./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor341551155 <...> Warning: Permanently added '10.128.1.138' (ECDSA) to the list of known hosts. execve("./syz-executor341551155", ["./syz-executor341551155"], 0x7fff651cb9d0 /* 10 vars */) = 0 brk(NULL) = 0x555556d80000 brk(0x555556d80c40) = 0x555556d80c40 arch_prctl(ARCH_SET_FS, 0x555556d80300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor341551155", 4096) = 27 brk(0x555556da1c40) = 0x555556da1c40 brk(0x555556da2000) = 0x555556da2000 mprotect(0x7f6a6f4fd000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 getpid() = 4993 mkdir("./syzkaller.WOouXJ", 0700) = 0 chmod("./syzkaller.WOouXJ", 0777) = 0 chdir("./syzkaller.WOouXJ") = 0 mkdir("./0", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d805d0) = 4994 ./strace-static-x86_64: Process 4994 attached [pid 4994] chdir("./0") = 0 [pid 4994] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 4994] setpgid(0, 0) = 0 [pid 4994] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 4994] write(3, "1000", 4) = 4 [pid 4994] close(3) = 0 [pid 4994] symlink("/dev/binderfs", "./binderfs") = 0 [pid 4994] memfd_create("syzkaller", 0) = 3 [pid 4994] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6a67020000 [pid 4994] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576 [pid 4994] munmap(0x7f6a67020000, 1048576) = 0 [pid 4994] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 4994] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 4994] close(3) = 0 [pid 4994] mkdir("./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", 0777) = 0 [ 56.744774][ T4994] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=4994 'syz-executor341' [ 56.771079][ T4994] loop0: detected capacity change from 0 to 2048 [pid 4994] mount("/dev/loop0", "./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "udf", MS_NODIRATIME, "") = 0 [pid 4994] openat(AT_FDCWD, "./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", O_RDONLY|O_DIRECTORY) = 3 [pid 4994] chdir("./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa") = 0 [pid 4994] ioctl(4, LOOP_CLR_FD) = 0 [pid 4994] close(4) = 0 [pid 4994] unlink(NULL) = -1 EFAULT (Bad address) [pid 4994] memfd_create("syzkaller", 0) = 4 [pid 4994] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6a5ed20000 [pid 4994] write(4, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 4994] munmap(0x7f6a5ed20000, 131072) = 0 [pid 4994] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 4994] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 4994] ioctl(5, LOOP_CLR_FD) = 0 [pid 4994] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 4994] close(5) = 0 [pid 4994] close(4) = 0 [ 56.786757][ T4994] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [pid 4994] creat("./bus", 000) = 4 [pid 4994] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0 [pid 4994] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 5 [pid 4994] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0) = 0x20000000 [pid 4994] memfd_create("syzkaller", 0) = 6 [pid 4994] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6a56940000 [pid 4994] write(6, "\xeb\x52\x90\x4e\x54\x46\x53\x20\x20\x20\x20\x00\x10\x01\x00\x00\x00\x00\x00\x00\x00\xf8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x80\x00\xff\x01\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x78\x5f\xaa\x3b\xd7\x0e\xce\x68\x00\x00\x00\x00\x0e\x1f\xbe\x71\x7c\xac\x22\xc0\x74\x0b\x56\xb4\x0e\xbb\x07\x00"..., 2097152) = 2097152 [pid 4994] munmap(0x7f6a56940000, 2097152) = 0 [pid 4994] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 4994] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 4994] ioctl(7, LOOP_CLR_FD) = 0 [pid 4994] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 4994] close(7) = 0 [pid 4994] close(6) = 0 [pid 4994] exit_group(0) = ? [pid 4994] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4994, si_uid=0, si_status=0, si_utime=0, si_stime=6 /* 0.06 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x555556d81620 /* 4 entries */, 32768) = 352 [ 56.928270][ T4993] BUG: unable to handle page fault for address: ffffed101923c17d [ 56.936017][ T4993] #PF: supervisor read access in kernel mode [ 56.941971][ T4993] #PF: error_code(0x0000) - not-present page [ 56.947934][ T4993] PGD 23ffee067 P4D 23ffee067 PUD 13fff5067 PMD 0 [ 56.954430][ T4993] Oops: 0000 [#1] PREEMPT SMP KASAN [ 56.959622][ T4993] CPU: 0 PID: 4993 Comm: syz-executor341 Not tainted 6.4.0-rc7-syzkaller-00226-ga92b7d26c743 #0 [ 56.970008][ T4993] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 [ 56.980042][ T4993] RIP: 0010:udf_close_lvid+0x14c/0x9a0 [ 56.985505][ T4993] Code: dc 49 83 c4 50 0f 84 f3 00 00 00 49 8d bf c0 00 00 00 48 89 7c 24 40 31 f6 e8 20 58 b8 07 49 8d 7c 24 18 48 89 f8 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 3d 05 00 00 4c 89 7c 24 18 4c 89 74 24 [ 57.005096][ T4993] RSP: 0018:ffffc90003a2fb00 EFLAGS: 00010a06 [ 57.011144][ T4993] RAX: 1ffff1101923c17d RBX: ffff8880763dc000 RCX: 0000000000000001 [ 57.019115][ T4993] RDX: 0000000000000000 RSI: ffffffff8b384840 RDI: ffff8880c91e0be8 [ 57.027083][ T4993] RBP: ffffc90003a2fbe8 R08: dffffc0000000000 R09: fffffbfff1cabba6 [ 57.035042][ T4993] R10: 0000000000000000 R11: dffffc0000000001 R12: ffff8880c91e0bd0 [ 57.043010][ T4993] R13: dffffc0000000000 R14: 1ffff92000745f6c R15: ffff88807d183400 [ 57.051055][ T4993] FS: 0000555556d80300(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 [ 57.059971][ T4993] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 57.066540][ T4993] CR2: ffffed101923c17d CR3: 0000000073647000 CR4: 00000000003506f0 [ 57.074500][ T4993] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 57.082457][ T4993] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 57.090412][ T4993] Call Trace: [ 57.093680][ T4993] [ 57.096599][ T4993] ? __die_body+0x5e/0xa0 [ 57.100922][ T4993] ? page_fault_oops+0x802/0xaa0 [ 57.105851][ T4993] ? kernelmode_fixup_or_oops+0x2a0/0x2a0 [ 57.111566][ T4993] ? page_fault_oops+0xaa0/0xaa0 [ 57.116500][ T4993] ? kernelmode_fixup_or_oops+0x225/0x2a0 [ 57.122214][ T4993] ? __bad_area_nosemaphore+0x12a/0x730 [ 57.127754][ T4993] ? trace_contention_end+0x3c/0xf0 [ 57.133027][ T4993] ? bad_area_nosemaphore+0x30/0x30 [ 57.138212][ T4993] ? __mutex_lock_common+0x42d/0x2530 [ 57.143573][ T4993] ? exc_page_fault+0x368/0x910 [ 57.148413][ T4993] ? mutex_lock_io_nested+0x60/0x60 [ 57.153596][ T4993] ? asm_exc_page_fault+0x26/0x30 [ 57.158612][ T4993] ? udf_close_lvid+0x14c/0x9a0 [ 57.163454][ T4993] ? hook_inode_free_security+0xb0/0xb0 [ 57.168986][ T4993] ? udf_open_lvid+0x5b0/0x5b0 [ 57.173741][ T4993] ? iput+0x37e/0x8f0 [ 57.177711][ T4993] ? clear_inode+0x150/0x150 [ 57.182292][ T4993] udf_put_super+0xcd/0x160 [ 57.186785][ T4993] ? udf_free_in_core_inode+0x30/0x30 [ 57.192146][ T4993] generic_shutdown_super+0x134/0x340 [ 57.197854][ T4993] kill_block_super+0x84/0xf0 [ 57.202519][ T4993] deactivate_locked_super+0xa4/0x110 [ 57.207878][ T4993] cleanup_mnt+0x426/0x4c0 [ 57.212286][ T4993] ? _raw_spin_unlock_irq+0x23/0x50 [ 57.217470][ T4993] task_work_run+0x24a/0x300 [ 57.222045][ T4993] ? dput+0x3a1/0x420 [ 57.226080][ T4993] ? task_work_cancel+0x2b0/0x2b0 [ 57.231089][ T4993] ? __x64_sys_umount+0x126/0x170 [ 57.236099][ T4993] ptrace_notify+0x2cd/0x380 [ 57.240676][ T4993] ? do_notify_parent+0xf50/0xf50 [ 57.245710][ T4993] ? user_path_at_empty+0x12f/0x180 [ 57.250898][ T4993] ? __x64_sys_umount+0x126/0x170 [ 57.255912][ T4993] ? path_umount+0xea0/0xea0 [ 57.260487][ T4993] ? syscall_enter_from_user_mode+0x32/0x230 [ 57.266457][ T4993] syscall_exit_to_user_mode+0x157/0x280 [ 57.272078][ T4993] do_syscall_64+0x4d/0xc0 [ 57.276479][ T4993] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 57.282363][ T4993] RIP: 0033:0x7f6a6f46efe7 [ 57.286767][ T4993] Code: 09 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 57.306357][ T4993] RSP: 002b:00007fff71033af8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [ 57.314777][ T4993] RAX: 0000000000000000 RBX: 000000000000dd88 RCX: 00007f6a6f46efe7 [ 57.322746][ T4993] RDX: 00007fff71033cac RSI: 000000000000000a RDI: 00007fff71033bb0 [ 57.330798][ T4993] RBP: 00007fff71033bb0 R08: 000000000000000c R09: 00007fff71033990 [ 57.338761][ T4993] R10: 0000555556d81633 R11: 0000000000000202 R12: 00007fff71034c20 [ 57.346737][ T4993] R13: 0000555556d815f0 R14: 00007fff71033b20 R15: 0000000000000001 [ 57.354797][ T4993] [ 57.357806][ T4993] Modules linked in: [ 57.361694][ T4993] CR2: ffffed101923c17d [ 57.365849][ T4993] ---[ end trace 0000000000000000 ]--- [ 57.371291][ T4993] RIP: 0010:udf_close_lvid+0x14c/0x9a0 [ 57.376752][ T4993] Code: dc 49 83 c4 50 0f 84 f3 00 00 00 49 8d bf c0 00 00 00 48 89 7c 24 40 31 f6 e8 20 58 b8 07 49 8d 7c 24 18 48 89 f8 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 3d 05 00 00 4c 89 7c 24 18 4c 89 74 24 [ 57.396353][ T4993] RSP: 0018:ffffc90003a2fb00 EFLAGS: 00010a06 [ 57.402410][ T4993] RAX: 1ffff1101923c17d RBX: ffff8880763dc000 RCX: 0000000000000001 [ 57.410366][ T4993] RDX: 0000000000000000 RSI: ffffffff8b384840 RDI: ffff8880c91e0be8 [ 57.418324][ T4993] RBP: ffffc90003a2fbe8 R08: dffffc0000000000 R09: fffffbfff1cabba6 [ 57.426282][ T4993] R10: 0000000000000000 R11: dffffc0000000001 R12: ffff8880c91e0bd0 [ 57.434242][ T4993] R13: dffffc0000000000 R14: 1ffff92000745f6c R15: ffff88807d183400 [ 57.442205][ T4993] FS: 0000555556d80300(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 [ 57.451384][ T4993] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 57.457953][ T4993] CR2: ffffed101923c17d CR3: 0000000073647000 CR4: 00000000003506f0 [ 57.465914][ T4993] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 57.473871][ T4993] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 57.481827][ T4993] Kernel panic - not syncing: Fatal exception [ 57.488027][ T4993] Kernel Offset: disabled [ 57.492339][ T4993] Rebooting in 86400 seconds..