./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor912538545 <...> Warning: Permanently added '10.128.1.24' (ED25519) to the list of known hosts. execve("./syz-executor912538545", ["./syz-executor912538545"], 0x7ffcdcb28df0 /* 10 vars */) = 0 brk(NULL) = 0x55559162d000 brk(0x55559162dd00) = 0x55559162dd00 arch_prctl(ARCH_SET_FS, 0x55559162d380) = 0 set_tid_address(0x55559162d650) = 5829 set_robust_list(0x55559162d660, 24) = 0 rseq(0x55559162dca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor912538545", 4096) = 27 getrandom("\xfc\x0b\x39\x9d\x3d\xa0\x7b\x51", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55559162dd00 brk(0x55559164ed00) = 0x55559164ed00 brk(0x55559164f000) = 0x55559164f000 mprotect(0x7fca0e859000, 16384, PROT_READ) = 0 mmap(0x3ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x3ffffffff000 mmap(0x400000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x400000000000 mmap(0x400001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x400001000000 mkdir("./syzkaller.V7yCNT", 0700) = 0 chmod("./syzkaller.V7yCNT", 0777) = 0 chdir("./syzkaller.V7yCNT") = 0 mkdir("./0", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5830 attached [pid 5830] set_robust_list(0x55559162d660, 24) = 0 [pid 5830] chdir("./0" [pid 5829] <... clone resumed>, child_tidptr=0x55559162d650) = 5830 [pid 5830] <... chdir resumed>) = 0 [pid 5830] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5830] setpgid(0, 0) = 0 [pid 5830] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5830] write(3, "1000", 4) = 4 [pid 5830] close(3) = 0 [pid 5830] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5830] write(1, "executing program\n", 18executing program ) = 18 [pid 5830] memfd_create("syzkaller", 0) = 3 [pid 5830] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fca06200000 [pid 5830] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 5830] munmap(0x7fca06200000, 138412032) = 0 [pid 5830] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5830] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5830] close(3) = 0 [pid 5830] close(4) = 0 [pid 5830] mkdir("./bus", 0777) = 0 [ 85.323799][ T5830] loop0: detected capacity change from 0 to 512 [ 85.366665][ T5830] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 85.381002][ T5830] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 85.397987][ T5830] EXT4-fs warning (device loop0): ext4_expand_extra_isize_ea:2863: Unable to expand inode 11. Delete some EAs or run e2fsck. [pid 5830] mount("/dev/loop0", "./bus", "ext4", MS_NOSUID|MS_NOEXEC|MS_SYNCHRONOUS|MS_POSIXACL, "quota,resuid=0x000000000000ee01,barrier=0x0000000000000003,debug_want_extra_isize=0x0000000000000080"...) = 0 [pid 5830] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 5830] chdir("./bus") = 0 [pid 5830] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5830] mount(NULL, "./file0", "overlay", 0, "lowerdir=./file0:/") = 0 [pid 5830] exit_group(0) = ? [pid 5830] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5830, si_uid=0, si_status=0, si_utime=0, si_stime=7 /* 0.07 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [ 85.412339][ T5830] EXT4-fs (loop0): 1 truncate cleaned up [ 85.419026][ T5830] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. getdents64(3, 0x55559162e6f0 /* 4 entries */, 32768) = 104 umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./0/binderfs") = 0 umount2("./0/bus", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EBUSY (Device or resource busy) newfstatat(AT_FDCWD, "./0/bus", {st_mode=S_IFDIR|0755, st_size=1024, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./0/bus", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EBUSY (Device or resource busy) openat(AT_FDCWD, "./0/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0755, st_size=1024, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555591636730 /* 8 entries */, 32768) = 240 umount2("./0/bus/lost+found", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/bus/lost+found", {st_mode=S_IFDIR|0700, st_size=11264, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./0/bus/lost+found", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./0/bus/lost+found", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 5 newfstatat(5, "", {st_mode=S_IFDIR|0700, st_size=11264, ...}, AT_EMPTY_PATH) = 0 getdents64(5, 0x55559163e770 /* 2 entries */, 32768) = 48 getdents64(5, 0x55559163e770 /* 0 entries */, 32768) = 0 close(5) = 0 rmdir("./0/bus/lost+found") = 0 umount2("./0/bus/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/bus/file2", {st_mode=S_IFREG|0755, st_size=9000, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./0/bus/file2") = 0 umount2("./0/bus/file.cold", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/bus/file.cold", {st_mode=S_IFREG|0755, st_size=100, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./0/bus/file.cold") = 0 umount2("./0/bus/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/bus/file1", {st_mode=S_IFREG|0755, st_size=10, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./0/bus/file1") = 0 umount2("./0/bus/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./0/bus/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/bus/file0", {st_mode=S_IFDIR|0755, st_size=60, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./0/bus/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./0/bus/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 5 newfstatat(5, "", {st_mode=S_IFDIR|0755, st_size=60, ...}, AT_EMPTY_PATH) = 0 getdents64(5, 0x55559163e770 /* 4 entries */, 32768) = 112 [ 85.873873][ T5829] ------------[ cut here ]------------ [ 85.879815][ T5829] bad length passed for symlink [/tmp/syz-imagegen2884317625/] (got 39, expected 29) [ 85.880048][ T5829] WARNING: CPU: 1 PID: 5829 at ./include/linux/fs.h:803 inode_set_cached_link+0xd0/0x110 [ 85.899816][ T5829] Modules linked in: [ 85.903794][ T5829] CPU: 1 UID: 0 PID: 5829 Comm: syz-executor912 Not tainted 6.14.0-rc2-syzkaller-00303-gad1b832bf1cf #0 [ 85.915035][ T5829] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 85.925223][ T5829] RIP: 0010:inode_set_cached_link+0xd0/0x110 [ 85.931297][ T5829] Code: 41 5f 5d c3 cc cc cc cc e8 9d 4c 45 ff c6 05 7c 62 a9 0d 01 90 48 c7 c7 20 c8 3d 8c 4c 89 f6 44 89 fa 89 e9 e8 51 0f 05 ff 90 <0f> 0b 90 90 e9 6a ff ff ff 89 f9 80 e1 07 80 c1 03 38 c1 7c a1 e8 [ 85.951049][ T5829] RSP: 0018:ffffc90003eef698 EFLAGS: 00010246 [ 85.957218][ T5829] RAX: b88ee7a8f5fa8a00 RBX: ffff888073178c98 RCX: ffff888030209e00 [ 85.965250][ T5829] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 85.973408][ T5829] RBP: 000000000000001d R08: ffffffff81817d42 R09: 1ffff110170e519a [ 85.981511][ T5829] R10: dffffc0000000000 R11: ffffed10170e519b R12: ffff888073178c98 [ 85.989808][ T5829] R13: dffffc0000000000 R14: ffff8880731789e8 R15: 0000000000000027 [ 86.001508][ T5829] FS: 000055559162d380(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000 [ 86.010689][ T5829] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 86.017417][ T5829] CR2: 00007ffef68b2fa8 CR3: 0000000076578000 CR4: 00000000003526f0 [ 86.025703][ T5829] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 86.035114][ T5829] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 86.043267][ T5829] Call Trace: [ 86.047409][ T5829] [ 86.050401][ T5829] ? __warn+0x165/0x4d0 [ 86.054631][ T5829] ? inode_set_cached_link+0xd0/0x110 [ 86.060164][ T5829] ? report_bug+0x2b3/0x500 [ 86.065142][ T5829] ? inode_set_cached_link+0xd0/0x110 [ 86.070929][ T5829] ? handle_bug+0x60/0x90 [ 86.078990][ T5829] ? exc_invalid_op+0x1a/0x50 [ 86.083920][ T5829] ? asm_exc_invalid_op+0x1a/0x20 [ 86.089134][ T5829] ? __warn_printk+0x292/0x360 [ 86.094339][ T5829] ? inode_set_cached_link+0xd0/0x110 [ 86.100339][ T5829] ? inode_set_cached_link+0xcf/0x110 [ 86.105877][ T5829] __ext4_iget+0x2ea4/0x3f30 [ 86.110960][ T5829] ? __pfx_lock_release+0x10/0x10 [ 86.116247][ T5829] ? __pfx___ext4_iget+0x10/0x10 [ 86.121486][ T5829] ? ext4_fname_free_filename+0x89/0xb0 [ 86.127255][ T5829] ? rcu_is_watching+0x15/0xb0 [ 86.132148][ T5829] ? ext4_fname_free_filename+0x89/0xb0 [ 86.137828][ T5829] ? kfree+0x4e/0x430 [ 86.141857][ T5829] ext4_lookup+0x3e3/0x750 [ 86.146392][ T5829] ? __pfx_ext4_lookup+0x10/0x10 [ 86.151569][ T5829] ? __init_waitqueue_head+0xae/0x150 [ 86.157173][ T5829] __lookup_slow+0x296/0x400 [ 86.161821][ T5829] ? __pfx___lookup_slow+0x10/0x10 [ 86.167127][ T5829] ? make_vfsuid+0x52/0xa0 [ 86.171630][ T5829] ? lookup_fast+0x17a/0x590 [ 86.176311][ T5829] lookup_slow+0x53/0x70 [ 86.180719][ T5829] walk_component+0x2e1/0x410 [ 86.185419][ T5829] path_lookupat+0x16f/0x450 [ 86.190138][ T5829] filename_lookup+0x2a3/0x670 [ 86.194974][ T5829] ? __virt_addr_valid+0x183/0x530 [ 86.200176][ T5829] ? __pfx_filename_lookup+0x10/0x10 [ 86.205951][ T5829] ? strncpy_from_user+0x146/0x270 [ 86.211091][ T5829] ? getname_flags+0x1e3/0x540 [ 86.215964][ T5829] user_path_at+0x3a/0x60 [ 86.220511][ T5829] __x64_sys_umount+0xf1/0x170 [ 86.225892][ T5829] ? __pfx___x64_sys_umount+0x10/0x10 [ 86.231307][ T5829] ? exc_page_fault+0x590/0x8b0 [ 86.236246][ T5829] do_syscall_64+0xf3/0x230 [ 86.240791][ T5829] ? clear_bhb_loop+0x35/0x90 [ 86.245521][ T5829] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.251546][ T5829] RIP: 0033:0x7fca0e7e6547 [ 86.256120][ T5829] Code: 07 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 [ 86.275957][ T5829] RSP: 002b:00007ffef68b3178 EFLAGS: 00000206 ORIG_RAX: 00000000000000a6 [ 86.284420][ T5829] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fca0e7e6547 [ 86.292496][ T5829] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffef68b3230 [ 86.300700][ T5829] RBP: 00007ffef68b3230 R08: 0000000000000000 R09: 0000000000000000 [ 86.308782][ T5829] R10: 00000000ffffffff R11: 0000000000000206 R12: 00007ffef68b4320 [ 86.317165][ T5829] R13: 000055559163e740 R14: 431bde82d7b634db R15: 00007ffef68b64a0 [ 86.325211][ T5829] [ 86.328582][ T5829] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 86.336776][ T5829] CPU: 1 UID: 0 PID: 5829 Comm: syz-executor912 Not tainted 6.14.0-rc2-syzkaller-00303-gad1b832bf1cf #0 [ 86.349079][ T5829] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 86.359917][ T5829] Call Trace: [ 86.363959][ T5829] [ 86.366939][ T5829] dump_stack_lvl+0x241/0x360 [ 86.371938][ T5829] ? __pfx_dump_stack_lvl+0x10/0x10 [ 86.377168][ T5829] ? __pfx__printk+0x10/0x10 [ 86.382297][ T5829] ? vscnprintf+0x5d/0x90 [ 86.386781][ T5829] panic+0x349/0x880 [ 86.390732][ T5829] ? __warn+0x174/0x4d0 [ 86.394961][ T5829] ? __pfx_panic+0x10/0x10 [ 86.399432][ T5829] __warn+0x344/0x4d0 [ 86.403436][ T5829] ? inode_set_cached_link+0xd0/0x110 [ 86.409012][ T5829] report_bug+0x2b3/0x500 [ 86.413576][ T5829] ? inode_set_cached_link+0xd0/0x110 [ 86.418991][ T5829] handle_bug+0x60/0x90 [ 86.423197][ T5829] exc_invalid_op+0x1a/0x50 [ 86.427720][ T5829] asm_exc_invalid_op+0x1a/0x20 [ 86.433053][ T5829] RIP: 0010:inode_set_cached_link+0xd0/0x110 [ 86.439168][ T5829] Code: 41 5f 5d c3 cc cc cc cc e8 9d 4c 45 ff c6 05 7c 62 a9 0d 01 90 48 c7 c7 20 c8 3d 8c 4c 89 f6 44 89 fa 89 e9 e8 51 0f 05 ff 90 <0f> 0b 90 90 e9 6a ff ff ff 89 f9 80 e1 07 80 c1 03 38 c1 7c a1 e8 [ 86.458892][ T5829] RSP: 0018:ffffc90003eef698 EFLAGS: 00010246 [ 86.465010][ T5829] RAX: b88ee7a8f5fa8a00 RBX: ffff888073178c98 RCX: ffff888030209e00 [ 86.473157][ T5829] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 86.481248][ T5829] RBP: 000000000000001d R08: ffffffff81817d42 R09: 1ffff110170e519a [ 86.489352][ T5829] R10: dffffc0000000000 R11: ffffed10170e519b R12: ffff888073178c98 [ 86.497441][ T5829] R13: dffffc0000000000 R14: ffff8880731789e8 R15: 0000000000000027 [ 86.505547][ T5829] ? __warn_printk+0x292/0x360 [ 86.512337][ T5829] ? inode_set_cached_link+0xcf/0x110 [ 86.517749][ T5829] __ext4_iget+0x2ea4/0x3f30 [ 86.522796][ T5829] ? __pfx_lock_release+0x10/0x10 [ 86.528123][ T5829] ? __pfx___ext4_iget+0x10/0x10 [ 86.533274][ T5829] ? ext4_fname_free_filename+0x89/0xb0 [ 86.539446][ T5829] ? rcu_is_watching+0x15/0xb0 [ 86.544786][ T5829] ? ext4_fname_free_filename+0x89/0xb0 [ 86.551158][ T5829] ? kfree+0x4e/0x430 [ 86.555367][ T5829] ext4_lookup+0x3e3/0x750 [ 86.559816][ T5829] ? __pfx_ext4_lookup+0x10/0x10 [ 86.564790][ T5829] ? __init_waitqueue_head+0xae/0x150 [ 86.570283][ T5829] __lookup_slow+0x296/0x400 [ 86.574902][ T5829] ? __pfx___lookup_slow+0x10/0x10 [ 86.580131][ T5829] ? make_vfsuid+0x52/0xa0 [ 86.584590][ T5829] ? lookup_fast+0x17a/0x590 [ 86.589289][ T5829] lookup_slow+0x53/0x70 [ 86.593569][ T5829] walk_component+0x2e1/0x410 [ 86.598262][ T5829] path_lookupat+0x16f/0x450 [ 86.603051][ T5829] filename_lookup+0x2a3/0x670 [ 86.607837][ T5829] ? __virt_addr_valid+0x183/0x530 [ 86.612990][ T5829] ? __pfx_filename_lookup+0x10/0x10 [ 86.618497][ T5829] ? strncpy_from_user+0x146/0x270 [ 86.623749][ T5829] ? getname_flags+0x1e3/0x540 [ 86.628531][ T5829] user_path_at+0x3a/0x60 [ 86.632880][ T5829] __x64_sys_umount+0xf1/0x170 [ 86.637669][ T5829] ? __pfx___x64_sys_umount+0x10/0x10 [ 86.643074][ T5829] ? exc_page_fault+0x590/0x8b0 [ 86.647965][ T5829] do_syscall_64+0xf3/0x230 [ 86.652498][ T5829] ? clear_bhb_loop+0x35/0x90 [ 86.657199][ T5829] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.663120][ T5829] RIP: 0033:0x7fca0e7e6547 [ 86.667641][ T5829] Code: 07 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 [ 86.687829][ T5829] RSP: 002b:00007ffef68b3178 EFLAGS: 00000206 ORIG_RAX: 00000000000000a6 [ 86.696359][ T5829] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fca0e7e6547 [ 86.704364][ T5829] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffef68b3230 [ 86.712355][ T5829] RBP: 00007ffef68b3230 R08: 0000000000000000 R09: 0000000000000000 [ 86.720487][ T5829] R10: 00000000ffffffff R11: 0000000000000206 R12: 00007ffef68b4320 [ 86.728579][ T5829] R13: 000055559163e740 R14: 431bde82d7b634db R15: 00007ffef68b64a0 [ 86.736689][ T5829] [ 86.741707][ T5829] Kernel Offset: disabled [ 86.746105][ T5829] Rebooting in 86400 seconds..