppid( [pid 5825] <... prlimit64 resumed>NULL) = 0 [pid 5824] <... unshare resumed>) = 0 [pid 5823] <... prlimit64 resumed>NULL) = 0 [pid 5828] <... set_robust_list resumed>) = 0 [pid 5827] <... getppid resumed>) = 0 [pid 5825] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, [pid 5824] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5823] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, [pid 5828] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5827] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, [pid 5825] <... prlimit64 resumed>NULL) = 0 [pid 5823] <... prlimit64 resumed>NULL) = 0 ./strace-static-x86_64: Process 5829 attached [pid 5828] <... prctl resumed>) = 0 [pid 5827] <... prlimit64 resumed>NULL) = 0 [pid 5825] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, [pid 5823] unshare(CLONE_NEWNS [pid 5829] set_robust_list(0x55556a2b3660, 24 [pid 5828] getppid( [pid 5827] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, [pid 5825] <... prlimit64 resumed>NULL) = 0 [pid 5824] <... clone resumed>, child_tidptr=0x55556a2b3650) = 5829 [pid 5829] <... set_robust_list resumed>) = 0 [pid 5825] unshare(CLONE_NEWNS [pid 5828] <... getppid resumed>) = 0 [pid 5827] <... prlimit64 resumed>NULL) = 0 [pid 5823] <... unshare resumed>) = 0 [pid 5828] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, [pid 5827] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, [pid 5825] <... unshare resumed>) = 0 [pid 5829] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5825] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL [pid 5829] <... prctl resumed>) = 0 [pid 5828] <... prlimit64 resumed>NULL) = 0 [pid 5827] <... prlimit64 resumed>NULL) = 0 [pid 5829] getppid( [pid 5828] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, [pid 5827] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, [pid 5825] <... mount resumed>) = 0 [pid 5823] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL [pid 5828] <... prlimit64 resumed>NULL) = 0 [pid 5827] <... prlimit64 resumed>NULL) = 0 [pid 5823] <... mount resumed>) = 0 [pid 5828] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, [pid 5827] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, [pid 5828] <... prlimit64 resumed>NULL) = 0 [pid 5827] <... prlimit64 resumed>NULL) = 0 [pid 5823] unshare(CLONE_NEWIPC [pid 5828] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5827] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, [pid 5823] <... unshare resumed>) = 0 [pid 5828] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, [pid 5827] <... prlimit64 resumed>NULL) = 0 [pid 5828] <... prlimit64 resumed>NULL) = 0 [pid 5827] unshare(CLONE_NEWNS [pid 5828] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, [pid 5827] <... unshare resumed>) = 0 [pid 5828] <... prlimit64 resumed>NULL) = 0 [pid 5828] unshare(CLONE_NEWNS [pid 5823] unshare(CLONE_NEWCGROUP [pid 5828] <... unshare resumed>) = 0 [pid 5823] <... unshare resumed>) = 0 [pid 5823] unshare(CLONE_NEWUTS [pid 5827] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL [pid 5823] <... unshare resumed>) = 0 [pid 5827] <... mount resumed>) = 0 [pid 5823] unshare(CLONE_SYSVSEM) = 0 [pid 5828] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL [pid 5827] unshare(CLONE_NEWIPC [pid 5823] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC [pid 5828] <... mount resumed>) = 0 [pid 5827] <... unshare resumed>) = 0 [pid 5823] <... openat resumed>) = 3 [pid 5828] unshare(CLONE_NEWIPC) = 0 [pid 5829] <... getppid resumed>) = 0 [pid 5827] unshare(CLONE_NEWCGROUP [pid 5825] unshare(CLONE_NEWIPC [pid 5823] write(3, "16777216", 8 [pid 5829] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, [pid 5828] unshare(CLONE_NEWCGROUP [pid 5827] <... unshare resumed>) = 0 [pid 5823] <... write resumed>) = 8 [pid 5829] <... prlimit64 resumed>NULL) = 0 [pid 5828] <... unshare resumed>) = 0 [pid 5827] unshare(CLONE_NEWUTS [pid 5825] <... unshare resumed>) = 0 [pid 5823] close(3 [pid 5829] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, [pid 5828] unshare(CLONE_NEWUTS [pid 5827] <... unshare resumed>) = 0 [pid 5825] unshare(CLONE_NEWCGROUP [pid 5823] <... close resumed>) = 0 [pid 5829] <... prlimit64 resumed>NULL) = 0 [pid 5827] unshare(CLONE_SYSVSEM [pid 5829] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, [pid 5828] <... unshare resumed>) = 0 [pid 5827] <... unshare resumed>) = 0 [pid 5823] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC [pid 5829] <... prlimit64 resumed>NULL) = 0 [pid 5828] unshare(CLONE_SYSVSEM [pid 5825] <... unshare resumed>) = 0 [pid 5828] <... unshare resumed>) = 0 [pid 5827] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC [pid 5828] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC [pid 5823] <... openat resumed>) = 3 [pid 5827] <... openat resumed>) = 3 [pid 5829] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, [pid 5828] <... openat resumed>) = 3 [pid 5825] unshare(CLONE_NEWUTS [pid 5823] write(3, "536870912", 9 [pid 5829] <... prlimit64 resumed>NULL) = 0 [pid 5828] write(3, "16777216", 8 [pid 5827] write(3, "16777216", 8 [pid 5825] <... unshare resumed>) = 0 [pid 5829] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, [pid 5828] <... write resumed>) = 8 [pid 5827] <... write resumed>) = 8 [pid 5825] unshare(CLONE_SYSVSEM [pid 5823] <... write resumed>) = 9 [pid 5829] <... prlimit64 resumed>NULL) = 0 [pid 5828] close(3 [pid 5827] close(3 [pid 5825] <... unshare resumed>) = 0 [pid 5829] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, [pid 5828] <... close resumed>) = 0 [pid 5827] <... close resumed>) = 0 [pid 5825] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC [pid 5823] close(3 [pid 5829] <... prlimit64 resumed>NULL) = 0 [pid 5828] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC [pid 5827] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC [pid 5829] unshare(CLONE_NEWNS [pid 5828] <... openat resumed>) = 3 [pid 5825] <... openat resumed>) = 3 [pid 5823] <... close resumed>) = 0 [pid 5827] <... openat resumed>) = 3 [pid 5823] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC [pid 5829] <... unshare resumed>) = 0 [pid 5828] write(3, "536870912", 9 [pid 5827] write(3, "536870912", 9 [pid 5825] write(3, "16777216", 8 [pid 5823] <... openat resumed>) = 3 [pid 5828] <... write resumed>) = 9 [pid 5827] <... write resumed>) = 9 [pid 5825] <... write resumed>) = 8 [pid 5828] close(3 [pid 5827] close(3 [pid 5825] close(3 [pid 5829] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL [pid 5828] <... close resumed>) = 0 [pid 5827] <... close resumed>) = 0 [pid 5825] <... close resumed>) = 0 [pid 5829] <... mount resumed>) = 0 [pid 5828] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC [pid 5827] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC [pid 5825] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC [pid 5829] unshare(CLONE_NEWIPC [pid 5828] <... openat resumed>) = 3 [pid 5827] <... openat resumed>) = 3 [pid 5825] <... openat resumed>) = 3 [pid 5823] write(3, "1024", 4 [pid 5829] <... unshare resumed>) = 0 [pid 5828] write(3, "1024", 4 [pid 5827] write(3, "1024", 4 [pid 5825] write(3, "536870912", 9 [pid 5823] <... write resumed>) = 4 [pid 5829] unshare(CLONE_NEWCGROUP [pid 5828] <... write resumed>) = 4 [pid 5823] close(3 [pid 5829] <... unshare resumed>) = 0 [pid 5828] close(3 [pid 5827] <... write resumed>) = 4 [pid 5825] <... write resumed>) = 9 [pid 5829] unshare(CLONE_NEWUTS [pid 5828] <... close resumed>) = 0 [pid 5827] close(3 [pid 5825] close(3 [pid 5823] <... close resumed>) = 0 [pid 5829] <... unshare resumed>) = 0 [pid 5828] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC [pid 5827] <... close resumed>) = 0 [pid 5825] <... close resumed>) = 0 [pid 5823] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC [pid 5829] unshare(CLONE_SYSVSEM [pid 5828] <... openat resumed>) = 3 [pid 5827] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC [pid 5825] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC [pid 5823] <... openat resumed>) = 3 [pid 5829] <... unshare resumed>) = 0 [pid 5827] <... openat resumed>) = 3 [pid 5825] <... openat resumed>) = 3 [pid 5828] write(3, "8192", 4 [pid 5823] write(3, "8192", 4 [pid 5827] write(3, "8192", 4 [pid 5823] <... write resumed>) = 4 [pid 5827] <... write resumed>) = 4 [pid 5828] <... write resumed>) = 4 [pid 5823] close(3 [pid 5827] close(3 [pid 5825] write(3, "1024", 4 [pid 5829] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC [pid 5827] <... close resumed>) = 0 [pid 5825] <... write resumed>) = 4 [pid 5823] <... close resumed>) = 0 [pid 5828] close(3 [pid 5827] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC [pid 5825] close(3 [pid 5829] <... openat resumed>) = 3 [pid 5828] <... close resumed>) = 0 [pid 5827] <... openat resumed>) = 3 [pid 5825] <... close resumed>) = 0 [pid 5823] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC [pid 5825] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC [pid 5829] write(3, "16777216", 8 [pid 5828] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC [pid 5827] write(3, "1024", 4 [pid 5823] <... openat resumed>) = 3 [pid 5825] <... openat resumed>) = 3 [pid 5823] write(3, "1024", 4) = 4 [pid 5829] <... write resumed>) = 8 [ 58.270649][ T29] audit: type=1400 audit(1737028450.109:92): avc: denied { mounton } for pid=5825 comm="syz-executor388" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [pid 5823] close(3 [pid 5829] close(3 [pid 5828] <... openat resumed>) = 3 [pid 5827] <... write resumed>) = 4 [pid 5825] write(3, "8192", 4 [pid 5823] <... close resumed>) = 0 [pid 5823] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC [pid 5829] <... close resumed>) = 0 [pid 5828] write(3, "1024", 4 [pid 5827] close(3 [pid 5825] <... write resumed>) = 4 [pid 5829] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC [pid 5827] <... close resumed>) = 0 [pid 5825] close(3 [pid 5823] <... openat resumed>) = 3 [pid 5829] <... openat resumed>) = 3 [pid 5828] <... write resumed>) = 4 [pid 5827] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC [pid 5825] <... close resumed>) = 0 [pid 5828] close(3 [pid 5825] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC [pid 5829] write(3, "536870912", 9 [pid 5828] <... close resumed>) = 0 [pid 5827] <... openat resumed>) = 3 [pid 5823] write(3, "1024", 4 [pid 5829] <... write resumed>) = 9 [pid 5827] write(3, "1024", 4 [pid 5825] <... openat resumed>) = 3 [pid 5823] <... write resumed>) = 4 [pid 5829] close(3 [pid 5828] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC [pid 5827] <... write resumed>) = 4 [pid 5825] write(3, "1024", 4 [pid 5823] close(3 [pid 5829] <... close resumed>) = 0 [pid 5827] close(3 [pid 5823] <... close resumed>) = 0 [pid 5829] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC [pid 5828] <... openat resumed>) = 3 [pid 5827] <... close resumed>) = 0 [pid 5825] <... write resumed>) = 4 [pid 5829] <... openat resumed>) = 3 [pid 5828] write(3, "1024", 4 [pid 5825] close(3 [pid 5827] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC [pid 5823] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC [pid 5829] write(3, "1024", 4 [pid 5828] <... write resumed>) = 4 [pid 5825] <... close resumed>) = 0 [pid 5828] close(3 [pid 5825] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC [pid 5828] <... close resumed>) = 0 [pid 5825] <... openat resumed>) = 3 [pid 5823] <... openat resumed>) = 3 [pid 5827] <... openat resumed>) = 3 [pid 5828] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC [pid 5829] <... write resumed>) = 4 [pid 5828] <... openat resumed>) = 3 [pid 5827] write(3, "1024 1048576 500 1024", 21 [pid 5825] write(3, "1024", 4 [pid 5823] write(3, "1024 1048576 500 1024", 21 [pid 5829] close(3 [pid 5827] <... write resumed>) = 21 [pid 5829] <... close resumed>) = 0 [pid 5828] write(3, "1024 1048576 500 1024", 21 [pid 5827] close(3 [pid 5825] <... write resumed>) = 4 [pid 5823] <... write resumed>) = 21 [pid 5829] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC [pid 5828] <... write resumed>) = 21 [pid 5825] close(3 [pid 5823] close(3 [pid 5828] close(3) = 0 [pid 5829] <... openat resumed>) = 3 [pid 5828] getpid() = 1 [pid 5825] <... close resumed>) = 0 [pid 5823] <... close resumed>) = 0 [pid 5828] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 5829] write(3, "8192", 4 [pid 5827] <... close resumed>) = 0 [pid 5825] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC [pid 5823] getpid( [pid 5829] <... write resumed>) = 4 [pid 5827] getpid( [pid 5825] <... openat resumed>) = 3 [pid 5823] <... getpid resumed>) = 1 [pid 5829] close(3 [pid 5827] <... getpid resumed>) = 1 [pid 5825] write(3, "1024 1048576 500 1024", 21 [pid 5823] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, [pid 5829] <... close resumed>) = 0 [pid 5827] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, [pid 5825] <... write resumed>) = 21 [pid 5823] <... capget resumed>{effective=1< [pid 5827] <... capget resumed>{effective=1< [pid 5823] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 5829] <... openat resumed>) = 3 [pid 5827] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 5825] <... close resumed>) = 0 [pid 5823] <... capset resumed>) = 0 [pid 5829] write(3, "1024", 4 [pid 5827] <... capset resumed>) = 0 [pid 5823] unshare(CLONE_NEWNET [pid 5829] <... write resumed>) = 4 [pid 5827] unshare(CLONE_NEWNET [pid 5829] close(3) = 0 [pid 5829] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC [pid 5825] getpid() = 1 [pid 5825] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, [pid 5829] <... openat resumed>) = 3 [pid 5825] <... capget resumed>{effective=1< [pid 5825] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 5829] <... write resumed>) = 4 [pid 5825] <... capset resumed>) = 0 [pid 5829] close(3 [pid 5825] unshare(CLONE_NEWNET [pid 5829] <... close resumed>) = 0 [pid 5829] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 5829] write(3, "1024 1048576 500 1024", 21) = 21 [pid 5829] close(3) = 0 [pid 5829] getpid() = 1 [pid 5829] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 5823] <... unshare resumed>) = 0 [pid 5823] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC) = 3 [pid 5823] write(3, "0 65535", 7) = 7 [pid 5823] close(3) = 0 [pid 5828] <... unshare resumed>) = 0 [pid 5823] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC) = 3 [pid 5823] write(3, "100000", 6) = 6 [pid 5828] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC [pid 5823] close(3 [pid 5828] <... openat resumed>) = 3 [pid 5823] <... close resumed>) = 0 [pid 5823] mkdir("./syz-tmp", 0777 [pid 5828] write(3, "0 65535", 7 [pid 5823] <... mkdir resumed>) = 0 [pid 5828] <... write resumed>) = 7 [pid 5828] close(3) = 0 [pid 5828] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC) = 3 [pid 5828] write(3, "100000", 6 [pid 5823] mount("", "./syz-tmp", "tmpfs", 0, NULL [pid 5828] <... write resumed>) = 6 [pid 5828] close(3 [pid 5823] <... mount resumed>) = 0 [pid 5823] mkdir("./syz-tmp/newroot", 0777 [pid 5829] <... unshare resumed>) = 0 [pid 5828] <... close resumed>) = 0 [pid 5827] <... unshare resumed>) = 0 [pid 5825] <... unshare resumed>) = 0 [pid 5823] <... mkdir resumed>) = 0 [pid 5829] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC [pid 5828] mkdir("./syz-tmp", 0777 [pid 5827] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC [pid 5829] <... openat resumed>) = 3 [pid 5828] <... mkdir resumed>) = 0 [pid 5827] <... openat resumed>) = 3 [pid 5829] write(3, "0 65535", 7 [pid 5825] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC [pid 5829] <... write resumed>) = 7 [pid 5823] mkdir("./syz-tmp/newroot/dev", 0700 [pid 5829] close(3 [pid 5825] <... openat resumed>) = 3 [pid 5823] <... mkdir resumed>) = 0 [pid 5829] <... close resumed>) = 0 [pid 5828] mount("", "./syz-tmp", "tmpfs", 0, NULL [pid 5827] write(3, "0 65535", 7 [pid 5829] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC [pid 5828] <... mount resumed>) = 0 [pid 5827] <... write resumed>) = 7 [pid 5825] write(3, "0 65535", 7 [pid 5829] <... openat resumed>) = 3 [pid 5825] <... write resumed>) = 7 [pid 5823] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5827] close(3 [pid 5825] close(3 [pid 5823] <... mount resumed>) = 0 [pid 5829] write(3, "100000", 6 [pid 5827] <... close resumed>) = 0 [pid 5825] <... close resumed>) = 0 [pid 5828] mkdir("./syz-tmp/newroot", 0777 [pid 5827] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC [pid 5829] <... write resumed>) = 6 [pid 5828] <... mkdir resumed>) = 0 [pid 5827] <... openat resumed>) = 3 [pid 5825] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC [pid 5829] close(3 [pid 5827] write(3, "100000", 6 [pid 5825] <... openat resumed>) = 3 [pid 5829] <... close resumed>) = 0 [pid 5827] <... write resumed>) = 6 [pid 5829] mkdir("./syz-tmp", 0777 [pid 5827] close(3 [pid 5825] write(3, "100000", 6 [pid 5829] <... mkdir resumed>) = 0 [pid 5828] mkdir("./syz-tmp/newroot/dev", 0700 [pid 5827] <... close resumed>) = 0 [pid 5825] <... write resumed>) = 6 [pid 5828] <... mkdir resumed>) = 0 [pid 5827] mkdir("./syz-tmp", 0777 [pid 5825] close(3 [pid 5823] mkdir("./syz-tmp/newroot/proc", 0700 [pid 5825] <... close resumed>) = 0 [pid 5823] <... mkdir resumed>) = 0 [pid 5825] mkdir("./syz-tmp", 0777 [pid 5827] <... mkdir resumed>) = 0 [pid 5825] <... mkdir resumed>) = 0 [pid 5828] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5823] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL [pid 5828] <... mount resumed>) = 0 [pid 5823] <... mount resumed>) = 0 [pid 5829] mount("", "./syz-tmp", "tmpfs", 0, NULL [pid 5828] mkdir("./syz-tmp/newroot/proc", 0700 [pid 5829] <... mount resumed>) = 0 [pid 5828] <... mkdir resumed>) = 0 [ 58.511284][ T29] audit: type=1400 audit(1737028450.349:93): avc: denied { mounton } for pid=5823 comm="syz-executor388" path="/root/syzkaller.4RpDbx/syz-tmp" dev="sda1" ino=1935 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 58.535795][ T29] audit: type=1400 audit(1737028450.349:94): avc: denied { mount } for pid=5823 comm="syz-executor388" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [pid 5828] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL [pid 5825] mount("", "./syz-tmp", "tmpfs", 0, NULL [pid 5828] <... mount resumed>) = 0 [pid 5825] <... mount resumed>) = 0 [pid 5827] mount("", "./syz-tmp", "tmpfs", 0, NULL) = 0 [pid 5825] mkdir("./syz-tmp/newroot", 0777 [pid 5823] mkdir("./syz-tmp/newroot/selinux", 0700 [pid 5828] mkdir("./syz-tmp/newroot/selinux", 0700 [pid 5827] mkdir("./syz-tmp/newroot", 0777 [pid 5825] <... mkdir resumed>) = 0 [pid 5823] <... mkdir resumed>) = 0 [pid 5829] mkdir("./syz-tmp/newroot", 0777 [pid 5828] <... mkdir resumed>) = 0 [pid 5827] <... mkdir resumed>) = 0 [pid 5829] <... mkdir resumed>) = 0 [pid 5828] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5827] mkdir("./syz-tmp/newroot/dev", 0700 [pid 5825] mkdir("./syz-tmp/newroot/dev", 0700 [pid 5823] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5828] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 5827] <... mkdir resumed>) = 0 [pid 5825] <... mkdir resumed>) = 0 [pid 5823] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 5829] mkdir("./syz-tmp/newroot/dev", 0700 [pid 5828] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5827] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5825] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5829] <... mkdir resumed>) = 0 [pid 5828] <... mount resumed>) = 0 [pid 5827] <... mount resumed>) = 0 [pid 5825] <... mount resumed>) = 0 [pid 5829] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0 [pid 5828] mkdir("./syz-tmp/newroot/sys", 0700 [pid 5827] mkdir("./syz-tmp/newroot/proc", 0700 [pid 5828] <... mkdir resumed>) = 0 [pid 5827] <... mkdir resumed>) = 0 [pid 5825] mkdir("./syz-tmp/newroot/proc", 0700 [pid 5823] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5829] mkdir("./syz-tmp/newroot/proc", 0700 [pid 5827] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL [pid 5825] <... mkdir resumed>) = 0 [pid 5823] <... mount resumed>) = 0 [pid 5829] <... mkdir resumed>) = 0 [pid 5828] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0 [pid 5829] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL [pid 5827] <... mount resumed>) = 0 [pid 5825] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL [pid 5823] mkdir("./syz-tmp/newroot/sys", 0700 [pid 5829] <... mount resumed>) = 0 [pid 5828] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0 [pid 5825] <... mount resumed>) = 0 [pid 5823] <... mkdir resumed>) = 0 [pid 5823] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0 [pid 5829] mkdir("./syz-tmp/newroot/selinux", 0700 [pid 5828] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5827] mkdir("./syz-tmp/newroot/selinux", 0700 [pid 5825] mkdir("./syz-tmp/newroot/selinux", 0700 [pid 5823] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5829] <... mkdir resumed>) = 0 [pid 5828] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 5827] <... mkdir resumed>) = 0 [pid 5825] <... mkdir resumed>) = 0 [pid 5823] <... mount resumed>) = 0 [ 58.558675][ T29] audit: type=1400 audit(1737028450.389:95): avc: denied { mounton } for pid=5823 comm="syz-executor388" path="/root/syzkaller.4RpDbx/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 58.584209][ T29] audit: type=1400 audit(1737028450.409:96): avc: denied { mount } for pid=5823 comm="syz-executor388" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [pid 5825] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = -1 ENOENT (No such file or directory) [pid 5829] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5828] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5827] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5825] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5823] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5829] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 5828] <... mount resumed>) = 0 [pid 5827] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 5825] <... mount resumed>) = 0 [pid 5829] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5823] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 5829] <... mount resumed>) = 0 [pid 5827] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5825] mkdir("./syz-tmp/newroot/sys", 0700 [pid 5823] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5829] mkdir("./syz-tmp/newroot/sys", 0700 [pid 5827] <... mount resumed>) = 0 [pid 5825] <... mkdir resumed>) = 0 [pid 5823] <... mount resumed>) = 0 [pid 5829] <... mkdir resumed>) = 0 [pid 5828] mkdir("./syz-tmp/newroot/syzcgroup", 0700 [pid 5827] mkdir("./syz-tmp/newroot/sys", 0700 [pid 5828] <... mkdir resumed>) = 0 [pid 5829] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5827] <... mkdir resumed>) = 0 [pid 5825] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5823] mkdir("./syz-tmp/newroot/syzcgroup", 0700 [pid 5829] <... mount resumed>) = 0 [pid 5828] mkdir("./syz-tmp/newroot/syzcgroup/unified", 0700) = 0 [pid 5827] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5825] <... mount resumed>) = 0 [pid 5823] <... mkdir resumed>) = 0 [pid 5829] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5827] <... mount resumed>) = 0 [pid 5829] <... mount resumed>) = 0 [pid 5828] mkdir("./syz-tmp/newroot/syzcgroup/cpu", 0700 [pid 5829] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5828] <... mkdir resumed>) = 0 [pid 5827] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5823] mkdir("./syz-tmp/newroot/syzcgroup/unified", 0700 [pid 5829] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 5829] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5823] <... mkdir resumed>) = 0 [pid 5828] mkdir("./syz-tmp/newroot/syzcgroup/net", 0700 [pid 5827] <... mount resumed>) = 0 [pid 5825] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5829] <... mount resumed>) = 0 [pid 5829] mkdir("./syz-tmp/newroot/syzcgroup", 0700 [pid 5828] <... mkdir resumed>) = 0 [pid 5827] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5823] mkdir("./syz-tmp/newroot/syzcgroup/cpu", 0700 [pid 5829] <... mkdir resumed>) = 0 [pid 5828] mount("/syzcgroup/unified", "./syz-tmp/newroot/syzcgroup/unified", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0 [pid 5825] <... mount resumed>) = 0 [pid 5827] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 5823] <... mkdir resumed>) = 0 [pid 5828] mount("/syzcgroup/cpu", "./syz-tmp/newroot/syzcgroup/cpu", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5829] mkdir("./syz-tmp/newroot/syzcgroup/unified", 0700 [pid 5827] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5825] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5823] mkdir("./syz-tmp/newroot/syzcgroup/net", 0700 [pid 5829] <... mkdir resumed>) = 0 [pid 5828] <... mount resumed>) = 0 [pid 5829] mkdir("./syz-tmp/newroot/syzcgroup/cpu", 0700) = 0 [pid 5827] <... mount resumed>) = 0 [pid 5825] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 5829] mkdir("./syz-tmp/newroot/syzcgroup/net", 0700 [pid 5828] mount("/syzcgroup/net", "./syz-tmp/newroot/syzcgroup/net", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5823] <... mkdir resumed>) = 0 [pid 5825] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5827] mkdir("./syz-tmp/newroot/syzcgroup", 0700 [pid 5829] <... mkdir resumed>) = 0 [pid 5827] <... mkdir resumed>) = 0 [pid 5829] mount("/syzcgroup/unified", "./syz-tmp/newroot/syzcgroup/unified", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5828] <... mount resumed>) = 0 [pid 5827] mkdir("./syz-tmp/newroot/syzcgroup/unified", 0700 [pid 5825] <... mount resumed>) = 0 [pid 5823] mount("/syzcgroup/unified", "./syz-tmp/newroot/syzcgroup/unified", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5829] <... mount resumed>) = 0 [pid 5828] mkdir("./syz-tmp/pivot", 0777 [pid 5827] <... mkdir resumed>) = 0 [pid 5825] mkdir("./syz-tmp/newroot/syzcgroup", 0700 [pid 5823] <... mount resumed>) = 0 [pid 5828] <... mkdir resumed>) = 0 [pid 5827] mkdir("./syz-tmp/newroot/syzcgroup/cpu", 0700 [pid 5829] mount("/syzcgroup/cpu", "./syz-tmp/newroot/syzcgroup/cpu", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5827] <... mkdir resumed>) = 0 [pid 5825] <... mkdir resumed>) = 0 [pid 5829] <... mount resumed>) = 0 [pid 5828] pivot_root("./syz-tmp", "./syz-tmp/pivot" [pid 5823] mount("/syzcgroup/cpu", "./syz-tmp/newroot/syzcgroup/cpu", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5825] mkdir("./syz-tmp/newroot/syzcgroup/unified", 0700 [pid 5827] mkdir("./syz-tmp/newroot/syzcgroup/net", 0700) = 0 [pid 5825] <... mkdir resumed>) = 0 [pid 5823] <... mount resumed>) = 0 [pid 5829] mount("/syzcgroup/net", "./syz-tmp/newroot/syzcgroup/net", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5828] <... pivot_root resumed>) = 0 [pid 5827] mount("/syzcgroup/unified", "./syz-tmp/newroot/syzcgroup/unified", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5825] mkdir("./syz-tmp/newroot/syzcgroup/cpu", 0700 [ 58.606931][ T29] audit: type=1400 audit(1737028450.429:97): avc: denied { mounton } for pid=5828 comm="syz-executor388" path="/root/syzkaller.cFET9a/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [pid 5823] mount("/syzcgroup/net", "./syz-tmp/newroot/syzcgroup/net", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5829] <... mount resumed>) = 0 [pid 5828] chdir("/" [pid 5827] <... mount resumed>) = 0 [pid 5825] <... mkdir resumed>) = 0 [pid 5829] mkdir("./syz-tmp/pivot", 0777 [pid 5828] <... chdir resumed>) = 0 [pid 5823] <... mount resumed>) = 0 [pid 5829] <... mkdir resumed>) = 0 [pid 5828] umount2("./pivot", MNT_DETACH [pid 5825] mkdir("./syz-tmp/newroot/syzcgroup/net", 0700 [pid 5823] mkdir("./syz-tmp/pivot", 0777 [pid 5829] pivot_root("./syz-tmp", "./syz-tmp/pivot" [pid 5828] <... umount2 resumed>) = 0 [pid 5827] mount("/syzcgroup/cpu", "./syz-tmp/newroot/syzcgroup/cpu", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5825] <... mkdir resumed>) = 0 [pid 5823] <... mkdir resumed>) = 0 [pid 5829] <... pivot_root resumed>) = 0 [pid 5827] <... mount resumed>) = 0 [pid 5825] mount("/syzcgroup/unified", "./syz-tmp/newroot/syzcgroup/unified", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5829] chdir("/" [pid 5828] chroot("./newroot" [pid 5827] mount("/syzcgroup/net", "./syz-tmp/newroot/syzcgroup/net", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5823] pivot_root("./syz-tmp", "./syz-tmp/pivot" [pid 5829] <... chdir resumed>) = 0 [pid 5828] <... chroot resumed>) = 0 [pid 5825] <... mount resumed>) = 0 [pid 5828] chdir("/" [pid 5825] mount("/syzcgroup/cpu", "./syz-tmp/newroot/syzcgroup/cpu", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5828] <... chdir resumed>) = 0 [pid 5827] <... mount resumed>) = 0 [pid 5825] <... mount resumed>) = 0 [pid 5825] mount("/syzcgroup/net", "./syz-tmp/newroot/syzcgroup/net", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5829] umount2("./pivot", MNT_DETACH [pid 5828] mkdir("/dev/gadgetfs", 0777 [pid 5827] mkdir("./syz-tmp/pivot", 0777 [pid 5823] <... pivot_root resumed>) = 0 [pid 5823] chdir("/" [pid 5825] <... mount resumed>) = 0 [pid 5823] <... chdir resumed>) = 0 [pid 5823] umount2("./pivot", MNT_DETACH [pid 5827] <... mkdir resumed>) = 0 [pid 5829] <... umount2 resumed>) = 0 [pid 5828] <... mkdir resumed>) = 0 [pid 5825] mkdir("./syz-tmp/pivot", 0777 [pid 5823] <... umount2 resumed>) = 0 [pid 5829] chroot("./newroot" [pid 5827] pivot_root("./syz-tmp", "./syz-tmp/pivot" [pid 5829] <... chroot resumed>) = 0 [pid 5827] <... pivot_root resumed>) = 0 [pid 5829] chdir("/" [pid 5828] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL [pid 5825] <... mkdir resumed>) = 0 [pid 5823] chroot("./newroot" [pid 5829] <... chdir resumed>) = 0 [pid 5829] mkdir("/dev/gadgetfs", 0777 [pid 5823] <... chroot resumed>) = 0 [pid 5829] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 5823] chdir("/" [pid 5829] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL [pid 5823] <... chdir resumed>) = 0 [pid 5827] chdir("/") = 0 [pid 5827] umount2("./pivot", MNT_DETACH [pid 5825] pivot_root("./syz-tmp", "./syz-tmp/pivot" [pid 5829] <... mount resumed>) = 0 [pid 5828] <... mount resumed>) = 0 [pid 5827] <... umount2 resumed>) = 0 [pid 5823] mkdir("/dev/gadgetfs", 0777 [pid 5828] mkdir("/dev/binderfs", 0777 [pid 5823] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 5829] mkdir("/dev/binderfs", 0777 [pid 5828] <... mkdir resumed>) = 0 [pid 5827] chroot("./newroot" [pid 5825] <... pivot_root resumed>) = 0 [pid 5823] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL [pid 5829] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 5829] mount("binder", "/dev/binderfs", "binder", 0, NULL [pid 5827] <... chroot resumed>) = 0 [pid 5823] <... mount resumed>) = 0 [pid 5828] mount("binder", "/dev/binderfs", "binder", 0, NULL [pid 5827] chdir("/" [pid 5825] chdir("/" [pid 5823] mkdir("/dev/binderfs", 0777 [pid 5827] <... chdir resumed>) = 0 [pid 5823] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 5823] mount("binder", "/dev/binderfs", "binder", 0, NULL [pid 5827] mkdir("/dev/gadgetfs", 0777 [pid 5829] <... mount resumed>) = 0 [pid 5829] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL [pid 5828] <... mount resumed>) = 0 [pid 5827] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 5825] <... chdir resumed>) = 0 [pid 5823] <... mount resumed>) = 0 [pid 5823] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL [pid 5829] <... mount resumed>) = -1 EBUSY (Device or resource busy) [pid 5828] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL [pid 5827] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL [pid 5825] umount2("./pivot", MNT_DETACH [pid 5829] getpid( [pid 5827] <... mount resumed>) = 0 [pid 5823] <... mount resumed>) = -1 EBUSY (Device or resource busy) [pid 5829] <... getpid resumed>) = 1 [pid 5828] <... mount resumed>) = -1 EBUSY (Device or resource busy) [pid 5827] mkdir("/dev/binderfs", 0777 [pid 5828] getpid() = 1 [pid 5823] getpid( [pid 5829] mkdir("/syzcgroup/unified/syz3", 0777 [pid 5828] mkdir("/syzcgroup/unified/syz4", 0777 [pid 5827] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 5825] <... umount2 resumed>) = 0 [pid 5829] <... mkdir resumed>) = 0 [pid 5827] mount("binder", "/dev/binderfs", "binder", 0, NULL [pid 5825] chroot("./newroot" [pid 5823] <... getpid resumed>) = 1 [pid 5823] mkdir("/syzcgroup/unified/syz0", 0777 [pid 5825] <... chroot resumed>) = 0 [pid 5827] <... mount resumed>) = 0 [pid 5825] chdir("/") = 0 [pid 5825] mkdir("/dev/gadgetfs", 0777 [pid 5828] <... mkdir resumed>) = 0 [pid 5823] <... mkdir resumed>) = 0 [pid 5829] openat(AT_FDCWD, "/syzcgroup/unified/syz3/pids.max", O_WRONLY|O_CLOEXEC [pid 5827] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL [pid 5828] openat(AT_FDCWD, "/syzcgroup/unified/syz4/pids.max", O_WRONLY|O_CLOEXEC [pid 5823] openat(AT_FDCWD, "/syzcgroup/unified/syz0/pids.max", O_WRONLY|O_CLOEXEC [pid 5827] <... mount resumed>) = -1 EBUSY (Device or resource busy) [pid 5825] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 5825] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL) = 0 [pid 5828] <... openat resumed>) = 3 [pid 5825] mkdir("/dev/binderfs", 0777 [pid 5829] <... openat resumed>) = 3 [pid 5828] write(3, "32", 2 [pid 5827] getpid( [pid 5825] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 5823] <... openat resumed>) = 3 [pid 5829] write(3, "32", 2 [pid 5828] <... write resumed>) = 2 [pid 5827] <... getpid resumed>) = 1 [pid 5825] mount("binder", "/dev/binderfs", "binder", 0, NULL [pid 5823] write(3, "32", 2 [pid 5829] <... write resumed>) = 2 [pid 5828] close(3 [pid 5827] mkdir("/syzcgroup/unified/syz2", 0777 [pid 5825] <... mount resumed>) = 0 [pid 5823] <... write resumed>) = 2 [pid 5829] close(3) = 0 [pid 5825] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL [pid 5829] openat(AT_FDCWD, "/syzcgroup/unified/syz3/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 5825] <... mount resumed>) = -1 EBUSY (Device or resource busy) [pid 5829] <... openat resumed>) = 3 [pid 5825] getpid() = 1 [pid 5825] mkdir("/syzcgroup/unified/syz1", 0777 [pid 5827] <... mkdir resumed>) = 0 [pid 5828] <... close resumed>) = 0 [pid 5823] close(3 [pid 5829] write(3, "1", 1 [pid 5828] openat(AT_FDCWD, "/syzcgroup/unified/syz4/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 5827] openat(AT_FDCWD, "/syzcgroup/unified/syz2/pids.max", O_WRONLY|O_CLOEXEC [pid 5823] <... close resumed>) = 0 [pid 5828] <... openat resumed>) = 3 [pid 5825] <... mkdir resumed>) = 0 [pid 5825] openat(AT_FDCWD, "/syzcgroup/unified/syz1/pids.max", O_WRONLY|O_CLOEXEC [pid 5828] write(3, "1", 1 [pid 5829] <... write resumed>) = 1 [pid 5827] <... openat resumed>) = 3 [pid 5825] <... openat resumed>) = 3 [pid 5823] openat(AT_FDCWD, "/syzcgroup/unified/syz0/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 5827] write(3, "32", 2 [pid 5829] close(3 [pid 5825] write(3, "32", 2 [pid 5829] <... close resumed>) = 0 [pid 5825] <... write resumed>) = 2 [pid 5829] mkdir("/syzcgroup/cpu/syz3", 0777 [pid 5825] close(3 [pid 5828] <... write resumed>) = 1 [pid 5827] <... write resumed>) = 2 [pid 5823] <... openat resumed>) = 3 [pid 5828] close(3 [pid 5827] close(3 [pid 5825] <... close resumed>) = 0 [pid 5828] <... close resumed>) = 0 [pid 5827] <... close resumed>) = 0 [pid 5828] mkdir("/syzcgroup/cpu/syz4", 0777 [pid 5827] openat(AT_FDCWD, "/syzcgroup/unified/syz2/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 5825] openat(AT_FDCWD, "/syzcgroup/unified/syz1/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 5827] <... openat resumed>) = 3 [pid 5825] <... openat resumed>) = 3 [pid 5823] write(3, "1", 1 [pid 5827] write(3, "1", 1 [pid 5825] write(3, "1", 1 [pid 5827] <... write resumed>) = 1 [pid 5829] <... mkdir resumed>) = 0 [pid 5828] <... mkdir resumed>) = 0 [pid 5825] <... write resumed>) = 1 [pid 5823] <... write resumed>) = 1 [pid 5825] close(3 [pid 5823] close(3 [pid 5829] openat(AT_FDCWD, "/syzcgroup/cpu/syz3/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 5828] openat(AT_FDCWD, "/syzcgroup/cpu/syz4/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 5827] close(3 [pid 5825] <... close resumed>) = 0 [pid 5823] <... close resumed>) = 0 [pid 5825] mkdir("/syzcgroup/cpu/syz1", 0777 [pid 5823] mkdir("/syzcgroup/cpu/syz0", 0777 [pid 5829] <... openat resumed>) = 3 [pid 5828] <... openat resumed>) = 3 [pid 5827] <... close resumed>) = 0 [pid 5829] write(3, "1", 1 [pid 5828] write(3, "1", 1 [pid 5827] mkdir("/syzcgroup/cpu/syz2", 0777 [pid 5829] <... write resumed>) = 1 [pid 5828] <... write resumed>) = 1 [pid 5825] <... mkdir resumed>) = 0 [pid 5823] <... mkdir resumed>) = 0 [pid 5825] openat(AT_FDCWD, "/syzcgroup/cpu/syz1/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 5823] openat(AT_FDCWD, "/syzcgroup/cpu/syz0/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 5829] close(3 [pid 5828] close(3 [pid 5829] <... close resumed>) = 0 [pid 5828] <... close resumed>) = 0 [pid 5827] <... mkdir resumed>) = 0 [pid 5828] openat(AT_FDCWD, "/syzcgroup/cpu/syz4/memory.soft_limit_in_bytes", O_WRONLY|O_CLOEXEC [pid 5827] openat(AT_FDCWD, "/syzcgroup/cpu/syz2/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 5829] openat(AT_FDCWD, "/syzcgroup/cpu/syz3/memory.soft_limit_in_bytes", O_WRONLY|O_CLOEXEC [pid 5825] <... openat resumed>) = 3 [pid 5823] <... openat resumed>) = 3 [pid 5829] <... openat resumed>) = 3 [pid 5828] <... openat resumed>) = 3 [pid 5827] <... openat resumed>) = 3 [pid 5823] write(3, "1", 1 [pid 5828] write(3, "313524224", 9 [pid 5827] write(3, "1", 1 [pid 5825] write(3, "1", 1 [pid 5823] <... write resumed>) = 1 [pid 5829] write(3, "313524224", 9 [pid 5827] <... write resumed>) = 1 [pid 5823] close(3) = 0 [pid 5823] openat(AT_FDCWD, "/syzcgroup/cpu/syz0/memory.soft_limit_in_bytes", O_WRONLY|O_CLOEXEC) = 3 [pid 5823] write(3, "313524224", 9) = 9 [pid 5823] close(3) = 0 [pid 5823] openat(AT_FDCWD, "/syzcgroup/cpu/syz0/memory.limit_in_bytes", O_WRONLY|O_CLOEXEC) = 3 [pid 5823] write(3, "314572800", 9) = 9 [pid 5823] close(3) = 0 [pid 5823] mkdir("/syzcgroup/net/syz0", 0777) = 0 [pid 5829] <... write resumed>) = 9 [pid 5828] <... write resumed>) = 9 [pid 5827] close(3 [pid 5825] <... write resumed>) = 1 [pid 5828] close(3 [pid 5825] close(3 [pid 5823] openat(AT_FDCWD, "/syzcgroup/net/syz0/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 5828] <... close resumed>) = 0 [pid 5829] close(3 [pid 5828] openat(AT_FDCWD, "/syzcgroup/cpu/syz4/memory.limit_in_bytes", O_WRONLY|O_CLOEXEC [pid 5827] <... close resumed>) = 0 [pid 5825] <... close resumed>) = 0 [pid 5829] <... close resumed>) = 0 [pid 5828] <... openat resumed>) = 3 [pid 5823] <... openat resumed>) = 3 [pid 5825] openat(AT_FDCWD, "/syzcgroup/cpu/syz1/memory.soft_limit_in_bytes", O_WRONLY|O_CLOEXEC [pid 5829] openat(AT_FDCWD, "/syzcgroup/cpu/syz3/memory.limit_in_bytes", O_WRONLY|O_CLOEXEC [pid 5823] write(3, "1", 1 [pid 5828] write(3, "314572800", 9 [pid 5827] openat(AT_FDCWD, "/syzcgroup/cpu/syz2/memory.soft_limit_in_bytes", O_WRONLY|O_CLOEXEC [pid 5825] <... openat resumed>) = 3 [pid 5828] <... write resumed>) = 9 [pid 5827] <... openat resumed>) = 3 [pid 5825] write(3, "313524224", 9 [pid 5823] <... write resumed>) = 1 [pid 5829] <... openat resumed>) = 3 [pid 5825] <... write resumed>) = 9 [pid 5823] close(3 [pid 5829] write(3, "314572800", 9 [pid 5825] close(3 [pid 5829] <... write resumed>) = 9 [pid 5823] <... close resumed>) = 0 [pid 5825] <... close resumed>) = 0 [pid 5829] close(3 [pid 5828] close(3 [pid 5827] write(3, "313524224", 9 [pid 5823] mkdir("./0", 0777 [pid 5829] <... close resumed>) = 0 [pid 5828] <... close resumed>) = 0 [pid 5827] <... write resumed>) = 9 [pid 5825] openat(AT_FDCWD, "/syzcgroup/cpu/syz1/memory.limit_in_bytes", O_WRONLY|O_CLOEXEC [pid 5828] mkdir("/syzcgroup/net/syz4", 0777 [pid 5827] close(3 [pid 5829] mkdir("/syzcgroup/net/syz3", 0777 [pid 5825] <... openat resumed>) = 3 [pid 5823] <... mkdir resumed>) = 0 [pid 5828] <... mkdir resumed>) = 0 [pid 5827] <... close resumed>) = 0 [pid 5828] openat(AT_FDCWD, "/syzcgroup/net/syz4/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 5827] openat(AT_FDCWD, "/syzcgroup/cpu/syz2/memory.limit_in_bytes", O_WRONLY|O_CLOEXEC) = 3 [pid 5827] write(3, "314572800", 9) = 9 [pid 5827] close(3) = 0 [pid 5827] mkdir("/syzcgroup/net/syz2", 0777 [pid 5829] <... mkdir resumed>) = 0 [pid 5828] <... openat resumed>) = 3 [pid 5825] write(3, "314572800", 9 [pid 5823] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5829] openat(AT_FDCWD, "/syzcgroup/net/syz3/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 5828] write(3, "1", 1 [pid 5827] <... mkdir resumed>) = 0 [pid 5825] <... write resumed>) = 9 [pid 5829] <... openat resumed>) = 3 [pid 5827] openat(AT_FDCWD, "/syzcgroup/net/syz2/cgroup.procs", O_WRONLY|O_CLOEXEC./strace-static-x86_64: Process 5836 attached [pid 5829] write(3, "1", 1 [pid 5828] <... write resumed>) = 1 [pid 5827] <... openat resumed>) = 3 [pid 5825] close(3 [pid 5836] set_robust_list(0x55556a2b3660, 24 [pid 5829] <... write resumed>) = 1 [pid 5828] close(3 [pid 5827] write(3, "1", 1 [pid 5836] <... set_robust_list resumed>) = 0 [pid 5829] close(3 [pid 5828] <... close resumed>) = 0 [pid 5827] <... write resumed>) = 1 [pid 5825] <... close resumed>) = 0 [pid 5823] <... clone resumed>, child_tidptr=0x55556a2b3650) = 2 [pid 5836] chdir("./0" [pid 5829] <... close resumed>) = 0 [pid 5828] mkdir("./0", 0777 [pid 5827] close(3 [pid 5825] mkdir("/syzcgroup/net/syz1", 0777 [pid 5836] <... chdir resumed>) = 0 [pid 5829] mkdir("./0", 0777 [pid 5827] <... close resumed>) = 0 [pid 5836] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5827] mkdir("./0", 0777 [pid 5836] <... prctl resumed>) = 0 [pid 5827] <... mkdir resumed>) = 0 [pid 5836] setpgid(0, 0 [pid 5827] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5836] <... setpgid resumed>) = 0 [pid 5829] <... mkdir resumed>) = 0 [pid 5825] <... mkdir resumed>) = 0 ./strace-static-x86_64: Process 5837 attached [pid 5836] symlink("/syzcgroup/unified/syz0", "./cgroup" [pid 5829] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5828] <... mkdir resumed>) = 0 [pid 5827] <... clone resumed>, child_tidptr=0x55556a2b3650) = 2 [pid 5825] openat(AT_FDCWD, "/syzcgroup/net/syz1/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 5837] set_robust_list(0x55556a2b3660, 24 [pid 5836] <... symlink resumed>) = 0 [ 58.807590][ T5828] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [pid 5836] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu"./strace-static-x86_64: Process 5838 attached [pid 5837] <... set_robust_list resumed>) = 0 [pid 5828] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5825] <... openat resumed>) = 3 [pid 5837] chdir("./0" [pid 5829] <... clone resumed>, child_tidptr=0x55556a2b3650) = 2 [pid 5825] write(3, "1", 1./strace-static-x86_64: Process 5839 attached [pid 5838] set_robust_list(0x55556a2b3660, 24 [pid 5837] <... chdir resumed>) = 0 [pid 5836] <... symlink resumed>) = 0 [pid 5825] <... write resumed>) = 1 [pid 5838] <... set_robust_list resumed>) = 0 [pid 5837] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5836] symlink("/syzcgroup/net/syz0", "./cgroup.net" [pid 5828] <... clone resumed>, child_tidptr=0x55556a2b3650) = 2 [pid 5839] set_robust_list(0x55556a2b3660, 24 [pid 5825] close(3 [pid 5838] chdir("./0" [pid 5837] <... prctl resumed>) = 0 [pid 5836] <... symlink resumed>) = 0 [pid 5825] <... close resumed>) = 0 [pid 5839] <... set_robust_list resumed>) = 0 [pid 5838] <... chdir resumed>) = 0 [pid 5837] setpgid(0, 0 [pid 5836] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5825] mkdir("./0", 0777 [pid 5839] chdir("./0" [pid 5838] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5837] <... setpgid resumed>) = 0 [pid 5825] <... mkdir resumed>) = 0 [pid 5837] symlink("/syzcgroup/unified/syz2", "./cgroup" [pid 5825] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5839] <... chdir resumed>) = 0 [pid 5838] <... prctl resumed>) = 0 [pid 5837] <... symlink resumed>) = 0 [pid 5836] <... openat resumed>) = 3 [pid 5839] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5838] setpgid(0, 0 [pid 5839] <... prctl resumed>) = 0 [pid 5838] <... setpgid resumed>) = 0 [pid 5836] write(3, "1000", 4 [pid 5839] setpgid(0, 0 [pid 5838] symlink("/syzcgroup/unified/syz3", "./cgroup"./strace-static-x86_64: Process 5840 attached [pid 5839] <... setpgid resumed>) = 0 [pid 5838] <... symlink resumed>) = 0 [pid 5837] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu" [pid 5836] <... write resumed>) = 4 [pid 5840] set_robust_list(0x55556a2b3660, 24 [pid 5839] symlink("/syzcgroup/unified/syz4", "./cgroup" [pid 5838] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu" [pid 5837] <... symlink resumed>) = 0 [pid 5825] <... clone resumed>, child_tidptr=0x55556a2b3650) = 2 [pid 5836] close(3 [pid 5840] <... set_robust_list resumed>) = 0 [pid 5837] symlink("/syzcgroup/net/syz2", "./cgroup.net" [pid 5840] chdir("./0" [pid 5839] <... symlink resumed>) = 0 [pid 5838] <... symlink resumed>) = 0 [pid 5836] <... close resumed>) = 0 [pid 5840] <... chdir resumed>) = 0 [pid 5839] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu" [pid 5838] symlink("/syzcgroup/net/syz3", "./cgroup.net" [pid 5837] <... symlink resumed>) = 0 [pid 5840] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5839] <... symlink resumed>) = 0 [pid 5837] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5836] symlink("/dev/binderfs", "./binderfs" [pid 5840] <... prctl resumed>) = 0 [pid 5839] symlink("/syzcgroup/net/syz4", "./cgroup.net" [pid 5838] <... symlink resumed>) = 0 [pid 5839] <... symlink resumed>) = 0 [pid 5836] <... symlink resumed>) = 0 [pid 5838] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5837] <... openat resumed>) = 3 [pid 5840] setpgid(0, 0 [pid 5839] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5836] write(1, "executing program\n", 18 [pid 5840] <... setpgid resumed>) = 0 [pid 5837] write(3, "1000", 4executing program [pid 5840] symlink("/syzcgroup/unified/syz1", "./cgroup" [pid 5839] <... openat resumed>) = 3 [pid 5837] <... write resumed>) = 4 [pid 5836] <... write resumed>) = 18 [pid 5839] write(3, "1000", 4 [pid 5838] <... openat resumed>) = 3 [pid 5836] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=12, insns=0x20000180, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(4, 17, 0), prog_flags=BPF_F_TEST_RND_HI32, prog_name="", prog_ifindex=0, expected_attach_type=0x33 /* BPF_??? */, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 148 [pid 5840] <... symlink resumed>) = 0 [pid 5839] <... write resumed>) = 4 [pid 5838] write(3, "1000", 4 [pid 5837] close(3 [pid 5840] symlink("/syzcgroup/cpu/syz1", "./cgroup.cpu"executing program [pid 5839] close(3 [pid 5837] <... close resumed>) = 0 [pid 5840] <... symlink resumed>) = 0 [pid 5837] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5837] write(1, "executing program\n", 18 [pid 5840] symlink("/syzcgroup/net/syz1", "./cgroup.net" [pid 5837] <... write resumed>) = 18 [pid 5840] <... symlink resumed>) = 0 [pid 5837] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=12, insns=0x20000180, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(4, 17, 0), prog_flags=BPF_F_TEST_RND_HI32, prog_name="", prog_ifindex=0, expected_attach_type=0x33 /* BPF_??? */, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 148executing program [pid 5840] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5839] <... close resumed>) = 0 [pid 5838] <... write resumed>) = 4 [pid 5840] <... openat resumed>) = 3 [pid 5840] write(3, "1000", 4) = 4 [pid 5840] close(3) = 0 [pid 5840] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5840] write(1, "executing program\n", 18) = 18 [pid 5840] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=12, insns=0x20000180, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(4, 17, 0), prog_flags=BPF_F_TEST_RND_HI32, prog_name="", prog_ifindex=0, expected_attach_type=0x33 /* BPF_??? */, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 148 [pid 5839] symlink("/dev/binderfs", "./binderfs" [pid 5838] close(3) = 0 [ 58.913604][ T5836] syz-executor388[5836] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 58.913701][ T5836] syz-executor388[5836] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 58.914461][ T5837] syz-executor388[5837] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 58.926526][ T5836] syz-executor388[5836] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [pid 5839] <... symlink resumed>) = 0 [pid 5838] symlink("/dev/binderfs", "./binderfs" [pid 5839] write(1, "executing program\n", 18 [pid 5838] <... symlink resumed>) = 0 executing program executing program [pid 5836] <... bpf resumed>) = 3 [pid 5838] write(1, "executing program\n", 18) = 18 [pid 5839] <... write resumed>) = 18 [pid 5836] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="sched_switch", prog_fd=3}}, 24 [ 58.940556][ T5840] syz-executor388[5840] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 58.962311][ T5837] syz-executor388[5837] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 58.975469][ T5840] syz-executor388[5840] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 58.988128][ T5837] syz-executor388[5837] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [pid 5838] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=12, insns=0x20000180, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(4, 17, 0), prog_flags=BPF_F_TEST_RND_HI32, prog_name="", prog_ifindex=0, expected_attach_type=0x33 /* BPF_??? */, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 148 [pid 5839] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=12, insns=0x20000180, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(4, 17, 0), prog_flags=BPF_F_TEST_RND_HI32, prog_name="", prog_ifindex=0, expected_attach_type=0x33 /* BPF_??? */, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 148) = 3 [pid 5838] <... bpf resumed>) = 3 [pid 5840] <... bpf resumed>) = 3 [pid 5839] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="sched_switch", prog_fd=3}}, 24 [pid 5837] <... bpf resumed>) = 3 [pid 5836] <... bpf resumed>) = 4 [pid 5840] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="sched_switch", prog_fd=3}}, 24 [pid 5839] <... bpf resumed>) = 4 [pid 5838] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="sched_switch", prog_fd=3}}, 24 [pid 5837] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="sched_switch", prog_fd=3}}, 24 [pid 5836] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 5840] <... bpf resumed>) = 4 [pid 5839] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 5838] <... bpf resumed>) = 4 [pid 5837] <... bpf resumed>) = 4 [pid 5836] <... openat resumed>) = 5 [pid 5840] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 5839] <... openat resumed>) = 5 [pid 5838] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 5837] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 5836] write(5, "3", 1 [ 59.001175][ T5840] syz-executor388[5840] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 59.002483][ T5838] syz-executor388[5838] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 59.040770][ T5836] FAULT_INJECTION: forcing a failure. [ 59.040770][ T5836] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 59.040992][ T5839] FAULT_INJECTION: forcing a failure. [ 59.040992][ T5839] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 59.041348][ T5839] [ 59.041354][ T5839] ====================================================== [ 59.041358][ T5839] WARNING: possible circular locking dependency detected [ 59.041378][ T5839] 6.13.0-rc7-syzkaller-00043-g619f0b6fad52 #0 Not tainted [ 59.041386][ T5839] ------------------------------------------------------ [ 59.041390][ T5839] syz-executor388/5839 is trying to acquire lock: [ 59.041398][ T5839] ffffffff8e0c8c00 (console_owner){....}-{0:0}, at: console_lock_spinning_enable+0x9f/0xd0 [ 59.041451][ T5839] [ 59.041451][ T5839] but task is already holding lock: [ 59.041455][ T5839] ffff8880b863ebd8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x29/0x130 [ 59.041486][ T5839] [ 59.041486][ T5839] which lock already depends on the new lock. [ 59.041486][ T5839] [ 59.041490][ T5839] [ 59.041490][ T5839] the existing dependency chain (in reverse order) is: [ 59.041494][ T5839] [ 59.041494][ T5839] -> #4 (&rq->__lock){-.-.}-{2:2}: [ 59.041512][ T5839] _raw_spin_lock_nested+0x31/0x40 [ 59.041531][ T5839] raw_spin_rq_lock_nested+0x29/0x130 [ 59.041545][ T5839] task_rq_lock+0xcf/0x3b0 [ 59.041559][ T5839] cgroup_move_task+0x82/0x250 [ 59.041571][ T5839] css_set_move_task+0x288/0x5f0 [ 59.041586][ T5839] cgroup_post_fork+0x1c6/0x910 [ 59.041603][ T5839] copy_process+0x50d8/0x8e50 [ 59.041621][ T5839] kernel_clone+0xfd/0x960 [ 59.041637][ T5839] user_mode_thread+0xb4/0xf0 [ 59.041653][ T5839] rest_init+0x23/0x2b0 [ 59.041665][ T5839] start_kernel+0x3e4/0x4d0 [ 59.041685][ T5839] x86_64_start_reservations+0x18/0x30 [ 59.041705][ T5839] x86_64_start_kernel+0xb2/0xc0 [ 59.041723][ T5839] common_startup_64+0x13e/0x148 [ 59.041740][ T5839] [ 59.041740][ T5839] -> #3 (&p->pi_lock){-.-.}-{2:2}: [ 59.041757][ T5839] _raw_spin_lock_irqsave+0x3a/0x60 [ 59.041772][ T5839] try_to_wake_up+0xb6/0x1490 [ 59.041786][ T5839] __wake_up_common+0x131/0x1e0 [ 59.041802][ T5839] __wake_up+0x31/0x60 [ 59.041814][ T5839] tty_port_default_wakeup+0x2a/0x40 [ 59.041844][ T5839] serial8250_tx_chars+0x68e/0x860 [ 59.041860][ T5839] serial8250_handle_irq+0x74d/0xc80 [ 59.041875][ T5839] serial8250_default_handle_irq+0x9a/0x210 [ 59.041890][ T5839] serial8250_interrupt+0x103/0x210 [ 59.041906][ T5839] __handle_irq_event_percpu+0x229/0x7d0 [ 59.041925][ T5839] handle_irq_event+0xab/0x1e0 [ 59.041942][ T5839] handle_edge_irq+0x263/0xd10 [ 59.041958][ T5839] __common_interrupt+0xdf/0x250 [ 59.041977][ T5839] common_interrupt+0xba/0xe0 [ 59.041991][ T5839] asm_common_interrupt+0x26/0x40 [ 59.042010][ T5839] acpi_safe_halt+0x1a/0x20 [ 59.042021][ T5839] acpi_idle_enter+0xc5/0x160 [ 59.042032][ T5839] cpuidle_enter_state+0xaa/0x4f0 [ 59.042050][ T5839] cpuidle_enter+0x4e/0xa0 [ 59.042069][ T5839] do_idle+0x310/0x3f0 [ 59.042081][ T5839] cpu_startup_entry+0x4f/0x60 [ 59.042094][ T5839] start_secondary+0x222/0x2b0 [ 59.042106][ T5839] common_startup_64+0x13e/0x148 [ 59.042121][ T5839] [ 59.042121][ T5839] -> #2 (&tty->write_wait){-.-.}-{3:3}: [ 59.042139][ T5839] _raw_spin_lock_irqsave+0x3a/0x60 [ 59.042154][ T5839] __wake_up+0x1c/0x60 [ 59.042166][ T5839] tty_port_default_wakeup+0x2a/0x40 [ 59.042179][ T5839] serial8250_tx_chars+0x68e/0x860 [ 59.042193][ T5839] serial8250_handle_irq+0x74d/0xc80 [ 59.042208][ T5839] serial8250_default_handle_irq+0x9a/0x210 [ 59.042223][ T5839] serial8250_interrupt+0x103/0x210 [ 59.042243][ T5839] __handle_irq_event_percpu+0x229/0x7d0 [ 59.042261][ T5839] handle_irq_event+0xab/0x1e0 [ 59.042278][ T5839] handle_edge_irq+0x263/0xd10 [ 59.042294][ T5839] __common_interrupt+0xdf/0x250 [ 59.042312][ T5839] common_interrupt+0xba/0xe0 [ 59.042324][ T5839] asm_common_interrupt+0x26/0x40 [ 59.042342][ T5839] acpi_safe_halt+0x1a/0x20 [ 59.042353][ T5839] acpi_idle_enter+0xc5/0x160 [ 59.042364][ T5839] cpuidle_enter_state+0xaa/0x4f0 [ 59.042382][ T5839] cpuidle_enter+0x4e/0xa0 [ 59.042399][ T5839] do_idle+0x310/0x3f0 [ 59.042411][ T5839] cpu_startup_entry+0x4f/0x60 [ 59.042425][ T5839] start_secondary+0x222/0x2b0 [ 59.042436][ T5839] common_startup_64+0x13e/0x148 [ 59.042451][ T5839] [ 59.042451][ T5839] -> #1 (&port_lock_key){-.-.}-{3:3}: [ 59.042469][ T5839] _raw_spin_lock_irqsave+0x3a/0x60 [ 59.042483][ T5839] serial8250_console_write+0xb56/0x17c0 [ 59.042499][ T5839] console_flush_all+0x803/0xc60 [ 59.042516][ T5839] console_unlock+0xd9/0x210 [ 59.042532][ T5839] vprintk_emit+0x424/0x6f0 [ 59.042549][ T5839] vprintk+0x7f/0xa0 [ 59.042566][ T5839] _printk+0xc8/0x100 [ 59.042579][ T5839] register_console+0xbfd/0x1170 [ 59.042597][ T5839] univ8250_console_init+0x5f/0x90 [ 59.042614][ T5839] console_init+0x154/0x690 [ 59.042626][ T5839] start_kernel+0x29a/0x4d0 [ 59.042644][ T5839] x86_64_start_reservations+0x18/0x30 [ 59.042663][ T5839] x86_64_start_kernel+0xb2/0xc0 [ 59.042682][ T5839] common_startup_64+0x13e/0x148 [ 59.042697][ T5839] [ 59.042697][ T5839] -> #0 (console_owner){....}-{0:0}: [ 59.042714][ T5839] __lock_acquire+0x249e/0x3c40 [ 59.042728][ T5839] lock_acquire.part.0+0x11b/0x380 [ 59.042742][ T5839] console_lock_spinning_enable+0xb0/0xd0 [ 59.042759][ T5839] console_flush_all+0x7ac/0xc60 [ 59.042776][ T5839] console_unlock+0xd9/0x210 [ 59.042792][ T5839] vprintk_emit+0x424/0x6f0 [ 59.042808][ T5839] vprintk+0x7f/0xa0 [ 59.042826][ T5839] _printk+0xc8/0x100 [ 59.042838][ T5839] should_fail_ex+0x46c/0x5b0 [ 59.042857][ T5839] copy_to_user_nofault+0xac/0x180 [ 59.042872][ T5839] bpf_probe_write_user+0xaf/0xf0 [ 59.042891][ T5839] bpf_prog_6303d92f98284ad8+0x44/0x48 [ 59.042904][ T5839] bpf_trace_run4+0x245/0x5a0 [ 59.042918][ T5839] __bpf_trace_sched_switch+0x13e/0x190 [ 59.042934][ T5839] __traceiter_sched_switch+0x6c/0xc0 [ 59.042948][ T5839] __schedule+0x1b71/0x5ad0 [ 59.042963][ T5839] schedule+0xe7/0x350 [ 59.042977][ T5839] ptrace_stop.part.0+0x440/0x940 [ 59.042994][ T5839] ptrace_do_notify+0x222/0x2d0 [ 59.043010][ T5839] ptrace_notify+0xc5/0x130 [ 59.043025][ T5839] syscall_exit_to_user_mode_prepare+0x126/0x290 [ 59.043043][ T5839] syscall_exit_to_user_mode+0x11/0x2a0 [ 59.043060][ T5839] do_syscall_64+0xda/0x250 [ 59.043078][ T5839] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 59.043095][ T5839] [ 59.043095][ T5839] other info that might help us debug this: [ 59.043095][ T5839] [ 59.043099][ T5839] Chain exists of: [ 59.043099][ T5839] console_owner --> &p->pi_lock --> &rq->__lock [ 59.043099][ T5839] [ 59.043118][ T5839] Possible unsafe locking scenario: [ 59.043118][ T5839] [ 59.043122][ T5839] CPU0 CPU1 [ 59.043125][ T5839] ---- ---- [ 59.043128][ T5839] lock(&rq->__lock); [ 59.043136][ T5839] lock(&p->pi_lock); [ 59.043144][ T5839] lock(&rq->__lock); [ 59.043153][ T5839] lock(console_owner); [ 59.043160][ T5839] [ 59.043160][ T5839] *** DEADLOCK *** [ 59.043160][ T5839] [ 59.043163][ T5839] 4 locks held by syz-executor388/5839: [ 59.043172][ T5839] #0: ffff8880b863ebd8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x29/0x130 [ 59.043205][ T5839] #1: ffffffff8e1bb900 (rcu_read_lock){....}-{1:3}, at: bpf_trace_run4+0x1d6/0x5a0 [ 59.043240][ T5839] #2: ffffffff8e1a9040 (console_lock){+.+.}-{0:0}, at: vprintk+0x7f/0xa0 [ 59.043276][ T5839] #3: ffffffff8e1a90b0 (console_srcu){....}-{0:0}, at: console_flush_all+0x159/0xc60 [ 59.043311][ T5839] [ 59.043311][ T5839] stack backtrace: [ 59.043318][ T5839] CPU: 0 UID: 0 PID: 5839 Comm: syz-executor388 Not tainted 6.13.0-rc7-syzkaller-00043-g619f0b6fad52 #0 [ 59.043335][ T5839] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 59.043351][ T5839] Call Trace: [ 59.043355][ T5839] [ 59.043361][ T5839] dump_stack_lvl+0x116/0x1f0 [ 59.043383][ T5839] print_circular_bug+0x419/0x5d0 [ 59.043398][ T5839] check_noncircular+0x31a/0x400 [ 59.043413][ T5839] ? __pfx_check_noncircular+0x10/0x10 [ 59.043430][ T5839] ? lockdep_lock+0x1b8/0x200 [ 59.043449][ T5839] ? __pfx_lockdep_lock+0x10/0x10 [ 59.043470][ T5839] __lock_acquire+0x249e/0x3c40 [ 59.043488][ T5839] ? __pfx___lock_acquire+0x10/0x10 [ 59.043506][ T5839] lock_acquire.part.0+0x11b/0x380 [ 59.043521][ T5839] ? console_lock_spinning_enable+0x9f/0xd0 [ 59.043540][ T5839] ? __pfx_lock_acquire.part.0+0x10/0x10 [ 59.043556][ T5839] ? rcu_is_watching+0x12/0xc0 [ 59.043575][ T5839] ? trace_lock_acquire+0x14e/0x1f0 [ 59.043594][ T5839] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 59.043612][ T5839] ? console_lock_spinning_enable+0x9f/0xd0 [ 59.043630][ T5839] ? lock_acquire+0x2f/0xb0 [ 59.043644][ T5839] ? console_lock_spinning_enable+0x9f/0xd0 [ 59.043664][ T5839] console_lock_spinning_enable+0xb0/0xd0 [ 59.043681][ T5839] ? console_lock_spinning_enable+0x9f/0xd0 [ 59.043700][ T5839] console_flush_all+0x7ac/0xc60 [ 59.043720][ T5839] ? __pfx_console_flush_all+0x10/0x10 [ 59.043740][ T5839] ? printk_percpu_data_ready+0x9/0x20 [ 59.043757][ T5839] ? nbcon_get_cpu_emergency_nesting+0x3b/0x50 [ 59.043772][ T5839] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 59.043791][ T5839] console_unlock+0xd9/0x210 [ 59.043809][ T5839] ? __pfx_console_unlock+0x10/0x10 [ 59.043827][ T5839] ? lock_acquire+0x2f/0xb0 [ 59.043841][ T5839] ? vprintk+0x7f/0xa0 [ 59.043860][ T5839] ? __down_trylock_console_sem+0xb0/0x140 [ 59.043877][ T5839] vprintk_emit+0x424/0x6f0 [ 59.043895][ T5839] ? __pfx_vprintk_emit+0x10/0x10 [ 59.043916][ T5839] vprintk+0x7f/0xa0 [ 59.043935][ T5839] _printk+0xc8/0x100 [ 59.043949][ T5839] ? __pfx__printk+0x10/0x10 [ 59.043964][ T5839] ? ___ratelimit+0x24c/0x570 [ 59.043982][ T5839] ? __pfx____ratelimit+0x10/0x10 [ 59.044001][ T5839] should_fail_ex+0x46c/0x5b0 [ 59.044021][ T5839] copy_to_user_nofault+0xac/0x180 [ 59.044037][ T5839] bpf_probe_write_user+0xaf/0xf0 [ 59.044057][ T5839] bpf_prog_6303d92f98284ad8+0x44/0x48 [ 59.044069][ T5839] bpf_trace_run4+0x245/0x5a0 [ 59.044084][ T5839] ? __pfx_bpf_trace_run4+0x10/0x10 [ 59.044100][ T5839] ? __pfx_lock_release+0x10/0x10 [ 59.044117][ T5839] __bpf_trace_sched_switch+0x13e/0x190 [ 59.044133][ T5839] ? __pfx___bpf_trace_sched_switch+0x10/0x10 [ 59.044150][ T5839] ? psi_group_change+0x6dc/0xd20 [ 59.044169][ T5839] __traceiter_sched_switch+0x6c/0xc0 [ 59.044185][ T5839] __schedule+0x1b71/0x5ad0 [ 59.044201][ T5839] ? __pfx___lock_acquire+0x10/0x10 [ 59.044216][ T5839] ? mark_held_locks+0x9f/0xe0 [ 59.044237][ T5839] ? __print_lock_name+0x220/0x260 [ 59.044256][ T5839] ? __pfx___schedule+0x10/0x10 [ 59.044272][ T5839] ? schedule+0x298/0x350 [ 59.044287][ T5839] ? __pfx_lock_release+0x10/0x10 [ 59.044303][ T5839] ? lock_acquire+0x2f/0xb0 [ 59.044317][ T5839] ? schedule+0x1fd/0x350 [ 59.044334][ T5839] schedule+0xe7/0x350 [ 59.044349][ T5839] ptrace_stop.part.0+0x440/0x940 [ 59.044367][ T5839] ptrace_do_notify+0x222/0x2d0 [ 59.044383][ T5839] ? __pfx_lock_acquire.part.0+0x10/0x10 [ 59.044399][ T5839] ? __pfx_ptrace_do_notify+0x10/0x10 [ 59.044416][ T5839] ? rcu_is_watching+0x12/0xc0 [ 59.044435][ T5839] ? lock_acquire+0x2f/0xb0 [ 59.044449][ T5839] ? ptrace_notify+0xb1/0x130 [ 59.044467][ T5839] ptrace_notify+0xc5/0x130 [ 59.044484][ T5839] syscall_exit_to_user_mode_prepare+0x126/0x290 [ 59.044503][ T5839] syscall_exit_to_user_mode+0x11/0x2a0 [ 59.044522][ T5839] do_syscall_64+0xda/0x250 [ 59.044541][ T5839] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 59.044559][ T5839] RIP: 0033:0x7fd4f256cba0 [ 59.044570][ T5839] Code: 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d c1 24 07 00 00 74 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 48 89 [ 59.044583][ T5839] RSP: 002b:00007ffebff53808 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 [ 59.044596][ T5839] RAX: 0000000000000001 RBX: 00007ffebff53830 RCX: 00007fd4f256cba0 [ 59.044606][ T5839] RDX: 0000000000000001 RSI: 00007ffebff53830 RDI: 0000000000000005 [ 59.044615][ T5839] RBP: 0000000000000005 R08: 0000000000000001 R09: 00007ffebff535a7 [ 59.044624][ T5839] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 59.044632][ T5839] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 59.044645][ T5839] [ 59.056335][ T5839] CPU: 0 UID: 0 PID: 5839 Comm: syz-executor388 Not tainted 6.13.0-rc7-syzkaller-00043-g619f0b6fad52 #0 [ 60.296980][ T5839] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 60.307025][ T5839] Call Trace: [ 60.310293][ T5839] [ 60.313215][ T5839] dump_stack_lvl+0x116/0x1f0 [ 60.317896][ T5839] should_fail_ex+0x497/0x5b0 [ 60.322571][ T5839] copy_to_user_nofault+0xac/0x180 [ 60.327674][ T5839] bpf_probe_write_user+0xaf/0xf0 [ 60.332694][ T5839] bpf_prog_6303d92f98284ad8+0x44/0x48 [ 60.338141][ T5839] bpf_trace_run4+0x245/0x5a0 [ 60.342807][ T5839] ? __pfx_bpf_trace_run4+0x10/0x10 [ 60.348004][ T5839] ? __pfx_lock_release+0x10/0x10 [ 60.353027][ T5839] __bpf_trace_sched_switch+0x13e/0x190 [ 60.358566][ T5839] ? __pfx___bpf_trace_sched_switch+0x10/0x10 [ 60.364624][ T5839] ? psi_group_change+0x6dc/0xd20 [ 60.369642][ T5839] __traceiter_sched_switch+0x6c/0xc0 [ 60.375005][ T5839] __schedule+0x1b71/0x5ad0 [ 60.379500][ T5839] ? __pfx___lock_acquire+0x10/0x10 [ 60.384687][ T5839] ? mark_held_locks+0x9f/0xe0 [ 60.389441][ T5839] ? __print_lock_name+0x220/0x260 [ 60.394633][ T5839] ? __pfx___schedule+0x10/0x10 [ 60.399476][ T5839] ? schedule+0x298/0x350 [ 60.403796][ T5839] ? __pfx_lock_release+0x10/0x10 [ 60.408812][ T5839] ? lock_acquire+0x2f/0xb0 [ 60.413303][ T5839] ? schedule+0x1fd/0x350 [ 60.417626][ T5839] schedule+0xe7/0x350 [ 60.421686][ T5839] ptrace_stop.part.0+0x440/0x940 [ 60.426714][ T5839] ptrace_do_notify+0x222/0x2d0 [ 60.431556][ T5839] ? __pfx_lock_acquire.part.0+0x10/0x10 [ 60.437177][ T5839] ? __pfx_ptrace_do_notify+0x10/0x10 [ 60.442540][ T5839] ? rcu_is_watching+0x12/0xc0 [ 60.447300][ T5839] ? lock_acquire+0x2f/0xb0 [ 60.451793][ T5839] ? ptrace_notify+0xb1/0x130 [ 60.456460][ T5839] ptrace_notify+0xc5/0x130 [ 60.460955][ T5839] syscall_exit_to_user_mode_prepare+0x126/0x290 [ 60.467281][ T5839] syscall_exit_to_user_mode+0x11/0x2a0 [ 60.472843][ T5839] do_syscall_64+0xda/0x250 [ 60.477358][ T5839] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 60.483259][ T5839] RIP: 0033:0x7fd4f256cba0 [ 60.487672][ T5839] Code: 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d c1 24 07 00 00 74 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 48 89 [ 60.507271][ T5839] RSP: 002b:00007ffebff53808 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 [ 60.515674][ T5839] RAX: 0000000000000001 RBX: 00007ffebff53830 RCX: 00007fd4f256cba0 [ 60.523637][ T5839] RDX: 0000000000000001 RSI: 00007ffebff53830 RDI: 0000000000000005 [ 60.531615][ T5839] RBP: 0000000000000005 R08: 0000000000000001 R09: 00007ffebff535a7 [ 60.539591][ T5839] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 60.547645][ T5839] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 60.555612][ T5839] [ 60.558619][ T5836] CPU: 1 UID: 0 PID: 5836 Comm: syz-executor388 Not tainted 6.13.0-rc7-syzkaller-00043-g619f0b6fad52 #0 [ 60.569731][ T5836] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 60.579779][ T5836] Call Trace: [ 60.583034][ T5836] [ 60.585953][ T5836] dump_stack_lvl+0x116/0x1f0 [ 60.590608][ T5836] should_fail_ex+0x497/0x5b0 [ 60.595262][ T5836] copy_to_user_nofault+0xac/0x180 [ 60.600349][ T5836] bpf_probe_write_user+0xaf/0xf0 [ 60.605352][ T5836] bpf_prog_6303d92f98284ad8+0x44/0x48 [ 60.610778][ T5836] bpf_trace_run4+0x245/0x5a0 [ 60.615426][ T5836] ? __pfx_bpf_trace_run4+0x10/0x10 [ 60.620597][ T5836] ? __pfx_lock_release+0x10/0x10 [ 60.625612][ T5836] __bpf_trace_sched_switch+0x13e/0x190 [ 60.631138][ T5836] ? __pfx___bpf_trace_sched_switch+0x10/0x10 [ 60.637177][ T5836] ? psi_group_change+0x6dc/0xd20 [ 60.642176][ T5836] __traceiter_sched_switch+0x6c/0xc0 [ 60.647522][ T5836] __schedule+0x1b71/0x5ad0 [ 60.652001][ T5836] ? __pfx___lock_acquire+0x10/0x10 [ 60.657171][ T5836] ? mark_held_locks+0x9f/0xe0 [ 60.661982][ T5836] ? __print_lock_name+0x220/0x260 [ 60.667090][ T5836] ? __pfx___schedule+0x10/0x10 [ 60.671928][ T5836] ? schedule+0x298/0x350 [ 60.676233][ T5836] ? __pfx_lock_release+0x10/0x10 [ 60.681234][ T5836] ? lock_acquire+0x2f/0xb0 [ 60.685709][ T5836] ? schedule+0x1fd/0x350 [ 60.690033][ T5836] schedule+0xe7/0x350 [ 60.694081][ T5836] ptrace_stop.part.0+0x440/0x940 [ 60.699186][ T5836] ptrace_do_notify+0x222/0x2d0 [ 60.704010][ T5836] ? __pfx_lock_acquire.part.0+0x10/0x10 [ 60.709632][ T5836] ? __pfx_ptrace_do_notify+0x10/0x10 [ 60.714977][ T5836] ? rcu_is_watching+0x12/0xc0 [ 60.719718][ T5836] ? lock_acquire+0x2f/0xb0 [ 60.724198][ T5836] ? ptrace_notify+0xb1/0x130 [ 60.728874][ T5836] ptrace_notify+0xc5/0x130 [ 60.733352][ T5836] syscall_exit_to_user_mode_prepare+0x126/0x290 [ 60.739655][ T5836] syscall_exit_to_user_mode+0x11/0x2a0 [ 60.745177][ T5836] do_syscall_64+0xda/0x250 [ 60.749672][ T5836] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 60.755542][ T5836] RIP: 0033:0x7fd4f256cba0 [ 60.759928][ T5836] Code: 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d c1 24 07 00 00 74 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 48 89 [ 60.779528][ T5836] RSP: 002b:00007ffebff53808 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 [ 60.787933][ T5836] RAX: 0000000000000001 RBX: 00007ffebff53830 RCX: 00007fd4f256cba0 [ 60.795879][ T5836] RDX: 0000000000000001 RSI: 00007ffebff53830 RDI: 0000000000000005 [ 60.803825][ T5836] RBP: 0000000000000005 R08: 0000000000000001 R09: 00007ffebff535a7 [ 60.811769][ T5836] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [pid 5839] write(5, "3", 1 [pid 5840] <... openat resumed>) = 5 [pid 5839] <... write resumed>) = 1 [pid 5838] <... openat resumed>) = 5 [pid 5836] <... write resumed>) = 1 [pid 5837] <... openat resumed>) = 5 [ 60.819714][ T5836] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 60.827663][ T5836] [ 60.832044][ T5837] FAULT_INJECTION: forcing a failure. [ 60.832044][ T5837] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 60.845084][ T5837] CPU: 0 UID: 0 PID: 5837 Comm: syz-executor388 Not tainted 6.13.0-rc7-syzkaller-00043-g619f0b6fad52 #0 [ 60.856164][ T5837] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 60.866190][ T5837] Call Trace: [ 60.869445][ T5837] [ 60.872363][ T5837] dump_stack_lvl+0x116/0x1f0 [ 60.877210][ T5837] should_fail_ex+0x497/0x5b0 [ 60.881877][ T5837] copy_to_user_nofault+0xac/0x180 [ 60.886965][ T5837] bpf_probe_write_user+0xaf/0xf0 [ 60.891965][ T5837] bpf_prog_6303d92f98284ad8+0x44/0x48 [ 60.897392][ T5837] bpf_trace_run4+0x245/0x5a0 [ 60.902038][ T5837] ? __pfx_bpf_trace_run4+0x10/0x10 [ 60.907205][ T5837] ? rcu_is_watching+0x12/0xc0 [ 60.911946][ T5837] ? __pfx_lock_release+0x10/0x10 [ 60.916951][ T5837] ? __pfx_sched_clock_cpu+0x10/0x10 [ 60.922209][ T5837] __bpf_trace_sched_switch+0x13e/0x190 [ 60.927727][ T5837] ? __pfx___bpf_trace_sched_switch+0x10/0x10 [ 60.933766][ T5837] ? psi_group_change+0x6dc/0xd20 [ 60.938764][ T5837] __traceiter_sched_switch+0x6c/0xc0 [ 60.944153][ T5837] __schedule+0x1b71/0x5ad0 [ 60.948631][ T5837] ? trace_irq_enable.constprop.0+0xea/0x140 [ 60.954586][ T5837] ? __pfx___schedule+0x10/0x10 [ 60.959410][ T5837] ? lock_release+0x4e2/0x6f0 [ 60.964060][ T5837] ? schedule+0x298/0x350 [ 60.968360][ T5837] ? __pfx_lock_release+0x10/0x10 [ 60.973361][ T5837] ? schedule+0x1fd/0x350 [ 60.977663][ T5837] ? lock_acquire+0x2f/0xb0 [ 60.982138][ T5837] ? schedule+0x1fd/0x350 [ 60.986441][ T5837] schedule+0xe7/0x350 [ 60.990483][ T5837] ptrace_stop.part.0+0x440/0x940 [ 60.995484][ T5837] ptrace_do_notify+0x222/0x2d0 [ 61.000310][ T5837] ? __pfx_ptrace_do_notify+0x10/0x10 [ 61.005662][ T5837] ? rcu_is_watching+0x12/0xc0 [ 61.010401][ T5837] ? lock_acquire+0x2f/0xb0 [ 61.014874][ T5837] ? ptrace_notify+0xb1/0x130 [ 61.019534][ T5837] ptrace_notify+0xc5/0x130 [ 61.024020][ T5837] syscall_exit_to_user_mode_prepare+0x126/0x290 [ 61.030334][ T5837] syscall_exit_to_user_mode+0x11/0x2a0 [ 61.035854][ T5837] do_syscall_64+0xda/0x250 [ 61.040333][ T5837] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 61.046204][ T5837] RIP: 0033:0x7fd4f256cba0 [ 61.050591][ T5837] Code: 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d c1 24 07 00 00 74 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 48 89 [pid 5837] write(5, "3", 1 [pid 5839] ioctl(-1, SIOCADDRT, 0x20000a80 [pid 5837] <... write resumed>) = 1 [pid 5838] write(5, "3", 1 [pid 5836] ioctl(-1, SIOCADDRT, 0x20000a80 [pid 5839] <... ioctl resumed>) = -1 EBADF (Bad file descriptor) [pid 5837] ioctl(-1, SIOCADDRT, 0x20000a80 [pid 5839] close(3 [pid 5837] <... ioctl resumed>) = -1 EBADF (Bad file descriptor) [pid 5839] <... close resumed>) = 0 [pid 5837] close(3 [pid 5839] close(4 [pid 5837] <... close resumed>) = 0 [pid 5839] <... close resumed>) = 0 [pid 5837] close(4 [pid 5839] close(5 [pid 5837] <... close resumed>) = 0 [pid 5839] <... close resumed>) = 0 [pid 5837] close(5 [pid 5839] close(6 [pid 5837] <... close resumed>) = 0 [pid 5839] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5837] close(6 [pid 5839] close(7 [pid 5837] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5839] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5837] close(7 [pid 5839] close(8 [pid 5837] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5839] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5837] close(8 [pid 5839] close(9 [pid 5837] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5839] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5837] close(9 [pid 5839] close(10 [pid 5837] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5839] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5837] close(10 [pid 5839] close(11 [pid 5837] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5839] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5837] close(11 [pid 5839] close(12 [pid 5837] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5839] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5837] close(12 [pid 5839] close(13 [pid 5837] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5839] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5837] close(13 [pid 5839] close(14 [pid 5837] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5839] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5837] close(14 [pid 5839] close(15 [pid 5837] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5839] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5837] close(15 [pid 5839] close(16 [pid 5837] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5839] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5837] close(16 [pid 5839] close(17 [pid 5837] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5839] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5837] close(17 [pid 5839] close(18 [pid 5837] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5839] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5837] close(18 [pid 5839] close(19 [pid 5837] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5839] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5837] close(19 [pid 5839] close(20 [pid 5837] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5839] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5837] close(20 [pid 5839] close(21 [pid 5837] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5839] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5837] close(21 [pid 5839] close(22 [pid 5837] <... close resumed>) = -1 EBADF (Bad file descriptor) [ 61.070170][ T5837] RSP: 002b:00007ffebff53808 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 [ 61.078555][ T5837] RAX: 0000000000000001 RBX: 00007ffebff53830 RCX: 00007fd4f256cba0 [ 61.086499][ T5837] RDX: 0000000000000001 RSI: 00007ffebff53830 RDI: 0000000000000005 [ 61.094440][ T5837] RBP: 0000000000000005 R08: 0000000000000001 R09: 00007ffebff535a7 [ 61.102383][ T5837] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 61.110322][ T5837] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 61.118278][ T5837] [ 61.127904][ T5838] FAULT_INJECTION: forcing a failure. [ 61.127904][ T5838] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 61.140934][ T5838] CPU: 1 UID: 0 PID: 5838 Comm: syz-executor388 Not tainted 6.13.0-rc7-syzkaller-00043-g619f0b6fad52 #0 [ 61.152112][ T5838] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 61.162140][ T5838] Call Trace: [ 61.165392][ T5838] [ 61.168296][ T5838] dump_stack_lvl+0x116/0x1f0 [ 61.172952][ T5838] should_fail_ex+0x497/0x5b0 [ 61.177622][ T5838] copy_to_user_nofault+0xac/0x180 [ 61.182710][ T5838] bpf_probe_write_user+0xaf/0xf0 [ 61.187710][ T5838] bpf_prog_6303d92f98284ad8+0x44/0x48 [ 61.193137][ T5838] bpf_trace_run4+0x245/0x5a0 [ 61.197789][ T5838] ? __pfx_bpf_trace_run4+0x10/0x10 [ 61.202958][ T5838] ? rcu_is_watching+0x12/0xc0 [ 61.207698][ T5838] ? __pfx_lock_release+0x10/0x10 [ 61.212694][ T5838] ? __pfx_sched_clock_cpu+0x10/0x10 [ 61.217952][ T5838] __bpf_trace_sched_switch+0x13e/0x190 [ 61.223473][ T5838] ? __pfx___bpf_trace_sched_switch+0x10/0x10 [ 61.229510][ T5838] ? psi_group_change+0x6dc/0xd20 [ 61.234508][ T5838] ? pick_next_task_fair+0xdae/0x1280 [ 61.239859][ T5838] __traceiter_sched_switch+0x6c/0xc0 [ 61.245204][ T5838] __schedule+0x1b71/0x5ad0 [ 61.249682][ T5838] ? lock_acquire+0x2f/0xb0 [ 61.254158][ T5838] ? __wake_up_sync_key+0x1c/0x50 [ 61.259155][ T5838] ? trace_irq_enable.constprop.0+0xea/0x140 [ 61.265111][ T5838] ? __pfx___schedule+0x10/0x10 [ 61.269937][ T5838] ? lock_release+0x4e2/0x6f0 [ 61.274585][ T5838] ? schedule+0x298/0x350 [ 61.278889][ T5838] ? __pfx_lock_release+0x10/0x10 [ 61.283887][ T5838] ? schedule+0x1fd/0x350 [ 61.288187][ T5838] ? lock_acquire+0x2f/0xb0 [ 61.292661][ T5838] ? schedule+0x1fd/0x350 [ 61.296961][ T5838] schedule+0xe7/0x350 [ 61.301001][ T5838] ptrace_stop.part.0+0x440/0x940 [ 61.305997][ T5838] ptrace_do_notify+0x222/0x2d0 [ 61.310829][ T5838] ? __pfx_ptrace_do_notify+0x10/0x10 [ 61.316174][ T5838] ? rcu_is_watching+0x12/0xc0 [ 61.320914][ T5838] ? lock_acquire+0x2f/0xb0 [ 61.325399][ T5838] ? ptrace_notify+0xb1/0x130 [ 61.330049][ T5838] ptrace_notify+0xc5/0x130 [ 61.334523][ T5838] syscall_exit_to_user_mode_prepare+0x126/0x290 [ 61.340831][ T5838] syscall_exit_to_user_mode+0x11/0x2a0 [ 61.346359][ T5838] do_syscall_64+0xda/0x250 [ 61.350840][ T5838] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 61.356707][ T5838] RIP: 0033:0x7fd4f256cba0 [pid 5839] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5837] close(22 [pid 5839] close(23 [pid 5837] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5839] <... close resumed>) = -1 EBADF (Bad file descriptor) [ 61.361104][ T5838] Code: 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d c1 24 07 00 00 74 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 48 89 [ 61.380687][ T5838] RSP: 002b:00007ffebff53808 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 [ 61.389173][ T5838] RAX: 0000000000000001 RBX: 00007ffebff53830 RCX: 00007fd4f256cba0 [ 61.397118][ T5838] RDX: 0000000000000001 RSI: 00007ffebff53830 RDI: 0000000000000005 [ 61.405059][ T5838] RBP: 0000000000000005 R08: 0000000000000001 R09: 00007ffebff535a7 [ 61.413003][ T5838] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 61.420946][ T5838] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 61.428892][ T5838] [ 61.433292][ T5840] FAULT_INJECTION: forcing a failure. [ 61.433292][ T5840] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 61.446322][ T5840] CPU: 1 UID: 0 PID: 5840 Comm: syz-executor388 Not tainted 6.13.0-rc7-syzkaller-00043-g619f0b6fad52 #0 [ 61.457402][ T5840] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 61.467447][ T5840] Call Trace: [ 61.470702][ T5840] [ 61.473606][ T5840] dump_stack_lvl+0x116/0x1f0 [ 61.478271][ T5840] should_fail_ex+0x497/0x5b0 [ 61.482938][ T5840] copy_to_user_nofault+0xac/0x180 [ 61.488022][ T5840] bpf_probe_write_user+0xaf/0xf0 [ 61.493026][ T5840] bpf_prog_6303d92f98284ad8+0x44/0x48 [ 61.498472][ T5840] bpf_trace_run4+0x245/0x5a0 [ 61.503124][ T5840] ? __pfx_bpf_trace_run4+0x10/0x10 [ 61.508291][ T5840] ? rcu_is_watching+0x12/0xc0 [ 61.513119][ T5840] ? __pfx_lock_release+0x10/0x10 [ 61.518130][ T5840] ? __pfx_sched_clock_cpu+0x10/0x10 [ 61.523388][ T5840] __bpf_trace_sched_switch+0x13e/0x190 [ 61.528908][ T5840] ? __pfx___bpf_trace_sched_switch+0x10/0x10 [ 61.534952][ T5840] ? psi_group_change+0x6dc/0xd20 [ 61.539951][ T5840] ? pick_next_task_fair+0xdae/0x1280 [ 61.545295][ T5840] __traceiter_sched_switch+0x6c/0xc0 [ 61.550643][ T5840] __schedule+0x1b71/0x5ad0 [ 61.555123][ T5840] ? trace_irq_enable.constprop.0+0xea/0x140 [ 61.561082][ T5840] ? __pfx___schedule+0x10/0x10 [ 61.565904][ T5840] ? lock_release+0x4e2/0x6f0 [ 61.570553][ T5840] ? schedule+0x298/0x350 [ 61.574865][ T5840] ? __pfx_lock_release+0x10/0x10 [ 61.579865][ T5840] ? schedule+0x1fd/0x350 [ 61.584168][ T5840] ? lock_acquire+0x2f/0xb0 [ 61.588652][ T5840] ? schedule+0x1fd/0x350 [ 61.592956][ T5840] schedule+0xe7/0x350 [ 61.596998][ T5840] ptrace_stop.part.0+0x440/0x940 [ 61.601997][ T5840] ptrace_do_notify+0x222/0x2d0 [ 61.606820][ T5840] ? __pfx_ptrace_do_notify+0x10/0x10 [ 61.612166][ T5840] ? rcu_is_watching+0x12/0xc0 [ 61.616907][ T5840] ? lock_acquire+0x2f/0xb0 [ 61.621397][ T5840] ? ptrace_notify+0xb1/0x130 [ 61.626062][ T5840] ptrace_notify+0xc5/0x130 [ 61.630548][ T5840] syscall_exit_to_user_mode_prepare+0x126/0x290 [ 61.636860][ T5840] syscall_exit_to_user_mode+0x11/0x2a0 [ 61.642395][ T5840] do_syscall_64+0xda/0x250 [ 61.646884][ T5840] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 61.652773][ T5840] RIP: 0033:0x7fd4f256cba0 [ 61.657163][ T5840] Code: 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d c1 24 07 00 00 74 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 48 89 [pid 5838] <... write resumed>) = 1 [pid 5837] close(23 [pid 5840] write(5, "3", 1 [pid 5839] close(24 [pid 5836] <... ioctl resumed>) = -1 EBADF (Bad file descriptor) [pid 5840] <... write resumed>) = 1 [pid 5839] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5837] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5839] close(25 [pid 5837] close(24 [pid 5836] close(3 [pid 5837] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5836] <... close resumed>) = 0 [pid 5839] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5836] close(4) = 0 [pid 5836] close(5) = 0 [pid 5836] close(6) = -1 EBADF (Bad file descriptor) [pid 5836] close(7) = -1 EBADF (Bad file descriptor) [pid 5836] close(8) = -1 EBADF (Bad file descriptor) [pid 5836] close(9) = -1 EBADF (Bad file descriptor) [pid 5836] close(10) = -1 EBADF (Bad file descriptor) [pid 5836] close(11) = -1 EBADF (Bad file descriptor) [pid 5837] close(25 [pid 5836] close(12) = -1 EBADF (Bad file descriptor) [pid 5836] close(13) = -1 EBADF (Bad file descriptor) [pid 5836] close(14) = -1 EBADF (Bad file descriptor) [pid 5836] close(15) = -1 EBADF (Bad file descriptor) [pid 5836] close(16) = -1 EBADF (Bad file descriptor) [pid 5836] close(17) = -1 EBADF (Bad file descriptor) [pid 5836] close(18) = -1 EBADF (Bad file descriptor) [pid 5836] close(19) = -1 EBADF (Bad file descriptor) [pid 5836] close(20) = -1 EBADF (Bad file descriptor) [pid 5836] close(21) = -1 EBADF (Bad file descriptor) [pid 5836] close(22) = -1 EBADF (Bad file descriptor) [pid 5836] close(23) = -1 EBADF (Bad file descriptor) [pid 5839] close(26 [pid 5836] close(24) = -1 EBADF (Bad file descriptor) [pid 5836] close(25) = -1 EBADF (Bad file descriptor) [pid 5836] close(26) = -1 EBADF (Bad file descriptor) [pid 5836] close(27) = -1 EBADF (Bad file descriptor) [pid 5836] close(28) = -1 EBADF (Bad file descriptor) [pid 5836] close(29) = -1 EBADF (Bad file descriptor) [pid 5836] exit_group(0) = ? [pid 5837] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5836] +++ exited with 0 +++ [pid 5837] close(26) = -1 EBADF (Bad file descriptor) [pid 5837] close(27) = -1 EBADF (Bad file descriptor) [pid 5837] close(28) = -1 EBADF (Bad file descriptor) [pid 5837] close(29 [pid 5839] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5837] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5837] exit_group(0) = ? [pid 5837] +++ exited with 0 +++ [pid 5827] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- [pid 5827] restart_syscall(<... resuming interrupted clone ...> [pid 5839] close(27 [pid 5823] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- [pid 5827] <... restart_syscall resumed>) = 0 [pid 5823] restart_syscall(<... resuming interrupted clone ...> [pid 5839] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5823] <... restart_syscall resumed>) = 0 [pid 5823] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5823] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5827] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5823] <... openat resumed>) = 3 [pid 5840] ioctl(-1, SIOCADDRT, 0x20000a80 [pid 5839] close(28 [pid 5838] ioctl(-1, SIOCADDRT, 0x20000a80 [pid 5823] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=120, ...}, AT_EMPTY_PATH) = 0 [pid 5840] <... ioctl resumed>) = -1 EBADF (Bad file descriptor) [pid 5839] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5827] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5840] close(3 [pid 5823] getdents64(3, [pid 5840] <... close resumed>) = 0 [pid 5839] close(29 [pid 5840] close(4 [pid 5823] <... getdents64 resumed>0x55556a2b46f0 /* 6 entries */, 32768) = 176 [pid 5839] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5827] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5823] umount2("./0/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5839] exit_group(0 [pid 5823] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5839] <... exit_group resumed>) = ? [pid 5827] <... openat resumed>) = 3 [pid 5840] <... close resumed>) = 0 [pid 5839] +++ exited with 0 +++ [pid 5838] <... ioctl resumed>) = -1 EBADF (Bad file descriptor) [pid 5827] newfstatat(3, "", [pid 5828] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5823] newfstatat(AT_FDCWD, "./0/cgroup", [pid 5838] close(3 [pid 5827] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=120, ...}, AT_EMPTY_PATH) = 0 [pid 5840] close(5 [pid 5823] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5840] <... close resumed>) = 0 [pid 5838] <... close resumed>) = 0 [pid 5840] close(6 [pid 5827] getdents64(3, [pid 5823] unlink("./0/cgroup" [pid 5840] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5838] close(4 [pid 5827] <... getdents64 resumed>0x55556a2b46f0 /* 6 entries */, 32768) = 176 [pid 5840] close(7) = -1 EBADF (Bad file descriptor) [pid 5840] close(8 [pid 5838] <... close resumed>) = 0 [pid 5827] umount2("./0/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5840] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5827] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5840] close(9 [pid 5838] close(5 [pid 5827] newfstatat(AT_FDCWD, "./0/cgroup", [pid 5823] <... unlink resumed>) = 0 [pid 5840] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5838] <... close resumed>) = 0 [pid 5840] close(10 [pid 5827] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5823] umount2("./0/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5838] close(6 [pid 5827] unlink("./0/cgroup" [pid 5838] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5823] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5838] close(7 [pid 5840] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5840] close(11) = -1 EBADF (Bad file descriptor) [pid 5838] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5823] newfstatat(AT_FDCWD, "./0/cgroup.cpu", [pid 5840] close(12 [pid 5838] close(8 [pid 5827] <... unlink resumed>) = 0 [pid 5840] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5838] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5823] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5827] umount2("./0/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5840] close(13 [pid 5838] close(9 [pid 5823] unlink("./0/cgroup.cpu" [pid 5840] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5838] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5827] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5840] close(14) = -1 EBADF (Bad file descriptor) [ 61.676762][ T5840] RSP: 002b:00007ffebff53808 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 [ 61.685164][ T5840] RAX: 0000000000000001 RBX: 00007ffebff53830 RCX: 00007fd4f256cba0 [ 61.693112][ T5840] RDX: 0000000000000001 RSI: 00007ffebff53830 RDI: 0000000000000005 [ 61.701060][ T5840] RBP: 0000000000000005 R08: 0000000000000001 R09: 00007ffebff535a7 [ 61.709019][ T5840] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 61.716967][ T5840] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 61.724916][ T5840] [pid 5840] close(15) = -1 EBADF (Bad file descriptor) [pid 5838] close(10 [pid 5827] newfstatat(AT_FDCWD, "./0/cgroup.cpu", [pid 5823] <... unlink resumed>) = 0 [pid 5838] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5840] close(16) = -1 EBADF (Bad file descriptor) [pid 5827] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5823] umount2("./0/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5840] close(17 [pid 5838] close(11 [pid 5827] unlink("./0/cgroup.cpu" [pid 5840] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5823] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5840] close(18) = -1 EBADF (Bad file descriptor) [pid 5840] close(19) = -1 EBADF (Bad file descriptor) [pid 5827] <... unlink resumed>) = 0 [pid 5840] close(20 [pid 5823] newfstatat(AT_FDCWD, "./0/cgroup.net", [pid 5827] umount2("./0/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5840] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5838] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5840] close(21 [pid 5823] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5840] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5838] close(12 [pid 5827] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5823] unlink("./0/cgroup.net" [pid 5840] close(22 [pid 5827] newfstatat(AT_FDCWD, "./0/cgroup.net", [pid 5840] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5840] close(23 [pid 5827] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5838] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5823] <... unlink resumed>) = 0 [pid 5827] unlink("./0/cgroup.net" [pid 5838] close(13 [pid 5823] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5840] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5840] close(24 [pid 5827] <... unlink resumed>) = 0 [pid 5838] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5823] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5840] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5827] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5823] newfstatat(AT_FDCWD, "./0/binderfs", [pid 5840] close(25 [pid 5827] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5840] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5838] close(14 [pid 5823] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5840] close(26 [pid 5827] newfstatat(AT_FDCWD, "./0/binderfs", [pid 5838] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5823] unlink("./0/binderfs" [pid 5840] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5828] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5840] close(27 [pid 5827] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5840] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5823] <... unlink resumed>) = 0 [pid 5840] close(28 [pid 5827] unlink("./0/binderfs" [pid 5823] getdents64(3, [pid 5840] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5838] close(15 [pid 5828] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5840] close(29 [pid 5827] <... unlink resumed>) = 0 [pid 5823] <... getdents64 resumed>0x55556a2b46f0 /* 0 entries */, 32768) = 0 [pid 5840] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5838] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5840] exit_group(0 [pid 5828] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5827] getdents64(3, [pid 5823] close(3 [pid 5838] close(16 [pid 5840] <... exit_group resumed>) = ? [pid 5838] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5828] <... openat resumed>) = 3 [pid 5827] <... getdents64 resumed>0x55556a2b46f0 /* 0 entries */, 32768) = 0 [pid 5823] <... close resumed>) = 0 [pid 5838] close(17 [pid 5827] close(3 [pid 5823] rmdir("./0" [pid 5828] newfstatat(3, "", [pid 5827] <... close resumed>) = 0 [pid 5827] rmdir("./0" [pid 5823] <... rmdir resumed>) = 0 [pid 5827] <... rmdir resumed>) = 0 [pid 5823] mkdir("./1", 0777 [pid 5838] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5827] mkdir("./1", 0777 [pid 5840] +++ exited with 0 +++ [pid 5838] close(18 [pid 5828] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=120, ...}, AT_EMPTY_PATH) = 0 [pid 5823] <... mkdir resumed>) = 0 [pid 5838] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5827] <... mkdir resumed>) = 0 [pid 5823] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5827] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5842 attached ./strace-static-x86_64: Process 5841 attached [pid 5838] close(19 [pid 5828] getdents64(3, [pid 5825] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- [pid 5841] set_robust_list(0x55556a2b3660, 24 [pid 5838] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5827] <... clone resumed>, child_tidptr=0x55556a2b3650) = 3 [pid 5823] <... clone resumed>, child_tidptr=0x55556a2b3650) = 3 [pid 5842] set_robust_list(0x55556a2b3660, 24 [pid 5841] <... set_robust_list resumed>) = 0 [pid 5838] close(20 [pid 5828] <... getdents64 resumed>0x55556a2b46f0 /* 6 entries */, 32768) = 176 [pid 5825] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5842] <... set_robust_list resumed>) = 0 [pid 5841] chdir("./1" [pid 5838] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5842] chdir("./1" [pid 5828] umount2("./0/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5825] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5838] close(21 [pid 5825] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5838] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5842] <... chdir resumed>) = 0 [pid 5841] <... chdir resumed>) = 0 [pid 5842] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5841] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5825] <... openat resumed>) = 3 [pid 5842] <... prctl resumed>) = 0 [pid 5841] <... prctl resumed>) = 0 [pid 5842] setpgid(0, 0 [pid 5841] setpgid(0, 0 [pid 5842] <... setpgid resumed>) = 0 [pid 5841] <... setpgid resumed>) = 0 [pid 5842] symlink("/syzcgroup/unified/syz2", "./cgroup" [pid 5841] symlink("/syzcgroup/unified/syz0", "./cgroup" [pid 5842] <... symlink resumed>) = 0 [pid 5838] close(22 [pid 5828] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5825] newfstatat(3, "", [pid 5842] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu" [pid 5841] <... symlink resumed>) = 0 [pid 5838] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5828] newfstatat(AT_FDCWD, "./0/cgroup", [pid 5825] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=120, ...}, AT_EMPTY_PATH) = 0 [pid 5842] <... symlink resumed>) = 0 [pid 5841] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu" [pid 5842] symlink("/syzcgroup/net/syz2", "./cgroup.net" [pid 5841] <... symlink resumed>) = 0 [pid 5828] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5825] getdents64(3, [pid 5842] <... symlink resumed>) = 0 [pid 5838] close(23 [pid 5828] unlink("./0/cgroup" [pid 5842] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5841] symlink("/syzcgroup/net/syz0", "./cgroup.net" [pid 5838] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5825] <... getdents64 resumed>0x55556a2b46f0 /* 6 entries */, 32768) = 176 [pid 5842] <... openat resumed>) = 3 [pid 5841] <... symlink resumed>) = 0 [pid 5828] <... unlink resumed>) = 0 [pid 5842] write(3, "1000", 4 [pid 5841] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5838] close(24 [pid 5828] umount2("./0/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5825] umount2("./0/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5842] <... write resumed>) = 4 [pid 5841] <... openat resumed>) = 3 [pid 5838] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5828] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5825] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5842] close(3 [pid 5841] write(3, "1000", 4 [pid 5838] close(25 [pid 5828] newfstatat(AT_FDCWD, "./0/cgroup.cpu", [pid 5825] newfstatat(AT_FDCWD, "./0/cgroup", [pid 5842] <... close resumed>) = 0 [pid 5841] <... write resumed>) = 4 [pid 5838] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5842] symlink("/dev/binderfs", "./binderfs" [pid 5841] close(3 [pid 5825] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5838] close(26 [pid 5842] <... symlink resumed>) = 0 executing program [pid 5828] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5842] write(1, "executing program\n", 18 [pid 5841] <... close resumed>) = 0 [pid 5838] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5825] unlink("./0/cgroup" [pid 5842] <... write resumed>) = 18 [pid 5841] symlink("/dev/binderfs", "./binderfs" [pid 5838] close(27 [pid 5828] unlink("./0/cgroup.cpu" [pid 5842] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=12, insns=0x20000180, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(4, 17, 0), prog_flags=BPF_F_TEST_RND_HI32, prog_name="", prog_ifindex=0, expected_attach_type=0x33 /* BPF_??? */, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 148 [pid 5838] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5825] <... unlink resumed>) = 0 [pid 5828] <... unlink resumed>) = 0 [pid 5842] <... bpf resumed>) = 3 [pid 5841] <... symlink resumed>) = 0 [pid 5838] close(28 executing program [pid 5828] umount2("./0/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5825] umount2("./0/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5841] write(1, "executing program\n", 18 [pid 5838] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5828] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5838] close(29 [pid 5825] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5828] newfstatat(AT_FDCWD, "./0/cgroup.net", [pid 5842] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="sched_switch", prog_fd=3}}, 24 [pid 5841] <... write resumed>) = 18 [pid 5838] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5825] newfstatat(AT_FDCWD, "./0/cgroup.cpu", [pid 5842] <... bpf resumed>) = 4 [pid 5841] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=12, insns=0x20000180, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(4, 17, 0), prog_flags=BPF_F_TEST_RND_HI32, prog_name="", prog_ifindex=0, expected_attach_type=0x33 /* BPF_??? */, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 148 [pid 5828] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5842] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 5841] <... bpf resumed>) = 3 [pid 5838] exit_group(0 [pid 5828] unlink("./0/cgroup.net" [pid 5825] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5842] <... openat resumed>) = 5 [pid 5838] <... exit_group resumed>) = ? [pid 5828] <... unlink resumed>) = 0 [pid 5825] unlink("./0/cgroup.cpu" [pid 5828] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5841] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="sched_switch", prog_fd=3}}, 24 [pid 5842] write(5, "3", 1 [pid 5841] <... bpf resumed>) = 4 [pid 5842] <... write resumed>) = 1 [ 61.844201][ T5842] FAULT_INJECTION: forcing a failure. [ 61.844201][ T5842] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 61.857335][ T5842] CPU: 0 UID: 0 PID: 5842 Comm: syz-executor388 Not tainted 6.13.0-rc7-syzkaller-00043-g619f0b6fad52 #0 [ 61.868421][ T5842] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 61.878456][ T5842] Call Trace: [ 61.881728][ T5842] [ 61.884643][ T5842] dump_stack_lvl+0x116/0x1f0 [ 61.889306][ T5842] should_fail_ex+0x497/0x5b0 [ 61.893968][ T5842] copy_to_user_nofault+0xac/0x180 [ 61.899070][ T5842] bpf_probe_write_user+0xaf/0xf0 [ 61.904071][ T5842] bpf_prog_6303d92f98284ad8+0x44/0x48 [ 61.909502][ T5842] bpf_trace_run4+0x245/0x5a0 [ 61.914167][ T5842] ? __pfx_bpf_trace_run4+0x10/0x10 [ 61.919339][ T5842] ? rcu_is_watching+0x12/0xc0 [ 61.924082][ T5842] ? __pfx_lock_release+0x10/0x10 [ 61.929097][ T5842] ? __pfx_sched_clock_cpu+0x10/0x10 [ 61.934355][ T5842] __bpf_trace_sched_switch+0x13e/0x190 [ 61.939878][ T5842] ? __pfx___bpf_trace_sched_switch+0x10/0x10 [ 61.945919][ T5842] ? psi_group_change+0x6dc/0xd20 [ 61.950933][ T5842] __traceiter_sched_switch+0x6c/0xc0 [ 61.956279][ T5842] __schedule+0x1b71/0x5ad0 [ 61.960760][ T5842] ? lock_acquire+0x2f/0xb0 [ 61.965236][ T5842] ? __wake_up_sync_key+0x1c/0x50 [ 61.970233][ T5842] ? trace_irq_enable.constprop.0+0xea/0x140 [ 61.976189][ T5842] ? __pfx___schedule+0x10/0x10 [ 61.981016][ T5842] ? lock_release+0x4e2/0x6f0 [ 61.985698][ T5842] ? schedule+0x298/0x350 [ 61.990001][ T5842] ? __pfx_lock_release+0x10/0x10 [ 61.995003][ T5842] ? schedule+0x1fd/0x350 [ 61.999317][ T5842] ? lock_acquire+0x2f/0xb0 [ 62.003807][ T5842] ? schedule+0x1fd/0x350 [ 62.008114][ T5842] schedule+0xe7/0x350 [ 62.012158][ T5842] ptrace_stop.part.0+0x440/0x940 [ 62.017160][ T5842] ptrace_do_notify+0x222/0x2d0 [ 62.021986][ T5842] ? __pfx_ptrace_do_notify+0x10/0x10 [ 62.027332][ T5842] ? rcu_is_watching+0x12/0xc0 [ 62.032086][ T5842] ? lock_acquire+0x2f/0xb0 [ 62.036562][ T5842] ? ptrace_notify+0xb1/0x130 [ 62.041213][ T5842] ptrace_notify+0xc5/0x130 [ 62.045690][ T5842] syscall_trace_enter+0xab/0x260 [ 62.050705][ T5842] do_syscall_64+0x1ee/0x250 [ 62.055273][ T5842] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 62.061141][ T5842] RIP: 0033:0x7fd4f256db49 [ 62.065529][ T5842] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 1b 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 62.085111][ T5842] RSP: 002b:00007ffebff53808 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [pid 5841] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 5842] ioctl(-1, SIOCADDRT, 0x20000a80 [pid 5838] +++ exited with 0 +++ [pid 5828] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5825] <... unlink resumed>) = 0 [pid 5829] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- [pid 5828] newfstatat(AT_FDCWD, "./0/binderfs", [pid 5825] umount2("./0/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5828] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5825] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5828] unlink("./0/binderfs" [pid 5825] newfstatat(AT_FDCWD, "./0/cgroup.net", [pid 5828] <... unlink resumed>) = 0 [pid 5825] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5842] <... ioctl resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5828] getdents64(3, [pid 5825] unlink("./0/cgroup.net" [pid 5842] close(3 [pid 5841] <... openat resumed>) = 5 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5828] <... getdents64 resumed>0x55556a2b46f0 /* 0 entries */, 32768) = 0 [pid 5842] <... close resumed>) = 0 [pid 5829] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5842] close(4 [pid 5841] write(5, "3", 1 [pid 5842] <... close resumed>) = 0 [pid 5841] <... write resumed>) = 1 [pid 5829] <... openat resumed>) = 3 [ 62.093496][ T5842] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd4f256db49 [ 62.101441][ T5842] RDX: 0000000020000a80 RSI: 000000000000890b RDI: 00000000ffffffff [ 62.109386][ T5842] RBP: 0000000000000001 R08: 00007ffebff535a7 R09: 0000000000000000 [ 62.117416][ T5842] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 62.125362][ T5842] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 62.133311][ T5842] [ 62.151890][ T5841] FAULT_INJECTION: forcing a failure. [ 62.151890][ T5841] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 62.164928][ T5841] CPU: 0 UID: 0 PID: 5841 Comm: syz-executor388 Not tainted 6.13.0-rc7-syzkaller-00043-g619f0b6fad52 #0 [ 62.176024][ T5841] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 62.186052][ T5841] Call Trace: [ 62.189393][ T5841] [ 62.192304][ T5841] dump_stack_lvl+0x116/0x1f0 [ 62.196964][ T5841] should_fail_ex+0x497/0x5b0 [ 62.201627][ T5841] copy_to_user_nofault+0xac/0x180 [ 62.206736][ T5841] bpf_probe_write_user+0xaf/0xf0 [ 62.211739][ T5841] bpf_prog_6303d92f98284ad8+0x44/0x48 [ 62.217166][ T5841] bpf_trace_run4+0x245/0x5a0 [ 62.221829][ T5841] ? __pfx_bpf_trace_run4+0x10/0x10 [ 62.227001][ T5841] ? psi_task_switch+0x2c1/0x8e0 [ 62.231914][ T5841] ? __pfx_lock_release+0x10/0x10 [ 62.236931][ T5841] ? psi_task_switch+0x2c1/0x8e0 [ 62.241840][ T5841] ? lock_acquire+0x2f/0xb0 [ 62.246317][ T5841] ? psi_task_switch+0x2c1/0x8e0 [ 62.251227][ T5841] __bpf_trace_sched_switch+0x13e/0x190 [ 62.256748][ T5841] ? __pfx___bpf_trace_sched_switch+0x10/0x10 [ 62.262790][ T5841] ? psi_task_switch+0x2c1/0x8e0 [ 62.267717][ T5841] __schedule+0x1b71/0x5ad0 [ 62.272198][ T5841] ? lock_acquire+0x2f/0xb0 [ 62.276673][ T5841] ? __wake_up_sync_key+0x1c/0x50 [ 62.281683][ T5841] ? trace_irq_enable.constprop.0+0xea/0x140 [ 62.287638][ T5841] ? __pfx___schedule+0x10/0x10 [ 62.292464][ T5841] ? lock_release+0x4e2/0x6f0 [ 62.297118][ T5841] ? schedule+0x298/0x350 [ 62.301423][ T5841] ? __pfx_lock_release+0x10/0x10 [ 62.306424][ T5841] ? schedule+0x1fd/0x350 [ 62.310727][ T5841] ? lock_acquire+0x2f/0xb0 [ 62.315201][ T5841] ? schedule+0x1fd/0x350 [ 62.319506][ T5841] schedule+0xe7/0x350 [ 62.323551][ T5841] ptrace_stop.part.0+0x440/0x940 [ 62.328553][ T5841] ptrace_do_notify+0x222/0x2d0 [ 62.333379][ T5841] ? __pfx_ptrace_do_notify+0x10/0x10 [ 62.338725][ T5841] ? rcu_is_watching+0x12/0xc0 [ 62.343466][ T5841] ? lock_acquire+0x2f/0xb0 [ 62.347943][ T5841] ? ptrace_notify+0xb1/0x130 [ 62.352597][ T5841] ptrace_notify+0xc5/0x130 [ 62.357094][ T5841] syscall_exit_to_user_mode_prepare+0x126/0x290 [ 62.363399][ T5841] syscall_exit_to_user_mode+0x11/0x2a0 [ 62.368924][ T5841] do_syscall_64+0xda/0x250 [ 62.373407][ T5841] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 62.379277][ T5841] RIP: 0033:0x7fd4f256db49 [ 62.383667][ T5841] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 1b 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 62.403247][ T5841] RSP: 002b:00007ffebff53808 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 62.411631][ T5841] RAX: fffffffffffffff7 RBX: 0000000000000003 RCX: 00007fd4f256db49 [ 62.419591][ T5841] RDX: 0000000020000a80 RSI: 000000000000890b RDI: 00000000ffffffff [ 62.427535][ T5841] RBP: 0000000000000001 R08: 00007ffebff535a7 R09: 0000000000000000 [ 62.435478][ T5841] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 62.443436][ T5841] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [pid 5828] close(3 [pid 5825] <... unlink resumed>) = 0 [pid 5842] close(5 [pid 5841] ioctl(-1, SIOCADDRT, 0x20000a80 [pid 5829] newfstatat(3, "", [pid 5828] <... close resumed>) = 0 [pid 5842] <... close resumed>) = 0 [pid 5841] <... ioctl resumed>) = -1 EBADF (Bad file descriptor) [pid 5828] rmdir("./0" [pid 5825] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5842] close(6 [pid 5841] close(3 [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=120, ...}, AT_EMPTY_PATH) = 0 [pid 5828] <... rmdir resumed>) = 0 [pid 5825] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5828] mkdir("./1", 0777 [pid 5825] newfstatat(AT_FDCWD, "./0/binderfs", [pid 5842] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5841] <... close resumed>) = 0 [pid 5829] getdents64(3, [pid 5828] <... mkdir resumed>) = 0 [pid 5842] close(7 [pid 5841] close(4 [pid 5829] <... getdents64 resumed>0x55556a2b46f0 /* 6 entries */, 32768) = 176 [pid 5842] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5841] <... close resumed>) = 0 [pid 5842] close(8 [pid 5829] umount2("./0/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5842] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5841] close(5 [pid 5842] close(9 [pid 5841] <... close resumed>) = 0 [pid 5842] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5841] close(6 [pid 5842] close(10 [pid 5841] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5842] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5841] close(7 [pid 5842] close(11 [pid 5841] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5842] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5841] close(8 [pid 5842] close(12 [pid 5841] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5842] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5841] close(9 [pid 5842] close(13 [pid 5841] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5842] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5841] close(10 [pid 5842] close(14 [pid 5841] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5842] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5841] close(11 [pid 5825] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5842] close(15 [pid 5841] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5828] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5825] unlink("./0/binderfs" [pid 5842] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5841] close(12 [pid 5829] newfstatat(AT_FDCWD, "./0/cgroup", [pid 5825] <... unlink resumed>) = 0 ./strace-static-x86_64: Process 5843 attached [pid 5829] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5825] getdents64(3, [pid 5842] close(16 [pid 5841] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] unlink("./0/cgroup" [pid 5843] set_robust_list(0x55556a2b3660, 24 [pid 5825] <... getdents64 resumed>0x55556a2b46f0 /* 0 entries */, 32768) = 0 [pid 5825] close(3 [pid 5843] <... set_robust_list resumed>) = 0 [pid 5842] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5841] close(13 [pid 5829] <... unlink resumed>) = 0 [pid 5825] <... close resumed>) = 0 [pid 5842] close(17 [pid 5829] umount2("./0/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5825] rmdir("./0" [pid 5843] chdir("./1" [pid 5842] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5841] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5828] <... clone resumed>, child_tidptr=0x55556a2b3650) = 3 [pid 5825] <... rmdir resumed>) = 0 [pid 5843] <... chdir resumed>) = 0 [pid 5842] close(18 [pid 5841] close(14 [pid 5829] newfstatat(AT_FDCWD, "./0/cgroup.cpu", [pid 5825] mkdir("./1", 0777 [pid 5843] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5842] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5841] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5825] <... mkdir resumed>) = 0 [pid 5843] <... prctl resumed>) = 0 [pid 5842] close(19 [pid 5841] close(15 [pid 5829] unlink("./0/cgroup.cpu" [pid 5825] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5843] setpgid(0, 0 [pid 5842] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5841] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... unlink resumed>) = 0 [pid 5841] close(16 [pid 5829] umount2("./0/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5825] <... clone resumed>, child_tidptr=0x55556a2b3650) = 3 [pid 5843] <... setpgid resumed>) = 0 [pid 5842] close(20 [pid 5841] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5843] symlink("/syzcgroup/unified/syz4", "./cgroup" [pid 5842] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] newfstatat(AT_FDCWD, "./0/cgroup.net", [pid 5842] close(21 [pid 5841] close(17./strace-static-x86_64: Process 5844 attached [pid 5842] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5841] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5842] close(22 [pid 5841] close(18 [pid 5844] set_robust_list(0x55556a2b3660, 24 [pid 5842] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] unlink("./0/cgroup.net" [pid 5841] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5842] close(23) = -1 EBADF (Bad file descriptor) [pid 5841] close(19 [pid 5829] <... unlink resumed>) = 0 [pid 5844] <... set_robust_list resumed>) = 0 [pid 5842] close(24 [pid 5841] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5842] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5841] close(20 [pid 5842] close(25 [pid 5841] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5842] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5841] close(21 [pid 5829] newfstatat(AT_FDCWD, "./0/binderfs", [pid 5842] close(26 [pid 5841] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5842] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5841] close(22 [pid 5842] close(27 [pid 5841] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5842] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5841] close(23 [pid 5829] unlink("./0/binderfs" [pid 5842] close(28 [pid 5841] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5844] chdir("./1" [pid 5842] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5841] close(24 [pid 5842] close(29 [pid 5841] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5842] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5841] close(25 [pid 5842] exit_group(0 [pid 5841] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5843] <... symlink resumed>) = 0 [pid 5842] <... exit_group resumed>) = ? [pid 5841] close(26 [pid 5842] +++ exited with 0 +++ [pid 5841] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5841] close(27 [pid 5843] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu" [pid 5841] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5841] close(28) = -1 EBADF (Bad file descriptor) [pid 5829] <... unlink resumed>) = 0 [pid 5841] close(29) = -1 EBADF (Bad file descriptor) [pid 5829] getdents64(3, [pid 5841] exit_group(0 [pid 5829] <... getdents64 resumed>0x55556a2b46f0 /* 0 entries */, 32768) = 0 [pid 5841] <... exit_group resumed>) = ? [pid 5844] <... chdir resumed>) = 0 [pid 5829] close(3 [pid 5841] +++ exited with 0 +++ [pid 5829] <... close resumed>) = 0 [pid 5827] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5844] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5829] rmdir("./0" [pid 5843] <... symlink resumed>) = 0 [pid 5827] restart_syscall(<... resuming interrupted clone ...> [pid 5823] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5843] symlink("/syzcgroup/net/syz4", "./cgroup.net" [pid 5844] <... prctl resumed>) = 0 [pid 5829] <... rmdir resumed>) = 0 [pid 5823] restart_syscall(<... resuming interrupted clone ...> [pid 5844] setpgid(0, 0 [pid 5829] mkdir("./1", 0777 [pid 5844] <... setpgid resumed>) = 0 [pid 5829] <... mkdir resumed>) = 0 [pid 5843] <... symlink resumed>) = 0 [pid 5844] symlink("/syzcgroup/unified/syz1", "./cgroup" [pid 5829] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5843] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC./strace-static-x86_64: Process 5845 attached [pid 5844] <... symlink resumed>) = 0 [pid 5843] <... openat resumed>) = 3 [pid 5829] <... clone resumed>, child_tidptr=0x55556a2b3650) = 3 [pid 5827] <... restart_syscall resumed>) = 0 [pid 5823] <... restart_syscall resumed>) = 0 [pid 5844] symlink("/syzcgroup/cpu/syz1", "./cgroup.cpu" [pid 5843] write(3, "1000", 4 [pid 5845] set_robust_list(0x55556a2b3660, 24 [pid 5843] <... write resumed>) = 4 [pid 5823] umount2("./1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5845] <... set_robust_list resumed>) = 0 [pid 5843] close(3 [pid 5827] umount2("./1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5845] chdir("./1" [pid 5843] <... close resumed>) = 0 [pid 5827] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5843] symlink("/dev/binderfs", "./binderfs" [pid 5827] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5823] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5843] <... symlink resumed>) = 0 [pid 5823] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5827] <... openat resumed>) = 3 [pid 5845] <... chdir resumed>) = 0 [pid 5845] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5844] <... symlink resumed>) = 0 [pid 5843] write(1, "executing program\n", 18 [pid 5827] newfstatat(3, "", executing program [pid 5823] <... openat resumed>) = 3 [pid 5845] <... prctl resumed>) = 0 [pid 5844] symlink("/syzcgroup/net/syz1", "./cgroup.net" [pid 5843] <... write resumed>) = 18 [pid 5823] newfstatat(3, "", [pid 5827] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=120, ...}, AT_EMPTY_PATH) = 0 [pid 5845] setpgid(0, 0 [pid 5843] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=12, insns=0x20000180, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(4, 17, 0), prog_flags=BPF_F_TEST_RND_HI32, prog_name="", prog_ifindex=0, expected_attach_type=0x33 /* BPF_??? */, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 148 [pid 5827] getdents64(3, [pid 5823] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=120, ...}, AT_EMPTY_PATH) = 0 [pid 5845] <... setpgid resumed>) = 0 [pid 5844] <... symlink resumed>) = 0 [pid 5827] <... getdents64 resumed>0x55556a2b46f0 /* 6 entries */, 32768) = 176 [pid 5823] getdents64(3, [pid 5827] umount2("./1/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5823] <... getdents64 resumed>0x55556a2b46f0 /* 6 entries */, 32768) = 176 [pid 5845] symlink("/syzcgroup/unified/syz3", "./cgroup" [pid 5827] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5827] newfstatat(AT_FDCWD, "./1/cgroup", [pid 5843] <... bpf resumed>) = 3 [pid 5827] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0 [ 62.451384][ T5841] [pid 5827] unlink("./1/cgroup" [pid 5845] <... symlink resumed>) = 0 [pid 5823] umount2("./1/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5844] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5823] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5823] newfstatat(AT_FDCWD, "./1/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5844] <... openat resumed>) = 3 [pid 5827] <... unlink resumed>) = 0 [pid 5823] unlink("./1/cgroup" [pid 5845] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu" [pid 5827] umount2("./1/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5843] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="sched_switch", prog_fd=3}}, 24 [pid 5823] <... unlink resumed>) = 0 [pid 5843] <... bpf resumed>) = 4 [pid 5823] umount2("./1/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5845] <... symlink resumed>) = 0 [pid 5823] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5844] write(3, "1000", 4 [pid 5827] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5845] symlink("/syzcgroup/net/syz3", "./cgroup.net" [pid 5844] <... write resumed>) = 4 [pid 5827] newfstatat(AT_FDCWD, "./1/cgroup.cpu", [pid 5823] newfstatat(AT_FDCWD, "./1/cgroup.cpu", [pid 5844] close(3 [pid 5827] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5844] <... close resumed>) = 0 [pid 5845] <... symlink resumed>) = 0 [pid 5845] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5844] symlink("/dev/binderfs", "./binderfs" [pid 5843] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 5827] unlink("./1/cgroup.cpu" [pid 5823] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5844] <... symlink resumed>) = 0 [pid 5827] <... unlink resumed>) = 0 [pid 5823] unlink("./1/cgroup.cpu" [pid 5827] umount2("./1/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5843] <... openat resumed>) = 5 [pid 5827] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5845] <... openat resumed>) = 3 [pid 5827] newfstatat(AT_FDCWD, "./1/cgroup.net", [pid 5823] <... unlink resumed>) = 0 [pid 5827] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5845] write(3, "1000", 4 [pid 5844] write(1, "executing program\n", 18 [pid 5843] write(5, "3", 1 [pid 5823] umount2("./1/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW [ 62.501279][ T5843] FAULT_INJECTION: forcing a failure. [ 62.501279][ T5843] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 62.514314][ T5843] CPU: 0 UID: 0 PID: 5843 Comm: syz-executor388 Not tainted 6.13.0-rc7-syzkaller-00043-g619f0b6fad52 #0 [ 62.525410][ T5843] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 62.535438][ T5843] Call Trace: [ 62.538696][ T5843] [ 62.541607][ T5843] dump_stack_lvl+0x116/0x1f0 [ 62.546282][ T5843] should_fail_ex+0x497/0x5b0 [ 62.550936][ T5843] copy_to_user_nofault+0xac/0x180 [ 62.556034][ T5843] bpf_probe_write_user+0xaf/0xf0 [ 62.561050][ T5843] bpf_prog_6303d92f98284ad8+0x44/0x48 [ 62.566481][ T5843] bpf_trace_run4+0x245/0x5a0 [ 62.571135][ T5843] ? __pfx_bpf_trace_run4+0x10/0x10 [ 62.576305][ T5843] ? psi_task_switch+0x2c1/0x8e0 [ 62.581215][ T5843] ? __pfx_lock_release+0x10/0x10 [ 62.586212][ T5843] ? psi_task_switch+0x2c1/0x8e0 [ 62.591120][ T5843] ? lock_acquire+0x2f/0xb0 [ 62.595597][ T5843] ? psi_task_switch+0x2c1/0x8e0 [ 62.600505][ T5843] __bpf_trace_sched_switch+0x13e/0x190 [ 62.606025][ T5843] ? __pfx___bpf_trace_sched_switch+0x10/0x10 [ 62.612069][ T5843] ? psi_task_switch+0x2c1/0x8e0 [ 62.616980][ T5843] __schedule+0x1b71/0x5ad0 [ 62.621457][ T5843] ? lock_acquire+0x2f/0xb0 [ 62.625930][ T5843] ? __wake_up_sync_key+0x1c/0x50 [ 62.630930][ T5843] ? trace_irq_enable.constprop.0+0xea/0x140 [ 62.636888][ T5843] ? __pfx___schedule+0x10/0x10 [ 62.641714][ T5843] ? lock_release+0x4e2/0x6f0 [ 62.646363][ T5843] ? schedule+0x298/0x350 [ 62.650666][ T5843] ? __pfx_lock_release+0x10/0x10 [ 62.655670][ T5843] ? schedule+0x1fd/0x350 [ 62.660038][ T5843] ? lock_acquire+0x2f/0xb0 [ 62.664532][ T5843] ? schedule+0x1fd/0x350 [ 62.668851][ T5843] schedule+0xe7/0x350 [ 62.672900][ T5843] ptrace_stop.part.0+0x440/0x940 [ 62.677903][ T5843] ptrace_do_notify+0x222/0x2d0 [ 62.682729][ T5843] ? __pfx_ptrace_do_notify+0x10/0x10 [ 62.688078][ T5843] ? rcu_is_watching+0x12/0xc0 [ 62.692827][ T5843] ? lock_acquire+0x2f/0xb0 [ 62.697306][ T5843] ? ptrace_notify+0xb1/0x130 [ 62.701959][ T5843] ptrace_notify+0xc5/0x130 [ 62.706438][ T5843] syscall_exit_to_user_mode_prepare+0x126/0x290 [ 62.712781][ T5843] syscall_exit_to_user_mode+0x11/0x2a0 [ 62.718366][ T5843] do_syscall_64+0xda/0x250 [ 62.722858][ T5843] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 62.728758][ T5843] RIP: 0033:0x7fd4f256db49 [ 62.733154][ T5843] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 1b 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 62.752738][ T5843] RSP: 002b:00007ffebff53808 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 62.761139][ T5843] RAX: fffffffffffffff7 RBX: 0000000000000003 RCX: 00007fd4f256db49 [ 62.769106][ T5843] RDX: 0000000020000a80 RSI: 000000000000890b RDI: 00000000ffffffff [ 62.777052][ T5843] RBP: 0000000000000001 R08: 00007ffebff535a7 R09: 0000000000000000 [ 62.784997][ T5843] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 62.792938][ T5843] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 executing program [pid 5827] unlink("./1/cgroup.net" [pid 5845] <... write resumed>) = 4 [pid 5843] <... write resumed>) = 1 [pid 5827] <... unlink resumed>) = 0 [pid 5823] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5845] close(3 [pid 5844] <... write resumed>) = 18 [pid 5843] ioctl(-1, SIOCADDRT, 0x20000a80 [pid 5823] newfstatat(AT_FDCWD, "./1/cgroup.net", [pid 5844] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=12, insns=0x20000180, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(4, 17, 0), prog_flags=BPF_F_TEST_RND_HI32, prog_name="", prog_ifindex=0, expected_attach_type=0x33 /* BPF_??? */, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 148 [pid 5843] <... ioctl resumed>) = -1 EBADF (Bad file descriptor) [pid 5827] umount2("./1/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5844] <... bpf resumed>) = 3 [pid 5827] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5844] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="sched_switch", prog_fd=3}}, 24 [pid 5827] newfstatat(AT_FDCWD, "./1/binderfs", [pid 5845] <... close resumed>) = 0 [pid 5844] <... bpf resumed>) = 4 [pid 5843] close(3 [pid 5827] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5823] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5845] symlink("/dev/binderfs", "./binderfs" [pid 5844] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 5843] <... close resumed>) = 0 [pid 5827] unlink("./1/binderfs" [pid 5823] unlink("./1/cgroup.net" [pid 5845] <... symlink resumed>) = 0 [pid 5844] <... openat resumed>) = 5 [pid 5843] close(4 [pid 5827] <... unlink resumed>) = 0 [pid 5827] getdents64(3, [pid 5823] <... unlink resumed>) = 0 executing program [pid 5845] write(1, "executing program\n", 18 [pid 5827] <... getdents64 resumed>0x55556a2b46f0 /* 0 entries */, 32768) = 0 [pid 5845] <... write resumed>) = 18 [pid 5844] write(5, "3", 1 [pid 5843] <... close resumed>) = 0 [pid 5827] close(3 [pid 5823] umount2("./1/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5845] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=12, insns=0x20000180, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(4, 17, 0), prog_flags=BPF_F_TEST_RND_HI32, prog_name="", prog_ifindex=0, expected_attach_type=0x33 /* BPF_??? */, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 148 [pid 5844] <... write resumed>) = 1 [pid 5843] close(5 [pid 5827] <... close resumed>) = 0 [ 62.800897][ T5843] [ 62.821587][ T5844] FAULT_INJECTION: forcing a failure. [ 62.821587][ T5844] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 62.834644][ T5844] CPU: 1 UID: 0 PID: 5844 Comm: syz-executor388 Not tainted 6.13.0-rc7-syzkaller-00043-g619f0b6fad52 #0 [ 62.845732][ T5844] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 62.855772][ T5844] Call Trace: [ 62.859036][ T5844] [ 62.861949][ T5844] dump_stack_lvl+0x116/0x1f0 [ 62.866608][ T5844] should_fail_ex+0x497/0x5b0 [ 62.871266][ T5844] copy_to_user_nofault+0xac/0x180 [ 62.876355][ T5844] bpf_probe_write_user+0xaf/0xf0 [ 62.881361][ T5844] bpf_prog_6303d92f98284ad8+0x44/0x48 [ 62.886813][ T5844] bpf_trace_run4+0x245/0x5a0 [ 62.891468][ T5844] ? __pfx_bpf_trace_run4+0x10/0x10 [ 62.896638][ T5844] ? psi_task_switch+0x2c1/0x8e0 [ 62.901547][ T5844] ? __pfx_lock_release+0x10/0x10 [ 62.906557][ T5844] ? psi_task_switch+0x2c1/0x8e0 [ 62.911468][ T5844] ? lock_acquire+0x2f/0xb0 [ 62.915948][ T5844] ? psi_task_switch+0x2c1/0x8e0 [ 62.920858][ T5844] __bpf_trace_sched_switch+0x13e/0x190 [ 62.926388][ T5844] ? __pfx___bpf_trace_sched_switch+0x10/0x10 [ 62.932445][ T5844] ? psi_task_switch+0x2c1/0x8e0 [ 62.937363][ T5844] __schedule+0x1b71/0x5ad0 [ 62.941859][ T5844] ? lock_acquire+0x2f/0xb0 [ 62.946359][ T5844] ? __wake_up_sync_key+0x1c/0x50 [ 62.951368][ T5844] ? trace_irq_enable.constprop.0+0xea/0x140 [ 62.957341][ T5844] ? __pfx___schedule+0x10/0x10 [ 62.962192][ T5844] ? lock_release+0x4e2/0x6f0 [ 62.966849][ T5844] ? schedule+0x298/0x350 [ 62.971152][ T5844] ? __pfx_lock_release+0x10/0x10 [ 62.976150][ T5844] ? schedule+0x1fd/0x350 [ 62.980455][ T5844] ? lock_acquire+0x2f/0xb0 [ 62.984946][ T5844] ? schedule+0x1fd/0x350 [ 62.989297][ T5844] schedule+0xe7/0x350 [ 62.993342][ T5844] ptrace_stop.part.0+0x440/0x940 [ 62.998346][ T5844] ptrace_do_notify+0x222/0x2d0 [ 63.003173][ T5844] ? __pfx_ptrace_do_notify+0x10/0x10 [ 63.008521][ T5844] ? rcu_is_watching+0x12/0xc0 [ 63.013264][ T5844] ? lock_acquire+0x2f/0xb0 [ 63.017739][ T5844] ? ptrace_notify+0xb1/0x130 [ 63.022395][ T5844] ptrace_notify+0xc5/0x130 [ 63.026903][ T5844] syscall_exit_to_user_mode_prepare+0x126/0x290 [ 63.033222][ T5844] syscall_exit_to_user_mode+0x11/0x2a0 [ 63.038753][ T5844] do_syscall_64+0xda/0x250 [ 63.043241][ T5844] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 63.049114][ T5844] RIP: 0033:0x7fd4f256db49 [ 63.053506][ T5844] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 1b 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 63.073088][ T5844] RSP: 002b:00007ffebff53808 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 63.081738][ T5844] RAX: fffffffffffffff7 RBX: 0000000000000003 RCX: 00007fd4f256db49 [ 63.089705][ T5844] RDX: 0000000020000a80 RSI: 000000000000890b RDI: 00000000ffffffff [pid 5844] ioctl(-1, SIOCADDRT, 0x20000a80 [pid 5843] <... close resumed>) = 0 [pid 5827] rmdir("./1" [pid 5823] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5845] <... bpf resumed>) = 3 [pid 5844] <... ioctl resumed>) = -1 EBADF (Bad file descriptor) [pid 5843] close(6 [pid 5823] newfstatat(AT_FDCWD, "./1/binderfs", [pid 5843] <... close resumed>) = -1 EBADF (Bad file descriptor) [ 63.097650][ T5844] RBP: 0000000000000001 R08: 00007ffebff535a7 R09: 0000000000000000 [ 63.105602][ T5844] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 63.113549][ T5844] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 63.121499][ T5844] [ 63.128779][ T5845] FAULT_INJECTION: forcing a failure. [ 63.128779][ T5845] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 63.141823][ T5845] CPU: 0 UID: 0 PID: 5845 Comm: syz-executor388 Not tainted 6.13.0-rc7-syzkaller-00043-g619f0b6fad52 #0 [ 63.152926][ T5845] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 63.162953][ T5845] Call Trace: [ 63.166207][ T5845] [ 63.169112][ T5845] dump_stack_lvl+0x116/0x1f0 [ 63.173771][ T5845] should_fail_ex+0x497/0x5b0 [ 63.178425][ T5845] copy_to_user_nofault+0xac/0x180 [ 63.183521][ T5845] bpf_probe_write_user+0xaf/0xf0 [ 63.188523][ T5845] bpf_prog_6303d92f98284ad8+0x44/0x48 [ 63.193969][ T5845] bpf_trace_run4+0x245/0x5a0 [ 63.198632][ T5845] ? __pfx_bpf_trace_run4+0x10/0x10 [ 63.203801][ T5845] ? rcu_is_watching+0x12/0xc0 [ 63.208540][ T5845] ? __pfx_lock_release+0x10/0x10 [ 63.213539][ T5845] ? __pfx_sched_clock_cpu+0x10/0x10 [ 63.218799][ T5845] __bpf_trace_sched_switch+0x13e/0x190 [ 63.224317][ T5845] ? __pfx___bpf_trace_sched_switch+0x10/0x10 [ 63.230358][ T5845] ? psi_group_change+0x6dc/0xd20 [ 63.235357][ T5845] __traceiter_sched_switch+0x6c/0xc0 [ 63.240701][ T5845] __schedule+0x1b71/0x5ad0 [ 63.245180][ T5845] ? lock_acquire+0x2f/0xb0 [ 63.249654][ T5845] ? __wake_up_sync_key+0x1c/0x50 [ 63.254661][ T5845] ? trace_irq_enable.constprop.0+0xea/0x140 [ 63.260616][ T5845] ? __pfx___schedule+0x10/0x10 [ 63.265438][ T5845] ? lock_release+0x4e2/0x6f0 [ 63.270086][ T5845] ? schedule+0x298/0x350 [ 63.274388][ T5845] ? __pfx_lock_release+0x10/0x10 [ 63.279385][ T5845] ? schedule+0x1fd/0x350 [ 63.283688][ T5845] ? lock_acquire+0x2f/0xb0 [ 63.288170][ T5845] ? schedule+0x1fd/0x350 [ 63.292472][ T5845] schedule+0xe7/0x350 [ 63.296531][ T5845] ptrace_stop.part.0+0x440/0x940 [ 63.301547][ T5845] ptrace_do_notify+0x222/0x2d0 [ 63.306374][ T5845] ? __pfx_ptrace_do_notify+0x10/0x10 [ 63.311731][ T5845] ? rcu_is_watching+0x12/0xc0 [ 63.316469][ T5845] ? lock_acquire+0x2f/0xb0 [ 63.320946][ T5845] ? ptrace_notify+0xb1/0x130 [ 63.325595][ T5845] ptrace_notify+0xc5/0x130 [ 63.330070][ T5845] syscall_trace_enter+0xab/0x260 [ 63.335071][ T5845] do_syscall_64+0x1ee/0x250 [ 63.339636][ T5845] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 63.345504][ T5845] RIP: 0033:0x7fd4f256db49 [ 63.349892][ T5845] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 1b 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 63.369484][ T5845] RSP: 002b:00007ffebff53808 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 63.377867][ T5845] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd4f256db49 [ 63.385912][ T5845] RDX: 0000000020000a80 RSI: 000000000000890b RDI: 00000000ffffffff [ 63.393854][ T5845] RBP: 0000000000000001 R08: 00007ffebff535a7 R09: 0000000000000000 [pid 5845] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="sched_switch", prog_fd=3}}, 24 [pid 5843] close(7 [pid 5827] <... rmdir resumed>) = 0 [pid 5823] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5845] <... bpf resumed>) = 4 [pid 5843] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5845] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 5823] unlink("./1/binderfs" [pid 5843] close(8 [pid 5827] mkdir("./2", 0777 [pid 5843] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5827] <... mkdir resumed>) = 0 [pid 5823] <... unlink resumed>) = 0 [pid 5843] close(9 [pid 5823] getdents64(3, [pid 5843] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5823] <... getdents64 resumed>0x55556a2b46f0 /* 0 entries */, 32768) = 0 [pid 5843] close(10 [pid 5823] close(3 [pid 5843] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5843] close(11 [pid 5827] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5823] <... close resumed>) = 0 ./strace-static-x86_64: Process 5846 attached [pid 5845] <... openat resumed>) = 5 [pid 5843] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5823] rmdir("./1" [pid 5843] close(12 [pid 5827] <... clone resumed>, child_tidptr=0x55556a2b3650) = 4 [pid 5846] set_robust_list(0x55556a2b3660, 24 [pid 5844] close(3 [pid 5843] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5823] <... rmdir resumed>) = 0 [pid 5846] <... set_robust_list resumed>) = 0 [pid 5845] write(5, "3", 1 [pid 5844] <... close resumed>) = 0 [pid 5843] close(13 [pid 5846] chdir("./2" [pid 5845] <... write resumed>) = 1 [pid 5844] close(4 [pid 5843] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5823] mkdir("./2", 0777 [pid 5846] <... chdir resumed>) = 0 [pid 5845] ioctl(-1, SIOCADDRT, 0x20000a80 [pid 5844] <... close resumed>) = 0 [pid 5845] <... ioctl resumed>) = -1 EBADF (Bad file descriptor) [pid 5843] close(14 [pid 5846] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5844] close(5 [pid 5846] <... prctl resumed>) = 0 [pid 5845] close(3 [pid 5844] <... close resumed>) = 0 [pid 5843] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5845] <... close resumed>) = 0 [pid 5844] close(6 [pid 5843] close(15 [pid 5823] <... mkdir resumed>) = 0 [pid 5846] setpgid(0, 0 [pid 5844] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5844] close(7) = -1 EBADF (Bad file descriptor) [pid 5844] close(8) = -1 EBADF (Bad file descriptor) [pid 5844] close(9 [pid 5846] <... setpgid resumed>) = 0 [pid 5844] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5844] close(10 [pid 5843] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5823] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5844] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5844] close(11 [pid 5846] symlink("/syzcgroup/unified/syz2", "./cgroup" [pid 5844] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5843] close(16 [pid 5844] close(12) = -1 EBADF (Bad file descriptor) [pid 5844] close(13) = -1 EBADF (Bad file descriptor) [pid 5844] close(14) = -1 EBADF (Bad file descriptor) [pid 5844] close(15) = -1 EBADF (Bad file descriptor) [pid 5844] close(16) = -1 EBADF (Bad file descriptor) [pid 5844] close(17) = -1 EBADF (Bad file descriptor) ./strace-static-x86_64: Process 5847 attached [pid 5844] close(18 [pid 5843] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5847] set_robust_list(0x55556a2b3660, 24 [pid 5846] <... symlink resumed>) = 0 [pid 5844] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5843] close(17 [pid 5847] <... set_robust_list resumed>) = 0 [pid 5845] close(4 [pid 5823] <... clone resumed>, child_tidptr=0x55556a2b3650) = 4 [pid 5847] chdir("./2" [pid 5846] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu" [pid 5844] close(19 [pid 5843] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5847] <... chdir resumed>) = 0 [pid 5845] <... close resumed>) = 0 [pid 5844] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5847] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5844] close(20 [pid 5847] <... prctl resumed>) = 0 [pid 5846] <... symlink resumed>) = 0 [pid 5845] close(5 [pid 5844] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5843] close(18 [pid 5847] setpgid(0, 0 [pid 5844] close(21 [pid 5847] <... setpgid resumed>) = 0 [pid 5846] symlink("/syzcgroup/net/syz2", "./cgroup.net" [pid 5845] <... close resumed>) = 0 [pid 5844] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5843] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5847] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 5846] <... symlink resumed>) = 0 [pid 5845] close(6 [pid 5844] close(22 [pid 5843] close(19 [pid 5847] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu" [pid 5844] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5847] <... symlink resumed>) = 0 [pid 5846] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5845] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5844] close(23 [pid 5843] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5847] symlink("/syzcgroup/net/syz0", "./cgroup.net" [pid 5844] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5847] <... symlink resumed>) = 0 [pid 5846] <... openat resumed>) = 3 [pid 5845] close(7 [pid 5844] close(24 [pid 5843] close(20 [pid 5847] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5846] write(3, "1000", 4 [pid 5845] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5844] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5843] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5847] <... openat resumed>) = 3 [pid 5846] <... write resumed>) = 4 [pid 5845] close(8 [pid 5843] close(21 [pid 5847] write(3, "1000", 4 [pid 5845] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5844] close(25 [pid 5843] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5847] <... write resumed>) = 4 [pid 5845] close(9 [pid 5844] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5843] close(22 [pid 5847] close(3 [pid 5845] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5844] close(26 [pid 5843] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5847] <... close resumed>) = 0 [pid 5845] close(10 [pid 5844] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5843] close(23 [pid 5847] symlink("/dev/binderfs", "./binderfs" [pid 5845] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5844] close(27 [pid 5843] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5847] <... symlink resumed>) = 0 [pid 5846] close(3 [pid 5845] close(11 [pid 5843] close(24 [pid 5847] write(1, "executing program\n", 18executing program [pid 5845] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5844] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5843] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5847] <... write resumed>) = 18 [pid 5846] <... close resumed>) = 0 [pid 5845] close(12 [pid 5844] close(28 [pid 5843] close(25 [pid 5847] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=12, insns=0x20000180, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(4, 17, 0), prog_flags=BPF_F_TEST_RND_HI32, prog_name="", prog_ifindex=0, expected_attach_type=0x33 /* BPF_??? */, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 148 [pid 5846] symlink("/dev/binderfs", "./binderfs" [pid 5845] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5844] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5843] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5847] <... bpf resumed>) = 3 [pid 5845] close(13 [pid 5844] close(29 [pid 5843] close(26 [pid 5847] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="sched_switch", prog_fd=3}}, 24 [pid 5846] <... symlink resumed>) = 0 [pid 5845] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5844] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5843] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5847] <... bpf resumed>) = 4 executing program [pid 5846] write(1, "executing program\n", 18 [pid 5845] close(14 [pid 5844] exit_group(0 [pid 5843] close(27 [pid 5847] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 5846] <... write resumed>) = 18 [pid 5845] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5844] <... exit_group resumed>) = ? [pid 5843] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5847] <... openat resumed>) = 5 [pid 5846] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=12, insns=0x20000180, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(4, 17, 0), prog_flags=BPF_F_TEST_RND_HI32, prog_name="", prog_ifindex=0, expected_attach_type=0x33 /* BPF_??? */, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 148 [pid 5845] close(15 [pid 5844] +++ exited with 0 +++ [pid 5843] close(28 [pid 5845] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5843] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5847] write(5, "3", 1 [pid 5845] close(16 [pid 5843] close(29 [pid 5825] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5847] <... write resumed>) = 1 [pid 5845] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5843] <... close resumed>) = -1 EBADF (Bad file descriptor) [ 63.401799][ T5845] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 63.409742][ T5845] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 63.417740][ T5845] [ 63.439142][ T5847] FAULT_INJECTION: forcing a failure. [ 63.439142][ T5847] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 63.452185][ T5847] CPU: 1 UID: 0 PID: 5847 Comm: syz-executor388 Not tainted 6.13.0-rc7-syzkaller-00043-g619f0b6fad52 #0 [ 63.463265][ T5847] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 63.473298][ T5847] Call Trace: [ 63.476550][ T5847] [ 63.479455][ T5847] dump_stack_lvl+0x116/0x1f0 [ 63.484116][ T5847] should_fail_ex+0x497/0x5b0 [ 63.488787][ T5847] copy_to_user_nofault+0xac/0x180 [ 63.493880][ T5847] bpf_probe_write_user+0xaf/0xf0 [ 63.498911][ T5847] bpf_prog_6303d92f98284ad8+0x44/0x48 [ 63.504342][ T5847] bpf_trace_run4+0x245/0x5a0 [ 63.508994][ T5847] ? __pfx_bpf_trace_run4+0x10/0x10 [ 63.514165][ T5847] ? psi_task_switch+0x2c1/0x8e0 [ 63.519078][ T5847] ? __pfx_lock_release+0x10/0x10 [ 63.524107][ T5847] ? psi_task_switch+0x2c1/0x8e0 [ 63.529029][ T5847] ? lock_acquire+0x2f/0xb0 [ 63.533515][ T5847] ? psi_task_switch+0x2c1/0x8e0 [ 63.538428][ T5847] __bpf_trace_sched_switch+0x13e/0x190 [ 63.543967][ T5847] ? __pfx___bpf_trace_sched_switch+0x10/0x10 [ 63.550038][ T5847] ? psi_task_switch+0x2c1/0x8e0 [ 63.554957][ T5847] __schedule+0x1b71/0x5ad0 [ 63.559441][ T5847] ? lock_acquire+0x2f/0xb0 [ 63.563922][ T5847] ? __wake_up_sync_key+0x1c/0x50 [ 63.568919][ T5847] ? trace_irq_enable.constprop.0+0xea/0x140 [ 63.574875][ T5847] ? __pfx___schedule+0x10/0x10 [ 63.579700][ T5847] ? lock_release+0x4e2/0x6f0 [ 63.584350][ T5847] ? schedule+0x298/0x350 [ 63.588658][ T5847] ? __pfx_lock_release+0x10/0x10 [ 63.593678][ T5847] ? schedule+0x1fd/0x350 [ 63.597985][ T5847] ? lock_acquire+0x2f/0xb0 [ 63.602472][ T5847] ? schedule+0x1fd/0x350 [ 63.606790][ T5847] schedule+0xe7/0x350 [ 63.610846][ T5847] ptrace_stop.part.0+0x440/0x940 [ 63.615866][ T5847] ptrace_do_notify+0x222/0x2d0 [ 63.620797][ T5847] ? __pfx_ptrace_do_notify+0x10/0x10 [ 63.626166][ T5847] ? rcu_is_watching+0x12/0xc0 [ 63.630918][ T5847] ? lock_acquire+0x2f/0xb0 [ 63.635399][ T5847] ? ptrace_notify+0xb1/0x130 [ 63.640056][ T5847] ptrace_notify+0xc5/0x130 [ 63.644545][ T5847] syscall_exit_to_user_mode_prepare+0x126/0x290 [ 63.650852][ T5847] syscall_exit_to_user_mode+0x11/0x2a0 [ 63.656378][ T5847] do_syscall_64+0xda/0x250 [ 63.660864][ T5847] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 63.666753][ T5847] RIP: 0033:0x7fd4f256db49 [ 63.671144][ T5847] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 1b 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 63.690747][ T5847] RSP: 002b:00007ffebff53808 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [pid 5847] ioctl(-1, SIOCADDRT, 0x20000a80 [pid 5845] close(17 [pid 5847] <... ioctl resumed>) = -1 EBADF (Bad file descriptor) [pid 5846] <... bpf resumed>) = 3 [pid 5845] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5843] exit_group(0 [pid 5847] close(3 [pid 5845] close(18 [pid 5843] <... exit_group resumed>) = ? [pid 5847] <... close resumed>) = 0 [pid 5847] close(4 [pid 5825] umount2("./1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5847] <... close resumed>) = 0 [pid 5825] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5847] close(5 [pid 5825] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5847] <... close resumed>) = 0 [pid 5843] +++ exited with 0 +++ [pid 5825] <... openat resumed>) = 3 [pid 5847] close(6 [pid 5845] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5828] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5825] newfstatat(3, "", [pid 5847] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5846] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="sched_switch", prog_fd=3}}, 24 [pid 5845] close(19 [pid 5828] restart_syscall(<... resuming interrupted clone ...> [pid 5825] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=120, ...}, AT_EMPTY_PATH) = 0 [pid 5847] close(7 [pid 5845] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5825] getdents64(3, [pid 5847] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5845] close(20 [pid 5825] <... getdents64 resumed>0x55556a2b46f0 /* 6 entries */, 32768) = 176 [pid 5847] close(8 [pid 5845] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5825] umount2("./1/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5847] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5845] close(21 [pid 5825] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5847] close(9 [pid 5845] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5825] newfstatat(AT_FDCWD, "./1/cgroup", [pid 5847] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5846] <... bpf resumed>) = 4 [pid 5845] close(22 [pid 5825] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5847] close(10 [pid 5845] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5825] unlink("./1/cgroup" [pid 5847] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5846] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 5845] close(23 [pid 5825] <... unlink resumed>) = 0 [pid 5847] close(11 [pid 5845] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5825] umount2("./1/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5847] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5845] close(24 [pid 5825] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5847] close(12 [pid 5845] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5825] newfstatat(AT_FDCWD, "./1/cgroup.cpu", [pid 5847] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5845] close(25 [pid 5825] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [ 63.699154][ T5847] RAX: fffffffffffffff7 RBX: 0000000000000003 RCX: 00007fd4f256db49 [ 63.707102][ T5847] RDX: 0000000020000a80 RSI: 000000000000890b RDI: 00000000ffffffff [ 63.715067][ T5847] RBP: 0000000000000001 R08: 00007ffebff535a7 R09: 0000000000000000 [ 63.723013][ T5847] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 63.730956][ T5847] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 63.738904][ T5847] [ 63.749468][ T5846] FAULT_INJECTION: forcing a failure. [ 63.749468][ T5846] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 63.762498][ T5846] CPU: 0 UID: 0 PID: 5846 Comm: syz-executor388 Not tainted 6.13.0-rc7-syzkaller-00043-g619f0b6fad52 #0 [ 63.773577][ T5846] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 63.783605][ T5846] Call Trace: [ 63.786862][ T5846] [ 63.789768][ T5846] dump_stack_lvl+0x116/0x1f0 [ 63.794424][ T5846] should_fail_ex+0x497/0x5b0 [ 63.799081][ T5846] copy_to_user_nofault+0xac/0x180 [ 63.804164][ T5846] bpf_probe_write_user+0xaf/0xf0 [ 63.809167][ T5846] bpf_prog_6303d92f98284ad8+0x44/0x48 [ 63.814597][ T5846] bpf_trace_run4+0x245/0x5a0 [ 63.819245][ T5846] ? __pfx_bpf_trace_run4+0x10/0x10 [ 63.824417][ T5846] ? psi_task_switch+0x2c1/0x8e0 [ 63.829329][ T5846] ? __pfx_lock_release+0x10/0x10 [ 63.834328][ T5846] ? psi_task_switch+0x2c1/0x8e0 [ 63.839234][ T5846] ? lock_acquire+0x2f/0xb0 [ 63.843709][ T5846] ? psi_task_switch+0x2c1/0x8e0 [ 63.848628][ T5846] __bpf_trace_sched_switch+0x13e/0x190 [ 63.854147][ T5846] ? __pfx___bpf_trace_sched_switch+0x10/0x10 [ 63.860191][ T5846] ? psi_task_switch+0x2c1/0x8e0 [ 63.865100][ T5846] __schedule+0x1b71/0x5ad0 [ 63.869581][ T5846] ? lock_acquire+0x2f/0xb0 [ 63.874058][ T5846] ? __wake_up_sync_key+0x1c/0x50 [ 63.879057][ T5846] ? trace_irq_enable.constprop.0+0xea/0x140 [ 63.885025][ T5846] ? __pfx___schedule+0x10/0x10 [ 63.889860][ T5846] ? lock_release+0x4e2/0x6f0 [ 63.894517][ T5846] ? schedule+0x298/0x350 [ 63.898818][ T5846] ? __pfx_lock_release+0x10/0x10 [ 63.903827][ T5846] ? schedule+0x1fd/0x350 [ 63.908127][ T5846] ? lock_acquire+0x2f/0xb0 [ 63.912607][ T5846] ? schedule+0x1fd/0x350 [ 63.916909][ T5846] schedule+0xe7/0x350 [ 63.920951][ T5846] ptrace_stop.part.0+0x440/0x940 [ 63.925952][ T5846] ptrace_do_notify+0x222/0x2d0 [ 63.930776][ T5846] ? __pfx_ptrace_do_notify+0x10/0x10 [ 63.936120][ T5846] ? rcu_is_watching+0x12/0xc0 [ 63.940860][ T5846] ? lock_acquire+0x2f/0xb0 [ 63.945334][ T5846] ? ptrace_notify+0xb1/0x130 [ 63.950000][ T5846] ptrace_notify+0xc5/0x130 [ 63.954480][ T5846] syscall_exit_to_user_mode_prepare+0x126/0x290 [ 63.960784][ T5846] syscall_exit_to_user_mode+0x11/0x2a0 [ 63.966306][ T5846] do_syscall_64+0xda/0x250 [ 63.970786][ T5846] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 63.976654][ T5846] RIP: 0033:0x7fd4f256db49 [ 63.981039][ T5846] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 1b 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [pid 5847] close(13 [pid 5846] <... openat resumed>) = 5 [pid 5845] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5825] unlink("./1/cgroup.cpu" [pid 5847] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5846] write(5, "3", 1 [pid 5845] close(26 [pid 5825] <... unlink resumed>) = 0 [pid 5847] close(14 [pid 5846] <... write resumed>) = 1 [pid 5845] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5825] umount2("./1/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5847] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5846] ioctl(-1, SIOCADDRT, 0x20000a80 [pid 5845] close(27 [pid 5825] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5847] close(15 [pid 5846] <... ioctl resumed>) = -1 EBADF (Bad file descriptor) [pid 5845] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5825] newfstatat(AT_FDCWD, "./1/cgroup.net", [pid 5847] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5846] close(3 [pid 5845] close(28 [pid 5828] <... restart_syscall resumed>) = 0 [pid 5825] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5847] close(16 [pid 5846] <... close resumed>) = 0 [pid 5845] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5825] unlink("./1/cgroup.net" [pid 5847] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5846] close(4 [pid 5845] close(29 [pid 5825] <... unlink resumed>) = 0 [pid 5847] close(17 [pid 5846] <... close resumed>) = 0 [pid 5845] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5828] umount2("./1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5825] umount2("./1/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5847] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5846] close(5 [pid 5845] exit_group(0 [pid 5828] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5825] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5847] close(18 [pid 5846] <... close resumed>) = 0 [pid 5845] <... exit_group resumed>) = ? [pid 5828] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5825] newfstatat(AT_FDCWD, "./1/binderfs", [pid 5847] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5846] close(6 [pid 5828] <... openat resumed>) = 3 [pid 5825] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5847] close(19 [pid 5828] newfstatat(3, "", [pid 5825] unlink("./1/binderfs" [pid 5847] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5828] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=120, ...}, AT_EMPTY_PATH) = 0 [pid 5825] <... unlink resumed>) = 0 [pid 5847] close(20 [pid 5845] +++ exited with 0 +++ [pid 5828] getdents64(3, [pid 5825] getdents64(3, [pid 5847] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5846] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5828] <... getdents64 resumed>0x55556a2b46f0 /* 6 entries */, 32768) = 176 [pid 5825] <... getdents64 resumed>0x55556a2b46f0 /* 0 entries */, 32768) = 0 [pid 5847] close(21 [pid 5846] close(7 [pid 5829] restart_syscall(<... resuming interrupted clone ...> [pid 5828] umount2("./1/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5825] close(3 [pid 5847] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5846] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5828] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5825] <... close resumed>) = 0 [pid 5847] close(22 [pid 5846] close(8 [pid 5828] newfstatat(AT_FDCWD, "./1/cgroup", [pid 5825] rmdir("./1" [pid 5847] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5846] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5828] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5825] <... rmdir resumed>) = 0 [pid 5847] close(23 [pid 5846] close(9 [pid 5828] unlink("./1/cgroup" [pid 5825] mkdir("./2", 0777 [pid 5847] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5846] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5828] <... unlink resumed>) = 0 [pid 5825] <... mkdir resumed>) = 0 [pid 5847] close(24 [pid 5846] close(10 [pid 5828] umount2("./1/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5825] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5847] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5846] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5828] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5848 attached [pid 5847] close(25 [pid 5846] close(11 [pid 5828] newfstatat(AT_FDCWD, "./1/cgroup.cpu", [pid 5825] <... clone resumed>, child_tidptr=0x55556a2b3650) = 4 [pid 5848] set_robust_list(0x55556a2b3660, 24 [pid 5847] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5846] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5828] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5848] <... set_robust_list resumed>) = 0 [pid 5847] close(26 [pid 5846] close(12 [pid 5828] unlink("./1/cgroup.cpu" [pid 5848] chdir("./2" [pid 5847] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5846] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5828] <... unlink resumed>) = 0 [pid 5848] <... chdir resumed>) = 0 [pid 5847] close(27 [pid 5846] close(13 [pid 5828] umount2("./1/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5848] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5847] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5846] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5828] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5848] <... prctl resumed>) = 0 [pid 5847] close(28 [pid 5846] close(14 [pid 5828] newfstatat(AT_FDCWD, "./1/cgroup.net", [pid 5848] setpgid(0, 0 [pid 5847] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5846] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... restart_syscall resumed>) = 0 [pid 5828] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5848] <... setpgid resumed>) = 0 [pid 5847] close(29 [pid 5846] close(15 [pid 5828] unlink("./1/cgroup.net" [pid 5848] symlink("/syzcgroup/unified/syz1", "./cgroup" [pid 5847] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5846] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5828] <... unlink resumed>) = 0 [pid 5848] <... symlink resumed>) = 0 [pid 5847] exit_group(0 [pid 5846] close(16 [pid 5829] umount2("./1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5828] umount2("./1/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5848] symlink("/syzcgroup/cpu/syz1", "./cgroup.cpu" [pid 5847] <... exit_group resumed>) = ? [pid 5846] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5828] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5848] <... symlink resumed>) = 0 [pid 5847] +++ exited with 0 +++ [pid 5846] close(17 [pid 5829] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5828] newfstatat(AT_FDCWD, "./1/binderfs", [pid 5848] symlink("/syzcgroup/net/syz1", "./cgroup.net" [pid 5846] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... openat resumed>) = 3 [pid 5828] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5846] close(18 [pid 5829] newfstatat(3, "", [pid 5828] unlink("./1/binderfs" [pid 5846] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=120, ...}, AT_EMPTY_PATH) = 0 [pid 5828] <... unlink resumed>) = 0 [pid 5848] <... symlink resumed>) = 0 [pid 5846] close(19 [pid 5829] getdents64(3, [pid 5828] getdents64(3, [pid 5823] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5848] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5846] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... getdents64 resumed>0x55556a2b46f0 /* 6 entries */, 32768) = 176 [pid 5828] <... getdents64 resumed>0x55556a2b46f0 /* 0 entries */, 32768) = 0 [pid 5823] restart_syscall(<... resuming interrupted clone ...> [pid 5846] close(20 [pid 5829] umount2("./1/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5828] close(3 [pid 5848] <... openat resumed>) = 3 [pid 5846] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5828] <... close resumed>) = 0 [pid 5848] write(3, "1000", 4 [pid 5829] newfstatat(AT_FDCWD, "./1/cgroup", [pid 5828] rmdir("./1" [pid 5823] <... restart_syscall resumed>) = 0 [pid 5848] <... write resumed>) = 4 [pid 5846] close(21 [pid 5829] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5828] <... rmdir resumed>) = 0 [pid 5848] close(3 [pid 5846] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] unlink("./1/cgroup" [pid 5828] mkdir("./2", 0777 [pid 5848] <... close resumed>) = 0 [pid 5846] close(22 [pid 5829] <... unlink resumed>) = 0 [pid 5828] <... mkdir resumed>) = 0 [pid 5848] symlink("/dev/binderfs", "./binderfs" [pid 5829] umount2("./1/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5828] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5848] <... symlink resumed>) = 0 [pid 5846] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5849 attached [pid 5848] write(1, "executing program\n", 18 [pid 5846] close(23 [pid 5829] newfstatat(AT_FDCWD, "./1/cgroup.cpu", executing program [pid 5849] set_robust_list(0x55556a2b3660, 24 [pid 5848] <... write resumed>) = 18 [pid 5846] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5823] umount2("./2", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5849] <... set_robust_list resumed>) = 0 [pid 5848] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=12, insns=0x20000180, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(4, 17, 0), prog_flags=BPF_F_TEST_RND_HI32, prog_name="", prog_ifindex=0, expected_attach_type=0x33 /* BPF_??? */, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 148 [pid 5846] close(24 [pid 5829] unlink("./1/cgroup.cpu" [pid 5849] chdir("./2" [pid 5846] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... unlink resumed>) = 0 [pid 5828] <... clone resumed>, child_tidptr=0x55556a2b3650) = 4 [pid 5823] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5849] <... chdir resumed>) = 0 [pid 5846] close(25 [pid 5829] umount2("./1/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 64.000624][ T5846] RSP: 002b:00007ffebff53808 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 64.009006][ T5846] RAX: fffffffffffffff7 RBX: 0000000000000003 RCX: 00007fd4f256db49 [ 64.016947][ T5846] RDX: 0000000020000a80 RSI: 000000000000890b RDI: 00000000ffffffff [ 64.024893][ T5846] RBP: 0000000000000001 R08: 00007ffebff535a7 R09: 0000000000000000 [ 64.032837][ T5846] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 64.040787][ T5846] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 64.048734][ T5846] [pid 5829] newfstatat(AT_FDCWD, "./1/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5829] unlink("./1/cgroup.net") = 0 [pid 5829] umount2("./1/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5829] newfstatat(AT_FDCWD, "./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5829] unlink("./1/binderfs") = 0 [pid 5829] getdents64(3, [pid 5849] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5846] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5823] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5846] close(26 [pid 5829] <... getdents64 resumed>0x55556a2b46f0 /* 0 entries */, 32768) = 0 [pid 5823] <... openat resumed>) = 3 [pid 5846] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] close(3 [pid 5823] newfstatat(3, "", [pid 5846] close(27 [pid 5829] <... close resumed>) = 0 [pid 5823] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=120, ...}, AT_EMPTY_PATH) = 0 [pid 5846] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] rmdir("./1" [pid 5823] getdents64(3, [pid 5846] close(28 [pid 5829] <... rmdir resumed>) = 0 [pid 5823] <... getdents64 resumed>0x55556a2b46f0 /* 6 entries */, 32768) = 176 [pid 5846] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5823] umount2("./2/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5846] close(29 [pid 5829] mkdir("./2", 0777 [pid 5823] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5846] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... mkdir resumed>) = 0 [pid 5846] exit_group(0) = ? [pid 5829] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5823] newfstatat(AT_FDCWD, "./2/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5823] unlink("./2/cgroup") = 0 [pid 5823] umount2("./2/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5823] newfstatat(AT_FDCWD, "./2/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5823] unlink("./2/cgroup.cpu") = 0 [pid 5823] umount2("./2/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5823] newfstatat(AT_FDCWD, "./2/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 ./strace-static-x86_64: Process 5850 attached [pid 5850] set_robust_list(0x55556a2b3660, 24 [pid 5849] <... prctl resumed>) = 0 [pid 5846] +++ exited with 0 +++ [pid 5829] <... clone resumed>, child_tidptr=0x55556a2b3650) = 4 [pid 5823] unlink("./2/cgroup.net" [pid 5850] <... set_robust_list resumed>) = 0 [pid 5823] <... unlink resumed>) = 0 [pid 5850] chdir("./2" [pid 5823] umount2("./2/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5850] <... chdir resumed>) = 0 [pid 5823] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5850] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5823] newfstatat(AT_FDCWD, "./2/binderfs", [pid 5850] <... prctl resumed>) = 0 [pid 5823] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5850] setpgid(0, 0) = 0 [pid 5823] unlink("./2/binderfs") = 0 [pid 5850] symlink("/syzcgroup/unified/syz3", "./cgroup" [pid 5849] setpgid(0, 0 [pid 5848] <... bpf resumed>) = 3 [pid 5827] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5823] getdents64(3, [pid 5850] <... symlink resumed>) = 0 [pid 5849] <... setpgid resumed>) = 0 [pid 5848] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="sched_switch", prog_fd=3}}, 24 [pid 5823] <... getdents64 resumed>0x55556a2b46f0 /* 0 entries */, 32768) = 0 [pid 5850] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu" [pid 5823] close(3 [pid 5850] <... symlink resumed>) = 0 [pid 5849] symlink("/syzcgroup/unified/syz4", "./cgroup" [pid 5848] <... bpf resumed>) = 4 [pid 5850] symlink("/syzcgroup/net/syz3", "./cgroup.net" [pid 5848] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 5827] umount2("./2", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5823] <... close resumed>) = 0 [pid 5850] <... symlink resumed>) = 0 [pid 5849] <... symlink resumed>) = 0 [pid 5827] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5827] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5823] rmdir("./2" [pid 5849] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu" [pid 5827] <... openat resumed>) = 3 [pid 5823] <... rmdir resumed>) = 0 [pid 5849] <... symlink resumed>) = 0 [pid 5827] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=120, ...}, AT_EMPTY_PATH) = 0 [pid 5849] symlink("/syzcgroup/net/syz4", "./cgroup.net" [pid 5827] getdents64(3, [pid 5823] mkdir("./3", 0777 [pid 5849] <... symlink resumed>) = 0 [pid 5850] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5849] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5848] <... openat resumed>) = 5 [pid 5827] <... getdents64 resumed>0x55556a2b46f0 /* 6 entries */, 32768) = 176 [pid 5823] <... mkdir resumed>) = 0 [pid 5850] <... openat resumed>) = 3 [pid 5823] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5849] <... openat resumed>) = 3 [ 64.087384][ T5848] bpf_get_probe_write_proto: 26 callbacks suppressed [ 64.087401][ T5848] syz-executor388[5848] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 64.094507][ T5848] syz-executor388[5848] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 64.106816][ T5848] syz-executor388[5848] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 64.132298][ T5848] FAULT_INJECTION: forcing a failure. [ 64.132298][ T5848] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 64.157005][ T5848] CPU: 0 UID: 0 PID: 5848 Comm: syz-executor388 Not tainted 6.13.0-rc7-syzkaller-00043-g619f0b6fad52 #0 [ 64.168085][ T5848] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 64.178126][ T5848] Call Trace: [ 64.181380][ T5848] [ 64.184289][ T5848] dump_stack_lvl+0x116/0x1f0 [ 64.188962][ T5848] should_fail_ex+0x497/0x5b0 [ 64.193625][ T5848] copy_to_user_nofault+0xac/0x180 [ 64.198723][ T5848] bpf_probe_write_user+0xaf/0xf0 [ 64.203726][ T5848] bpf_prog_6303d92f98284ad8+0x44/0x48 [ 64.209157][ T5848] bpf_trace_run4+0x245/0x5a0 [ 64.213809][ T5848] ? __pfx_bpf_trace_run4+0x10/0x10 [ 64.218979][ T5848] ? psi_task_switch+0x2c1/0x8e0 [ 64.223894][ T5848] ? __pfx_lock_release+0x10/0x10 [ 64.228895][ T5848] ? psi_task_switch+0x2c1/0x8e0 [ 64.233803][ T5848] ? lock_acquire+0x2f/0xb0 [ 64.238279][ T5848] ? psi_task_switch+0x2c1/0x8e0 [ 64.243187][ T5848] __bpf_trace_sched_switch+0x13e/0x190 [ 64.248708][ T5848] ? __pfx___bpf_trace_sched_switch+0x10/0x10 [ 64.254747][ T5848] ? psi_task_switch+0x2c1/0x8e0 [ 64.259655][ T5848] __schedule+0x1b71/0x5ad0 [ 64.264133][ T5848] ? trace_irq_enable.constprop.0+0xea/0x140 [ 64.270090][ T5848] ? __pfx___schedule+0x10/0x10 [ 64.274921][ T5848] ? lock_release+0x4e2/0x6f0 [ 64.279568][ T5848] ? schedule+0x298/0x350 [ 64.283871][ T5848] ? __pfx_lock_release+0x10/0x10 [ 64.288879][ T5848] ? schedule+0x1fd/0x350 [ 64.293183][ T5848] ? lock_acquire+0x2f/0xb0 [ 64.297657][ T5848] ? schedule+0x1fd/0x350 [ 64.301965][ T5848] schedule+0xe7/0x350 [ 64.306007][ T5848] ptrace_stop.part.0+0x440/0x940 [ 64.311019][ T5848] ptrace_do_notify+0x222/0x2d0 [ 64.315847][ T5848] ? __pfx_ptrace_do_notify+0x10/0x10 [ 64.321197][ T5848] ? rcu_is_watching+0x12/0xc0 [ 64.325939][ T5848] ? lock_acquire+0x2f/0xb0 [ 64.330413][ T5848] ? ptrace_notify+0xb1/0x130 [ 64.335074][ T5848] ptrace_notify+0xc5/0x130 [ 64.339553][ T5848] syscall_exit_to_user_mode_prepare+0x126/0x290 [ 64.345867][ T5848] syscall_exit_to_user_mode+0x11/0x2a0 [ 64.351394][ T5848] do_syscall_64+0xda/0x250 [ 64.355887][ T5848] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 64.361760][ T5848] RIP: 0033:0x7fd4f256db49 [ 64.366144][ T5848] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 1b 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [pid 5848] write(5, "3", 1 [pid 5827] umount2("./2/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5851 attached [pid 5850] write(3, "1000", 4 [pid 5849] write(3, "1000", 4 [pid 5848] <... write resumed>) = 1 [pid 5827] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5848] ioctl(-1, SIOCADDRT, 0x20000a80 [pid 5851] set_robust_list(0x55556a2b3660, 24 [pid 5849] <... write resumed>) = 4 [pid 5848] <... ioctl resumed>) = -1 EBADF (Bad file descriptor) [pid 5827] newfstatat(AT_FDCWD, "./2/cgroup", [pid 5851] <... set_robust_list resumed>) = 0 [pid 5850] <... write resumed>) = 4 [pid 5823] <... clone resumed>, child_tidptr=0x55556a2b3650) = 5 [pid 5850] close(3 [pid 5827] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5851] chdir("./3" [pid 5850] <... close resumed>) = 0 [pid 5851] <... chdir resumed>) = 0 [pid 5850] symlink("/dev/binderfs", "./binderfs"executing program [pid 5827] unlink("./2/cgroup" [pid 5851] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5850] <... symlink resumed>) = 0 [pid 5849] close(3 [pid 5848] close(3 [pid 5850] write(1, "executing program\n", 18 [pid 5851] <... prctl resumed>) = 0 [pid 5850] <... write resumed>) = 18 [pid 5848] <... close resumed>) = 0 [pid 5827] <... unlink resumed>) = 0 [pid 5851] setpgid(0, 0 [ 64.385723][ T5848] RSP: 002b:00007ffebff53808 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 64.394108][ T5848] RAX: fffffffffffffff7 RBX: 0000000000000003 RCX: 00007fd4f256db49 [ 64.402049][ T5848] RDX: 0000000020000a80 RSI: 000000000000890b RDI: 00000000ffffffff [ 64.409988][ T5848] RBP: 0000000000000001 R08: 00007ffebff535a7 R09: 0000000000000000 [ 64.417932][ T5848] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 64.425878][ T5848] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 64.433825][ T5848] [pid 5850] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=12, insns=0x20000180, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(4, 17, 0), prog_flags=BPF_F_TEST_RND_HI32, prog_name="", prog_ifindex=0, expected_attach_type=0x33 /* BPF_??? */, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 148 [pid 5849] <... close resumed>) = 0 [pid 5851] <... setpgid resumed>) = 0 [pid 5849] symlink("/dev/binderfs", "./binderfs" [pid 5848] close(4 [pid 5827] umount2("./2/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5851] symlink("/syzcgroup/unified/syz0", "./cgroup" [pid 5849] <... symlink resumed>) = 0 [pid 5848] <... close resumed>) = 0 executing program [pid 5851] <... symlink resumed>) = 0 [pid 5849] write(1, "executing program\n", 18 [pid 5848] close(5 [pid 5827] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5848] <... close resumed>) = 0 [pid 5848] close(6) = -1 EBADF (Bad file descriptor) [pid 5850] <... bpf resumed>) = 3 [pid 5848] close(7 [pid 5851] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu" [pid 5850] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="sched_switch", prog_fd=3}}, 24 [pid 5849] <... write resumed>) = 18 [pid 5848] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5827] newfstatat(AT_FDCWD, "./2/cgroup.cpu", [pid 5851] <... symlink resumed>) = 0 [pid 5849] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=12, insns=0x20000180, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(4, 17, 0), prog_flags=BPF_F_TEST_RND_HI32, prog_name="", prog_ifindex=0, expected_attach_type=0x33 /* BPF_??? */, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 148 [pid 5848] close(8 [pid 5827] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5848] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5851] symlink("/syzcgroup/net/syz0", "./cgroup.net" [pid 5850] <... bpf resumed>) = 4 [pid 5848] close(9 [pid 5827] unlink("./2/cgroup.cpu" [pid 5851] <... symlink resumed>) = 0 [ 64.441101][ T5850] syz-executor388[5850] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 64.441171][ T5850] syz-executor388[5850] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 64.453066][ T5850] syz-executor388[5850] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 64.467652][ T5849] syz-executor388[5849] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [pid 5850] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 5848] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5827] <... unlink resumed>) = 0 [pid 5851] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5850] <... openat resumed>) = 5 [pid 5851] <... openat resumed>) = 3 [pid 5848] close(10 [pid 5827] umount2("./2/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5851] write(3, "1000", 4 [pid 5850] write(5, "3", 1 [pid 5848] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5827] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5851] <... write resumed>) = 4 [pid 5850] <... write resumed>) = 1 [pid 5848] close(11 [pid 5827] newfstatat(AT_FDCWD, "./2/cgroup.net", [pid 5851] close(3 [pid 5850] ioctl(-1, SIOCADDRT, 0x20000a80 [ 64.479938][ T5849] syz-executor388[5849] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 64.491841][ T5849] syz-executor388[5849] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 64.500066][ T5850] FAULT_INJECTION: forcing a failure. [ 64.500066][ T5850] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 64.528231][ T5850] CPU: 1 UID: 0 PID: 5850 Comm: syz-executor388 Not tainted 6.13.0-rc7-syzkaller-00043-g619f0b6fad52 #0 [ 64.539310][ T5850] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 64.549336][ T5850] Call Trace: [ 64.552592][ T5850] [ 64.555501][ T5850] dump_stack_lvl+0x116/0x1f0 [ 64.560253][ T5850] should_fail_ex+0x497/0x5b0 [ 64.564910][ T5850] copy_to_user_nofault+0xac/0x180 [ 64.569996][ T5850] bpf_probe_write_user+0xaf/0xf0 [ 64.574998][ T5850] bpf_prog_6303d92f98284ad8+0x44/0x48 [ 64.580425][ T5850] bpf_trace_run4+0x245/0x5a0 [ 64.585072][ T5850] ? __pfx_bpf_trace_run4+0x10/0x10 [ 64.590242][ T5850] ? psi_task_switch+0x2c1/0x8e0 [ 64.595153][ T5850] ? __pfx_lock_release+0x10/0x10 [ 64.600152][ T5850] ? psi_task_switch+0x2c1/0x8e0 [ 64.605062][ T5850] ? lock_acquire+0x2f/0xb0 [ 64.609549][ T5850] ? psi_task_switch+0x2c1/0x8e0 [ 64.614460][ T5850] __bpf_trace_sched_switch+0x13e/0x190 [ 64.619980][ T5850] ? __pfx___bpf_trace_sched_switch+0x10/0x10 [ 64.626021][ T5850] ? psi_task_switch+0x2c1/0x8e0 [ 64.630930][ T5850] __schedule+0x1b71/0x5ad0 [ 64.635416][ T5850] ? lock_acquire+0x2f/0xb0 [ 64.639903][ T5850] ? __wake_up_sync_key+0x1c/0x50 [ 64.644929][ T5850] ? trace_irq_enable.constprop.0+0xea/0x140 [ 64.650916][ T5850] ? __pfx___schedule+0x10/0x10 [ 64.655749][ T5850] ? lock_release+0x4e2/0x6f0 [ 64.660402][ T5850] ? schedule+0x298/0x350 [ 64.664793][ T5850] ? __pfx_lock_release+0x10/0x10 [ 64.669791][ T5850] ? schedule+0x1fd/0x350 [ 64.674095][ T5850] ? lock_acquire+0x2f/0xb0 [ 64.678573][ T5850] ? schedule+0x1fd/0x350 [ 64.682891][ T5850] schedule+0xe7/0x350 [ 64.686935][ T5850] ptrace_stop.part.0+0x440/0x940 [ 64.691954][ T5850] ptrace_do_notify+0x222/0x2d0 [ 64.696797][ T5850] ? __pfx_ptrace_do_notify+0x10/0x10 [ 64.702151][ T5850] ? rcu_is_watching+0x12/0xc0 [ 64.706907][ T5850] ? lock_acquire+0x2f/0xb0 [ 64.711387][ T5850] ? ptrace_notify+0xb1/0x130 [ 64.716041][ T5850] ptrace_notify+0xc5/0x130 [ 64.720519][ T5850] syscall_exit_to_user_mode_prepare+0x126/0x290 [ 64.726840][ T5850] syscall_exit_to_user_mode+0x11/0x2a0 [ 64.732365][ T5850] do_syscall_64+0xda/0x250 [ 64.736847][ T5850] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 64.742718][ T5850] RIP: 0033:0x7fd4f256db49 [ 64.747120][ T5850] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 1b 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 64.766705][ T5850] RSP: 002b:00007ffebff53808 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 64.775094][ T5850] RAX: fffffffffffffff7 RBX: 0000000000000003 RCX: 00007fd4f256db49 [ 64.783040][ T5850] RDX: 0000000020000a80 RSI: 000000000000890b RDI: 00000000ffffffff [pid 5848] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5851] <... close resumed>) = 0 [pid 5850] <... ioctl resumed>) = -1 EBADF (Bad file descriptor) [pid 5849] <... bpf resumed>) = 3 [pid 5848] close(12 [pid 5827] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5851] symlink("/dev/binderfs", "./binderfs" [pid 5850] close(3 [pid 5848] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5827] unlink("./2/cgroup.net" [pid 5851] <... symlink resumed>) = 0 [pid 5850] <... close resumed>) = 0 [pid 5849] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="sched_switch", prog_fd=3}}, 24 [pid 5848] close(13 [pid 5851] write(1, "executing program\n", 18executing program [pid 5850] close(4 [pid 5849] <... bpf resumed>) = 4 [pid 5848] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5851] <... write resumed>) = 18 [pid 5850] <... close resumed>) = 0 [pid 5849] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 5848] close(14 [pid 5851] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=12, insns=0x20000180, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(4, 17, 0), prog_flags=BPF_F_TEST_RND_HI32, prog_name="", prog_ifindex=0, expected_attach_type=0x33 /* BPF_??? */, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 148 [pid 5850] close(5 [pid 5848] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5851] <... bpf resumed>) = 3 [pid 5850] <... close resumed>) = 0 [pid 5849] <... openat resumed>) = 5 [pid 5848] close(15 [pid 5851] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="sched_switch", prog_fd=3}}, 24 [pid 5850] close(6 [pid 5848] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5851] <... bpf resumed>) = 4 [pid 5850] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5849] write(5, "3", 1 [pid 5848] close(16 [pid 5851] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 5850] close(7 [pid 5849] <... write resumed>) = 1 [pid 5848] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5851] <... openat resumed>) = 5 [pid 5850] <... close resumed>) = -1 EBADF (Bad file descriptor) [ 64.791074][ T5850] RBP: 0000000000000001 R08: 00007ffebff535a7 R09: 0000000000000000 [ 64.799020][ T5850] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 64.806979][ T5850] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 64.814929][ T5850] [ 64.824954][ T5851] syz-executor388[5851] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 64.827724][ T5849] FAULT_INJECTION: forcing a failure. [ 64.827724][ T5849] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 64.852468][ T5849] CPU: 0 UID: 0 PID: 5849 Comm: syz-executor388 Not tainted 6.13.0-rc7-syzkaller-00043-g619f0b6fad52 #0 [ 64.863576][ T5849] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 64.873622][ T5849] Call Trace: [ 64.876893][ T5849] [ 64.879818][ T5849] dump_stack_lvl+0x116/0x1f0 [ 64.884509][ T5849] should_fail_ex+0x497/0x5b0 [ 64.889190][ T5849] copy_to_user_nofault+0xac/0x180 [ 64.894302][ T5849] bpf_probe_write_user+0xaf/0xf0 [ 64.899330][ T5849] bpf_prog_6303d92f98284ad8+0x44/0x48 [ 64.904779][ T5849] bpf_trace_run4+0x245/0x5a0 [ 64.909458][ T5849] ? __pfx_bpf_trace_run4+0x10/0x10 [ 64.914659][ T5849] ? rcu_is_watching+0x12/0xc0 [ 64.919426][ T5849] ? __pfx_lock_release+0x10/0x10 [ 64.924444][ T5849] ? __pfx_sched_clock_cpu+0x10/0x10 [ 64.929718][ T5849] __bpf_trace_sched_switch+0x13e/0x190 [ 64.935267][ T5849] ? __pfx___bpf_trace_sched_switch+0x10/0x10 [ 64.941322][ T5849] ? psi_group_change+0x6dc/0xd20 [ 64.946335][ T5849] __traceiter_sched_switch+0x6c/0xc0 [ 64.951694][ T5849] __schedule+0x1b71/0x5ad0 [ 64.956190][ T5849] ? trace_irq_enable.constprop.0+0xea/0x140 [ 64.962158][ T5849] ? __pfx___schedule+0x10/0x10 [ 64.966993][ T5849] ? lock_release+0x4e2/0x6f0 [ 64.971654][ T5849] ? schedule+0x298/0x350 [ 64.975975][ T5849] ? __pfx_lock_release+0x10/0x10 [ 64.980984][ T5849] ? schedule+0x1fd/0x350 [ 64.985327][ T5849] ? lock_acquire+0x2f/0xb0 [ 64.989813][ T5849] ? schedule+0x1fd/0x350 [ 64.994135][ T5849] schedule+0xe7/0x350 [ 64.998190][ T5849] ptrace_stop.part.0+0x440/0x940 [ 65.003204][ T5849] ptrace_do_notify+0x222/0x2d0 [ 65.008042][ T5849] ? __pfx_ptrace_do_notify+0x10/0x10 [ 65.013411][ T5849] ? rcu_is_watching+0x12/0xc0 [ 65.018166][ T5849] ? lock_acquire+0x2f/0xb0 [ 65.022654][ T5849] ? ptrace_notify+0xb1/0x130 [ 65.027318][ T5849] ptrace_notify+0xc5/0x130 [ 65.031808][ T5849] syscall_trace_enter+0xab/0x260 [ 65.036829][ T5849] do_syscall_64+0x1ee/0x250 [ 65.041409][ T5849] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 65.047301][ T5849] RIP: 0033:0x7fd4f256db49 [ 65.051698][ T5849] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 1b 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 65.071288][ T5849] RSP: 002b:00007ffebff53808 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 65.079714][ T5849] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd4f256db49 [pid 5848] close(17 [pid 5851] write(5, "3", 1 [pid 5850] close(8 [pid 5849] ioctl(-1, SIOCADDRT, 0x20000a80 [pid 5848] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5851] <... write resumed>) = 1 [pid 5850] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5827] <... unlink resumed>) = 0 [ 65.087671][ T5849] RDX: 0000000020000a80 RSI: 000000000000890b RDI: 00000000ffffffff [ 65.095624][ T5849] RBP: 0000000000000001 R08: 00007ffebff535a7 R09: 0000000000000000 [ 65.103583][ T5849] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 65.111545][ T5849] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 65.119508][ T5849] [ 65.122888][ T5851] FAULT_INJECTION: forcing a failure. [ 65.122888][ T5851] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 65.135922][ T5851] CPU: 1 UID: 0 PID: 5851 Comm: syz-executor388 Not tainted 6.13.0-rc7-syzkaller-00043-g619f0b6fad52 #0 [ 65.147009][ T5851] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 65.157040][ T5851] Call Trace: [ 65.160295][ T5851] [ 65.163203][ T5851] dump_stack_lvl+0x116/0x1f0 [ 65.167862][ T5851] should_fail_ex+0x497/0x5b0 [ 65.172537][ T5851] copy_to_user_nofault+0xac/0x180 [ 65.177630][ T5851] bpf_probe_write_user+0xaf/0xf0 [ 65.182641][ T5851] bpf_prog_6303d92f98284ad8+0x44/0x48 [ 65.188073][ T5851] bpf_trace_run4+0x245/0x5a0 [ 65.192722][ T5851] ? __pfx_bpf_trace_run4+0x10/0x10 [ 65.197896][ T5851] ? rcu_is_watching+0x12/0xc0 [ 65.202637][ T5851] ? __pfx_lock_release+0x10/0x10 [ 65.207638][ T5851] ? __pfx_sched_clock_cpu+0x10/0x10 [ 65.212906][ T5851] __bpf_trace_sched_switch+0x13e/0x190 [ 65.218428][ T5851] ? __pfx___bpf_trace_sched_switch+0x10/0x10 [ 65.224472][ T5851] ? psi_group_change+0x6dc/0xd20 [ 65.229474][ T5851] __traceiter_sched_switch+0x6c/0xc0 [ 65.234821][ T5851] __schedule+0x1b71/0x5ad0 [ 65.239301][ T5851] ? trace_irq_enable.constprop.0+0xea/0x140 [ 65.245258][ T5851] ? __pfx___schedule+0x10/0x10 [ 65.250082][ T5851] ? lock_release+0x4e2/0x6f0 [ 65.254741][ T5851] ? schedule+0x298/0x350 [ 65.259044][ T5851] ? __pfx_lock_release+0x10/0x10 [ 65.264044][ T5851] ? schedule+0x1fd/0x350 [ 65.268349][ T5851] ? lock_acquire+0x2f/0xb0 [ 65.272826][ T5851] ? schedule+0x1fd/0x350 [ 65.277130][ T5851] schedule+0xe7/0x350 [ 65.281175][ T5851] ptrace_stop.part.0+0x440/0x940 [ 65.286176][ T5851] ptrace_do_notify+0x222/0x2d0 [ 65.291018][ T5851] ? __pfx_ptrace_do_notify+0x10/0x10 [ 65.296379][ T5851] ? rcu_is_watching+0x12/0xc0 [ 65.301122][ T5851] ? lock_acquire+0x2f/0xb0 [ 65.305614][ T5851] ? ptrace_notify+0xb1/0x130 [ 65.310269][ T5851] ptrace_notify+0xc5/0x130 [ 65.314751][ T5851] syscall_trace_enter+0xab/0x260 [ 65.319768][ T5851] do_syscall_64+0x1ee/0x250 [ 65.324338][ T5851] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 65.330207][ T5851] RIP: 0033:0x7fd4f256db49 [ 65.334597][ T5851] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 1b 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 65.354265][ T5851] RSP: 002b:00007ffebff53808 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 65.362651][ T5851] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd4f256db49 [ 65.370598][ T5851] RDX: 0000000020000a80 RSI: 000000000000890b RDI: 00000000ffffffff [ 65.378542][ T5851] RBP: 0000000000000001 R08: 00007ffebff535a7 R09: 0000000000000000 [ 65.386494][ T5851] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [pid 5851] ioctl(-1, SIOCADDRT, 0x20000a80 [pid 5850] close(9 [pid 5849] <... ioctl resumed>) = -1 EBADF (Bad file descriptor) [pid 5827] umount2("./2/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5849] close(3 [pid 5827] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5851] <... ioctl resumed>) = -1 EBADF (Bad file descriptor) [pid 5850] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5849] <... close resumed>) = 0 [pid 5827] newfstatat(AT_FDCWD, "./2/binderfs", [pid 5849] close(4 [pid 5827] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5851] close(3 [pid 5850] close(10 [pid 5849] <... close resumed>) = 0 [pid 5827] unlink("./2/binderfs" [pid 5849] close(5 [pid 5851] <... close resumed>) = 0 [pid 5850] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5849] <... close resumed>) = 0 [pid 5827] <... unlink resumed>) = 0 [pid 5849] close(6 [pid 5827] getdents64(3, [pid 5849] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5827] <... getdents64 resumed>0x55556a2b46f0 /* 0 entries */, 32768) = 0 [pid 5849] close(7 [pid 5827] close(3 [pid 5849] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5851] close(4 [pid 5850] close(11 [pid 5849] close(8 [pid 5848] close(18 [pid 5827] <... close resumed>) = 0 [ 65.394455][ T5851] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 65.402421][ T5851] [ 65.411280][ T29] kauditd_printk_skb: 12 callbacks suppressed [ 65.411296][ T29] audit: type=1400 audit(1737028457.259:110): avc: denied { rename } for pid=5177 comm="syslogd" name="messages" dev="tmpfs" ino=3 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [pid 5827] rmdir("./2" [pid 5851] <... close resumed>) = 0 [pid 5850] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5849] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5848] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5827] <... rmdir resumed>) = 0 [pid 5827] mkdir("./3", 0777 [pid 5851] close(5 [pid 5850] close(12 [pid 5851] <... close resumed>) = 0 [pid 5850] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5849] close(9 [pid 5848] close(19 [pid 5827] <... mkdir resumed>) = 0 [pid 5851] close(6 [pid 5850] close(13 [pid 5849] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5848] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5827] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5851] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5850] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5849] close(10 [pid 5848] close(20 [pid 5851] close(7 [pid 5850] close(14 [pid 5849] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5848] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5827] <... clone resumed>, child_tidptr=0x55556a2b3650) = 5 [pid 5851] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5850] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5849] close(11 [pid 5848] close(21 [pid 5851] close(8 [pid 5850] close(15 [pid 5849] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5848] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5851] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5850] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5851] close(9 [pid 5850] close(16 [pid 5849] close(12 [pid 5848] close(22 [pid 5851] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5850] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5851] close(10 [pid 5850] close(17 [pid 5849] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5848] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5851] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5850] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5851] close(11 [pid 5850] close(18 [pid 5849] close(13 [pid 5848] close(23 [pid 5851] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5850] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5851] close(12 [pid 5850] close(19 [pid 5849] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5848] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5851] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5850] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5851] close(13 [pid 5850] close(20 [pid 5849] close(14 [pid 5848] close(24 [pid 5851] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5850] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5851] close(14 [pid 5850] close(21 [pid 5849] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5848] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5851] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5850] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5851] close(15 [pid 5850] close(22 [pid 5849] close(15 [pid 5848] close(25 [pid 5851] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5850] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5851] close(16 [pid 5850] close(23 [pid 5849] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5848] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5851] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5850] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5851] close(17 [pid 5850] close(24 [pid 5849] close(16 [pid 5848] close(26 [pid 5851] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5850] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5851] close(18 [pid 5850] close(25 [pid 5849] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5848] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5851] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5850] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5851] close(19 [pid 5850] close(26 [pid 5849] close(17 [pid 5848] close(27 [pid 5851] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5850] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5851] close(20 [pid 5850] close(27 [pid 5849] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5848] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5851] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5850] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5851] close(21 [pid 5850] close(28 [pid 5849] close(18 [pid 5848] close(28 [pid 5851] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5850] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5851] close(22 [pid 5850] close(29 [pid 5849] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5848] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5851] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5850] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5851] close(23 [pid 5850] exit_group(0 [pid 5849] close(19 [pid 5848] close(29 [pid 5851] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5850] <... exit_group resumed>) = ? [pid 5849] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5848] <... close resumed>) = -1 EBADF (Bad file descriptor) ./strace-static-x86_64: Process 5852 attached [pid 5851] close(24 [pid 5850] +++ exited with 0 +++ [pid 5849] close(20 [pid 5848] exit_group(0 [pid 5852] set_robust_list(0x55556a2b3660, 24 [pid 5851] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5849] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5848] <... exit_group resumed>) = ? [pid 5829] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5852] <... set_robust_list resumed>) = 0 [pid 5851] close(25 [pid 5849] close(21 [pid 5848] +++ exited with 0 +++ [pid 5852] chdir("./3" [pid 5851] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5849] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5852] <... chdir resumed>) = 0 [pid 5851] close(26 [pid 5849] close(22 [pid 5825] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- [pid 5852] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5851] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5849] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5852] <... prctl resumed>) = 0 [pid 5851] close(27 [pid 5849] close(23 [pid 5852] setpgid(0, 0 [pid 5851] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5849] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5852] <... setpgid resumed>) = 0 [pid 5851] close(28 [pid 5849] close(24 [pid 5851] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5849] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5851] close(29 [pid 5849] close(25 [pid 5852] symlink("/syzcgroup/unified/syz2", "./cgroup" [pid 5851] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5849] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5851] exit_group(0 [pid 5849] close(26 [pid 5851] <... exit_group resumed>) = ? [pid 5849] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5852] <... symlink resumed>) = 0 [pid 5851] +++ exited with 0 +++ [pid 5849] close(27) = -1 EBADF (Bad file descriptor) [pid 5823] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- [pid 5849] close(28 [pid 5823] restart_syscall(<... resuming interrupted clone ...> [pid 5849] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5849] close(29) = -1 EBADF (Bad file descriptor) [pid 5849] exit_group(0) = ? [pid 5852] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu" [pid 5849] +++ exited with 0 +++ [pid 5852] <... symlink resumed>) = 0 [pid 5828] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5852] symlink("/syzcgroup/net/syz2", "./cgroup.net" [pid 5828] restart_syscall(<... resuming interrupted clone ...> [pid 5852] <... symlink resumed>) = 0 [pid 5852] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5852] write(3, "1000", 4) = 4 [pid 5852] close(3) = 0 [pid 5852] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5852] write(1, "executing program\n", 18executing program ) = 18 [pid 5852] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=12, insns=0x20000180, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(4, 17, 0), prog_flags=BPF_F_TEST_RND_HI32, prog_name="", prog_ifindex=0, expected_attach_type=0x33 /* BPF_??? */, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 148) = 3 [pid 5852] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="sched_switch", prog_fd=3}}, 24) = 4 [pid 5852] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 5852] write(5, "3", 1) = 1 [ 65.440167][ T29] audit: type=1400 audit(1737028457.259:111): avc: denied { unlink } for pid=5177 comm="syslogd" name="messages.0" dev="tmpfs" ino=2 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 65.463368][ T29] audit: type=1400 audit(1737028457.259:112): avc: denied { create } for pid=5177 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 65.496460][ T5852] FAULT_INJECTION: forcing a failure. [ 65.496460][ T5852] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 65.509509][ T5852] CPU: 0 UID: 0 PID: 5852 Comm: syz-executor388 Not tainted 6.13.0-rc7-syzkaller-00043-g619f0b6fad52 #0 [ 65.520625][ T5852] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 65.530702][ T5852] Call Trace: [ 65.533984][ T5852] [ 65.536909][ T5852] dump_stack_lvl+0x116/0x1f0 [ 65.541596][ T5852] should_fail_ex+0x497/0x5b0 [ 65.546278][ T5852] copy_to_user_nofault+0xac/0x180 [ 65.551386][ T5852] bpf_probe_write_user+0xaf/0xf0 [ 65.556413][ T5852] bpf_prog_6303d92f98284ad8+0x44/0x48 [ 65.561866][ T5852] bpf_trace_run4+0x245/0x5a0 [ 65.566542][ T5852] ? __pfx_bpf_trace_run4+0x10/0x10 [ 65.571735][ T5852] ? psi_task_switch+0x203/0x8e0 [ 65.576666][ T5852] ? __pfx_lock_release+0x10/0x10 [ 65.581687][ T5852] ? psi_task_switch+0x203/0x8e0 [ 65.586621][ T5852] ? lock_acquire+0x2f/0xb0 [ 65.591135][ T5852] ? psi_task_switch+0x203/0x8e0 [ 65.596081][ T5852] __bpf_trace_sched_switch+0x13e/0x190 [ 65.601640][ T5852] ? __pfx___bpf_trace_sched_switch+0x10/0x10 [ 65.607712][ T5852] ? psi_task_switch+0x203/0x8e0 [ 65.612650][ T5852] __schedule+0x1b71/0x5ad0 [ 65.617155][ T5852] ? trace_irq_enable.constprop.0+0xea/0x140 [ 65.623141][ T5852] ? __pfx___schedule+0x10/0x10 [ 65.627990][ T5852] ? lock_release+0x4e2/0x6f0 [ 65.632662][ T5852] ? schedule+0x298/0x350 [ 65.636986][ T5852] ? __pfx_lock_release+0x10/0x10 [ 65.642007][ T5852] ? schedule+0x1fd/0x350 [ 65.646332][ T5852] ? lock_acquire+0x2f/0xb0 [ 65.650836][ T5852] ? schedule+0x1fd/0x350 [ 65.655165][ T5852] schedule+0xe7/0x350 [ 65.659231][ T5852] ptrace_stop.part.0+0x440/0x940 [ 65.664265][ T5852] ptrace_do_notify+0x222/0x2d0 [ 65.669115][ T5852] ? __pfx_ptrace_do_notify+0x10/0x10 [ 65.674483][ T5852] ? rcu_is_watching+0x12/0xc0 [ 65.679248][ T5852] ? lock_acquire+0x2f/0xb0 [ 65.683747][ T5852] ? ptrace_notify+0xb1/0x130 [ 65.688430][ T5852] ptrace_notify+0xc5/0x130 [ 65.692935][ T5852] syscall_exit_to_user_mode_prepare+0x126/0x290 [ 65.699266][ T5852] syscall_exit_to_user_mode+0x11/0x2a0 [ 65.704815][ T5852] do_syscall_64+0xda/0x250 [ 65.709320][ T5852] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 65.715213][ T5852] RIP: 0033:0x7fd4f256db49 [ 65.719642][ T5852] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 1b 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 65.739261][ T5852] RSP: 002b:00007ffebff53808 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [pid 5852] ioctl(-1, SIOCADDRT, 0x20000a80) = -1 EBADF (Bad file descriptor) [pid 5823] <... restart_syscall resumed>) = 0 [pid 5852] close(3 [pid 5828] <... restart_syscall resumed>) = 0 [pid 5852] <... close resumed>) = 0 [pid 5829] umount2("./2", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5852] close(4 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5823] umount2("./3", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5828] umount2("./2", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5825] umount2("./2", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] <... openat resumed>) = 3 [pid 5828] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5825] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5823] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] newfstatat(3, "", [pid 5828] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5825] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5823] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5852] <... close resumed>) = 0 [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=120, ...}, AT_EMPTY_PATH) = 0 [pid 5828] <... openat resumed>) = 3 [pid 5825] <... openat resumed>) = 3 [pid 5852] close(5 [pid 5829] getdents64(3, [pid 5828] newfstatat(3, "", [pid 5823] <... openat resumed>) = 3 [pid 5852] <... close resumed>) = 0 [pid 5829] <... getdents64 resumed>0x55556a2b46f0 /* 6 entries */, 32768) = 176 [pid 5828] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=120, ...}, AT_EMPTY_PATH) = 0 [pid 5825] newfstatat(3, "", [pid 5823] newfstatat(3, "", [pid 5852] close(6 [pid 5829] umount2("./2/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5828] getdents64(3, [pid 5825] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=120, ...}, AT_EMPTY_PATH) = 0 [pid 5823] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=120, ...}, AT_EMPTY_PATH) = 0 [pid 5852] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5828] <... getdents64 resumed>0x55556a2b46f0 /* 6 entries */, 32768) = 176 [pid 5825] getdents64(3, [pid 5852] close(7 [pid 5829] newfstatat(AT_FDCWD, "./2/cgroup", [pid 5828] umount2("./2/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5823] getdents64(3, [pid 5852] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5828] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5825] <... getdents64 resumed>0x55556a2b46f0 /* 6 entries */, 32768) = 176 [pid 5852] close(8 [pid 5829] unlink("./2/cgroup" [pid 5828] newfstatat(AT_FDCWD, "./2/cgroup", [pid 5825] umount2("./2/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5823] <... getdents64 resumed>0x55556a2b46f0 /* 6 entries */, 32768) = 176 [pid 5852] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... unlink resumed>) = 0 [pid 5828] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5825] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5852] close(9 [pid 5829] umount2("./2/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5828] unlink("./2/cgroup" [pid 5825] newfstatat(AT_FDCWD, "./2/cgroup", [pid 5823] umount2("./3/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5852] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5828] <... unlink resumed>) = 0 [pid 5825] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5852] close(10 [pid 5829] newfstatat(AT_FDCWD, "./2/cgroup.cpu", [pid 5828] umount2("./2/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5823] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5852] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5828] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5825] unlink("./2/cgroup" [pid 5852] close(11 [pid 5829] unlink("./2/cgroup.cpu" [pid 5828] newfstatat(AT_FDCWD, "./2/cgroup.cpu", [pid 5825] <... unlink resumed>) = 0 [pid 5823] newfstatat(AT_FDCWD, "./3/cgroup", [pid 5852] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... unlink resumed>) = 0 [pid 5828] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5852] close(12 [pid 5829] umount2("./2/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5828] unlink("./2/cgroup.cpu" [pid 5825] umount2("./2/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5823] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5852] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5828] <... unlink resumed>) = 0 [pid 5825] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5823] unlink("./3/cgroup" [pid 5852] close(13 [pid 5829] newfstatat(AT_FDCWD, "./2/cgroup.net", [pid 5828] umount2("./2/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5825] newfstatat(AT_FDCWD, "./2/cgroup.cpu", [pid 5852] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5828] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5825] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5823] <... unlink resumed>) = 0 [pid 5852] close(14 [pid 5829] unlink("./2/cgroup.net" [pid 5828] newfstatat(AT_FDCWD, "./2/cgroup.net", [pid 5825] unlink("./2/cgroup.cpu" [pid 5823] umount2("./3/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5852] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... unlink resumed>) = 0 [pid 5828] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5852] close(15 [pid 5829] umount2("./2/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5828] unlink("./2/cgroup.net" [pid 5825] <... unlink resumed>) = 0 [pid 5823] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5852] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5828] <... unlink resumed>) = 0 [pid 5825] umount2("./2/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5823] newfstatat(AT_FDCWD, "./3/cgroup.cpu", [pid 5852] close(16 [pid 5829] newfstatat(AT_FDCWD, "./2/binderfs", [pid 5828] umount2("./2/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5825] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5852] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5828] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5823] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5852] close(17 [pid 5829] unlink("./2/binderfs" [pid 5828] newfstatat(AT_FDCWD, "./2/binderfs", [pid 5825] newfstatat(AT_FDCWD, "./2/cgroup.net", [pid 5823] unlink("./3/cgroup.cpu" [pid 5852] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... unlink resumed>) = 0 [pid 5828] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5825] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5852] close(18 [pid 5829] getdents64(3, [pid 5828] unlink("./2/binderfs" [pid 5825] unlink("./2/cgroup.net" [pid 5823] <... unlink resumed>) = 0 [pid 5852] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... getdents64 resumed>0x55556a2b46f0 /* 0 entries */, 32768) = 0 [pid 5828] <... unlink resumed>) = 0 [pid 5823] umount2("./3/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5852] close(19 [pid 5829] close(3 [pid 5828] getdents64(3, [pid 5825] <... unlink resumed>) = 0 [pid 5852] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... close resumed>) = 0 [pid 5828] <... getdents64 resumed>0x55556a2b46f0 /* 0 entries */, 32768) = 0 [pid 5825] umount2("./2/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5823] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5852] close(20 [pid 5829] rmdir("./2" [pid 5828] close(3 [pid 5823] newfstatat(AT_FDCWD, "./3/cgroup.net", [pid 5852] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... rmdir resumed>) = 0 [pid 5828] <... close resumed>) = 0 [pid 5825] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5852] close(21 [pid 5829] mkdir("./3", 0777 [pid 5828] rmdir("./2" [pid 5825] newfstatat(AT_FDCWD, "./2/binderfs", [pid 5852] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... mkdir resumed>) = 0 [pid 5828] <... rmdir resumed>) = 0 [pid 5825] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5823] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5852] close(22 [pid 5829] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5828] mkdir("./3", 0777 [pid 5825] unlink("./2/binderfs" [pid 5852] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5828] <... mkdir resumed>) = 0 [pid 5823] unlink("./3/cgroup.net" [pid 5828] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5825] <... unlink resumed>) = 0 ./strace-static-x86_64: Process 5853 attached [pid 5852] close(23 [pid 5823] <... unlink resumed>) = 0 ./strace-static-x86_64: Process 5854 attached [pid 5853] set_robust_list(0x55556a2b3660, 24 [pid 5852] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... clone resumed>, child_tidptr=0x55556a2b3650) = 5 [pid 5828] <... clone resumed>, child_tidptr=0x55556a2b3650) = 5 [pid 5825] getdents64(3, [pid 5854] set_robust_list(0x55556a2b3660, 24 [pid 5853] <... set_robust_list resumed>) = 0 [pid 5852] close(24 [pid 5825] <... getdents64 resumed>0x55556a2b46f0 /* 0 entries */, 32768) = 0 [pid 5823] umount2("./3/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5854] <... set_robust_list resumed>) = 0 [pid 5853] chdir("./3" [pid 5852] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5825] close(3 [pid 5854] chdir("./3" [pid 5853] <... chdir resumed>) = 0 [pid 5823] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5852] close(25 [pid 5854] <... chdir resumed>) = 0 [pid 5853] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5852] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5825] <... close resumed>) = 0 [pid 5823] newfstatat(AT_FDCWD, "./3/binderfs", [pid 5854] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5853] <... prctl resumed>) = 0 [pid 5825] rmdir("./2" [pid 5854] <... prctl resumed>) = 0 [pid 5853] setpgid(0, 0 [pid 5852] close(26 [pid 5825] <... rmdir resumed>) = 0 [pid 5823] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5854] setpgid(0, 0 [pid 5853] <... setpgid resumed>) = 0 [pid 5852] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5854] <... setpgid resumed>) = 0 [pid 5853] symlink("/syzcgroup/unified/syz3", "./cgroup" [pid 5825] mkdir("./3", 0777 [pid 5823] unlink("./3/binderfs" [pid 5854] symlink("/syzcgroup/unified/syz4", "./cgroup" [pid 5853] <... symlink resumed>) = 0 [pid 5852] close(27 [pid 5825] <... mkdir resumed>) = 0 [pid 5853] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu" [pid 5823] <... unlink resumed>) = 0 [pid 5854] <... symlink resumed>) = 0 [pid 5853] <... symlink resumed>) = 0 [pid 5852] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5825] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5823] getdents64(3, [pid 5854] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu" [pid 5853] symlink("/syzcgroup/net/syz3", "./cgroup.net" [pid 5852] close(28 [pid 5823] <... getdents64 resumed>0x55556a2b46f0 /* 0 entries */, 32768) = 0 ./strace-static-x86_64: Process 5855 attached [pid 5854] <... symlink resumed>) = 0 [pid 5853] <... symlink resumed>) = 0 [pid 5852] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5823] close(3 [pid 5855] set_robust_list(0x55556a2b3660, 24 [pid 5854] symlink("/syzcgroup/net/syz4", "./cgroup.net" [pid 5853] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5852] close(29 [pid 5855] <... set_robust_list resumed>) = 0 [pid 5854] <... symlink resumed>) = 0 [pid 5853] <... openat resumed>) = 3 [pid 5823] <... close resumed>) = 0 [pid 5854] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5853] write(3, "1000", 4 [pid 5852] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5853] <... write resumed>) = 4 [pid 5853] close(3) = 0 [pid 5854] <... openat resumed>) = 3 [pid 5853] symlink("/dev/binderfs", "./binderfs" [pid 5855] chdir("./3" [pid 5854] write(3, "1000", 4 [pid 5853] <... symlink resumed>) = 0 [pid 5852] exit_group(0 [pid 5825] <... clone resumed>, child_tidptr=0x55556a2b3650) = 5 [pid 5823] rmdir("./3"executing program [pid 5855] <... chdir resumed>) = 0 [pid 5854] <... write resumed>) = 4 [pid 5853] write(1, "executing program\n", 18 [pid 5852] <... exit_group resumed>) = ? [pid 5823] <... rmdir resumed>) = 0 [pid 5855] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5854] close(3 [pid 5853] <... write resumed>) = 18 [pid 5853] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=12, insns=0x20000180, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(4, 17, 0), prog_flags=BPF_F_TEST_RND_HI32, prog_name="", prog_ifindex=0, expected_attach_type=0x33 /* BPF_??? */, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 148 [pid 5855] <... prctl resumed>) = 0 [pid 5854] <... close resumed>) = 0 [pid 5853] <... bpf resumed>) = 3 executing program [pid 5852] +++ exited with 0 +++ [pid 5823] mkdir("./4", 0777 [pid 5855] setpgid(0, 0 [pid 5854] symlink("/dev/binderfs", "./binderfs" [pid 5853] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="sched_switch", prog_fd=3}}, 24 [pid 5854] <... symlink resumed>) = 0 [pid 5855] <... setpgid resumed>) = 0 [pid 5853] <... bpf resumed>) = 4 [pid 5823] <... mkdir resumed>) = 0 [pid 5854] write(1, "executing program\n", 18 [ 65.747675][ T5852] RAX: fffffffffffffff7 RBX: 0000000000000003 RCX: 00007fd4f256db49 [ 65.755640][ T5852] RDX: 0000000020000a80 RSI: 000000000000890b RDI: 00000000ffffffff [ 65.763603][ T5852] RBP: 0000000000000001 R08: 00007ffebff535a7 R09: 0000000000000000 [ 65.771567][ T5852] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 65.779531][ T5852] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 65.787504][ T5852] [ 65.819171][ T5853] FAULT_INJECTION: forcing a failure. [ 65.819171][ T5853] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 65.832210][ T5853] CPU: 1 UID: 0 PID: 5853 Comm: syz-executor388 Not tainted 6.13.0-rc7-syzkaller-00043-g619f0b6fad52 #0 [ 65.843290][ T5853] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 65.853316][ T5853] Call Trace: [ 65.856589][ T5853] [ 65.859500][ T5853] dump_stack_lvl+0x116/0x1f0 [ 65.864157][ T5853] should_fail_ex+0x497/0x5b0 [ 65.868812][ T5853] copy_to_user_nofault+0xac/0x180 [ 65.873896][ T5853] bpf_probe_write_user+0xaf/0xf0 [ 65.878900][ T5853] bpf_prog_6303d92f98284ad8+0x44/0x48 [ 65.884327][ T5853] bpf_trace_run4+0x245/0x5a0 [ 65.888977][ T5853] ? __pfx_bpf_trace_run4+0x10/0x10 [ 65.894154][ T5853] ? psi_task_switch+0x2c1/0x8e0 [ 65.899067][ T5853] ? __pfx_lock_release+0x10/0x10 [ 65.904062][ T5853] ? psi_task_switch+0x2c1/0x8e0 [ 65.908970][ T5853] ? lock_acquire+0x2f/0xb0 [ 65.913449][ T5853] ? psi_task_switch+0x2c1/0x8e0 [ 65.918356][ T5853] __bpf_trace_sched_switch+0x13e/0x190 [ 65.923876][ T5853] ? __pfx___bpf_trace_sched_switch+0x10/0x10 [ 65.929915][ T5853] ? psi_task_switch+0x2c1/0x8e0 [ 65.934836][ T5853] __schedule+0x1b71/0x5ad0 [ 65.939315][ T5853] ? lock_acquire+0x2f/0xb0 [ 65.943789][ T5853] ? __wake_up_sync_key+0x1c/0x50 [ 65.949130][ T5853] ? trace_irq_enable.constprop.0+0xea/0x140 [ 65.955091][ T5853] ? __pfx___schedule+0x10/0x10 [ 65.959916][ T5853] ? lock_release+0x4e2/0x6f0 [ 65.964564][ T5853] ? schedule+0x298/0x350 [ 65.968867][ T5853] ? __pfx_lock_release+0x10/0x10 [ 65.973868][ T5853] ? schedule+0x1fd/0x350 [ 65.978168][ T5853] ? lock_acquire+0x2f/0xb0 [ 65.982643][ T5853] ? schedule+0x1fd/0x350 [ 65.986955][ T5853] schedule+0xe7/0x350 [ 65.991006][ T5853] ptrace_stop.part.0+0x440/0x940 [ 65.996006][ T5853] ptrace_do_notify+0x222/0x2d0 [ 66.000847][ T5853] ? __pfx_ptrace_do_notify+0x10/0x10 [ 66.006207][ T5853] ? rcu_is_watching+0x12/0xc0 [ 66.010961][ T5853] ? lock_acquire+0x2f/0xb0 [ 66.015439][ T5853] ? ptrace_notify+0xb1/0x130 [ 66.020109][ T5853] ptrace_notify+0xc5/0x130 [ 66.024590][ T5853] syscall_exit_to_user_mode_prepare+0x126/0x290 [ 66.030894][ T5853] syscall_exit_to_user_mode+0x11/0x2a0 [ 66.036417][ T5853] do_syscall_64+0xda/0x250 [ 66.040895][ T5853] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 66.046764][ T5853] RIP: 0033:0x7fd4f256db49 [ 66.051156][ T5853] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 1b 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 66.070735][ T5853] RSP: 002b:00007ffebff53808 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 66.079132][ T5853] RAX: fffffffffffffff7 RBX: 0000000000000003 RCX: 00007fd4f256db49 [ 66.087085][ T5853] RDX: 0000000020000a80 RSI: 000000000000890b RDI: 00000000ffffffff [ 66.095025][ T5853] RBP: 0000000000000001 R08: 00007ffebff535a7 R09: 0000000000000000 [ 66.102968][ T5853] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 66.110910][ T5853] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [pid 5853] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 5855] symlink("/syzcgroup/unified/syz1", "./cgroup" [pid 5854] <... write resumed>) = 18 [pid 5853] <... openat resumed>) = 5 [pid 5823] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5853] write(5, "3", 1 [pid 5854] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=12, insns=0x20000180, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(4, 17, 0), prog_flags=BPF_F_TEST_RND_HI32, prog_name="", prog_ifindex=0, expected_attach_type=0x33 /* BPF_??? */, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 148 [pid 5853] <... write resumed>) = 1 [pid 5853] ioctl(-1, SIOCADDRT, 0x20000a80./strace-static-x86_64: Process 5856 attached [pid 5855] <... symlink resumed>) = 0 [pid 5854] <... bpf resumed>) = 3 [pid 5853] <... ioctl resumed>) = -1 EBADF (Bad file descriptor) [pid 5827] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5856] set_robust_list(0x55556a2b3660, 24 [pid 5855] symlink("/syzcgroup/cpu/syz1", "./cgroup.cpu" [pid 5854] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="sched_switch", prog_fd=3}}, 24 [pid 5853] close(3 [pid 5827] umount2("./3", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5823] <... clone resumed>, child_tidptr=0x55556a2b3650) = 6 [pid 5856] <... set_robust_list resumed>) = 0 [pid 5855] <... symlink resumed>) = 0 [pid 5854] <... bpf resumed>) = 4 [pid 5853] <... close resumed>) = 0 [pid 5827] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5856] chdir("./4" [pid 5855] symlink("/syzcgroup/net/syz1", "./cgroup.net" [pid 5854] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 5853] close(4 [pid 5856] <... chdir resumed>) = 0 [pid 5855] <... symlink resumed>) = 0 [pid 5853] <... close resumed>) = 0 [pid 5827] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5856] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5855] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5854] <... openat resumed>) = 5 [pid 5853] close(5 [pid 5856] <... prctl resumed>) = 0 [pid 5853] <... close resumed>) = 0 [pid 5856] setpgid(0, 0 [pid 5855] <... openat resumed>) = 3 [pid 5853] close(6 [pid 5856] <... setpgid resumed>) = 0 [pid 5855] write(3, "1000", 4 [pid 5854] write(5, "3", 1 [pid 5853] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5856] symlink("/syzcgroup/unified/syz0", "./cgroup" [pid 5855] <... write resumed>) = 4 [pid 5854] <... write resumed>) = 1 [pid 5853] close(7 [pid 5827] <... openat resumed>) = 3 [pid 5856] <... symlink resumed>) = 0 [pid 5855] close(3 [ 66.118857][ T5853] [ 66.132543][ T5854] FAULT_INJECTION: forcing a failure. [ 66.132543][ T5854] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 66.145581][ T5854] CPU: 0 UID: 0 PID: 5854 Comm: syz-executor388 Not tainted 6.13.0-rc7-syzkaller-00043-g619f0b6fad52 #0 [ 66.156687][ T5854] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 66.166734][ T5854] Call Trace: [ 66.169990][ T5854] [ 66.172903][ T5854] dump_stack_lvl+0x116/0x1f0 [ 66.177571][ T5854] should_fail_ex+0x497/0x5b0 [ 66.182254][ T5854] copy_to_user_nofault+0xac/0x180 [ 66.187345][ T5854] bpf_probe_write_user+0xaf/0xf0 [ 66.192393][ T5854] bpf_prog_6303d92f98284ad8+0x44/0x48 [ 66.197838][ T5854] bpf_trace_run4+0x245/0x5a0 [ 66.202499][ T5854] ? __pfx_bpf_trace_run4+0x10/0x10 [ 66.207689][ T5854] ? psi_task_switch+0x2c1/0x8e0 [ 66.212601][ T5854] ? __pfx_lock_release+0x10/0x10 [ 66.217614][ T5854] ? psi_task_switch+0x2c1/0x8e0 [ 66.222527][ T5854] ? lock_acquire+0x2f/0xb0 [ 66.227026][ T5854] ? psi_task_switch+0x2c1/0x8e0 [ 66.231941][ T5854] __bpf_trace_sched_switch+0x13e/0x190 [ 66.237476][ T5854] ? __pfx___bpf_trace_sched_switch+0x10/0x10 [ 66.243529][ T5854] ? psi_task_switch+0x2c1/0x8e0 [ 66.248455][ T5854] __schedule+0x1b71/0x5ad0 [ 66.252944][ T5854] ? lock_acquire+0x2f/0xb0 [ 66.257430][ T5854] ? __wake_up_sync_key+0x1c/0x50 [ 66.262437][ T5854] ? trace_irq_enable.constprop.0+0xea/0x140 [ 66.268404][ T5854] ? __pfx___schedule+0x10/0x10 [ 66.273265][ T5854] ? lock_release+0x4e2/0x6f0 [ 66.277931][ T5854] ? schedule+0x298/0x350 [ 66.282249][ T5854] ? __pfx_lock_release+0x10/0x10 [ 66.287260][ T5854] ? schedule+0x1fd/0x350 [ 66.291574][ T5854] ? lock_acquire+0x2f/0xb0 [ 66.296057][ T5854] ? schedule+0x1fd/0x350 [ 66.300374][ T5854] schedule+0xe7/0x350 [ 66.304430][ T5854] ptrace_stop.part.0+0x440/0x940 [ 66.309443][ T5854] ptrace_do_notify+0x222/0x2d0 [ 66.314282][ T5854] ? __pfx_ptrace_do_notify+0x10/0x10 [ 66.319638][ T5854] ? rcu_is_watching+0x12/0xc0 [ 66.324399][ T5854] ? lock_acquire+0x2f/0xb0 [ 66.328891][ T5854] ? ptrace_notify+0xb1/0x130 [ 66.333562][ T5854] ptrace_notify+0xc5/0x130 [ 66.338052][ T5854] syscall_exit_to_user_mode_prepare+0x126/0x290 [ 66.344384][ T5854] syscall_exit_to_user_mode+0x11/0x2a0 [ 66.349918][ T5854] do_syscall_64+0xda/0x250 [ 66.354410][ T5854] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 66.360292][ T5854] RIP: 0033:0x7fd4f256db49 [ 66.364688][ T5854] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 1b 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 66.384278][ T5854] RSP: 002b:00007ffebff53808 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 66.392674][ T5854] RAX: fffffffffffffff7 RBX: 0000000000000003 RCX: 00007fd4f256db49 [ 66.400626][ T5854] RDX: 0000000020000a80 RSI: 000000000000890b RDI: 00000000ffffffff [ 66.408577][ T5854] RBP: 0000000000000001 R08: 00007ffebff535a7 R09: 0000000000000000 [pid 5854] ioctl(-1, SIOCADDRT, 0x20000a80 [pid 5853] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5827] newfstatat(3, "", [pid 5856] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu" [pid 5855] <... close resumed>) = 0 [pid 5854] <... ioctl resumed>) = -1 EBADF (Bad file descriptor) [pid 5853] close(8 [pid 5827] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=120, ...}, AT_EMPTY_PATH) = 0 [pid 5855] symlink("/dev/binderfs", "./binderfs" [pid 5854] close(3 [pid 5853] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5827] getdents64(3, [pid 5856] <... symlink resumed>) = 0 [pid 5855] <... symlink resumed>) = 0 [pid 5854] <... close resumed>) = 0 [pid 5853] close(9 [pid 5827] <... getdents64 resumed>0x55556a2b46f0 /* 6 entries */, 32768) = 176 executing program [pid 5856] symlink("/syzcgroup/net/syz0", "./cgroup.net" [pid 5855] write(1, "executing program\n", 18 [pid 5854] close(4 [pid 5853] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5827] umount2("./3/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5856] <... symlink resumed>) = 0 [pid 5855] <... write resumed>) = 18 [pid 5854] <... close resumed>) = 0 [pid 5853] close(10 [pid 5827] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5855] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=12, insns=0x20000180, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(4, 17, 0), prog_flags=BPF_F_TEST_RND_HI32, prog_name="", prog_ifindex=0, expected_attach_type=0x33 /* BPF_??? */, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 148 [pid 5854] close(5 [pid 5853] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5856] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5855] <... bpf resumed>) = 3 [pid 5854] <... close resumed>) = 0 [pid 5853] close(11 [pid 5827] newfstatat(AT_FDCWD, "./3/cgroup", [pid 5855] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="sched_switch", prog_fd=3}}, 24 [pid 5854] close(6 [pid 5853] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5827] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5856] <... openat resumed>) = 3 [pid 5854] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5853] close(12 [pid 5827] unlink("./3/cgroup" [pid 5856] write(3, "1000", 4 [pid 5855] <... bpf resumed>) = 4 [pid 5854] close(7 [pid 5853] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5827] <... unlink resumed>) = 0 [pid 5855] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 5854] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5853] close(13 [pid 5827] umount2("./3/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5855] <... openat resumed>) = 5 [pid 5854] close(8 [pid 5853] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5827] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5855] write(5, "3", 1 [pid 5856] <... write resumed>) = 4 [pid 5854] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5853] close(14 [pid 5827] newfstatat(AT_FDCWD, "./3/cgroup.cpu", [pid 5856] close(3 [pid 5855] <... write resumed>) = 1 [pid 5854] close(9 [pid 5853] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5827] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [ 66.416530][ T5854] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 66.424499][ T5854] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 66.432470][ T5854] [ 66.442296][ T5855] FAULT_INJECTION: forcing a failure. [ 66.442296][ T5855] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 66.455334][ T5855] CPU: 0 UID: 0 PID: 5855 Comm: syz-executor388 Not tainted 6.13.0-rc7-syzkaller-00043-g619f0b6fad52 #0 [ 66.466419][ T5855] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 66.476453][ T5855] Call Trace: [ 66.479708][ T5855] [ 66.482618][ T5855] dump_stack_lvl+0x116/0x1f0 [ 66.487278][ T5855] should_fail_ex+0x497/0x5b0 [ 66.491939][ T5855] copy_to_user_nofault+0xac/0x180 [ 66.497026][ T5855] bpf_probe_write_user+0xaf/0xf0 [ 66.502032][ T5855] bpf_prog_6303d92f98284ad8+0x44/0x48 [ 66.507459][ T5855] bpf_trace_run4+0x245/0x5a0 [ 66.512113][ T5855] ? __pfx_bpf_trace_run4+0x10/0x10 [ 66.517284][ T5855] ? psi_task_switch+0x2c1/0x8e0 [ 66.522194][ T5855] ? __pfx_lock_release+0x10/0x10 [ 66.527191][ T5855] ? psi_task_switch+0x2c1/0x8e0 [ 66.532100][ T5855] ? lock_acquire+0x2f/0xb0 [ 66.536575][ T5855] ? psi_task_switch+0x2c1/0x8e0 [ 66.541517][ T5855] __bpf_trace_sched_switch+0x13e/0x190 [ 66.547066][ T5855] ? __pfx___bpf_trace_sched_switch+0x10/0x10 [ 66.553131][ T5855] ? psi_task_switch+0x2c1/0x8e0 [ 66.558058][ T5855] __schedule+0x1b71/0x5ad0 [ 66.562558][ T5855] ? lock_acquire+0x2f/0xb0 [ 66.567051][ T5855] ? __wake_up_sync_key+0x1c/0x50 [ 66.572059][ T5855] ? trace_irq_enable.constprop.0+0xea/0x140 [ 66.578028][ T5855] ? __pfx___schedule+0x10/0x10 [ 66.582861][ T5855] ? lock_release+0x4e2/0x6f0 [ 66.587522][ T5855] ? schedule+0x298/0x350 [ 66.591833][ T5855] ? __pfx_lock_release+0x10/0x10 [ 66.596860][ T5855] ? schedule+0x1fd/0x350 [ 66.601186][ T5855] ? lock_acquire+0x2f/0xb0 [ 66.605686][ T5855] ? schedule+0x1fd/0x350 [ 66.610011][ T5855] schedule+0xe7/0x350 [ 66.614084][ T5855] ptrace_stop.part.0+0x440/0x940 [ 66.619112][ T5855] ptrace_do_notify+0x222/0x2d0 [ 66.623954][ T5855] ? __pfx_ptrace_do_notify+0x10/0x10 [ 66.629316][ T5855] ? rcu_is_watching+0x12/0xc0 [ 66.634068][ T5855] ? lock_acquire+0x2f/0xb0 [ 66.638566][ T5855] ? ptrace_notify+0xb1/0x130 [ 66.643228][ T5855] ptrace_notify+0xc5/0x130 [ 66.647719][ T5855] syscall_exit_to_user_mode_prepare+0x126/0x290 [ 66.654037][ T5855] syscall_exit_to_user_mode+0x11/0x2a0 [ 66.659570][ T5855] do_syscall_64+0xda/0x250 [ 66.664060][ T5855] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 66.669940][ T5855] RIP: 0033:0x7fd4f256db49 [ 66.674338][ T5855] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 1b 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 66.693950][ T5855] RSP: 002b:00007ffebff53808 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 66.702353][ T5855] RAX: fffffffffffffff7 RBX: 0000000000000003 RCX: 00007fd4f256db49 [ 66.710327][ T5855] RDX: 0000000020000a80 RSI: 000000000000890b RDI: 00000000ffffffff [pid 5855] ioctl(-1, SIOCADDRT, 0x20000a80 [pid 5854] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5853] close(15 [pid 5827] unlink("./3/cgroup.cpu" [pid 5856] <... close resumed>) = 0 [pid 5855] <... ioctl resumed>) = -1 EBADF (Bad file descriptor) [pid 5854] close(10 [pid 5853] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5856] symlink("/dev/binderfs", "./binderfs" [pid 5854] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5853] close(16 [pid 5854] close(11 [pid 5853] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5854] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5853] close(17 [pid 5854] close(12) = -1 EBADF (Bad file descriptor) [pid 5853] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5854] close(13 [pid 5853] close(18 [pid 5854] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5853] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5854] close(14 [pid 5853] close(19 [pid 5854] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5853] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5854] close(15 [pid 5853] close(20 [pid 5856] <... symlink resumed>) = 0 [pid 5853] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5853] close(21 executing program [pid 5856] write(1, "executing program\n", 18 [pid 5855] close(3 [pid 5854] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5853] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5827] <... unlink resumed>) = 0 [pid 5856] <... write resumed>) = 18 [pid 5855] <... close resumed>) = 0 [pid 5854] close(16 [pid 5853] close(22 [pid 5827] umount2("./3/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5855] close(4 [pid 5854] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5853] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5827] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5855] <... close resumed>) = 0 [pid 5854] close(17 [pid 5827] newfstatat(AT_FDCWD, "./3/cgroup.net", [pid 5856] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=12, insns=0x20000180, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(4, 17, 0), prog_flags=BPF_F_TEST_RND_HI32, prog_name="", prog_ifindex=0, expected_attach_type=0x33 /* BPF_??? */, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 148 [pid 5855] close(5 [pid 5854] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5853] close(23 [pid 5827] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5855] <... close resumed>) = 0 [pid 5854] close(18 [pid 5853] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5827] unlink("./3/cgroup.net" [pid 5855] close(6 [pid 5854] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5853] close(24 [pid 5827] <... unlink resumed>) = 0 [pid 5855] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5854] close(19 [pid 5853] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5827] umount2("./3/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5855] close(7 [pid 5854] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5853] close(25 [pid 5827] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5856] <... bpf resumed>) = 3 [pid 5855] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5854] close(20 [pid 5853] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5827] newfstatat(AT_FDCWD, "./3/binderfs", [pid 5855] close(8 [pid 5854] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5853] close(26 [pid 5827] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5855] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5854] close(21 [pid 5853] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5827] unlink("./3/binderfs" [pid 5855] close(9 [pid 5854] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5853] close(27 [pid 5827] <... unlink resumed>) = 0 [pid 5855] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5854] close(22 [pid 5853] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5827] getdents64(3, [pid 5855] close(10 [pid 5854] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5853] close(28 [pid 5827] <... getdents64 resumed>0x55556a2b46f0 /* 0 entries */, 32768) = 0 [pid 5855] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5854] close(23 [pid 5853] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5827] close(3 [pid 5855] close(11 [pid 5854] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5853] close(29 [pid 5827] <... close resumed>) = 0 [pid 5855] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5854] close(24 [pid 5853] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5827] rmdir("./3" [pid 5856] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="sched_switch", prog_fd=3}}, 24 [pid 5855] close(12 [pid 5854] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5853] exit_group(0 [pid 5827] <... rmdir resumed>) = 0 [pid 5855] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5854] close(25 [pid 5853] <... exit_group resumed>) = ? [pid 5827] mkdir("./4", 0777 [pid 5856] <... bpf resumed>) = 4 [pid 5855] close(13 [pid 5854] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5827] <... mkdir resumed>) = 0 [pid 5855] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5854] close(26 [pid 5827] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5857 attached [pid 5855] close(14 [pid 5854] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5853] +++ exited with 0 +++ [pid 5856] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 5857] set_robust_list(0x55556a2b3660, 24 [pid 5855] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5854] close(27 [pid 5827] <... clone resumed>, child_tidptr=0x55556a2b3650) = 6 [pid 5857] <... set_robust_list resumed>) = 0 [pid 5855] close(15 [pid 5854] <... close resumed>) = -1 EBADF (Bad file descriptor) [ 66.718286][ T5855] RBP: 0000000000000001 R08: 00007ffebff535a7 R09: 0000000000000000 [ 66.726243][ T5855] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 66.734198][ T5855] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 66.742159][ T5855] [ 66.765608][ T5856] FAULT_INJECTION: forcing a failure. [ 66.765608][ T5856] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 66.778651][ T5856] CPU: 1 UID: 0 PID: 5856 Comm: syz-executor388 Not tainted 6.13.0-rc7-syzkaller-00043-g619f0b6fad52 #0 [ 66.789849][ T5856] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 66.799921][ T5856] Call Trace: [ 66.803182][ T5856] [ 66.806092][ T5856] dump_stack_lvl+0x116/0x1f0 [ 66.810755][ T5856] should_fail_ex+0x497/0x5b0 [ 66.815425][ T5856] copy_to_user_nofault+0xac/0x180 [ 66.820512][ T5856] bpf_probe_write_user+0xaf/0xf0 [ 66.825525][ T5856] bpf_prog_6303d92f98284ad8+0x44/0x48 [ 66.830960][ T5856] bpf_trace_run4+0x245/0x5a0 [ 66.835618][ T5856] ? __pfx_bpf_trace_run4+0x10/0x10 [ 66.840787][ T5856] ? psi_task_switch+0x2c1/0x8e0 [ 66.845698][ T5856] ? __pfx_lock_release+0x10/0x10 [ 66.850715][ T5856] ? psi_task_switch+0x2c1/0x8e0 [ 66.855646][ T5856] ? lock_acquire+0x2f/0xb0 [ 66.860123][ T5856] ? psi_task_switch+0x2c1/0x8e0 [ 66.865034][ T5856] __bpf_trace_sched_switch+0x13e/0x190 [ 66.870551][ T5856] ? __pfx___bpf_trace_sched_switch+0x10/0x10 [ 66.876607][ T5856] ? psi_task_switch+0x2c1/0x8e0 [ 66.881520][ T5856] __schedule+0x1b71/0x5ad0 [ 66.886001][ T5856] ? lock_acquire+0x2f/0xb0 [ 66.890481][ T5856] ? __wake_up_sync_key+0x1c/0x50 [ 66.895495][ T5856] ? trace_irq_enable.constprop.0+0xea/0x140 [ 66.901455][ T5856] ? __pfx___schedule+0x10/0x10 [ 66.906281][ T5856] ? lock_release+0x4e2/0x6f0 [ 66.910940][ T5856] ? schedule+0x298/0x350 [ 66.915243][ T5856] ? __pfx_lock_release+0x10/0x10 [ 66.920239][ T5856] ? schedule+0x1fd/0x350 [ 66.924540][ T5856] ? lock_acquire+0x2f/0xb0 [ 66.929014][ T5856] ? schedule+0x1fd/0x350 [ 66.933328][ T5856] schedule+0xe7/0x350 [ 66.937375][ T5856] ptrace_stop.part.0+0x440/0x940 [ 66.942376][ T5856] ptrace_do_notify+0x222/0x2d0 [ 66.947212][ T5856] ? __pfx_ptrace_do_notify+0x10/0x10 [ 66.952558][ T5856] ? rcu_is_watching+0x12/0xc0 [ 66.957312][ T5856] ? lock_acquire+0x2f/0xb0 [ 66.961787][ T5856] ? ptrace_notify+0xb1/0x130 [ 66.966439][ T5856] ptrace_notify+0xc5/0x130 [ 66.970919][ T5856] syscall_exit_to_user_mode_prepare+0x126/0x290 [ 66.977223][ T5856] syscall_exit_to_user_mode+0x11/0x2a0 [ 66.982747][ T5856] do_syscall_64+0xda/0x250 [ 66.987226][ T5856] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 66.993098][ T5856] RIP: 0033:0x7fd4f256db49 [ 66.997491][ T5856] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 1b 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 67.017072][ T5856] RSP: 002b:00007ffebff53808 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 67.025457][ T5856] RAX: fffffffffffffff7 RBX: 0000000000000003 RCX: 00007fd4f256db49 [ 67.033407][ T5856] RDX: 0000000020000a80 RSI: 000000000000890b RDI: 00000000ffffffff [ 67.041348][ T5856] RBP: 0000000000000001 R08: 00007ffebff535a7 R09: 0000000000000000 [ 67.049291][ T5856] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 67.057233][ T5856] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [pid 5829] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5857] chdir("./4" [pid 5856] <... openat resumed>) = 5 [pid 5855] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5854] close(28 [pid 5829] restart_syscall(<... resuming interrupted clone ...> [pid 5857] <... chdir resumed>) = 0 [pid 5856] write(5, "3", 1 [pid 5855] close(16 [pid 5854] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5857] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5856] <... write resumed>) = 1 [pid 5855] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5854] close(29 [pid 5857] <... prctl resumed>) = 0 [pid 5856] ioctl(-1, SIOCADDRT, 0x20000a80 [pid 5855] close(17 [pid 5854] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5857] setpgid(0, 0 [pid 5856] <... ioctl resumed>) = -1 EBADF (Bad file descriptor) [pid 5855] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5854] exit_group(0 [pid 5857] <... setpgid resumed>) = 0 [pid 5856] close(3 [pid 5855] close(18 [pid 5829] <... restart_syscall resumed>) = 0 [pid 5854] <... exit_group resumed>) = ? [pid 5856] <... close resumed>) = 0 [pid 5855] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5856] close(4) = 0 [pid 5856] close(5) = 0 [pid 5856] close(6 [pid 5857] symlink("/syzcgroup/unified/syz2", "./cgroup" [pid 5855] close(19 [pid 5854] +++ exited with 0 +++ [pid 5856] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5855] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] umount2("./3", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5828] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5856] close(7 [pid 5855] close(20 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5857] <... symlink resumed>) = 0 [pid 5856] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5855] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5857] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu" [pid 5856] close(8 [pid 5855] close(21 [pid 5828] umount2("./3", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5856] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5855] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... openat resumed>) = 3 [pid 5828] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5857] <... symlink resumed>) = 0 [pid 5856] close(9 [pid 5855] close(22 [pid 5829] newfstatat(3, "", [pid 5828] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5857] symlink("/syzcgroup/net/syz2", "./cgroup.net" [pid 5856] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5855] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=120, ...}, AT_EMPTY_PATH) = 0 [pid 5855] close(23 [pid 5856] close(10 [pid 5855] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] getdents64(3, [pid 5828] <... openat resumed>) = 3 [pid 5857] <... symlink resumed>) = 0 [pid 5856] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5855] close(24 [pid 5829] <... getdents64 resumed>0x55556a2b46f0 /* 6 entries */, 32768) = 176 [pid 5856] close(11 [pid 5855] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5828] newfstatat(3, "", [pid 5857] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5856] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5855] close(25 [pid 5829] umount2("./3/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5828] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=120, ...}, AT_EMPTY_PATH) = 0 [pid 5856] close(12 [pid 5855] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5828] getdents64(3, [pid 5856] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5855] close(26 [pid 5829] newfstatat(AT_FDCWD, "./3/cgroup", [pid 5828] <... getdents64 resumed>0x55556a2b46f0 /* 6 entries */, 32768) = 176 [pid 5856] close(13 [pid 5855] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5857] <... openat resumed>) = 3 [pid 5856] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5855] close(27 [pid 5829] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5828] umount2("./3/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5857] write(3, "1000", 4 [pid 5856] close(14 [pid 5855] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] unlink("./3/cgroup" [pid 5828] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5857] <... write resumed>) = 4 [pid 5856] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5856] close(15 [pid 5828] newfstatat(AT_FDCWD, "./3/cgroup", [pid 5857] close(3 [pid 5856] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5855] close(28 [pid 5829] <... unlink resumed>) = 0 [pid 5828] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5857] <... close resumed>) = 0 [pid 5856] close(16 [pid 5855] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] umount2("./3/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5857] symlink("/dev/binderfs", "./binderfs" [pid 5856] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5855] close(29 [pid 5828] unlink("./3/cgroup" [pid 5857] <... symlink resumed>) = 0 [pid 5856] close(17executing program [pid 5855] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5828] <... unlink resumed>) = 0 [pid 5857] write(1, "executing program\n", 18 [pid 5856] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5857] <... write resumed>) = 18 [pid 5856] close(18 [pid 5855] exit_group(0 [pid 5829] newfstatat(AT_FDCWD, "./3/cgroup.cpu", [pid 5828] umount2("./3/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5857] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=12, insns=0x20000180, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(4, 17, 0), prog_flags=BPF_F_TEST_RND_HI32, prog_name="", prog_ifindex=0, expected_attach_type=0x33 /* BPF_??? */, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 148 [pid 5856] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5828] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5856] close(19 [pid 5855] <... exit_group resumed>) = ? [pid 5829] unlink("./3/cgroup.cpu" [pid 5828] newfstatat(AT_FDCWD, "./3/cgroup.cpu", [pid 5856] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5828] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5829] <... unlink resumed>) = 0 [pid 5856] close(20 [pid 5828] unlink("./3/cgroup.cpu" [pid 5856] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5828] <... unlink resumed>) = 0 [pid 5856] close(21) = -1 EBADF (Bad file descriptor) [pid 5856] close(22 [pid 5828] umount2("./3/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5856] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5856] close(23 [pid 5828] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5856] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5856] close(24 [pid 5828] newfstatat(AT_FDCWD, "./3/cgroup.net", [pid 5856] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5828] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5856] close(25 [pid 5828] unlink("./3/cgroup.net" [pid 5856] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5855] +++ exited with 0 +++ [pid 5856] close(26 [pid 5829] umount2("./3/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5828] <... unlink resumed>) = 0 [pid 5825] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5856] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5828] umount2("./3/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5825] restart_syscall(<... resuming interrupted clone ...> [pid 5857] <... bpf resumed>) = 3 [pid 5856] close(27 [pid 5828] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5857] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="sched_switch", prog_fd=3}}, 24 [pid 5856] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5828] newfstatat(AT_FDCWD, "./3/binderfs", [pid 5856] close(28 [pid 5857] <... bpf resumed>) = 4 [pid 5829] newfstatat(AT_FDCWD, "./3/cgroup.net", [pid 5828] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5857] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 5856] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5857] <... openat resumed>) = 5 [pid 5856] close(29 [pid 5829] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5828] unlink("./3/binderfs" [pid 5857] write(5, "3", 1 [pid 5856] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] unlink("./3/cgroup.net" [pid 5828] <... unlink resumed>) = 0 [pid 5857] <... write resumed>) = 1 [pid 5856] exit_group(0 [pid 5829] <... unlink resumed>) = 0 [pid 5828] getdents64(3, [pid 5825] <... restart_syscall resumed>) = 0 [ 67.065193][ T5856] [ 67.095063][ T5857] FAULT_INJECTION: forcing a failure. [ 67.095063][ T5857] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 67.108105][ T5857] CPU: 1 UID: 0 PID: 5857 Comm: syz-executor388 Not tainted 6.13.0-rc7-syzkaller-00043-g619f0b6fad52 #0 [ 67.119203][ T5857] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 67.129232][ T5857] Call Trace: [ 67.132486][ T5857] [ 67.135393][ T5857] dump_stack_lvl+0x116/0x1f0 [ 67.140083][ T5857] should_fail_ex+0x497/0x5b0 [ 67.144741][ T5857] copy_to_user_nofault+0xac/0x180 [ 67.149828][ T5857] bpf_probe_write_user+0xaf/0xf0 [ 67.154853][ T5857] bpf_prog_6303d92f98284ad8+0x44/0x48 [ 67.160283][ T5857] bpf_trace_run4+0x245/0x5a0 [ 67.164938][ T5857] ? __pfx_bpf_trace_run4+0x10/0x10 [ 67.170120][ T5857] ? psi_task_switch+0x2c1/0x8e0 [ 67.175029][ T5857] ? __pfx_lock_release+0x10/0x10 [ 67.180028][ T5857] ? psi_task_switch+0x2c1/0x8e0 [ 67.184936][ T5857] ? lock_acquire+0x2f/0xb0 [ 67.189414][ T5857] ? psi_task_switch+0x2c1/0x8e0 [ 67.194325][ T5857] __bpf_trace_sched_switch+0x13e/0x190 [ 67.199847][ T5857] ? __pfx___bpf_trace_sched_switch+0x10/0x10 [ 67.205891][ T5857] ? psi_task_switch+0x2c1/0x8e0 [ 67.210809][ T5857] __schedule+0x1b71/0x5ad0 [ 67.215289][ T5857] ? lock_acquire+0x2f/0xb0 [ 67.219764][ T5857] ? __wake_up_sync_key+0x1c/0x50 [ 67.224773][ T5857] ? trace_irq_enable.constprop.0+0xea/0x140 [ 67.230730][ T5857] ? __pfx___schedule+0x10/0x10 [ 67.235557][ T5857] ? lock_release+0x4e2/0x6f0 [ 67.240211][ T5857] ? schedule+0x298/0x350 [ 67.244516][ T5857] ? __pfx_lock_release+0x10/0x10 [ 67.249516][ T5857] ? schedule+0x1fd/0x350 [ 67.253824][ T5857] ? lock_acquire+0x2f/0xb0 [ 67.258302][ T5857] ? schedule+0x1fd/0x350 [ 67.262621][ T5857] schedule+0xe7/0x350 [ 67.266663][ T5857] ptrace_stop.part.0+0x440/0x940 [ 67.271684][ T5857] ptrace_do_notify+0x222/0x2d0 [ 67.276513][ T5857] ? __pfx_ptrace_do_notify+0x10/0x10 [ 67.281860][ T5857] ? rcu_is_watching+0x12/0xc0 [ 67.286604][ T5857] ? lock_acquire+0x2f/0xb0 [ 67.291082][ T5857] ? ptrace_notify+0xb1/0x130 [ 67.295738][ T5857] ptrace_notify+0xc5/0x130 [ 67.300236][ T5857] syscall_exit_to_user_mode_prepare+0x126/0x290 [ 67.306545][ T5857] syscall_exit_to_user_mode+0x11/0x2a0 [ 67.312071][ T5857] do_syscall_64+0xda/0x250 [ 67.316571][ T5857] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 67.322447][ T5857] RIP: 0033:0x7fd4f256db49 [pid 5857] ioctl(-1, SIOCADDRT, 0x20000a80 [pid 5856] <... exit_group resumed>) = ? [pid 5829] umount2("./3/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5828] <... getdents64 resumed>0x55556a2b46f0 /* 0 entries */, 32768) = 0 [ 67.326837][ T5857] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 1b 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 67.346424][ T5857] RSP: 002b:00007ffebff53808 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 67.354816][ T5857] RAX: fffffffffffffff7 RBX: 0000000000000003 RCX: 00007fd4f256db49 [ 67.362762][ T5857] RDX: 0000000020000a80 RSI: 000000000000890b RDI: 00000000ffffffff [ 67.370704][ T5857] RBP: 0000000000000001 R08: 00007ffebff535a7 R09: 0000000000000000 [ 67.378648][ T5857] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 67.386601][ T5857] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [pid 5857] <... ioctl resumed>) = -1 EBADF (Bad file descriptor) [pid 5856] +++ exited with 0 +++ [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5857] close(3 [pid 5829] newfstatat(AT_FDCWD, "./3/binderfs", [pid 5825] umount2("./3", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5857] <... close resumed>) = 0 [pid 5829] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5825] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5857] close(4 [pid 5829] unlink("./3/binderfs" [pid 5828] close(3 [pid 5825] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5857] <... close resumed>) = 0 [pid 5829] <... unlink resumed>) = 0 [pid 5828] <... close resumed>) = 0 [pid 5825] <... openat resumed>) = 3 [pid 5857] close(5 [pid 5829] getdents64(3, [pid 5828] rmdir("./3" [pid 5825] newfstatat(3, "", [pid 5857] <... close resumed>) = 0 [pid 5829] <... getdents64 resumed>0x55556a2b46f0 /* 0 entries */, 32768) = 0 [pid 5828] <... rmdir resumed>) = 0 [pid 5825] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=120, ...}, AT_EMPTY_PATH) = 0 [pid 5823] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5857] close(6 [pid 5829] close(3 [pid 5828] mkdir("./4", 0777 [pid 5825] getdents64(3, [pid 5823] umount2("./4", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5857] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... close resumed>) = 0 [pid 5828] <... mkdir resumed>) = 0 [pid 5825] <... getdents64 resumed>0x55556a2b46f0 /* 6 entries */, 32768) = 176 [pid 5823] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5857] close(7 [pid 5829] rmdir("./3" [pid 5828] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5825] umount2("./3/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5858 attached [pid 5857] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... rmdir resumed>) = 0 [pid 5825] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5823] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5858] set_robust_list(0x55556a2b3660, 24 [pid 5857] close(8 [pid 5829] mkdir("./4", 0777 [pid 5828] <... clone resumed>, child_tidptr=0x55556a2b3650) = 6 [pid 5825] newfstatat(AT_FDCWD, "./3/cgroup", [pid 5858] <... set_robust_list resumed>) = 0 [pid 5857] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... mkdir resumed>) = 0 [pid 5825] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5823] <... openat resumed>) = 3 [pid 5857] close(9 [pid 5829] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5825] unlink("./3/cgroup" [pid 5857] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5825] <... unlink resumed>) = 0 [pid 5857] close(10 [pid 5825] umount2("./3/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5857] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5825] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5857] close(11 [pid 5825] newfstatat(AT_FDCWD, "./3/cgroup.cpu", ./strace-static-x86_64: Process 5859 attached [pid 5858] chdir("./4" [pid 5857] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5825] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5823] newfstatat(3, "", [pid 5859] set_robust_list(0x55556a2b3660, 24 [pid 5858] <... chdir resumed>) = 0 [pid 5857] close(12 [pid 5829] <... clone resumed>, child_tidptr=0x55556a2b3650) = 6 [pid 5825] unlink("./3/cgroup.cpu" [pid 5859] <... set_robust_list resumed>) = 0 [pid 5858] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5857] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5825] <... unlink resumed>) = 0 [pid 5823] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=120, ...}, AT_EMPTY_PATH) = 0 [pid 5859] chdir("./4" [pid 5858] <... prctl resumed>) = 0 [pid 5857] close(13 [pid 5825] umount2("./3/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5859] <... chdir resumed>) = 0 [pid 5858] setpgid(0, 0 [pid 5857] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5825] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5823] getdents64(3, [pid 5859] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5858] <... setpgid resumed>) = 0 [pid 5857] close(14 [pid 5825] newfstatat(AT_FDCWD, "./3/cgroup.net", [pid 5859] <... prctl resumed>) = 0 [pid 5857] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5825] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5859] setpgid(0, 0 [pid 5858] symlink("/syzcgroup/unified/syz4", "./cgroup" [pid 5857] close(15 [pid 5825] unlink("./3/cgroup.net" [pid 5823] <... getdents64 resumed>0x55556a2b46f0 /* 6 entries */, 32768) = 176 [pid 5859] <... setpgid resumed>) = 0 [pid 5858] <... symlink resumed>) = 0 [pid 5857] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5825] <... unlink resumed>) = 0 [pid 5859] symlink("/syzcgroup/unified/syz3", "./cgroup" [pid 5857] close(16 [pid 5825] umount2("./3/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5823] umount2("./4/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5859] <... symlink resumed>) = 0 [pid 5858] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu" [pid 5857] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5825] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5859] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu" [pid 5857] close(17 [pid 5825] newfstatat(AT_FDCWD, "./3/binderfs", [pid 5823] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5859] <... symlink resumed>) = 0 [pid 5858] <... symlink resumed>) = 0 [pid 5857] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5825] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5823] newfstatat(AT_FDCWD, "./4/cgroup", [pid 5859] symlink("/syzcgroup/net/syz3", "./cgroup.net" [pid 5858] symlink("/syzcgroup/net/syz4", "./cgroup.net" [pid 5857] close(18 [pid 5825] unlink("./3/binderfs" [pid 5859] <... symlink resumed>) = 0 [pid 5858] <... symlink resumed>) = 0 [pid 5857] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5825] <... unlink resumed>) = 0 [pid 5823] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5859] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5858] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5857] close(19 [pid 5825] getdents64(3, [pid 5859] <... openat resumed>) = 3 [pid 5857] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5825] <... getdents64 resumed>0x55556a2b46f0 /* 0 entries */, 32768) = 0 [pid 5823] unlink("./4/cgroup" [pid 5859] write(3, "1000", 4 [pid 5858] <... openat resumed>) = 3 [pid 5857] close(20 [pid 5825] close(3 [pid 5859] <... write resumed>) = 4 [pid 5857] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5825] <... close resumed>) = 0 [pid 5823] <... unlink resumed>) = 0 [pid 5859] close(3 [pid 5857] close(21 [pid 5825] rmdir("./3" [pid 5859] <... close resumed>) = 0 [pid 5858] write(3, "1000", 4 [pid 5857] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5825] <... rmdir resumed>) = 0 [pid 5823] umount2("./4/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5859] symlink("/dev/binderfs", "./binderfs" [pid 5858] <... write resumed>) = 4 [pid 5857] close(22 [pid 5825] mkdir("./4", 0777 [pid 5859] <... symlink resumed>) = 0 [pid 5858] close(3 [pid 5857] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5825] <... mkdir resumed>) = 0 [pid 5823] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5859] write(1, "executing program\n", 18executing program [pid 5858] <... close resumed>) = 0 [pid 5857] close(23 [pid 5825] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5859] <... write resumed>) = 18 [pid 5858] symlink("/dev/binderfs", "./binderfs" [pid 5857] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5823] newfstatat(AT_FDCWD, "./4/cgroup.cpu", ./strace-static-x86_64: Process 5860 attached [pid 5859] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=12, insns=0x20000180, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(4, 17, 0), prog_flags=BPF_F_TEST_RND_HI32, prog_name="", prog_ifindex=0, expected_attach_type=0x33 /* BPF_??? */, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 148 [pid 5858] <... symlink resumed>) = 0 [pid 5857] close(24 [pid 5825] <... clone resumed>, child_tidptr=0x55556a2b3650) = 6 [pid 5860] set_robust_list(0x55556a2b3660, 24 [pid 5859] <... bpf resumed>) = 3 [pid 5858] write(1, "executing program\n", 18executing program [pid 5857] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5823] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5860] <... set_robust_list resumed>) = 0 [pid 5859] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="sched_switch", prog_fd=3}}, 24 [pid 5858] <... write resumed>) = 18 [pid 5857] close(25 [pid 5859] <... bpf resumed>) = 4 [pid 5857] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5823] unlink("./4/cgroup.cpu" [pid 5859] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 5858] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=12, insns=0x20000180, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(4, 17, 0), prog_flags=BPF_F_TEST_RND_HI32, prog_name="", prog_ifindex=0, expected_attach_type=0x33 /* BPF_??? */, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 148 [pid 5857] close(26 [pid 5860] chdir("./4" [pid 5859] <... openat resumed>) = 5 [pid 5857] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5823] <... unlink resumed>) = 0 [pid 5859] write(5, "3", 1 [pid 5857] close(27 [pid 5859] <... write resumed>) = 1 [pid 5857] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5823] umount2("./4/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW [ 67.394555][ T5857] [ 67.423286][ T5859] FAULT_INJECTION: forcing a failure. [ 67.423286][ T5859] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 67.436325][ T5859] CPU: 1 UID: 0 PID: 5859 Comm: syz-executor388 Not tainted 6.13.0-rc7-syzkaller-00043-g619f0b6fad52 #0 [ 67.447406][ T5859] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 67.457454][ T5859] Call Trace: [ 67.460707][ T5859] [ 67.463632][ T5859] dump_stack_lvl+0x116/0x1f0 [ 67.468311][ T5859] should_fail_ex+0x497/0x5b0 [ 67.472979][ T5859] copy_to_user_nofault+0xac/0x180 [ 67.478075][ T5859] bpf_probe_write_user+0xaf/0xf0 [ 67.483091][ T5859] bpf_prog_6303d92f98284ad8+0x44/0x48 [ 67.488517][ T5859] bpf_trace_run4+0x245/0x5a0 [ 67.493168][ T5859] ? __pfx_bpf_trace_run4+0x10/0x10 [ 67.498347][ T5859] ? psi_task_switch+0x2c1/0x8e0 [ 67.503269][ T5859] ? __pfx_lock_release+0x10/0x10 [ 67.508266][ T5859] ? psi_task_switch+0x2c1/0x8e0 [ 67.513180][ T5859] ? lock_acquire+0x2f/0xb0 [ 67.517662][ T5859] ? psi_task_switch+0x2c1/0x8e0 [ 67.522572][ T5859] __bpf_trace_sched_switch+0x13e/0x190 [ 67.528105][ T5859] ? __pfx___bpf_trace_sched_switch+0x10/0x10 [ 67.534149][ T5859] ? psi_task_switch+0x2c1/0x8e0 [ 67.539057][ T5859] __schedule+0x1b71/0x5ad0 [ 67.543553][ T5859] ? lock_acquire+0x2f/0xb0 [ 67.548029][ T5859] ? __wake_up_sync_key+0x1c/0x50 [ 67.553026][ T5859] ? trace_irq_enable.constprop.0+0xea/0x140 [ 67.558982][ T5859] ? __pfx___schedule+0x10/0x10 [ 67.563809][ T5859] ? lock_release+0x4e2/0x6f0 [ 67.568460][ T5859] ? schedule+0x298/0x350 [ 67.572763][ T5859] ? __pfx_lock_release+0x10/0x10 [ 67.577760][ T5859] ? schedule+0x1fd/0x350 [ 67.582063][ T5859] ? lock_acquire+0x2f/0xb0 [ 67.586543][ T5859] ? schedule+0x1fd/0x350 [ 67.590848][ T5859] schedule+0xe7/0x350 [ 67.594894][ T5859] ptrace_stop.part.0+0x440/0x940 [ 67.599894][ T5859] ptrace_do_notify+0x222/0x2d0 [ 67.604719][ T5859] ? __pfx_ptrace_do_notify+0x10/0x10 [ 67.610062][ T5859] ? rcu_is_watching+0x12/0xc0 [ 67.614818][ T5859] ? lock_acquire+0x2f/0xb0 [ 67.619306][ T5859] ? ptrace_notify+0xb1/0x130 [ 67.623960][ T5859] ptrace_notify+0xc5/0x130 [ 67.628442][ T5859] syscall_exit_to_user_mode_prepare+0x126/0x290 [ 67.634748][ T5859] syscall_exit_to_user_mode+0x11/0x2a0 [ 67.640272][ T5859] do_syscall_64+0xda/0x250 [ 67.644755][ T5859] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 67.650623][ T5859] RIP: 0033:0x7fd4f256db49 [ 67.655011][ T5859] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 1b 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [pid 5859] ioctl(-1, SIOCADDRT, 0x20000a80 [pid 5857] close(28 [pid 5860] <... chdir resumed>) = 0 [pid 5859] <... ioctl resumed>) = -1 EBADF (Bad file descriptor) [pid 5858] <... bpf resumed>) = 3 [pid 5857] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5823] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5859] close(3 [pid 5857] close(29 [pid 5859] <... close resumed>) = 0 [pid 5857] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5859] close(4 [pid 5857] exit_group(0 [pid 5823] newfstatat(AT_FDCWD, "./4/cgroup.net", [pid 5859] <... close resumed>) = 0 [ 67.674593][ T5859] RSP: 002b:00007ffebff53808 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 67.682983][ T5859] RAX: fffffffffffffff7 RBX: 0000000000000003 RCX: 00007fd4f256db49 [ 67.690942][ T5859] RDX: 0000000020000a80 RSI: 000000000000890b RDI: 00000000ffffffff [ 67.698886][ T5859] RBP: 0000000000000001 R08: 00007ffebff535a7 R09: 0000000000000000 [ 67.706849][ T5859] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 67.714812][ T5859] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [pid 5857] <... exit_group resumed>) = ? [pid 5860] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5859] close(5 [pid 5858] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="sched_switch", prog_fd=3}}, 24 [pid 5857] +++ exited with 0 +++ [pid 5823] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5860] <... prctl resumed>) = 0 [pid 5859] <... close resumed>) = 0 [pid 5859] close(6) = -1 EBADF (Bad file descriptor) [pid 5859] close(7) = -1 EBADF (Bad file descriptor) [pid 5823] unlink("./4/cgroup.net" [pid 5860] setpgid(0, 0 [pid 5859] close(8 [pid 5827] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5859] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5859] close(9) = -1 EBADF (Bad file descriptor) [pid 5860] <... setpgid resumed>) = 0 [pid 5859] close(10 [pid 5827] umount2("./4", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5823] <... unlink resumed>) = 0 [pid 5859] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5858] <... bpf resumed>) = 4 [pid 5859] close(11 [pid 5860] symlink("/syzcgroup/unified/syz1", "./cgroup" [pid 5859] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5859] close(12 [pid 5827] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5859] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5823] umount2("./4/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5859] close(13 [pid 5827] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5859] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5859] close(14) = -1 EBADF (Bad file descriptor) [pid 5859] close(15 [pid 5858] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 5827] <... openat resumed>) = 3 [pid 5859] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5859] close(16) = -1 EBADF (Bad file descriptor) [pid 5859] close(17) = -1 EBADF (Bad file descriptor) [pid 5859] close(18) = -1 EBADF (Bad file descriptor) [pid 5859] close(19) = -1 EBADF (Bad file descriptor) [pid 5859] close(20) = -1 EBADF (Bad file descriptor) [pid 5859] close(21) = -1 EBADF (Bad file descriptor) [pid 5860] <... symlink resumed>) = 0 [pid 5859] close(22) = -1 EBADF (Bad file descriptor) [pid 5859] close(23) = -1 EBADF (Bad file descriptor) [pid 5859] close(24) = -1 EBADF (Bad file descriptor) [pid 5823] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5859] close(25) = -1 EBADF (Bad file descriptor) [pid 5858] <... openat resumed>) = 5 [pid 5859] close(26) = -1 EBADF (Bad file descriptor) [pid 5859] close(27 [pid 5827] newfstatat(3, "", [pid 5823] newfstatat(AT_FDCWD, "./4/binderfs", [pid 5859] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5859] close(28 [pid 5827] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=120, ...}, AT_EMPTY_PATH) = 0 [pid 5859] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5858] write(5, "3", 1 [pid 5823] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5859] close(29 [pid 5858] <... write resumed>) = 1 [pid 5859] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5827] getdents64(3, [pid 5823] unlink("./4/binderfs" [pid 5860] symlink("/syzcgroup/cpu/syz1", "./cgroup.cpu" [pid 5859] exit_group(0 [pid 5858] ioctl(-1, SIOCADDRT, 0x20000a80 [pid 5827] <... getdents64 resumed>0x55556a2b46f0 /* 6 entries */, 32768) = 176 [pid 5859] <... exit_group resumed>) = ? [ 67.722782][ T5859] [ 67.745115][ T5858] FAULT_INJECTION: forcing a failure. [ 67.745115][ T5858] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 67.758155][ T5858] CPU: 0 UID: 0 PID: 5858 Comm: syz-executor388 Not tainted 6.13.0-rc7-syzkaller-00043-g619f0b6fad52 #0 [ 67.769247][ T5858] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 67.779298][ T5858] Call Trace: [ 67.782575][ T5858] [ 67.785487][ T5858] dump_stack_lvl+0x116/0x1f0 [ 67.790148][ T5858] should_fail_ex+0x497/0x5b0 [ 67.794819][ T5858] copy_to_user_nofault+0xac/0x180 [ 67.799924][ T5858] bpf_probe_write_user+0xaf/0xf0 [ 67.804957][ T5858] bpf_prog_6303d92f98284ad8+0x44/0x48 [ 67.810407][ T5858] bpf_trace_run4+0x245/0x5a0 [ 67.815062][ T5858] ? __pfx_bpf_trace_run4+0x10/0x10 [ 67.820232][ T5858] ? psi_task_switch+0x203/0x8e0 [ 67.825140][ T5858] ? __pfx_lock_release+0x10/0x10 [ 67.830137][ T5858] ? psi_task_switch+0x203/0x8e0 [ 67.835053][ T5858] ? lock_acquire+0x2f/0xb0 [ 67.839532][ T5858] ? psi_task_switch+0x203/0x8e0 [ 67.844446][ T5858] __bpf_trace_sched_switch+0x13e/0x190 [ 67.849967][ T5858] ? __pfx___bpf_trace_sched_switch+0x10/0x10 [ 67.856011][ T5858] ? psi_task_switch+0x203/0x8e0 [ 67.860953][ T5858] __schedule+0x1b71/0x5ad0 [ 67.865445][ T5858] ? lock_acquire+0x2f/0xb0 [ 67.869944][ T5858] ? __wake_up_sync_key+0x1c/0x50 [ 67.875033][ T5858] ? trace_irq_enable.constprop.0+0xea/0x140 [ 67.880995][ T5858] ? __pfx___schedule+0x10/0x10 [ 67.885820][ T5858] ? lock_release+0x4e2/0x6f0 [ 67.890487][ T5858] ? schedule+0x298/0x350 [ 67.894790][ T5858] ? __pfx_lock_release+0x10/0x10 [ 67.899788][ T5858] ? schedule+0x1fd/0x350 [ 67.904094][ T5858] ? lock_acquire+0x2f/0xb0 [ 67.908585][ T5858] ? schedule+0x1fd/0x350 [ 67.912892][ T5858] schedule+0xe7/0x350 [ 67.916940][ T5858] ptrace_stop.part.0+0x440/0x940 [ 67.921955][ T5858] ptrace_do_notify+0x222/0x2d0 [ 67.926796][ T5858] ? __pfx_ptrace_do_notify+0x10/0x10 [ 67.932144][ T5858] ? rcu_is_watching+0x12/0xc0 [ 67.936887][ T5858] ? lock_acquire+0x2f/0xb0 [ 67.941365][ T5858] ? ptrace_notify+0xb1/0x130 [ 67.946035][ T5858] ptrace_notify+0xc5/0x130 [ 67.950511][ T5858] syscall_exit_to_user_mode_prepare+0x126/0x290 [ 67.956816][ T5858] syscall_exit_to_user_mode+0x11/0x2a0 [ 67.962341][ T5858] do_syscall_64+0xda/0x250 [ 67.966824][ T5858] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 67.972694][ T5858] RIP: 0033:0x7fd4f256db49 [pid 5823] <... unlink resumed>) = 0 [pid 5860] <... symlink resumed>) = 0 [pid 5859] +++ exited with 0 +++ [pid 5858] <... ioctl resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5827] umount2("./4/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5823] getdents64(3, [pid 5860] symlink("/syzcgroup/net/syz1", "./cgroup.net" [pid 5858] close(3 [pid 5827] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5823] <... getdents64 resumed>0x55556a2b46f0 /* 0 entries */, 32768) = 0 [pid 5858] <... close resumed>) = 0 [pid 5827] newfstatat(AT_FDCWD, "./4/cgroup", [pid 5823] close(3 [pid 5827] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5823] <... close resumed>) = 0 [ 67.977083][ T5858] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 1b 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 67.996663][ T5858] RSP: 002b:00007ffebff53808 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 68.005049][ T5858] RAX: fffffffffffffff7 RBX: 0000000000000003 RCX: 00007fd4f256db49 [ 68.013429][ T5858] RDX: 0000000020000a80 RSI: 000000000000890b RDI: 00000000ffffffff [ 68.021390][ T5858] RBP: 0000000000000001 R08: 00007ffebff535a7 R09: 0000000000000000 [ 68.029363][ T5858] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 68.037306][ T5858] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 executing program [pid 5823] rmdir("./4" [pid 5860] <... symlink resumed>) = 0 [pid 5858] close(4 [pid 5823] <... rmdir resumed>) = 0 [pid 5829] umount2("./4", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5858] <... close resumed>) = 0 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5823] mkdir("./5", 0777 [pid 5860] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5829] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5858] close(5 [pid 5823] <... mkdir resumed>) = 0 [pid 5827] unlink("./4/cgroup" [pid 5860] <... openat resumed>) = 3 [pid 5858] <... close resumed>) = 0 [pid 5829] <... openat resumed>) = 3 [pid 5827] <... unlink resumed>) = 0 [pid 5823] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5860] write(3, "1000", 4 [pid 5858] close(6 [pid 5829] newfstatat(3, "", [pid 5827] umount2("./4/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5860] <... write resumed>) = 4 [pid 5858] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=120, ...}, AT_EMPTY_PATH) = 0 [pid 5827] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5860] close(3 [pid 5858] close(7 [pid 5829] getdents64(3, [pid 5827] newfstatat(AT_FDCWD, "./4/cgroup.cpu", [pid 5860] <... close resumed>) = 0 [pid 5858] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... getdents64 resumed>0x55556a2b46f0 /* 6 entries */, 32768) = 176 [pid 5827] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5860] symlink("/dev/binderfs", "./binderfs" [pid 5858] close(8 [pid 5829] umount2("./4/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5827] unlink("./4/cgroup.cpu" [pid 5860] <... symlink resumed>) = 0 [pid 5858] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5827] <... unlink resumed>) = 0 [pid 5858] close(9 [pid 5829] newfstatat(AT_FDCWD, "./4/cgroup", [pid 5827] umount2("./4/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5860] write(1, "executing program\n", 18 [pid 5858] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5827] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5860] <... write resumed>) = 18 [pid 5858] close(10 [pid 5829] unlink("./4/cgroup" [pid 5827] newfstatat(AT_FDCWD, "./4/cgroup.net", [pid 5858] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5827] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5829] <... unlink resumed>) = 0 [pid 5858] close(11 [pid 5827] unlink("./4/cgroup.net"./strace-static-x86_64: Process 5861 attached [pid 5860] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=12, insns=0x20000180, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(4, 17, 0), prog_flags=BPF_F_TEST_RND_HI32, prog_name="", prog_ifindex=0, expected_attach_type=0x33 /* BPF_??? */, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 148 [pid 5858] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] umount2("./4/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5827] <... unlink resumed>) = 0 [pid 5861] set_robust_list(0x55556a2b3660, 24 [pid 5858] close(12 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5827] umount2("./4/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5823] <... clone resumed>, child_tidptr=0x55556a2b3650) = 7 [pid 5861] <... set_robust_list resumed>) = 0 [pid 5858] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] newfstatat(AT_FDCWD, "./4/cgroup.cpu", [pid 5827] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5858] close(13 [pid 5827] newfstatat(AT_FDCWD, "./4/binderfs", [pid 5861] chdir("./5" [pid 5860] <... bpf resumed>) = 3 [pid 5858] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5827] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5861] <... chdir resumed>) = 0 [pid 5860] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="sched_switch", prog_fd=3}}, 24 [pid 5858] close(14 [pid 5829] unlink("./4/cgroup.cpu" [pid 5827] unlink("./4/binderfs" [pid 5861] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5860] <... bpf resumed>) = 4 [pid 5858] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... unlink resumed>) = 0 [pid 5827] <... unlink resumed>) = 0 [pid 5861] <... prctl resumed>) = 0 [pid 5860] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 5858] close(15 [pid 5829] umount2("./4/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5827] getdents64(3, [pid 5861] setpgid(0, 0 [pid 5860] <... openat resumed>) = 5 [pid 5858] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5827] <... getdents64 resumed>0x55556a2b46f0 /* 0 entries */, 32768) = 0 [pid 5861] <... setpgid resumed>) = 0 [pid 5860] write(5, "3", 1 [pid 5858] close(16 [pid 5829] newfstatat(AT_FDCWD, "./4/cgroup.net", [pid 5827] close(3 [pid 5861] symlink("/syzcgroup/unified/syz0", "./cgroup" [pid 5860] <... write resumed>) = 1 [pid 5858] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5827] <... close resumed>) = 0 [pid 5860] ioctl(-1, SIOCADDRT, 0x20000a80 [pid 5858] close(17 [pid 5829] unlink("./4/cgroup.net" [pid 5827] rmdir("./4" [pid 5861] <... symlink resumed>) = 0 [pid 5827] <... rmdir resumed>) = 0 [ 68.045256][ T5858] [ 68.059657][ T5860] FAULT_INJECTION: forcing a failure. [ 68.059657][ T5860] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 68.072703][ T5860] CPU: 0 UID: 0 PID: 5860 Comm: syz-executor388 Not tainted 6.13.0-rc7-syzkaller-00043-g619f0b6fad52 #0 [ 68.083790][ T5860] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 68.093818][ T5860] Call Trace: [ 68.097075][ T5860] [ 68.099981][ T5860] dump_stack_lvl+0x116/0x1f0 [ 68.104640][ T5860] should_fail_ex+0x497/0x5b0 [ 68.109300][ T5860] copy_to_user_nofault+0xac/0x180 [ 68.114389][ T5860] bpf_probe_write_user+0xaf/0xf0 [ 68.119390][ T5860] bpf_prog_6303d92f98284ad8+0x44/0x48 [ 68.124820][ T5860] bpf_trace_run4+0x245/0x5a0 [ 68.129469][ T5860] ? __pfx_bpf_trace_run4+0x10/0x10 [ 68.134726][ T5860] ? psi_task_switch+0x2c1/0x8e0 [ 68.139632][ T5860] ? __pfx_lock_release+0x10/0x10 [ 68.144627][ T5860] ? psi_task_switch+0x2c1/0x8e0 [ 68.149532][ T5860] ? lock_acquire+0x2f/0xb0 [ 68.154005][ T5860] ? psi_task_switch+0x2c1/0x8e0 [ 68.158913][ T5860] __bpf_trace_sched_switch+0x13e/0x190 [ 68.164431][ T5860] ? __pfx___bpf_trace_sched_switch+0x10/0x10 [ 68.170470][ T5860] ? psi_task_switch+0x2c1/0x8e0 [ 68.175379][ T5860] __schedule+0x1b71/0x5ad0 [ 68.179854][ T5860] ? trace_irq_enable.constprop.0+0xea/0x140 [ 68.185807][ T5860] ? __pfx___schedule+0x10/0x10 [ 68.190627][ T5860] ? lock_release+0x4e2/0x6f0 [ 68.195274][ T5860] ? schedule+0x298/0x350 [ 68.199577][ T5860] ? __pfx_lock_release+0x10/0x10 [ 68.204573][ T5860] ? schedule+0x1fd/0x350 [ 68.208875][ T5860] ? lock_acquire+0x2f/0xb0 [ 68.213349][ T5860] ? schedule+0x1fd/0x350 [ 68.217649][ T5860] schedule+0xe7/0x350 [ 68.221690][ T5860] ptrace_stop.part.0+0x440/0x940 [ 68.226687][ T5860] ptrace_do_notify+0x222/0x2d0 [ 68.231510][ T5860] ? __pfx_ptrace_do_notify+0x10/0x10 [ 68.236867][ T5860] ? rcu_is_watching+0x12/0xc0 [ 68.241606][ T5860] ? lock_acquire+0x2f/0xb0 [ 68.246082][ T5860] ? ptrace_notify+0xb1/0x130 [ 68.250733][ T5860] ptrace_notify+0xc5/0x130 [ 68.255208][ T5860] syscall_exit_to_user_mode_prepare+0x126/0x290 [ 68.261519][ T5860] syscall_exit_to_user_mode+0x11/0x2a0 [ 68.267046][ T5860] do_syscall_64+0xda/0x250 [ 68.271538][ T5860] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 68.277424][ T5860] RIP: 0033:0x7fd4f256db49 [ 68.281822][ T5860] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 1b 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 68.301417][ T5860] RSP: 002b:00007ffebff53808 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 68.309804][ T5860] RAX: fffffffffffffff7 RBX: 0000000000000003 RCX: 00007fd4f256db49 [ 68.317833][ T5860] RDX: 0000000020000a80 RSI: 000000000000890b RDI: 00000000ffffffff [ 68.325777][ T5860] RBP: 0000000000000001 R08: 00007ffebff535a7 R09: 0000000000000000 [ 68.333722][ T5860] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [pid 5827] mkdir("./5", 0777 [pid 5860] <... ioctl resumed>) = -1 EBADF (Bad file descriptor) [pid 5858] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5861] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu" [pid 5829] <... unlink resumed>) = 0 [pid 5861] <... symlink resumed>) = 0 [pid 5860] close(3 [pid 5858] close(18 [pid 5829] umount2("./4/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5827] <... mkdir resumed>) = 0 [pid 5861] symlink("/syzcgroup/net/syz0", "./cgroup.net" [pid 5860] <... close resumed>) = 0 [pid 5858] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5827] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5861] <... symlink resumed>) = 0 [pid 5860] close(4 [pid 5858] close(19 [pid 5829] newfstatat(AT_FDCWD, "./4/binderfs", [pid 5861] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5860] <... close resumed>) = 0 [pid 5858] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5861] <... openat resumed>) = 3 [pid 5860] close(5 [pid 5858] close(20 [pid 5829] unlink("./4/binderfs"./strace-static-x86_64: Process 5862 attached [pid 5861] write(3, "1000", 4 [pid 5860] <... close resumed>) = 0 [pid 5858] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... unlink resumed>) = 0 [pid 5827] <... clone resumed>, child_tidptr=0x55556a2b3650) = 7 [pid 5861] <... write resumed>) = 4 [pid 5860] close(6 [pid 5862] set_robust_list(0x55556a2b3660, 24 [pid 5858] close(21 [pid 5829] getdents64(3, [pid 5861] close(3 [pid 5860] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5858] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... getdents64 resumed>0x55556a2b46f0 /* 0 entries */, 32768) = 0 [pid 5862] <... set_robust_list resumed>) = 0 [pid 5861] <... close resumed>) = 0 [pid 5860] close(7 [pid 5858] close(22 [pid 5829] close(3 [pid 5861] symlink("/dev/binderfs", "./binderfs" [pid 5860] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5858] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... close resumed>) = 0 [pid 5862] chdir("./5" [pid 5860] close(8 [pid 5858] close(23 [pid 5829] rmdir("./4" [pid 5861] <... symlink resumed>) = 0 [pid 5860] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5858] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... rmdir resumed>) = 0 [pid 5829] mkdir("./5", 0777 [pid 5860] close(9executing program [pid 5862] <... chdir resumed>) = 0 [pid 5861] write(1, "executing program\n", 18 [pid 5860] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5858] close(24 [pid 5829] <... mkdir resumed>) = 0 [pid 5862] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5861] <... write resumed>) = 18 [pid 5860] close(10 [pid 5858] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5862] <... prctl resumed>) = 0 [pid 5861] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=12, insns=0x20000180, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(4, 17, 0), prog_flags=BPF_F_TEST_RND_HI32, prog_name="", prog_ifindex=0, expected_attach_type=0x33 /* BPF_??? */, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 148 [pid 5860] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5858] close(25./strace-static-x86_64: Process 5863 attached [pid 5862] setpgid(0, 0 [pid 5860] close(11 [pid 5858] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5829] <... clone resumed>, child_tidptr=0x55556a2b3650) = 7 [pid 5862] <... setpgid resumed>) = 0 [pid 5860] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5858] close(26 [pid 5860] close(12 [pid 5858] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5860] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5858] close(27 [pid 5860] close(13 [pid 5858] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5860] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5858] close(28 [pid 5860] close(14 [pid 5858] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5860] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5863] set_robust_list(0x55556a2b3660, 24 [pid 5858] close(29 [pid 5860] close(15 [pid 5858] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5860] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5860] close(16 [pid 5858] exit_group(0 [pid 5860] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5858] <... exit_group resumed>) = ? [pid 5860] close(17 [pid 5858] +++ exited with 0 +++ [pid 5860] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5863] <... set_robust_list resumed>) = 0 [pid 5860] close(18 [pid 5828] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5860] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5828] restart_syscall(<... resuming interrupted clone ...> [pid 5860] close(19) = -1 EBADF (Bad file descriptor) [pid 5860] close(20) = -1 EBADF (Bad file descriptor) [pid 5860] close(21 [pid 5862] symlink("/syzcgroup/unified/syz2", "./cgroup" [pid 5860] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5860] close(22) = -1 EBADF (Bad file descriptor) [pid 5860] close(23) = -1 EBADF (Bad file descriptor) [pid 5860] close(24) = -1 EBADF (Bad file descriptor) [pid 5860] close(25) = -1 EBADF (Bad file descriptor) [pid 5860] close(26) = -1 EBADF (Bad file descriptor) [pid 5860] close(27) = -1 EBADF (Bad file descriptor) [pid 5860] close(28) = -1 EBADF (Bad file descriptor) [pid 5860] close(29 [pid 5862] <... symlink resumed>) = 0 [pid 5863] chdir("./5" [pid 5860] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5861] <... bpf resumed>) = 3 [pid 5860] exit_group(0) = ? [pid 5862] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu" [pid 5860] +++ exited with 0 +++ [pid 5825] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5825] restart_syscall(<... resuming interrupted clone ...> [pid 5862] <... symlink resumed>) = 0 [pid 5863] <... chdir resumed>) = 0 [pid 5862] symlink("/syzcgroup/net/syz2", "./cgroup.net" [pid 5861] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="sched_switch", prog_fd=3}}, 24 [pid 5863] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5825] <... restart_syscall resumed>) = 0 [pid 5863] <... prctl resumed>) = 0 [pid 5862] <... symlink resumed>) = 0 [pid 5828] <... restart_syscall resumed>) = 0 [pid 5863] setpgid(0, 0 [pid 5862] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5861] <... bpf resumed>) = 4 [pid 5825] umount2("./4", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5863] <... setpgid resumed>) = 0 [pid 5862] <... openat resumed>) = 3 [pid 5861] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 5828] umount2("./4", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5825] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5828] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5863] symlink("/syzcgroup/unified/syz3", "./cgroup" [pid 5828] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5862] write(3, "1000", 4 [pid 5828] newfstatat(3, "", [pid 5863] <... symlink resumed>) = 0 [pid 5862] <... write resumed>) = 4 [pid 5861] <... openat resumed>) = 5 [pid 5825] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5862] close(3 [pid 5861] write(5, "3", 1 [pid 5828] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=120, ...}, AT_EMPTY_PATH) = 0 [pid 5863] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu" [pid 5828] getdents64(3, [pid 5861] <... write resumed>) = 1 [pid 5825] <... openat resumed>) = 3 [pid 5863] <... symlink resumed>) = 0 [pid 5862] <... close resumed>) = 0 [ 68.341681][ T5860] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 68.349630][ T5860] [ 68.382353][ T5861] FAULT_INJECTION: forcing a failure. [ 68.382353][ T5861] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 68.395399][ T5861] CPU: 0 UID: 0 PID: 5861 Comm: syz-executor388 Not tainted 6.13.0-rc7-syzkaller-00043-g619f0b6fad52 #0 [ 68.406483][ T5861] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 68.416530][ T5861] Call Trace: [ 68.419785][ T5861] [ 68.422692][ T5861] dump_stack_lvl+0x116/0x1f0 [ 68.427367][ T5861] should_fail_ex+0x497/0x5b0 [ 68.432027][ T5861] copy_to_user_nofault+0xac/0x180 [ 68.437175][ T5861] bpf_probe_write_user+0xaf/0xf0 [ 68.442202][ T5861] bpf_prog_6303d92f98284ad8+0x44/0x48 [ 68.447645][ T5861] bpf_trace_run4+0x245/0x5a0 [ 68.452309][ T5861] ? __pfx_bpf_trace_run4+0x10/0x10 [ 68.457511][ T5861] ? psi_task_switch+0x2c1/0x8e0 [ 68.462420][ T5861] ? __pfx_lock_release+0x10/0x10 [ 68.467437][ T5861] ? psi_task_switch+0x2c1/0x8e0 [ 68.472373][ T5861] ? lock_acquire+0x2f/0xb0 [ 68.476859][ T5861] ? psi_task_switch+0x2c1/0x8e0 [ 68.481791][ T5861] __bpf_trace_sched_switch+0x13e/0x190 [ 68.487330][ T5861] ? __pfx___bpf_trace_sched_switch+0x10/0x10 [ 68.493393][ T5861] ? psi_task_switch+0x2c1/0x8e0 [ 68.498325][ T5861] __schedule+0x1b71/0x5ad0 [ 68.502810][ T5861] ? lock_acquire+0x2f/0xb0 [ 68.507305][ T5861] ? __wake_up_sync_key+0x1c/0x50 [ 68.512307][ T5861] ? trace_irq_enable.constprop.0+0xea/0x140 [ 68.518264][ T5861] ? __pfx___schedule+0x10/0x10 [ 68.523096][ T5861] ? lock_release+0x4e2/0x6f0 [ 68.527766][ T5861] ? schedule+0x298/0x350 [ 68.532071][ T5861] ? __pfx_lock_release+0x10/0x10 [ 68.537084][ T5861] ? schedule+0x1fd/0x350 [ 68.541404][ T5861] ? lock_acquire+0x2f/0xb0 [ 68.545880][ T5861] ? schedule+0x1fd/0x350 [ 68.550186][ T5861] schedule+0xe7/0x350 [ 68.554230][ T5861] ptrace_stop.part.0+0x440/0x940 [ 68.559233][ T5861] ptrace_do_notify+0x222/0x2d0 [ 68.564058][ T5861] ? __pfx_ptrace_do_notify+0x10/0x10 [ 68.569405][ T5861] ? rcu_is_watching+0x12/0xc0 [ 68.574146][ T5861] ? lock_acquire+0x2f/0xb0 [ 68.578636][ T5861] ? ptrace_notify+0xb1/0x130 [ 68.583289][ T5861] ptrace_notify+0xc5/0x130 [ 68.587781][ T5861] syscall_exit_to_user_mode_prepare+0x126/0x290 [ 68.594110][ T5861] syscall_exit_to_user_mode+0x11/0x2a0 [ 68.599653][ T5861] do_syscall_64+0xda/0x250 [ 68.604160][ T5861] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 68.610034][ T5861] RIP: 0033:0x7fd4f256db49 [pid 5861] ioctl(-1, SIOCADDRT, 0x20000a80 [pid 5828] <... getdents64 resumed>0x55556a2b46f0 /* 6 entries */, 32768) = 176 [pid 5825] newfstatat(3, "", [pid 5863] symlink("/syzcgroup/net/syz3", "./cgroup.net" [pid 5862] symlink("/dev/binderfs", "./binderfs" [pid 5828] umount2("./4/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5863] <... symlink resumed>) = 0 [pid 5861] <... ioctl resumed>) = -1 EBADF (Bad file descriptor) [pid 5825] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=120, ...}, AT_EMPTY_PATH) = 0 executing program [pid 5863] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5862] <... symlink resumed>) = 0 [pid 5861] close(3 [pid 5828] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5825] getdents64(3, [pid 5863] <... openat resumed>) = 3 [pid 5862] write(1, "executing program\n", 18 [pid 5861] <... close resumed>) = 0 [pid 5828] newfstatat(AT_FDCWD, "./4/cgroup", [pid 5825] <... getdents64 resumed>0x55556a2b46f0 /* 6 entries */, 32768) = 176 [ 68.614425][ T5861] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 1b 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 68.634003][ T5861] RSP: 002b:00007ffebff53808 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 68.642390][ T5861] RAX: fffffffffffffff7 RBX: 0000000000000003 RCX: 00007fd4f256db49 [ 68.650333][ T5861] RDX: 0000000020000a80 RSI: 000000000000890b RDI: 00000000ffffffff [ 68.658283][ T5861] RBP: 0000000000000001 R08: 00007ffebff535a7 R09: 0000000000000000 [ 68.666241][ T5861] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 68.674183][ T5861] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [pid 5863] write(3, "1000", 4 [pid 5862] <... write resumed>) = 18 [pid 5861] close(4 [pid 5828] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5825] umount2("./4/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5863] <... write resumed>) = 4 [pid 5862] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=12, insns=0x20000180, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(4, 17, 0), prog_flags=BPF_F_TEST_RND_HI32, prog_name="", prog_ifindex=0, expected_attach_type=0x33 /* BPF_??? */, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 148 [pid 5861] <... close resumed>) = 0 [pid 5828] unlink("./4/cgroup" [pid 5825] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5863] close(3 [pid 5862] <... bpf resumed>) = 3 [pid 5861] close(5 [pid 5828] <... unlink resumed>) = 0 [pid 5825] newfstatat(AT_FDCWD, "./4/cgroup", [pid 5863] <... close resumed>) = 0 [pid 5862] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="sched_switch", prog_fd=3}}, 24 [pid 5861] <... close resumed>) = 0 [pid 5863] symlink("/dev/binderfs", "./binderfs" [pid 5861] close(6 [pid 5828] umount2("./4/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5861] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5828] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5828] newfstatat(AT_FDCWD, "./4/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5863] <... symlink resumed>) = 0 [pid 5861] close(7 [pid 5828] unlink("./4/cgroup.cpu" [pid 5863] write(1, "executing program\n", 18 [pid 5862] <... bpf resumed>) = 4 executing program [pid 5861] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5828] <... unlink resumed>) = 0 [pid 5825] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5863] <... write resumed>) = 18 [pid 5862] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 5861] close(8 [pid 5828] umount2("./4/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5863] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=12, insns=0x20000180, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(4, 17, 0), prog_flags=BPF_F_TEST_RND_HI32, prog_name="", prog_ifindex=0, expected_attach_type=0x33 /* BPF_??? */, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 148 [pid 5862] <... openat resumed>) = 5 [pid 5861] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5828] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5825] unlink("./4/cgroup" [pid 5862] write(5, "3", 1) = 1 [pid 5828] newfstatat(AT_FDCWD, "./4/cgroup.net", [ 68.682141][ T5861] [ 68.694531][ T5862] FAULT_INJECTION: forcing a failure. [ 68.694531][ T5862] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 68.707582][ T5862] CPU: 1 UID: 0 PID: 5862 Comm: syz-executor388 Not tainted 6.13.0-rc7-syzkaller-00043-g619f0b6fad52 #0 [ 68.718662][ T5862] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 68.728698][ T5862] Call Trace: [ 68.731954][ T5862] [ 68.734882][ T5862] dump_stack_lvl+0x116/0x1f0 [ 68.739540][ T5862] should_fail_ex+0x497/0x5b0 [ 68.744205][ T5862] copy_to_user_nofault+0xac/0x180 [ 68.749320][ T5862] bpf_probe_write_user+0xaf/0xf0 [ 68.754328][ T5862] bpf_prog_6303d92f98284ad8+0x44/0x48 [ 68.759764][ T5862] bpf_trace_run4+0x245/0x5a0 [ 68.764420][ T5862] ? __pfx_bpf_trace_run4+0x10/0x10 [ 68.769609][ T5862] ? psi_task_switch+0x2c1/0x8e0 [ 68.774524][ T5862] ? __pfx_lock_release+0x10/0x10 [ 68.779549][ T5862] ? psi_task_switch+0x2c1/0x8e0 [ 68.784475][ T5862] ? lock_acquire+0x2f/0xb0 [ 68.788964][ T5862] ? psi_task_switch+0x2c1/0x8e0 [ 68.793900][ T5862] __bpf_trace_sched_switch+0x13e/0x190 [ 68.799445][ T5862] ? __pfx___bpf_trace_sched_switch+0x10/0x10 [ 68.805520][ T5862] ? psi_task_switch+0x2c1/0x8e0 [ 68.810452][ T5862] __schedule+0x1b71/0x5ad0 [ 68.814937][ T5862] ? lock_acquire+0x2f/0xb0 [ 68.819425][ T5862] ? __wake_up_sync_key+0x1c/0x50 [ 68.824447][ T5862] ? trace_irq_enable.constprop.0+0xea/0x140 [ 68.830421][ T5862] ? __pfx___schedule+0x10/0x10 [ 68.835247][ T5862] ? lock_release+0x4e2/0x6f0 [ 68.839900][ T5862] ? schedule+0x298/0x350 [ 68.844214][ T5862] ? __pfx_lock_release+0x10/0x10 [ 68.849226][ T5862] ? schedule+0x1fd/0x350 [ 68.853542][ T5862] ? lock_acquire+0x2f/0xb0 [ 68.858032][ T5862] ? schedule+0x1fd/0x350 [ 68.862349][ T5862] schedule+0xe7/0x350 [ 68.866407][ T5862] ptrace_stop.part.0+0x440/0x940 [ 68.871426][ T5862] ptrace_do_notify+0x222/0x2d0 [ 68.876264][ T5862] ? __pfx_ptrace_do_notify+0x10/0x10 [ 68.881624][ T5862] ? rcu_is_watching+0x12/0xc0 [ 68.886379][ T5862] ? lock_acquire+0x2f/0xb0 [ 68.890864][ T5862] ? ptrace_notify+0xb1/0x130 [ 68.895530][ T5862] ptrace_notify+0xc5/0x130 [ 68.900020][ T5862] syscall_exit_to_user_mode_prepare+0x126/0x290 [ 68.906339][ T5862] syscall_exit_to_user_mode+0x11/0x2a0 [ 68.911875][ T5862] do_syscall_64+0xda/0x250 [ 68.916367][ T5862] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 68.922251][ T5862] RIP: 0033:0x7fd4f256db49 [ 68.926652][ T5862] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 1b 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 68.946341][ T5862] RSP: 002b:00007ffebff53808 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 68.954738][ T5862] RAX: fffffffffffffff7 RBX: 0000000000000003 RCX: 00007fd4f256db49 [ 68.962693][ T5862] RDX: 0000000020000a80 RSI: 000000000000890b RDI: 00000000ffffffff [ 68.970649][ T5862] RBP: 0000000000000001 R08: 00007ffebff535a7 R09: 0000000000000000 [pid 5862] ioctl(-1, SIOCADDRT, 0x20000a80 [pid 5828] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5863] <... bpf resumed>) = 3 [pid 5862] <... ioctl resumed>) = -1 EBADF (Bad file descriptor) [pid 5861] close(9 [pid 5825] <... unlink resumed>) = 0 [pid 5863] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="sched_switch", prog_fd=3}}, 24 [pid 5862] close(3 [pid 5861] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5828] unlink("./4/cgroup.net" [pid 5825] umount2("./4/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5863] <... bpf resumed>) = 4 [pid 5862] <... close resumed>) = 0 [pid 5861] close(10 [pid 5828] <... unlink resumed>) = 0 [pid 5825] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5863] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 5862] close(4 [pid 5861] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5828] umount2("./4/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5825] newfstatat(AT_FDCWD, "./4/cgroup.cpu", [pid 5863] <... openat resumed>) = 5 [pid 5862] <... close resumed>) = 0 [pid 5861] close(11 [pid 5828] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5825] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5863] write(5, "3", 1 [pid 5862] close(5 [pid 5861] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 5828] newfstatat(AT_FDCWD, "./4/binderfs", [pid 5825] unlink("./4/cgroup.cpu" [pid 5863] <... write resumed>) = 1 [pid 5862] <... close resumed>) = 0 [pid 5861] close(12 [pid 5828] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5825] <... unlink resumed>) = 0 [ 68.978605][ T5862] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 68.986567][ T5862] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 68.994527][ T5862] [ 69.005046][ T5863] FAULT_INJECTION: forcing a failure. [ 69.005046][ T5863] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 69.018075][ T5863] CPU: 0 UID: 0 PID: 5863 Comm: syz-executor388 Not tainted 6.13.0-rc7-syzkaller-00043-g619f0b6fad52 #0 [ 69.029159][ T5863] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 69.039188][ T5863] Call Trace: [ 69.042442][ T5863] [ 69.045349][ T5863] dump_stack_lvl+0x116/0x1f0 [ 69.050028][ T5863] should_fail_ex+0x497/0x5b0 [ 69.054683][ T5863] copy_to_user_nofault+0xac/0x180 [ 69.059771][ T5863] bpf_probe_write_user+0xaf/0xf0 [ 69.064773][ T5863] bpf_prog_6303d92f98284ad8+0x44/0x48 [ 69.070226][ T5863] bpf_trace_run4+0x245/0x5a0 [ 69.074878][ T5863] ? __pfx_bpf_trace_run4+0x10/0x10 [ 69.080047][ T5863] ? psi_task_switch+0x2c1/0x8e0