./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor971580519 <...> = -1 EBADF (Bad file descriptor) [pid 567] close(19) = -1 EBADF (Bad file descriptor) [pid 567] close(20) = -1 EBADF (Bad file descriptor) [pid 567] close(21) = -1 EBADF (Bad file descriptor) [pid 567] close(22) = -1 EBADF (Bad file descriptor) [pid 567] close(23) = -1 EBADF (Bad file descriptor) [pid 567] close(24) = -1 EBADF (Bad file descriptor) [pid 567] close(25) = -1 EBADF (Bad file descriptor) [pid 567] close(26) = -1 EBADF (Bad file descriptor) [pid 567] close(27) = -1 EBADF (Bad file descriptor) [pid 567] close(28) = -1 EBADF (Bad file descriptor) [pid 567] close(29) = -1 EBADF (Bad file descriptor) [pid 567] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 567] exit_group(0) = ? write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory [pid 567] +++ exited with 0 +++ [pid 383] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=27, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 383] umount2("./25", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] openat(AT_FDCWD, "./25", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 383] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 383] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 383] umount2("./25/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./25/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 383] unlink("./25/binderfs") = 0 [pid 383] umount2("./25/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./25/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 383] unlink("./25/cgroup") = 0 [pid 383] umount2("./25/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./25/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 383] unlink("./25/cgroup.net") = 0 [pid 383] umount2("./25/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 383] umount2("./25/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./25/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 383] umount2("./25/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] openat(AT_FDCWD, "./25/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 383] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 383] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 383] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 383] close(4) = 0 [pid 383] rmdir("./25/file0") = 0 [pid 383] umount2("./25/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./25/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 383] unlink("./25/cgroup.cpu") = 0 [pid 383] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 383] close(3) = 0 [pid 383] rmdir("./25") = 0 [pid 383] mkdir("./26", 0777) = 0 [pid 383] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 570 attached [pid 570] chdir("./26") = 0 [pid 383] <... clone resumed>, child_tidptr=0x555556fab5d0) = 28 [pid 570] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 570] setpgid(0, 0) = 0 [pid 570] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 570] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 570] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [pid 570] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 570] write(3, "1000", 4) = 4 [pid 570] close(3) = 0 [pid 570] symlink("/dev/binderfs", "./binderfs") = 0 [pid 570] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 570] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 570] open("./file0", O_RDONLY) = 3 [pid 570] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [ 110.169481][ T567] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 110.177441][ T567] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 110.185399][ T567] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 110.193444][ T567] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 110.201395][ T567] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000019 [ 110.211938][ T567] cgroup: cgroup_addrm_files: failed to add max, err=-12 [pid 570] write(4, "-pids ", 6) = 6 [pid 570] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 570] write(5, "22", 2) = 2 [ 110.250931][ T566] FAULT_INJECTION: forcing a failure. [ 110.250931][ T566] name failslab, interval 1, probability 0, space 0, times 0 [ 110.263638][ T566] CPU: 0 PID: 566 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 110.275338][ T566] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 110.285389][ T566] Call Trace: [ 110.288661][ T566] dump_stack_lvl+0x1e2/0x24b [ 110.293336][ T566] ? bfq_pos_tree_add_move+0x43e/0x43e [ 110.298866][ T566] ? selinux_kernfs_init_security+0x1a8/0x760 [ 110.304919][ T566] dump_stack+0x15/0x17 [ 110.309065][ T566] should_fail+0x3c0/0x510 [ 110.313464][ T566] ? __kernfs_new_node+0x99/0x6e0 [ 110.318474][ T566] __should_failslab+0x9f/0xe0 [ 110.323223][ T566] should_failslab+0x9/0x20 [ 110.327702][ T566] __kmalloc_track_caller+0x5f/0x350 [ 110.332971][ T566] kstrdup_const+0x55/0x90 [ 110.337400][ T566] __kernfs_new_node+0x99/0x6e0 [ 110.342236][ T566] ? is_module_text_address+0xe1/0x140 [ 110.347681][ T566] ? kernfs_new_node+0x170/0x170 [ 110.352605][ T566] ? ptr_to_hashval+0x60/0x60 [ 110.357435][ T566] ? arch_stack_walk+0xf8/0x140 [ 110.362275][ T566] ? snprintf+0xd6/0x120 [ 110.366508][ T566] kernfs_new_node+0x97/0x170 [ 110.371169][ T566] __kernfs_create_file+0x4a/0x270 [ 110.376266][ T566] cgroup_addrm_files+0xab8/0xfe0 [ 110.381279][ T566] ? ____kasan_kmalloc+0xdc/0x110 [ 110.386283][ T566] ? __kasan_kmalloc+0x9/0x10 [ 110.390958][ T566] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 110.396494][ T566] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 110.402631][ T566] ? delete_node+0x759/0x7b0 [ 110.407218][ T566] ? __kasan_check_read+0x11/0x20 [ 110.412227][ T566] ? delete_node+0x759/0x7b0 [ 110.416799][ T566] ? __kasan_check_write+0x14/0x20 [ 110.421898][ T566] ? idr_replace+0x1c4/0x230 [ 110.426484][ T566] ? idr_get_next+0x4b0/0x4b0 [ 110.431153][ T566] ? _raw_spin_lock_bh+0xa3/0x1b0 [ 110.436162][ T566] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 110.441434][ T566] css_populate_dir+0x137/0x370 [ 110.446274][ T566] cgroup_apply_control_enable+0x8b9/0x12f0 [ 110.452144][ T566] cgroup_apply_control+0x93/0x710 [ 110.457234][ T566] ? css_next_child+0x160/0x160 [ 110.462069][ T566] ? stack_trace_save+0x12d/0x1f0 [ 110.467468][ T566] ? io_schedule+0x120/0x120 [ 110.472058][ T566] ? kernfs_fop_write_iter+0x15e/0x410 [ 110.477504][ T566] ? __kasan_check_write+0x14/0x20 [ 110.482607][ T566] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 110.487880][ T566] cgroup_subtree_control_write+0xd19/0x1310 [ 110.493838][ T566] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 110.499800][ T566] ? __kasan_check_write+0x14/0x20 [ 110.504909][ T566] ? _copy_from_iter+0x3fb/0xd60 [ 110.509835][ T566] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 110.515793][ T566] cgroup_file_write+0x28e/0x590 [ 110.520717][ T566] ? cgroup_seqfile_stop+0xc0/0xc0 [ 110.525820][ T566] ? mutex_lock+0xa6/0x110 [ 110.530237][ T566] ? mutex_trylock+0xb0/0xb0 [ 110.534838][ T566] ? __kasan_check_write+0x14/0x20 [ 110.539940][ T566] kernfs_fop_write_iter+0x2d0/0x410 [ 110.545213][ T566] ? cgroup_seqfile_stop+0xc0/0xc0 [ 110.550317][ T566] vfs_write+0xc1c/0xf40 [ 110.554541][ T566] ? __kasan_check_write+0x14/0x20 [ 110.559632][ T566] ? kernel_write+0x3c0/0x3c0 [ 110.564284][ T566] ? _raw_spin_unlock_irq+0x4e/0x70 [ 110.569460][ T566] ? ptrace_stop+0x6ff/0x9f0 [ 110.574032][ T566] ? __kasan_check_read+0x11/0x20 [ 110.579048][ T566] ? __fdget_pos+0x27e/0x310 [ 110.583616][ T566] ksys_write+0x198/0x2c0 [ 110.587923][ T566] ? do_notify_parent+0xa60/0xa60 [ 110.592934][ T566] ? __ia32_sys_read+0x90/0x90 [ 110.597681][ T566] ? __ia32_sys_open+0x270/0x270 [ 110.602596][ T566] __x64_sys_write+0x7b/0x90 [ 110.607165][ T566] do_syscall_64+0x34/0x70 [ 110.611560][ T566] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 110.617428][ T566] RIP: 0033:0x7fc8ece62c09 [ 110.621823][ T566] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 110.641403][ T566] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 570] write(4, "+pids ", 6 [pid 566] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 566] close(3) = 0 [pid 566] close(4) = 0 [pid 566] close(5) = 0 [pid 566] close(6) = -1 EBADF (Bad file descriptor) [pid 566] close(7) = -1 EBADF (Bad file descriptor) [pid 566] close(8) = -1 EBADF (Bad file descriptor) [pid 566] close(9) = -1 EBADF (Bad file descriptor) [pid 566] close(10) = -1 EBADF (Bad file descriptor) [pid 566] close(11) = -1 EBADF (Bad file descriptor) [pid 566] close(12) = -1 EBADF (Bad file descriptor) [pid 566] close(13) = -1 EBADF (Bad file descriptor) [pid 566] close(14) = -1 EBADF (Bad file descriptor) [pid 566] close(15) = -1 EBADF (Bad file descriptor) [pid 566] close(16) = -1 EBADF (Bad file descriptor) [pid 566] close(17) = -1 EBADF (Bad file descriptor) [pid 566] close(18) = -1 EBADF (Bad file descriptor) [pid 566] close(19) = -1 EBADF (Bad file descriptor) [pid 566] close(20) = -1 EBADF (Bad file descriptor) [pid 566] close(21) = -1 EBADF (Bad file descriptor) [pid 566] close(22) = -1 EBADF (Bad file descriptor) [pid 566] close(23) = -1 EBADF (Bad file descriptor) [pid 566] close(24) = -1 EBADF (Bad file descriptor) [pid 566] close(25) = -1 EBADF (Bad file descriptor) [pid 566] close(26) = -1 EBADF (Bad file descriptor) [pid 566] close(27) = -1 EBADF (Bad file descriptor) [pid 566] close(28) = -1 EBADF (Bad file descriptor) [pid 566] close(29) = -1 EBADF (Bad file descriptor) [pid 566] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory ) = 89 [pid 566] exit_group(0) = ? [pid 566] +++ exited with 0 +++ [pid 382] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=37, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 382] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 382] umount2("./35", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] openat(AT_FDCWD, "./35", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 382] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 382] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 382] umount2("./35/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./35/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 382] unlink("./35/binderfs") = 0 [pid 382] umount2("./35/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./35/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 382] unlink("./35/cgroup") = 0 [pid 382] umount2("./35/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./35/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 382] unlink("./35/cgroup.net") = 0 [pid 382] umount2("./35/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 382] umount2("./35/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./35/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 382] umount2("./35/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] openat(AT_FDCWD, "./35/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 382] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 382] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 382] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 382] close(4) = 0 [ 110.649793][ T566] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 110.657743][ T566] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 110.665698][ T566] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 110.673649][ T566] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 110.681607][ T566] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000023 [ 110.691901][ T566] cgroup: cgroup_addrm_files: failed to add max, err=-12 [pid 382] rmdir("./35/file0") = 0 [pid 382] umount2("./35/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./35/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 382] unlink("./35/cgroup.cpu") = 0 [pid 382] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 382] close(3) = 0 [pid 382] rmdir("./35") = 0 [pid 382] mkdir("./36", 0777) = 0 [pid 382] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 571 attached [pid 571] chdir("./36" [pid 382] <... clone resumed>, child_tidptr=0x555556fab5d0) = 38 [pid 571] <... chdir resumed>) = 0 [pid 571] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 571] setpgid(0, 0) = 0 [pid 571] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 571] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [pid 571] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 571] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 571] write(3, "1000", 4) = 4 [pid 571] close(3) = 0 [pid 571] symlink("/dev/binderfs", "./binderfs") = 0 [pid 571] mkdirat(AT_FDCWD, "./file0", 000) = 0 [ 110.720663][ T563] FAULT_INJECTION: forcing a failure. [ 110.720663][ T563] name failslab, interval 1, probability 0, space 0, times 0 [ 110.733480][ T563] CPU: 0 PID: 563 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 110.745092][ T563] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 110.755152][ T563] Call Trace: [ 110.758440][ T563] dump_stack_lvl+0x1e2/0x24b [ 110.763108][ T563] ? bfq_pos_tree_add_move+0x43e/0x43e [ 110.768543][ T563] ? selinux_kernfs_init_security+0x1a8/0x760 [ 110.774601][ T563] dump_stack+0x15/0x17 [ 110.778738][ T563] should_fail+0x3c0/0x510 [ 110.783141][ T563] ? __kernfs_new_node+0x99/0x6e0 [ 110.788152][ T563] __should_failslab+0x9f/0xe0 [ 110.792902][ T563] should_failslab+0x9/0x20 [ 110.797392][ T563] __kmalloc_track_caller+0x5f/0x350 [ 110.802653][ T563] kstrdup_const+0x55/0x90 [ 110.807044][ T563] __kernfs_new_node+0x99/0x6e0 [ 110.811879][ T563] ? is_module_text_address+0xe1/0x140 [ 110.817316][ T563] ? kernfs_new_node+0x170/0x170 [ 110.822237][ T563] ? ptr_to_hashval+0x60/0x60 [ 110.826900][ T563] ? arch_stack_walk+0xf8/0x140 [ 110.831743][ T563] ? snprintf+0xd6/0x120 [ 110.835970][ T563] kernfs_new_node+0x97/0x170 [ 110.840630][ T563] __kernfs_create_file+0x4a/0x270 [ 110.845718][ T563] cgroup_addrm_files+0xab8/0xfe0 [ 110.850720][ T563] ? ____kasan_kmalloc+0xdc/0x110 [ 110.855717][ T563] ? __kasan_kmalloc+0x9/0x10 [ 110.860374][ T563] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 110.865895][ T563] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 110.872035][ T563] ? delete_node+0x759/0x7b0 [ 110.876614][ T563] ? __kasan_check_read+0x11/0x20 [ 110.881618][ T563] ? delete_node+0x759/0x7b0 [ 110.886193][ T563] ? __kasan_check_write+0x14/0x20 [ 110.891286][ T563] ? idr_replace+0x1c4/0x230 [ 110.895851][ T563] ? idr_get_next+0x4b0/0x4b0 [ 110.900510][ T563] ? _raw_spin_lock_bh+0xa3/0x1b0 [ 110.905520][ T563] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 110.910692][ T563] css_populate_dir+0x137/0x370 [ 110.915519][ T563] cgroup_apply_control_enable+0x8b9/0x12f0 [ 110.921388][ T563] cgroup_apply_control+0x93/0x710 [ 110.926474][ T563] ? css_next_child+0x160/0x160 [ 110.931300][ T563] ? stack_trace_save+0x12d/0x1f0 [ 110.936311][ T563] ? io_schedule+0x120/0x120 [ 110.940888][ T563] ? kernfs_fop_write_iter+0x15e/0x410 [ 110.946342][ T563] ? __kasan_check_write+0x14/0x20 [ 110.951438][ T563] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 110.956699][ T563] cgroup_subtree_control_write+0xd19/0x1310 [ 110.962664][ T563] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 110.968627][ T563] ? __kasan_check_write+0x14/0x20 [ 110.973723][ T563] ? _copy_from_iter+0x3fb/0xd60 [ 110.978647][ T563] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 110.984781][ T563] cgroup_file_write+0x28e/0x590 [ 110.989700][ T563] ? cgroup_seqfile_stop+0xc0/0xc0 [ 110.994797][ T563] ? mutex_lock+0xa6/0x110 [ 110.999197][ T563] ? mutex_trylock+0xb0/0xb0 [ 111.003775][ T563] ? __kasan_check_write+0x14/0x20 [ 111.008863][ T563] kernfs_fop_write_iter+0x2d0/0x410 [ 111.014132][ T563] ? cgroup_seqfile_stop+0xc0/0xc0 [ 111.019233][ T563] vfs_write+0xc1c/0xf40 [ 111.023467][ T563] ? __kasan_check_write+0x14/0x20 [ 111.028563][ T563] ? kernel_write+0x3c0/0x3c0 [ 111.033214][ T563] ? _raw_spin_unlock_irq+0x4e/0x70 [ 111.038396][ T563] ? ptrace_stop+0x6ff/0x9f0 [ 111.042999][ T563] ? __kasan_check_read+0x11/0x20 [ 111.048001][ T563] ? __fdget_pos+0x27e/0x310 [ 111.052565][ T563] ksys_write+0x198/0x2c0 [ 111.056876][ T563] ? do_notify_parent+0xa60/0xa60 [ 111.061885][ T563] ? __ia32_sys_read+0x90/0x90 [ 111.066631][ T563] ? __ia32_sys_open+0x270/0x270 [ 111.071554][ T563] __x64_sys_write+0x7b/0x90 [ 111.076130][ T563] do_syscall_64+0x34/0x70 [ 111.080530][ T563] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 111.086398][ T563] RIP: 0033:0x7fc8ece62c09 [ 111.090795][ T563] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 111.110384][ T563] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 571] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 563] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 571] open("./file0", O_RDONLY) = 3 [pid 571] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [pid 563] close(3 [pid 571] write(4, "-pids ", 6 [pid 563] <... close resumed>) = 0 [pid 563] close(4) = 0 [pid 563] close(5) = 0 [pid 563] close(6) = -1 EBADF (Bad file descriptor) [pid 563] close(7) = -1 EBADF (Bad file descriptor) [pid 563] close(8) = -1 EBADF (Bad file descriptor) [pid 563] close(9) = -1 EBADF (Bad file descriptor) [pid 563] close(10) = -1 EBADF (Bad file descriptor) [pid 563] close(11) = -1 EBADF (Bad file descriptor) [pid 563] close(12) = -1 EBADF (Bad file descriptor) [pid 563] close(13) = -1 EBADF (Bad file descriptor) [pid 563] close(14) = -1 EBADF (Bad file descriptor) [pid 563] close(15) = -1 EBADF (Bad file descriptor) [pid 563] close(16) = -1 EBADF (Bad file descriptor) [pid 563] close(17) = -1 EBADF (Bad file descriptor) [pid 563] close(18) = -1 EBADF (Bad file descriptor) [pid 563] close(19) = -1 EBADF (Bad file descriptor) [pid 563] close(20) = -1 EBADF (Bad file descriptor) [pid 563] close(21) = -1 EBADF (Bad file descriptor) [pid 563] close(22) = -1 EBADF (Bad file descriptor) [pid 563] close(23) = -1 EBADF (Bad file descriptor) [pid 563] close(24) = -1 EBADF (Bad file descriptor) [pid 563] close(25) = -1 EBADF (Bad file descriptor) [pid 563] close(26) = -1 EBADF (Bad file descriptor) [pid 563] close(27) = -1 EBADF (Bad file descriptor) [pid 563] close(28) = -1 EBADF (Bad file descriptor) [pid 563] close(29) = -1 EBADF (Bad file descriptor) [pid 563] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory ) = 89 [pid 563] exit_group(0) = ? [pid 563] +++ exited with 0 +++ [pid 375] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=33, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 375] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 375] umount2("./31", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] openat(AT_FDCWD, "./31", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 375] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 375] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 375] umount2("./31/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./31/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 375] unlink("./31/binderfs") = 0 [pid 375] umount2("./31/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./31/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 375] unlink("./31/cgroup") = 0 [pid 375] umount2("./31/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./31/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 375] unlink("./31/cgroup.net") = 0 [pid 375] umount2("./31/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 375] umount2("./31/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./31/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 375] umount2("./31/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] openat(AT_FDCWD, "./31/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 375] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 375] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [ 111.118770][ T563] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 111.126719][ T563] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 111.134666][ T563] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 111.142613][ T563] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 111.150565][ T563] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 000000000000001f [ 111.160316][ T563] cgroup: cgroup_addrm_files: failed to add max, err=-12 [pid 375] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 375] close(4) = 0 [ 111.190435][ T568] FAULT_INJECTION: forcing a failure. [ 111.190435][ T568] name failslab, interval 1, probability 0, space 0, times 0 [ 111.203484][ T568] CPU: 0 PID: 568 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 111.215103][ T568] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 111.225141][ T568] Call Trace: [ 111.228451][ T568] dump_stack_lvl+0x1e2/0x24b [ 111.233113][ T568] ? panic+0x7d7/0x7d7 [ 111.237163][ T568] ? bfq_pos_tree_add_move+0x43e/0x43e [ 111.242617][ T568] ? find_next_bit+0xd6/0x120 [ 111.247291][ T568] ? cpumask_next+0x11/0x30 [ 111.251774][ T568] dump_stack+0x15/0x17 [ 111.255915][ T568] should_fail+0x3c0/0x510 [ 111.260311][ T568] ? percpu_ref_init+0xd0/0x330 [ 111.265155][ T568] __should_failslab+0x9f/0xe0 [ 111.269918][ T568] should_failslab+0x9/0x20 [ 111.274406][ T568] kmem_cache_alloc_trace+0x3a/0x330 [ 111.279679][ T568] percpu_ref_init+0xd0/0x330 [ 111.284356][ T568] ? cgroup_setup_root+0xea0/0xea0 [ 111.289452][ T568] cgroup_apply_control_enable+0x3a2/0x12f0 [ 111.295326][ T568] cgroup_apply_control+0x93/0x710 [ 111.300426][ T568] ? css_next_child+0x160/0x160 [ 111.305257][ T568] ? stack_trace_save+0x12d/0x1f0 [ 111.310266][ T568] ? io_schedule+0x120/0x120 [ 111.314845][ T568] ? kernfs_fop_write_iter+0x15e/0x410 [ 111.320293][ T568] ? __kasan_check_write+0x14/0x20 [ 111.325390][ T568] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 111.330659][ T568] cgroup_subtree_control_write+0xd19/0x1310 [ 111.336620][ T568] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 111.342581][ T568] ? __kasan_check_write+0x14/0x20 [ 111.347673][ T568] ? _copy_from_iter+0x3fb/0xd60 [ 111.352589][ T568] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 111.358545][ T568] cgroup_file_write+0x28e/0x590 [ 111.363468][ T568] ? cgroup_seqfile_stop+0xc0/0xc0 [ 111.368560][ T568] ? mutex_lock+0xa6/0x110 [ 111.372955][ T568] ? mutex_trylock+0xb0/0xb0 [ 111.377526][ T568] ? __kasan_check_write+0x14/0x20 [ 111.382622][ T568] kernfs_fop_write_iter+0x2d0/0x410 [ 111.387883][ T568] ? cgroup_seqfile_stop+0xc0/0xc0 [ 111.392974][ T568] vfs_write+0xc1c/0xf40 [ 111.397197][ T568] ? __kasan_check_write+0x14/0x20 [ 111.402292][ T568] ? kernel_write+0x3c0/0x3c0 [ 111.406960][ T568] ? _raw_spin_unlock_irq+0x4e/0x70 [ 111.412137][ T568] ? ptrace_stop+0x6ff/0x9f0 [ 111.416706][ T568] ? __kasan_check_read+0x11/0x20 [ 111.421718][ T568] ? __fdget_pos+0x27e/0x310 [ 111.426291][ T568] ksys_write+0x198/0x2c0 [ 111.430601][ T568] ? do_notify_parent+0xa60/0xa60 [ 111.435610][ T568] ? __ia32_sys_read+0x90/0x90 [ 111.440355][ T568] ? __ia32_sys_open+0x270/0x270 [ 111.445278][ T568] __x64_sys_write+0x7b/0x90 [ 111.449861][ T568] do_syscall_64+0x34/0x70 [ 111.454261][ T568] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 111.460141][ T568] RIP: 0033:0x7fc8ece62c09 [ 111.464545][ T568] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 375] rmdir("./31/file0") = 0 [pid 375] umount2("./31/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 568] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 568] close(3 [pid 375] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 568] <... close resumed>) = 0 [pid 375] lstat("./31/cgroup.cpu", [pid 568] close(4 [pid 375] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 568] <... close resumed>) = 0 [pid 375] unlink("./31/cgroup.cpu") = 0 [pid 568] close(5) = 0 [pid 375] getdents64(3, [pid 568] close(6 [pid 375] <... getdents64 resumed>0x555556fad630 /* 0 entries */, 32768) = 0 [pid 568] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 375] close(3 [pid 568] close(7 [pid 375] <... close resumed>) = 0 [pid 568] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 375] rmdir("./31") = 0 [pid 568] close(8) = -1 EBADF (Bad file descriptor) [pid 375] mkdir("./32", 0777) = 0 [pid 568] close(9) = -1 EBADF (Bad file descriptor) [pid 375] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 568] close(10) = -1 EBADF (Bad file descriptor) [pid 568] close(11./strace-static-x86_64: Process 572 attached ) = -1 EBADF (Bad file descriptor) [pid 572] chdir("./32" [pid 568] close(12 [pid 572] <... chdir resumed>) = 0 [pid 568] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 375] <... clone resumed>, child_tidptr=0x555556fab5d0) = 34 [pid 572] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 568] close(13 [pid 572] <... prctl resumed>) = 0 [pid 568] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 572] setpgid(0, 0 [pid 568] close(14 [pid 572] <... setpgid resumed>) = 0 [pid 568] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 572] symlink("/syzcgroup/unified/syz0", "./cgroup" [pid 568] close(15 [pid 572] <... symlink resumed>) = 0 [pid 568] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 572] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu" [pid 568] close(16 [pid 572] <... symlink resumed>) = 0 [pid 568] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 572] symlink("/syzcgroup/net/syz0", "./cgroup.net" [pid 568] close(17 [pid 572] <... symlink resumed>) = 0 [pid 568] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 572] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 568] close(18 [pid 572] <... openat resumed>) = 3 [pid 568] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 572] write(3, "1000", 4 [pid 568] close(19 [pid 572] <... write resumed>) = 4 [pid 568] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 572] close(3 [pid 568] close(20 [pid 572] <... close resumed>) = 0 [pid 568] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 572] symlink("/dev/binderfs", "./binderfs" [pid 568] close(21 [pid 572] <... symlink resumed>) = 0 [pid 568] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 572] mkdirat(AT_FDCWD, "./file0", 000 [pid 568] close(22 [pid 572] <... mkdirat resumed>) = 0 [pid 568] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 572] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 568] close(23 [pid 572] <... mount resumed>) = 0 [pid 568] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 572] open("./file0", O_RDONLY [pid 568] close(24 [pid 572] <... open resumed>) = 3 [pid 568] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 572] openat(3, "cgroup.subtree_control", O_RDWR [pid 568] close(25 [pid 572] <... openat resumed>) = 4 [pid 568] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 572] write(4, "-pids ", 6 [pid 568] close(26) = -1 EBADF (Bad file descriptor) [pid 568] close(27) = -1 EBADF (Bad file descriptor) [pid 568] close(28) = -1 EBADF (Bad file descriptor) [pid 568] close(29) = -1 EBADF (Bad file descriptor) write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory [pid 568] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 568] exit_group(0) = ? [pid 568] +++ exited with 0 +++ [pid 376] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=32, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 376] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 376] umount2("./30", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] openat(AT_FDCWD, "./30", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 376] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 376] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 376] umount2("./30/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./30/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 376] unlink("./30/binderfs") = 0 [pid 376] umount2("./30/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./30/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 376] unlink("./30/cgroup") = 0 [pid 376] umount2("./30/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./30/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 376] unlink("./30/cgroup.net") = 0 [pid 376] umount2("./30/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 376] umount2("./30/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./30/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 376] umount2("./30/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] openat(AT_FDCWD, "./30/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 376] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 376] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 376] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 376] close(4) = 0 [pid 376] rmdir("./30/file0") = 0 [pid 376] umount2("./30/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./30/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 376] unlink("./30/cgroup.cpu") = 0 [pid 376] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 376] close(3) = 0 [ 111.484137][ T568] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 111.492540][ T568] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 111.500496][ T568] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 111.508451][ T568] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 111.516406][ T568] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 111.524362][ T568] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 000000000000001e [pid 376] rmdir("./30" [pid 572] <... write resumed>) = 6 [pid 569] <... write resumed>) = 6 [pid 565] <... write resumed>) = 6 [pid 376] <... rmdir resumed>) = 0 [pid 572] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 572] write(5, "22", 2) = 2 [pid 572] write(4, "+pids ", 6 [pid 569] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 569] write(5, "22", 2) = 2 [pid 569] write(4, "+pids ", 6 [pid 565] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 565] write(5, "22", 2) = 2 [pid 565] write(4, "+pids ", 6 [pid 376] mkdir("./31", 0777) = 0 [pid 376] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556fab5d0) = 33 ./strace-static-x86_64: Process 573 attached [ 111.560621][ T570] FAULT_INJECTION: forcing a failure. [ 111.560621][ T570] name failslab, interval 1, probability 0, space 0, times 0 [ 111.573273][ T570] CPU: 1 PID: 570 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 111.584893][ T570] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 111.594944][ T570] Call Trace: [ 111.598237][ T570] dump_stack_lvl+0x1e2/0x24b [ 111.602905][ T570] ? bfq_pos_tree_add_move+0x43e/0x43e [ 111.608356][ T570] ? selinux_kernfs_init_security+0x1a8/0x760 [ 111.614428][ T570] dump_stack+0x15/0x17 [ 111.618578][ T570] should_fail+0x3c0/0x510 [ 111.622983][ T570] ? __kernfs_new_node+0x99/0x6e0 [ 111.627992][ T570] __should_failslab+0x9f/0xe0 [ 111.632737][ T570] should_failslab+0x9/0x20 [ 111.637220][ T570] __kmalloc_track_caller+0x5f/0x350 [ 111.642575][ T570] kstrdup_const+0x55/0x90 [ 111.646985][ T570] __kernfs_new_node+0x99/0x6e0 [ 111.651819][ T570] ? is_module_text_address+0xe1/0x140 [ 111.657264][ T570] ? kernfs_new_node+0x170/0x170 [ 111.662192][ T570] ? ptr_to_hashval+0x60/0x60 [ 111.666845][ T570] ? arch_stack_walk+0xf8/0x140 [ 111.671679][ T570] ? snprintf+0xd6/0x120 [ 111.675910][ T570] kernfs_new_node+0x97/0x170 [ 111.680569][ T570] __kernfs_create_file+0x4a/0x270 [ 111.685667][ T570] cgroup_addrm_files+0xab8/0xfe0 [ 111.690675][ T570] ? ____kasan_kmalloc+0xdc/0x110 [ 111.695688][ T570] ? __kasan_kmalloc+0x9/0x10 [ 111.700356][ T570] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 111.705890][ T570] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 111.712044][ T570] ? delete_node+0x759/0x7b0 [ 111.716626][ T570] ? __kasan_check_read+0x11/0x20 [ 111.721626][ T570] ? delete_node+0x759/0x7b0 [ 111.726191][ T570] ? __kasan_check_write+0x14/0x20 [ 111.731290][ T570] ? idr_replace+0x1c4/0x230 [ 111.735869][ T570] ? idr_get_next+0x4b0/0x4b0 [ 111.740521][ T570] ? _raw_spin_lock_bh+0xa3/0x1b0 [ 111.745519][ T570] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 111.750693][ T570] css_populate_dir+0x137/0x370 [ 111.755525][ T570] cgroup_apply_control_enable+0x8b9/0x12f0 [ 111.761394][ T570] cgroup_apply_control+0x93/0x710 [ 111.766493][ T570] ? css_next_child+0x160/0x160 [ 111.771333][ T570] ? stack_trace_save+0x12d/0x1f0 [ 111.776343][ T570] ? io_schedule+0x120/0x120 [ 111.780910][ T570] ? kernfs_fop_write_iter+0x15e/0x410 [ 111.786346][ T570] ? __kasan_check_write+0x14/0x20 [ 111.791442][ T570] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 111.796715][ T570] cgroup_subtree_control_write+0xd19/0x1310 [ 111.802678][ T570] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 111.808640][ T570] ? __kasan_check_write+0x14/0x20 [ 111.813735][ T570] ? _copy_from_iter+0x3fb/0xd60 [ 111.818660][ T570] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 111.824612][ T570] cgroup_file_write+0x28e/0x590 [ 111.829523][ T570] ? cgroup_seqfile_stop+0xc0/0xc0 [ 111.834615][ T570] ? mutex_lock+0xa6/0x110 [ 111.839030][ T570] ? mutex_trylock+0xb0/0xb0 [ 111.843617][ T570] ? __kasan_check_write+0x14/0x20 [ 111.848728][ T570] kernfs_fop_write_iter+0x2d0/0x410 [ 111.853997][ T570] ? cgroup_seqfile_stop+0xc0/0xc0 [ 111.859094][ T570] vfs_write+0xc1c/0xf40 [ 111.863312][ T570] ? __kasan_check_write+0x14/0x20 [ 111.868409][ T570] ? kernel_write+0x3c0/0x3c0 [ 111.873105][ T570] ? _raw_spin_unlock_irq+0x4e/0x70 [ 111.878288][ T570] ? ptrace_stop+0x6ff/0x9f0 [ 111.882853][ T570] ? __kasan_check_read+0x11/0x20 [ 111.887860][ T570] ? __fdget_pos+0x27e/0x310 [ 111.892435][ T570] ksys_write+0x198/0x2c0 [ 111.896751][ T570] ? do_notify_parent+0xa60/0xa60 [ 111.901762][ T570] ? __ia32_sys_read+0x90/0x90 [ 111.906500][ T570] ? __ia32_sys_open+0x270/0x270 [ 111.911423][ T570] __x64_sys_write+0x7b/0x90 [ 111.916004][ T570] do_syscall_64+0x34/0x70 [ 111.920407][ T570] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 111.926290][ T570] RIP: 0033:0x7fc8ece62c09 [ 111.930711][ T570] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 111.950825][ T570] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 573] chdir("./31") = 0 [pid 573] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 573] setpgid(0, 0) = 0 [pid 573] symlink("/syzcgroup/unified/syz1", "./cgroup") = 0 [pid 573] symlink("/syzcgroup/cpu/syz1", "./cgroup.cpu") = 0 [pid 573] symlink("/syzcgroup/net/syz1", "./cgroup.net") = 0 [pid 573] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 573] write(3, "1000", 4) = 4 [pid 573] close(3) = 0 [pid 573] symlink("/dev/binderfs", "./binderfs") = 0 [pid 573] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 573] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 570] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 573] <... mount resumed>) = 0 [pid 570] close(3) = 0 [pid 570] close(4 [pid 573] open("./file0", O_RDONLY [pid 570] <... close resumed>) = 0 [pid 570] close(5) = 0 [pid 570] close(6) = -1 EBADF (Bad file descriptor) [pid 570] close(7) = -1 EBADF (Bad file descriptor) [pid 570] close(8) = -1 EBADF (Bad file descriptor) [pid 570] close(9) = -1 EBADF (Bad file descriptor) [pid 570] close(10) = -1 EBADF (Bad file descriptor) [pid 570] close(11) = -1 EBADF (Bad file descriptor) [pid 570] close(12) = -1 EBADF (Bad file descriptor) [pid 570] close(13) = -1 EBADF (Bad file descriptor) [pid 570] close(14) = -1 EBADF (Bad file descriptor) [pid 570] close(15) = -1 EBADF (Bad file descriptor) [pid 570] close(16) = -1 EBADF (Bad file descriptor) [pid 570] close(17) = -1 EBADF (Bad file descriptor) [pid 570] close(18) = -1 EBADF (Bad file descriptor) [pid 570] close(19) = -1 EBADF (Bad file descriptor) [pid 570] close(20) = -1 EBADF (Bad file descriptor) [pid 570] close(21) = -1 EBADF (Bad file descriptor) [pid 570] close(22) = -1 EBADF (Bad file descriptor) [pid 570] close(23) = -1 EBADF (Bad file descriptor) [pid 570] close(24) = -1 EBADF (Bad file descriptor) [pid 570] close(25) = -1 EBADF (Bad file descriptor) [pid 570] close(26) = -1 EBADF (Bad file descriptor) [pid 570] close(27) = -1 EBADF (Bad file descriptor) [pid 570] close(28) = -1 EBADF (Bad file descriptor) [pid 570] close(29) = -1 EBADF (Bad file descriptor) write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory [pid 570] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 570] exit_group(0) = ? [pid 573] <... open resumed>) = 3 [pid 570] +++ exited with 0 +++ [pid 573] openat(3, "cgroup.subtree_control", O_RDWR [pid 383] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=28, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 573] <... openat resumed>) = 4 [pid 383] umount2("./26", MNT_DETACH|UMOUNT_NOFOLLOW [pid 573] write(4, "-pids ", 6 [pid 383] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 383] openat(AT_FDCWD, "./26", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 383] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 383] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 383] umount2("./26/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./26/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 383] unlink("./26/binderfs") = 0 [pid 383] umount2("./26/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./26/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 383] unlink("./26/cgroup") = 0 [pid 383] umount2("./26/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./26/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 383] unlink("./26/cgroup.net") = 0 [pid 383] umount2("./26/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 383] umount2("./26/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./26/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 383] umount2("./26/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] openat(AT_FDCWD, "./26/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 383] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 383] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 383] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 383] close(4) = 0 [pid 383] rmdir("./26/file0") = 0 [pid 383] umount2("./26/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./26/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 383] unlink("./26/cgroup.cpu") = 0 [pid 383] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 383] close(3) = 0 [pid 383] rmdir("./26") = 0 [pid 383] mkdir("./27", 0777) = 0 [pid 383] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556fab5d0) = 29 ./strace-static-x86_64: Process 574 attached [pid 574] chdir("./27") = 0 [pid 574] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 574] setpgid(0, 0) = 0 [pid 574] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 574] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 574] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [pid 574] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 574] write(3, "1000", 4) = 4 [pid 574] close(3) = 0 [pid 574] symlink("/dev/binderfs", "./binderfs") = 0 [pid 574] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 574] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 574] open("./file0", O_RDONLY) = 3 [pid 574] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [ 111.959214][ T570] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 111.967161][ T570] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 111.975111][ T570] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 111.983059][ T570] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 111.991011][ T570] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 000000000000001a [ 111.999768][ T570] cgroup: cgroup_addrm_files: failed to add max, err=-12 [pid 574] write(4, "-pids ", 6) = 6 [pid 574] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 574] write(5, "22", 2) = 2 [ 112.040434][ T565] FAULT_INJECTION: forcing a failure. [ 112.040434][ T565] name failslab, interval 1, probability 0, space 0, times 0 [ 112.053544][ T565] CPU: 1 PID: 565 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 112.065175][ T565] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 112.075219][ T565] Call Trace: [ 112.078487][ T565] dump_stack_lvl+0x1e2/0x24b [ 112.083143][ T565] ? bfq_pos_tree_add_move+0x43e/0x43e [ 112.088579][ T565] ? selinux_kernfs_init_security+0x1a8/0x760 [ 112.094625][ T565] dump_stack+0x15/0x17 [ 112.098758][ T565] should_fail+0x3c0/0x510 [ 112.103163][ T565] ? __kernfs_new_node+0x99/0x6e0 [ 112.108172][ T565] __should_failslab+0x9f/0xe0 [ 112.112913][ T565] should_failslab+0x9/0x20 [ 112.117393][ T565] __kmalloc_track_caller+0x5f/0x350 [ 112.122651][ T565] kstrdup_const+0x55/0x90 [ 112.127136][ T565] __kernfs_new_node+0x99/0x6e0 [ 112.131969][ T565] ? is_module_text_address+0xe1/0x140 [ 112.137399][ T565] ? kernfs_new_node+0x170/0x170 [ 112.142315][ T565] ? ptr_to_hashval+0x60/0x60 [ 112.146965][ T565] ? arch_stack_walk+0xf8/0x140 [ 112.151792][ T565] ? snprintf+0xd6/0x120 [ 112.156012][ T565] kernfs_new_node+0x97/0x170 [ 112.160667][ T565] __kernfs_create_file+0x4a/0x270 [ 112.165752][ T565] cgroup_addrm_files+0xab8/0xfe0 [ 112.170752][ T565] ? ____kasan_kmalloc+0xdc/0x110 [ 112.175755][ T565] ? __kasan_kmalloc+0x9/0x10 [ 112.180416][ T565] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 112.185934][ T565] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 112.192066][ T565] ? delete_node+0x759/0x7b0 [ 112.196631][ T565] ? __kasan_check_read+0x11/0x20 [ 112.201627][ T565] ? delete_node+0x759/0x7b0 [ 112.206192][ T565] ? __kasan_check_write+0x14/0x20 [ 112.211282][ T565] ? idr_replace+0x1c4/0x230 [ 112.215848][ T565] ? idr_get_next+0x4b0/0x4b0 [ 112.220498][ T565] ? _raw_spin_lock_bh+0xa3/0x1b0 [ 112.225519][ T565] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 112.230705][ T565] css_populate_dir+0x137/0x370 [ 112.235535][ T565] cgroup_apply_control_enable+0x8b9/0x12f0 [ 112.241404][ T565] cgroup_apply_control+0x93/0x710 [ 112.246490][ T565] ? css_next_child+0x160/0x160 [ 112.251323][ T565] ? stack_trace_save+0x12d/0x1f0 [ 112.256336][ T565] ? io_schedule+0x120/0x120 [ 112.260921][ T565] ? kernfs_fop_write_iter+0x15e/0x410 [ 112.266381][ T565] ? __kasan_check_write+0x14/0x20 [ 112.271481][ T565] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 112.276739][ T565] cgroup_subtree_control_write+0xd19/0x1310 [ 112.282696][ T565] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 112.288652][ T565] ? __kasan_check_write+0x14/0x20 [ 112.293919][ T565] ? _copy_from_iter+0x3fb/0xd60 [ 112.298850][ T565] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 112.304818][ T565] cgroup_file_write+0x28e/0x590 [ 112.309738][ T565] ? cgroup_seqfile_stop+0xc0/0xc0 [ 112.314835][ T565] ? mutex_lock+0xa6/0x110 [ 112.319236][ T565] ? mutex_trylock+0xb0/0xb0 [ 112.323811][ T565] ? __kasan_check_write+0x14/0x20 [ 112.328899][ T565] kernfs_fop_write_iter+0x2d0/0x410 [ 112.334247][ T565] ? cgroup_seqfile_stop+0xc0/0xc0 [ 112.339342][ T565] vfs_write+0xc1c/0xf40 [ 112.343578][ T565] ? __kasan_check_write+0x14/0x20 [ 112.348677][ T565] ? kernel_write+0x3c0/0x3c0 [ 112.353332][ T565] ? _raw_spin_unlock_irq+0x4e/0x70 [ 112.358514][ T565] ? ptrace_stop+0x6ff/0x9f0 [ 112.363085][ T565] ? __kasan_check_read+0x11/0x20 [ 112.368086][ T565] ? __fdget_pos+0x27e/0x310 [ 112.372651][ T565] ksys_write+0x198/0x2c0 [ 112.376956][ T565] ? do_notify_parent+0xa60/0xa60 [ 112.381956][ T565] ? __ia32_sys_read+0x90/0x90 [ 112.386706][ T565] ? __ia32_sys_open+0x270/0x270 [ 112.391627][ T565] __x64_sys_write+0x7b/0x90 [ 112.396204][ T565] do_syscall_64+0x34/0x70 [ 112.400606][ T565] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 112.406472][ T565] RIP: 0033:0x7fc8ece62c09 [ 112.410874][ T565] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 112.430465][ T565] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 574] write(4, "+pids ", 6 [pid 565] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 565] close(3) = 0 [pid 565] close(4) = 0 [pid 565] close(5) = 0 [pid 565] close(6) = -1 EBADF (Bad file descriptor) [pid 565] close(7) = -1 EBADF (Bad file descriptor) [pid 565] close(8) = -1 EBADF (Bad file descriptor) [pid 565] close(9) = -1 EBADF (Bad file descriptor) [pid 565] close(10) = -1 EBADF (Bad file descriptor) [pid 565] close(11) = -1 EBADF (Bad file descriptor) [pid 565] close(12) = -1 EBADF (Bad file descriptor) [pid 565] close(13) = -1 EBADF (Bad file descriptor) [pid 565] close(14) = -1 EBADF (Bad file descriptor) [pid 565] close(15) = -1 EBADF (Bad file descriptor) [pid 565] close(16) = -1 EBADF (Bad file descriptor) [pid 565] close(17) = -1 EBADF (Bad file descriptor) [pid 565] close(18) = -1 EBADF (Bad file descriptor) [pid 565] close(19) = -1 EBADF (Bad file descriptor) [pid 565] close(20) = -1 EBADF (Bad file descriptor) [pid 565] close(21) = -1 EBADF (Bad file descriptor) [pid 565] close(22) = -1 EBADF (Bad file descriptor) [pid 565] close(23) = -1 EBADF (Bad file descriptor) [pid 565] close(24) = -1 EBADF (Bad file descriptor) [pid 565] close(25) = -1 EBADF (Bad file descriptor) [pid 565] close(26) = -1 EBADF (Bad file descriptor) [pid 565] close(27) = -1 EBADF (Bad file descriptor) [pid 565] close(28) = -1 EBADF (Bad file descriptor) [pid 565] close(29) = -1 EBADF (Bad file descriptor) write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory [pid 565] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 565] exit_group(0) = ? [pid 565] +++ exited with 0 +++ [pid 380] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=28, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 380] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 380] umount2("./26", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] openat(AT_FDCWD, "./26", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 380] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 380] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 380] umount2("./26/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./26/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 380] unlink("./26/binderfs") = 0 [pid 380] umount2("./26/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./26/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 380] unlink("./26/cgroup") = 0 [pid 380] umount2("./26/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./26/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 380] unlink("./26/cgroup.net") = 0 [pid 380] umount2("./26/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 380] umount2("./26/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./26/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 380] umount2("./26/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] openat(AT_FDCWD, "./26/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 380] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 380] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 380] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 380] close(4) = 0 [pid 380] rmdir("./26/file0") = 0 [pid 380] umount2("./26/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./26/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 380] unlink("./26/cgroup.cpu") = 0 [pid 380] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 380] close(3) = 0 [pid 380] rmdir("./26") = 0 [pid 380] mkdir("./27", 0777) = 0 [pid 380] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 575 attached [pid 575] chdir("./27") = 0 [pid 380] <... clone resumed>, child_tidptr=0x555556fab5d0) = 29 [pid 575] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 575] setpgid(0, 0) = 0 [pid 575] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 575] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 575] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 575] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 575] write(3, "1000", 4) = 4 [pid 575] close(3) = 0 [pid 575] symlink("/dev/binderfs", "./binderfs") = 0 [pid 575] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 575] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 575] open("./file0", O_RDONLY) = 3 [pid 575] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [ 112.438859][ T565] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 112.446808][ T565] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 112.454760][ T565] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 112.462713][ T565] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 112.470659][ T565] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 000000000000001a [ 112.478978][ T565] cgroup: cgroup_addrm_files: failed to add max, err=-12 [pid 575] write(4, "-pids ", 6) = 6 [pid 575] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 575] write(5, "22", 2) = 2 [ 112.530585][ T572] FAULT_INJECTION: forcing a failure. [ 112.530585][ T572] name failslab, interval 1, probability 0, space 0, times 0 [ 112.543664][ T572] CPU: 0 PID: 572 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 112.555285][ T572] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 112.565327][ T572] Call Trace: [ 112.568608][ T572] dump_stack_lvl+0x1e2/0x24b [ 112.573269][ T572] ? bfq_pos_tree_add_move+0x43e/0x43e [ 112.578708][ T572] ? selinux_kernfs_init_security+0x1a8/0x760 [ 112.584843][ T572] dump_stack+0x15/0x17 [ 112.588981][ T572] should_fail+0x3c0/0x510 [ 112.593382][ T572] ? __kernfs_new_node+0x99/0x6e0 [ 112.598388][ T572] __should_failslab+0x9f/0xe0 [ 112.603147][ T572] should_failslab+0x9/0x20 [ 112.607640][ T572] __kmalloc_track_caller+0x5f/0x350 [ 112.612903][ T572] kstrdup_const+0x55/0x90 [ 112.617301][ T572] __kernfs_new_node+0x99/0x6e0 [ 112.622130][ T572] ? is_module_text_address+0xe1/0x140 [ 112.627563][ T572] ? kernfs_new_node+0x170/0x170 [ 112.632492][ T572] ? ptr_to_hashval+0x60/0x60 [ 112.637158][ T572] ? arch_stack_walk+0xf8/0x140 [ 112.641992][ T572] ? snprintf+0xd6/0x120 [ 112.646207][ T572] kernfs_new_node+0x97/0x170 [ 112.650858][ T572] __kernfs_create_file+0x4a/0x270 [ 112.655945][ T572] cgroup_addrm_files+0xab8/0xfe0 [ 112.660941][ T572] ? ____kasan_kmalloc+0xdc/0x110 [ 112.665937][ T572] ? __kasan_kmalloc+0x9/0x10 [ 112.670593][ T572] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 112.676118][ T572] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 112.682248][ T572] ? delete_node+0x759/0x7b0 [ 112.686813][ T572] ? __kasan_check_read+0x11/0x20 [ 112.691822][ T572] ? delete_node+0x759/0x7b0 [ 112.696393][ T572] ? __kasan_check_write+0x14/0x20 [ 112.701481][ T572] ? idr_replace+0x1c4/0x230 [ 112.706050][ T572] ? idr_get_next+0x4b0/0x4b0 [ 112.710703][ T572] ? _raw_spin_lock_bh+0xa3/0x1b0 [ 112.715708][ T572] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 112.720891][ T572] css_populate_dir+0x137/0x370 [ 112.725722][ T572] cgroup_apply_control_enable+0x8b9/0x12f0 [ 112.731592][ T572] cgroup_apply_control+0x93/0x710 [ 112.736680][ T572] ? css_next_child+0x160/0x160 [ 112.741510][ T572] ? stack_trace_save+0x12d/0x1f0 [ 112.746518][ T572] ? io_schedule+0x120/0x120 [ 112.751090][ T572] ? kernfs_fop_write_iter+0x15e/0x410 [ 112.756523][ T572] ? __kasan_check_write+0x14/0x20 [ 112.761608][ T572] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 112.766869][ T572] cgroup_subtree_control_write+0xd19/0x1310 [ 112.772827][ T572] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 112.778784][ T572] ? __kasan_check_write+0x14/0x20 [ 112.783875][ T572] ? _copy_from_iter+0x3fb/0xd60 [ 112.788798][ T572] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 112.794758][ T572] cgroup_file_write+0x28e/0x590 [ 112.799761][ T572] ? cgroup_seqfile_stop+0xc0/0xc0 [ 112.804849][ T572] ? mutex_lock+0xa6/0x110 [ 112.809239][ T572] ? mutex_trylock+0xb0/0xb0 [ 112.813801][ T572] ? __kasan_check_write+0x14/0x20 [ 112.818889][ T572] kernfs_fop_write_iter+0x2d0/0x410 [ 112.824147][ T572] ? cgroup_seqfile_stop+0xc0/0xc0 [ 112.829236][ T572] vfs_write+0xc1c/0xf40 [ 112.833459][ T572] ? __kasan_check_write+0x14/0x20 [ 112.838546][ T572] ? kernel_write+0x3c0/0x3c0 [ 112.843197][ T572] ? _raw_spin_unlock_irq+0x4e/0x70 [ 112.848368][ T572] ? ptrace_stop+0x6ff/0x9f0 [ 112.852933][ T572] ? __kasan_check_read+0x11/0x20 [ 112.857932][ T572] ? __fdget_pos+0x27e/0x310 [ 112.862502][ T572] ksys_write+0x198/0x2c0 [ 112.866816][ T572] ? do_notify_parent+0xa60/0xa60 [ 112.871821][ T572] ? __ia32_sys_read+0x90/0x90 [ 112.876557][ T572] ? __ia32_sys_open+0x270/0x270 [ 112.881468][ T572] __x64_sys_write+0x7b/0x90 [ 112.886031][ T572] do_syscall_64+0x34/0x70 [ 112.890425][ T572] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 112.896293][ T572] RIP: 0033:0x7fc8ece62c09 [ 112.900688][ T572] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 112.920276][ T572] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 575] write(4, "+pids ", 6 [pid 572] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 572] close(3) = 0 [pid 572] close(4) = 0 [pid 572] close(5) = 0 [pid 572] close(6) = -1 EBADF (Bad file descriptor) [pid 572] close(7) = -1 EBADF (Bad file descriptor) [pid 572] close(8) = -1 EBADF (Bad file descriptor) [pid 572] close(9) = -1 EBADF (Bad file descriptor) [pid 572] close(10) = -1 EBADF (Bad file descriptor) [pid 572] close(11) = -1 EBADF (Bad file descriptor) [pid 572] close(12) = -1 EBADF (Bad file descriptor) [pid 572] close(13) = -1 EBADF (Bad file descriptor) [pid 572] close(14) = -1 EBADF (Bad file descriptor) [pid 572] close(15) = -1 EBADF (Bad file descriptor) [pid 572] close(16) = -1 EBADF (Bad file descriptor) [pid 572] close(17) = -1 EBADF (Bad file descriptor) [pid 572] close(18) = -1 EBADF (Bad file descriptor) [pid 572] close(19) = -1 EBADF (Bad file descriptor) [pid 572] close(20) = -1 EBADF (Bad file descriptor) [pid 572] close(21) = -1 EBADF (Bad file descriptor) [pid 572] close(22) = -1 EBADF (Bad file descriptor) [pid 572] close(23) = -1 EBADF (Bad file descriptor) [pid 572] close(24) = -1 EBADF (Bad file descriptor) [pid 572] close(25) = -1 EBADF (Bad file descriptor) [pid 572] close(26) = -1 EBADF (Bad file descriptor) [pid 572] close(27) = -1 EBADF (Bad file descriptor) [pid 572] close(28) = -1 EBADF (Bad file descriptor) [pid 572] close(29) = -1 EBADF (Bad file descriptor) [pid 572] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory ) = 89 [pid 572] exit_group(0) = ? [pid 572] +++ exited with 0 +++ [pid 375] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=34, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 375] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 375] umount2("./32", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] openat(AT_FDCWD, "./32", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 375] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 375] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 375] umount2("./32/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./32/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 375] unlink("./32/binderfs") = 0 [pid 375] umount2("./32/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./32/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 375] unlink("./32/cgroup") = 0 [pid 375] umount2("./32/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./32/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 375] unlink("./32/cgroup.net") = 0 [ 112.928681][ T572] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 112.936633][ T572] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 112.944666][ T572] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 112.952611][ T572] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 112.960558][ T572] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000020 [ 112.969179][ T572] cgroup: cgroup_addrm_files: failed to add max, err=-12 [ 113.009695][ T375] ------------[ cut here ]------------ [ 113.015215][ T375] WARNING: CPU: 0 PID: 375 at fs/namespace.c:1168 mntput_no_expire+0x48a/0x6c0 [ 113.024214][ T375] Modules linked in: [ 113.028108][ T375] CPU: 0 PID: 375 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 113.039726][ T375] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 113.049804][ T375] RIP: 0010:mntput_no_expire+0x48a/0x6c0 [ 113.055459][ T375] Code: 48 c7 c2 80 02 44 86 e8 64 f0 8e ff e9 8b fc ff ff e8 ba 21 b6 ff e9 81 fc ff ff e8 b0 21 b6 ff e9 77 fc ff ff e8 a6 21 b6 ff <0f> 0b e9 f4 fc ff ff e8 9a 21 b6 ff e8 65 ad a2 ff e9 ea fc ff ff [ 113.075086][ T375] RSP: 0018:ffffc9000095fba0 EFLAGS: 00010293 [ 113.081171][ T375] RAX: ffffffff81b68f1a RBX: 00000000ffffffff RCX: ffff8881065e13c0 [ 113.089139][ T375] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000 [ 113.097127][ T375] RBP: ffffc9000095fc70 R08: ffffffff81b68c08 R09: 0000000000000003 [ 113.105098][ T375] R10: fffff5200012bf65 R11: 1ffff9200012bf64 R12: dffffc0000000000 [ 113.113090][ T375] R13: ffff888114981a40 R14: ffffc9000095fc00 R15: 1ffff9200012bf7c [ 113.121064][ T375] FS: 0000555556fab300(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 113.129970][ T375] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 113.136562][ T375] CR2: 00007ffd7d0e1c18 CR3: 000000011dd54000 CR4: 00000000003506b0 [ 113.144642][ T375] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 113.152629][ T375] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 113.160599][ T375] Call Trace: [ 113.163867][ T375] ? io_schedule+0x120/0x120 [ 113.168446][ T375] ? vfs_submount+0xb0/0xb0 [ 113.172961][ T375] ? shrink_dentry_list+0x4ec/0x500 [ 113.178158][ T375] ? __kasan_check_write+0x14/0x20 [ 113.183282][ T375] namespace_unlock+0x448/0x4f0 [ 113.188140][ T375] ? umount_tree+0xf50/0xf50 [ 113.192758][ T375] ? __detach_mounts+0x670/0x670 [ 113.197692][ T375] ? selinux_umount+0xf0/0x130 [ 113.202475][ T375] ? security_sb_umount+0x9d/0xb0 [ 113.207486][ T375] path_umount+0xf03/0xfb0 [ 113.211964][ T375] ? namespace_unlock+0x4f0/0x4f0 [ 113.216977][ T375] ? user_path_at_empty+0x40/0x50 [ 113.222005][ T375] __x64_sys_umount+0x122/0x170 [ 113.226865][ T375] ? path_umount+0xfb0/0xfb0 [ 113.231545][ T375] ? syscall_enter_from_user_mode+0x58/0x1b0 [ 113.237516][ T375] do_syscall_64+0x34/0x70 [ 113.241939][ T375] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 113.247824][ T375] RIP: 0033:0x7fc8ece63fb7 [ 113.252287][ T375] Code: 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 113.271901][ T375] RSP: 002b:00007ffd7d0e2358 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [ 113.280321][ T375] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc8ece63fb7 [ 113.288286][ T375] RDX: 00007ffd7d0e241a RSI: 000000000000000a RDI: 00007ffd7d0e2410 [ 113.296281][ T375] RBP: 00007ffd7d0e2410 R08: 00000000ffffffff R09: 00007ffd7d0e21f0 [ 113.304251][ T375] R10: 0000555556fad6a3 R11: 0000000000000202 R12: 00007ffd7d0e3490 [ 113.312235][ T375] R13: 0000555556fad600 R14: 00007ffd7d0e2380 R15: 0000000000000021 [ 113.320233][ T375] ---[ end trace d4de1ca9cdcd1979 ]--- [ 113.325883][ T574] FAULT_INJECTION: forcing a failure. [ 113.325883][ T574] name failslab, interval 1, probability 0, space 0, times 0 [ 113.325960][ T375] ------------[ cut here ]------------ [ 113.339063][ T574] CPU: 1 PID: 574 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 113.344083][ T375] WARNING: CPU: 0 PID: 375 at fs/namespace.c:1168 mntput_no_expire+0x48a/0x6c0 [ 113.355520][ T574] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 113.355524][ T574] Call Trace: [ 113.355538][ T574] dump_stack_lvl+0x1e2/0x24b [ 113.355555][ T574] ? bfq_pos_tree_add_move+0x43e/0x43e [ 113.364462][ T375] Modules linked in: [ 113.374493][ T574] dump_stack+0x15/0x17 [ 113.374511][ T574] should_fail+0x3c0/0x510 [ 113.377768][ T375] [ 113.382419][ T574] ? pids_css_alloc+0x4e/0x120 [ 113.382429][ T574] __should_failslab+0x9f/0xe0 [ 113.382445][ T574] should_failslab+0x9/0x20 [ 113.387878][ T375] CPU: 0 PID: 375 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 113.392086][ T574] kmem_cache_alloc_trace+0x3a/0x330 [ 113.392096][ T574] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 113.392112][ T574] pids_css_alloc+0x4e/0x120 [ 113.396233][ T375] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 113.400620][ T574] cgroup_apply_control_enable+0x350/0x12f0 [ 113.400636][ T574] cgroup_apply_control+0x93/0x710 [ 113.402945][ T375] RIP: 0010:mntput_no_expire+0x48a/0x6c0 [ 113.407677][ T574] ? css_next_child+0x160/0x160 [ 113.412419][ T375] Code: 48 c7 c2 80 02 44 86 e8 64 f0 8e ff e9 8b fc ff ff e8 ba 21 b6 ff e9 81 fc ff ff e8 b0 21 b6 ff e9 77 fc ff ff e8 a6 21 b6 ff <0f> 0b e9 f4 fc ff ff e8 9a 21 b6 ff e8 65 ad a2 ff e9 ea fc ff ff [ 113.416886][ T574] ? stack_trace_save+0x12d/0x1f0 [ 113.428480][ T375] RSP: 0018:ffffc9000095fca0 EFLAGS: 00010293 [ 113.433727][ T574] ? io_schedule+0x120/0x120 [ 113.433744][ T574] ? kernfs_fop_write_iter+0x15e/0x410 [ 113.438907][ T375] [ 113.443482][ T574] ? __kasan_check_write+0x14/0x20 [ 113.443494][ T574] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 113.443513][ T574] cgroup_subtree_control_write+0xd19/0x1310 [ 113.453554][ T375] RAX: ffffffff81b68f1a RBX: 00000000fffffffe RCX: ffff8881065e13c0 [ 113.459415][ T574] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 113.464503][ T375] RDX: 0000000000000000 RSI: 00000000fffffffe RDI: 0000000000000000 [ 113.470107][ T574] ? __kasan_check_write+0x14/0x20 [ 113.474937][ T375] RBP: ffffc9000095fd70 R08: ffffffff81b68c08 R09: 0000000000000003 [ 113.494519][ T574] ? _copy_from_iter+0x3fb/0xd60 [ 113.494532][ T574] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 113.494550][ T574] cgroup_file_write+0x28e/0x590 [ 113.499557][ T375] R10: fffff5200012bf85 R11: 1ffff9200012bf84 R12: dffffc0000000000 [ 113.505592][ T574] ? cgroup_seqfile_stop+0xc0/0xc0 [ 113.505603][ T574] ? mutex_lock+0xa6/0x110 [ 113.505619][ T574] ? mutex_trylock+0xb0/0xb0 [ 113.510183][ T375] R13: ffff888114981a40 R14: ffffc9000095fd00 R15: 1ffff9200012bf9c [ 113.515615][ T574] ? __kasan_check_write+0x14/0x20 [ 113.517916][ T375] FS: 0000555556fab300(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 113.522990][ T574] kernfs_fop_write_iter+0x2d0/0x410 [ 113.522999][ T574] ? cgroup_seqfile_stop+0xc0/0xc0 [ 113.523016][ T574] vfs_write+0xc1c/0xf40 [ 113.528273][ T375] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 113.534219][ T574] ? __kasan_check_write+0x14/0x20 [ 113.534236][ T574] ? kernel_write+0x3c0/0x3c0 [pid 375] umount2("./32/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 574] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 574] close(3) = 0 [pid 574] close(4) = 0 [pid 574] close(5) = 0 [pid 574] close(6) = -1 EBADF (Bad file descriptor) [pid 574] close(7) = -1 EBADF (Bad file descriptor) [pid 574] close(8) = -1 EBADF (Bad file descriptor) [pid 574] close(9) = -1 EBADF (Bad file descriptor) [pid 574] close(10) = -1 EBADF (Bad file descriptor) [pid 574] close(11) = -1 EBADF (Bad file descriptor) [pid 574] close(12) = -1 EBADF (Bad file descriptor) [pid 574] close(13) = -1 EBADF (Bad file descriptor) [ 113.542192][ T375] CR2: 00007ffd7d0e1c18 CR3: 000000011dd54000 CR4: 00000000003506b0 [ 113.548140][ T574] ? _raw_spin_unlock_irq+0x4e/0x70 [ 113.556213][ T375] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 113.561281][ T574] ? ptrace_stop+0x6ff/0x9f0 [ 113.561297][ T574] ? __kasan_check_read+0x11/0x20 [ 113.569239][ T375] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 113.574143][ T574] ? __fdget_pos+0x27e/0x310 [ 113.574159][ T574] ksys_write+0x198/0x2c0 [ 113.580103][ T375] Call Trace: [pid 574] close(14) = -1 EBADF (Bad file descriptor) [pid 574] close(15) = -1 EBADF (Bad file descriptor) [pid 574] close(16) = -1 EBADF (Bad file descriptor) [pid 574] close(17) = -1 EBADF (Bad file descriptor) [pid 574] close(18) = -1 EBADF (Bad file descriptor) [pid 574] close(19) = -1 EBADF (Bad file descriptor) [pid 574] close(20) = -1 EBADF (Bad file descriptor) [pid 574] close(21) = -1 EBADF (Bad file descriptor) [pid 574] close(22) = -1 EBADF (Bad file descriptor) [pid 574] close(23) = -1 EBADF (Bad file descriptor) [pid 574] close(24) = -1 EBADF (Bad file descriptor) [pid 574] close(25) = -1 EBADF (Bad file descriptor) [pid 574] close(26) = -1 EBADF (Bad file descriptor) [pid 574] close(27) = -1 EBADF (Bad file descriptor) [pid 574] close(28) = -1 EBADF (Bad file descriptor) [pid 574] close(29) = -1 EBADF (Bad file descriptor) [pid 574] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory ) = 89 [pid 574] exit_group(0) = ? [pid 574] +++ exited with 0 +++ [pid 383] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=29, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 383] restart_syscall(<... resuming interrupted clone ...>) = 0 [ 113.585015][ T574] ? do_notify_parent+0xa60/0xa60 [ 113.585030][ T574] ? __ia32_sys_read+0x90/0x90 [ 113.592986][ T375] ? lockref_get_or_lock+0x340/0x340 [ 113.598058][ T574] ? __ia32_sys_open+0x270/0x270 [ 113.602453][ T375] ? umount_tree+0xf50/0xf50 [ 113.607008][ T574] __x64_sys_write+0x7b/0x90 [ 113.614961][ T375] ? vfs_submount+0xb0/0xb0 [ 113.620037][ T574] do_syscall_64+0x34/0x70 [ 113.628950][ T375] ? dput+0x2b6/0x320 [ 113.634195][ T574] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 113.634209][ T574] RIP: 0033:0x7fc8ece62c09 [ 113.639292][ T375] path_umount+0x1fe/0xfb0 [ 113.643502][ T574] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 113.643515][ T574] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 [ 113.650076][ T375] ? namespace_unlock+0x4f0/0x4f0 [ 113.655146][ T574] ORIG_RAX: 0000000000000001 [ 113.655154][ T574] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 113.655166][ T574] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 113.659823][ T375] ? user_path_at_empty+0x40/0x50 [ 113.667757][ T574] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 113.667764][ T574] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 113.667777][ T574] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 000000000000001b [ 113.672956][ T375] __x64_sys_umount+0x122/0x170 [ 113.852304][ T375] ? path_umount+0xfb0/0xfb0 [ 113.856884][ T375] ? syscall_enter_from_user_mode+0x58/0x1b0 [ 113.862864][ T375] do_syscall_64+0x34/0x70 [ 113.867266][ T375] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 113.873160][ T375] RIP: 0033:0x7fc8ece63fb7 [ 113.877564][ T375] Code: 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 113.897170][ T375] RSP: 002b:00007ffd7d0e2358 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [ 113.905593][ T375] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc8ece63fb7 [pid 383] umount2("./27", MNT_DETACH|UMOUNT_NOFOLLOW [pid 375] <... umount2 resumed>) = 0 [pid 375] umount2("./32/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 375] lstat("./32/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 383] openat(AT_FDCWD, "./27", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 383] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 375] umount2("./32/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 383] getdents64(3, [pid 375] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 375] openat(AT_FDCWD, "./32/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 375] fstat(4, [pid 383] <... getdents64 resumed>0x555556fad630 /* 7 entries */, 32768) = 208 [pid 375] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 375] getdents64(4, [pid 383] umount2("./27/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] <... getdents64 resumed>0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 375] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 383] lstat("./27/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 375] close(4 [pid 383] unlink("./27/binderfs" [pid 375] <... close resumed>) = 0 [pid 375] rmdir("./32/file0" [pid 383] <... unlink resumed>) = 0 [pid 375] <... rmdir resumed>) = 0 [pid 375] umount2("./32/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 383] umount2("./27/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 375] lstat("./32/cgroup.cpu", [pid 383] lstat("./27/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 375] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 383] unlink("./27/cgroup" [pid 375] unlink("./32/cgroup.cpu") = 0 [pid 375] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 383] <... unlink resumed>) = 0 [pid 375] close(3) = 0 [pid 383] umount2("./27/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./27/cgroup.net", [pid 375] rmdir("./32") = 0 [pid 383] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 383] unlink("./27/cgroup.net" [pid 375] mkdir("./33", 0777) = 0 [pid 383] <... unlink resumed>) = 0 [pid 375] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 383] umount2("./27/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 ./strace-static-x86_64: Process 576 attached [pid 375] <... clone resumed>, child_tidptr=0x555556fab5d0) = 35 [pid 576] chdir("./33" [pid 383] umount2("./27/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 576] <... chdir resumed>) = 0 [pid 383] lstat("./27/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 576] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 383] umount2("./27/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 576] setpgid(0, 0 [pid 383] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 383] openat(AT_FDCWD, "./27/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 576] <... setpgid resumed>) = 0 [pid 383] <... openat resumed>) = 4 [pid 576] symlink("/syzcgroup/unified/syz0", "./cgroup" [pid 383] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 383] getdents64(4, [pid 576] <... symlink resumed>) = 0 [pid 576] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu" [pid 383] <... getdents64 resumed>0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 383] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 383] close(4) = 0 [pid 576] <... symlink resumed>) = 0 [pid 383] rmdir("./27/file0" [pid 576] symlink("/syzcgroup/net/syz0", "./cgroup.net" [pid 383] <... rmdir resumed>) = 0 [pid 576] <... symlink resumed>) = 0 [pid 576] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 383] umount2("./27/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 576] <... openat resumed>) = 3 [pid 383] lstat("./27/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 576] write(3, "1000", 4 [pid 383] unlink("./27/cgroup.cpu" [pid 576] <... write resumed>) = 4 [pid 383] <... unlink resumed>) = 0 [pid 576] close(3) = 0 [pid 383] getdents64(3, [pid 576] symlink("/dev/binderfs", "./binderfs" [pid 383] <... getdents64 resumed>0x555556fad630 /* 0 entries */, 32768) = 0 [pid 383] close(3 [pid 576] <... symlink resumed>) = 0 [pid 383] <... close resumed>) = 0 [pid 383] rmdir("./27" [pid 576] mkdirat(AT_FDCWD, "./file0", 000 [pid 383] <... rmdir resumed>) = 0 [pid 383] mkdir("./28", 0777 [pid 576] <... mkdirat resumed>) = 0 [pid 383] <... mkdir resumed>) = 0 [pid 383] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 576] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 383] <... clone resumed>, child_tidptr=0x555556fab5d0) = 30 ./strace-static-x86_64: Process 577 attached [ 113.913569][ T375] RDX: 00007ffd7d0e241a RSI: 000000000000000a RDI: 00007ffd7d0e2410 [ 113.921537][ T375] RBP: 00007ffd7d0e2410 R08: 00000000ffffffff R09: 00007ffd7d0e21f0 [ 113.929491][ T375] R10: 0000555556fad6a3 R11: 0000000000000202 R12: 00007ffd7d0e3490 [ 113.937455][ T375] R13: 0000555556fad600 R14: 00007ffd7d0e2380 R15: 0000000000000021 [ 113.945422][ T375] ---[ end trace d4de1ca9cdcd197a ]--- [pid 576] open("./file0", O_RDONLY [pid 577] chdir("./28" [pid 573] <... write resumed>) = 6 [pid 577] <... chdir resumed>) = 0 [pid 576] <... open resumed>) = 3 [pid 573] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 577] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 576] openat(3, "cgroup.subtree_control", O_RDWR [pid 573] <... openat resumed>) = 5 [pid 573] write(5, "22", 2) = 2 [pid 573] write(4, "+pids ", 6 [pid 577] <... prctl resumed>) = 0 [pid 577] setpgid(0, 0) = 0 [pid 577] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 577] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 577] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [pid 577] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 577] write(3, "1000", 4) = 4 [pid 577] close(3) = 0 [pid 577] symlink("/dev/binderfs", "./binderfs") = 0 [pid 577] mkdirat(AT_FDCWD, "./file0", 000) = 0 [ 113.974083][ T569] FAULT_INJECTION: forcing a failure. [ 113.974083][ T569] name failslab, interval 1, probability 0, space 0, times 0 [ 113.987169][ T569] CPU: 0 PID: 569 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 113.998789][ T569] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 114.008822][ T569] Call Trace: [ 114.012164][ T569] dump_stack_lvl+0x1e2/0x24b [ 114.016833][ T569] ? bfq_pos_tree_add_move+0x43e/0x43e [pid 577] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 576] <... openat resumed>) = 4 [ 114.022271][ T569] ? selinux_kernfs_init_security+0x1a8/0x760 [ 114.028317][ T569] dump_stack+0x15/0x17 [ 114.032452][ T569] should_fail+0x3c0/0x510 [ 114.036848][ T569] ? __kernfs_new_node+0x99/0x6e0 [ 114.041853][ T569] __should_failslab+0x9f/0xe0 [ 114.046594][ T569] should_failslab+0x9/0x20 [ 114.051077][ T569] __kmalloc_track_caller+0x5f/0x350 [ 114.056341][ T569] kstrdup_const+0x55/0x90 [ 114.060881][ T569] __kernfs_new_node+0x99/0x6e0 [ 114.065716][ T569] ? is_module_text_address+0xe1/0x140 [ 114.071154][ T569] ? kernfs_new_node+0x170/0x170 [ 114.076071][ T569] ? ptr_to_hashval+0x60/0x60 [ 114.080736][ T569] ? arch_stack_walk+0xf8/0x140 [ 114.085590][ T569] ? snprintf+0xd6/0x120 [ 114.089836][ T569] kernfs_new_node+0x97/0x170 [ 114.094517][ T569] __kernfs_create_file+0x4a/0x270 [ 114.099618][ T569] cgroup_addrm_files+0xab8/0xfe0 [ 114.104732][ T569] ? ____kasan_kmalloc+0xdc/0x110 [ 114.109747][ T569] ? __kasan_kmalloc+0x9/0x10 [ 114.114405][ T569] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 114.119927][ T569] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 114.126062][ T569] ? delete_node+0x759/0x7b0 [ 114.130635][ T569] ? __kasan_check_read+0x11/0x20 [ 114.135637][ T569] ? delete_node+0x759/0x7b0 [ 114.140212][ T569] ? __kasan_check_write+0x14/0x20 [ 114.145307][ T569] ? idr_replace+0x1c4/0x230 [ 114.149874][ T569] ? idr_get_next+0x4b0/0x4b0 [ 114.154529][ T569] ? _raw_spin_lock_bh+0xa3/0x1b0 [ 114.159538][ T569] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 114.164724][ T569] css_populate_dir+0x137/0x370 [ 114.169556][ T569] cgroup_apply_control_enable+0x8b9/0x12f0 [ 114.175428][ T569] cgroup_apply_control+0x93/0x710 [ 114.180525][ T569] ? css_next_child+0x160/0x160 [ 114.185365][ T569] ? stack_trace_save+0x12d/0x1f0 [ 114.190371][ T569] ? io_schedule+0x120/0x120 [ 114.194938][ T569] ? kernfs_fop_write_iter+0x15e/0x410 [ 114.200374][ T569] ? __kasan_check_write+0x14/0x20 [ 114.205472][ T569] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 114.210748][ T569] cgroup_subtree_control_write+0xd19/0x1310 [ 114.216713][ T569] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 114.222676][ T569] ? __kasan_check_write+0x14/0x20 [ 114.227770][ T569] ? _copy_from_iter+0x3fb/0xd60 [ 114.232693][ T569] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 114.238656][ T569] cgroup_file_write+0x28e/0x590 [ 114.243576][ T569] ? cgroup_seqfile_stop+0xc0/0xc0 [ 114.248681][ T569] ? mutex_lock+0xa6/0x110 [ 114.253082][ T569] ? mutex_trylock+0xb0/0xb0 [ 114.257654][ T569] ? __kasan_check_write+0x14/0x20 [ 114.262748][ T569] kernfs_fop_write_iter+0x2d0/0x410 [ 114.268015][ T569] ? cgroup_seqfile_stop+0xc0/0xc0 [ 114.273121][ T569] vfs_write+0xc1c/0xf40 [ 114.277362][ T569] ? __kasan_check_write+0x14/0x20 [ 114.282463][ T569] ? kernel_write+0x3c0/0x3c0 [ 114.287121][ T569] ? _raw_spin_unlock_irq+0x4e/0x70 [ 114.292301][ T569] ? ptrace_stop+0x6ff/0x9f0 [ 114.296874][ T569] ? __kasan_check_read+0x11/0x20 [ 114.301882][ T569] ? __fdget_pos+0x27e/0x310 [ 114.306458][ T569] ksys_write+0x198/0x2c0 [ 114.310776][ T569] ? do_notify_parent+0xa60/0xa60 [ 114.315789][ T569] ? __ia32_sys_read+0x90/0x90 [ 114.320631][ T569] ? __ia32_sys_open+0x270/0x270 [ 114.325553][ T569] __x64_sys_write+0x7b/0x90 [ 114.330126][ T569] do_syscall_64+0x34/0x70 [ 114.334526][ T569] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 114.340398][ T569] RIP: 0033:0x7fc8ece62c09 [ 114.344796][ T569] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 114.364381][ T569] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 576] write(4, "-pids ", 6 [pid 569] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 577] <... mount resumed>) = 0 [pid 569] close(3) = 0 [pid 569] close(4) = 0 [pid 569] close(5) = 0 [pid 569] close(6) = -1 EBADF (Bad file descriptor) [pid 569] close(7) = -1 EBADF (Bad file descriptor) [pid 569] close(8) = -1 EBADF (Bad file descriptor) [pid 569] close(9) = -1 EBADF (Bad file descriptor) [pid 569] close(10) = -1 EBADF (Bad file descriptor) [pid 569] close(11) = -1 EBADF (Bad file descriptor) [pid 569] close(12) = -1 EBADF (Bad file descriptor) [pid 569] close(13) = -1 EBADF (Bad file descriptor) [pid 569] close(14) = -1 EBADF (Bad file descriptor) [pid 569] close(15) = -1 EBADF (Bad file descriptor) [pid 569] close(16) = -1 EBADF (Bad file descriptor) [pid 569] close(17) = -1 EBADF (Bad file descriptor) [pid 569] close(18) = -1 EBADF (Bad file descriptor) [pid 569] close(19) = -1 EBADF (Bad file descriptor) [pid 569] close(20) = -1 EBADF (Bad file descriptor) [pid 569] close(21) = -1 EBADF (Bad file descriptor) [pid 569] close(22) = -1 EBADF (Bad file descriptor) [pid 569] close(23) = -1 EBADF (Bad file descriptor) [pid 569] close(24) = -1 EBADF (Bad file descriptor) [pid 569] close(25) = -1 EBADF (Bad file descriptor) [pid 569] close(26) = -1 EBADF (Bad file descriptor) [pid 569] close(27) = -1 EBADF (Bad file descriptor) [pid 569] close(28) = -1 EBADF (Bad file descriptor) [pid 569] close(29) = -1 EBADF (Bad file descriptor) write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory [pid 569] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 569] exit_group(0) = ? [pid 577] open("./file0", O_RDONLY) = 3 [pid 577] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [pid 577] write(4, "-pids ", 6 [pid 569] +++ exited with 0 +++ [pid 381] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=33, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 381] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 381] umount2("./31", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] openat(AT_FDCWD, "./31", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 381] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 381] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 381] umount2("./31/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./31/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 381] unlink("./31/binderfs") = 0 [pid 381] umount2("./31/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./31/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 381] unlink("./31/cgroup") = 0 [pid 381] umount2("./31/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./31/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 381] unlink("./31/cgroup.net") = 0 [ 114.372776][ T569] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 114.380730][ T569] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 114.388681][ T569] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 114.396637][ T569] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 114.404589][ T569] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 000000000000001f [ 114.414310][ T569] cgroup: cgroup_addrm_files: failed to add max, err=-12 [ 114.433411][ T381] ------------[ cut here ]------------ [ 114.438910][ T381] WARNING: CPU: 0 PID: 381 at fs/namespace.c:1168 mntput_no_expire+0x48a/0x6c0 [ 114.447850][ T381] Modules linked in: [ 114.451744][ T381] CPU: 0 PID: 381 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 114.463393][ T381] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 114.473457][ T381] RIP: 0010:mntput_no_expire+0x48a/0x6c0 [ 114.479068][ T381] Code: 48 c7 c2 80 02 44 86 e8 64 f0 8e ff e9 8b fc ff ff e8 ba 21 b6 ff e9 81 fc ff ff e8 b0 21 b6 ff e9 77 fc ff ff e8 a6 21 b6 ff <0f> 0b e9 f4 fc ff ff e8 9a 21 b6 ff e8 65 ad a2 ff e9 ea fc ff ff [ 114.498688][ T381] RSP: 0018:ffffc90000b37ba0 EFLAGS: 00010293 [ 114.504785][ T381] RAX: ffffffff81b68f1a RBX: 00000000ffffffff RCX: ffff8881065813c0 [ 114.512769][ T381] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000 [ 114.520752][ T381] RBP: ffffc90000b37c70 R08: ffffffff81b68c08 R09: 0000000000000003 [ 114.528717][ T381] R10: fffff52000166f65 R11: 1ffff92000166f64 R12: dffffc0000000000 [ 114.536715][ T381] R13: ffff888114b3ac40 R14: ffffc90000b37c00 R15: 1ffff92000166f7c [ 114.544703][ T381] FS: 0000555556fab300(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 114.553648][ T381] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 114.560333][ T381] CR2: 00007ffd7d0e1c18 CR3: 000000011dddb000 CR4: 00000000003506b0 [ 114.568378][ T381] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 114.576363][ T381] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 114.584334][ T381] Call Trace: [ 114.587609][ T381] ? io_schedule+0x120/0x120 [ 114.592207][ T381] ? vfs_submount+0xb0/0xb0 [ 114.596699][ T381] ? shrink_dentry_list+0x4ec/0x500 [ 114.601902][ T381] ? __kasan_check_write+0x14/0x20 [ 114.606997][ T381] namespace_unlock+0x448/0x4f0 [ 114.611849][ T381] ? umount_tree+0xf50/0xf50 [ 114.616429][ T381] ? __detach_mounts+0x670/0x670 [ 114.621367][ T381] ? selinux_umount+0xf0/0x130 [ 114.626113][ T381] ? security_sb_umount+0x9d/0xb0 [ 114.631133][ T381] path_umount+0xf03/0xfb0 [ 114.635539][ T381] ? namespace_unlock+0x4f0/0x4f0 [ 114.640566][ T381] ? user_path_at_empty+0x40/0x50 [ 114.645576][ T381] __x64_sys_umount+0x122/0x170 [ 114.650429][ T381] ? path_umount+0xfb0/0xfb0 [ 114.655004][ T381] ? syscall_enter_from_user_mode+0x58/0x1b0 [ 114.661070][ T381] do_syscall_64+0x34/0x70 [ 114.665478][ T381] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 114.671364][ T381] RIP: 0033:0x7fc8ece63fb7 [ 114.675764][ T381] Code: 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 114.695989][ T381] RSP: 002b:00007ffd7d0e2358 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [ 114.704415][ T381] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc8ece63fb7 [ 114.712386][ T381] RDX: 00007ffd7d0e241a RSI: 000000000000000a RDI: 00007ffd7d0e2410 [ 114.720355][ T381] RBP: 00007ffd7d0e2410 R08: 00000000ffffffff R09: 00007ffd7d0e21f0 [ 114.728318][ T381] R10: 0000555556fad6a3 R11: 0000000000000202 R12: 00007ffd7d0e3490 [ 114.736292][ T381] R13: 0000555556fad600 R14: 00007ffd7d0e2380 R15: 0000000000000020 [ 114.744259][ T381] ---[ end trace d4de1ca9cdcd197b ]--- [ 114.749767][ T381] ------------[ cut here ]------------ [ 114.749896][ T573] FAULT_INJECTION: forcing a failure. [ 114.749896][ T573] name failslab, interval 1, probability 0, space 0, times 0 [ 114.755273][ T381] WARNING: CPU: 1 PID: 381 at fs/namespace.c:1168 mntput_no_expire+0x48a/0x6c0 [ 114.755284][ T381] Modules linked in: [ 114.767924][ T573] CPU: 0 PID: 573 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 114.776765][ T381] [ 114.780619][ T573] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 114.780624][ T573] Call Trace: [ 114.780651][ T573] dump_stack_lvl+0x1e2/0x24b [ 114.792242][ T381] CPU: 1 PID: 381 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 114.794538][ T573] ? bfq_pos_tree_add_move+0x43e/0x43e [ 114.804564][ T381] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 114.807823][ T573] ? selinux_kernfs_init_security+0x1a8/0x760 [ 114.812476][ T381] RIP: 0010:mntput_no_expire+0x48a/0x6c0 [ 114.824054][ T573] dump_stack+0x15/0x17 [ 114.824062][ T573] should_fail+0x3c0/0x510 [ 114.824078][ T573] ? __kernfs_new_node+0x99/0x6e0 [ 114.829504][ T381] Code: 48 c7 c2 80 02 44 86 e8 64 f0 8e ff e9 8b fc ff ff e8 ba 21 b6 ff e9 81 fc ff ff e8 b0 21 b6 ff e9 77 fc ff ff e8 a6 21 b6 ff <0f> 0b e9 f4 fc ff ff e8 9a 21 b6 ff e8 65 ad a2 ff e9 ea fc ff ff [ 114.829518][ T381] RSP: 0018:ffffc90000b37ca0 EFLAGS: 00010293 [ 114.839547][ T573] __should_failslab+0x9f/0xe0 [ 114.839563][ T573] should_failslab+0x9/0x20 [ 114.845596][ T381] [ 114.851200][ T573] __kmalloc_track_caller+0x5f/0x350 [ 114.851216][ T573] kstrdup_const+0x55/0x90 [ 114.855343][ T381] RAX: ffffffff81b68f1a RBX: 00000000fffffffe RCX: ffff8881065813c0 [ 114.859735][ T573] __kernfs_new_node+0x99/0x6e0 [ 114.864732][ T381] RDX: 0000000000000000 RSI: 00000000fffffffe RDI: 0000000000000000 [ 114.884303][ T573] ? is_module_text_address+0xe1/0x140 [ 114.884319][ T573] ? kernfs_new_node+0x170/0x170 [ 114.890359][ T381] RBP: ffffc90000b37d70 R08: ffffffff81b68c08 R09: 0000000000000003 [ 114.895088][ T573] ? ptr_to_hashval+0x60/0x60 [ 114.899556][ T381] R10: fffff52000166f85 R11: 1ffff92000166f84 R12: dffffc0000000000 [ 114.901854][ T573] ? arch_stack_walk+0xf8/0x140 [ 114.901869][ T573] ? snprintf+0xd6/0x120 [ 114.907160][ T381] R13: ffff888114b3ac40 R14: ffffc90000b37d00 R15: 1ffff92000166f9c [ 114.911542][ T573] kernfs_new_node+0x97/0x170 [ 114.911558][ T573] __kernfs_create_file+0x4a/0x270 [ 114.919508][ T381] FS: 0000555556fab300(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 114.924323][ T573] cgroup_addrm_files+0xab8/0xfe0 [ 114.924339][ T573] ? ____kasan_kmalloc+0xdc/0x110 [ 114.932287][ T381] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 114.937715][ T573] ? __kasan_kmalloc+0x9/0x10 [ 114.942632][ T381] CR2: 00007fc8ececd130 CR3: 000000011dddb000 CR4: 00000000003506a0 [ 114.950574][ T573] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 114.950590][ T573] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 114.955238][ T381] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 114.963178][ T573] ? delete_node+0x759/0x7b0 [ 114.963195][ T573] ? __kasan_check_read+0x11/0x20 [ 114.968012][ T381] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 114.972219][ T573] ? delete_node+0x759/0x7b0 [ 114.972228][ T573] ? __kasan_check_write+0x14/0x20 [ 114.972244][ T573] ? idr_replace+0x1c4/0x230 [ 114.980192][ T381] Call Trace: [ 114.984840][ T573] ? idr_get_next+0x4b0/0x4b0 [ 114.989919][ T381] ? lockref_get_or_lock+0x340/0x340 [ 114.998811][ T573] ? _raw_spin_lock_bh+0xa3/0x1b0 [ 114.998819][ T573] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 114.998834][ T573] css_populate_dir+0x137/0x370 [ 115.003834][ T381] ? umount_tree+0xf50/0xf50 [ 115.008822][ T573] cgroup_apply_control_enable+0x8b9/0x12f0 [ 115.015383][ T381] ? vfs_submount+0xb0/0xb0 [ 115.020026][ T573] cgroup_apply_control+0x93/0x710 [ 115.027978][ T381] ? dput+0x2b6/0x320 [ 115.033480][ T573] ? css_next_child+0x160/0x160 [ 115.033495][ T573] ? stack_trace_save+0x12d/0x1f0 [ 115.039618][ T381] path_umount+0x1fe/0xfb0 [ 115.047558][ T573] ? io_schedule+0x120/0x120 [ 115.047574][ T573] ? kernfs_fop_write_iter+0x15e/0x410 [ 115.052147][ T381] ? namespace_unlock+0x4f0/0x4f0 [ 115.057139][ T573] ? __kasan_check_write+0x14/0x20 [ 115.065090][ T381] ? user_path_at_empty+0x40/0x50 [ 115.069666][ T573] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 115.074752][ T381] __x64_sys_umount+0x122/0x170 [ 115.079308][ T573] cgroup_subtree_control_write+0xd19/0x1310 [ 115.082573][ T381] ? path_umount+0xfb0/0xfb0 [ 115.087213][ T573] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 115.092477][ T381] ? syscall_enter_from_user_mode+0x58/0x1b0 [ 115.097465][ T573] ? __kasan_check_write+0x14/0x20 [ 115.102637][ T381] do_syscall_64+0x34/0x70 [ 115.107452][ T573] ? _copy_from_iter+0x3fb/0xd60 [ 115.112017][ T381] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 115.117875][ T573] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 115.122350][ T381] RIP: 0033:0x7fc8ece63fb7 [ 115.127426][ T573] cgroup_file_write+0x28e/0x590 [ 115.131384][ T381] Code: 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 115.136198][ T573] ? cgroup_seqfile_stop+0xc0/0xc0 [ 115.141194][ T381] RSP: 002b:00007ffd7d0e2358 EFLAGS: 00000202 [ 115.145577][ T573] ? mutex_lock+0xa6/0x110 [ 115.150131][ T381] ORIG_RAX: 00000000000000a6 [ 115.155557][ T573] ? mutex_trylock+0xb0/0xb0 [ 115.155574][ T573] ? __kasan_check_write+0x14/0x20 [ 115.160570][ T381] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc8ece63fb7 [ 115.165648][ T573] kernfs_fop_write_iter+0x2d0/0x410 [ 115.170644][ T381] RDX: 00007ffd7d0e241a RSI: 000000000000000a RDI: 00007ffd7d0e2410 [ 115.175896][ T573] ? cgroup_seqfile_stop+0xc0/0xc0 [ 115.180718][ T381] RBP: 00007ffd7d0e2410 R08: 00000000ffffffff R09: 00007ffd7d0e21f0 [ 115.186663][ T573] vfs_write+0xc1c/0xf40 [ 115.191227][ T381] R10: 0000555556fad6a3 R11: 0000000000000202 R12: 00007ffd7d0e3490 [ 115.197177][ T573] ? __kasan_check_write+0x14/0x20 [ 115.203131][ T381] R13: 0000555556fad600 R14: 00007ffd7d0e2380 R15: 0000000000000020 [ 115.208211][ T573] ? kernel_write+0x3c0/0x3c0 [ 115.212605][ T381] ---[ end trace d4de1ca9cdcd197c ]--- [ 115.217516][ T573] ? _raw_spin_unlock_irq+0x4e/0x70 [ 115.363011][ T573] ? ptrace_stop+0x6ff/0x9f0 [ 115.367588][ T573] ? __kasan_check_read+0x11/0x20 [ 115.372592][ T573] ? __fdget_pos+0x27e/0x310 [ 115.377174][ T573] ksys_write+0x198/0x2c0 [ 115.381509][ T573] ? do_notify_parent+0xa60/0xa60 [ 115.386520][ T573] ? __ia32_sys_read+0x90/0x90 [ 115.391267][ T573] ? __ia32_sys_open+0x270/0x270 [ 115.396184][ T573] __x64_sys_write+0x7b/0x90 [ 115.400761][ T573] do_syscall_64+0x34/0x70 [ 115.405158][ T573] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 115.411036][ T573] RIP: 0033:0x7fc8ece62c09 [ 115.415439][ T573] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 381] umount2("./31/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 381] umount2("./31/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./31/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 381] umount2("./31/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] openat(AT_FDCWD, "./31/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 381] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 381] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 381] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 381] close(4) = 0 [pid 381] rmdir("./31/file0") = 0 [pid 381] umount2("./31/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./31/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 381] unlink("./31/cgroup.cpu") = 0 [pid 381] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 381] close(3) = 0 [pid 381] rmdir("./31") = 0 [pid 381] mkdir("./32", 0777) = 0 [pid 381] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556fab5d0) = 34 ./strace-static-x86_64: Process 578 attached [pid 578] chdir("./32") = 0 [pid 578] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 578] setpgid(0, 0) = 0 [pid 578] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [pid 578] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 578] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 578] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 578] write(3, "1000", 4) = 4 [pid 578] close(3) = 0 [pid 578] symlink("/dev/binderfs", "./binderfs") = 0 [pid 578] mkdirat(AT_FDCWD, "./file0", 000) = 0 [ 115.435033][ T573] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 115.443429][ T573] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 115.451386][ T573] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 115.459343][ T573] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 115.467294][ T573] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 115.475244][ T573] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 000000000000001f [pid 578] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 573] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 578] <... mount resumed>) = 0 [pid 578] open("./file0", O_RDONLY) = 3 [pid 573] close(3 [pid 578] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [pid 573] <... close resumed>) = 0 [pid 578] write(4, "-pids ", 6 [pid 573] close(4) = 0 [pid 573] close(5) = 0 [pid 573] close(6) = -1 EBADF (Bad file descriptor) [pid 573] close(7) = -1 EBADF (Bad file descriptor) [pid 573] close(8) = -1 EBADF (Bad file descriptor) [pid 573] close(9) = -1 EBADF (Bad file descriptor) [pid 573] close(10) = -1 EBADF (Bad file descriptor) [pid 573] close(11) = -1 EBADF (Bad file descriptor) [pid 573] close(12) = -1 EBADF (Bad file descriptor) [pid 573] close(13) = -1 EBADF (Bad file descriptor) [pid 573] close(14) = -1 EBADF (Bad file descriptor) [pid 573] close(15) = -1 EBADF (Bad file descriptor) [pid 573] close(16) = -1 EBADF (Bad file descriptor) [pid 573] close(17) = -1 EBADF (Bad file descriptor) [pid 573] close(18) = -1 EBADF (Bad file descriptor) [pid 573] close(19) = -1 EBADF (Bad file descriptor) [pid 573] close(20) = -1 EBADF (Bad file descriptor) [pid 573] close(21) = -1 EBADF (Bad file descriptor) [pid 573] close(22) = -1 EBADF (Bad file descriptor) [pid 573] close(23) = -1 EBADF (Bad file descriptor) [pid 573] close(24) = -1 EBADF (Bad file descriptor) [pid 573] close(25) = -1 EBADF (Bad file descriptor) [pid 573] close(26) = -1 EBADF (Bad file descriptor) [pid 573] close(27) = -1 EBADF (Bad file descriptor) [pid 573] close(28) = -1 EBADF (Bad file descriptor) [pid 573] close(29) = -1 EBADF (Bad file descriptor) [pid 573] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory ) = 89 [pid 573] exit_group(0) = ? [pid 573] +++ exited with 0 +++ [pid 376] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=33, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 376] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 376] umount2("./31", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] openat(AT_FDCWD, "./31", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 376] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 376] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 376] umount2("./31/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./31/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 376] unlink("./31/binderfs") = 0 [pid 376] umount2("./31/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./31/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 376] unlink("./31/cgroup") = 0 [pid 376] umount2("./31/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./31/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 376] unlink("./31/cgroup.net") = 0 [pid 376] umount2("./31/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 376] umount2("./31/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./31/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 376] umount2("./31/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] openat(AT_FDCWD, "./31/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 376] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 376] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 376] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 376] close(4) = 0 [pid 376] rmdir("./31/file0") = 0 [pid 376] umount2("./31/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./31/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 376] unlink("./31/cgroup.cpu") = 0 [pid 376] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 376] close(3) = 0 [pid 376] rmdir("./31") = 0 [pid 376] mkdir("./32", 0777) = 0 [pid 376] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 579 attached [pid 579] chdir("./32" [pid 376] <... clone resumed>, child_tidptr=0x555556fab5d0) = 34 [pid 579] <... chdir resumed>) = 0 [pid 579] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 579] setpgid(0, 0) = 0 [pid 579] symlink("/syzcgroup/unified/syz1", "./cgroup") = 0 [pid 579] symlink("/syzcgroup/cpu/syz1", "./cgroup.cpu") = 0 [pid 579] symlink("/syzcgroup/net/syz1", "./cgroup.net") = 0 [pid 579] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 579] write(3, "1000", 4) = 4 [pid 579] close(3) = 0 [pid 579] symlink("/dev/binderfs", "./binderfs") = 0 [pid 579] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 579] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 579] open("./file0", O_RDONLY) = 3 [pid 579] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [ 115.483749][ T573] cgroup: cgroup_addrm_files: failed to add max, err=-12 [pid 579] write(4, "-pids ", 6 [pid 578] <... write resumed>) = 6 [pid 576] <... write resumed>) = 6 [pid 578] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 576] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 578] <... openat resumed>) = 5 [pid 576] <... openat resumed>) = 5 [pid 578] write(5, "22", 2 [pid 576] write(5, "22", 2 [pid 578] <... write resumed>) = 2 [pid 576] <... write resumed>) = 2 [pid 578] write(4, "+pids ", 6 [ 115.530476][ T575] FAULT_INJECTION: forcing a failure. [ 115.530476][ T575] name failslab, interval 1, probability 0, space 0, times 0 [ 115.543464][ T575] CPU: 0 PID: 575 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 115.555079][ T575] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 115.565111][ T575] Call Trace: [ 115.568389][ T575] dump_stack_lvl+0x1e2/0x24b [ 115.573066][ T575] ? panic+0x7d7/0x7d7 [ 115.577128][ T575] ? bfq_pos_tree_add_move+0x43e/0x43e [ 115.582574][ T575] ? find_next_bit+0xd6/0x120 [ 115.587226][ T575] ? cpumask_next+0x11/0x30 [ 115.591703][ T575] dump_stack+0x15/0x17 [ 115.595848][ T575] should_fail+0x3c0/0x510 [ 115.600253][ T575] ? percpu_ref_init+0xd0/0x330 [ 115.605088][ T575] __should_failslab+0x9f/0xe0 [ 115.609830][ T575] should_failslab+0x9/0x20 [ 115.614425][ T575] kmem_cache_alloc_trace+0x3a/0x330 [ 115.619690][ T575] percpu_ref_init+0xd0/0x330 [ 115.624342][ T575] ? cgroup_setup_root+0xea0/0xea0 [ 115.629439][ T575] cgroup_apply_control_enable+0x3a2/0x12f0 [ 115.635308][ T575] cgroup_apply_control+0x93/0x710 [ 115.640409][ T575] ? css_next_child+0x160/0x160 [ 115.645252][ T575] ? stack_trace_save+0x12d/0x1f0 [ 115.650267][ T575] ? io_schedule+0x120/0x120 [ 115.654849][ T575] ? kernfs_fop_write_iter+0x15e/0x410 [ 115.660301][ T575] ? __kasan_check_write+0x14/0x20 [ 115.665404][ T575] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 115.670676][ T575] cgroup_subtree_control_write+0xd19/0x1310 [ 115.676641][ T575] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 115.682608][ T575] ? __kasan_check_write+0x14/0x20 [ 115.687700][ T575] ? _copy_from_iter+0x3fb/0xd60 [ 115.692620][ T575] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 115.698579][ T575] cgroup_file_write+0x28e/0x590 [ 115.703510][ T575] ? cgroup_seqfile_stop+0xc0/0xc0 [ 115.708615][ T575] ? mutex_lock+0xa6/0x110 [ 115.713016][ T575] ? mutex_trylock+0xb0/0xb0 [ 115.717605][ T575] ? __kasan_check_write+0x14/0x20 [ 115.722692][ T575] kernfs_fop_write_iter+0x2d0/0x410 [ 115.727956][ T575] ? cgroup_seqfile_stop+0xc0/0xc0 [ 115.733066][ T575] vfs_write+0xc1c/0xf40 [ 115.737295][ T575] ? __kasan_check_write+0x14/0x20 [ 115.742393][ T575] ? kernel_write+0x3c0/0x3c0 [ 115.747071][ T575] ? _raw_spin_unlock_irq+0x4e/0x70 [ 115.752255][ T575] ? ptrace_stop+0x6ff/0x9f0 [ 115.756823][ T575] ? __kasan_check_read+0x11/0x20 [ 115.761823][ T575] ? __fdget_pos+0x27e/0x310 [ 115.766390][ T575] ksys_write+0x198/0x2c0 [ 115.770697][ T575] ? do_notify_parent+0xa60/0xa60 [ 115.775701][ T575] ? __ia32_sys_read+0x90/0x90 [ 115.780442][ T575] ? __ia32_sys_open+0x270/0x270 [ 115.785361][ T575] __x64_sys_write+0x7b/0x90 [ 115.789938][ T575] do_syscall_64+0x34/0x70 [ 115.794340][ T575] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 115.800214][ T575] RIP: 0033:0x7fc8ece62c09 [ 115.804608][ T575] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 576] write(4, "+pids ", 6 [pid 575] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 382] kill(-38, SIGKILL [pid 575] close(3 [pid 382] <... kill resumed>) = 0 [pid 382] kill(38, SIGKILL [pid 575] <... close resumed>) = 0 [pid 382] <... kill resumed>) = 0 [pid 575] close(4) = 0 [pid 575] close(5) = 0 [pid 575] close(6) = -1 EBADF (Bad file descriptor) [pid 575] close(7) = -1 EBADF (Bad file descriptor) [pid 575] close(8) = -1 EBADF (Bad file descriptor) [pid 575] close(9) = -1 EBADF (Bad file descriptor) [pid 575] close(10) = -1 EBADF (Bad file descriptor) [pid 575] close(11) = -1 EBADF (Bad file descriptor) [pid 575] close(12) = -1 EBADF (Bad file descriptor) [pid 575] close(13) = -1 EBADF (Bad file descriptor) [pid 575] close(14) = -1 EBADF (Bad file descriptor) [pid 575] close(15) = -1 EBADF (Bad file descriptor) [pid 575] close(16) = -1 EBADF (Bad file descriptor) [pid 575] close(17) = -1 EBADF (Bad file descriptor) [pid 575] close(18) = -1 EBADF (Bad file descriptor) [pid 575] close(19) = -1 EBADF (Bad file descriptor) [pid 575] close(20) = -1 EBADF (Bad file descriptor) [pid 575] close(21) = -1 EBADF (Bad file descriptor) [pid 575] close(22) = -1 EBADF (Bad file descriptor) [pid 575] close(23) = -1 EBADF (Bad file descriptor) [pid 575] close(24) = -1 EBADF (Bad file descriptor) [pid 575] close(25) = -1 EBADF (Bad file descriptor) [pid 575] close(26) = -1 EBADF (Bad file descriptor) [pid 575] close(27) = -1 EBADF (Bad file descriptor) [pid 575] close(28) = -1 EBADF (Bad file descriptor) [pid 575] close(29) = -1 EBADF (Bad file descriptor) [pid 575] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory ) = 89 [pid 575] exit_group(0) = ? [pid 575] +++ exited with 0 +++ [pid 380] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=29, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 380] umount2("./27", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] openat(AT_FDCWD, "./27", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [ 115.824191][ T575] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 115.832584][ T575] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 115.840542][ T575] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 115.848505][ T575] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 115.856472][ T575] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 115.864434][ T575] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 000000000000001b [pid 380] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 579] <... write resumed>) = 6 [pid 579] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 579] write(5, "22", 2) = 2 [ 115.890531][ T576] FAULT_INJECTION: forcing a failure. [ 115.890531][ T576] name failslab, interval 1, probability 0, space 0, times 0 [ 115.903553][ T576] CPU: 0 PID: 576 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 115.915169][ T576] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 115.925200][ T576] Call Trace: [ 115.928468][ T576] dump_stack_lvl+0x1e2/0x24b [ 115.933120][ T576] ? bfq_pos_tree_add_move+0x43e/0x43e [ 115.938554][ T576] ? selinux_kernfs_init_security+0x1a8/0x760 [ 115.944598][ T576] dump_stack+0x15/0x17 [ 115.948735][ T576] should_fail+0x3c0/0x510 [ 115.953132][ T576] ? __kernfs_new_node+0x99/0x6e0 [ 115.958135][ T576] __should_failslab+0x9f/0xe0 [ 115.962875][ T576] should_failslab+0x9/0x20 [ 115.967354][ T576] __kmalloc_track_caller+0x5f/0x350 [ 115.972620][ T576] kstrdup_const+0x55/0x90 [ 115.977013][ T576] __kernfs_new_node+0x99/0x6e0 [ 115.981838][ T576] ? is_module_text_address+0xe1/0x140 [ 115.987273][ T576] ? kernfs_new_node+0x170/0x170 [ 115.992201][ T576] ? ptr_to_hashval+0x60/0x60 [ 115.996859][ T576] ? arch_stack_walk+0xf8/0x140 [ 116.001692][ T576] ? snprintf+0xd6/0x120 [ 116.005924][ T576] kernfs_new_node+0x97/0x170 [ 116.010598][ T576] __kernfs_create_file+0x4a/0x270 [ 116.015695][ T576] cgroup_addrm_files+0xab8/0xfe0 [ 116.020701][ T576] ? ____kasan_kmalloc+0xdc/0x110 [ 116.025720][ T576] ? __kasan_kmalloc+0x9/0x10 [ 116.030392][ T576] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 116.035956][ T576] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 116.042091][ T576] ? delete_node+0x759/0x7b0 [ 116.046669][ T576] ? __kasan_check_read+0x11/0x20 [ 116.051679][ T576] ? delete_node+0x759/0x7b0 [ 116.056255][ T576] ? __kasan_check_write+0x14/0x20 [ 116.061392][ T576] ? idr_replace+0x1c4/0x230 [ 116.065970][ T576] ? idr_get_next+0x4b0/0x4b0 [ 116.070628][ T576] ? _raw_spin_lock_bh+0xa3/0x1b0 [ 116.075633][ T576] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 116.080814][ T576] css_populate_dir+0x137/0x370 [ 116.085666][ T576] cgroup_apply_control_enable+0x8b9/0x12f0 [ 116.091548][ T576] cgroup_apply_control+0x93/0x710 [ 116.096644][ T576] ? css_next_child+0x160/0x160 [ 116.101473][ T576] ? stack_trace_save+0x12d/0x1f0 [ 116.106480][ T576] ? io_schedule+0x120/0x120 [ 116.111058][ T576] ? kernfs_fop_write_iter+0x15e/0x410 [ 116.116504][ T576] ? __kasan_check_write+0x14/0x20 [ 116.121603][ T576] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 116.126874][ T576] cgroup_subtree_control_write+0xd19/0x1310 [ 116.132843][ T576] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 116.138811][ T576] ? __kasan_check_write+0x14/0x20 [ 116.143909][ T576] ? _copy_from_iter+0x3fb/0xd60 [ 116.148916][ T576] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 116.154891][ T576] cgroup_file_write+0x28e/0x590 [ 116.159817][ T576] ? cgroup_seqfile_stop+0xc0/0xc0 [ 116.164909][ T576] ? mutex_lock+0xa6/0x110 [ 116.169306][ T576] ? mutex_trylock+0xb0/0xb0 [ 116.173883][ T576] ? __kasan_check_write+0x14/0x20 [ 116.178981][ T576] kernfs_fop_write_iter+0x2d0/0x410 [ 116.184253][ T576] ? cgroup_seqfile_stop+0xc0/0xc0 [ 116.189352][ T576] vfs_write+0xc1c/0xf40 [ 116.193585][ T576] ? __kasan_check_write+0x14/0x20 [ 116.198687][ T576] ? kernel_write+0x3c0/0x3c0 [ 116.203352][ T576] ? _raw_spin_unlock_irq+0x4e/0x70 [ 116.208534][ T576] ? ptrace_stop+0x6ff/0x9f0 [ 116.213107][ T576] ? __kasan_check_read+0x11/0x20 [ 116.218126][ T576] ? __fdget_pos+0x27e/0x310 [ 116.222702][ T576] ksys_write+0x198/0x2c0 [ 116.227021][ T576] ? do_notify_parent+0xa60/0xa60 [ 116.232029][ T576] ? __ia32_sys_read+0x90/0x90 [ 116.236773][ T576] ? __ia32_sys_open+0x270/0x270 [ 116.241693][ T576] __x64_sys_write+0x7b/0x90 [ 116.246264][ T576] do_syscall_64+0x34/0x70 [ 116.250663][ T576] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 116.256536][ T576] RIP: 0033:0x7fc8ece62c09 [ 116.260936][ T576] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 116.280520][ T576] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 579] write(4, "+pids ", 6 [pid 380] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 380] umount2("./27/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 576] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 576] close(3 [pid 380] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 576] <... close resumed>) = 0 [pid 380] lstat("./27/binderfs", [pid 576] close(4 [pid 380] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 576] <... close resumed>) = 0 [pid 576] close(5) = 0 [pid 576] close(6 [pid 380] unlink("./27/binderfs" [pid 576] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 576] close(7 [pid 380] <... unlink resumed>) = 0 [pid 576] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 576] close(8 [pid 380] umount2("./27/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW [pid 576] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 576] close(9) = -1 EBADF (Bad file descriptor) [pid 576] close(10) = -1 EBADF (Bad file descriptor) [pid 576] close(11) = -1 EBADF (Bad file descriptor) [pid 576] close(12) = -1 EBADF (Bad file descriptor) [pid 576] close(13) = -1 EBADF (Bad file descriptor) [pid 576] close(14 [pid 380] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 576] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 380] lstat("./27/cgroup", [pid 576] close(15 [pid 380] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 576] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 380] unlink("./27/cgroup" [pid 576] close(16 [pid 380] <... unlink resumed>) = 0 [pid 576] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 380] umount2("./27/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 576] close(17 [pid 380] lstat("./27/cgroup.net", [pid 576] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 380] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 576] close(18 [pid 380] unlink("./27/cgroup.net" [pid 576] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 576] close(19) = -1 EBADF (Bad file descriptor) [pid 380] <... unlink resumed>) = 0 [pid 576] close(20 [pid 380] umount2("./27/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 576] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 576] close(21) = -1 EBADF (Bad file descriptor) [pid 380] <... umount2 resumed>) = 0 [pid 576] close(22) = -1 EBADF (Bad file descriptor) [pid 576] close(23 [pid 380] umount2("./27/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 576] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 380] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 576] close(24 [pid 380] lstat("./27/file0", [pid 576] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 380] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 576] close(25 [pid 380] umount2("./27/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 576] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 576] close(26 [pid 380] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 576] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 380] openat(AT_FDCWD, "./27/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 576] close(27) = -1 EBADF (Bad file descriptor) [pid 380] <... openat resumed>) = 4 [pid 576] close(28 [pid 380] fstat(4, [pid 576] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 576] close(29 [pid 380] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 576] <... close resumed>) = -1 EBADF (Bad file descriptor) write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory [pid 576] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89 [pid 380] getdents64(4, [pid 576] <... write resumed>) = 89 [pid 576] exit_group(0 [pid 380] <... getdents64 resumed>0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 576] <... exit_group resumed>) = ? [pid 380] getdents64(4, [pid 576] +++ exited with 0 +++ [pid 380] <... getdents64 resumed>0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 380] close(4 [pid 375] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=35, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 380] <... close resumed>) = 0 [pid 375] restart_syscall(<... resuming interrupted clone ...> [pid 380] rmdir("./27/file0") = 0 [pid 380] umount2("./27/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./27/cgroup.cpu", [pid 375] <... restart_syscall resumed>) = 0 [pid 380] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 380] unlink("./27/cgroup.cpu") = 0 [pid 380] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 375] umount2("./33", MNT_DETACH|UMOUNT_NOFOLLOW [pid 380] close(3 [pid 375] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 380] <... close resumed>) = 0 [pid 375] openat(AT_FDCWD, "./33", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 380] rmdir("./27" [pid 375] <... openat resumed>) = 3 [pid 380] <... rmdir resumed>) = 0 [pid 375] fstat(3, [pid 380] mkdir("./28", 0777 [pid 375] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 375] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 375] umount2("./33/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 380] <... mkdir resumed>) = 0 [pid 375] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 380] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 375] lstat("./33/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 375] unlink("./33/binderfs"./strace-static-x86_64: Process 580 attached ) = 0 [pid 380] <... clone resumed>, child_tidptr=0x555556fab5d0) = 30 [pid 375] umount2("./33/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW [pid 580] chdir("./28" [pid 375] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 580] <... chdir resumed>) = 0 [pid 375] lstat("./33/cgroup", [pid 580] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 375] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 580] <... prctl resumed>) = 0 [pid 375] unlink("./33/cgroup" [pid 580] setpgid(0, 0 [pid 375] <... unlink resumed>) = 0 [pid 580] <... setpgid resumed>) = 0 [pid 375] umount2("./33/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW [pid 580] symlink("/syzcgroup/unified/syz2", "./cgroup" [pid 375] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 580] <... symlink resumed>) = 0 [pid 375] lstat("./33/cgroup.net", [pid 580] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu" [pid 375] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 580] <... symlink resumed>) = 0 [pid 375] unlink("./33/cgroup.net" [pid 580] symlink("/syzcgroup/net/syz2", "./cgroup.net" [pid 375] <... unlink resumed>) = 0 [pid 375] umount2("./33/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 580] <... symlink resumed>) = 0 [pid 375] <... umount2 resumed>) = 0 [pid 580] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 375] umount2("./33/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 580] <... openat resumed>) = 3 [pid 375] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 580] write(3, "1000", 4 [pid 375] lstat("./33/file0", [pid 580] <... write resumed>) = 4 [pid 375] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 580] close(3 [pid 375] umount2("./33/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 580] <... close resumed>) = 0 [pid 375] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 580] symlink("/dev/binderfs", "./binderfs" [pid 375] openat(AT_FDCWD, "./33/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 375] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 580] <... symlink resumed>) = 0 [pid 375] getdents64(4, [pid 580] mkdirat(AT_FDCWD, "./file0", 000 [pid 375] <... getdents64 resumed>0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 375] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 375] close(4) = 0 [pid 580] <... mkdirat resumed>) = 0 [pid 375] rmdir("./33/file0" [pid 580] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 375] <... rmdir resumed>) = 0 [pid 375] umount2("./33/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 580] <... mount resumed>) = 0 [pid 375] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 580] open("./file0", O_RDONLY [pid 375] lstat("./33/cgroup.cpu", [pid 580] <... open resumed>) = 3 [pid 375] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 580] openat(3, "cgroup.subtree_control", O_RDWR [pid 375] unlink("./33/cgroup.cpu" [pid 580] <... openat resumed>) = 4 [pid 375] <... unlink resumed>) = 0 [pid 580] write(4, "-pids ", 6 [pid 375] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 375] close(3) = 0 [pid 375] rmdir("./33") = 0 [pid 375] mkdir("./34", 0777) = 0 [pid 375] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 581 attached , child_tidptr=0x555556fab5d0) = 36 [pid 581] chdir("./34") = 0 [pid 581] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 581] setpgid(0, 0) = 0 [pid 581] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 581] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 581] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 581] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 581] write(3, "1000", 4) = 4 [pid 581] close(3) = 0 [pid 581] symlink("/dev/binderfs", "./binderfs") = 0 [ 116.288915][ T576] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 116.296871][ T576] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 116.304823][ T576] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 116.312775][ T576] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 116.320741][ T576] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000021 [ 116.329368][ T576] cgroup: cgroup_addrm_files: failed to add max, err=-12 [pid 581] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 580] <... write resumed>) = 6 [pid 581] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 571] <... write resumed>) = ? [pid 571] +++ killed by SIGKILL +++ [pid 382] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=38, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} --- [pid 382] umount2("./36", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] openat(AT_FDCWD, "./36", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 382] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 382] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 382] umount2("./36/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./36/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 382] unlink("./36/binderfs") = 0 [pid 382] umount2("./36/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./36/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 382] unlink("./36/cgroup") = 0 [pid 382] umount2("./36/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./36/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 382] unlink("./36/cgroup.net") = 0 [pid 382] umount2("./36/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 580] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 580] write(5, "22", 2) = 2 [pid 580] write(4, "+pids ", 6 [pid 382] <... umount2 resumed>) = 0 [pid 382] umount2("./36/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./36/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 382] umount2("./36/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] openat(AT_FDCWD, "./36/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 382] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 382] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 382] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 382] close(4) = 0 [pid 382] rmdir("./36/file0") = 0 [pid 382] umount2("./36/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./36/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 382] unlink("./36/cgroup.cpu") = 0 [pid 382] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 382] close(3) = 0 [pid 382] rmdir("./36") = 0 [pid 382] mkdir("./37", 0777) = 0 [pid 382] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556fab5d0) = 39 ./strace-static-x86_64: Process 582 attached [pid 582] chdir("./37") = 0 [pid 582] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 582] setpgid(0, 0) = 0 [pid 582] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 582] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [pid 582] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 582] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 582] write(3, "1000", 4) = 4 [pid 582] close(3) = 0 [pid 582] symlink("/dev/binderfs", "./binderfs") = 0 [pid 582] mkdirat(AT_FDCWD, "./file0", 000) = 0 [ 116.360606][ T578] FAULT_INJECTION: forcing a failure. [ 116.360606][ T578] name failslab, interval 1, probability 0, space 0, times 0 [ 116.373268][ T578] CPU: 0 PID: 578 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 116.384885][ T578] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 116.394939][ T578] Call Trace: [ 116.398234][ T578] dump_stack_lvl+0x1e2/0x24b [ 116.402902][ T578] ? bfq_pos_tree_add_move+0x43e/0x43e [ 116.408343][ T578] ? selinux_kernfs_init_security+0x1a8/0x760 [ 116.414399][ T578] dump_stack+0x15/0x17 [ 116.418535][ T578] should_fail+0x3c0/0x510 [ 116.422929][ T578] ? __kernfs_new_node+0x99/0x6e0 [ 116.427931][ T578] __should_failslab+0x9f/0xe0 [ 116.432682][ T578] should_failslab+0x9/0x20 [ 116.437186][ T578] __kmalloc_track_caller+0x5f/0x350 [ 116.442459][ T578] kstrdup_const+0x55/0x90 [ 116.446854][ T578] __kernfs_new_node+0x99/0x6e0 [ 116.451690][ T578] ? is_module_text_address+0xe1/0x140 [ 116.457143][ T578] ? kernfs_new_node+0x170/0x170 [ 116.462063][ T578] ? ptr_to_hashval+0x60/0x60 [ 116.466726][ T578] ? arch_stack_walk+0xf8/0x140 [ 116.471575][ T578] ? snprintf+0xd6/0x120 [ 116.475819][ T578] kernfs_new_node+0x97/0x170 [ 116.480494][ T578] __kernfs_create_file+0x4a/0x270 [ 116.485584][ T578] cgroup_addrm_files+0xab8/0xfe0 [ 116.490593][ T578] ? ____kasan_kmalloc+0xdc/0x110 [ 116.495604][ T578] ? __kasan_kmalloc+0x9/0x10 [ 116.500259][ T578] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 116.505781][ T578] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 116.511912][ T578] ? delete_node+0x759/0x7b0 [ 116.516482][ T578] ? __kasan_check_read+0x11/0x20 [ 116.521490][ T578] ? delete_node+0x759/0x7b0 [ 116.526071][ T578] ? __kasan_check_write+0x14/0x20 [ 116.531174][ T578] ? idr_replace+0x1c4/0x230 [ 116.535741][ T578] ? idr_get_next+0x4b0/0x4b0 [ 116.540394][ T578] ? _raw_spin_lock_bh+0xa3/0x1b0 [ 116.545404][ T578] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 116.550584][ T578] css_populate_dir+0x137/0x370 [ 116.555423][ T578] cgroup_apply_control_enable+0x8b9/0x12f0 [ 116.561315][ T578] cgroup_apply_control+0x93/0x710 [ 116.566416][ T578] ? css_next_child+0x160/0x160 [ 116.571247][ T578] ? stack_trace_save+0x12d/0x1f0 [ 116.576251][ T578] ? io_schedule+0x120/0x120 [ 116.580822][ T578] ? kernfs_fop_write_iter+0x15e/0x410 [ 116.586266][ T578] ? __kasan_check_write+0x14/0x20 [ 116.591365][ T578] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 116.596635][ T578] cgroup_subtree_control_write+0xd19/0x1310 [ 116.602610][ T578] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 116.608601][ T578] ? __kasan_check_write+0x14/0x20 [ 116.613699][ T578] ? _copy_from_iter+0x3fb/0xd60 [ 116.618631][ T578] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 116.624606][ T578] cgroup_file_write+0x28e/0x590 [ 116.629531][ T578] ? cgroup_seqfile_stop+0xc0/0xc0 [ 116.634619][ T578] ? mutex_lock+0xa6/0x110 [ 116.639013][ T578] ? mutex_trylock+0xb0/0xb0 [ 116.643595][ T578] ? __kasan_check_write+0x14/0x20 [ 116.648693][ T578] kernfs_fop_write_iter+0x2d0/0x410 [ 116.653971][ T578] ? cgroup_seqfile_stop+0xc0/0xc0 [ 116.659071][ T578] vfs_write+0xc1c/0xf40 [ 116.663290][ T578] ? __kasan_check_write+0x14/0x20 [ 116.668383][ T578] ? kernel_write+0x3c0/0x3c0 [ 116.673038][ T578] ? _raw_spin_unlock_irq+0x4e/0x70 [ 116.678231][ T578] ? ptrace_stop+0x6ff/0x9f0 [ 116.682831][ T578] ? __kasan_check_read+0x11/0x20 [ 116.687842][ T578] ? __fdget_pos+0x27e/0x310 [ 116.692415][ T578] ksys_write+0x198/0x2c0 [ 116.696722][ T578] ? do_notify_parent+0xa60/0xa60 [ 116.701733][ T578] ? __ia32_sys_read+0x90/0x90 [ 116.706493][ T578] ? __ia32_sys_open+0x270/0x270 [ 116.711417][ T578] __x64_sys_write+0x7b/0x90 [ 116.715986][ T578] do_syscall_64+0x34/0x70 [ 116.720378][ T578] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 116.726253][ T578] RIP: 0033:0x7fc8ece62c09 [ 116.730643][ T578] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 116.750227][ T578] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 582] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 578] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 582] <... mount resumed>) = 0 [pid 581] <... mount resumed>) = 0 [pid 582] open("./file0", O_RDONLY) = 3 [pid 582] openat(3, "cgroup.subtree_control", O_RDWR [pid 581] open("./file0", O_RDONLY [pid 578] close(3 [pid 582] <... openat resumed>) = 4 [pid 582] write(4, "-pids ", 6 [pid 581] <... open resumed>) = 3 [pid 578] <... close resumed>) = 0 [pid 581] openat(3, "cgroup.subtree_control", O_RDWR [pid 578] close(4 [pid 581] <... openat resumed>) = 4 [pid 581] write(4, "-pids ", 6 [pid 578] <... close resumed>) = 0 [pid 578] close(5) = 0 [pid 578] close(6) = -1 EBADF (Bad file descriptor) [pid 578] close(7) = -1 EBADF (Bad file descriptor) [pid 578] close(8) = -1 EBADF (Bad file descriptor) [pid 578] close(9) = -1 EBADF (Bad file descriptor) [pid 578] close(10) = -1 EBADF (Bad file descriptor) [pid 578] close(11) = -1 EBADF (Bad file descriptor) [pid 578] close(12) = -1 EBADF (Bad file descriptor) [pid 578] close(13) = -1 EBADF (Bad file descriptor) [pid 578] close(14) = -1 EBADF (Bad file descriptor) [pid 578] close(15) = -1 EBADF (Bad file descriptor) [pid 578] close(16) = -1 EBADF (Bad file descriptor) [pid 578] close(17) = -1 EBADF (Bad file descriptor) [pid 578] close(18) = -1 EBADF (Bad file descriptor) [pid 578] close(19) = -1 EBADF (Bad file descriptor) [pid 578] close(20) = -1 EBADF (Bad file descriptor) [pid 578] close(21) = -1 EBADF (Bad file descriptor) [pid 578] close(22) = -1 EBADF (Bad file descriptor) [pid 578] close(23) = -1 EBADF (Bad file descriptor) [pid 578] close(24) = -1 EBADF (Bad file descriptor) [pid 578] close(25) = -1 EBADF (Bad file descriptor) [pid 578] close(26) = -1 EBADF (Bad file descriptor) [pid 578] close(27) = -1 EBADF (Bad file descriptor) [pid 578] close(28) = -1 EBADF (Bad file descriptor) [pid 578] close(29) = -1 EBADF (Bad file descriptor) [pid 578] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory ) = 89 [ 116.758624][ T578] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 116.766573][ T578] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 116.774527][ T578] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 116.782476][ T578] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 116.790431][ T578] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000020 [ 116.798570][ T578] cgroup: cgroup_addrm_files: failed to add max, err=-12 [pid 578] exit_group(0) = ? [pid 578] +++ exited with 0 +++ [pid 381] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=34, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 381] umount2("./32", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] openat(AT_FDCWD, "./32", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 381] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 381] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 381] umount2("./32/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./32/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 381] unlink("./32/binderfs") = 0 [pid 381] umount2("./32/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./32/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 381] unlink("./32/cgroup") = 0 [pid 381] umount2("./32/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./32/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 381] unlink("./32/cgroup.net") = 0 [ 116.820441][ T579] FAULT_INJECTION: forcing a failure. [ 116.820441][ T579] name failslab, interval 1, probability 0, space 0, times 0 [ 116.833821][ T579] CPU: 1 PID: 579 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 116.845442][ T579] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 116.855489][ T579] Call Trace: [ 116.858767][ T579] dump_stack_lvl+0x1e2/0x24b [ 116.863427][ T579] ? panic+0x7d7/0x7d7 [ 116.867476][ T579] ? bfq_pos_tree_add_move+0x43e/0x43e [ 116.872924][ T579] ? find_next_bit+0xd6/0x120 [ 116.877588][ T579] ? cpumask_next+0x11/0x30 [ 116.882070][ T579] dump_stack+0x15/0x17 [ 116.886204][ T579] should_fail+0x3c0/0x510 [ 116.890601][ T579] ? percpu_ref_init+0xd0/0x330 [ 116.895428][ T579] __should_failslab+0x9f/0xe0 [ 116.900167][ T579] should_failslab+0x9/0x20 [ 116.904658][ T579] kmem_cache_alloc_trace+0x3a/0x330 [ 116.909920][ T579] percpu_ref_init+0xd0/0x330 [ 116.914572][ T579] ? cgroup_setup_root+0xea0/0xea0 [ 116.919659][ T579] cgroup_apply_control_enable+0x3a2/0x12f0 [ 116.925533][ T579] cgroup_apply_control+0x93/0x710 [ 116.930625][ T579] ? css_next_child+0x160/0x160 [ 116.935467][ T579] ? stack_trace_save+0x12d/0x1f0 [ 116.940468][ T579] ? io_schedule+0x120/0x120 [ 116.945044][ T579] ? kernfs_fop_write_iter+0x15e/0x410 [ 116.950486][ T579] ? __kasan_check_write+0x14/0x20 [ 116.955574][ T579] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 116.960835][ T579] cgroup_subtree_control_write+0xd19/0x1310 [ 116.966789][ T579] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 116.972747][ T579] ? __kasan_check_write+0x14/0x20 [ 116.977834][ T579] ? _copy_from_iter+0x3fb/0xd60 [ 116.982747][ T579] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 116.988703][ T579] cgroup_file_write+0x28e/0x590 [ 116.993622][ T579] ? cgroup_seqfile_stop+0xc0/0xc0 [ 116.998706][ T579] ? mutex_lock+0xa6/0x110 [ 117.003534][ T579] ? mutex_trylock+0xb0/0xb0 [ 117.008106][ T579] ? __kasan_check_write+0x14/0x20 [ 117.013200][ T579] kernfs_fop_write_iter+0x2d0/0x410 [ 117.018473][ T579] ? cgroup_seqfile_stop+0xc0/0xc0 [ 117.023578][ T579] vfs_write+0xc1c/0xf40 [ 117.027804][ T579] ? __kasan_check_write+0x14/0x20 [ 117.032893][ T579] ? kernel_write+0x3c0/0x3c0 [ 117.037546][ T579] ? _raw_spin_unlock_irq+0x4e/0x70 [ 117.042719][ T579] ? ptrace_stop+0x6ff/0x9f0 [ 117.047285][ T579] ? __kasan_check_read+0x11/0x20 [ 117.052282][ T579] ? __fdget_pos+0x27e/0x310 [ 117.056852][ T579] ksys_write+0x198/0x2c0 [ 117.061161][ T579] ? do_notify_parent+0xa60/0xa60 [ 117.066168][ T579] ? __ia32_sys_read+0x90/0x90 [ 117.070916][ T579] ? __ia32_sys_open+0x270/0x270 [ 117.075834][ T579] __x64_sys_write+0x7b/0x90 [ 117.080409][ T579] do_syscall_64+0x34/0x70 [ 117.084813][ T579] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 117.090684][ T579] RIP: 0033:0x7fc8ece62c09 [ 117.095089][ T579] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 381] umount2("./32/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 381] umount2("./32/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./32/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 381] umount2("./32/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] openat(AT_FDCWD, "./32/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 381] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 381] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 381] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 381] close(4) = 0 [pid 381] rmdir("./32/file0") = 0 [pid 381] umount2("./32/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./32/cgroup.cpu", [pid 579] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 381] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 381] unlink("./32/cgroup.cpu") = 0 [pid 381] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 381] close(3) = 0 [pid 381] rmdir("./32") = 0 [pid 381] mkdir("./33", 0777 [pid 579] close(3 [pid 381] <... mkdir resumed>) = 0 [pid 381] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 583 attached [pid 579] <... close resumed>) = 0 [pid 381] <... clone resumed>, child_tidptr=0x555556fab5d0) = 35 [pid 583] chdir("./33" [pid 579] close(4 [pid 583] <... chdir resumed>) = 0 [pid 583] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 583] setpgid(0, 0) = 0 [pid 583] symlink("/syzcgroup/unified/syz3", "./cgroup" [pid 579] <... close resumed>) = 0 [pid 583] <... symlink resumed>) = 0 [pid 579] close(5 [pid 583] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu" [pid 579] <... close resumed>) = 0 [pid 583] <... symlink resumed>) = 0 [pid 579] close(6 [pid 583] symlink("/syzcgroup/net/syz3", "./cgroup.net" [pid 579] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 583] <... symlink resumed>) = 0 [pid 579] close(7 [pid 583] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 579] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 583] <... openat resumed>) = 3 [pid 579] close(8 [pid 583] write(3, "1000", 4 [pid 579] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 583] <... write resumed>) = 4 [pid 579] close(9 [pid 583] close(3 [pid 579] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 583] <... close resumed>) = 0 [pid 579] close(10 [pid 583] symlink("/dev/binderfs", "./binderfs" [pid 579] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 583] <... symlink resumed>) = 0 [pid 579] close(11 [pid 583] mkdirat(AT_FDCWD, "./file0", 000 [pid 579] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 583] <... mkdirat resumed>) = 0 [pid 579] close(12 [pid 583] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 579] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 583] <... mount resumed>) = 0 [pid 579] close(13 [pid 583] open("./file0", O_RDONLY [pid 579] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 583] <... open resumed>) = 3 [pid 579] close(14 [pid 583] openat(3, "cgroup.subtree_control", O_RDWR [pid 579] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 583] <... openat resumed>) = 4 [pid 579] close(15 [pid 583] write(4, "-pids ", 6 [pid 579] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 579] close(16) = -1 EBADF (Bad file descriptor) [pid 579] close(17) = -1 EBADF (Bad file descriptor) [pid 579] close(18) = -1 EBADF (Bad file descriptor) [pid 579] close(19) = -1 EBADF (Bad file descriptor) [pid 579] close(20) = -1 EBADF (Bad file descriptor) [pid 579] close(21) = -1 EBADF (Bad file descriptor) [pid 579] close(22) = -1 EBADF (Bad file descriptor) [pid 579] close(23) = -1 EBADF (Bad file descriptor) [pid 579] close(24) = -1 EBADF (Bad file descriptor) [pid 579] close(25) = -1 EBADF (Bad file descriptor) [pid 579] close(26) = -1 EBADF (Bad file descriptor) [pid 579] close(27) = -1 EBADF (Bad file descriptor) [pid 579] close(28) = -1 EBADF (Bad file descriptor) [pid 579] close(29) = -1 EBADF (Bad file descriptor) write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory [pid 579] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 579] exit_group(0) = ? [pid 579] +++ exited with 0 +++ [pid 376] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=34, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 376] umount2("./32", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] openat(AT_FDCWD, "./32", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 376] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 376] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 376] umount2("./32/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./32/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 376] unlink("./32/binderfs") = 0 [pid 376] umount2("./32/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./32/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 376] unlink("./32/cgroup") = 0 [pid 376] umount2("./32/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./32/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 376] unlink("./32/cgroup.net") = 0 [pid 376] umount2("./32/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 376] umount2("./32/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./32/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 376] umount2("./32/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] openat(AT_FDCWD, "./32/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 376] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 376] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 376] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 376] close(4) = 0 [pid 376] rmdir("./32/file0") = 0 [pid 376] umount2("./32/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./32/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 376] unlink("./32/cgroup.cpu") = 0 [pid 376] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 376] close(3) = 0 [pid 376] rmdir("./32") = 0 [pid 376] mkdir("./33", 0777) = 0 [pid 376] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 584 attached [pid 584] chdir("./33" [pid 376] <... clone resumed>, child_tidptr=0x555556fab5d0) = 35 [pid 584] <... chdir resumed>) = 0 [pid 584] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 584] setpgid(0, 0) = 0 [pid 584] symlink("/syzcgroup/unified/syz1", "./cgroup") = 0 [pid 584] symlink("/syzcgroup/cpu/syz1", "./cgroup.cpu") = 0 [pid 584] symlink("/syzcgroup/net/syz1", "./cgroup.net") = 0 [pid 584] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 584] write(3, "1000", 4) = 4 [pid 584] close(3) = 0 [pid 584] symlink("/dev/binderfs", "./binderfs") = 0 [pid 584] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 584] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 584] open("./file0", O_RDONLY) = 3 [pid 584] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [pid 584] write(4, "-pids ", 6 [pid 581] <... write resumed>) = 6 [ 117.114670][ T579] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 117.123061][ T579] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 117.131027][ T579] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 117.138977][ T579] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 117.146923][ T579] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 117.154965][ T579] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000020 [pid 581] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 581] write(5, "22", 2) = 2 [ 117.190466][ T580] FAULT_INJECTION: forcing a failure. [ 117.190466][ T580] name failslab, interval 1, probability 0, space 0, times 0 [ 117.203111][ T580] CPU: 1 PID: 580 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 117.214815][ T580] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 117.224861][ T580] Call Trace: [ 117.228150][ T580] dump_stack_lvl+0x1e2/0x24b [ 117.232806][ T580] ? panic+0x7d7/0x7d7 [ 117.236857][ T580] ? bfq_pos_tree_add_move+0x43e/0x43e [ 117.242300][ T580] ? find_next_bit+0xd6/0x120 [ 117.246980][ T580] ? cpumask_next+0x11/0x30 [ 117.251463][ T580] dump_stack+0x15/0x17 [ 117.255606][ T580] should_fail+0x3c0/0x510 [ 117.260014][ T580] ? percpu_ref_init+0xd0/0x330 [ 117.264987][ T580] __should_failslab+0x9f/0xe0 [ 117.269731][ T580] should_failslab+0x9/0x20 [ 117.274211][ T580] kmem_cache_alloc_trace+0x3a/0x330 [ 117.279488][ T580] percpu_ref_init+0xd0/0x330 [ 117.284330][ T580] ? cgroup_setup_root+0xea0/0xea0 [ 117.289420][ T580] cgroup_apply_control_enable+0x3a2/0x12f0 [ 117.295299][ T580] cgroup_apply_control+0x93/0x710 [ 117.300402][ T580] ? css_next_child+0x160/0x160 [ 117.305233][ T580] ? stack_trace_save+0x12d/0x1f0 [ 117.310243][ T580] ? io_schedule+0x120/0x120 [ 117.314830][ T580] ? kernfs_fop_write_iter+0x15e/0x410 [ 117.320283][ T580] ? __kasan_check_write+0x14/0x20 [ 117.325380][ T580] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 117.330650][ T580] cgroup_subtree_control_write+0xd19/0x1310 [ 117.336608][ T580] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 117.342571][ T580] ? __kasan_check_write+0x14/0x20 [ 117.347667][ T580] ? _copy_from_iter+0x3fb/0xd60 [ 117.352585][ T580] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 117.358542][ T580] cgroup_file_write+0x28e/0x590 [ 117.363499][ T580] ? cgroup_seqfile_stop+0xc0/0xc0 [ 117.368598][ T580] ? mutex_lock+0xa6/0x110 [ 117.372993][ T580] ? mutex_trylock+0xb0/0xb0 [ 117.377560][ T580] ? __kasan_check_write+0x14/0x20 [ 117.382659][ T580] kernfs_fop_write_iter+0x2d0/0x410 [ 117.387928][ T580] ? cgroup_seqfile_stop+0xc0/0xc0 [ 117.393026][ T580] vfs_write+0xc1c/0xf40 [ 117.397260][ T580] ? __kasan_check_write+0x14/0x20 [ 117.402355][ T580] ? kernel_write+0x3c0/0x3c0 [ 117.407009][ T580] ? _raw_spin_unlock_irq+0x4e/0x70 [ 117.412192][ T580] ? ptrace_stop+0x6ff/0x9f0 [ 117.416779][ T580] ? __kasan_check_read+0x11/0x20 [ 117.421790][ T580] ? __fdget_pos+0x27e/0x310 [ 117.426442][ T580] ksys_write+0x198/0x2c0 [ 117.430766][ T580] ? do_notify_parent+0xa60/0xa60 [ 117.435868][ T580] ? __ia32_sys_read+0x90/0x90 [ 117.440626][ T580] ? __ia32_sys_open+0x270/0x270 [ 117.445550][ T580] __x64_sys_write+0x7b/0x90 [ 117.450116][ T580] do_syscall_64+0x34/0x70 [ 117.454512][ T580] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 117.460381][ T580] RIP: 0033:0x7fc8ece62c09 [ 117.464774][ T580] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 581] write(4, "+pids ", 6 [pid 580] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 580] close(3) = 0 [pid 580] close(4) = 0 [pid 580] close(5) = 0 [pid 580] close(6) = -1 EBADF (Bad file descriptor) [pid 580] close(7) = -1 EBADF (Bad file descriptor) [pid 580] close(8) = -1 EBADF (Bad file descriptor) [pid 580] close(9) = -1 EBADF (Bad file descriptor) [pid 580] close(10) = -1 EBADF (Bad file descriptor) [pid 580] close(11) = -1 EBADF (Bad file descriptor) [pid 580] close(12) = -1 EBADF (Bad file descriptor) [pid 580] close(13) = -1 EBADF (Bad file descriptor) [pid 580] close(14) = -1 EBADF (Bad file descriptor) [pid 580] close(15) = -1 EBADF (Bad file descriptor) [pid 580] close(16) = -1 EBADF (Bad file descriptor) [pid 580] close(17) = -1 EBADF (Bad file descriptor) [pid 580] close(18) = -1 EBADF (Bad file descriptor) [pid 580] close(19) = -1 EBADF (Bad file descriptor) [pid 580] close(20) = -1 EBADF (Bad file descriptor) [pid 580] close(21) = -1 EBADF (Bad file descriptor) [pid 580] close(22) = -1 EBADF (Bad file descriptor) [pid 580] close(23) = -1 EBADF (Bad file descriptor) [pid 580] close(24) = -1 EBADF (Bad file descriptor) [pid 580] close(25) = -1 EBADF (Bad file descriptor) [pid 580] close(26) = -1 EBADF (Bad file descriptor) [pid 580] close(27) = -1 EBADF (Bad file descriptor) [pid 580] close(28) = -1 EBADF (Bad file descriptor) [pid 580] close(29) = -1 EBADF (Bad file descriptor) write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory [pid 580] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 580] exit_group(0) = ? [pid 580] +++ exited with 0 +++ [pid 380] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=30, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 380] umount2("./28", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] openat(AT_FDCWD, "./28", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 380] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 380] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 380] umount2("./28/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./28/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 380] unlink("./28/binderfs") = 0 [pid 380] umount2("./28/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./28/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 380] unlink("./28/cgroup") = 0 [pid 380] umount2("./28/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./28/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 380] unlink("./28/cgroup.net") = 0 [pid 380] umount2("./28/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 380] umount2("./28/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./28/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 380] umount2("./28/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] openat(AT_FDCWD, "./28/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 380] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 380] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 380] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 380] close(4) = 0 [ 117.484554][ T580] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 117.492945][ T580] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 117.500895][ T580] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 117.508856][ T580] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 117.516816][ T580] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 117.524766][ T580] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 000000000000001c [pid 380] rmdir("./28/file0") = 0 [pid 380] umount2("./28/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./28/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 380] unlink("./28/cgroup.cpu") = 0 [pid 380] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 380] close(3) = 0 [pid 380] rmdir("./28") = 0 [pid 380] mkdir("./29", 0777) = 0 [pid 380] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556fab5d0) = 31 ./strace-static-x86_64: Process 585 attached [pid 585] chdir("./29") = 0 [pid 585] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 585] setpgid(0, 0) = 0 [pid 585] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 585] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 585] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 585] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 585] write(3, "1000", 4) = 4 [pid 585] close(3) = 0 [pid 585] symlink("/dev/binderfs", "./binderfs") = 0 [pid 585] mkdirat(AT_FDCWD, "./file0", 000) = 0 [ 117.550466][ T581] FAULT_INJECTION: forcing a failure. [ 117.550466][ T581] name failslab, interval 1, probability 0, space 0, times 0 [ 117.563559][ T581] CPU: 0 PID: 581 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 117.575274][ T581] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 117.585325][ T581] Call Trace: [ 117.588612][ T581] dump_stack_lvl+0x1e2/0x24b [ 117.593271][ T581] ? panic+0x7d7/0x7d7 [ 117.597317][ T581] ? bfq_pos_tree_add_move+0x43e/0x43e [ 117.602764][ T581] ? find_next_bit+0xd6/0x120 [ 117.607694][ T581] ? cpumask_next+0x11/0x30 [ 117.612263][ T581] dump_stack+0x15/0x17 [ 117.616397][ T581] should_fail+0x3c0/0x510 [ 117.620806][ T581] ? percpu_ref_init+0xd0/0x330 [ 117.625635][ T581] __should_failslab+0x9f/0xe0 [ 117.630389][ T581] should_failslab+0x9/0x20 [ 117.634919][ T581] kmem_cache_alloc_trace+0x3a/0x330 [ 117.640197][ T581] percpu_ref_init+0xd0/0x330 [ 117.644854][ T581] ? cgroup_setup_root+0xea0/0xea0 [ 117.649944][ T581] cgroup_apply_control_enable+0x3a2/0x12f0 [ 117.655815][ T581] cgroup_apply_control+0x93/0x710 [ 117.660920][ T581] ? css_next_child+0x160/0x160 [ 117.665759][ T581] ? stack_trace_save+0x12d/0x1f0 [ 117.670771][ T581] ? io_schedule+0x120/0x120 [ 117.675338][ T581] ? kernfs_fop_write_iter+0x15e/0x410 [ 117.680788][ T581] ? __kasan_check_write+0x14/0x20 [ 117.685933][ T581] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 117.691209][ T581] cgroup_subtree_control_write+0xd19/0x1310 [ 117.697173][ T581] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 117.703133][ T581] ? __kasan_check_write+0x14/0x20 [ 117.708227][ T581] ? _copy_from_iter+0x3fb/0xd60 [ 117.713146][ T581] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 117.719111][ T581] cgroup_file_write+0x28e/0x590 [ 117.724036][ T581] ? cgroup_seqfile_stop+0xc0/0xc0 [ 117.729136][ T581] ? mutex_lock+0xa6/0x110 [ 117.733533][ T581] ? mutex_trylock+0xb0/0xb0 [ 117.738106][ T581] ? __kasan_check_write+0x14/0x20 [ 117.743199][ T581] kernfs_fop_write_iter+0x2d0/0x410 [ 117.748461][ T581] ? cgroup_seqfile_stop+0xc0/0xc0 [ 117.753558][ T581] vfs_write+0xc1c/0xf40 [ 117.757782][ T581] ? __kasan_check_write+0x14/0x20 [ 117.762874][ T581] ? kernel_write+0x3c0/0x3c0 [ 117.767532][ T581] ? _raw_spin_unlock_irq+0x4e/0x70 [ 117.772713][ T581] ? ptrace_stop+0x6ff/0x9f0 [ 117.777282][ T581] ? __kasan_check_read+0x11/0x20 [ 117.782289][ T581] ? __fdget_pos+0x27e/0x310 [ 117.786858][ T581] ksys_write+0x198/0x2c0 [ 117.791167][ T581] ? do_notify_parent+0xa60/0xa60 [ 117.796168][ T581] ? __ia32_sys_read+0x90/0x90 [ 117.800910][ T581] ? __ia32_sys_open+0x270/0x270 [ 117.805829][ T581] __x64_sys_write+0x7b/0x90 [ 117.810400][ T581] do_syscall_64+0x34/0x70 [ 117.814796][ T581] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 117.820664][ T581] RIP: 0033:0x7fc8ece62c09 [ 117.825059][ T581] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 585] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 581] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 585] open("./file0", O_RDONLY [pid 581] close(3 [pid 585] <... open resumed>) = 3 [pid 581] <... close resumed>) = 0 [pid 585] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [pid 581] close(4 [pid 585] write(4, "-pids ", 6 [pid 581] <... close resumed>) = 0 [pid 581] close(5) = 0 [pid 581] close(6) = -1 EBADF (Bad file descriptor) [pid 581] close(7) = -1 EBADF (Bad file descriptor) [pid 581] close(8) = -1 EBADF (Bad file descriptor) [pid 581] close(9) = -1 EBADF (Bad file descriptor) [pid 581] close(10) = -1 EBADF (Bad file descriptor) [pid 581] close(11) = -1 EBADF (Bad file descriptor) [pid 581] close(12) = -1 EBADF (Bad file descriptor) [pid 581] close(13) = -1 EBADF (Bad file descriptor) [pid 581] close(14) = -1 EBADF (Bad file descriptor) [pid 581] close(15) = -1 EBADF (Bad file descriptor) [pid 581] close(16) = -1 EBADF (Bad file descriptor) [pid 581] close(17) = -1 EBADF (Bad file descriptor) [pid 581] close(18) = -1 EBADF (Bad file descriptor) [pid 581] close(19) = -1 EBADF (Bad file descriptor) [pid 581] close(20) = -1 EBADF (Bad file descriptor) [pid 581] close(21) = -1 EBADF (Bad file descriptor) [pid 581] close(22) = -1 EBADF (Bad file descriptor) [pid 581] close(23) = -1 EBADF (Bad file descriptor) [pid 581] close(24) = -1 EBADF (Bad file descriptor) [pid 581] close(25) = -1 EBADF (Bad file descriptor) [pid 581] close(26) = -1 EBADF (Bad file descriptor) [pid 581] close(27) = -1 EBADF (Bad file descriptor) [pid 581] close(28) = -1 EBADF (Bad file descriptor) [pid 581] close(29) = -1 EBADF (Bad file descriptor) [pid 581] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory ) = 89 [pid 581] exit_group(0) = ? [pid 581] +++ exited with 0 +++ [pid 375] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=36, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 375] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 375] umount2("./34", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] openat(AT_FDCWD, "./34", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 375] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 375] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 375] umount2("./34/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./34/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 577] <... write resumed>) = 6 [pid 375] unlink("./34/binderfs" [pid 585] <... write resumed>) = 6 [pid 584] <... write resumed>) = 6 [pid 583] <... write resumed>) = 6 [pid 582] <... write resumed>) = 6 [pid 577] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 375] <... unlink resumed>) = 0 [pid 585] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 584] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 583] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 582] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 375] umount2("./34/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW [pid 585] <... openat resumed>) = 5 [pid 577] <... openat resumed>) = 5 [pid 375] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 582] <... openat resumed>) = 5 [pid 375] lstat("./34/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 584] <... openat resumed>) = 5 [pid 375] unlink("./34/cgroup" [pid 585] write(5, "22", 2 [pid 584] write(5, "22", 2 [pid 583] <... openat resumed>) = 5 [pid 582] write(5, "22", 2 [pid 577] write(5, "22", 2 [pid 375] <... unlink resumed>) = 0 [pid 585] <... write resumed>) = 2 [pid 584] <... write resumed>) = 2 [pid 583] write(5, "22", 2 [pid 582] <... write resumed>) = 2 [pid 577] <... write resumed>) = 2 [ 117.844641][ T581] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 117.853031][ T581] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 117.860981][ T581] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 117.868934][ T581] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 117.876885][ T581] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 117.884833][ T581] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000022 [pid 375] umount2("./34/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW [pid 585] write(4, "+pids ", 6 [pid 584] write(4, "+pids ", 6 [pid 583] <... write resumed>) = 2 [pid 582] write(4, "+pids ", 6 [pid 577] write(4, "+pids ", 6 [pid 375] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 375] lstat("./34/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 375] unlink("./34/cgroup.net") = 0 [pid 375] umount2("./34/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 583] write(4, "+pids ", 6 [pid 375] <... umount2 resumed>) = 0 [pid 375] umount2("./34/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./34/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 375] umount2("./34/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] openat(AT_FDCWD, "./34/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 375] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 375] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 375] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 375] close(4) = 0 [pid 375] rmdir("./34/file0") = 0 [pid 375] umount2("./34/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./34/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 375] unlink("./34/cgroup.cpu") = 0 [pid 375] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 375] close(3) = 0 [pid 375] rmdir("./34") = 0 [pid 375] mkdir("./35", 0777) = 0 [pid 375] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 586 attached [pid 586] chdir("./35" [pid 375] <... clone resumed>, child_tidptr=0x555556fab5d0) = 37 [pid 586] <... chdir resumed>) = 0 [pid 586] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 586] setpgid(0, 0) = 0 [pid 586] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 586] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 586] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 586] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 586] write(3, "1000", 4) = 4 [pid 586] close(3) = 0 [pid 586] symlink("/dev/binderfs", "./binderfs") = 0 [pid 586] mkdirat(AT_FDCWD, "./file0", 000) = 0 [ 117.912718][ T585] FAULT_INJECTION: forcing a failure. [ 117.912718][ T585] name failslab, interval 1, probability 0, space 0, times 0 [ 117.925565][ T585] CPU: 0 PID: 585 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 117.937185][ T585] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 117.947224][ T585] Call Trace: [ 117.950502][ T585] dump_stack_lvl+0x1e2/0x24b [ 117.955160][ T585] ? bfq_pos_tree_add_move+0x43e/0x43e [ 117.960598][ T585] ? selinux_kernfs_init_security+0x1a8/0x760 [ 117.966643][ T585] dump_stack+0x15/0x17 [ 117.970784][ T585] should_fail+0x3c0/0x510 [ 117.975188][ T585] ? __kernfs_new_node+0x99/0x6e0 [ 117.980365][ T585] __should_failslab+0x9f/0xe0 [ 117.985107][ T585] should_failslab+0x9/0x20 [ 117.989590][ T585] __kmalloc_track_caller+0x5f/0x350 [ 117.994852][ T585] kstrdup_const+0x55/0x90 [ 117.999252][ T585] __kernfs_new_node+0x99/0x6e0 [ 118.004086][ T585] ? is_module_text_address+0xe1/0x140 [ 118.009534][ T585] ? kernfs_new_node+0x170/0x170 [ 118.014457][ T585] ? ptr_to_hashval+0x60/0x60 [ 118.019110][ T585] ? arch_stack_walk+0xf8/0x140 [ 118.023938][ T585] ? snprintf+0xd6/0x120 [ 118.028162][ T585] kernfs_new_node+0x97/0x170 [ 118.032826][ T585] __kernfs_create_file+0x4a/0x270 [ 118.037920][ T585] cgroup_addrm_files+0xab8/0xfe0 [ 118.042930][ T585] ? ____kasan_kmalloc+0xdc/0x110 [ 118.047928][ T585] ? __kasan_kmalloc+0x9/0x10 [ 118.052584][ T585] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 118.058124][ T585] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 118.064261][ T585] ? delete_node+0x759/0x7b0 [ 118.068831][ T585] ? __kasan_check_read+0x11/0x20 [ 118.073838][ T585] ? delete_node+0x759/0x7b0 [ 118.078406][ T585] ? __kasan_check_write+0x14/0x20 [ 118.083505][ T585] ? idr_replace+0x1c4/0x230 [ 118.088076][ T585] ? idr_get_next+0x4b0/0x4b0 [ 118.092734][ T585] ? _raw_spin_lock_bh+0xa3/0x1b0 [ 118.097738][ T585] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 118.103060][ T585] css_populate_dir+0x137/0x370 [ 118.107897][ T585] cgroup_apply_control_enable+0x8b9/0x12f0 [ 118.113870][ T585] cgroup_apply_control+0x93/0x710 [ 118.118961][ T585] ? css_next_child+0x160/0x160 [ 118.123785][ T585] ? stack_trace_save+0x12d/0x1f0 [ 118.128786][ T585] ? io_schedule+0x120/0x120 [ 118.133360][ T585] ? kernfs_fop_write_iter+0x15e/0x410 [ 118.138813][ T585] ? __kasan_check_write+0x14/0x20 [ 118.143909][ T585] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 118.149168][ T585] cgroup_subtree_control_write+0xd19/0x1310 [ 118.155129][ T585] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 118.161091][ T585] ? __kasan_check_write+0x14/0x20 [ 118.166178][ T585] ? _copy_from_iter+0x3fb/0xd60 [ 118.171091][ T585] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 118.177056][ T585] cgroup_file_write+0x28e/0x590 [ 118.181977][ T585] ? cgroup_seqfile_stop+0xc0/0xc0 [ 118.187072][ T585] ? mutex_lock+0xa6/0x110 [ 118.191495][ T585] ? mutex_trylock+0xb0/0xb0 [ 118.196071][ T585] ? __kasan_check_write+0x14/0x20 [ 118.201156][ T585] kernfs_fop_write_iter+0x2d0/0x410 [ 118.206422][ T585] ? cgroup_seqfile_stop+0xc0/0xc0 [ 118.211519][ T585] vfs_write+0xc1c/0xf40 [ 118.215749][ T585] ? __kasan_check_write+0x14/0x20 [ 118.220847][ T585] ? kernel_write+0x3c0/0x3c0 [ 118.225502][ T585] ? _raw_spin_unlock_irq+0x4e/0x70 [ 118.230683][ T585] ? ptrace_stop+0x6ff/0x9f0 [ 118.235257][ T585] ? __kasan_check_read+0x11/0x20 [ 118.240256][ T585] ? __fdget_pos+0x27e/0x310 [ 118.244821][ T585] ksys_write+0x198/0x2c0 [ 118.249125][ T585] ? do_notify_parent+0xa60/0xa60 [ 118.254124][ T585] ? __ia32_sys_read+0x90/0x90 [ 118.258871][ T585] ? __ia32_sys_open+0x270/0x270 [ 118.263791][ T585] __x64_sys_write+0x7b/0x90 [ 118.268364][ T585] do_syscall_64+0x34/0x70 [ 118.272766][ T585] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 118.278633][ T585] RIP: 0033:0x7fc8ece62c09 [ 118.283031][ T585] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 118.302618][ T585] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 586] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 585] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 586] <... mount resumed>) = 0 [pid 585] close(3 [pid 586] open("./file0", O_RDONLY [pid 585] <... close resumed>) = 0 [pid 586] <... open resumed>) = 3 [pid 586] openat(3, "cgroup.subtree_control", O_RDWR [pid 585] close(4 [pid 586] <... openat resumed>) = 4 [pid 586] write(4, "-pids ", 6 [pid 585] <... close resumed>) = 0 [pid 585] close(5) = 0 [pid 585] close(6) = -1 EBADF (Bad file descriptor) [pid 585] close(7) = -1 EBADF (Bad file descriptor) [pid 585] close(8) = -1 EBADF (Bad file descriptor) [pid 585] close(9) = -1 EBADF (Bad file descriptor) [pid 585] close(10) = -1 EBADF (Bad file descriptor) [pid 585] close(11) = -1 EBADF (Bad file descriptor) [pid 585] close(12) = -1 EBADF (Bad file descriptor) [pid 585] close(13) = -1 EBADF (Bad file descriptor) [pid 585] close(14) = -1 EBADF (Bad file descriptor) [pid 585] close(15) = -1 EBADF (Bad file descriptor) [pid 585] close(16) = -1 EBADF (Bad file descriptor) [pid 585] close(17) = -1 EBADF (Bad file descriptor) [pid 585] close(18) = -1 EBADF (Bad file descriptor) [pid 585] close(19) = -1 EBADF (Bad file descriptor) [pid 585] close(20) = -1 EBADF (Bad file descriptor) [pid 585] close(21) = -1 EBADF (Bad file descriptor) [pid 585] close(22) = -1 EBADF (Bad file descriptor) [pid 585] close(23) = -1 EBADF (Bad file descriptor) [pid 585] close(24) = -1 EBADF (Bad file descriptor) [pid 585] close(25) = -1 EBADF (Bad file descriptor) [pid 585] close(26) = -1 EBADF (Bad file descriptor) [pid 585] close(27) = -1 EBADF (Bad file descriptor) [pid 585] close(28) = -1 EBADF (Bad file descriptor) [pid 585] close(29) = -1 EBADF (Bad file descriptor) [pid 585] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory ) = 89 [pid 585] exit_group(0) = ? [pid 585] +++ exited with 0 +++ [pid 380] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=31, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 380] umount2("./29", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] openat(AT_FDCWD, "./29", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 380] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 380] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 380] umount2("./29/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./29/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 380] unlink("./29/binderfs") = 0 [pid 380] umount2("./29/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./29/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [ 118.311014][ T585] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 118.318967][ T585] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 118.326922][ T585] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 118.335221][ T585] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 118.343170][ T585] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 000000000000001d [ 118.352055][ T585] cgroup: cgroup_addrm_files: failed to add max, err=-12 [pid 380] unlink("./29/cgroup" [pid 586] <... write resumed>) = 6 [pid 380] <... unlink resumed>) = 0 [pid 380] umount2("./29/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./29/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 380] unlink("./29/cgroup.net") = 0 [pid 380] umount2("./29/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 586] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 586] write(5, "22", 2) = 2 [ 118.380969][ T584] FAULT_INJECTION: forcing a failure. [ 118.380969][ T584] name failslab, interval 1, probability 0, space 0, times 0 [ 118.393741][ T584] CPU: 1 PID: 584 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 118.393838][ T380] ------------[ cut here ]------------ [ 118.405351][ T584] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 118.405356][ T584] Call Trace: [ 118.405375][ T584] dump_stack_lvl+0x1e2/0x24b [ 118.405385][ T584] ? bfq_pos_tree_add_move+0x43e/0x43e [ 118.405404][ T584] ? selinux_kernfs_init_security+0x1a8/0x760 [ 118.410894][ T380] WARNING: CPU: 0 PID: 380 at fs/namespace.c:1168 mntput_no_expire+0x48a/0x6c0 [ 118.420881][ T584] dump_stack+0x15/0x17 [ 118.420891][ T584] should_fail+0x3c0/0x510 [ 118.420901][ T584] ? __kernfs_new_node+0x99/0x6e0 [ 118.420910][ T584] __should_failslab+0x9f/0xe0 [ 118.420928][ T584] should_failslab+0x9/0x20 [ 118.424188][ T380] Modules linked in: [ 118.428843][ T584] __kmalloc_track_caller+0x5f/0x350 [ 118.434292][ T380] [ 118.440317][ T584] kstrdup_const+0x55/0x90 [ 118.440335][ T584] __kernfs_new_node+0x99/0x6e0 [ 118.449241][ T380] CPU: 0 PID: 380 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 118.453881][ T584] ? is_module_text_address+0xe1/0x140 [ 118.453891][ T584] ? kernfs_new_node+0x170/0x170 [ 118.453908][ T584] ? ptr_to_hashval+0x60/0x60 [ 118.458284][ T380] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 118.463276][ T584] ? arch_stack_walk+0xf8/0x140 [ 118.463286][ T584] ? snprintf+0xd6/0x120 [ 118.463301][ T584] kernfs_new_node+0x97/0x170 [ 118.468045][ T380] RIP: 0010:mntput_no_expire+0x48a/0x6c0 [ 118.472523][ T584] __kernfs_create_file+0x4a/0x270 [ 118.472535][ T584] cgroup_addrm_files+0xab8/0xfe0 [ 118.472544][ T584] ? ____kasan_kmalloc+0xdc/0x110 [ 118.472560][ T584] ? __kasan_kmalloc+0x9/0x10 [ 118.476431][ T380] Code: 48 c7 c2 80 02 44 86 e8 64 f0 8e ff e9 8b fc ff ff e8 ba 21 b6 ff e9 81 fc ff ff e8 b0 21 b6 ff e9 77 fc ff ff e8 a6 21 b6 ff <0f> 0b e9 f4 fc ff ff e8 9a 21 b6 ff e8 65 ad a2 ff e9 ea fc ff ff [ 118.481677][ T584] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 118.481688][ T584] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 118.481696][ T584] ? delete_node+0x759/0x7b0 [ 118.481706][ T584] ? __kasan_check_read+0x11/0x20 [ 118.481720][ T584] ? delete_node+0x759/0x7b0 [ 118.484021][ T380] RSP: 0018:ffffc90000b27ca0 EFLAGS: 00010293 [ 118.488421][ T584] ? __kasan_check_write+0x14/0x20 [ 118.493255][ T380] [ 118.504849][ T584] ? idr_replace+0x1c4/0x230 [ 118.504861][ T584] ? idr_get_next+0x4b0/0x4b0 [ 118.504879][ T584] ? _raw_spin_lock_bh+0xa3/0x1b0 [ 118.510324][ T380] RAX: ffffffff81b68f1a RBX: 00000000ffffffff RCX: ffff8881065ebb40 [ 118.515235][ T584] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 118.519882][ T380] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000 [ 118.529916][ T584] css_populate_dir+0x137/0x370 [ 118.529929][ T584] cgroup_apply_control_enable+0x8b9/0x12f0 [ 118.529949][ T584] cgroup_apply_control+0x93/0x710 [ 118.534783][ T380] RBP: ffffc90000b27d70 R08: ffffffff81b68c08 R09: 0000000000000003 [ 118.539003][ T584] ? css_next_child+0x160/0x160 [ 118.543692][ T380] R10: fffff52000164f85 R11: 1ffff92000164f84 R12: dffffc0000000000 [ 118.549254][ T584] ? stack_trace_save+0x12d/0x1f0 [ 118.554366][ T380] R13: ffff888116a96e00 R14: ffffc90000b27d00 R15: 1ffff92000164f9c [ 118.559385][ T584] ? io_schedule+0x120/0x120 [ 118.564404][ T380] FS: 0000555556fab300(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 118.569030][ T584] ? kernfs_fop_write_iter+0x15e/0x410 [ 118.588632][ T380] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 118.594129][ T584] ? __kasan_check_write+0x14/0x20 [ 118.594148][ T584] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 118.600314][ T380] CR2: 00007ffd7d0e1c18 CR3: 000000011ddaf000 CR4: 00000000003506b0 [ 118.604849][ T584] cgroup_subtree_control_write+0xd19/0x1310 [ 118.609840][ T380] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 118.614403][ T584] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 118.614415][ T584] ? __kasan_check_write+0x14/0x20 [pid 586] write(4, "+pids ", 6write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory [pid 584] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 584] close(3) = 0 [pid 584] close(4) = 0 [pid 584] close(5) = 0 [pid 584] close(6) = -1 EBADF (Bad file descriptor) [pid 584] close(7) = -1 EBADF (Bad file descriptor) [pid 584] close(8) = -1 EBADF (Bad file descriptor) [pid 584] close(9) = -1 EBADF (Bad file descriptor) [pid 584] close(10) = -1 EBADF (Bad file descriptor) [pid 584] close(11) = -1 EBADF (Bad file descriptor) [pid 584] close(12) = -1 EBADF (Bad file descriptor) [pid 584] close(13) = -1 EBADF (Bad file descriptor) [pid 584] close(14) = -1 EBADF (Bad file descriptor) [pid 584] close(15) = -1 EBADF (Bad file descriptor) [pid 584] close(16) = -1 EBADF (Bad file descriptor) [pid 584] close(17) = -1 EBADF (Bad file descriptor) [pid 584] close(18) = -1 EBADF (Bad file descriptor) [pid 584] close(19) = -1 EBADF (Bad file descriptor) [pid 584] close(20) = -1 EBADF (Bad file descriptor) [pid 584] close(21) = -1 EBADF (Bad file descriptor) [pid 584] close(22) = -1 EBADF (Bad file descriptor) [pid 584] close(23) = -1 EBADF (Bad file descriptor) [pid 584] close(24) = -1 EBADF (Bad file descriptor) [pid 584] close(25) = -1 EBADF (Bad file descriptor) [pid 584] close(26) = -1 EBADF (Bad file descriptor) [pid 584] close(27) = -1 EBADF (Bad file descriptor) [pid 584] close(28) = -1 EBADF (Bad file descriptor) [pid 584] close(29) = -1 EBADF (Bad file descriptor) [pid 584] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 584] exit_group(0) = ? [pid 584] +++ exited with 0 +++ [pid 376] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=35, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [ 118.614434][ T584] ? _copy_from_iter+0x3fb/0xd60 [ 118.620472][ T380] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 118.625548][ T584] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 118.627856][ T380] Call Trace: [ 118.632428][ T584] cgroup_file_write+0x28e/0x590 [ 118.632439][ T584] ? cgroup_seqfile_stop+0xc0/0xc0 [ 118.632448][ T584] ? mutex_lock+0xa6/0x110 [ 118.632465][ T584] ? mutex_trylock+0xb0/0xb0 [ 118.637124][ T380] ? lockref_get_or_lock+0x340/0x340 [ 118.642119][ T584] ? __kasan_check_write+0x14/0x20 [ 118.642132][ T584] kernfs_fop_write_iter+0x2d0/0x410 [ 118.642152][ T584] ? cgroup_seqfile_stop+0xc0/0xc0 [ 118.650108][ T380] ? umount_tree+0xf50/0xf50 [ 118.655265][ T584] vfs_write+0xc1c/0xf40 [ 118.655277][ T584] ? __kasan_check_write+0x14/0x20 [ 118.655287][ T584] ? kernel_write+0x3c0/0x3c0 [ 118.655304][ T584] ? _raw_spin_unlock_irq+0x4e/0x70 [ 118.663325][ T380] ? vfs_submount+0xb0/0xb0 [ 118.668069][ T584] ? ptrace_stop+0x6ff/0x9f0 [ 118.673955][ T380] ? __rcu_read_unlock+0x60/0x90 [ 118.679017][ T584] ? __kasan_check_read+0x11/0x20 [ 118.686979][ T380] ? dput+0x2b6/0x320 [ 118.691782][ T584] ? __fdget_pos+0x27e/0x310 [ 118.691792][ T584] ksys_write+0x198/0x2c0 [ 118.691810][ T584] ? do_notify_parent+0xa60/0xa60 [ 118.699770][ T380] path_umount+0x1fe/0xfb0 [ 118.704761][ T584] ? __ia32_sys_read+0x90/0x90 [ 118.704775][ T584] ? __ia32_sys_open+0x270/0x270 [ 118.704785][ T584] __x64_sys_write+0x7b/0x90 [ 118.704804][ T584] do_syscall_64+0x34/0x70 [ 118.712765][ T380] ? namespace_unlock+0x4f0/0x4f0 [pid 376] umount2("./33", MNT_DETACH|UMOUNT_NOFOLLOW [pid 383] kill(-30, SIGKILL) = 0 [pid 383] kill(30, SIGKILL) = 0 [ 118.717335][ T584] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 118.726353][ T380] ? user_path_at_empty+0x40/0x50 [ 118.731695][ T584] RIP: 0033:0x7fc8ece62c09 [ 118.731707][ T584] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 118.731723][ T584] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 [ 118.738290][ T380] __x64_sys_umount+0x122/0x170 [ 118.743359][ T584] ORIG_RAX: 0000000000000001 [ 118.743367][ T584] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 118.743374][ T584] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 118.743388][ T584] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 118.748647][ T380] ? path_umount+0xfb0/0xfb0 [ 118.756583][ T584] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 118.756591][ T584] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000021 [ 118.770871][ T584] cgroup: cgroup_addrm_files: failed to add max, err=-12 [ 118.776579][ T380] ? syscall_enter_from_user_mode+0x58/0x1b0 [ 118.776591][ T380] do_syscall_64+0x34/0x70 [ 118.776610][ T380] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 119.051279][ T380] RIP: 0033:0x7fc8ece63fb7 [ 119.055701][ T380] Code: 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 119.075321][ T380] RSP: 002b:00007ffd7d0e2358 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [pid 376] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 380] <... umount2 resumed>) = 0 [pid 376] openat(AT_FDCWD, "./33", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 380] umount2("./29/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 376] <... openat resumed>) = 3 [pid 380] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 376] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 376] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 376] umount2("./33/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./33/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 376] unlink("./33/binderfs") = 0 [pid 376] umount2("./33/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./33/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 376] unlink("./33/cgroup") = 0 [pid 376] umount2("./33/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./33/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 376] unlink("./33/cgroup.net") = 0 [pid 376] umount2("./33/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 376] umount2("./33/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./33/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 376] umount2("./33/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] openat(AT_FDCWD, "./33/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 376] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 376] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 376] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 376] close(4) = 0 [pid 376] rmdir("./33/file0") = 0 [pid 376] umount2("./33/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./33/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 376] unlink("./33/cgroup.cpu") = 0 [pid 376] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 376] close(3) = 0 [pid 376] rmdir("./33" [pid 380] lstat("./29/file0", [pid 376] <... rmdir resumed>) = 0 [pid 380] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 380] umount2("./29/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] openat(AT_FDCWD, "./29/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 376] mkdir("./34", 0777 [pid 380] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 376] <... mkdir resumed>) = 0 [pid 380] getdents64(4, [pid 376] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 380] <... getdents64 resumed>0x555556fb5670 /* 2 entries */, 32768) = 48 ./strace-static-x86_64: Process 587 attached [pid 380] getdents64(4, [pid 376] <... clone resumed>, child_tidptr=0x555556fab5d0) = 36 [pid 587] chdir("./34" [pid 380] <... getdents64 resumed>0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 587] <... chdir resumed>) = 0 [pid 380] close(4 [pid 587] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 380] <... close resumed>) = 0 [pid 380] rmdir("./29/file0" [pid 587] <... prctl resumed>) = 0 [pid 380] <... rmdir resumed>) = 0 [pid 587] setpgid(0, 0 [pid 380] umount2("./29/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 587] <... setpgid resumed>) = 0 [pid 380] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 587] symlink("/syzcgroup/unified/syz1", "./cgroup" [pid 380] lstat("./29/cgroup.cpu", [pid 587] <... symlink resumed>) = 0 [pid 587] symlink("/syzcgroup/cpu/syz1", "./cgroup.cpu" [pid 380] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 587] <... symlink resumed>) = 0 [pid 587] symlink("/syzcgroup/net/syz1", "./cgroup.net") = 0 [pid 587] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 380] unlink("./29/cgroup.cpu" [pid 587] <... openat resumed>) = 3 [pid 587] write(3, "1000", 4) = 4 [pid 587] close(3) = 0 [pid 587] symlink("/dev/binderfs", "./binderfs" [pid 380] <... unlink resumed>) = 0 [pid 587] <... symlink resumed>) = 0 [pid 587] mkdirat(AT_FDCWD, "./file0", 000 [pid 380] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 587] <... mkdirat resumed>) = 0 [pid 587] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 587] open("./file0", O_RDONLY) = 3 [pid 587] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [pid 587] write(4, "-pids ", 6 [pid 380] close(3) = 0 [pid 380] rmdir("./29") = 0 [pid 383] openat(AT_FDCWD, "/sys/fs/fuse/connections", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 383] fstat(3, {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0 [pid 383] getdents64(3, 0x555556fad630 /* 2 entries */, 32768) = 48 [pid 383] getdents64(3, [pid 380] mkdir("./30", 0777 [pid 383] <... getdents64 resumed>0x555556fad630 /* 0 entries */, 32768) = 0 [pid 380] <... mkdir resumed>) = 0 [pid 383] close(3) = 0 [pid 380] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 588 attached [pid 588] chdir("./30" [pid 380] <... clone resumed>, child_tidptr=0x555556fab5d0) = 32 [pid 588] <... chdir resumed>) = 0 [pid 588] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 588] setpgid(0, 0) = 0 [pid 588] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 588] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 588] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 588] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 588] write(3, "1000", 4) = 4 [pid 588] close(3) = 0 [pid 588] symlink("/dev/binderfs", "./binderfs") = 0 [pid 588] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 588] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 588] open("./file0", O_RDONLY) = 3 [pid 588] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [ 119.083898][ T380] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc8ece63fb7 [ 119.091867][ T380] RDX: 00007ffd7d0e241a RSI: 000000000000000a RDI: 00007ffd7d0e2410 [ 119.099821][ T380] RBP: 00007ffd7d0e2410 R08: 00000000ffffffff R09: 00007ffd7d0e21f0 [ 119.107786][ T380] R10: 0000555556fad6a3 R11: 0000000000000202 R12: 00007ffd7d0e3490 [ 119.115785][ T380] R13: 0000555556fad600 R14: 00007ffd7d0e2380 R15: 000000000000001e [ 119.123770][ T380] ---[ end trace d4de1ca9cdcd197d ]--- [pid 588] write(4, "-pids ", 6) = 6 [pid 588] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 588] write(5, "22", 2) = 2 [ 119.161003][ T577] FAULT_INJECTION: forcing a failure. [ 119.161003][ T577] name failslab, interval 1, probability 0, space 0, times 0 [ 119.173770][ T577] CPU: 1 PID: 577 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 119.185493][ T577] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 119.195547][ T577] Call Trace: [ 119.198827][ T577] dump_stack_lvl+0x1e2/0x24b [ 119.203482][ T577] ? panic+0x7d7/0x7d7 [ 119.207534][ T577] ? bfq_pos_tree_add_move+0x43e/0x43e [ 119.212976][ T577] ? find_next_bit+0xd6/0x120 [ 119.217633][ T577] ? cpumask_next+0x11/0x30 [ 119.222123][ T577] dump_stack+0x15/0x17 [ 119.226277][ T577] should_fail+0x3c0/0x510 [ 119.231194][ T577] ? percpu_ref_init+0xd0/0x330 [ 119.236027][ T577] __should_failslab+0x9f/0xe0 [ 119.240776][ T577] should_failslab+0x9/0x20 [ 119.245275][ T577] kmem_cache_alloc_trace+0x3a/0x330 [ 119.250548][ T577] percpu_ref_init+0xd0/0x330 [ 119.255212][ T577] ? cgroup_setup_root+0xea0/0xea0 [ 119.260414][ T577] cgroup_apply_control_enable+0x3a2/0x12f0 [ 119.266303][ T577] cgroup_apply_control+0x93/0x710 [ 119.271399][ T577] ? css_next_child+0x160/0x160 [ 119.276241][ T577] ? stack_trace_save+0x12d/0x1f0 [ 119.281271][ T577] ? io_schedule+0x120/0x120 [ 119.285853][ T577] ? kernfs_fop_write_iter+0x15e/0x410 [ 119.291295][ T577] ? __kasan_check_write+0x14/0x20 [ 119.296402][ T577] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 119.301676][ T577] cgroup_subtree_control_write+0xd19/0x1310 [ 119.307641][ T577] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 119.313621][ T577] ? __kasan_check_write+0x14/0x20 [ 119.318720][ T577] ? _copy_from_iter+0x3fb/0xd60 [ 119.323635][ T577] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 119.329594][ T577] cgroup_file_write+0x28e/0x590 [ 119.334521][ T577] ? cgroup_seqfile_stop+0xc0/0xc0 [ 119.339620][ T577] ? mutex_lock+0xa6/0x110 [ 119.344012][ T577] ? mutex_trylock+0xb0/0xb0 [ 119.348589][ T577] ? __kasan_check_write+0x14/0x20 [ 119.353684][ T577] kernfs_fop_write_iter+0x2d0/0x410 [ 119.358985][ T577] ? cgroup_seqfile_stop+0xc0/0xc0 [ 119.364088][ T577] vfs_write+0xc1c/0xf40 [ 119.368317][ T577] ? __kasan_check_write+0x14/0x20 [ 119.373411][ T577] ? kernel_write+0x3c0/0x3c0 [ 119.378067][ T577] ? _raw_spin_unlock_irq+0x4e/0x70 [ 119.383260][ T577] ? ptrace_stop+0x6ff/0x9f0 [ 119.387841][ T577] ? __kasan_check_read+0x11/0x20 [ 119.392845][ T577] ? __fdget_pos+0x27e/0x310 [ 119.397424][ T577] ksys_write+0x198/0x2c0 [ 119.401823][ T577] ? do_notify_parent+0xa60/0xa60 [ 119.406833][ T577] ? __ia32_sys_read+0x90/0x90 [ 119.411583][ T577] ? __ia32_sys_open+0x270/0x270 [ 119.416514][ T577] __x64_sys_write+0x7b/0x90 [ 119.421082][ T577] do_syscall_64+0x34/0x70 [ 119.425476][ T577] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 119.431357][ T577] RIP: 0033:0x7fc8ece62c09 [ 119.435775][ T577] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 588] write(4, "+pids ", 6 [pid 577] <... write resumed>) = ? [pid 577] +++ killed by SIGKILL +++ [pid 383] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=30, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=1} --- [pid 383] umount2("./28", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] openat(AT_FDCWD, "./28", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 383] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 383] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 383] umount2("./28/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./28/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 383] unlink("./28/binderfs") = 0 [pid 383] umount2("./28/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./28/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 383] unlink("./28/cgroup") = 0 [pid 383] umount2("./28/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./28/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 383] unlink("./28/cgroup.net") = 0 [pid 383] umount2("./28/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 383] umount2("./28/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./28/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 383] umount2("./28/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] openat(AT_FDCWD, "./28/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 383] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 383] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 383] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 383] close(4) = 0 [pid 383] rmdir("./28/file0") = 0 [pid 383] umount2("./28/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./28/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 383] unlink("./28/cgroup.cpu") = 0 [pid 383] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 383] close(3) = 0 [pid 383] rmdir("./28") = 0 [pid 383] mkdir("./29", 0777) = 0 [pid 383] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 589 attached , child_tidptr=0x555556fab5d0) = 31 [pid 589] chdir("./29") = 0 [pid 589] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 589] setpgid(0, 0) = 0 [pid 589] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 589] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 589] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [pid 589] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 589] write(3, "1000", 4) = 4 [pid 589] close(3) = 0 [pid 589] symlink("/dev/binderfs", "./binderfs") = 0 [pid 589] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 589] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 589] open("./file0", O_RDONLY) = 3 [pid 589] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [ 119.455414][ T577] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 119.463822][ T577] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 119.471779][ T577] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 119.479738][ T577] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 119.487700][ T577] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 119.495651][ T577] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 000000000000001c [pid 589] write(4, "-pids ", 6 [pid 587] <... write resumed>) = 6 [pid 587] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 587] write(5, "22", 2) = 2 [ 119.530723][ T586] FAULT_INJECTION: forcing a failure. [ 119.530723][ T586] name failslab, interval 1, probability 0, space 0, times 0 [ 119.543520][ T586] CPU: 1 PID: 586 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 119.555134][ T586] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 119.565182][ T586] Call Trace: [ 119.568466][ T586] dump_stack_lvl+0x1e2/0x24b [ 119.573141][ T586] ? panic+0x7d7/0x7d7 [ 119.577208][ T586] ? bfq_pos_tree_add_move+0x43e/0x43e [ 119.582654][ T586] ? find_next_bit+0xd6/0x120 [ 119.587307][ T586] ? cpumask_next+0x11/0x30 [ 119.591797][ T586] dump_stack+0x15/0x17 [ 119.595938][ T586] should_fail+0x3c0/0x510 [ 119.600332][ T586] ? percpu_ref_init+0xd0/0x330 [ 119.605165][ T586] __should_failslab+0x9f/0xe0 [ 119.609923][ T586] should_failslab+0x9/0x20 [ 119.614406][ T586] kmem_cache_alloc_trace+0x3a/0x330 [ 119.619674][ T586] percpu_ref_init+0xd0/0x330 [ 119.624347][ T586] ? cgroup_setup_root+0xea0/0xea0 [ 119.629442][ T586] cgroup_apply_control_enable+0x3a2/0x12f0 [ 119.635311][ T586] cgroup_apply_control+0x93/0x710 [ 119.640405][ T586] ? css_next_child+0x160/0x160 [ 119.645246][ T586] ? stack_trace_save+0x12d/0x1f0 [ 119.650341][ T586] ? io_schedule+0x120/0x120 [ 119.654911][ T586] ? kernfs_fop_write_iter+0x15e/0x410 [ 119.660352][ T586] ? __kasan_check_write+0x14/0x20 [ 119.665446][ T586] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 119.670742][ T586] cgroup_subtree_control_write+0xd19/0x1310 [ 119.676701][ T586] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 119.682663][ T586] ? __kasan_check_write+0x14/0x20 [ 119.687760][ T586] ? _copy_from_iter+0x3fb/0xd60 [ 119.692683][ T586] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 119.698640][ T586] cgroup_file_write+0x28e/0x590 [ 119.703552][ T586] ? cgroup_seqfile_stop+0xc0/0xc0 [ 119.708649][ T586] ? mutex_lock+0xa6/0x110 [ 119.713065][ T586] ? mutex_trylock+0xb0/0xb0 [ 119.717640][ T586] ? __kasan_check_write+0x14/0x20 [ 119.722735][ T586] kernfs_fop_write_iter+0x2d0/0x410 [ 119.727993][ T586] ? cgroup_seqfile_stop+0xc0/0xc0 [ 119.733080][ T586] vfs_write+0xc1c/0xf40 [ 119.737299][ T586] ? __kasan_check_write+0x14/0x20 [ 119.742402][ T586] ? kernel_write+0x3c0/0x3c0 [ 119.747071][ T586] ? _raw_spin_unlock_irq+0x4e/0x70 [ 119.752247][ T586] ? ptrace_stop+0x6ff/0x9f0 [ 119.756815][ T586] ? __kasan_check_read+0x11/0x20 [ 119.761821][ T586] ? __fdget_pos+0x27e/0x310 [ 119.766393][ T586] ksys_write+0x198/0x2c0 [ 119.770711][ T586] ? do_notify_parent+0xa60/0xa60 [ 119.775719][ T586] ? __ia32_sys_read+0x90/0x90 [ 119.780458][ T586] ? __ia32_sys_open+0x270/0x270 [ 119.785379][ T586] __x64_sys_write+0x7b/0x90 [ 119.789955][ T586] do_syscall_64+0x34/0x70 [ 119.794350][ T586] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 119.800224][ T586] RIP: 0033:0x7fc8ece62c09 [ 119.804629][ T586] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 587] write(4, "+pids ", 6 [pid 586] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 586] close(3) = 0 [pid 586] close(4) = 0 [pid 586] close(5) = 0 [pid 586] close(6) = -1 EBADF (Bad file descriptor) [pid 586] close(7) = -1 EBADF (Bad file descriptor) [pid 586] close(8) = -1 EBADF (Bad file descriptor) [pid 586] close(9) = -1 EBADF (Bad file descriptor) [pid 586] close(10) = -1 EBADF (Bad file descriptor) [pid 586] close(11) = -1 EBADF (Bad file descriptor) [pid 586] close(12) = -1 EBADF (Bad file descriptor) [pid 586] close(13) = -1 EBADF (Bad file descriptor) [pid 586] close(14) = -1 EBADF (Bad file descriptor) [pid 586] close(15) = -1 EBADF (Bad file descriptor) [pid 586] close(16) = -1 EBADF (Bad file descriptor) [pid 586] close(17) = -1 EBADF (Bad file descriptor) [pid 586] close(18) = -1 EBADF (Bad file descriptor) [pid 586] close(19) = -1 EBADF (Bad file descriptor) [pid 586] close(20) = -1 EBADF (Bad file descriptor) [pid 586] close(21) = -1 EBADF (Bad file descriptor) [pid 586] close(22) = -1 EBADF (Bad file descriptor) [pid 586] close(23) = -1 EBADF (Bad file descriptor) [pid 586] close(24) = -1 EBADF (Bad file descriptor) [pid 586] close(25) = -1 EBADF (Bad file descriptor) [pid 586] close(26) = -1 EBADF (Bad file descriptor) [pid 586] close(27) = -1 EBADF (Bad file descriptor) [pid 586] close(28) = -1 EBADF (Bad file descriptor) [pid 586] close(29) = -1 EBADF (Bad file descriptor) write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory [pid 586] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 586] exit_group(0) = ? [pid 586] +++ exited with 0 +++ [pid 375] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=37, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 375] umount2("./35", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] openat(AT_FDCWD, "./35", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 375] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 375] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 375] umount2("./35/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./35/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 375] unlink("./35/binderfs") = 0 [pid 375] umount2("./35/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./35/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 375] unlink("./35/cgroup") = 0 [pid 375] umount2("./35/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./35/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 375] unlink("./35/cgroup.net") = 0 [pid 375] umount2("./35/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 375] umount2("./35/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./35/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 375] umount2("./35/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] openat(AT_FDCWD, "./35/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 375] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 375] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 375] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 375] close(4) = 0 [pid 375] rmdir("./35/file0") = 0 [pid 375] umount2("./35/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./35/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 375] unlink("./35/cgroup.cpu") = 0 [pid 375] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 375] close(3) = 0 [pid 375] rmdir("./35") = 0 [pid 375] mkdir("./36", 0777) = 0 [pid 375] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 590 attached , child_tidptr=0x555556fab5d0) = 38 [pid 590] chdir("./36") = 0 [pid 590] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 590] setpgid(0, 0) = 0 [pid 590] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 590] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 590] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 590] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 590] write(3, "1000", 4) = 4 [pid 590] close(3) = 0 [pid 590] symlink("/dev/binderfs", "./binderfs") = 0 [pid 590] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 590] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 590] open("./file0", O_RDONLY) = 3 [pid 590] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [ 119.824233][ T586] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 119.832627][ T586] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 119.840579][ T586] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 119.848534][ T586] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 119.856494][ T586] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 119.864449][ T586] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000023 [ 119.900861][ T582] FAULT_INJECTION: forcing a failure. [ 119.900861][ T582] name failslab, interval 1, probability 0, space 0, times 0 [ 119.913622][ T582] CPU: 0 PID: 582 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 119.925233][ T582] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 119.935267][ T582] Call Trace: [ 119.938545][ T582] dump_stack_lvl+0x1e2/0x24b [ 119.943220][ T582] ? panic+0x7d7/0x7d7 [ 119.947281][ T582] ? bfq_pos_tree_add_move+0x43e/0x43e [ 119.952730][ T582] ? find_next_bit+0xd6/0x120 [ 119.957400][ T582] ? cpumask_next+0x11/0x30 [ 119.961891][ T582] dump_stack+0x15/0x17 [ 119.966024][ T582] should_fail+0x3c0/0x510 [ 119.970426][ T582] ? percpu_ref_init+0xd0/0x330 [ 119.975264][ T582] __should_failslab+0x9f/0xe0 [ 119.980010][ T582] should_failslab+0x9/0x20 [ 119.984491][ T582] kmem_cache_alloc_trace+0x3a/0x330 [ 119.989758][ T582] percpu_ref_init+0xd0/0x330 [ 119.994427][ T582] ? cgroup_setup_root+0xea0/0xea0 [ 119.999515][ T582] cgroup_apply_control_enable+0x3a2/0x12f0 [ 120.005385][ T582] cgroup_apply_control+0x93/0x710 [ 120.010471][ T582] ? css_next_child+0x160/0x160 [ 120.015298][ T582] ? stack_trace_save+0x12d/0x1f0 [ 120.020309][ T582] ? io_schedule+0x120/0x120 [ 120.024892][ T582] ? kernfs_fop_write_iter+0x15e/0x410 [ 120.030343][ T582] ? __kasan_check_write+0x14/0x20 [ 120.035443][ T582] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 120.040714][ T582] cgroup_subtree_control_write+0xd19/0x1310 [ 120.046667][ T582] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 120.052624][ T582] ? __kasan_check_write+0x14/0x20 [ 120.057716][ T582] ? _copy_from_iter+0x3fb/0xd60 [ 120.062631][ T582] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 120.068586][ T582] cgroup_file_write+0x28e/0x590 [ 120.073508][ T582] ? cgroup_seqfile_stop+0xc0/0xc0 [ 120.078602][ T582] ? mutex_lock+0xa6/0x110 [ 120.082992][ T582] ? mutex_trylock+0xb0/0xb0 [ 120.087567][ T582] ? __kasan_check_write+0x14/0x20 [ 120.092663][ T582] kernfs_fop_write_iter+0x2d0/0x410 [ 120.097936][ T582] ? cgroup_seqfile_stop+0xc0/0xc0 [ 120.103041][ T582] vfs_write+0xc1c/0xf40 [ 120.107283][ T582] ? __kasan_check_write+0x14/0x20 [ 120.112370][ T582] ? kernel_write+0x3c0/0x3c0 [ 120.117027][ T582] ? _raw_spin_unlock_irq+0x4e/0x70 [ 120.122227][ T582] ? ptrace_stop+0x6ff/0x9f0 [ 120.126791][ T582] ? __kasan_check_read+0x11/0x20 [ 120.131794][ T582] ? __fdget_pos+0x27e/0x310 [ 120.136380][ T582] ksys_write+0x198/0x2c0 [ 120.140704][ T582] ? do_notify_parent+0xa60/0xa60 [ 120.145715][ T582] ? __ia32_sys_read+0x90/0x90 [ 120.150453][ T582] ? __ia32_sys_open+0x270/0x270 [ 120.155376][ T582] __x64_sys_write+0x7b/0x90 [ 120.159964][ T582] do_syscall_64+0x34/0x70 [ 120.164377][ T582] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 120.170264][ T582] RIP: 0033:0x7fc8ece62c09 [ 120.174677][ T582] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 590] write(4, "-pids ", 6 [pid 582] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 582] close(3) = 0 [pid 582] close(4) = 0 [pid 582] close(5) = 0 [pid 582] close(6) = -1 EBADF (Bad file descriptor) [pid 582] close(7) = -1 EBADF (Bad file descriptor) [pid 582] close(8) = -1 EBADF (Bad file descriptor) [pid 582] close(9) = -1 EBADF (Bad file descriptor) [pid 582] close(10) = -1 EBADF (Bad file descriptor) [pid 582] close(11) = -1 EBADF (Bad file descriptor) [pid 582] close(12) = -1 EBADF (Bad file descriptor) [pid 582] close(13) = -1 EBADF (Bad file descriptor) [pid 582] close(14) = -1 EBADF (Bad file descriptor) [pid 582] close(15) = -1 EBADF (Bad file descriptor) [pid 582] close(16) = -1 EBADF (Bad file descriptor) [pid 582] close(17) = -1 EBADF (Bad file descriptor) [pid 582] close(18) = -1 EBADF (Bad file descriptor) [pid 582] close(19) = -1 EBADF (Bad file descriptor) [pid 582] close(20) = -1 EBADF (Bad file descriptor) [pid 582] close(21) = -1 EBADF (Bad file descriptor) [pid 582] close(22) = -1 EBADF (Bad file descriptor) [pid 582] close(23) = -1 EBADF (Bad file descriptor) [pid 582] close(24) = -1 EBADF (Bad file descriptor) [pid 582] close(25) = -1 EBADF (Bad file descriptor) [pid 582] close(26) = -1 EBADF (Bad file descriptor) [pid 582] close(27) = -1 EBADF (Bad file descriptor) [pid 582] close(28) = -1 EBADF (Bad file descriptor) [pid 582] close(29) = -1 EBADF (Bad file descriptor) [pid 582] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory ) = 89 [pid 582] exit_group(0) = ? [pid 582] +++ exited with 0 +++ [pid 382] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=39, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 382] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 382] umount2("./37", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] openat(AT_FDCWD, "./37", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 382] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 382] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 382] umount2("./37/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./37/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 382] unlink("./37/binderfs") = 0 [pid 382] umount2("./37/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./37/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 382] unlink("./37/cgroup") = 0 [pid 382] umount2("./37/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./37/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 382] unlink("./37/cgroup.net") = 0 [pid 382] umount2("./37/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 382] umount2("./37/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./37/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 382] umount2("./37/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] openat(AT_FDCWD, "./37/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 382] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 382] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 382] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 382] close(4) = 0 [pid 382] rmdir("./37/file0") = 0 [pid 382] umount2("./37/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./37/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 382] unlink("./37/cgroup.cpu") = 0 [pid 382] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 382] close(3) = 0 [ 120.194268][ T582] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 120.202666][ T582] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 120.210626][ T582] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 120.218580][ T582] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 120.226536][ T582] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 120.234487][ T582] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000025 [pid 382] rmdir("./37") = 0 [pid 382] mkdir("./38", 0777 [pid 590] <... write resumed>) = 6 [pid 590] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 590] write(5, "22", 2) = 2 [pid 590] write(4, "+pids ", 6 [pid 382] <... mkdir resumed>) = 0 [pid 382] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556fab5d0) = 40 ./strace-static-x86_64: Process 591 attached [pid 591] chdir("./38") = 0 [pid 591] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 591] setpgid(0, 0) = 0 [pid 591] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 591] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [pid 591] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 591] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 591] write(3, "1000", 4) = 4 [pid 591] close(3) = 0 [pid 591] symlink("/dev/binderfs", "./binderfs") = 0 [pid 591] mkdirat(AT_FDCWD, "./file0", 000) = 0 [ 120.270442][ T587] FAULT_INJECTION: forcing a failure. [ 120.270442][ T587] name failslab, interval 1, probability 0, space 0, times 0 [ 120.283284][ T587] CPU: 1 PID: 587 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 120.294908][ T587] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 120.304958][ T587] Call Trace: [ 120.308239][ T587] dump_stack_lvl+0x1e2/0x24b [ 120.312914][ T587] ? bfq_pos_tree_add_move+0x43e/0x43e [ 120.318369][ T587] ? selinux_kernfs_init_security+0x1a8/0x760 [ 120.324416][ T587] dump_stack+0x15/0x17 [ 120.328668][ T587] should_fail+0x3c0/0x510 [ 120.333085][ T587] ? __kernfs_new_node+0x99/0x6e0 [ 120.338089][ T587] __should_failslab+0x9f/0xe0 [ 120.342847][ T587] should_failslab+0x9/0x20 [ 120.347347][ T587] __kmalloc_track_caller+0x5f/0x350 [ 120.352617][ T587] kstrdup_const+0x55/0x90 [ 120.357011][ T587] __kernfs_new_node+0x99/0x6e0 [ 120.361844][ T587] ? is_module_text_address+0xe1/0x140 [ 120.367288][ T587] ? kernfs_new_node+0x170/0x170 [ 120.372213][ T587] ? ptr_to_hashval+0x60/0x60 [ 120.376883][ T587] ? arch_stack_walk+0xf8/0x140 [ 120.381718][ T587] ? snprintf+0xd6/0x120 [ 120.385937][ T587] kernfs_new_node+0x97/0x170 [ 120.390592][ T587] __kernfs_create_file+0x4a/0x270 [ 120.395692][ T587] cgroup_addrm_files+0xab8/0xfe0 [ 120.400701][ T587] ? ____kasan_kmalloc+0xdc/0x110 [ 120.405699][ T587] ? __kasan_kmalloc+0x9/0x10 [ 120.410354][ T587] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 120.415886][ T587] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 120.422134][ T587] ? delete_node+0x759/0x7b0 [ 120.426711][ T587] ? __kasan_check_read+0x11/0x20 [ 120.431720][ T587] ? delete_node+0x759/0x7b0 [ 120.436287][ T587] ? __kasan_check_write+0x14/0x20 [ 120.441381][ T587] ? idr_replace+0x1c4/0x230 [ 120.445968][ T587] ? idr_get_next+0x4b0/0x4b0 [ 120.450635][ T587] ? _raw_spin_lock_bh+0xa3/0x1b0 [ 120.455651][ T587] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 120.460834][ T587] css_populate_dir+0x137/0x370 [ 120.465672][ T587] cgroup_apply_control_enable+0x8b9/0x12f0 [ 120.471540][ T587] cgroup_apply_control+0x93/0x710 [ 120.476626][ T587] ? css_next_child+0x160/0x160 [ 120.481476][ T587] ? stack_trace_save+0x12d/0x1f0 [ 120.486490][ T587] ? io_schedule+0x120/0x120 [ 120.491063][ T587] ? kernfs_fop_write_iter+0x15e/0x410 [ 120.496508][ T587] ? __kasan_check_write+0x14/0x20 [ 120.501600][ T587] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 120.506862][ T587] cgroup_subtree_control_write+0xd19/0x1310 [ 120.512819][ T587] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 120.518775][ T587] ? __kasan_check_write+0x14/0x20 [ 120.523870][ T587] ? _copy_from_iter+0x3fb/0xd60 [ 120.528794][ T587] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 120.534750][ T587] cgroup_file_write+0x28e/0x590 [ 120.539661][ T587] ? cgroup_seqfile_stop+0xc0/0xc0 [ 120.544759][ T587] ? mutex_lock+0xa6/0x110 [ 120.549172][ T587] ? mutex_trylock+0xb0/0xb0 [ 120.553756][ T587] ? __kasan_check_write+0x14/0x20 [ 120.558855][ T587] kernfs_fop_write_iter+0x2d0/0x410 [ 120.564123][ T587] ? cgroup_seqfile_stop+0xc0/0xc0 [ 120.569222][ T587] vfs_write+0xc1c/0xf40 [ 120.573442][ T587] ? __kasan_check_write+0x14/0x20 [ 120.578531][ T587] ? kernel_write+0x3c0/0x3c0 [ 120.583195][ T587] ? _raw_spin_unlock_irq+0x4e/0x70 [ 120.588380][ T587] ? ptrace_stop+0x6ff/0x9f0 [ 120.592946][ T587] ? __kasan_check_read+0x11/0x20 [ 120.597956][ T587] ? __fdget_pos+0x27e/0x310 [ 120.602541][ T587] ksys_write+0x198/0x2c0 [ 120.606867][ T587] ? do_notify_parent+0xa60/0xa60 [ 120.611878][ T587] ? __ia32_sys_read+0x90/0x90 [ 120.616616][ T587] ? __ia32_sys_open+0x270/0x270 [ 120.621535][ T587] __x64_sys_write+0x7b/0x90 [ 120.626116][ T587] do_syscall_64+0x34/0x70 [ 120.630526][ T587] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 120.636409][ T587] RIP: 0033:0x7fc8ece62c09 [ 120.640818][ T587] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 120.660405][ T587] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 591] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 587] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 591] <... mount resumed>) = 0 [pid 591] open("./file0", O_RDONLY [pid 587] close(3 [pid 591] <... open resumed>) = 3 [pid 591] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [pid 591] write(4, "-pids ", 6 [pid 587] <... close resumed>) = 0 [pid 587] close(4) = 0 [pid 587] close(5) = 0 [pid 587] close(6) = -1 EBADF (Bad file descriptor) [pid 587] close(7) = -1 EBADF (Bad file descriptor) [pid 587] close(8) = -1 EBADF (Bad file descriptor) [pid 587] close(9) = -1 EBADF (Bad file descriptor) [pid 587] close(10) = -1 EBADF (Bad file descriptor) [pid 587] close(11) = -1 EBADF (Bad file descriptor) [pid 587] close(12) = -1 EBADF (Bad file descriptor) [pid 587] close(13) = -1 EBADF (Bad file descriptor) [pid 587] close(14) = -1 EBADF (Bad file descriptor) [pid 587] close(15) = -1 EBADF (Bad file descriptor) [pid 587] close(16) = -1 EBADF (Bad file descriptor) [pid 587] close(17) = -1 EBADF (Bad file descriptor) [pid 587] close(18) = -1 EBADF (Bad file descriptor) [pid 587] close(19) = -1 EBADF (Bad file descriptor) [pid 587] close(20) = -1 EBADF (Bad file descriptor) [pid 587] close(21) = -1 EBADF (Bad file descriptor) [pid 587] close(22) = -1 EBADF (Bad file descriptor) [pid 587] close(23) = -1 EBADF (Bad file descriptor) [pid 587] close(24) = -1 EBADF (Bad file descriptor) [pid 587] close(25) = -1 EBADF (Bad file descriptor) [pid 587] close(26) = -1 EBADF (Bad file descriptor) [pid 587] close(27) = -1 EBADF (Bad file descriptor) [pid 587] close(28) = -1 EBADF (Bad file descriptor) [pid 587] close(29) = -1 EBADF (Bad file descriptor) [pid 587] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory ) = 89 [pid 587] exit_group(0) = ? [pid 587] +++ exited with 0 +++ [pid 376] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=36, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 376] umount2("./34", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] openat(AT_FDCWD, "./34", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 376] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 376] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 376] umount2("./34/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./34/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 376] unlink("./34/binderfs") = 0 [pid 376] umount2("./34/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./34/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 376] unlink("./34/cgroup") = 0 [pid 376] umount2("./34/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./34/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 376] unlink("./34/cgroup.net") = 0 [pid 376] umount2("./34/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 376] umount2("./34/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./34/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 376] umount2("./34/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] openat(AT_FDCWD, "./34/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 376] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 376] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 376] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 376] close(4) = 0 [pid 376] rmdir("./34/file0") = 0 [pid 376] umount2("./34/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./34/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 376] unlink("./34/cgroup.cpu") = 0 [pid 376] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 376] close(3) = 0 [pid 376] rmdir("./34") = 0 [pid 376] mkdir("./35", 0777) = 0 [pid 376] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 592 attached [pid 592] chdir("./35" [pid 376] <... clone resumed>, child_tidptr=0x555556fab5d0) = 37 [pid 592] <... chdir resumed>) = 0 [pid 592] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 592] setpgid(0, 0) = 0 [pid 592] symlink("/syzcgroup/unified/syz1", "./cgroup") = 0 [pid 592] symlink("/syzcgroup/cpu/syz1", "./cgroup.cpu") = 0 [pid 592] symlink("/syzcgroup/net/syz1", "./cgroup.net") = 0 [pid 592] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 592] write(3, "1000", 4) = 4 [pid 592] close(3) = 0 [pid 592] symlink("/dev/binderfs", "./binderfs") = 0 [pid 592] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 592] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 592] open("./file0", O_RDONLY) = 3 [pid 592] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [pid 592] write(4, "-pids ", 6) = 6 [pid 592] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [ 120.668798][ T587] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 120.676758][ T587] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 120.684705][ T587] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 120.692662][ T587] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 120.700621][ T587] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000022 [ 120.708642][ T587] cgroup: cgroup_addrm_files: failed to add max, err=-12 [pid 592] write(5, "22", 2) = 2 [ 120.750521][ T590] FAULT_INJECTION: forcing a failure. [ 120.750521][ T590] name failslab, interval 1, probability 0, space 0, times 0 [ 120.763198][ T590] CPU: 1 PID: 590 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 120.774817][ T590] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 120.784851][ T590] Call Trace: [ 120.788132][ T590] dump_stack_lvl+0x1e2/0x24b [ 120.792792][ T590] ? bfq_pos_tree_add_move+0x43e/0x43e [ 120.798232][ T590] ? selinux_kernfs_init_security+0x1a8/0x760 [ 120.804293][ T590] dump_stack+0x15/0x17 [ 120.808432][ T590] should_fail+0x3c0/0x510 [ 120.812831][ T590] ? __kernfs_new_node+0x99/0x6e0 [ 120.817838][ T590] __should_failslab+0x9f/0xe0 [ 120.822682][ T590] should_failslab+0x9/0x20 [ 120.827173][ T590] __kmalloc_track_caller+0x5f/0x350 [ 120.832442][ T590] kstrdup_const+0x55/0x90 [ 120.836852][ T590] __kernfs_new_node+0x99/0x6e0 [ 120.841688][ T590] ? is_module_text_address+0xe1/0x140 [ 120.847125][ T590] ? kernfs_new_node+0x170/0x170 [ 120.852043][ T590] ? ptr_to_hashval+0x60/0x60 [ 120.856702][ T590] ? arch_stack_walk+0xf8/0x140 [ 120.861540][ T590] ? snprintf+0xd6/0x120 [ 120.865767][ T590] kernfs_new_node+0x97/0x170 [ 120.870426][ T590] __kernfs_create_file+0x4a/0x270 [ 120.875517][ T590] cgroup_addrm_files+0xab8/0xfe0 [ 120.880522][ T590] ? ____kasan_kmalloc+0xdc/0x110 [ 120.885526][ T590] ? __kasan_kmalloc+0x9/0x10 [ 120.890187][ T590] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 120.895717][ T590] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 120.901852][ T590] ? delete_node+0x759/0x7b0 [ 120.906435][ T590] ? __kasan_check_read+0x11/0x20 [ 120.911436][ T590] ? delete_node+0x759/0x7b0 [ 120.916004][ T590] ? __kasan_check_write+0x14/0x20 [ 120.921103][ T590] ? idr_replace+0x1c4/0x230 [ 120.925674][ T590] ? idr_get_next+0x4b0/0x4b0 [ 120.930755][ T590] ? _raw_spin_lock_bh+0xa3/0x1b0 [ 120.935759][ T590] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 120.940936][ T590] css_populate_dir+0x137/0x370 [ 120.945768][ T590] cgroup_apply_control_enable+0x8b9/0x12f0 [ 120.951638][ T590] cgroup_apply_control+0x93/0x710 [ 120.956730][ T590] ? css_next_child+0x160/0x160 [ 120.961559][ T590] ? stack_trace_save+0x12d/0x1f0 [ 120.966563][ T590] ? io_schedule+0x120/0x120 [ 120.971140][ T590] ? kernfs_fop_write_iter+0x15e/0x410 [ 120.976577][ T590] ? __kasan_check_write+0x14/0x20 [ 120.981671][ T590] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 120.986934][ T590] cgroup_subtree_control_write+0xd19/0x1310 [ 120.992891][ T590] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 120.998856][ T590] ? __kasan_check_write+0x14/0x20 [ 121.003946][ T590] ? _copy_from_iter+0x3fb/0xd60 [ 121.008860][ T590] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 121.014816][ T590] cgroup_file_write+0x28e/0x590 [ 121.019731][ T590] ? cgroup_seqfile_stop+0xc0/0xc0 [ 121.024823][ T590] ? mutex_lock+0xa6/0x110 [ 121.029698][ T590] ? mutex_trylock+0xb0/0xb0 [ 121.034266][ T590] ? __kasan_check_write+0x14/0x20 [ 121.039356][ T590] kernfs_fop_write_iter+0x2d0/0x410 [ 121.044620][ T590] ? cgroup_seqfile_stop+0xc0/0xc0 [ 121.049714][ T590] vfs_write+0xc1c/0xf40 [ 121.053937][ T590] ? __kasan_check_write+0x14/0x20 [ 121.059041][ T590] ? kernel_write+0x3c0/0x3c0 [ 121.063701][ T590] ? _raw_spin_unlock_irq+0x4e/0x70 [ 121.068892][ T590] ? ptrace_stop+0x6ff/0x9f0 [ 121.073468][ T590] ? __kasan_check_read+0x11/0x20 [ 121.078474][ T590] ? __fdget_pos+0x27e/0x310 [ 121.083044][ T590] ksys_write+0x198/0x2c0 [ 121.087361][ T590] ? do_notify_parent+0xa60/0xa60 [ 121.092368][ T590] ? __ia32_sys_read+0x90/0x90 [ 121.097116][ T590] ? __ia32_sys_open+0x270/0x270 [ 121.102036][ T590] __x64_sys_write+0x7b/0x90 [ 121.106608][ T590] do_syscall_64+0x34/0x70 [ 121.111003][ T590] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 121.116876][ T590] RIP: 0033:0x7fc8ece62c09 [ 121.121276][ T590] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 121.141296][ T590] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 592] write(4, "+pids ", 6 [pid 590] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 590] close(3) = 0 [pid 590] close(4) = 0 [pid 590] close(5) = 0 [pid 590] close(6) = -1 EBADF (Bad file descriptor) [pid 590] close(7) = -1 EBADF (Bad file descriptor) [pid 590] close(8) = -1 EBADF (Bad file descriptor) [pid 590] close(9) = -1 EBADF (Bad file descriptor) [pid 590] close(10) = -1 EBADF (Bad file descriptor) [pid 590] close(11) = -1 EBADF (Bad file descriptor) [pid 590] close(12) = -1 EBADF (Bad file descriptor) [pid 590] close(13) = -1 EBADF (Bad file descriptor) [pid 590] close(14) = -1 EBADF (Bad file descriptor) [pid 590] close(15) = -1 EBADF (Bad file descriptor) [pid 590] close(16) = -1 EBADF (Bad file descriptor) [pid 590] close(17) = -1 EBADF (Bad file descriptor) [pid 590] close(18) = -1 EBADF (Bad file descriptor) [pid 590] close(19) = -1 EBADF (Bad file descriptor) [pid 590] close(20) = -1 EBADF (Bad file descriptor) [pid 590] close(21) = -1 EBADF (Bad file descriptor) [pid 590] close(22) = -1 EBADF (Bad file descriptor) [pid 590] close(23) = -1 EBADF (Bad file descriptor) [pid 590] close(24) = -1 EBADF (Bad file descriptor) [pid 590] close(25) = -1 EBADF (Bad file descriptor) [pid 590] close(26) = -1 EBADF (Bad file descriptor) [pid 590] close(27) = -1 EBADF (Bad file descriptor) [pid 590] close(28) = -1 EBADF (Bad file descriptor) [pid 590] close(29) = -1 EBADF (Bad file descriptor) [pid 590] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory ) = 89 [pid 590] exit_group(0) = ? [pid 590] +++ exited with 0 +++ [pid 375] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=38, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 375] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 375] umount2("./36", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] openat(AT_FDCWD, "./36", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 375] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 375] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 375] umount2("./36/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 121.149692][ T590] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 121.157644][ T590] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 121.165595][ T590] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 121.173544][ T590] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 121.181493][ T590] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000024 [ 121.190110][ T590] cgroup: cgroup_addrm_files: failed to add max, err=-12 [pid 375] lstat("./36/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 589] <... write resumed>) = 6 [pid 375] unlink("./36/binderfs") = 0 [pid 375] umount2("./36/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./36/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 375] unlink("./36/cgroup") = 0 [pid 375] umount2("./36/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./36/cgroup.net", [pid 589] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 375] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 375] unlink("./36/cgroup.net") = 0 [pid 375] umount2("./36/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 589] <... openat resumed>) = 5 [pid 589] write(5, "22", 2) = 2 [ 121.220528][ T588] FAULT_INJECTION: forcing a failure. [ 121.220528][ T588] name failslab, interval 1, probability 0, space 0, times 0 [ 121.233267][ T588] CPU: 0 PID: 588 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 121.244883][ T588] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 121.254916][ T588] Call Trace: [ 121.258186][ T588] dump_stack_lvl+0x1e2/0x24b [ 121.262853][ T588] ? bfq_pos_tree_add_move+0x43e/0x43e [ 121.268302][ T588] ? selinux_kernfs_init_security+0x1a8/0x760 [ 121.274347][ T588] dump_stack+0x15/0x17 [ 121.278481][ T588] should_fail+0x3c0/0x510 [ 121.283014][ T588] ? __kernfs_new_node+0x99/0x6e0 [ 121.288028][ T588] __should_failslab+0x9f/0xe0 [ 121.292784][ T588] should_failslab+0x9/0x20 [ 121.297267][ T588] __kmalloc_track_caller+0x5f/0x350 [ 121.302528][ T588] kstrdup_const+0x55/0x90 [ 121.306922][ T588] __kernfs_new_node+0x99/0x6e0 [ 121.311752][ T588] ? is_module_text_address+0xe1/0x140 [ 121.317195][ T588] ? kernfs_new_node+0x170/0x170 [ 121.322114][ T588] ? ptr_to_hashval+0x60/0x60 [ 121.326777][ T588] ? arch_stack_walk+0xf8/0x140 [ 121.331611][ T588] ? snprintf+0xd6/0x120 [ 121.335836][ T588] kernfs_new_node+0x97/0x170 [ 121.340488][ T588] __kernfs_create_file+0x4a/0x270 [ 121.345575][ T588] cgroup_addrm_files+0xab8/0xfe0 [ 121.350584][ T588] ? ____kasan_kmalloc+0xdc/0x110 [ 121.355591][ T588] ? __kasan_kmalloc+0x9/0x10 [ 121.360251][ T588] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 121.365773][ T588] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 121.371910][ T588] ? delete_node+0x759/0x7b0 [ 121.376490][ T588] ? __kasan_check_read+0x11/0x20 [ 121.381491][ T588] ? delete_node+0x759/0x7b0 [ 121.386056][ T588] ? __kasan_check_write+0x14/0x20 [ 121.391148][ T588] ? idr_replace+0x1c4/0x230 [ 121.395712][ T588] ? idr_get_next+0x4b0/0x4b0 [ 121.400362][ T588] ? _raw_spin_lock_bh+0xa3/0x1b0 [ 121.405628][ T588] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 121.410809][ T588] css_populate_dir+0x137/0x370 [ 121.415650][ T588] cgroup_apply_control_enable+0x8b9/0x12f0 [ 121.421531][ T588] cgroup_apply_control+0x93/0x710 [ 121.426626][ T588] ? css_next_child+0x160/0x160 [ 121.431456][ T588] ? io_schedule+0x120/0x120 [ 121.436021][ T588] ? kernfs_fop_write_iter+0x15e/0x410 [ 121.441469][ T588] ? __kasan_check_write+0x14/0x20 [ 121.446564][ T588] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 121.451828][ T588] cgroup_subtree_control_write+0xd19/0x1310 [ 121.457790][ T588] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 121.463748][ T588] ? __kasan_check_write+0x14/0x20 [ 121.468843][ T588] ? _copy_from_iter+0x3fb/0xd60 [ 121.473768][ T588] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 121.479725][ T588] cgroup_file_write+0x28e/0x590 [ 121.484641][ T588] ? cgroup_seqfile_stop+0xc0/0xc0 [ 121.489730][ T588] ? mutex_lock+0xa6/0x110 [ 121.494126][ T588] ? mutex_trylock+0xb0/0xb0 [ 121.498703][ T588] ? __kasan_check_write+0x14/0x20 [ 121.503798][ T588] kernfs_fop_write_iter+0x2d0/0x410 [ 121.509091][ T588] ? cgroup_seqfile_stop+0xc0/0xc0 [ 121.514189][ T588] vfs_write+0xc1c/0xf40 [ 121.518414][ T588] ? __kasan_check_write+0x14/0x20 [ 121.523509][ T588] ? kernel_write+0x3c0/0x3c0 [ 121.528164][ T588] ? _raw_spin_unlock_irq+0x4e/0x70 [ 121.533350][ T588] ? ptrace_stop+0x6ff/0x9f0 [ 121.537927][ T588] ? __kasan_check_read+0x11/0x20 [ 121.542926][ T588] ? __fdget_pos+0x27e/0x310 [ 121.547490][ T588] ksys_write+0x198/0x2c0 [ 121.551803][ T588] ? do_notify_parent+0xa60/0xa60 [ 121.556801][ T588] ? __ia32_sys_read+0x90/0x90 [ 121.561546][ T588] ? __ia32_sys_open+0x270/0x270 [ 121.566470][ T588] __x64_sys_write+0x7b/0x90 [ 121.571042][ T588] do_syscall_64+0x34/0x70 [ 121.575447][ T588] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 121.581313][ T588] RIP: 0033:0x7fc8ece62c09 [ 121.585713][ T588] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 121.605304][ T588] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 121.613701][ T588] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 121.621659][ T588] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 121.629605][ T588] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 121.637905][ T588] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 121.645862][ T588] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 000000000000001e [ 121.654003][ T588] cgroup: cgroup_addrm_files: failed to add max, err=-12 [ 121.654286][ T375] ------------[ cut here ]------------ [ 121.666490][ T375] WARNING: CPU: 1 PID: 375 at fs/namespace.c:1168 mntput_no_expire+0x48a/0x6c0 [ 121.675408][ T375] Modules linked in: [ 121.679292][ T375] CPU: 1 PID: 375 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 121.690917][ T375] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 121.700976][ T375] RIP: 0010:mntput_no_expire+0x48a/0x6c0 [ 121.706587][ T375] Code: 48 c7 c2 80 02 44 86 e8 64 f0 8e ff e9 8b fc ff ff e8 ba 21 b6 ff e9 81 fc ff ff e8 b0 21 b6 ff e9 77 fc ff ff e8 a6 21 b6 ff <0f> 0b e9 f4 fc ff ff e8 9a 21 b6 ff e8 65 ad a2 ff e9 ea fc ff ff [ 121.726193][ T375] RSP: 0018:ffffc9000095fca0 EFLAGS: 00010293 [ 121.732267][ T375] RAX: ffffffff81b68f1a RBX: 00000000ffffffff RCX: ffff8881065e13c0 [ 121.740248][ T375] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000 [ 121.748218][ T375] RBP: ffffc9000095fd70 R08: ffffffff81b68c08 R09: 0000000000000003 [ 121.756208][ T375] R10: fffff5200012bf85 R11: 1ffff9200012bf84 R12: dffffc0000000000 [ 121.764182][ T375] R13: ffff888116a96000 R14: ffffc9000095fd00 R15: 1ffff9200012bf9c [pid 589] write(4, "+pids ", 6write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory [pid 588] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 588] close(3) = 0 [pid 588] close(4) = 0 [pid 588] close(5) = 0 [pid 588] close(6) = -1 EBADF (Bad file descriptor) [pid 588] close(7) = -1 EBADF (Bad file descriptor) [pid 588] close(8) = -1 EBADF (Bad file descriptor) [pid 588] close(9) = -1 EBADF (Bad file descriptor) [pid 588] close(10) = -1 EBADF (Bad file descriptor) [pid 588] close(11) = -1 EBADF (Bad file descriptor) [pid 588] close(12) = -1 EBADF (Bad file descriptor) [pid 588] close(13) = -1 EBADF (Bad file descriptor) [pid 588] close(14) = -1 EBADF (Bad file descriptor) [pid 588] close(15) = -1 EBADF (Bad file descriptor) [pid 588] close(16) = -1 EBADF (Bad file descriptor) [pid 588] close(17) = -1 EBADF (Bad file descriptor) [pid 588] close(18) = -1 EBADF (Bad file descriptor) [pid 588] close(19) = -1 EBADF (Bad file descriptor) [pid 588] close(20) = -1 EBADF (Bad file descriptor) [pid 588] close(21) = -1 EBADF (Bad file descriptor) [pid 588] close(22) = -1 EBADF (Bad file descriptor) [pid 588] close(23) = -1 EBADF (Bad file descriptor) [pid 588] close(24) = -1 EBADF (Bad file descriptor) [pid 588] close(25) = -1 EBADF (Bad file descriptor) [pid 588] close(26) = -1 EBADF (Bad file descriptor) [pid 588] close(27) = -1 EBADF (Bad file descriptor) [pid 588] close(28) = -1 EBADF (Bad file descriptor) [pid 588] close(29) = -1 EBADF (Bad file descriptor) [pid 588] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 588] exit_group(0) = ? [pid 588] +++ exited with 0 +++ [pid 380] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=32, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [ 121.772152][ T375] FS: 0000555556fab300(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 121.781088][ T375] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 121.787656][ T375] CR2: 00007fc8ece1cc86 CR3: 000000011dd54000 CR4: 00000000003506a0 [ 121.795629][ T375] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 121.803597][ T375] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 121.811696][ T375] Call Trace: [ 121.814975][ T375] ? lockref_get_or_lock+0x340/0x340 [ 121.820257][ T375] ? umount_tree+0xf50/0xf50 [ 121.824909][ T375] ? vfs_submount+0xb0/0xb0 [ 121.829397][ T375] ? dput+0x2b6/0x320 [ 121.833379][ T375] path_umount+0x1fe/0xfb0 [ 121.837779][ T375] ? namespace_unlock+0x4f0/0x4f0 [ 121.842817][ T375] ? user_path_at_empty+0x40/0x50 [ 121.847820][ T375] __x64_sys_umount+0x122/0x170 [ 121.852669][ T375] ? path_umount+0xfb0/0xfb0 [ 121.857249][ T375] ? syscall_enter_from_user_mode+0x58/0x1b0 [ 121.863220][ T375] do_syscall_64+0x34/0x70 [ 121.867622][ T375] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 121.873515][ T375] RIP: 0033:0x7fc8ece63fb7 [ 121.877915][ T375] Code: 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 121.897511][ T375] RSP: 002b:00007ffd7d0e2358 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [ 121.905918][ T375] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc8ece63fb7 [ 121.913883][ T375] RDX: 00007ffd7d0e241a RSI: 000000000000000a RDI: 00007ffd7d0e2410 [pid 380] umount2("./30", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] <... umount2 resumed>) = 0 [pid 375] umount2("./36/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 380] openat(AT_FDCWD, "./30", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 375] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 380] <... openat resumed>) = 3 [pid 380] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 380] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 380] umount2("./30/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./30/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 380] unlink("./30/binderfs") = 0 [pid 380] umount2("./30/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW [pid 375] lstat("./36/file0", [pid 380] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 380] lstat("./30/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 380] unlink("./30/cgroup") = 0 [pid 380] umount2("./30/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./30/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 380] unlink("./30/cgroup.net") = 0 [pid 380] umount2("./30/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 380] umount2("./30/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 375] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 380] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 375] umount2("./36/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 380] lstat("./30/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 380] umount2("./30/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] openat(AT_FDCWD, "./30/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 380] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 380] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 380] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 380] close(4) = 0 [pid 380] rmdir("./30/file0" [pid 375] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 375] openat(AT_FDCWD, "./36/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 380] <... rmdir resumed>) = 0 [pid 380] umount2("./30/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./30/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 380] unlink("./30/cgroup.cpu") = 0 [pid 380] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 380] close(3) = 0 [pid 380] rmdir("./30" [pid 375] <... openat resumed>) = 4 [pid 380] <... rmdir resumed>) = 0 [pid 375] fstat(4, [pid 380] mkdir("./31", 0777 [pid 375] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 375] getdents64(4, [pid 380] <... mkdir resumed>) = 0 [pid 380] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 375] <... getdents64 resumed>0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 375] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 380] <... clone resumed>, child_tidptr=0x555556fab5d0) = 33 ./strace-static-x86_64: Process 593 attached [pid 593] chdir("./31" [pid 375] close(4 [pid 593] <... chdir resumed>) = 0 [pid 593] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 593] setpgid(0, 0) = 0 [pid 593] symlink("/syzcgroup/unified/syz2", "./cgroup" [pid 375] <... close resumed>) = 0 [pid 593] <... symlink resumed>) = 0 [pid 593] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 593] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 375] rmdir("./36/file0" [pid 593] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 593] write(3, "1000", 4) = 4 [pid 593] close(3) = 0 [pid 593] symlink("/dev/binderfs", "./binderfs") = 0 [pid 593] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 593] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 375] <... rmdir resumed>) = 0 [pid 593] <... mount resumed>) = 0 [pid 593] open("./file0", O_RDONLY) = 3 [pid 593] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [ 121.921847][ T375] RBP: 00007ffd7d0e2410 R08: 00000000ffffffff R09: 00007ffd7d0e21f0 [ 121.929800][ T375] R10: 0000555556fad6a3 R11: 0000000000000202 R12: 00007ffd7d0e3490 [ 121.937772][ T375] R13: 0000555556fad600 R14: 00007ffd7d0e2380 R15: 0000000000000025 [ 121.945735][ T375] ---[ end trace d4de1ca9cdcd197e ]--- [ 121.965819][ T589] FAULT_INJECTION: forcing a failure. [pid 593] write(4, "-pids ", 6 [pid 375] umount2("./36/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./36/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 375] unlink("./36/cgroup.cpu") = 0 [pid 375] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 375] close(3) = 0 [pid 375] rmdir("./36") = 0 [pid 375] mkdir("./37", 0777) = 0 [pid 375] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 594 attached [pid 594] chdir("./37" [pid 375] <... clone resumed>, child_tidptr=0x555556fab5d0) = 39 [pid 594] <... chdir resumed>) = 0 [pid 594] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 594] setpgid(0, 0) = 0 [pid 594] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 594] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 594] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 594] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 594] write(3, "1000", 4) = 4 [pid 594] close(3) = 0 [pid 594] symlink("/dev/binderfs", "./binderfs") = 0 [pid 594] mkdirat(AT_FDCWD, "./file0", 000) = 0 [ 121.965819][ T589] name failslab, interval 1, probability 0, space 0, times 0 [ 121.978802][ T589] CPU: 1 PID: 589 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 121.990436][ T589] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 122.000468][ T589] Call Trace: [ 122.003744][ T589] dump_stack_lvl+0x1e2/0x24b [ 122.008407][ T589] ? panic+0x7d7/0x7d7 [ 122.012461][ T589] ? bfq_pos_tree_add_move+0x43e/0x43e [ 122.017898][ T589] ? find_next_bit+0xd6/0x120 [ 122.022550][ T589] ? cpumask_next+0x11/0x30 [ 122.027037][ T589] dump_stack+0x15/0x17 [ 122.031178][ T589] should_fail+0x3c0/0x510 [ 122.035662][ T589] ? percpu_ref_init+0xd0/0x330 [ 122.040489][ T589] __should_failslab+0x9f/0xe0 [ 122.045237][ T589] should_failslab+0x9/0x20 [ 122.049724][ T589] kmem_cache_alloc_trace+0x3a/0x330 [ 122.054983][ T589] percpu_ref_init+0xd0/0x330 [ 122.059632][ T589] ? cgroup_setup_root+0xea0/0xea0 [ 122.064719][ T589] cgroup_apply_control_enable+0x3a2/0x12f0 [ 122.070589][ T589] cgroup_apply_control+0x93/0x710 [ 122.075678][ T589] ? css_next_child+0x160/0x160 [ 122.080506][ T589] ? io_schedule+0x120/0x120 [ 122.085087][ T589] ? kernfs_fop_write_iter+0x15e/0x410 [ 122.090535][ T589] ? __kasan_check_write+0x14/0x20 [ 122.095621][ T589] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 122.100880][ T589] cgroup_subtree_control_write+0xd19/0x1310 [ 122.106844][ T589] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 122.112808][ T589] ? __kasan_check_write+0x14/0x20 [ 122.117893][ T589] ? _copy_from_iter+0x3fb/0xd60 [pid 594] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 381] kill(-35, SIGKILL) = 0 [pid 381] kill(35, SIGKILL) = 0 [ 122.122804][ T589] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 122.129105][ T589] cgroup_file_write+0x28e/0x590 [ 122.134034][ T589] ? cgroup_seqfile_stop+0xc0/0xc0 [ 122.139139][ T589] ? mutex_lock+0xa6/0x110 [ 122.143540][ T589] ? mutex_trylock+0xb0/0xb0 [ 122.148113][ T589] ? __kasan_check_write+0x14/0x20 [ 122.153305][ T589] kernfs_fop_write_iter+0x2d0/0x410 [ 122.158579][ T589] ? cgroup_seqfile_stop+0xc0/0xc0 [ 122.163675][ T589] vfs_write+0xc1c/0xf40 [ 122.167898][ T589] ? __kasan_check_write+0x14/0x20 [ 122.172989][ T589] ? kernel_write+0x3c0/0x3c0 [ 122.177654][ T589] ? _raw_spin_unlock_irq+0x4e/0x70 [ 122.182846][ T589] ? ptrace_stop+0x6ff/0x9f0 [ 122.187422][ T589] ? __kasan_check_read+0x11/0x20 [ 122.192514][ T589] ? __fdget_pos+0x27e/0x310 [ 122.197086][ T589] ksys_write+0x198/0x2c0 [ 122.201402][ T589] ? do_notify_parent+0xa60/0xa60 [ 122.206406][ T589] ? __ia32_sys_read+0x90/0x90 [ 122.211162][ T589] ? __ia32_sys_open+0x270/0x270 [ 122.216083][ T589] __x64_sys_write+0x7b/0x90 [ 122.220649][ T589] do_syscall_64+0x34/0x70 [ 122.225041][ T589] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 122.230904][ T589] RIP: 0033:0x7fc8ece62c09 [ 122.235295][ T589] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 122.254878][ T589] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 122.263281][ T589] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [pid 594] <... mount resumed>) = 0 [pid 589] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 594] open("./file0", O_RDONLY [pid 589] close(3 [pid 594] <... open resumed>) = 3 [pid 589] <... close resumed>) = 0 [pid 594] openat(3, "cgroup.subtree_control", O_RDWR [pid 589] close(4 [pid 594] <... openat resumed>) = 4 [pid 589] <... close resumed>) = 0 [pid 594] write(4, "-pids ", 6 [pid 589] close(5) = 0 [pid 589] close(6) = -1 EBADF (Bad file descriptor) [pid 589] close(7) = -1 EBADF (Bad file descriptor) [pid 589] close(8) = -1 EBADF (Bad file descriptor) [pid 589] close(9) = -1 EBADF (Bad file descriptor) [pid 589] close(10) = -1 EBADF (Bad file descriptor) [pid 589] close(11) = -1 EBADF (Bad file descriptor) [pid 589] close(12) = -1 EBADF (Bad file descriptor) [pid 589] close(13) = -1 EBADF (Bad file descriptor) [pid 589] close(14) = -1 EBADF (Bad file descriptor) [pid 589] close(15) = -1 EBADF (Bad file descriptor) [pid 589] close(16) = -1 EBADF (Bad file descriptor) [pid 589] close(17) = -1 EBADF (Bad file descriptor) [pid 589] close(18) = -1 EBADF (Bad file descriptor) [pid 589] close(19) = -1 EBADF (Bad file descriptor) [pid 589] close(20) = -1 EBADF (Bad file descriptor) [pid 589] close(21) = -1 EBADF (Bad file descriptor) [pid 589] close(22) = -1 EBADF (Bad file descriptor) [pid 589] close(23) = -1 EBADF (Bad file descriptor) [pid 589] close(24) = -1 EBADF (Bad file descriptor) [pid 589] close(25) = -1 EBADF (Bad file descriptor) [pid 589] close(26) = -1 EBADF (Bad file descriptor) [pid 589] close(27) = -1 EBADF (Bad file descriptor) [pid 589] close(28) = -1 EBADF (Bad file descriptor) [pid 589] close(29) = -1 EBADF (Bad file descriptor) write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory [pid 589] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 589] exit_group(0) = ? [pid 589] +++ exited with 0 +++ [pid 383] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=31, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 383] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 383] umount2("./29", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] openat(AT_FDCWD, "./29", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 383] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 383] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 383] umount2("./29/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./29/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 383] unlink("./29/binderfs") = 0 [pid 383] umount2("./29/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./29/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 383] unlink("./29/cgroup") = 0 [pid 383] umount2("./29/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./29/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 383] unlink("./29/cgroup.net") = 0 [pid 383] umount2("./29/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 383] umount2("./29/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./29/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 383] umount2("./29/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] openat(AT_FDCWD, "./29/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 383] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 383] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 383] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 383] close(4) = 0 [pid 383] rmdir("./29/file0") = 0 [pid 383] umount2("./29/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./29/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 383] unlink("./29/cgroup.cpu") = 0 [pid 383] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 383] close(3) = 0 [pid 383] rmdir("./29") = 0 [pid 383] mkdir("./30", 0777) = 0 [pid 383] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556fab5d0) = 32 ./strace-static-x86_64: Process 595 attached [pid 595] chdir("./30") = 0 [pid 595] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 595] setpgid(0, 0) = 0 [pid 595] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 595] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 595] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [pid 595] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 595] write(3, "1000", 4) = 4 [pid 595] close(3) = 0 [ 122.271233][ T589] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 122.279195][ T589] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 122.287153][ T589] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 122.295108][ T589] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 000000000000001d [pid 594] <... write resumed>) = 6 [pid 593] <... write resumed>) = 6 [pid 593] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 595] symlink("/dev/binderfs", "./binderfs" [pid 594] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 593] <... openat resumed>) = 5 [pid 594] <... openat resumed>) = 5 [pid 593] write(5, "22", 2 [pid 594] write(5, "22", 2 [pid 593] <... write resumed>) = 2 [pid 594] <... write resumed>) = 2 [pid 593] write(4, "+pids ", 6 [pid 595] <... symlink resumed>) = 0 [pid 594] write(4, "+pids ", 6 [pid 595] mkdirat(AT_FDCWD, "./file0", 000) = 0 [ 122.320526][ T583] FAULT_INJECTION: forcing a failure. [ 122.320526][ T583] name failslab, interval 1, probability 0, space 0, times 0 [ 122.334869][ T583] CPU: 0 PID: 583 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 122.346489][ T583] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 122.356522][ T583] Call Trace: [ 122.359797][ T583] dump_stack_lvl+0x1e2/0x24b [ 122.364450][ T583] ? panic+0x7d7/0x7d7 [ 122.368495][ T583] ? bfq_pos_tree_add_move+0x43e/0x43e [ 122.373929][ T583] ? find_next_bit+0xd6/0x120 [ 122.378580][ T583] ? cpumask_next+0x11/0x30 [ 122.383058][ T583] dump_stack+0x15/0x17 [ 122.387198][ T583] should_fail+0x3c0/0x510 [ 122.391602][ T583] ? percpu_ref_init+0xd0/0x330 [ 122.396426][ T583] __should_failslab+0x9f/0xe0 [ 122.401167][ T583] should_failslab+0x9/0x20 [ 122.405646][ T583] kmem_cache_alloc_trace+0x3a/0x330 [ 122.410905][ T583] percpu_ref_init+0xd0/0x330 [ 122.415565][ T583] ? cgroup_setup_root+0xea0/0xea0 [ 122.420674][ T583] cgroup_apply_control_enable+0x3a2/0x12f0 [ 122.426558][ T583] cgroup_apply_control+0x93/0x710 [ 122.431645][ T583] ? css_next_child+0x160/0x160 [ 122.436474][ T583] ? io_schedule+0x120/0x120 [ 122.441046][ T583] ? kernfs_fop_write_iter+0x15e/0x410 [ 122.446490][ T583] ? __kasan_check_write+0x14/0x20 [ 122.451605][ T583] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 122.456883][ T583] cgroup_subtree_control_write+0xd19/0x1310 [ 122.462836][ T583] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 122.468814][ T583] ? __kasan_check_write+0x14/0x20 [ 122.473936][ T583] ? _copy_from_iter+0x3fb/0xd60 [ 122.478863][ T583] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 122.484822][ T583] cgroup_file_write+0x28e/0x590 [ 122.489750][ T583] ? cgroup_seqfile_stop+0xc0/0xc0 [ 122.494855][ T583] ? mutex_lock+0xa6/0x110 [ 122.499263][ T583] ? mutex_trylock+0xb0/0xb0 [ 122.503839][ T583] ? __kasan_check_write+0x14/0x20 [ 122.508939][ T583] kernfs_fop_write_iter+0x2d0/0x410 [ 122.514211][ T583] ? cgroup_seqfile_stop+0xc0/0xc0 [ 122.519311][ T583] vfs_write+0xc1c/0xf40 [ 122.523542][ T583] ? __kasan_check_write+0x14/0x20 [ 122.528643][ T583] ? kernel_write+0x3c0/0x3c0 [ 122.533308][ T583] ? _raw_spin_unlock_irq+0x4e/0x70 [ 122.538485][ T583] ? ptrace_stop+0x6ff/0x9f0 [ 122.543054][ T583] ? __kasan_check_read+0x11/0x20 [ 122.548071][ T583] ? __fdget_pos+0x27e/0x310 [ 122.552654][ T583] ksys_write+0x198/0x2c0 [ 122.556968][ T583] ? do_notify_parent+0xa60/0xa60 [ 122.561978][ T583] ? __ia32_sys_read+0x90/0x90 [ 122.566716][ T583] ? __ia32_sys_open+0x270/0x270 [ 122.571803][ T583] __x64_sys_write+0x7b/0x90 [ 122.576379][ T583] do_syscall_64+0x34/0x70 [ 122.580786][ T583] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 122.586662][ T583] RIP: 0033:0x7fc8ece62c09 [ 122.591062][ T583] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 122.610642][ T583] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 595] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 583] <... write resumed>) = ? [pid 595] open("./file0", O_RDONLY [pid 583] +++ killed by SIGKILL +++ [pid 381] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=35, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=1} --- [pid 381] umount2("./33", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] openat(AT_FDCWD, "./33", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 595] <... open resumed>) = 3 [pid 595] openat(3, "cgroup.subtree_control", O_RDWR [pid 381] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 381] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 381] umount2("./33/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./33/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 381] unlink("./33/binderfs") = 0 [pid 381] umount2("./33/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./33/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 381] unlink("./33/cgroup" [pid 595] <... openat resumed>) = 4 [pid 595] write(4, "-pids ", 6 [pid 381] <... unlink resumed>) = 0 [pid 381] umount2("./33/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./33/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 381] unlink("./33/cgroup.net") = 0 [pid 381] umount2("./33/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 381] umount2("./33/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./33/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 381] umount2("./33/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] openat(AT_FDCWD, "./33/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 381] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 381] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 381] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 381] close(4) = 0 [pid 381] rmdir("./33/file0") = 0 [pid 381] umount2("./33/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./33/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 381] unlink("./33/cgroup.cpu") = 0 [pid 381] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 381] close(3) = 0 [pid 381] rmdir("./33") = 0 [pid 381] mkdir("./34", 0777) = 0 [pid 381] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556fab5d0) = 36 ./strace-static-x86_64: Process 596 attached [pid 596] chdir("./34") = 0 [pid 596] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 596] setpgid(0, 0) = 0 [pid 596] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [ 122.619035][ T583] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 122.626983][ T583] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 122.634942][ T583] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 122.642896][ T583] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 122.650848][ T583] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000021 [ 122.670682][ T594] FAULT_INJECTION: forcing a failure. [pid 596] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 596] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 596] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 596] write(3, "1000", 4) = 4 [pid 596] close(3) = 0 [pid 596] symlink("/dev/binderfs", "./binderfs") = 0 [pid 596] mkdirat(AT_FDCWD, "./file0", 000) = 0 [ 122.670682][ T594] name failslab, interval 1, probability 0, space 0, times 0 [ 122.683336][ T594] CPU: 0 PID: 594 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 122.694947][ T594] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 122.705017][ T594] Call Trace: [ 122.708290][ T594] dump_stack_lvl+0x1e2/0x24b [ 122.712947][ T594] ? bfq_pos_tree_add_move+0x43e/0x43e [ 122.718386][ T594] ? selinux_kernfs_init_security+0x1a8/0x760 [ 122.724566][ T594] dump_stack+0x15/0x17 [ 122.728699][ T594] should_fail+0x3c0/0x510 [ 122.733091][ T594] ? __kernfs_new_node+0x99/0x6e0 [ 122.738095][ T594] __should_failslab+0x9f/0xe0 [ 122.742838][ T594] should_failslab+0x9/0x20 [ 122.747448][ T594] __kmalloc_track_caller+0x5f/0x350 [ 122.752726][ T594] kstrdup_const+0x55/0x90 [ 122.757127][ T594] __kernfs_new_node+0x99/0x6e0 [ 122.761960][ T594] ? is_module_text_address+0xe1/0x140 [ 122.767417][ T594] ? kernfs_new_node+0x170/0x170 [ 122.772338][ T594] ? ptr_to_hashval+0x60/0x60 [ 122.777007][ T594] ? arch_stack_walk+0xf8/0x140 [ 122.781841][ T594] ? snprintf+0xd6/0x120 [ 122.786058][ T594] kernfs_new_node+0x97/0x170 [ 122.790709][ T594] __kernfs_create_file+0x4a/0x270 [ 122.795800][ T594] cgroup_addrm_files+0xab8/0xfe0 [ 122.800809][ T594] ? ____kasan_kmalloc+0xdc/0x110 [ 122.805807][ T594] ? __kasan_kmalloc+0x9/0x10 [ 122.810492][ T594] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 122.816027][ T594] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 122.822153][ T594] ? delete_node+0x759/0x7b0 [ 122.826717][ T594] ? __kasan_check_read+0x11/0x20 [ 122.831728][ T594] ? delete_node+0x759/0x7b0 [ 122.836312][ T594] ? __kasan_check_write+0x14/0x20 [ 122.841409][ T594] ? idr_replace+0x1c4/0x230 [ 122.845978][ T594] ? idr_get_next+0x4b0/0x4b0 [ 122.850631][ T594] ? _raw_spin_lock_bh+0xa3/0x1b0 [ 122.855636][ T594] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 122.860812][ T594] css_populate_dir+0x137/0x370 [ 122.865650][ T594] cgroup_apply_control_enable+0x8b9/0x12f0 [ 122.871540][ T594] cgroup_apply_control+0x93/0x710 [ 122.876638][ T594] ? css_next_child+0x160/0x160 [ 122.881465][ T594] ? io_schedule+0x120/0x120 [ 122.886040][ T594] ? kernfs_fop_write_iter+0x15e/0x410 [ 122.891493][ T594] ? __kasan_check_write+0x14/0x20 [ 122.896586][ T594] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 122.901847][ T594] cgroup_subtree_control_write+0xd19/0x1310 [ 122.907804][ T594] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 122.913758][ T594] ? __kasan_check_write+0x14/0x20 [ 122.918853][ T594] ? _copy_from_iter+0x3fb/0xd60 [ 122.923774][ T594] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 122.929728][ T594] cgroup_file_write+0x28e/0x590 [ 122.934641][ T594] ? cgroup_seqfile_stop+0xc0/0xc0 [ 122.939732][ T594] ? mutex_lock+0xa6/0x110 [ 122.944135][ T594] ? mutex_trylock+0xb0/0xb0 [ 122.948711][ T594] ? __kasan_check_write+0x14/0x20 [ 122.953800][ T594] kernfs_fop_write_iter+0x2d0/0x410 [ 122.959059][ T594] ? cgroup_seqfile_stop+0xc0/0xc0 [ 122.964148][ T594] vfs_write+0xc1c/0xf40 [ 122.968369][ T594] ? __kasan_check_write+0x14/0x20 [ 122.973465][ T594] ? kernel_write+0x3c0/0x3c0 [ 122.978128][ T594] ? _raw_spin_unlock_irq+0x4e/0x70 [ 122.983313][ T594] ? ptrace_stop+0x6ff/0x9f0 [ 122.987896][ T594] ? __kasan_check_read+0x11/0x20 [ 122.992925][ T594] ? __fdget_pos+0x27e/0x310 [ 122.997493][ T594] ksys_write+0x198/0x2c0 [ 123.001815][ T594] ? do_notify_parent+0xa60/0xa60 [ 123.006822][ T594] ? __ia32_sys_read+0x90/0x90 [ 123.011571][ T594] ? __ia32_sys_open+0x270/0x270 [ 123.016496][ T594] __x64_sys_write+0x7b/0x90 [ 123.021063][ T594] do_syscall_64+0x34/0x70 [ 123.025456][ T594] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 123.031327][ T594] RIP: 0033:0x7fc8ece62c09 [ 123.035717][ T594] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 123.055298][ T594] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 123.063692][ T594] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [pid 596] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 594] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 596] open("./file0", O_RDONLY [pid 594] close(3 [pid 596] <... open resumed>) = 3 [pid 596] openat(3, "cgroup.subtree_control", O_RDWR [pid 594] <... close resumed>) = 0 [pid 596] <... openat resumed>) = 4 [pid 594] close(4 [pid 596] write(4, "-pids ", 6 [pid 594] <... close resumed>) = 0 [pid 594] close(5) = 0 [pid 594] close(6) = -1 EBADF (Bad file descriptor) [pid 594] close(7) = -1 EBADF (Bad file descriptor) [pid 594] close(8) = -1 EBADF (Bad file descriptor) [pid 594] close(9) = -1 EBADF (Bad file descriptor) [pid 594] close(10) = -1 EBADF (Bad file descriptor) [pid 594] close(11) = -1 EBADF (Bad file descriptor) [pid 594] close(12) = -1 EBADF (Bad file descriptor) [pid 594] close(13) = -1 EBADF (Bad file descriptor) [pid 594] close(14) = -1 EBADF (Bad file descriptor) [pid 594] close(15) = -1 EBADF (Bad file descriptor) [pid 594] close(16) = -1 EBADF (Bad file descriptor) [pid 594] close(17) = -1 EBADF (Bad file descriptor) [pid 594] close(18) = -1 EBADF (Bad file descriptor) [pid 594] close(19) = -1 EBADF (Bad file descriptor) [pid 594] close(20) = -1 EBADF (Bad file descriptor) [pid 594] close(21) = -1 EBADF (Bad file descriptor) [pid 594] close(22) = -1 EBADF (Bad file descriptor) [pid 594] close(23) = -1 EBADF (Bad file descriptor) [pid 594] close(24) = -1 EBADF (Bad file descriptor) [pid 594] close(25) = -1 EBADF (Bad file descriptor) [pid 594] close(26) = -1 EBADF (Bad file descriptor) [pid 594] close(27) = -1 EBADF (Bad file descriptor) [pid 594] close(28) = -1 EBADF (Bad file descriptor) [pid 594] close(29) = -1 EBADF (Bad file descriptor) [pid 594] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory ) = 89 [pid 594] exit_group(0) = ? [pid 594] +++ exited with 0 +++ [pid 375] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=39, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 375] umount2("./37", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] openat(AT_FDCWD, "./37", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 375] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 375] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 375] umount2("./37/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./37/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 375] unlink("./37/binderfs") = 0 [pid 375] umount2("./37/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./37/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 375] unlink("./37/cgroup") = 0 [pid 375] umount2("./37/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./37/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 375] unlink("./37/cgroup.net") = 0 [ 123.071639][ T594] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 123.079595][ T594] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 123.087552][ T594] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 123.095501][ T594] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000025 [ 123.103805][ T594] cgroup: cgroup_addrm_files: failed to add max, err=-12 [ 123.133757][ T375] ------------[ cut here ]------------ [ 123.139269][ T375] WARNING: CPU: 0 PID: 375 at fs/namespace.c:1168 mntput_no_expire+0x48a/0x6c0 [ 123.148224][ T375] Modules linked in: [ 123.152125][ T375] CPU: 0 PID: 375 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 123.163753][ T375] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 123.173843][ T375] RIP: 0010:mntput_no_expire+0x48a/0x6c0 [ 123.179471][ T375] Code: 48 c7 c2 80 02 44 86 e8 64 f0 8e ff e9 8b fc ff ff e8 ba 21 b6 ff e9 81 fc ff ff e8 b0 21 b6 ff e9 77 fc ff ff e8 a6 21 b6 ff <0f> 0b e9 f4 fc ff ff e8 9a 21 b6 ff e8 65 ad a2 ff e9 ea fc ff ff [ 123.199173][ T375] RSP: 0018:ffffc9000095fba0 EFLAGS: 00010293 [ 123.205275][ T375] RAX: ffffffff81b68f1a RBX: 00000000ffffffff RCX: ffff8881065e13c0 [ 123.213298][ T375] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000 [ 123.221280][ T375] RBP: ffffc9000095fc70 R08: ffffffff81b68c08 R09: 0000000000000003 [ 123.229233][ T375] R10: fffff5200012bf65 R11: 1ffff9200012bf64 R12: dffffc0000000000 [ 123.237225][ T375] R13: ffff888116a97180 R14: ffffc9000095fc00 R15: 1ffff9200012bf7c [ 123.245225][ T375] FS: 0000555556fab300(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 123.254165][ T375] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 123.260753][ T375] CR2: 00007ffd7d0e1c18 CR3: 000000011dd54000 CR4: 00000000003506b0 [ 123.268716][ T375] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 123.276702][ T375] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 123.284677][ T375] Call Trace: [ 123.287951][ T375] ? io_schedule+0x120/0x120 [ 123.292546][ T375] ? vfs_submount+0xb0/0xb0 [ 123.297045][ T375] ? shrink_dentry_list+0x4ec/0x500 [ 123.302261][ T375] ? __kasan_check_write+0x14/0x20 [ 123.307365][ T375] namespace_unlock+0x448/0x4f0 [ 123.312225][ T375] ? umount_tree+0xf50/0xf50 [ 123.316818][ T375] ? __detach_mounts+0x670/0x670 [ 123.321768][ T375] ? selinux_umount+0xf0/0x130 [ 123.326534][ T375] ? security_sb_umount+0x9d/0xb0 [ 123.331576][ T375] path_umount+0xf03/0xfb0 [ 123.335988][ T375] ? namespace_unlock+0x4f0/0x4f0 [ 123.341034][ T375] ? user_path_at_empty+0x40/0x50 [ 123.346046][ T375] __x64_sys_umount+0x122/0x170 [ 123.350911][ T375] ? path_umount+0xfb0/0xfb0 [ 123.355497][ T375] ? syscall_enter_from_user_mode+0x58/0x1b0 [ 123.361484][ T375] do_syscall_64+0x34/0x70 [ 123.365914][ T375] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 123.371846][ T375] RIP: 0033:0x7fc8ece63fb7 [ 123.376257][ T375] Code: 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 123.395900][ T375] RSP: 002b:00007ffd7d0e2358 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [ 123.404327][ T375] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc8ece63fb7 [ 123.412312][ T375] RDX: 00007ffd7d0e241a RSI: 000000000000000a RDI: 00007ffd7d0e2410 [ 123.420299][ T375] RBP: 00007ffd7d0e2410 R08: 00000000ffffffff R09: 00007ffd7d0e21f0 [ 123.428261][ T375] R10: 0000555556fad6a3 R11: 0000000000000202 R12: 00007ffd7d0e3490 [ 123.436287][ T375] R13: 0000555556fad600 R14: 00007ffd7d0e2380 R15: 0000000000000026 [ 123.444278][ T375] ---[ end trace d4de1ca9cdcd197f ]--- [ 123.449890][ T375] ------------[ cut here ]------------ [ 123.449972][ T593] FAULT_INJECTION: forcing a failure. [ 123.449972][ T593] name failslab, interval 1, probability 0, space 0, times 0 [ 123.455385][ T375] WARNING: CPU: 0 PID: 375 at fs/namespace.c:1168 mntput_no_expire+0x48a/0x6c0 [ 123.455402][ T375] Modules linked in: [ 123.468689][ T593] CPU: 1 PID: 593 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 123.477011][ T375] [ 123.480864][ T593] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 123.480868][ T593] Call Trace: [ 123.480885][ T593] dump_stack_lvl+0x1e2/0x24b [ 123.480905][ T593] ? panic+0x7d7/0x7d7 [ 123.492689][ T375] CPU: 0 PID: 375 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 123.494974][ T593] ? bfq_pos_tree_add_move+0x43e/0x43e [ 123.505007][ T375] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 123.508264][ T593] ? find_next_bit+0xd6/0x120 [ 123.512931][ T375] RIP: 0010:mntput_no_expire+0x48a/0x6c0 [ 123.516961][ T593] ? cpumask_next+0x11/0x30 [ 123.528580][ T375] Code: 48 c7 c2 80 02 44 86 e8 64 f0 8e ff e9 8b fc ff ff e8 ba 21 b6 ff e9 81 fc ff ff e8 b0 21 b6 ff e9 77 fc ff ff e8 a6 21 b6 ff <0f> 0b e9 f4 fc ff ff e8 9a 21 b6 ff e8 65 ad a2 ff e9 ea fc ff ff [ 123.533982][ T593] dump_stack+0x15/0x17 [ 123.533998][ T593] should_fail+0x3c0/0x510 [ 123.544033][ T375] RSP: 0018:ffffc9000095fca0 EFLAGS: 00010293 [ 123.548677][ T593] ? percpu_ref_init+0xd0/0x330 [ 123.554299][ T375] [ 123.558754][ T593] __should_failslab+0x9f/0xe0 [ 123.578339][ T375] RAX: ffffffff81b68f1a RBX: 00000000fffffffe RCX: ffff8881065e13c0 [ 123.582453][ T593] should_failslab+0x9/0x20 [ 123.582470][ T593] kmem_cache_alloc_trace+0x3a/0x330 [ 123.586853][ T375] RDX: 0000000000000000 RSI: 00000000fffffffe RDI: 0000000000000000 [ 123.592888][ T593] percpu_ref_init+0xd0/0x330 [ 123.592898][ T593] ? cgroup_setup_root+0xea0/0xea0 [ 123.592915][ T593] cgroup_apply_control_enable+0x3a2/0x12f0 [ 123.597731][ T375] RBP: ffffc9000095fd70 R08: ffffffff81b68c08 R09: 0000000000000003 [ 123.600047][ T593] cgroup_apply_control+0x93/0x710 [ 123.604781][ T375] R10: fffff5200012bf85 R11: 1ffff9200012bf84 R12: dffffc0000000000 [ 123.612719][ T593] ? css_next_child+0x160/0x160 [ 123.612728][ T593] ? io_schedule+0x120/0x120 [ 123.612738][ T593] ? kernfs_fop_write_iter+0x15e/0x410 [ 123.612747][ T593] ? __kasan_check_write+0x14/0x20 [ 123.612756][ T593] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 123.612766][ T593] cgroup_subtree_control_write+0xd19/0x1310 [ 123.612782][ T593] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 123.617257][ T375] R13: ffff888116a97180 R14: ffffc9000095fd00 R15: 1ffff9200012bf9c [ 123.622508][ T593] ? __kasan_check_write+0x14/0x20 [ 123.622518][ T593] ? _copy_from_iter+0x3fb/0xd60 [ 123.622534][ T593] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 123.630489][ T375] FS: 0000555556fab300(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 123.635130][ T593] cgroup_file_write+0x28e/0x590 [ 123.640232][ T375] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 123.646089][ T593] ? cgroup_seqfile_stop+0xc0/0xc0 [ 123.654043][ T375] CR2: 00007ffd7d0e1c18 CR3: 000000011dd54000 CR4: 00000000003506b0 [ 123.659123][ T593] ? mutex_lock+0xa6/0x110 [ 123.667082][ T375] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 123.671888][ T593] ? mutex_trylock+0xb0/0xb0 [ 123.671898][ T593] ? __kasan_check_write+0x14/0x20 [ 123.671907][ T593] kernfs_fop_write_iter+0x2d0/0x410 [ 123.671922][ T593] ? cgroup_seqfile_stop+0xc0/0xc0 [ 123.676486][ T375] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 123.681907][ T593] vfs_write+0xc1c/0xf40 [ 123.681916][ T593] ? __kasan_check_write+0x14/0x20 [ 123.681931][ T593] ? kernel_write+0x3c0/0x3c0 [ 123.687007][ T375] Call Trace: [ 123.692263][ T593] ? _raw_spin_unlock_irq+0x4e/0x70 [ 123.692273][ T593] ? ptrace_stop+0x6ff/0x9f0 [ 123.692288][ T593] ? __kasan_check_read+0x11/0x20 [ 123.698241][ T375] ? lockref_get_or_lock+0x340/0x340 [ 123.704183][ T593] ? __fdget_pos+0x27e/0x310 [ 123.704193][ T593] ksys_write+0x198/0x2c0 [ 123.704210][ T593] ? do_notify_parent+0xa60/0xa60 [ 123.712162][ T375] ? umount_tree+0xf50/0xf50 [ 123.717236][ T593] ? __ia32_sys_read+0x90/0x90 [ 123.722151][ T375] ? vfs_submount+0xb0/0xb0 [ 123.728095][ T593] ? __ia32_sys_open+0x270/0x270 [ 123.737017][ T375] ? dput+0x2b6/0x320 [ 123.741911][ T593] __x64_sys_write+0x7b/0x90 [ 123.741928][ T593] do_syscall_64+0x34/0x70 [ 123.748486][ T375] path_umount+0x1fe/0xfb0 [ 123.753563][ T593] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 123.753572][ T593] RIP: 0033:0x7fc8ece62c09 [ 123.753588][ T593] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 123.761547][ T375] ? namespace_unlock+0x4f0/0x4f0 [ 123.765938][ T593] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 [ 123.773943][ T375] ? user_path_at_empty+0x40/0x50 [ 123.778462][ T593] ORIG_RAX: 0000000000000001 [ 123.783563][ T375] __x64_sys_umount+0x122/0x170 [ 123.788820][ T593] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 123.793963][ T375] ? path_umount+0xfb0/0xfb0 [ 123.801849][ T593] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 123.801857][ T593] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 123.801863][ T593] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 123.801869][ T593] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 000000000000001f [ 123.989690][ T375] ? syscall_enter_from_user_mode+0x58/0x1b0 [ 123.995668][ T375] do_syscall_64+0x34/0x70 [ 124.000081][ T375] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 124.005976][ T375] RIP: 0033:0x7fc8ece63fb7 [ 124.010393][ T375] Code: 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 375] umount2("./37/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 593] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 375] <... umount2 resumed>) = 0 [pid 593] close(3 [pid 375] umount2("./37/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 593] <... close resumed>) = 0 [pid 593] close(4 [pid 375] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 593] <... close resumed>) = 0 [pid 375] lstat("./37/file0", [pid 593] close(5) = 0 [pid 375] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 593] close(6 [pid 375] umount2("./37/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 593] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 593] close(7 [pid 375] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 593] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 375] openat(AT_FDCWD, "./37/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 593] close(8 [pid 375] <... openat resumed>) = 4 [pid 593] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 375] fstat(4, [pid 593] close(9) = -1 EBADF (Bad file descriptor) [pid 375] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 593] close(10) = -1 EBADF (Bad file descriptor) [pid 375] getdents64(4, [pid 593] close(11 [pid 375] <... getdents64 resumed>0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 593] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 375] getdents64(4, [pid 593] close(12) = -1 EBADF (Bad file descriptor) [pid 375] <... getdents64 resumed>0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 593] close(13) = -1 EBADF (Bad file descriptor) [pid 375] close(4 [pid 593] close(14) = -1 EBADF (Bad file descriptor) [pid 375] <... close resumed>) = 0 [pid 593] close(15) = -1 EBADF (Bad file descriptor) [pid 593] close(16) = -1 EBADF (Bad file descriptor) [pid 593] close(17) = -1 EBADF (Bad file descriptor) [pid 593] close(18) = -1 EBADF (Bad file descriptor) [pid 593] close(19) = -1 EBADF (Bad file descriptor) [pid 375] rmdir("./37/file0" [pid 593] close(20) = -1 EBADF (Bad file descriptor) [pid 593] close(21) = -1 EBADF (Bad file descriptor) [pid 593] close(22) = -1 EBADF (Bad file descriptor) [pid 593] close(23) = -1 EBADF (Bad file descriptor) [pid 593] close(24) = -1 EBADF (Bad file descriptor) [pid 593] close(25) = -1 EBADF (Bad file descriptor) [pid 593] close(26) = -1 EBADF (Bad file descriptor) [pid 593] close(27) = -1 EBADF (Bad file descriptor) [pid 593] close(28) = -1 EBADF (Bad file descriptor) [pid 593] close(29 [pid 375] <... rmdir resumed>) = 0 [pid 593] <... close resumed>) = -1 EBADF (Bad file descriptor) write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory [pid 593] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 593] exit_group(0) = ? [pid 593] +++ exited with 0 +++ [pid 375] umount2("./37/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./37/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 375] unlink("./37/cgroup.cpu") = 0 [pid 375] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 375] close(3) = 0 [pid 375] rmdir("./37") = 0 [pid 375] mkdir("./38", 0777) = 0 [pid 375] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556fab5d0) = 40 ./strace-static-x86_64: Process 597 attached [ 124.030085][ T375] RSP: 002b:00007ffd7d0e2358 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [ 124.038507][ T375] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc8ece63fb7 [ 124.046488][ T375] RDX: 00007ffd7d0e241a RSI: 000000000000000a RDI: 00007ffd7d0e2410 [ 124.054476][ T375] RBP: 00007ffd7d0e2410 R08: 00000000ffffffff R09: 00007ffd7d0e21f0 [ 124.062453][ T375] R10: 0000555556fad6a3 R11: 0000000000000202 R12: 00007ffd7d0e3490 [ 124.070416][ T375] R13: 0000555556fad600 R14: 00007ffd7d0e2380 R15: 0000000000000026 [ 124.078366][ T375] ---[ end trace d4de1ca9cdcd1980 ]--- [pid 597] chdir("./38") = 0 [pid 591] <... write resumed>) = 6 [pid 380] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=33, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 380] umount2("./31", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] openat(AT_FDCWD, "./31", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 380] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 380] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 380] umount2("./31/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./31/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 380] unlink("./31/binderfs") = 0 [pid 380] umount2("./31/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./31/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 380] unlink("./31/cgroup") = 0 [pid 380] umount2("./31/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./31/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 380] unlink("./31/cgroup.net") = 0 [pid 380] umount2("./31/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 597] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 597] setpgid(0, 0) = 0 [pid 597] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 597] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 597] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 597] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 597] write(3, "1000", 4) = 4 [pid 597] close(3) = 0 [pid 597] symlink("/dev/binderfs", "./binderfs") = 0 [pid 597] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 597] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 591] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 380] <... umount2 resumed>) = 0 [pid 380] umount2("./31/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./31/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 380] umount2("./31/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] openat(AT_FDCWD, "./31/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 380] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 380] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 380] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 380] close(4) = 0 [pid 380] rmdir("./31/file0") = 0 [pid 380] umount2("./31/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./31/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 380] unlink("./31/cgroup.cpu") = 0 [pid 380] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 380] close(3) = 0 [pid 380] rmdir("./31") = 0 [pid 380] mkdir("./32", 0777) = 0 [pid 380] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556fab5d0) = 34 ./strace-static-x86_64: Process 598 attached [pid 598] chdir("./32") = 0 [pid 598] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 598] setpgid(0, 0) = 0 [pid 598] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 598] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 598] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 598] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 598] write(3, "1000", 4) = 4 [pid 598] close(3) = 0 [pid 598] symlink("/dev/binderfs", "./binderfs") = 0 [pid 598] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 598] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 591] <... openat resumed>) = 5 [pid 591] write(5, "22", 2) = 2 [ 124.100586][ T592] FAULT_INJECTION: forcing a failure. [ 124.100586][ T592] name failslab, interval 1, probability 0, space 0, times 0 [ 124.113278][ T592] CPU: 0 PID: 592 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 124.124894][ T592] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 124.134934][ T592] Call Trace: [ 124.138213][ T592] dump_stack_lvl+0x1e2/0x24b [ 124.142881][ T592] ? panic+0x7d7/0x7d7 [ 124.146933][ T592] ? bfq_pos_tree_add_move+0x43e/0x43e [ 124.152363][ T592] ? find_next_bit+0xd6/0x120 [ 124.157020][ T592] ? cpumask_next+0x11/0x30 [ 124.161513][ T592] dump_stack+0x15/0x17 [ 124.165654][ T592] should_fail+0x3c0/0x510 [ 124.170055][ T592] ? percpu_ref_init+0xd0/0x330 [ 124.174877][ T592] __should_failslab+0x9f/0xe0 [ 124.179618][ T592] should_failslab+0x9/0x20 [ 124.184110][ T592] kmem_cache_alloc_trace+0x3a/0x330 [ 124.189374][ T592] percpu_ref_init+0xd0/0x330 [ 124.194028][ T592] ? cgroup_setup_root+0xea0/0xea0 [ 124.199120][ T592] cgroup_apply_control_enable+0x3a2/0x12f0 [ 124.204984][ T592] cgroup_apply_control+0x93/0x710 [ 124.210077][ T592] ? css_next_child+0x160/0x160 [ 124.214902][ T592] ? stack_trace_save+0x12d/0x1f0 [ 124.219927][ T592] ? io_schedule+0x120/0x120 [ 124.224501][ T592] ? kernfs_fop_write_iter+0x15e/0x410 [ 124.230298][ T592] ? __kasan_check_write+0x14/0x20 [ 124.235395][ T592] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 124.240671][ T592] cgroup_subtree_control_write+0xd19/0x1310 [ 124.246645][ T592] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 124.252619][ T592] ? __kasan_check_write+0x14/0x20 [ 124.257726][ T592] ? _copy_from_iter+0x3fb/0xd60 [ 124.262660][ T592] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 124.268631][ T592] cgroup_file_write+0x28e/0x590 [ 124.273566][ T592] ? cgroup_seqfile_stop+0xc0/0xc0 [ 124.278658][ T592] ? mutex_lock+0xa6/0x110 [ 124.283071][ T592] ? mutex_trylock+0xb0/0xb0 [ 124.287645][ T592] ? __kasan_check_write+0x14/0x20 [ 124.292728][ T592] kernfs_fop_write_iter+0x2d0/0x410 [ 124.297986][ T592] ? cgroup_seqfile_stop+0xc0/0xc0 [ 124.303081][ T592] vfs_write+0xc1c/0xf40 [ 124.307311][ T592] ? __kasan_check_write+0x14/0x20 [ 124.312405][ T592] ? kernel_write+0x3c0/0x3c0 [ 124.317060][ T592] ? _raw_spin_unlock_irq+0x4e/0x70 [ 124.322244][ T592] ? ptrace_stop+0x6ff/0x9f0 [ 124.326817][ T592] ? __kasan_check_read+0x11/0x20 [ 124.331817][ T592] ? __fdget_pos+0x27e/0x310 [ 124.336380][ T592] ksys_write+0x198/0x2c0 [ 124.340689][ T592] ? do_notify_parent+0xa60/0xa60 [ 124.345738][ T592] ? __ia32_sys_read+0x90/0x90 [ 124.350487][ T592] ? __ia32_sys_open+0x270/0x270 [ 124.355407][ T592] __x64_sys_write+0x7b/0x90 [ 124.359978][ T592] do_syscall_64+0x34/0x70 [ 124.364372][ T592] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 124.370242][ T592] RIP: 0033:0x7fc8ece62c09 [ 124.374640][ T592] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 591] write(4, "+pids ", 6 [pid 598] <... mount resumed>) = 0 [pid 597] <... mount resumed>) = 0 [pid 592] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 598] open("./file0", O_RDONLY) = 3 [pid 592] close(3 [pid 598] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [pid 592] <... close resumed>) = 0 [pid 598] write(4, "-pids ", 6 [pid 592] close(4) = 0 [pid 592] close(5) = 0 [pid 592] close(6) = -1 EBADF (Bad file descriptor) [pid 592] close(7) = -1 EBADF (Bad file descriptor) [pid 592] close(8) = -1 EBADF (Bad file descriptor) [pid 592] close(9) = -1 EBADF (Bad file descriptor) [pid 592] close(10) = -1 EBADF (Bad file descriptor) [pid 592] close(11) = -1 EBADF (Bad file descriptor) [pid 592] close(12) = -1 EBADF (Bad file descriptor) [pid 592] close(13) = -1 EBADF (Bad file descriptor) [pid 592] close(14) = -1 EBADF (Bad file descriptor) [pid 592] close(15) = -1 EBADF (Bad file descriptor) [pid 592] close(16) = -1 EBADF (Bad file descriptor) [pid 592] close(17) = -1 EBADF (Bad file descriptor) [pid 592] close(18) = -1 EBADF (Bad file descriptor) [pid 592] close(19) = -1 EBADF (Bad file descriptor) [pid 592] close(20) = -1 EBADF (Bad file descriptor) [pid 592] close(21) = -1 EBADF (Bad file descriptor) [pid 592] close(22) = -1 EBADF (Bad file descriptor) [pid 592] close(23) = -1 EBADF (Bad file descriptor) [pid 592] close(24) = -1 EBADF (Bad file descriptor) [pid 592] close(25) = -1 EBADF (Bad file descriptor) [pid 592] close(26) = -1 EBADF (Bad file descriptor) [pid 592] close(27) = -1 EBADF (Bad file descriptor) [pid 592] close(28) = -1 EBADF (Bad file descriptor) [pid 592] close(29) = -1 EBADF (Bad file descriptor) [pid 592] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory ) = 89 [pid 592] exit_group(0) = ? [pid 597] open("./file0", O_RDONLY [pid 592] +++ exited with 0 +++ [pid 597] <... open resumed>) = 3 [pid 376] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=37, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 597] openat(3, "cgroup.subtree_control", O_RDWR [pid 376] restart_syscall(<... resuming interrupted clone ...> [pid 597] <... openat resumed>) = 4 [pid 376] <... restart_syscall resumed>) = 0 [pid 597] write(4, "-pids ", 6 [pid 376] umount2("./35", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] openat(AT_FDCWD, "./35", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 376] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 376] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 376] umount2("./35/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./35/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 376] unlink("./35/binderfs") = 0 [pid 376] umount2("./35/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./35/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 376] unlink("./35/cgroup") = 0 [pid 376] umount2("./35/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./35/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 376] unlink("./35/cgroup.net") = 0 [pid 376] umount2("./35/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 376] umount2("./35/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./35/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 376] umount2("./35/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] openat(AT_FDCWD, "./35/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 376] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 376] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 376] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 376] close(4) = 0 [pid 376] rmdir("./35/file0") = 0 [pid 376] umount2("./35/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./35/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 376] unlink("./35/cgroup.cpu") = 0 [pid 376] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 376] close(3) = 0 [pid 376] rmdir("./35") = 0 [pid 376] mkdir("./36", 0777) = 0 [pid 376] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 599 attached [pid 599] chdir("./36") = 0 [pid 599] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 599] setpgid(0, 0 [pid 376] <... clone resumed>, child_tidptr=0x555556fab5d0) = 38 [pid 599] <... setpgid resumed>) = 0 [pid 599] symlink("/syzcgroup/unified/syz1", "./cgroup") = 0 [pid 599] symlink("/syzcgroup/cpu/syz1", "./cgroup.cpu") = 0 [pid 599] symlink("/syzcgroup/net/syz1", "./cgroup.net") = 0 [pid 599] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 599] write(3, "1000", 4) = 4 [pid 599] close(3) = 0 [pid 599] symlink("/dev/binderfs", "./binderfs") = 0 [ 124.394225][ T592] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 124.402615][ T592] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 124.410562][ T592] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 124.418600][ T592] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 124.426547][ T592] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 124.434495][ T592] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000023 [pid 599] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 597] <... write resumed>) = 6 [pid 599] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 597] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 597] write(5, "22", 2) = 2 [ 124.460561][ T591] FAULT_INJECTION: forcing a failure. [ 124.460561][ T591] name failslab, interval 1, probability 0, space 0, times 0 [ 124.473299][ T591] CPU: 1 PID: 591 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 124.484994][ T591] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 124.495031][ T591] Call Trace: [ 124.498310][ T591] dump_stack_lvl+0x1e2/0x24b [ 124.502961][ T591] ? bfq_pos_tree_add_move+0x43e/0x43e [ 124.508411][ T591] ? selinux_kernfs_init_security+0x1a8/0x760 [ 124.514475][ T591] dump_stack+0x15/0x17 [ 124.518885][ T591] should_fail+0x3c0/0x510 [ 124.523295][ T591] ? __kernfs_new_node+0x99/0x6e0 [ 124.528691][ T591] __should_failslab+0x9f/0xe0 [ 124.533441][ T591] should_failslab+0x9/0x20 [ 124.537935][ T591] __kmalloc_track_caller+0x5f/0x350 [ 124.543288][ T591] kstrdup_const+0x55/0x90 [ 124.547676][ T591] __kernfs_new_node+0x99/0x6e0 [ 124.552508][ T591] ? is_module_text_address+0xe1/0x140 [ 124.557944][ T591] ? kernfs_new_node+0x170/0x170 [ 124.562861][ T591] ? ptr_to_hashval+0x60/0x60 [ 124.567523][ T591] ? arch_stack_walk+0xf8/0x140 [ 124.572355][ T591] ? snprintf+0xd6/0x120 [ 124.576568][ T591] kernfs_new_node+0x97/0x170 [ 124.581235][ T591] __kernfs_create_file+0x4a/0x270 [ 124.586326][ T591] cgroup_addrm_files+0xab8/0xfe0 [ 124.591323][ T591] ? ____kasan_kmalloc+0xdc/0x110 [ 124.596323][ T591] ? __kasan_kmalloc+0x9/0x10 [ 124.600983][ T591] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 124.606511][ T591] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 124.612647][ T591] ? delete_node+0x759/0x7b0 [ 124.617209][ T591] ? __kasan_check_read+0x11/0x20 [ 124.622203][ T591] ? delete_node+0x759/0x7b0 [ 124.626854][ T591] ? __kasan_check_write+0x14/0x20 [ 124.632277][ T591] ? idr_replace+0x1c4/0x230 [ 124.636850][ T591] ? idr_get_next+0x4b0/0x4b0 [ 124.641503][ T591] ? _raw_spin_lock_bh+0xa3/0x1b0 [ 124.646512][ T591] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 124.651693][ T591] css_populate_dir+0x137/0x370 [ 124.656521][ T591] cgroup_apply_control_enable+0x8b9/0x12f0 [ 124.662469][ T591] cgroup_apply_control+0x93/0x710 [ 124.667565][ T591] ? css_next_child+0x160/0x160 [ 124.672401][ T591] ? io_schedule+0x120/0x120 [ 124.676964][ T591] ? kernfs_fop_write_iter+0x15e/0x410 [ 124.682404][ T591] ? __kasan_check_write+0x14/0x20 [ 124.687497][ T591] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 124.692766][ T591] cgroup_subtree_control_write+0xd19/0x1310 [ 124.698738][ T591] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 124.704706][ T591] ? __kasan_check_write+0x14/0x20 [ 124.709800][ T591] ? _copy_from_iter+0x3fb/0xd60 [ 124.714722][ T591] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 124.720690][ T591] cgroup_file_write+0x28e/0x590 [ 124.725612][ T591] ? cgroup_seqfile_stop+0xc0/0xc0 [ 124.730709][ T591] ? mutex_lock+0xa6/0x110 [ 124.735102][ T591] ? mutex_trylock+0xb0/0xb0 [ 124.739669][ T591] ? __kasan_check_write+0x14/0x20 [ 124.744757][ T591] kernfs_fop_write_iter+0x2d0/0x410 [ 124.750023][ T591] ? cgroup_seqfile_stop+0xc0/0xc0 [ 124.755109][ T591] vfs_write+0xc1c/0xf40 [ 124.759330][ T591] ? __kasan_check_write+0x14/0x20 [ 124.764422][ T591] ? kernel_write+0x3c0/0x3c0 [ 124.769075][ T591] ? _raw_spin_unlock_irq+0x4e/0x70 [ 124.774343][ T591] ? ptrace_stop+0x6ff/0x9f0 [ 124.778909][ T591] ? __kasan_check_read+0x11/0x20 [ 124.783907][ T591] ? __fdget_pos+0x27e/0x310 [ 124.788471][ T591] ksys_write+0x198/0x2c0 [ 124.792775][ T591] ? do_notify_parent+0xa60/0xa60 [ 124.797778][ T591] ? __ia32_sys_read+0x90/0x90 [ 124.802521][ T591] ? __ia32_sys_open+0x270/0x270 [ 124.807430][ T591] __x64_sys_write+0x7b/0x90 [ 124.811991][ T591] do_syscall_64+0x34/0x70 [ 124.816384][ T591] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 124.822250][ T591] RIP: 0033:0x7fc8ece62c09 [ 124.826639][ T591] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 124.846657][ T591] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 597] write(4, "+pids ", 6 [pid 599] <... mount resumed>) = 0 [pid 591] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 599] open("./file0", O_RDONLY [pid 591] close(3 [pid 599] <... open resumed>) = 3 [pid 591] <... close resumed>) = 0 [pid 599] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [pid 591] close(4) = 0 [pid 591] close(5) = 0 [pid 591] close(6) = -1 EBADF (Bad file descriptor) [pid 591] close(7) = -1 EBADF (Bad file descriptor) [pid 591] close(8) = -1 EBADF (Bad file descriptor) [pid 591] close(9) = -1 EBADF (Bad file descriptor) [pid 591] close(10) = -1 EBADF (Bad file descriptor) [pid 591] close(11) = -1 EBADF (Bad file descriptor) [pid 591] close(12) = -1 EBADF (Bad file descriptor) [pid 591] close(13) = -1 EBADF (Bad file descriptor) [pid 591] close(14) = -1 EBADF (Bad file descriptor) [pid 591] close(15) = -1 EBADF (Bad file descriptor) [pid 599] write(4, "-pids ", 6 [pid 591] close(16) = -1 EBADF (Bad file descriptor) [pid 591] close(17) = -1 EBADF (Bad file descriptor) [pid 591] close(18) = -1 EBADF (Bad file descriptor) [pid 591] close(19) = -1 EBADF (Bad file descriptor) [pid 591] close(20) = -1 EBADF (Bad file descriptor) [pid 591] close(21) = -1 EBADF (Bad file descriptor) [pid 591] close(22) = -1 EBADF (Bad file descriptor) [pid 591] close(23) = -1 EBADF (Bad file descriptor) [pid 591] close(24) = -1 EBADF (Bad file descriptor) [pid 591] close(25) = -1 EBADF (Bad file descriptor) [pid 591] close(26) = -1 EBADF (Bad file descriptor) [pid 591] close(27) = -1 EBADF (Bad file descriptor) [pid 591] close(28) = -1 EBADF (Bad file descriptor) [pid 591] close(29) = -1 EBADF (Bad file descriptor) write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory [pid 591] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 591] exit_group(0) = ? [pid 591] +++ exited with 0 +++ [pid 382] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=40, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 382] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 382] umount2("./38", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] openat(AT_FDCWD, "./38", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 382] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 382] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 382] umount2("./38/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./38/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 382] unlink("./38/binderfs") = 0 [pid 382] umount2("./38/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./38/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 382] unlink("./38/cgroup") = 0 [pid 382] umount2("./38/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./38/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 382] unlink("./38/cgroup.net") = 0 [pid 382] umount2("./38/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 382] umount2("./38/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./38/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 382] umount2("./38/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] openat(AT_FDCWD, "./38/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 382] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 382] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [ 124.855056][ T591] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 124.863009][ T591] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 124.870962][ T591] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 124.878916][ T591] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 124.886868][ T591] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000026 [ 124.895913][ T591] cgroup: cgroup_addrm_files: failed to add max, err=-12 [pid 382] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 599] <... write resumed>) = 6 [pid 599] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 599] write(5, "22", 2) = 2 [pid 599] write(4, "+pids ", 6 [pid 382] close(4) = 0 [pid 382] rmdir("./38/file0") = 0 [pid 382] umount2("./38/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./38/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 382] unlink("./38/cgroup.cpu") = 0 [pid 382] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 382] close(3) = 0 [pid 382] rmdir("./38") = 0 [pid 382] mkdir("./39", 0777) = 0 [pid 382] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556fab5d0) = 41 ./strace-static-x86_64: Process 600 attached [pid 600] chdir("./39") = 0 [pid 600] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 600] setpgid(0, 0) = 0 [pid 600] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 600] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [pid 600] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 600] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 600] write(3, "1000", 4) = 4 [pid 600] close(3) = 0 [pid 600] symlink("/dev/binderfs", "./binderfs") = 0 [pid 600] mkdirat(AT_FDCWD, "./file0", 000) = 0 [ 124.921046][ T597] FAULT_INJECTION: forcing a failure. [ 124.921046][ T597] name failslab, interval 1, probability 0, space 0, times 0 [ 124.934207][ T597] CPU: 0 PID: 597 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 124.945820][ T597] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 124.955855][ T597] Call Trace: [ 124.959124][ T597] dump_stack_lvl+0x1e2/0x24b [ 124.963782][ T597] ? panic+0x7d7/0x7d7 [ 124.967839][ T597] ? bfq_pos_tree_add_move+0x43e/0x43e [ 124.973284][ T597] ? find_next_bit+0xd6/0x120 [ 124.977936][ T597] ? cpumask_next+0x11/0x30 [ 124.982424][ T597] dump_stack+0x15/0x17 [ 124.986568][ T597] should_fail+0x3c0/0x510 [ 124.990967][ T597] ? percpu_ref_init+0xd0/0x330 [ 124.995798][ T597] __should_failslab+0x9f/0xe0 [ 125.000541][ T597] should_failslab+0x9/0x20 [ 125.005018][ T597] kmem_cache_alloc_trace+0x3a/0x330 [ 125.010287][ T597] percpu_ref_init+0xd0/0x330 [ 125.014945][ T597] ? cgroup_setup_root+0xea0/0xea0 [ 125.020030][ T597] cgroup_apply_control_enable+0x3a2/0x12f0 [ 125.025897][ T597] cgroup_apply_control+0x93/0x710 [ 125.030991][ T597] ? css_next_child+0x160/0x160 [ 125.035835][ T597] ? stack_trace_save+0x12d/0x1f0 [ 125.040862][ T597] ? io_schedule+0x120/0x120 [ 125.045438][ T597] ? kernfs_fop_write_iter+0x15e/0x410 [ 125.050879][ T597] ? __kasan_check_write+0x14/0x20 [ 125.055967][ T597] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 125.061230][ T597] cgroup_subtree_control_write+0xd19/0x1310 [ 125.067206][ T597] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 125.073158][ T597] ? __kasan_check_write+0x14/0x20 [ 125.078242][ T597] ? _copy_from_iter+0x3fb/0xd60 [ 125.083183][ T597] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 125.089152][ T597] cgroup_file_write+0x28e/0x590 [ 125.094071][ T597] ? cgroup_seqfile_stop+0xc0/0xc0 [ 125.099158][ T597] ? mutex_lock+0xa6/0x110 [ 125.103554][ T597] ? mutex_trylock+0xb0/0xb0 [ 125.108117][ T597] ? __kasan_check_write+0x14/0x20 [ 125.113215][ T597] kernfs_fop_write_iter+0x2d0/0x410 [ 125.118471][ T597] ? cgroup_seqfile_stop+0xc0/0xc0 [ 125.123554][ T597] vfs_write+0xc1c/0xf40 [ 125.127778][ T597] ? __kasan_check_write+0x14/0x20 [ 125.132873][ T597] ? kernel_write+0x3c0/0x3c0 [ 125.137523][ T597] ? _raw_spin_unlock_irq+0x4e/0x70 [ 125.142702][ T597] ? ptrace_stop+0x6ff/0x9f0 [ 125.147270][ T597] ? __kasan_check_read+0x11/0x20 [ 125.152278][ T597] ? __fdget_pos+0x27e/0x310 [ 125.156844][ T597] ksys_write+0x198/0x2c0 [ 125.161148][ T597] ? do_notify_parent+0xa60/0xa60 [ 125.166152][ T597] ? __ia32_sys_read+0x90/0x90 [ 125.170896][ T597] ? __ia32_sys_open+0x270/0x270 [ 125.175813][ T597] __x64_sys_write+0x7b/0x90 [ 125.180374][ T597] do_syscall_64+0x34/0x70 [ 125.184763][ T597] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 125.190626][ T597] RIP: 0033:0x7fc8ece62c09 [ 125.195014][ T597] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 600] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 597] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 600] open("./file0", O_RDONLY [pid 597] close(3 [pid 600] <... open resumed>) = 3 [pid 597] <... close resumed>) = 0 [pid 600] openat(3, "cgroup.subtree_control", O_RDWR [pid 597] close(4 [pid 600] <... openat resumed>) = 4 [pid 597] <... close resumed>) = 0 [pid 600] write(4, "-pids ", 6 [pid 597] close(5) = 0 [pid 597] close(6) = -1 EBADF (Bad file descriptor) [pid 597] close(7) = -1 EBADF (Bad file descriptor) [pid 597] close(8) = -1 EBADF (Bad file descriptor) [pid 597] close(9) = -1 EBADF (Bad file descriptor) [pid 597] close(10) = -1 EBADF (Bad file descriptor) [pid 597] close(11) = -1 EBADF (Bad file descriptor) [pid 597] close(12) = -1 EBADF (Bad file descriptor) [pid 597] close(13) = -1 EBADF (Bad file descriptor) [pid 597] close(14) = -1 EBADF (Bad file descriptor) [pid 597] close(15) = -1 EBADF (Bad file descriptor) [pid 597] close(16) = -1 EBADF (Bad file descriptor) [pid 597] close(17) = -1 EBADF (Bad file descriptor) [pid 597] close(18) = -1 EBADF (Bad file descriptor) [pid 597] close(19) = -1 EBADF (Bad file descriptor) [pid 597] close(20) = -1 EBADF (Bad file descriptor) [pid 597] close(21) = -1 EBADF (Bad file descriptor) [pid 597] close(22) = -1 EBADF (Bad file descriptor) [pid 597] close(23) = -1 EBADF (Bad file descriptor) [pid 597] close(24) = -1 EBADF (Bad file descriptor) [pid 597] close(25) = -1 EBADF (Bad file descriptor) [pid 597] close(26) = -1 EBADF (Bad file descriptor) [pid 597] close(27) = -1 EBADF (Bad file descriptor) [pid 597] close(28) = -1 EBADF (Bad file descriptor) [pid 597] close(29) = -1 EBADF (Bad file descriptor) [pid 597] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory ) = 89 [pid 597] exit_group(0) = ? [pid 597] +++ exited with 0 +++ [pid 375] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=40, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 375] umount2("./38", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] openat(AT_FDCWD, "./38", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 375] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 375] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 375] umount2("./38/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./38/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 375] unlink("./38/binderfs") = 0 [pid 375] umount2("./38/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./38/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 375] unlink("./38/cgroup") = 0 [pid 375] umount2("./38/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./38/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 375] unlink("./38/cgroup.net") = 0 [ 125.214686][ T597] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 125.223082][ T597] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 125.231026][ T597] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 125.239238][ T597] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 125.247198][ T597] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 125.255149][ T597] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000026 [ 125.289371][ T375] ------------[ cut here ]------------ [ 125.294900][ T375] WARNING: CPU: 0 PID: 375 at fs/namespace.c:1168 mntput_no_expire+0x48a/0x6c0 [ 125.303912][ T375] Modules linked in: [ 125.307818][ T375] CPU: 0 PID: 375 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 125.319446][ T375] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 125.329523][ T375] RIP: 0010:mntput_no_expire+0x48a/0x6c0 [ 125.335179][ T375] Code: 48 c7 c2 80 02 44 86 e8 64 f0 8e ff e9 8b fc ff ff e8 ba 21 b6 ff e9 81 fc ff ff e8 b0 21 b6 ff e9 77 fc ff ff e8 a6 21 b6 ff <0f> 0b e9 f4 fc ff ff e8 9a 21 b6 ff e8 65 ad a2 ff e9 ea fc ff ff [ 125.354791][ T375] RSP: 0018:ffffc9000095fba0 EFLAGS: 00010293 [ 125.360857][ T375] RAX: ffffffff81b68f1a RBX: 00000000fffffffe RCX: ffff8881065e13c0 [ 125.369081][ T375] RDX: 0000000000000000 RSI: 00000000fffffffe RDI: 0000000000000000 [ 125.377062][ T375] RBP: ffffc9000095fc70 R08: ffffffff81b68c08 R09: 0000000000000003 [ 125.385045][ T375] R10: fffff5200012bf65 R11: 1ffff9200012bf64 R12: dffffc0000000000 [ 125.393031][ T375] R13: ffff888117098000 R14: ffffc9000095fc00 R15: 1ffff9200012bf7c [ 125.401005][ T375] FS: 0000555556fab300(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 125.409907][ T375] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 125.416488][ T375] CR2: 00007ffd7d0e1c18 CR3: 000000011dd54000 CR4: 00000000003506b0 [ 125.424478][ T375] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 125.432451][ T375] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 125.440415][ T375] Call Trace: [ 125.443679][ T375] ? io_schedule+0x120/0x120 [ 125.448249][ T375] ? vfs_submount+0xb0/0xb0 [ 125.452778][ T375] ? shrink_dentry_list+0x4ec/0x500 [ 125.457974][ T375] ? __kasan_check_write+0x14/0x20 [ 125.463093][ T375] namespace_unlock+0x448/0x4f0 [ 125.467944][ T375] ? umount_tree+0xf50/0xf50 [ 125.472550][ T375] ? __detach_mounts+0x670/0x670 [ 125.477487][ T375] ? selinux_umount+0xf0/0x130 [ 125.482249][ T375] ? security_sb_umount+0x9d/0xb0 [ 125.487262][ T375] path_umount+0xf03/0xfb0 [ 125.491707][ T375] ? namespace_unlock+0x4f0/0x4f0 [ 125.496730][ T375] ? user_path_at_empty+0x40/0x50 [ 125.501767][ T375] __x64_sys_umount+0x122/0x170 [ 125.506604][ T375] ? path_umount+0xfb0/0xfb0 [ 125.511210][ T375] ? syscall_enter_from_user_mode+0x58/0x1b0 [ 125.517178][ T375] do_syscall_64+0x34/0x70 [ 125.521605][ T375] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 125.527477][ T375] RIP: 0033:0x7fc8ece63fb7 [ 125.531901][ T375] Code: 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 125.551514][ T375] RSP: 002b:00007ffd7d0e2358 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [ 125.559921][ T375] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc8ece63fb7 [ 125.567912][ T375] RDX: 00007ffd7d0e241a RSI: 000000000000000a RDI: 00007ffd7d0e2410 [ 125.575903][ T375] RBP: 00007ffd7d0e2410 R08: 00000000ffffffff R09: 00007ffd7d0e21f0 [ 125.583875][ T375] R10: 0000555556fad6a3 R11: 0000000000000202 R12: 00007ffd7d0e3490 [ 125.591848][ T375] R13: 0000555556fad600 R14: 00007ffd7d0e2380 R15: 0000000000000027 [ 125.599802][ T375] ---[ end trace d4de1ca9cdcd1981 ]--- [ 125.605406][ T375] ------------[ cut here ]------------ [ 125.605487][ T599] FAULT_INJECTION: forcing a failure. [ 125.605487][ T599] name failslab, interval 1, probability 0, space 0, times 0 [ 125.611018][ T375] WARNING: CPU: 0 PID: 375 at fs/namespace.c:1168 mntput_no_expire+0x48a/0x6c0 [ 125.611030][ T375] Modules linked in: [pid 375] umount2("./38/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 598] <... write resumed>) = 6 [pid 596] <... write resumed>) = 6 [pid 595] <... write resumed>) = 6 [pid 596] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [ 125.636904][ T375] CPU: 0 PID: 375 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 125.648605][ T375] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 125.658687][ T375] RIP: 0010:mntput_no_expire+0x48a/0x6c0 [ 125.664332][ T375] Code: 48 c7 c2 80 02 44 86 e8 64 f0 8e ff e9 8b fc ff ff e8 ba 21 b6 ff e9 81 fc ff ff e8 b0 21 b6 ff e9 77 fc ff ff e8 a6 21 b6 ff <0f> 0b e9 f4 fc ff ff e8 9a 21 b6 ff e8 65 ad a2 ff e9 ea fc ff ff [ 125.683938][ T375] RSP: 0018:ffffc9000095fca0 EFLAGS: 00010293 [pid 595] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [ 125.689993][ T375] RAX: ffffffff81b68f1a RBX: 00000000fffffffd RCX: ffff8881065e13c0 [ 125.697967][ T375] RDX: 0000000000000000 RSI: 00000000fffffffd RDI: 0000000000000000 [ 125.705934][ T375] RBP: ffffc9000095fd70 R08: ffffffff81b68c08 R09: 0000000000000003 [ 125.713898][ T375] R10: fffff5200012bf85 R11: 1ffff9200012bf84 R12: dffffc0000000000 [ 125.721896][ T375] R13: ffff888117098000 R14: ffffc9000095fd00 R15: 1ffff9200012bf9c [ 125.729858][ T375] FS: 0000555556fab300(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 125.738784][ T375] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 125.745357][ T375] CR2: 00007ffd7d0e1c18 CR3: 000000011dd54000 CR4: 00000000003506b0 [ 125.753336][ T375] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 125.761307][ T375] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 125.769256][ T375] Call Trace: [ 125.772567][ T375] ? lockref_get_or_lock+0x340/0x340 [ 125.777834][ T375] ? umount_tree+0xf50/0xf50 [ 125.782419][ T375] ? vfs_submount+0xb0/0xb0 [ 125.786898][ T375] ? dput+0x2b6/0x320 [ 125.790875][ T375] path_umount+0x1fe/0xfb0 [ 125.795279][ T375] ? namespace_unlock+0x4f0/0x4f0 [ 125.800294][ T375] ? user_path_at_empty+0x40/0x50 [ 125.805296][ T375] __x64_sys_umount+0x122/0x170 [ 125.810124][ T375] ? path_umount+0xfb0/0xfb0 [ 125.814720][ T375] ? syscall_enter_from_user_mode+0x58/0x1b0 [ 125.820692][ T375] do_syscall_64+0x34/0x70 [ 125.825090][ T375] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 125.830971][ T375] RIP: 0033:0x7fc8ece63fb7 [ 125.835367][ T375] Code: 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 125.854966][ T599] CPU: 1 PID: 599 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 125.854972][ T599] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 125.854976][ T599] Call Trace: [ 125.854996][ T599] dump_stack_lvl+0x1e2/0x24b [ 125.866584][ T375] RSP: 002b:00007ffd7d0e2358 EFLAGS: 00000202 [ 125.876616][ T599] ? panic+0x7d7/0x7d7 [ 125.876632][ T599] ? bfq_pos_tree_add_move+0x43e/0x43e [ 125.879885][ T375] ORIG_RAX: 00000000000000a6 [ 125.884528][ T599] ? find_next_bit+0xd6/0x120 [ 125.884545][ T599] ? cpumask_next+0x11/0x30 [ 125.890580][ T375] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc8ece63fb7 [ 125.894610][ T599] dump_stack+0x15/0x17 [ 125.900035][ T375] RDX: 00007ffd7d0e241a RSI: 000000000000000a RDI: 00007ffd7d0e2410 [ 125.904675][ T599] should_fail+0x3c0/0x510 [ 125.904684][ T599] ? percpu_ref_init+0xd0/0x330 [ 125.904701][ T599] __should_failslab+0x9f/0xe0 [ 125.909347][ T375] RBP: 00007ffd7d0e2410 R08: 00000000ffffffff R09: 00007ffd7d0e21f0 [ 125.913815][ T599] should_failslab+0x9/0x20 [ 125.913832][ T599] kmem_cache_alloc_trace+0x3a/0x330 [ 125.921798][ T375] R10: 0000555556fad6a3 R11: 0000000000000202 R12: 00007ffd7d0e3490 [ 125.925921][ T599] percpu_ref_init+0xd0/0x330 [ 125.933879][ T375] R13: 0000555556fad600 R14: 00007ffd7d0e2380 R15: 0000000000000027 [ 125.938259][ T599] ? cgroup_setup_root+0xea0/0xea0 [ 125.943088][ T375] ---[ end trace d4de1ca9cdcd1982 ]--- [ 125.947820][ T599] cgroup_apply_control_enable+0x3a2/0x12f0 [ 126.002367][ T599] cgroup_apply_control+0x93/0x710 [ 126.007466][ T599] ? css_next_child+0x160/0x160 [ 126.012298][ T599] ? stack_trace_save+0x12d/0x1f0 [ 126.017298][ T599] ? io_schedule+0x120/0x120 [ 126.021869][ T599] ? kernfs_fop_write_iter+0x15e/0x410 [ 126.027306][ T599] ? __kasan_check_write+0x14/0x20 [ 126.032398][ T599] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 126.037666][ T599] cgroup_subtree_control_write+0xd19/0x1310 [ 126.043622][ T599] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 126.049577][ T599] ? __kasan_check_write+0x14/0x20 [ 126.054665][ T599] ? _copy_from_iter+0x3fb/0xd60 [ 126.059576][ T599] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 126.065531][ T599] cgroup_file_write+0x28e/0x590 [ 126.070442][ T599] ? cgroup_seqfile_stop+0xc0/0xc0 [ 126.075527][ T599] ? mutex_lock+0xa6/0x110 [ 126.079919][ T599] ? mutex_trylock+0xb0/0xb0 [ 126.084483][ T599] ? __kasan_check_write+0x14/0x20 [ 126.089572][ T599] kernfs_fop_write_iter+0x2d0/0x410 [ 126.094832][ T599] ? cgroup_seqfile_stop+0xc0/0xc0 [ 126.099920][ T599] vfs_write+0xc1c/0xf40 [ 126.104143][ T599] ? __kasan_check_write+0x14/0x20 [ 126.109231][ T599] ? kernel_write+0x3c0/0x3c0 [ 126.113882][ T599] ? _raw_spin_unlock_irq+0x4e/0x70 [ 126.119057][ T599] ? ptrace_stop+0x6ff/0x9f0 [ 126.123622][ T599] ? __kasan_check_read+0x11/0x20 [ 126.128620][ T599] ? __fdget_pos+0x27e/0x310 [ 126.133186][ T599] ksys_write+0x198/0x2c0 [ 126.137496][ T599] ? do_notify_parent+0xa60/0xa60 [ 126.142493][ T599] ? __ia32_sys_read+0x90/0x90 [ 126.147235][ T599] ? __ia32_sys_open+0x270/0x270 [ 126.152148][ T599] __x64_sys_write+0x7b/0x90 [ 126.156713][ T599] do_syscall_64+0x34/0x70 [ 126.161104][ T599] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 126.166972][ T599] RIP: 0033:0x7fc8ece62c09 [ 126.171364][ T599] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 598] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 596] <... openat resumed>) = 5 [pid 595] <... openat resumed>) = 5 [pid 375] <... umount2 resumed>) = 0 [pid 598] write(5, "22", 2 [pid 596] write(5, "22", 2 [pid 595] write(5, "22", 2 [pid 598] <... write resumed>) = 2 [pid 596] <... write resumed>) = 2 [pid 595] <... write resumed>) = 2 [pid 375] umount2("./38/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 598] write(4, "+pids ", 6 [pid 596] write(4, "+pids ", 6 [pid 595] write(4, "+pids ", 6 [pid 375] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 375] lstat("./38/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 599] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 375] umount2("./38/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 599] close(3 [pid 375] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 599] <... close resumed>) = 0 [pid 375] openat(AT_FDCWD, "./38/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 599] close(4 [pid 375] <... openat resumed>) = 4 [pid 599] <... close resumed>) = 0 [pid 375] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 599] close(5 [pid 375] getdents64(4, [pid 599] <... close resumed>) = 0 [pid 599] close(6 [pid 375] <... getdents64 resumed>0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 599] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 599] close(7 [pid 375] getdents64(4, [pid 599] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 599] close(8 [pid 375] <... getdents64 resumed>0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 599] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 375] close(4 [pid 599] close(9 [pid 375] <... close resumed>) = 0 [pid 599] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 599] close(10 [pid 375] rmdir("./38/file0" [pid 599] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 375] <... rmdir resumed>) = 0 [pid 599] close(11 [pid 375] umount2("./38/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 599] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 599] close(12 [pid 375] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 599] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 599] close(13 [pid 375] lstat("./38/cgroup.cpu", [pid 599] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 375] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 599] close(14) = -1 EBADF (Bad file descriptor) [pid 375] unlink("./38/cgroup.cpu" [pid 599] close(15) = -1 EBADF (Bad file descriptor) [pid 375] <... unlink resumed>) = 0 [pid 599] close(16 [pid 375] getdents64(3, [pid 599] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 599] close(17 [pid 375] <... getdents64 resumed>0x555556fad630 /* 0 entries */, 32768) = 0 [pid 599] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 599] close(18 [pid 375] close(3 [pid 599] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 599] close(19 [pid 375] <... close resumed>) = 0 [pid 599] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 375] rmdir("./38" [pid 599] close(20) = -1 EBADF (Bad file descriptor) [pid 375] <... rmdir resumed>) = 0 [pid 599] close(21) = -1 EBADF (Bad file descriptor) [pid 375] mkdir("./39", 0777 [pid 599] close(22 [pid 375] <... mkdir resumed>) = 0 [pid 599] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 599] close(23 [pid 375] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 599] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 599] close(24./strace-static-x86_64: Process 601 attached ) = -1 EBADF (Bad file descriptor) [pid 601] chdir("./39") = 0 [pid 599] close(25 [pid 375] <... clone resumed>, child_tidptr=0x555556fab5d0) = 41 [pid 601] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 599] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 601] <... prctl resumed>) = 0 [pid 599] close(26 [pid 601] setpgid(0, 0 [pid 599] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 601] <... setpgid resumed>) = 0 [pid 599] close(27 [pid 601] symlink("/syzcgroup/unified/syz0", "./cgroup" [pid 599] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 601] <... symlink resumed>) = 0 [pid 599] close(28 [pid 601] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu" [pid 599] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 601] <... symlink resumed>) = 0 [pid 599] close(29 [pid 601] symlink("/syzcgroup/net/syz0", "./cgroup.net" [pid 599] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 601] <... symlink resumed>) = 0 [pid 601] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 599] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory [pid 601] <... openat resumed>) = 3 [pid 599] <... write resumed>) = 89 [pid 601] write(3, "1000", 4 [pid 599] exit_group(0 [pid 601] <... write resumed>) = 4 [pid 599] <... exit_group resumed>) = ? [pid 601] close(3) = 0 [pid 601] symlink("/dev/binderfs", "./binderfs") = 0 [pid 601] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 599] +++ exited with 0 +++ [pid 601] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 376] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=38, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 601] <... mount resumed>) = 0 [pid 601] open("./file0", O_RDONLY) = 3 [pid 601] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [pid 601] write(4, "-pids ", 6 [pid 376] umount2("./36", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] openat(AT_FDCWD, "./36", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 376] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 376] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 376] umount2("./36/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./36/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 376] unlink("./36/binderfs") = 0 [pid 376] umount2("./36/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./36/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 376] unlink("./36/cgroup") = 0 [pid 376] umount2("./36/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./36/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 376] unlink("./36/cgroup.net") = 0 [pid 376] umount2("./36/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 376] umount2("./36/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./36/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 376] umount2("./36/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] openat(AT_FDCWD, "./36/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [ 126.190957][ T599] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 126.199367][ T599] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 126.207317][ T599] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 126.215266][ T599] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 126.223215][ T599] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 126.231164][ T599] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000024 [pid 376] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 376] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 376] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 376] close(4) = 0 [pid 376] rmdir("./36/file0") = 0 [pid 376] umount2("./36/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./36/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 376] unlink("./36/cgroup.cpu") = 0 [pid 376] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 376] close(3) = 0 [pid 376] rmdir("./36") = 0 [pid 376] mkdir("./37", 0777) = 0 [pid 376] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556fab5d0) = 39 [ 126.260629][ T595] FAULT_INJECTION: forcing a failure. [ 126.260629][ T595] name failslab, interval 1, probability 0, space 0, times 0 [ 126.273324][ T595] CPU: 0 PID: 595 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 126.284940][ T595] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 126.294979][ T595] Call Trace: [ 126.298245][ T595] dump_stack_lvl+0x1e2/0x24b [ 126.302909][ T595] ? bfq_pos_tree_add_move+0x43e/0x43e ./strace-static-x86_64: Process 602 attached [pid 602] chdir("./37") = 0 [pid 602] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 602] setpgid(0, 0) = 0 [pid 602] symlink("/syzcgroup/unified/syz1", "./cgroup") = 0 [pid 602] symlink("/syzcgroup/cpu/syz1", "./cgroup.cpu") = 0 [pid 602] symlink("/syzcgroup/net/syz1", "./cgroup.net") = 0 [pid 602] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 602] write(3, "1000", 4) = 4 [pid 602] close(3) = 0 [pid 602] symlink("/dev/binderfs", "./binderfs") = 0 [pid 602] mkdirat(AT_FDCWD, "./file0", 000) = 0 [ 126.308371][ T595] ? selinux_kernfs_init_security+0x1a8/0x760 [ 126.314424][ T595] dump_stack+0x15/0x17 [ 126.318551][ T595] should_fail+0x3c0/0x510 [ 126.322951][ T595] ? __kernfs_new_node+0x99/0x6e0 [ 126.327965][ T595] __should_failslab+0x9f/0xe0 [ 126.332713][ T595] should_failslab+0x9/0x20 [ 126.337205][ T595] __kmalloc_track_caller+0x5f/0x350 [ 126.342464][ T595] kstrdup_const+0x55/0x90 [ 126.346850][ T595] __kernfs_new_node+0x99/0x6e0 [ 126.351673][ T595] ? is_module_text_address+0xe1/0x140 [ 126.357109][ T595] ? kernfs_new_node+0x170/0x170 [ 126.362030][ T595] ? ptr_to_hashval+0x60/0x60 [ 126.366686][ T595] ? arch_stack_walk+0xf8/0x140 [ 126.371524][ T595] ? snprintf+0xd6/0x120 [ 126.375740][ T595] kernfs_new_node+0x97/0x170 [ 126.380398][ T595] __kernfs_create_file+0x4a/0x270 [ 126.385488][ T595] cgroup_addrm_files+0xab8/0xfe0 [ 126.390483][ T595] ? ____kasan_kmalloc+0xdc/0x110 [ 126.395478][ T595] ? __kasan_kmalloc+0x9/0x10 [ 126.400132][ T595] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 126.405660][ T595] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 126.411786][ T595] ? delete_node+0x759/0x7b0 [ 126.416360][ T595] ? __kasan_check_read+0x11/0x20 [ 126.421365][ T595] ? delete_node+0x759/0x7b0 [ 126.425929][ T595] ? __kasan_check_write+0x14/0x20 [ 126.431021][ T595] ? idr_replace+0x1c4/0x230 [ 126.435591][ T595] ? idr_get_next+0x4b0/0x4b0 [ 126.440245][ T595] ? _raw_spin_lock_bh+0xa3/0x1b0 [ 126.445246][ T595] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 126.450432][ T595] css_populate_dir+0x137/0x370 [ 126.455275][ T595] cgroup_apply_control_enable+0x8b9/0x12f0 [ 126.461145][ T595] cgroup_apply_control+0x93/0x710 [ 126.466231][ T595] ? css_next_child+0x160/0x160 [ 126.471057][ T595] ? io_schedule+0x120/0x120 [ 126.475630][ T595] ? kernfs_fop_write_iter+0x15e/0x410 [ 126.481076][ T595] ? __kasan_check_write+0x14/0x20 [ 126.486167][ T595] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 126.491437][ T595] cgroup_subtree_control_write+0xd19/0x1310 [ 126.497418][ T595] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 126.503381][ T595] ? __kasan_check_write+0x14/0x20 [ 126.508477][ T595] ? _copy_from_iter+0x3fb/0xd60 [ 126.513398][ T595] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 126.519350][ T595] cgroup_file_write+0x28e/0x590 [ 126.524267][ T595] ? cgroup_seqfile_stop+0xc0/0xc0 [ 126.529353][ T595] ? mutex_lock+0xa6/0x110 [ 126.533750][ T595] ? mutex_trylock+0xb0/0xb0 [ 126.538322][ T595] ? __kasan_check_write+0x14/0x20 [ 126.543406][ T595] kernfs_fop_write_iter+0x2d0/0x410 [ 126.548671][ T595] ? cgroup_seqfile_stop+0xc0/0xc0 [ 126.553756][ T595] vfs_write+0xc1c/0xf40 [ 126.557972][ T595] ? __kasan_check_write+0x14/0x20 [ 126.563058][ T595] ? kernel_write+0x3c0/0x3c0 [ 126.567713][ T595] ? _raw_spin_unlock_irq+0x4e/0x70 [ 126.572892][ T595] ? ptrace_stop+0x6ff/0x9f0 [ 126.577462][ T595] ? __kasan_check_read+0x11/0x20 [ 126.582477][ T595] ? __fdget_pos+0x27e/0x310 [ 126.587040][ T595] ksys_write+0x198/0x2c0 [ 126.591344][ T595] ? do_notify_parent+0xa60/0xa60 [ 126.596349][ T595] ? __ia32_sys_read+0x90/0x90 [ 126.601085][ T595] ? __ia32_sys_open+0x270/0x270 [ 126.605994][ T595] __x64_sys_write+0x7b/0x90 [ 126.610556][ T595] do_syscall_64+0x34/0x70 [ 126.614946][ T595] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 126.620812][ T595] RIP: 0033:0x7fc8ece62c09 [ 126.625215][ T595] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 126.644806][ T595] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 126.653214][ T595] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [pid 602] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 595] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 602] <... mount resumed>) = 0 [pid 595] close(3 [pid 602] open("./file0", O_RDONLY [pid 595] <... close resumed>) = 0 [pid 602] <... open resumed>) = 3 [pid 595] close(4 [pid 602] openat(3, "cgroup.subtree_control", O_RDWR [pid 595] <... close resumed>) = 0 [pid 602] <... openat resumed>) = 4 [pid 595] close(5 [pid 602] write(4, "-pids ", 6 [pid 595] <... close resumed>) = 0 [pid 595] close(6) = -1 EBADF (Bad file descriptor) [pid 595] close(7) = -1 EBADF (Bad file descriptor) [pid 595] close(8) = -1 EBADF (Bad file descriptor) [pid 595] close(9) = -1 EBADF (Bad file descriptor) [pid 595] close(10) = -1 EBADF (Bad file descriptor) [pid 595] close(11) = -1 EBADF (Bad file descriptor) [pid 595] close(12) = -1 EBADF (Bad file descriptor) [pid 595] close(13) = -1 EBADF (Bad file descriptor) [pid 595] close(14) = -1 EBADF (Bad file descriptor) [pid 595] close(15) = -1 EBADF (Bad file descriptor) [pid 595] close(16) = -1 EBADF (Bad file descriptor) [pid 595] close(17) = -1 EBADF (Bad file descriptor) [pid 595] close(18) = -1 EBADF (Bad file descriptor) [pid 595] close(19) = -1 EBADF (Bad file descriptor) [pid 595] close(20) = -1 EBADF (Bad file descriptor) [pid 595] close(21) = -1 EBADF (Bad file descriptor) [pid 595] close(22) = -1 EBADF (Bad file descriptor) [pid 595] close(23) = -1 EBADF (Bad file descriptor) [pid 595] close(24) = -1 EBADF (Bad file descriptor) [pid 595] close(25) = -1 EBADF (Bad file descriptor) [pid 595] close(26) = -1 EBADF (Bad file descriptor) [pid 595] close(27) = -1 EBADF (Bad file descriptor) [pid 595] close(28) = -1 EBADF (Bad file descriptor) [pid 595] close(29) = -1 EBADF (Bad file descriptor) [pid 595] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory ) = 89 [pid 595] exit_group(0) = ? [pid 595] +++ exited with 0 +++ [pid 383] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=32, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 383] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 383] umount2("./30", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] openat(AT_FDCWD, "./30", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 383] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 383] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 383] umount2("./30/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./30/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 383] unlink("./30/binderfs") = 0 [pid 383] umount2("./30/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./30/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 383] unlink("./30/cgroup") = 0 [pid 383] umount2("./30/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./30/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 383] unlink("./30/cgroup.net") = 0 [ 126.661178][ T595] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 126.669132][ T595] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 126.677076][ T595] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 126.685029][ T595] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 000000000000001e [ 126.693125][ T595] cgroup: cgroup_addrm_files: failed to add max, err=-12 [pid 383] umount2("./30/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 600] <... write resumed>) = 6 [ 126.719906][ T383] ------------[ cut here ]------------ [ 126.725427][ T383] WARNING: CPU: 1 PID: 383 at fs/namespace.c:1168 mntput_no_expire+0x48a/0x6c0 [ 126.734419][ T383] Modules linked in: [ 126.734656][ T596] FAULT_INJECTION: forcing a failure. [ 126.734656][ T596] name failslab, interval 1, probability 0, space 0, times 0 [ 126.738315][ T383] CPU: 1 PID: 383 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 126.762491][ T383] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 126.772731][ T383] RIP: 0010:mntput_no_expire+0x48a/0x6c0 [ 126.778359][ T383] Code: 48 c7 c2 80 02 44 86 e8 64 f0 8e ff e9 8b fc ff ff e8 ba 21 b6 ff e9 81 fc ff ff e8 b0 21 b6 ff e9 77 fc ff ff e8 a6 21 b6 ff <0f> 0b e9 f4 fc ff ff e8 9a 21 b6 ff e8 65 ad a2 ff e9 ea fc ff ff [ 126.797980][ T383] RSP: 0018:ffffc90000b87ba0 EFLAGS: 00010293 [ 126.803747][ T596] CPU: 0 PID: 596 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 126.804054][ T383] RAX: ffffffff81b68f1a RBX: 00000000ffffffff RCX: ffff8881065e3b40 [ 126.815638][ T596] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 126.815644][ T596] Call Trace: [ 126.815664][ T596] dump_stack_lvl+0x1e2/0x24b [ 126.815674][ T596] ? bfq_pos_tree_add_move+0x43e/0x43e [ 126.815685][ T596] ? selinux_kernfs_init_security+0x1a8/0x760 [ 126.815694][ T596] dump_stack+0x15/0x17 [ 126.815703][ T596] should_fail+0x3c0/0x510 [ 126.815712][ T596] ? __kernfs_new_node+0x99/0x6e0 [ 126.815722][ T596] __should_failslab+0x9f/0xe0 [ 126.815730][ T596] should_failslab+0x9/0x20 [ 126.815751][ T596] __kmalloc_track_caller+0x5f/0x350 [ 126.823719][ T383] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000 [ 126.833730][ T596] kstrdup_const+0x55/0x90 [ 126.833740][ T596] __kernfs_new_node+0x99/0x6e0 [ 126.833757][ T596] ? is_module_text_address+0xe1/0x140 [ 126.837014][ T383] RBP: ffffc90000b87c70 R08: ffffffff81b68c08 R09: 0000000000000003 [ 126.841658][ T596] ? kernfs_new_node+0x170/0x170 [ 126.841668][ T596] ? ptr_to_hashval+0x60/0x60 [ 126.841676][ T596] ? arch_stack_walk+0xf8/0x140 [ 126.841685][ T596] ? snprintf+0xd6/0x120 [ 126.841694][ T596] kernfs_new_node+0x97/0x170 [ 126.841712][ T596] __kernfs_create_file+0x4a/0x270 [ 126.847139][ T383] R10: fffff52000170f65 R11: 1ffff92000170f64 R12: dffffc0000000000 [ 126.853166][ T596] cgroup_addrm_files+0xab8/0xfe0 [ 126.853176][ T596] ? ____kasan_kmalloc+0xdc/0x110 [ 126.853191][ T596] ? __kasan_kmalloc+0x9/0x10 [ 126.857317][ T383] R13: ffff888117098380 R14: ffffc90000b87c00 R15: 1ffff92000170f7c [ 126.861697][ T596] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 126.861708][ T596] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 126.861723][ T596] ? delete_node+0x759/0x7b0 [ 126.866715][ T383] FS: 0000555556fab300(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 126.871438][ T596] ? __kasan_check_read+0x11/0x20 [ 126.871447][ T596] ? delete_node+0x759/0x7b0 [ 126.871455][ T596] ? __kasan_check_write+0x14/0x20 [ 126.871471][ T596] ? idr_replace+0x1c4/0x230 [ 126.875946][ T383] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 126.881195][ T596] ? idr_get_next+0x4b0/0x4b0 [ 126.881204][ T596] ? _raw_spin_lock_bh+0xa3/0x1b0 [ 126.881219][ T596] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 126.889163][ T383] CR2: 00007ffd7d0e1c18 CR3: 0000000104bfa000 CR4: 00000000003506a0 [ 126.893541][ T596] css_populate_dir+0x137/0x370 [ 126.893560][ T596] cgroup_apply_control_enable+0x8b9/0x12f0 [ 126.898375][ T383] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 126.903799][ T596] cgroup_apply_control+0x93/0x710 [ 126.903815][ T596] ? css_next_child+0x160/0x160 [ 126.911767][ T383] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 126.916666][ T596] ? io_schedule+0x120/0x120 [ 126.921309][ T383] Call Trace: [ 126.926125][ T596] ? kernfs_fop_write_iter+0x15e/0x410 [ 126.930356][ T383] ? io_schedule+0x120/0x120 [ 126.934978][ T596] ? __kasan_check_write+0x14/0x20 [ 126.940056][ T383] ? vfs_submount+0xb0/0xb0 [ 126.947993][ T596] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 126.948011][ T596] cgroup_subtree_control_write+0xd19/0x1310 [pid 600] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 596] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 596] close(3) = 0 [pid 596] close(4) = 0 [pid 596] close(5) = 0 [pid 596] close(6) = -1 EBADF (Bad file descriptor) [pid 596] close(7) = -1 EBADF (Bad file descriptor) [pid 596] close(8) = -1 EBADF (Bad file descriptor) [pid 596] close(9) = -1 EBADF (Bad file descriptor) [pid 596] close(10) = -1 EBADF (Bad file descriptor) [pid 596] close(11) = -1 EBADF (Bad file descriptor) [pid 596] close(12) = -1 EBADF (Bad file descriptor) [pid 596] close(13) = -1 EBADF (Bad file descriptor) [pid 596] close(14) = -1 EBADF (Bad file descriptor) [pid 596] close(15) = -1 EBADF (Bad file descriptor) [pid 596] close(16) = -1 EBADF (Bad file descriptor) [pid 596] close(17) = -1 EBADF (Bad file descriptor) [pid 596] close(18) = -1 EBADF (Bad file descriptor) [pid 596] close(19) = -1 EBADF (Bad file descriptor) [pid 596] close(20) = -1 EBADF (Bad file descriptor) [pid 596] close(21) = -1 EBADF (Bad file descriptor) [pid 596] close(22) = -1 EBADF (Bad file descriptor) [pid 596] close(23) = -1 EBADF (Bad file descriptor) [pid 596] close(24) = -1 EBADF (Bad file descriptor) [pid 596] close(25) = -1 EBADF (Bad file descriptor) [pid 596] close(26) = -1 EBADF (Bad file descriptor) [pid 596] close(27) = -1 EBADF (Bad file descriptor) [pid 596] close(28) = -1 EBADF (Bad file descriptor) [pid 596] close(29) = -1 EBADF (Bad file descriptor) [pid 596] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory ) = 89 [pid 596] exit_group(0) = ? [pid 596] +++ exited with 0 +++ [pid 381] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=36, si_uid=0, si_status=0, si_utime=0, si_stime=11} --- [pid 381] restart_syscall(<... resuming interrupted clone ...>) = 0 [ 126.953009][ T383] ? shrink_dentry_list+0x4ec/0x500 [ 126.958000][ T596] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 126.962658][ T383] ? __kasan_check_write+0x14/0x20 [ 126.970595][ T596] ? __kasan_check_write+0x14/0x20 [ 126.970613][ T596] ? _copy_from_iter+0x3fb/0xd60 [ 126.976126][ T383] namespace_unlock+0x448/0x4f0 [ 126.982242][ T596] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 126.982251][ T596] cgroup_file_write+0x28e/0x590 [ 126.982265][ T596] ? cgroup_seqfile_stop+0xc0/0xc0 [ 126.986826][ T383] ? umount_tree+0xf50/0xf50 [ 126.995716][ T596] ? mutex_lock+0xa6/0x110 [ 126.995726][ T596] ? mutex_trylock+0xb0/0xb0 [ 126.995735][ T596] ? __kasan_check_write+0x14/0x20 [ 126.995744][ T596] kernfs_fop_write_iter+0x2d0/0x410 [ 126.995758][ T596] ? cgroup_seqfile_stop+0xc0/0xc0 [ 127.000758][ T383] ? __detach_mounts+0x670/0x670 [ 127.005310][ T596] vfs_write+0xc1c/0xf40 [ 127.010393][ T383] ? selinux_umount+0xf0/0x130 [ 127.014942][ T596] ? __kasan_check_write+0x14/0x20 [ 127.021503][ T383] ? security_sb_umount+0x9d/0xb0 [ 127.026143][ T596] ? kernel_write+0x3c0/0x3c0 [ 127.031143][ T383] path_umount+0xf03/0xfb0 [ 127.036300][ T596] ? _raw_spin_unlock_irq+0x4e/0x70 [ 127.044253][ T383] ? namespace_unlock+0x4f0/0x4f0 [ 127.049060][ T596] ? ptrace_stop+0x6ff/0x9f0 [ 127.054945][ T383] ? user_path_at_empty+0x40/0x50 [ 127.062858][ T596] ? __kasan_check_read+0x11/0x20 [ 127.062874][ T596] ? __fdget_pos+0x27e/0x310 [ 127.068039][ T383] __x64_sys_umount+0x122/0x170 [ 127.072850][ T596] ksys_write+0x198/0x2c0 [ 127.072861][ T596] ? do_notify_parent+0xa60/0xa60 [ 127.072876][ T596] ? __ia32_sys_read+0x90/0x90 [ 127.080828][ T383] ? path_umount+0xfb0/0xfb0 [ 127.085379][ T596] ? __ia32_sys_open+0x270/0x270 [ 127.088650][ T383] ? syscall_enter_from_user_mode+0x58/0x1b0 [ 127.094067][ T596] __x64_sys_write+0x7b/0x90 [ 127.094076][ T596] do_syscall_64+0x34/0x70 [ 127.094091][ T596] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 127.098652][ T383] do_syscall_64+0x34/0x70 [ 127.103722][ T596] RIP: 0033:0x7fc8ece62c09 [ 127.103733][ T596] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 127.103746][ T596] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 [ 127.108219][ T383] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 127.113459][ T596] ORIG_RAX: 0000000000000001 [ 127.113467][ T596] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 127.113473][ T596] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 127.113479][ T596] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 127.113491][ T596] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 127.119446][ T383] RIP: 0033:0x7fc8ece63fb7 [ 127.124626][ T596] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000022 [ 127.141277][ T596] cgroup: cgroup_addrm_files: failed to add max, err=-12 [ 127.145721][ T383] Code: 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 127.145728][ T383] RSP: 002b:00007ffd7d0e2358 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [ 127.145748][ T383] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc8ece63fb7 [ 127.441193][ T383] RDX: 00007ffd7d0e241a RSI: 000000000000000a RDI: 00007ffd7d0e2410 [ 127.449153][ T383] RBP: 00007ffd7d0e2410 R08: 00000000ffffffff R09: 00007ffd7d0e21f0 [ 127.457148][ T383] R10: 0000555556fad6a3 R11: 0000000000000202 R12: 00007ffd7d0e3490 [pid 381] umount2("./34", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] <... umount2 resumed>) = 0 [pid 381] openat(AT_FDCWD, "./34", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 381] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 381] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 381] umount2("./34/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./34/binderfs", [pid 383] umount2("./30/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 381] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 381] unlink("./34/binderfs") = 0 [pid 383] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 600] <... openat resumed>) = 5 [pid 381] umount2("./34/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./34/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 600] write(5, "22", 2) = 2 [pid 383] lstat("./30/file0", [pid 381] unlink("./34/cgroup" [pid 600] write(4, "+pids ", 6 [pid 381] <... unlink resumed>) = 0 [pid 381] umount2("./34/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./34/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 381] unlink("./34/cgroup.net") = 0 [pid 381] umount2("./34/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 383] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 383] umount2("./30/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 381] <... umount2 resumed>) = 0 [pid 381] umount2("./34/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./34/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 381] umount2("./34/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] openat(AT_FDCWD, "./34/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 381] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 381] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 381] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 381] close(4) = 0 [pid 381] rmdir("./34/file0" [pid 383] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 381] <... rmdir resumed>) = 0 [pid 383] openat(AT_FDCWD, "./30/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 381] umount2("./34/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./34/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 381] unlink("./34/cgroup.cpu") = 0 [pid 381] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 381] close(3) = 0 [pid 381] rmdir("./34") = 0 [pid 383] <... openat resumed>) = 4 [pid 381] mkdir("./35", 0777 [pid 383] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 383] getdents64(4, [pid 381] <... mkdir resumed>) = 0 [pid 381] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 383] <... getdents64 resumed>0x555556fb5670 /* 2 entries */, 32768) = 48 ./strace-static-x86_64: Process 603 attached [pid 381] <... clone resumed>, child_tidptr=0x555556fab5d0) = 37 [pid 603] chdir("./35" [pid 383] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 383] close(4) = 0 [pid 603] <... chdir resumed>) = 0 [pid 383] rmdir("./30/file0" [pid 603] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 383] <... rmdir resumed>) = 0 [pid 603] <... prctl resumed>) = 0 [pid 383] umount2("./30/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 603] setpgid(0, 0 [pid 383] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 383] lstat("./30/cgroup.cpu", [pid 603] <... setpgid resumed>) = 0 [pid 383] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 383] unlink("./30/cgroup.cpu") = 0 [pid 383] getdents64(3, [pid 603] symlink("/syzcgroup/unified/syz3", "./cgroup" [pid 383] <... getdents64 resumed>0x555556fad630 /* 0 entries */, 32768) = 0 [pid 383] close(3) = 0 [pid 383] rmdir("./30" [pid 603] <... symlink resumed>) = 0 [pid 383] <... rmdir resumed>) = 0 [pid 603] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu" [pid 383] mkdir("./31", 0777 [pid 603] <... symlink resumed>) = 0 [pid 383] <... mkdir resumed>) = 0 [pid 603] symlink("/syzcgroup/net/syz3", "./cgroup.net" [pid 383] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556fab5d0) = 33 [pid 603] <... symlink resumed>) = 0 [pid 603] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 ./strace-static-x86_64: Process 604 attached [pid 603] write(3, "1000", 4 [pid 604] chdir("./31") = 0 [pid 604] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 604] setpgid(0, 0) = 0 [pid 604] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 604] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu" [pid 603] <... write resumed>) = 4 [pid 604] <... symlink resumed>) = 0 [pid 603] close(3 [pid 604] symlink("/syzcgroup/net/syz4", "./cgroup.net" [pid 603] <... close resumed>) = 0 [pid 604] <... symlink resumed>) = 0 [pid 603] symlink("/dev/binderfs", "./binderfs" [pid 604] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 603] <... symlink resumed>) = 0 [pid 604] write(3, "1000", 4) = 4 [pid 603] mkdirat(AT_FDCWD, "./file0", 000 [pid 604] close(3) = 0 [pid 604] symlink("/dev/binderfs", "./binderfs") = 0 [pid 604] mkdirat(AT_FDCWD, "./file0", 000 [pid 603] <... mkdirat resumed>) = 0 [pid 604] <... mkdirat resumed>) = 0 [pid 604] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 603] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 604] <... mount resumed>) = 0 [pid 604] open("./file0", O_RDONLY) = 3 [pid 603] <... mount resumed>) = 0 [pid 604] openat(3, "cgroup.subtree_control", O_RDWR [pid 603] open("./file0", O_RDONLY [pid 604] <... openat resumed>) = 4 [pid 604] write(4, "-pids ", 6 [pid 603] <... open resumed>) = 3 [pid 603] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [ 127.467243][ T383] R13: 0000555556fad600 R14: 00007ffd7d0e2380 R15: 000000000000001f [ 127.475241][ T383] ---[ end trace d4de1ca9cdcd1983 ]--- [ 127.510576][ T598] FAULT_INJECTION: forcing a failure. [pid 603] write(4, "-pids ", 6) = 6 [ 127.510576][ T598] name failslab, interval 1, probability 0, space 0, times 0 [ 127.524922][ T598] CPU: 0 PID: 598 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 127.536624][ T598] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 127.546656][ T598] Call Trace: [ 127.549924][ T598] dump_stack_lvl+0x1e2/0x24b [ 127.554574][ T598] ? panic+0x7d7/0x7d7 [ 127.558623][ T598] ? bfq_pos_tree_add_move+0x43e/0x43e [ 127.564055][ T598] ? find_next_bit+0xd6/0x120 [ 127.568707][ T598] ? cpumask_next+0x11/0x30 [ 127.573182][ T598] dump_stack+0x15/0x17 [ 127.577310][ T598] should_fail+0x3c0/0x510 [ 127.581698][ T598] ? percpu_ref_init+0xd0/0x330 [ 127.586519][ T598] __should_failslab+0x9f/0xe0 [ 127.591254][ T598] should_failslab+0x9/0x20 [ 127.595729][ T598] kmem_cache_alloc_trace+0x3a/0x330 [ 127.600984][ T598] percpu_ref_init+0xd0/0x330 [ 127.605631][ T598] ? cgroup_setup_root+0xea0/0xea0 [ 127.610714][ T598] cgroup_apply_control_enable+0x3a2/0x12f0 [ 127.616579][ T598] cgroup_apply_control+0x93/0x710 [ 127.621673][ T598] ? css_next_child+0x160/0x160 [ 127.626493][ T598] ? io_schedule+0x120/0x120 [ 127.631053][ T598] ? kernfs_fop_write_iter+0x15e/0x410 [ 127.636481][ T598] ? __kasan_check_write+0x14/0x20 [ 127.641561][ T598] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 127.646839][ T598] cgroup_subtree_control_write+0xd19/0x1310 [ 127.652790][ T598] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 127.658745][ T598] ? __kasan_check_write+0x14/0x20 [ 127.663834][ T598] ? _copy_from_iter+0x3fb/0xd60 [ 127.668745][ T598] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 127.674693][ T598] cgroup_file_write+0x28e/0x590 [ 127.679602][ T598] ? cgroup_seqfile_stop+0xc0/0xc0 [ 127.684684][ T598] ? mutex_lock+0xa6/0x110 [ 127.689079][ T598] ? mutex_trylock+0xb0/0xb0 [ 127.693644][ T598] ? __kasan_check_write+0x14/0x20 [ 127.698728][ T598] kernfs_fop_write_iter+0x2d0/0x410 [ 127.703985][ T598] ? cgroup_seqfile_stop+0xc0/0xc0 [ 127.709069][ T598] vfs_write+0xc1c/0xf40 [ 127.713286][ T598] ? __kasan_check_write+0x14/0x20 [ 127.718372][ T598] ? kernel_write+0x3c0/0x3c0 [ 127.723018][ T598] ? _raw_spin_unlock_irq+0x4e/0x70 [ 127.728189][ T598] ? ptrace_stop+0x6ff/0x9f0 [ 127.732752][ T598] ? __kasan_check_read+0x11/0x20 [ 127.737749][ T598] ? __fdget_pos+0x27e/0x310 [ 127.742309][ T598] ksys_write+0x198/0x2c0 [ 127.746613][ T598] ? do_notify_parent+0xa60/0xa60 [ 127.751607][ T598] ? __ia32_sys_read+0x90/0x90 [ 127.756339][ T598] ? __ia32_sys_open+0x270/0x270 [ 127.761247][ T598] __x64_sys_write+0x7b/0x90 [ 127.765807][ T598] do_syscall_64+0x34/0x70 [ 127.770199][ T598] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 127.776073][ T598] RIP: 0033:0x7fc8ece62c09 [ 127.780461][ T598] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 127.800035][ T598] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 127.808442][ T598] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 127.816389][ T598] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [pid 603] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 603] write(5, "22", 2) = 2 [pid 603] write(4, "+pids ", 6write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory [pid 598] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 598] close(3) = 0 [pid 598] close(4) = 0 [pid 598] close(5) = 0 [pid 598] close(6) = -1 EBADF (Bad file descriptor) [pid 598] close(7) = -1 EBADF (Bad file descriptor) [pid 598] close(8) = -1 EBADF (Bad file descriptor) [pid 598] close(9) = -1 EBADF (Bad file descriptor) [pid 598] close(10) = -1 EBADF (Bad file descriptor) [pid 598] close(11) = -1 EBADF (Bad file descriptor) [pid 598] close(12) = -1 EBADF (Bad file descriptor) [pid 598] close(13) = -1 EBADF (Bad file descriptor) [pid 598] close(14) = -1 EBADF (Bad file descriptor) [pid 598] close(15) = -1 EBADF (Bad file descriptor) [pid 598] close(16) = -1 EBADF (Bad file descriptor) [pid 598] close(17) = -1 EBADF (Bad file descriptor) [pid 598] close(18) = -1 EBADF (Bad file descriptor) [pid 598] close(19) = -1 EBADF (Bad file descriptor) [pid 598] close(20) = -1 EBADF (Bad file descriptor) [pid 598] close(21) = -1 EBADF (Bad file descriptor) [pid 598] close(22) = -1 EBADF (Bad file descriptor) [pid 598] close(23) = -1 EBADF (Bad file descriptor) [pid 598] close(24) = -1 EBADF (Bad file descriptor) [pid 598] close(25) = -1 EBADF (Bad file descriptor) [pid 598] close(26) = -1 EBADF (Bad file descriptor) [pid 598] close(27) = -1 EBADF (Bad file descriptor) [pid 598] close(28) = -1 EBADF (Bad file descriptor) [pid 598] close(29) = -1 EBADF (Bad file descriptor) [pid 598] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 598] exit_group(0) = ? [pid 598] +++ exited with 0 +++ [pid 380] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=34, si_uid=0, si_status=0, si_utime=0, si_stime=8} --- [pid 380] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 380] umount2("./32", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] openat(AT_FDCWD, "./32", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 380] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 380] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 380] umount2("./32/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./32/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 380] unlink("./32/binderfs") = 0 [pid 380] umount2("./32/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./32/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 380] unlink("./32/cgroup") = 0 [pid 380] umount2("./32/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./32/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 380] unlink("./32/cgroup.net") = 0 [pid 380] umount2("./32/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 380] umount2("./32/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./32/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 380] umount2("./32/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] openat(AT_FDCWD, "./32/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 380] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 380] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 380] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 380] close(4) = 0 [pid 380] rmdir("./32/file0") = 0 [pid 380] umount2("./32/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./32/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 380] unlink("./32/cgroup.cpu") = 0 [pid 380] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 380] close(3) = 0 [pid 380] rmdir("./32") = 0 [pid 380] mkdir("./33", 0777) = 0 [pid 380] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 605 attached , child_tidptr=0x555556fab5d0) = 35 [pid 605] chdir("./33") = 0 [pid 605] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 605] setpgid(0, 0) = 0 [pid 605] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 605] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 605] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 605] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 605] write(3, "1000", 4) = 4 [pid 605] close(3) = 0 [pid 605] symlink("/dev/binderfs", "./binderfs") = 0 [pid 605] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 605] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 605] open("./file0", O_RDONLY) = 3 [pid 605] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [ 127.824329][ T598] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 127.832273][ T598] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 127.840310][ T598] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000020 [pid 605] write(4, "-pids ", 6 [pid 602] <... write resumed>) = 6 [pid 601] <... write resumed>) = 6 [pid 601] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 601] write(5, "22", 2) = 2 [pid 601] write(4, "+pids ", 6 [pid 602] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 602] write(5, "22", 2) = 2 [ 127.870512][ T600] FAULT_INJECTION: forcing a failure. [ 127.870512][ T600] name failslab, interval 1, probability 0, space 0, times 0 [ 127.883286][ T600] CPU: 1 PID: 600 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 127.894903][ T600] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 127.904945][ T600] Call Trace: [ 127.908213][ T600] dump_stack_lvl+0x1e2/0x24b [ 127.912877][ T600] ? panic+0x7d7/0x7d7 [ 127.916943][ T600] ? bfq_pos_tree_add_move+0x43e/0x43e [ 127.922398][ T600] ? find_next_bit+0xd6/0x120 [ 127.927062][ T600] ? cpumask_next+0x11/0x30 [ 127.931545][ T600] dump_stack+0x15/0x17 [ 127.935676][ T600] should_fail+0x3c0/0x510 [ 127.940070][ T600] ? percpu_ref_init+0xd0/0x330 [ 127.944897][ T600] __should_failslab+0x9f/0xe0 [ 127.949633][ T600] should_failslab+0x9/0x20 [ 127.954121][ T600] kmem_cache_alloc_trace+0x3a/0x330 [ 127.959388][ T600] percpu_ref_init+0xd0/0x330 [ 127.964049][ T600] ? cgroup_setup_root+0xea0/0xea0 [ 127.969153][ T600] cgroup_apply_control_enable+0x3a2/0x12f0 [ 127.975039][ T600] cgroup_apply_control+0x93/0x710 [ 127.980135][ T600] ? css_next_child+0x160/0x160 [ 127.984966][ T600] ? io_schedule+0x120/0x120 [ 127.989534][ T600] ? kernfs_fop_write_iter+0x15e/0x410 [ 127.994966][ T600] ? __kasan_check_write+0x14/0x20 [ 128.000054][ T600] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 128.005316][ T600] cgroup_subtree_control_write+0xd19/0x1310 [ 128.011293][ T600] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 128.017276][ T600] ? __kasan_check_write+0x14/0x20 [ 128.022380][ T600] ? _copy_from_iter+0x3fb/0xd60 [ 128.027304][ T600] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 128.033267][ T600] cgroup_file_write+0x28e/0x590 [ 128.038200][ T600] ? cgroup_seqfile_stop+0xc0/0xc0 [ 128.043306][ T600] ? mutex_lock+0xa6/0x110 [ 128.047712][ T600] ? mutex_trylock+0xb0/0xb0 [ 128.052289][ T600] ? __kasan_check_write+0x14/0x20 [ 128.057392][ T600] kernfs_fop_write_iter+0x2d0/0x410 [ 128.062676][ T600] ? cgroup_seqfile_stop+0xc0/0xc0 [ 128.067788][ T600] vfs_write+0xc1c/0xf40 [ 128.072016][ T600] ? __kasan_check_write+0x14/0x20 [ 128.077102][ T600] ? kernel_write+0x3c0/0x3c0 [ 128.081760][ T600] ? _raw_spin_unlock_irq+0x4e/0x70 [ 128.086948][ T600] ? ptrace_stop+0x6ff/0x9f0 [ 128.091542][ T600] ? __kasan_check_read+0x11/0x20 [ 128.096549][ T600] ? __fdget_pos+0x27e/0x310 [ 128.101125][ T600] ksys_write+0x198/0x2c0 [ 128.105441][ T600] ? do_notify_parent+0xa60/0xa60 [ 128.110443][ T600] ? __ia32_sys_read+0x90/0x90 [ 128.115184][ T600] ? __ia32_sys_open+0x270/0x270 [ 128.120096][ T600] __x64_sys_write+0x7b/0x90 [ 128.124667][ T600] do_syscall_64+0x34/0x70 [ 128.129061][ T600] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 128.134927][ T600] RIP: 0033:0x7fc8ece62c09 [ 128.139321][ T600] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 128.158905][ T600] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 602] write(4, "+pids ", 6 [pid 600] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 600] close(3) = 0 [pid 600] close(4) = 0 [pid 600] close(5) = 0 [pid 600] close(6) = -1 EBADF (Bad file descriptor) [pid 600] close(7) = -1 EBADF (Bad file descriptor) [pid 600] close(8) = -1 EBADF (Bad file descriptor) [pid 600] close(9) = -1 EBADF (Bad file descriptor) [pid 600] close(10) = -1 EBADF (Bad file descriptor) [pid 600] close(11) = -1 EBADF (Bad file descriptor) [pid 600] close(12) = -1 EBADF (Bad file descriptor) [pid 600] close(13) = -1 EBADF (Bad file descriptor) [pid 600] close(14) = -1 EBADF (Bad file descriptor) [pid 600] close(15) = -1 EBADF (Bad file descriptor) [pid 600] close(16) = -1 EBADF (Bad file descriptor) [pid 600] close(17) = -1 EBADF (Bad file descriptor) [pid 600] close(18) = -1 EBADF (Bad file descriptor) [pid 600] close(19) = -1 EBADF (Bad file descriptor) [pid 600] close(20) = -1 EBADF (Bad file descriptor) [pid 600] close(21) = -1 EBADF (Bad file descriptor) [pid 600] close(22) = -1 EBADF (Bad file descriptor) [pid 600] close(23) = -1 EBADF (Bad file descriptor) [pid 600] close(24) = -1 EBADF (Bad file descriptor) [pid 600] close(25) = -1 EBADF (Bad file descriptor) [pid 600] close(26) = -1 EBADF (Bad file descriptor) [pid 600] close(27) = -1 EBADF (Bad file descriptor) [pid 600] close(28) = -1 EBADF (Bad file descriptor) [pid 600] close(29write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory ) = -1 EBADF (Bad file descriptor) [pid 600] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 600] exit_group(0) = ? [pid 600] +++ exited with 0 +++ [pid 382] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=41, si_uid=0, si_status=0, si_utime=0, si_stime=14} --- [ 128.167305][ T600] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 128.175268][ T600] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 128.183219][ T600] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 128.191173][ T600] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 128.199133][ T600] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000027 [pid 604] <... write resumed>) = 6 [pid 604] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 604] write(5, "22", 2) = 2 [pid 604] write(4, "+pids ", 6 [pid 382] umount2("./39", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] openat(AT_FDCWD, "./39", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 382] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 382] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 382] umount2("./39/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./39/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 382] unlink("./39/binderfs") = 0 [pid 382] umount2("./39/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./39/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 382] unlink("./39/cgroup") = 0 [pid 382] umount2("./39/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./39/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 382] unlink("./39/cgroup.net") = 0 [ 128.220664][ T601] FAULT_INJECTION: forcing a failure. [ 128.220664][ T601] name failslab, interval 1, probability 0, space 0, times 0 [ 128.233370][ T601] CPU: 1 PID: 601 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 128.245005][ T601] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 128.255050][ T601] Call Trace: [ 128.258341][ T601] dump_stack_lvl+0x1e2/0x24b [ 128.263005][ T601] ? bfq_pos_tree_add_move+0x43e/0x43e [ 128.268450][ T601] ? selinux_kernfs_init_security+0x1a8/0x760 [ 128.274553][ T601] dump_stack+0x15/0x17 [ 128.278814][ T601] should_fail+0x3c0/0x510 [ 128.283230][ T601] ? __kernfs_new_node+0x99/0x6e0 [ 128.288249][ T601] __should_failslab+0x9f/0xe0 [ 128.293010][ T601] should_failslab+0x9/0x20 [ 128.297490][ T601] __kmalloc_track_caller+0x5f/0x350 [ 128.302763][ T601] kstrdup_const+0x55/0x90 [ 128.307704][ T601] __kernfs_new_node+0x99/0x6e0 [ 128.312538][ T601] ? is_module_text_address+0xe1/0x140 [ 128.317977][ T601] ? kernfs_new_node+0x170/0x170 [ 128.322903][ T601] ? ptr_to_hashval+0x60/0x60 [ 128.327553][ T601] ? arch_stack_walk+0xf8/0x140 [ 128.332377][ T601] ? snprintf+0xd6/0x120 [ 128.336605][ T601] kernfs_new_node+0x97/0x170 [ 128.341261][ T601] __kernfs_create_file+0x4a/0x270 [ 128.346354][ T601] cgroup_addrm_files+0xab8/0xfe0 [ 128.351379][ T601] ? ____kasan_kmalloc+0xdc/0x110 [ 128.356383][ T601] ? __kasan_kmalloc+0x9/0x10 [ 128.361040][ T601] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 128.366577][ T601] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 128.372714][ T601] ? delete_node+0x759/0x7b0 [ 128.377290][ T601] ? __kasan_check_read+0x11/0x20 [ 128.382306][ T601] ? delete_node+0x759/0x7b0 [ 128.386880][ T601] ? __kasan_check_write+0x14/0x20 [ 128.391974][ T601] ? idr_replace+0x1c4/0x230 [ 128.396549][ T601] ? idr_get_next+0x4b0/0x4b0 [ 128.401201][ T601] ? _raw_spin_lock_bh+0xa3/0x1b0 [ 128.406206][ T601] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 128.411381][ T601] css_populate_dir+0x137/0x370 [ 128.416221][ T601] cgroup_apply_control_enable+0x8b9/0x12f0 [ 128.422099][ T601] cgroup_apply_control+0x93/0x710 [ 128.427194][ T601] ? css_next_child+0x160/0x160 [ 128.432028][ T601] ? stack_trace_save+0x12d/0x1f0 [ 128.437041][ T601] ? io_schedule+0x120/0x120 [ 128.441619][ T601] ? kernfs_fop_write_iter+0x15e/0x410 [ 128.447058][ T601] ? __kasan_check_write+0x14/0x20 [ 128.452149][ T601] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 128.457410][ T601] cgroup_subtree_control_write+0xd19/0x1310 [ 128.463372][ T601] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 128.469326][ T601] ? __kasan_check_write+0x14/0x20 [ 128.474422][ T601] ? _copy_from_iter+0x3fb/0xd60 [ 128.479351][ T601] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 128.485321][ T601] cgroup_file_write+0x28e/0x590 [ 128.490246][ T601] ? cgroup_seqfile_stop+0xc0/0xc0 [ 128.495350][ T601] ? mutex_lock+0xa6/0x110 [ 128.499744][ T601] ? mutex_trylock+0xb0/0xb0 [ 128.504309][ T601] ? __kasan_check_write+0x14/0x20 [ 128.509409][ T601] kernfs_fop_write_iter+0x2d0/0x410 [ 128.514767][ T601] ? cgroup_seqfile_stop+0xc0/0xc0 [ 128.519853][ T601] vfs_write+0xc1c/0xf40 [ 128.524074][ T601] ? __kasan_check_write+0x14/0x20 [ 128.529161][ T601] ? kernel_write+0x3c0/0x3c0 [ 128.533813][ T601] ? _raw_spin_unlock_irq+0x4e/0x70 [ 128.538986][ T601] ? ptrace_stop+0x6ff/0x9f0 [ 128.543554][ T601] ? __kasan_check_read+0x11/0x20 [ 128.548553][ T601] ? __fdget_pos+0x27e/0x310 [ 128.553116][ T601] ksys_write+0x198/0x2c0 [ 128.557421][ T601] ? do_notify_parent+0xa60/0xa60 [ 128.562421][ T601] ? __ia32_sys_read+0x90/0x90 [ 128.567160][ T601] ? __ia32_sys_open+0x270/0x270 [ 128.572072][ T601] __x64_sys_write+0x7b/0x90 [ 128.576639][ T601] do_syscall_64+0x34/0x70 [ 128.581032][ T601] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 128.586904][ T601] RIP: 0033:0x7fc8ece62c09 [ 128.591297][ T601] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 128.610875][ T601] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 382] umount2("./39/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 382] umount2("./39/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./39/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 382] umount2("./39/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] openat(AT_FDCWD, "./39/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 382] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 382] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 382] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 382] close(4) = 0 [pid 382] rmdir("./39/file0") = 0 [pid 382] umount2("./39/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./39/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 382] unlink("./39/cgroup.cpu") = 0 [pid 382] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 382] close(3) = 0 [pid 382] rmdir("./39") = 0 [pid 382] mkdir("./40", 0777) = 0 [pid 382] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556fab5d0) = 42 ./strace-static-x86_64: Process 606 attached [pid 606] chdir("./40") = 0 [pid 606] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 606] setpgid(0, 0) = 0 [pid 606] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 606] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [pid 606] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 606] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 606] write(3, "1000", 4) = 4 [pid 606] close(3) = 0 [pid 606] symlink("/dev/binderfs", "./binderfs") = 0 [pid 606] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 606] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 601] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 606] <... mount resumed>) = 0 [pid 601] close(3 [pid 606] open("./file0", O_RDONLY) = 3 [pid 606] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [pid 606] write(4, "-pids ", 6 [pid 601] <... close resumed>) = 0 [pid 601] close(4) = 0 [pid 601] close(5) = 0 [pid 601] close(6) = -1 EBADF (Bad file descriptor) [pid 601] close(7) = -1 EBADF (Bad file descriptor) [pid 601] close(8) = -1 EBADF (Bad file descriptor) [pid 601] close(9) = -1 EBADF (Bad file descriptor) [pid 601] close(10) = -1 EBADF (Bad file descriptor) [pid 601] close(11) = -1 EBADF (Bad file descriptor) [pid 601] close(12) = -1 EBADF (Bad file descriptor) [pid 601] close(13) = -1 EBADF (Bad file descriptor) [pid 601] close(14) = -1 EBADF (Bad file descriptor) [pid 601] close(15) = -1 EBADF (Bad file descriptor) [pid 601] close(16) = -1 EBADF (Bad file descriptor) [pid 601] close(17) = -1 EBADF (Bad file descriptor) [pid 601] close(18) = -1 EBADF (Bad file descriptor) [pid 601] close(19) = -1 EBADF (Bad file descriptor) [pid 601] close(20) = -1 EBADF (Bad file descriptor) [pid 601] close(21) = -1 EBADF (Bad file descriptor) [pid 601] close(22) = -1 EBADF (Bad file descriptor) [pid 601] close(23) = -1 EBADF (Bad file descriptor) [pid 601] close(24) = -1 EBADF (Bad file descriptor) [pid 601] close(25) = -1 EBADF (Bad file descriptor) [pid 601] close(26) = -1 EBADF (Bad file descriptor) [pid 601] close(27) = -1 EBADF (Bad file descriptor) [pid 601] close(28) = -1 EBADF (Bad file descriptor) write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory [pid 601] close(29) = -1 EBADF (Bad file descriptor) [pid 601] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 601] exit_group(0) = ? [pid 601] +++ exited with 0 +++ [pid 375] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=41, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 375] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 375] umount2("./39", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] openat(AT_FDCWD, "./39", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 375] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 375] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 375] umount2("./39/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./39/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 375] unlink("./39/binderfs") = 0 [pid 375] umount2("./39/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./39/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 375] unlink("./39/cgroup") = 0 [pid 375] umount2("./39/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./39/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 375] unlink("./39/cgroup.net") = 0 [ 128.619262][ T601] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 128.627212][ T601] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 128.635159][ T601] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 128.643107][ T601] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 128.651056][ T601] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000027 [ 128.659973][ T601] cgroup: cgroup_addrm_files: failed to add max, err=-12 [ 128.676756][ T375] ------------[ cut here ]------------ [ 128.682260][ T375] WARNING: CPU: 0 PID: 375 at fs/namespace.c:1168 mntput_no_expire+0x48a/0x6c0 [ 128.691225][ T375] Modules linked in: [ 128.695103][ T375] CPU: 0 PID: 375 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 128.706720][ T375] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 128.710396][ T603] FAULT_INJECTION: forcing a failure. [ 128.710396][ T603] name failslab, interval 1, probability 0, space 0, times 0 [ 128.716785][ T375] RIP: 0010:mntput_no_expire+0x48a/0x6c0 [ 128.716802][ T375] Code: 48 c7 c2 80 02 44 86 e8 64 f0 8e ff e9 8b fc ff ff e8 ba 21 b6 ff e9 81 fc ff ff e8 b0 21 b6 ff e9 77 fc ff ff e8 a6 21 b6 ff <0f> 0b e9 f4 fc ff ff e8 9a 21 b6 ff e8 65 ad a2 ff e9 ea fc ff ff [ 128.741670][ T603] CPU: 1 PID: 603 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 128.754579][ T375] RSP: 0018:ffffc9000095fba0 EFLAGS: 00010293 [ 128.766139][ T603] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 128.766143][ T603] Call Trace: [ 128.766160][ T603] dump_stack_lvl+0x1e2/0x24b [ 128.766177][ T603] ? bfq_pos_tree_add_move+0x43e/0x43e [ 128.772208][ T375] [ 128.782279][ T603] ? selinux_kernfs_init_security+0x1a8/0x760 [ 128.782288][ T603] dump_stack+0x15/0x17 [ 128.782307][ T603] should_fail+0x3c0/0x510 [ 128.785567][ T375] RAX: ffffffff81b68f1a RBX: 00000000ffffffff RCX: ffff8881065e13c0 [ 128.790206][ T603] ? __kernfs_new_node+0x99/0x6e0 [ 128.790216][ T603] __should_failslab+0x9f/0xe0 [ 128.790232][ T603] should_failslab+0x9/0x20 [ 128.795657][ T375] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000 [ 128.797960][ T603] __kmalloc_track_caller+0x5f/0x350 [ 128.803997][ T375] RBP: ffffc9000095fc70 R08: ffffffff81b68c08 R09: 0000000000000003 [ 128.808119][ T603] kstrdup_const+0x55/0x90 [ 128.812528][ T375] R10: fffff5200012bf65 R11: 1ffff9200012bf64 R12: dffffc0000000000 [ 128.820445][ T603] __kernfs_new_node+0x99/0x6e0 [ 128.820455][ T603] ? is_module_text_address+0xe1/0x140 [ 128.820470][ T603] ? kernfs_new_node+0x170/0x170 [ 128.825463][ T375] R13: ffff888117099dc0 R14: ffffc9000095fc00 R15: 1ffff9200012bf7c [ 128.830189][ T603] ? ptr_to_hashval+0x60/0x60 [ 128.830198][ T603] ? arch_stack_walk+0xf8/0x140 [ 128.830213][ T603] ? snprintf+0xd6/0x120 [ 128.834683][ T375] FS: 0000555556fab300(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 128.842617][ T603] kernfs_new_node+0x97/0x170 [ 128.842627][ T603] __kernfs_create_file+0x4a/0x270 [ 128.842636][ T603] cgroup_addrm_files+0xab8/0xfe0 [ 128.842655][ T603] ? ____kasan_kmalloc+0xdc/0x110 [ 128.847907][ T375] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 128.855846][ T603] ? __kasan_kmalloc+0x9/0x10 [ 128.855856][ T603] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 128.855872][ T603] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 128.860260][ T375] CR2: 00007ffd7d0e1c18 CR3: 000000011dd54000 CR4: 00000000003506b0 [ 128.868199][ T603] ? delete_node+0x759/0x7b0 [ 128.873031][ T375] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 128.878437][ T603] ? __kasan_check_read+0x11/0x20 [ 128.878445][ T603] ? delete_node+0x759/0x7b0 [ 128.878460][ T603] ? __kasan_check_write+0x14/0x20 [ 128.883369][ T375] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 128.891301][ T603] ? idr_replace+0x1c4/0x230 [ 128.891317][ T603] ? idr_get_next+0x4b0/0x4b0 [ 128.895953][ T375] Call Trace: [ 128.900768][ T603] ? _raw_spin_lock_bh+0xa3/0x1b0 [ 128.900776][ T603] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 128.900786][ T603] css_populate_dir+0x137/0x370 [ 128.900803][ T603] cgroup_apply_control_enable+0x8b9/0x12f0 [ 128.905013][ T375] ? io_schedule+0x120/0x120 [ 128.913907][ T603] cgroup_apply_control+0x93/0x710 [ 128.913927][ T603] ? css_next_child+0x160/0x160 [ 128.918743][ T375] ? vfs_submount+0xb0/0xb0 [ 128.923815][ T603] ? io_schedule+0x120/0x120 [ 128.923825][ T603] ? kernfs_fop_write_iter+0x15e/0x410 [ 128.923840][ T603] ? __kasan_check_write+0x14/0x20 [ 128.928831][ T375] ? shrink_dentry_list+0x4ec/0x500 [ 128.933815][ T603] ? cgroup_kn_lock_live+0x1b0/0x2f0 [pid 375] umount2("./39/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 605] <... write resumed>) = 6 [ 128.933825][ T603] cgroup_subtree_control_write+0xd19/0x1310 [ 128.933841][ T603] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 128.940402][ T375] ? __kasan_check_write+0x14/0x20 [ 128.945041][ T603] ? __kasan_check_write+0x14/0x20 [ 128.950559][ T375] namespace_unlock+0x448/0x4f0 [ 128.956675][ T603] ? _copy_from_iter+0x3fb/0xd60 [ 128.964634][ T375] ? umount_tree+0xf50/0xf50 [ 128.969171][ T603] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 128.977120][ T375] ? __detach_mounts+0x670/0x670 [ 128.982099][ T603] cgroup_file_write+0x28e/0x590 [ 128.982114][ T603] ? cgroup_seqfile_stop+0xc0/0xc0 [ 128.986672][ T375] ? selinux_umount+0xf0/0x130 [ 128.991744][ T603] ? mutex_lock+0xa6/0x110 [ 128.991753][ T603] ? mutex_trylock+0xb0/0xb0 [ 128.991769][ T603] ? __kasan_check_write+0x14/0x20 [ 128.999710][ T375] ? security_sb_umount+0x9d/0xb0 [ 129.004263][ T603] kernfs_fop_write_iter+0x2d0/0x410 [ 129.004278][ T603] ? cgroup_seqfile_stop+0xc0/0xc0 [ 129.008924][ T375] path_umount+0xf03/0xfb0 [ 129.012172][ T603] vfs_write+0xc1c/0xf40 [ 129.012189][ T603] ? __kasan_check_write+0x14/0x20 [ 129.017185][ T375] ? namespace_unlock+0x4f0/0x4f0 [ 129.022344][ T603] ? kernel_write+0x3c0/0x3c0 [ 129.022352][ T603] ? _raw_spin_unlock_irq+0x4e/0x70 [ 129.022361][ T603] ? ptrace_stop+0x6ff/0x9f0 [ 129.022376][ T603] ? __kasan_check_read+0x11/0x20 [ 129.027196][ T375] ? user_path_at_empty+0x40/0x50 [ 129.033050][ T603] ? __fdget_pos+0x27e/0x310 [ 129.033060][ T603] ksys_write+0x198/0x2c0 [ 129.033076][ T603] ? do_notify_parent+0xa60/0xa60 [ 129.037633][ T375] __x64_sys_umount+0x122/0x170 [ 129.042703][ T603] ? __ia32_sys_read+0x90/0x90 [ 129.042712][ T603] ? __ia32_sys_open+0x270/0x270 [ 129.042727][ T603] __x64_sys_write+0x7b/0x90 [ 129.047543][ T375] ? path_umount+0xfb0/0xfb0 [ 129.052011][ T603] do_syscall_64+0x34/0x70 [ 129.052027][ T603] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 129.056588][ T375] ? syscall_enter_from_user_mode+0x58/0x1b0 [ 129.062007][ T603] RIP: 0033:0x7fc8ece62c09 [ 129.062026][ T603] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 129.067107][ T375] do_syscall_64+0x34/0x70 [ 129.072264][ T603] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 129.072284][ T603] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 129.077541][ T375] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 129.083483][ T603] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 129.083490][ T603] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 129.083496][ T603] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 129.083502][ T603] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000023 [ 129.348326][ T375] RIP: 0033:0x7fc8ece63fb7 [ 129.352768][ T375] Code: 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 605] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 605] write(5, "22", 2) = 2 [ 129.372372][ T375] RSP: 002b:00007ffd7d0e2358 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [ 129.380819][ T375] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc8ece63fb7 [ 129.388782][ T375] RDX: 00007ffd7d0e241a RSI: 000000000000000a RDI: 00007ffd7d0e2410 [ 129.396756][ T375] RBP: 00007ffd7d0e2410 R08: 00000000ffffffff R09: 00007ffd7d0e21f0 [ 129.404725][ T375] R10: 0000555556fad6a3 R11: 0000000000000202 R12: 00007ffd7d0e3490 [ 129.412705][ T375] R13: 0000555556fad600 R14: 00007ffd7d0e2380 R15: 0000000000000028 [ 129.420689][ T375] ---[ end trace d4de1ca9cdcd1984 ]--- [pid 605] write(4, "+pids ", 6 [pid 603] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 603] close(3) = 0 [pid 603] close(4) = 0 [pid 603] close(5) = 0 [pid 603] close(6) = -1 EBADF (Bad file descriptor) [pid 603] close(7) = -1 EBADF (Bad file descriptor) [pid 603] close(8) = -1 EBADF (Bad file descriptor) [pid 603] close(9) = -1 EBADF (Bad file descriptor) [pid 603] close(10) = -1 EBADF (Bad file descriptor) [pid 603] close(11) = -1 EBADF (Bad file descriptor) [pid 603] close(12) = -1 EBADF (Bad file descriptor) [pid 603] close(13) = -1 EBADF (Bad file descriptor) [pid 603] close(14) = -1 EBADF (Bad file descriptor) [pid 603] close(15) = -1 EBADF (Bad file descriptor) [pid 603] close(16) = -1 EBADF (Bad file descriptor) [pid 603] close(17) = -1 EBADF (Bad file descriptor) [pid 603] close(18) = -1 EBADF (Bad file descriptor) [pid 603] close(19) = -1 EBADF (Bad file descriptor) [pid 603] close(20) = -1 EBADF (Bad file descriptor) [pid 603] close(21) = -1 EBADF (Bad file descriptor) [pid 603] close(22) = -1 EBADF (Bad file descriptor) [pid 603] close(23) = -1 EBADF (Bad file descriptor) [pid 603] close(24) = -1 EBADF (Bad file descriptor) [pid 603] close(25) = -1 EBADF (Bad file descriptor) [pid 603] close(26) = -1 EBADF (Bad file descriptor) [pid 603] close(27) = -1 EBADF (Bad file descriptor) [pid 603] close(28) = -1 EBADF (Bad file descriptor) [pid 603] close(29) = -1 EBADF (Bad file descriptor) [pid 603] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory ) = 89 [pid 603] exit_group(0) = ? [pid 603] +++ exited with 0 +++ [pid 381] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=37, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 381] restart_syscall(<... resuming interrupted clone ...>) = 0 [ 129.426193][ T375] ------------[ cut here ]------------ [ 129.431688][ T375] WARNING: CPU: 0 PID: 375 at fs/namespace.c:1168 mntput_no_expire+0x48a/0x6c0 [ 129.440734][ T375] Modules linked in: [ 129.441159][ T603] cgroup: cgroup_addrm_files: failed to add max, err=-12 [ 129.444634][ T375] CPU: 0 PID: 375 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 129.444641][ T375] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 129.444657][ T375] RIP: 0010:mntput_no_expire+0x48a/0x6c0 [ 129.444673][ T375] Code: 48 c7 c2 80 02 44 86 e8 64 f0 8e ff e9 8b fc ff ff e8 ba 21 b6 ff e9 81 fc ff ff e8 b0 21 b6 ff e9 77 fc ff ff e8 a6 21 b6 ff <0f> 0b e9 f4 fc ff ff e8 9a 21 b6 ff e8 65 ad a2 ff e9 ea fc ff ff [ 129.498614][ T375] RSP: 0018:ffffc9000095fca0 EFLAGS: 00010293 [ 129.504705][ T375] RAX: ffffffff81b68f1a RBX: 00000000fffffffe RCX: ffff8881065e13c0 [ 129.512686][ T375] RDX: 0000000000000000 RSI: 00000000fffffffe RDI: 0000000000000000 [ 129.520677][ T375] RBP: ffffc9000095fd70 R08: ffffffff81b68c08 R09: 0000000000000003 [ 129.528644][ T375] R10: fffff5200012bf85 R11: 1ffff9200012bf84 R12: dffffc0000000000 [ 129.536624][ T375] R13: ffff888117099dc0 R14: ffffc9000095fd00 R15: 1ffff9200012bf9c [ 129.544599][ T375] FS: 0000555556fab300(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 129.553540][ T375] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 129.560112][ T375] CR2: 00007ffd7d0e1c18 CR3: 000000011dd54000 CR4: 00000000003506b0 [ 129.568126][ T375] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 129.576104][ T375] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 129.584071][ T375] Call Trace: [ 129.587355][ T375] ? lockref_get_or_lock+0x340/0x340 [ 129.592650][ T375] ? umount_tree+0xf50/0xf50 [ 129.597226][ T375] ? vfs_submount+0xb0/0xb0 [ 129.601722][ T375] ? dput+0x2b6/0x320 [ 129.605682][ T375] path_umount+0x1fe/0xfb0 [ 129.610076][ T375] ? namespace_unlock+0x4f0/0x4f0 [ 129.615099][ T375] ? user_path_at_empty+0x40/0x50 [ 129.620104][ T375] __x64_sys_umount+0x122/0x170 [ 129.624948][ T375] ? path_umount+0xfb0/0xfb0 [ 129.629516][ T375] ? syscall_enter_from_user_mode+0x58/0x1b0 [ 129.635489][ T375] do_syscall_64+0x34/0x70 [ 129.639882][ T375] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 129.645773][ T375] RIP: 0033:0x7fc8ece63fb7 [ 129.650174][ T375] Code: 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 129.669801][ T375] RSP: 002b:00007ffd7d0e2358 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [pid 381] umount2("./35", MNT_DETACH|UMOUNT_NOFOLLOW [pid 375] <... umount2 resumed>) = 0 [pid 375] umount2("./39/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./39/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 375] umount2("./39/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] openat(AT_FDCWD, "./39/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 375] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 375] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 375] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 375] close(4) = 0 [pid 381] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 375] rmdir("./39/file0" [pid 381] openat(AT_FDCWD, "./35", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 381] fstat(3, [pid 375] <... rmdir resumed>) = 0 [pid 381] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 381] getdents64(3, [pid 375] umount2("./39/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./39/cgroup.cpu", [pid 381] <... getdents64 resumed>0x555556fad630 /* 7 entries */, 32768) = 208 [pid 375] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 375] unlink("./39/cgroup.cpu" [pid 381] umount2("./35/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./35/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 381] unlink("./35/binderfs") = 0 [pid 375] <... unlink resumed>) = 0 [pid 381] umount2("./35/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./35/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 381] unlink("./35/cgroup" [pid 375] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 381] <... unlink resumed>) = 0 [pid 381] umount2("./35/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] close(3 [pid 381] lstat("./35/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 381] unlink("./35/cgroup.net" [pid 375] <... close resumed>) = 0 [pid 381] <... unlink resumed>) = 0 [pid 375] rmdir("./39" [pid 381] umount2("./35/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 381] umount2("./35/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] <... rmdir resumed>) = 0 [pid 381] lstat("./35/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 381] umount2("./35/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] openat(AT_FDCWD, "./35/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 375] mkdir("./40", 0777 [pid 381] <... openat resumed>) = 4 [pid 381] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 381] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 381] getdents64(4, [pid 375] <... mkdir resumed>) = 0 [pid 381] <... getdents64 resumed>0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 381] close(4) = 0 [pid 381] rmdir("./35/file0" [pid 375] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 381] <... rmdir resumed>) = 0 [pid 381] umount2("./35/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 607 attached [pid 607] chdir("./40" [pid 375] <... clone resumed>, child_tidptr=0x555556fab5d0) = 42 [pid 607] <... chdir resumed>) = 0 [pid 607] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 607] setpgid(0, 0) = 0 [pid 607] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 607] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 607] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 607] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 381] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 607] write(3, "1000", 4) = 4 [ 129.678208][ T375] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc8ece63fb7 [ 129.686176][ T375] RDX: 00007ffd7d0e241a RSI: 000000000000000a RDI: 00007ffd7d0e2410 [ 129.694145][ T375] RBP: 00007ffd7d0e2410 R08: 00000000ffffffff R09: 00007ffd7d0e21f0 [ 129.702110][ T375] R10: 0000555556fad6a3 R11: 0000000000000202 R12: 00007ffd7d0e3490 [ 129.710058][ T375] R13: 0000555556fad600 R14: 00007ffd7d0e2380 R15: 0000000000000028 [ 129.718039][ T375] ---[ end trace d4de1ca9cdcd1985 ]--- [pid 381] lstat("./35/cgroup.cpu", [pid 607] close(3) = 0 [pid 381] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 607] symlink("/dev/binderfs", "./binderfs") = 0 [pid 381] unlink("./35/cgroup.cpu" [pid 607] mkdirat(AT_FDCWD, "./file0", 000 [pid 381] <... unlink resumed>) = 0 [pid 607] <... mkdirat resumed>) = 0 [pid 607] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 381] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 381] close(3) = 0 [pid 381] rmdir("./35") = 0 [pid 381] mkdir("./36", 0777) = 0 [pid 381] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556fab5d0) = 38 ./strace-static-x86_64: Process 608 attached [pid 608] chdir("./36") = 0 [pid 608] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 608] setpgid(0, 0) = 0 [pid 608] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [pid 608] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 608] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 608] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 608] write(3, "1000", 4) = 4 [pid 608] close(3) = 0 [pid 608] symlink("/dev/binderfs", "./binderfs") = 0 [pid 608] mkdirat(AT_FDCWD, "./file0", 000) = 0 [ 129.740797][ T605] FAULT_INJECTION: forcing a failure. [ 129.740797][ T605] name failslab, interval 1, probability 0, space 0, times 0 [ 129.753487][ T605] CPU: 1 PID: 605 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 129.765098][ T605] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 129.775141][ T605] Call Trace: [ 129.778445][ T605] dump_stack_lvl+0x1e2/0x24b [ 129.783106][ T605] ? panic+0x7d7/0x7d7 [ 129.787157][ T605] ? bfq_pos_tree_add_move+0x43e/0x43e [ 129.792599][ T605] ? find_next_bit+0xd6/0x120 [ 129.797256][ T605] ? cpumask_next+0x11/0x30 [ 129.801752][ T605] dump_stack+0x15/0x17 [ 129.805889][ T605] should_fail+0x3c0/0x510 [ 129.810277][ T605] ? percpu_ref_init+0xd0/0x330 [ 129.815109][ T605] __should_failslab+0x9f/0xe0 [ 129.819862][ T605] should_failslab+0x9/0x20 [ 129.824344][ T605] kmem_cache_alloc_trace+0x3a/0x330 [ 129.829602][ T605] percpu_ref_init+0xd0/0x330 [ 129.834265][ T605] ? cgroup_setup_root+0xea0/0xea0 [ 129.839362][ T605] cgroup_apply_control_enable+0x3a2/0x12f0 [ 129.845235][ T605] cgroup_apply_control+0x93/0x710 [ 129.850331][ T605] ? css_next_child+0x160/0x160 [ 129.855170][ T605] ? io_schedule+0x120/0x120 [ 129.859734][ T605] ? kernfs_fop_write_iter+0x15e/0x410 [ 129.865164][ T605] ? __kasan_check_write+0x14/0x20 [ 129.870253][ T605] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 129.875512][ T605] cgroup_subtree_control_write+0xd19/0x1310 [ 129.881466][ T605] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 129.887421][ T605] ? __kasan_check_write+0x14/0x20 [ 129.892509][ T605] ? _copy_from_iter+0x3fb/0xd60 [ 129.897421][ T605] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 129.903386][ T605] cgroup_file_write+0x28e/0x590 [ 129.908304][ T605] ? cgroup_seqfile_stop+0xc0/0xc0 [ 129.913406][ T605] ? mutex_lock+0xa6/0x110 [ 129.917794][ T605] ? mutex_trylock+0xb0/0xb0 [ 129.922363][ T605] ? __kasan_check_write+0x14/0x20 [ 129.927463][ T605] kernfs_fop_write_iter+0x2d0/0x410 [ 129.932729][ T605] ? cgroup_seqfile_stop+0xc0/0xc0 [ 129.937822][ T605] vfs_write+0xc1c/0xf40 [ 129.942037][ T605] ? __kasan_check_write+0x14/0x20 [ 129.947130][ T605] ? kernel_write+0x3c0/0x3c0 [ 129.952108][ T605] ? _raw_spin_unlock_irq+0x4e/0x70 [ 129.957289][ T605] ? ptrace_stop+0x6ff/0x9f0 [ 129.961853][ T605] ? __kasan_check_read+0x11/0x20 [ 129.966856][ T605] ? __fdget_pos+0x27e/0x310 [ 129.971429][ T605] ksys_write+0x198/0x2c0 [ 129.975739][ T605] ? do_notify_parent+0xa60/0xa60 [ 129.980738][ T605] ? __ia32_sys_read+0x90/0x90 [ 129.985475][ T605] __x64_sys_write+0x7b/0x90 [ 129.990045][ T605] do_syscall_64+0x34/0x70 [ 129.994447][ T605] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 130.000319][ T605] RIP: 0033:0x7fc8ece62c09 [ 130.004710][ T605] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 130.024295][ T605] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 130.032696][ T605] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [pid 608] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 607] <... mount resumed>) = 0 [pid 605] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 608] open("./file0", O_RDONLY [pid 607] open("./file0", O_RDONLY [pid 605] close(3 [pid 608] <... open resumed>) = 3 [pid 607] <... open resumed>) = 3 [pid 605] <... close resumed>) = 0 [pid 608] openat(3, "cgroup.subtree_control", O_RDWR [pid 607] openat(3, "cgroup.subtree_control", O_RDWR [pid 605] close(4 [pid 608] <... openat resumed>) = 4 [pid 607] <... openat resumed>) = 4 [pid 605] <... close resumed>) = 0 [pid 608] write(4, "-pids ", 6 [pid 607] write(4, "-pids ", 6 [pid 605] close(5) = 0 [pid 605] close(6) = -1 EBADF (Bad file descriptor) [pid 605] close(7) = -1 EBADF (Bad file descriptor) [pid 605] close(8) = -1 EBADF (Bad file descriptor) [pid 605] close(9) = -1 EBADF (Bad file descriptor) [pid 605] close(10) = -1 EBADF (Bad file descriptor) [pid 605] close(11) = -1 EBADF (Bad file descriptor) [pid 605] close(12) = -1 EBADF (Bad file descriptor) [pid 605] close(13) = -1 EBADF (Bad file descriptor) [pid 605] close(14) = -1 EBADF (Bad file descriptor) [pid 605] close(15) = -1 EBADF (Bad file descriptor) [pid 605] close(16) = -1 EBADF (Bad file descriptor) [pid 605] close(17) = -1 EBADF (Bad file descriptor) [pid 605] close(18) = -1 EBADF (Bad file descriptor) [pid 605] close(19) = -1 EBADF (Bad file descriptor) [pid 605] close(20) = -1 EBADF (Bad file descriptor) [pid 605] close(21) = -1 EBADF (Bad file descriptor) [pid 605] close(22) = -1 EBADF (Bad file descriptor) [pid 605] close(23) = -1 EBADF (Bad file descriptor) [pid 605] close(24) = -1 EBADF (Bad file descriptor) [pid 605] close(25) = -1 EBADF (Bad file descriptor) [pid 605] close(26) = -1 EBADF (Bad file descriptor) [pid 605] close(27) = -1 EBADF (Bad file descriptor) [pid 605] close(28) = -1 EBADF (Bad file descriptor) [pid 605] close(29) = -1 EBADF (Bad file descriptor) write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory [pid 605] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 605] exit_group(0) = ? [pid 605] +++ exited with 0 +++ [pid 380] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=35, si_uid=0, si_status=0, si_utime=0, si_stime=27} --- [pid 380] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 380] umount2("./33", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] openat(AT_FDCWD, "./33", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 380] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 380] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 380] umount2("./33/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./33/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 380] unlink("./33/binderfs") = 0 [pid 380] umount2("./33/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./33/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 380] unlink("./33/cgroup") = 0 [pid 380] umount2("./33/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./33/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 380] unlink("./33/cgroup.net") = 0 [pid 380] umount2("./33/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 380] umount2("./33/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./33/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 380] umount2("./33/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] openat(AT_FDCWD, "./33/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 380] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 380] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 380] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 380] close(4) = 0 [pid 380] rmdir("./33/file0") = 0 [pid 380] umount2("./33/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./33/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 380] unlink("./33/cgroup.cpu") = 0 [pid 380] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 380] close(3) = 0 [pid 380] rmdir("./33") = 0 [pid 380] mkdir("./34", 0777) = 0 [pid 380] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 609 attached , child_tidptr=0x555556fab5d0) = 36 [pid 609] chdir("./34") = 0 [pid 609] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 609] setpgid(0, 0) = 0 [pid 609] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 609] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 609] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 609] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 609] write(3, "1000", 4) = 4 [pid 609] close(3) = 0 [pid 609] symlink("/dev/binderfs", "./binderfs") = 0 [pid 609] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 609] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 609] open("./file0", O_RDONLY) = 3 [pid 609] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [ 130.040651][ T605] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 130.048625][ T605] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 130.056584][ T605] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 130.064536][ T605] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000021 [pid 609] write(4, "-pids ", 6) = 6 [pid 608] <... write resumed>) = 6 [pid 607] <... write resumed>) = 6 [pid 609] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 608] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 607] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 609] <... openat resumed>) = 5 [pid 608] <... openat resumed>) = 5 [pid 607] <... openat resumed>) = 5 [pid 609] write(5, "22", 2 [pid 608] write(5, "22", 2 [pid 607] write(5, "22", 2 [pid 609] <... write resumed>) = 2 [pid 608] <... write resumed>) = 2 [pid 607] <... write resumed>) = 2 [pid 609] write(4, "+pids ", 6 [pid 608] write(4, "+pids ", 6 [ 130.100518][ T604] FAULT_INJECTION: forcing a failure. [ 130.100518][ T604] name failslab, interval 1, probability 0, space 0, times 0 [ 130.114931][ T604] CPU: 0 PID: 604 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 130.126550][ T604] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 130.136711][ T604] Call Trace: [ 130.139980][ T604] dump_stack_lvl+0x1e2/0x24b [ 130.144639][ T604] ? panic+0x7d7/0x7d7 [ 130.148866][ T604] ? bfq_pos_tree_add_move+0x43e/0x43e [ 130.154304][ T604] ? find_next_bit+0xd6/0x120 [ 130.158955][ T604] ? cpumask_next+0x11/0x30 [ 130.163432][ T604] dump_stack+0x15/0x17 [ 130.167561][ T604] should_fail+0x3c0/0x510 [ 130.171958][ T604] ? percpu_ref_init+0xd0/0x330 [ 130.176792][ T604] __should_failslab+0x9f/0xe0 [ 130.181540][ T604] should_failslab+0x9/0x20 [ 130.186036][ T604] kmem_cache_alloc_trace+0x3a/0x330 [ 130.191306][ T604] percpu_ref_init+0xd0/0x330 [ 130.195974][ T604] ? cgroup_setup_root+0xea0/0xea0 [ 130.201070][ T604] cgroup_apply_control_enable+0x3a2/0x12f0 [ 130.206946][ T604] cgroup_apply_control+0x93/0x710 [ 130.212043][ T604] ? css_next_child+0x160/0x160 [ 130.216876][ T604] ? stack_trace_save+0x12d/0x1f0 [ 130.221883][ T604] ? io_schedule+0x120/0x120 [ 130.226455][ T604] ? kernfs_fop_write_iter+0x15e/0x410 [ 130.231894][ T604] ? __kasan_check_write+0x14/0x20 [ 130.236989][ T604] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 130.242248][ T604] cgroup_subtree_control_write+0xd19/0x1310 [ 130.248199][ T604] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 130.254161][ T604] ? __kasan_check_write+0x14/0x20 [ 130.259254][ T604] ? _copy_from_iter+0x3fb/0xd60 [ 130.264171][ T604] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 130.270130][ T604] cgroup_file_write+0x28e/0x590 [ 130.275047][ T604] ? cgroup_seqfile_stop+0xc0/0xc0 [ 130.280135][ T604] ? mutex_lock+0xa6/0x110 [ 130.284530][ T604] ? mutex_trylock+0xb0/0xb0 [ 130.289096][ T604] ? __kasan_check_write+0x14/0x20 [ 130.294191][ T604] kernfs_fop_write_iter+0x2d0/0x410 [ 130.299456][ T604] ? cgroup_seqfile_stop+0xc0/0xc0 [ 130.304549][ T604] vfs_write+0xc1c/0xf40 [ 130.308772][ T604] ? __kasan_check_write+0x14/0x20 [ 130.313862][ T604] ? kernel_write+0x3c0/0x3c0 [ 130.318511][ T604] ? _raw_spin_unlock_irq+0x4e/0x70 [ 130.323699][ T604] ? ptrace_stop+0x6ff/0x9f0 [ 130.328267][ T604] ? __kasan_check_read+0x11/0x20 [ 130.333265][ T604] ? __fdget_pos+0x27e/0x310 [ 130.337829][ T604] ksys_write+0x198/0x2c0 [ 130.342139][ T604] ? do_notify_parent+0xa60/0xa60 [ 130.347145][ T604] ? __ia32_sys_read+0x90/0x90 [ 130.351891][ T604] ? __ia32_sys_open+0x270/0x270 [ 130.356811][ T604] __x64_sys_write+0x7b/0x90 [ 130.361391][ T604] do_syscall_64+0x34/0x70 [ 130.365778][ T604] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 130.371641][ T604] RIP: 0033:0x7fc8ece62c09 [ 130.376030][ T604] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 607] write(4, "+pids ", 6 [pid 604] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 604] close(3) = 0 [pid 604] close(4) = 0 [pid 604] close(5) = 0 [pid 604] close(6) = -1 EBADF (Bad file descriptor) [pid 604] close(7) = -1 EBADF (Bad file descriptor) [pid 604] close(8) = -1 EBADF (Bad file descriptor) [pid 604] close(9) = -1 EBADF (Bad file descriptor) [pid 604] close(10) = -1 EBADF (Bad file descriptor) [pid 604] close(11) = -1 EBADF (Bad file descriptor) [pid 604] close(12) = -1 EBADF (Bad file descriptor) [pid 604] close(13) = -1 EBADF (Bad file descriptor) [pid 604] close(14) = -1 EBADF (Bad file descriptor) [pid 604] close(15) = -1 EBADF (Bad file descriptor) [pid 604] close(16) = -1 EBADF (Bad file descriptor) [pid 604] close(17) = -1 EBADF (Bad file descriptor) [pid 604] close(18) = -1 EBADF (Bad file descriptor) [pid 604] close(19) = -1 EBADF (Bad file descriptor) [pid 604] close(20) = -1 EBADF (Bad file descriptor) [pid 604] close(21) = -1 EBADF (Bad file descriptor) [pid 604] close(22) = -1 EBADF (Bad file descriptor) [pid 604] close(23) = -1 EBADF (Bad file descriptor) [pid 604] close(24) = -1 EBADF (Bad file descriptor) [pid 604] close(25) = -1 EBADF (Bad file descriptor) [pid 604] close(26) = -1 EBADF (Bad file descriptor) [pid 604] close(27) = -1 EBADF (Bad file descriptor) [pid 604] close(28) = -1 EBADF (Bad file descriptor) [pid 604] close(29) = -1 EBADF (Bad file descriptor) [pid 604] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory ) = 89 [pid 604] exit_group(0) = ? [pid 604] +++ exited with 0 +++ [pid 383] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=33, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [ 130.395608][ T604] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 130.403994][ T604] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 130.411940][ T604] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 130.420002][ T604] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 130.427963][ T604] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 130.435914][ T604] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 000000000000001f [pid 383] umount2("./31", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] openat(AT_FDCWD, "./31", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 383] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 383] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 383] umount2("./31/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./31/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 383] unlink("./31/binderfs") = 0 [pid 383] umount2("./31/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./31/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 383] unlink("./31/cgroup") = 0 [pid 383] umount2("./31/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./31/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 383] unlink("./31/cgroup.net") = 0 [ 130.460576][ T608] FAULT_INJECTION: forcing a failure. [ 130.460576][ T608] name failslab, interval 1, probability 0, space 0, times 0 [ 130.473241][ T608] CPU: 1 PID: 608 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 130.484875][ T608] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 130.494926][ T608] Call Trace: [ 130.498207][ T608] dump_stack_lvl+0x1e2/0x24b [ 130.502871][ T608] ? bfq_pos_tree_add_move+0x43e/0x43e [ 130.508307][ T608] ? selinux_kernfs_init_security+0x1a8/0x760 [ 130.514347][ T608] dump_stack+0x15/0x17 [ 130.518477][ T608] should_fail+0x3c0/0x510 [ 130.522869][ T608] ? __kernfs_new_node+0x99/0x6e0 [ 130.527878][ T608] __should_failslab+0x9f/0xe0 [ 130.532641][ T608] should_failslab+0x9/0x20 [ 130.537122][ T608] __kmalloc_track_caller+0x5f/0x350 [ 130.542385][ T608] kstrdup_const+0x55/0x90 [ 130.546861][ T608] __kernfs_new_node+0x99/0x6e0 [ 130.551696][ T608] ? is_module_text_address+0xe1/0x140 [ 130.557149][ T608] ? kernfs_new_node+0x170/0x170 [ 130.562069][ T608] ? ptr_to_hashval+0x60/0x60 [ 130.566727][ T608] ? arch_stack_walk+0xf8/0x140 [ 130.571556][ T608] ? snprintf+0xd6/0x120 [ 130.575771][ T608] kernfs_new_node+0x97/0x170 [ 130.580442][ T608] __kernfs_create_file+0x4a/0x270 [ 130.585533][ T608] cgroup_addrm_files+0xab8/0xfe0 [ 130.590556][ T608] ? ____kasan_kmalloc+0xdc/0x110 [ 130.595558][ T608] ? __kasan_kmalloc+0x9/0x10 [ 130.600220][ T608] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 130.605741][ T608] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 130.611873][ T608] ? delete_node+0x759/0x7b0 [ 130.616449][ T608] ? __kasan_check_read+0x11/0x20 [ 130.621446][ T608] ? delete_node+0x759/0x7b0 [ 130.626107][ T608] ? __kasan_check_write+0x14/0x20 [ 130.631201][ T608] ? idr_replace+0x1c4/0x230 [ 130.635772][ T608] ? idr_get_next+0x4b0/0x4b0 [ 130.640458][ T608] ? _raw_spin_lock_bh+0xa3/0x1b0 [ 130.645454][ T608] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 130.650626][ T608] css_populate_dir+0x137/0x370 [ 130.655462][ T608] cgroup_apply_control_enable+0x8b9/0x12f0 [ 130.661349][ T608] cgroup_apply_control+0x93/0x710 [ 130.666443][ T608] ? css_next_child+0x160/0x160 [ 130.671270][ T608] ? io_schedule+0x120/0x120 [ 130.675833][ T608] ? kernfs_fop_write_iter+0x15e/0x410 [ 130.681265][ T608] ? __kasan_check_write+0x14/0x20 [ 130.686371][ T608] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 130.691645][ T608] cgroup_subtree_control_write+0xd19/0x1310 [ 130.697606][ T608] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 130.703569][ T608] ? __kasan_check_write+0x14/0x20 [ 130.708663][ T608] ? _copy_from_iter+0x3fb/0xd60 [ 130.713587][ T608] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 130.719539][ T608] cgroup_file_write+0x28e/0x590 [ 130.724468][ T608] ? cgroup_seqfile_stop+0xc0/0xc0 [ 130.729564][ T608] ? mutex_lock+0xa6/0x110 [ 130.733962][ T608] ? mutex_trylock+0xb0/0xb0 [ 130.738549][ T608] ? __kasan_check_write+0x14/0x20 [ 130.743639][ T608] kernfs_fop_write_iter+0x2d0/0x410 [ 130.748901][ T608] ? cgroup_seqfile_stop+0xc0/0xc0 [ 130.753992][ T608] vfs_write+0xc1c/0xf40 [ 130.758211][ T608] ? __kasan_check_write+0x14/0x20 [ 130.763297][ T608] ? kernel_write+0x3c0/0x3c0 [ 130.767956][ T608] ? _raw_spin_unlock_irq+0x4e/0x70 [ 130.773138][ T608] ? ptrace_stop+0x6ff/0x9f0 [ 130.777714][ T608] ? __kasan_check_read+0x11/0x20 [ 130.782720][ T608] ? __fdget_pos+0x27e/0x310 [ 130.787291][ T608] ksys_write+0x198/0x2c0 [ 130.791625][ T608] ? do_notify_parent+0xa60/0xa60 [ 130.796634][ T608] ? __ia32_sys_read+0x90/0x90 [ 130.801376][ T608] ? __ia32_sys_open+0x270/0x270 [ 130.806297][ T608] __x64_sys_write+0x7b/0x90 [ 130.810862][ T608] do_syscall_64+0x34/0x70 [ 130.815256][ T608] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 130.821127][ T608] RIP: 0033:0x7fc8ece62c09 [ 130.825530][ T608] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 130.845122][ T608] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 130.853528][ T608] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [pid 383] umount2("./31/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 383] umount2("./31/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./31/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 383] umount2("./31/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] openat(AT_FDCWD, "./31/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 383] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 383] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 383] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 383] close(4) = 0 [pid 383] rmdir("./31/file0") = 0 [pid 383] umount2("./31/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./31/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 383] unlink("./31/cgroup.cpu") = 0 [pid 383] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 383] close(3) = 0 [pid 383] rmdir("./31" [pid 608] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 383] <... rmdir resumed>) = 0 [pid 608] close(3 [pid 383] mkdir("./32", 0777 [pid 608] <... close resumed>) = 0 [pid 608] close(4 [pid 383] <... mkdir resumed>) = 0 [pid 608] <... close resumed>) = 0 [pid 608] close(5) = 0 [pid 608] close(6) = -1 EBADF (Bad file descriptor) [pid 608] close(7) = -1 EBADF (Bad file descriptor) [pid 608] close(8) = -1 EBADF (Bad file descriptor) [pid 608] close(9) = -1 EBADF (Bad file descriptor) [pid 608] close(10) = -1 EBADF (Bad file descriptor) [pid 608] close(11) = -1 EBADF (Bad file descriptor) [pid 608] close(12) = -1 EBADF (Bad file descriptor) [pid 608] close(13) = -1 EBADF (Bad file descriptor) [pid 608] close(14) = -1 EBADF (Bad file descriptor) [pid 608] close(15) = -1 EBADF (Bad file descriptor) [pid 608] close(16) = -1 EBADF (Bad file descriptor) [pid 608] close(17) = -1 EBADF (Bad file descriptor) [pid 608] close(18) = -1 EBADF (Bad file descriptor) [pid 608] close(19) = -1 EBADF (Bad file descriptor) [pid 608] close(20) = -1 EBADF (Bad file descriptor) [pid 608] close(21) = -1 EBADF (Bad file descriptor) [pid 608] close(22) = -1 EBADF (Bad file descriptor) [pid 608] close(23) = -1 EBADF (Bad file descriptor) [pid 608] close(24) = -1 EBADF (Bad file descriptor) [pid 608] close(25) = -1 EBADF (Bad file descriptor) [pid 608] close(26) = -1 EBADF (Bad file descriptor) [pid 608] close(27) = -1 EBADF (Bad file descriptor) [pid 608] close(28) = -1 EBADF (Bad file descriptor) [pid 608] close(29) = -1 EBADF (Bad file descriptor) write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory [pid 608] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 608] exit_group(0) = ? [pid 608] +++ exited with 0 +++ [pid 383] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 610 attached [pid 381] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=38, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 610] chdir("./32" [pid 383] <... clone resumed>, child_tidptr=0x555556fab5d0) = 34 [pid 610] <... chdir resumed>) = 0 [pid 610] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 610] setpgid(0, 0) = 0 [pid 610] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 381] umount2("./36", MNT_DETACH|UMOUNT_NOFOLLOW [pid 610] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 610] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [pid 610] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 610] write(3, "1000", 4) = 4 [pid 610] close(3) = 0 [pid 610] symlink("/dev/binderfs", "./binderfs") = 0 [pid 610] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 610] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 610] open("./file0", O_RDONLY) = 3 [pid 610] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [pid 610] write(4, "-pids ", 6 [pid 381] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 381] openat(AT_FDCWD, "./36", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 381] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 381] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 381] umount2("./36/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./36/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 381] unlink("./36/binderfs") = 0 [pid 381] umount2("./36/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./36/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 381] unlink("./36/cgroup") = 0 [pid 381] umount2("./36/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./36/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 381] unlink("./36/cgroup.net") = 0 [pid 381] umount2("./36/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 381] umount2("./36/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./36/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 381] umount2("./36/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] openat(AT_FDCWD, "./36/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 381] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 381] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 381] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 381] close(4) = 0 [pid 381] rmdir("./36/file0") = 0 [pid 381] umount2("./36/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./36/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 381] unlink("./36/cgroup.cpu") = 0 [pid 381] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 381] close(3) = 0 [pid 381] rmdir("./36") = 0 [pid 381] mkdir("./37", 0777) = 0 [pid 381] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556fab5d0) = 39 ./strace-static-x86_64: Process 611 attached [pid 611] chdir("./37") = 0 [pid 611] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 611] setpgid(0, 0) = 0 [pid 611] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [pid 611] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 611] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 611] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 611] write(3, "1000", 4) = 4 [pid 611] close(3) = 0 [pid 611] symlink("/dev/binderfs", "./binderfs") = 0 [pid 611] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 611] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 611] open("./file0", O_RDONLY) = 3 [pid 611] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [ 130.861481][ T608] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 130.869427][ T608] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 130.877378][ T608] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 130.885334][ T608] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000024 [ 130.893742][ T608] cgroup: cgroup_addrm_files: failed to add max, err=-12 [ 130.930430][ T609] FAULT_INJECTION: forcing a failure. [ 130.930430][ T609] name failslab, interval 1, probability 0, space 0, times 0 [ 130.943386][ T609] CPU: 0 PID: 609 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 130.954987][ T609] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 130.965015][ T609] Call Trace: [ 130.968290][ T609] dump_stack_lvl+0x1e2/0x24b [ 130.972949][ T609] ? panic+0x7d7/0x7d7 [ 130.976996][ T609] ? bfq_pos_tree_add_move+0x43e/0x43e [ 130.982442][ T609] ? find_next_bit+0xd6/0x120 [ 130.987100][ T609] ? cpumask_next+0x11/0x30 [ 130.991578][ T609] dump_stack+0x15/0x17 [ 130.995707][ T609] should_fail+0x3c0/0x510 [ 131.000093][ T609] ? percpu_ref_init+0xd0/0x330 [ 131.004924][ T609] __should_failslab+0x9f/0xe0 [ 131.009670][ T609] should_failslab+0x9/0x20 [ 131.014146][ T609] kmem_cache_alloc_trace+0x3a/0x330 [ 131.019406][ T609] percpu_ref_init+0xd0/0x330 [ 131.024057][ T609] ? cgroup_setup_root+0xea0/0xea0 [ 131.029141][ T609] cgroup_apply_control_enable+0x3a2/0x12f0 [ 131.035006][ T609] cgroup_apply_control+0x93/0x710 [ 131.040099][ T609] ? css_next_child+0x160/0x160 [ 131.044931][ T609] ? stack_trace_save+0x12d/0x1f0 [ 131.049938][ T609] ? io_schedule+0x120/0x120 [ 131.054512][ T609] ? kernfs_fop_write_iter+0x15e/0x410 [ 131.059944][ T609] ? __kasan_check_write+0x14/0x20 [ 131.065030][ T609] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 131.070290][ T609] cgroup_subtree_control_write+0xd19/0x1310 [ 131.076243][ T609] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 131.082204][ T609] ? __kasan_check_write+0x14/0x20 [ 131.087301][ T609] ? _copy_from_iter+0x3fb/0xd60 [ 131.092247][ T609] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 131.098199][ T609] cgroup_file_write+0x28e/0x590 [ 131.103125][ T609] ? cgroup_seqfile_stop+0xc0/0xc0 [ 131.108220][ T609] ? mutex_lock+0xa6/0x110 [ 131.112616][ T609] ? mutex_trylock+0xb0/0xb0 [ 131.117200][ T609] ? __kasan_check_write+0x14/0x20 [ 131.122297][ T609] kernfs_fop_write_iter+0x2d0/0x410 [ 131.127554][ T609] ? cgroup_seqfile_stop+0xc0/0xc0 [ 131.132638][ T609] vfs_write+0xc1c/0xf40 [ 131.136866][ T609] ? __kasan_check_write+0x14/0x20 [ 131.141957][ T609] ? kernel_write+0x3c0/0x3c0 [ 131.146619][ T609] ? _raw_spin_unlock_irq+0x4e/0x70 [ 131.151796][ T609] ? ptrace_stop+0x6ff/0x9f0 [ 131.156371][ T609] ? __kasan_check_read+0x11/0x20 [ 131.161368][ T609] ? __fdget_pos+0x27e/0x310 [ 131.165939][ T609] ksys_write+0x198/0x2c0 [ 131.170260][ T609] ? do_notify_parent+0xa60/0xa60 [ 131.175267][ T609] ? __ia32_sys_read+0x90/0x90 [ 131.180011][ T609] ? __ia32_sys_open+0x270/0x270 [ 131.184931][ T609] __x64_sys_write+0x7b/0x90 [ 131.189493][ T609] do_syscall_64+0x34/0x70 [ 131.193894][ T609] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 131.199775][ T609] RIP: 0033:0x7fc8ece62c09 [ 131.204172][ T609] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 611] write(4, "-pids ", 6 [pid 609] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 609] close(3) = 0 [pid 609] close(4) = 0 [pid 609] close(5) = 0 [pid 609] close(6) = -1 EBADF (Bad file descriptor) [pid 609] close(7) = -1 EBADF (Bad file descriptor) [pid 609] close(8) = -1 EBADF (Bad file descriptor) [pid 609] close(9) = -1 EBADF (Bad file descriptor) [pid 609] close(10) = -1 EBADF (Bad file descriptor) [pid 609] close(11) = -1 EBADF (Bad file descriptor) [pid 609] close(12) = -1 EBADF (Bad file descriptor) [pid 609] close(13) = -1 EBADF (Bad file descriptor) [pid 609] close(14) = -1 EBADF (Bad file descriptor) [pid 609] close(15) = -1 EBADF (Bad file descriptor) [pid 609] close(16) = -1 EBADF (Bad file descriptor) [pid 609] close(17) = -1 EBADF (Bad file descriptor) [pid 609] close(18) = -1 EBADF (Bad file descriptor) [pid 609] close(19) = -1 EBADF (Bad file descriptor) [pid 609] close(20) = -1 EBADF (Bad file descriptor) [pid 609] close(21) = -1 EBADF (Bad file descriptor) [pid 609] close(22) = -1 EBADF (Bad file descriptor) [pid 609] close(23) = -1 EBADF (Bad file descriptor) [pid 609] close(24) = -1 EBADF (Bad file descriptor) [pid 609] close(25) = -1 EBADF (Bad file descriptor) [pid 609] close(26) = -1 EBADF (Bad file descriptor) [pid 609] close(27) = -1 EBADF (Bad file descriptor) [pid 609] close(28) = -1 EBADF (Bad file descriptor) [pid 609] close(29) = -1 EBADF (Bad file descriptor) [pid 609] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory ) = 89 [pid 609] exit_group(0) = ? [pid 609] +++ exited with 0 +++ [pid 380] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=36, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 380] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 380] umount2("./34", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] openat(AT_FDCWD, "./34", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 380] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 380] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 380] umount2("./34/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./34/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 380] unlink("./34/binderfs") = 0 [pid 380] umount2("./34/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./34/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 380] unlink("./34/cgroup") = 0 [pid 380] umount2("./34/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./34/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 380] unlink("./34/cgroup.net") = 0 [pid 380] umount2("./34/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 380] umount2("./34/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./34/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 380] umount2("./34/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] openat(AT_FDCWD, "./34/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 380] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 380] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 380] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 380] close(4) = 0 [pid 380] rmdir("./34/file0") = 0 [pid 380] umount2("./34/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./34/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 380] unlink("./34/cgroup.cpu") = 0 [pid 380] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 380] close(3) = 0 [pid 380] rmdir("./34") = 0 [pid 380] mkdir("./35", 0777) = 0 [pid 380] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 612 attached [pid 612] chdir("./35") = 0 [pid 380] <... clone resumed>, child_tidptr=0x555556fab5d0) = 37 [pid 612] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 612] setpgid(0, 0) = 0 [pid 612] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 612] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 612] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 612] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 612] write(3, "1000", 4) = 4 [pid 612] close(3) = 0 [pid 612] symlink("/dev/binderfs", "./binderfs") = 0 [pid 612] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 612] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 376] kill(-39, SIGKILL [pid 612] <... mount resumed>) = 0 [pid 376] <... kill resumed>) = 0 [pid 612] open("./file0", O_RDONLY) = 3 [pid 376] kill(39, SIGKILL [pid 612] openat(3, "cgroup.subtree_control", O_RDWR [pid 376] <... kill resumed>) = 0 [pid 612] <... openat resumed>) = 4 [ 131.223750][ T609] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 131.232152][ T609] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 131.240112][ T609] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 131.248065][ T609] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 131.256021][ T609] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 131.263982][ T609] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000022 [pid 612] write(4, "-pids ", 6) = 6 [pid 611] <... write resumed>) = 6 [pid 606] <... write resumed>) = 6 [pid 612] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 606] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 612] <... openat resumed>) = 5 [pid 606] <... openat resumed>) = 5 [pid 612] write(5, "22", 2 [pid 606] write(5, "22", 2 [pid 612] <... write resumed>) = 2 [pid 606] <... write resumed>) = 2 [pid 612] write(4, "+pids ", 6 [pid 606] write(4, "+pids ", 6 [pid 611] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 611] write(5, "22", 2) = 2 [ 131.310602][ T607] FAULT_INJECTION: forcing a failure. [ 131.310602][ T607] name failslab, interval 1, probability 0, space 0, times 0 [ 131.324033][ T607] CPU: 0 PID: 607 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 131.335656][ T607] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 131.345698][ T607] Call Trace: [ 131.348982][ T607] dump_stack_lvl+0x1e2/0x24b [ 131.353644][ T607] ? bfq_pos_tree_add_move+0x43e/0x43e [ 131.359078][ T607] ? selinux_kernfs_init_security+0x1a8/0x760 [ 131.365128][ T607] dump_stack+0x15/0x17 [ 131.369262][ T607] should_fail+0x3c0/0x510 [ 131.373677][ T607] ? __kernfs_new_node+0x99/0x6e0 [ 131.378687][ T607] __should_failslab+0x9f/0xe0 [ 131.383428][ T607] should_failslab+0x9/0x20 [ 131.387914][ T607] __kmalloc_track_caller+0x5f/0x350 [ 131.393187][ T607] kstrdup_const+0x55/0x90 [ 131.397576][ T607] __kernfs_new_node+0x99/0x6e0 [ 131.402400][ T607] ? is_module_text_address+0xe1/0x140 [ 131.407830][ T607] ? kernfs_new_node+0x170/0x170 [ 131.412747][ T607] ? ptr_to_hashval+0x60/0x60 [ 131.417406][ T607] ? arch_stack_walk+0xf8/0x140 [ 131.422236][ T607] ? snprintf+0xd6/0x120 [ 131.426480][ T607] kernfs_new_node+0x97/0x170 [ 131.431149][ T607] __kernfs_create_file+0x4a/0x270 [ 131.436244][ T607] cgroup_addrm_files+0xab8/0xfe0 [ 131.441249][ T607] ? ____kasan_kmalloc+0xdc/0x110 [ 131.446255][ T607] ? __kasan_kmalloc+0x9/0x10 [ 131.450922][ T607] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 131.456473][ T607] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 131.462612][ T607] ? delete_node+0x759/0x7b0 [ 131.467205][ T607] ? __kasan_check_read+0x11/0x20 [ 131.472230][ T607] ? delete_node+0x759/0x7b0 [ 131.476802][ T607] ? __kasan_check_write+0x14/0x20 [ 131.482014][ T607] ? idr_replace+0x1c4/0x230 [ 131.486587][ T607] ? idr_get_next+0x4b0/0x4b0 [ 131.491259][ T607] ? _raw_spin_lock_bh+0xa3/0x1b0 [ 131.496266][ T607] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 131.501446][ T607] css_populate_dir+0x137/0x370 [ 131.506282][ T607] cgroup_apply_control_enable+0x8b9/0x12f0 [ 131.512171][ T607] cgroup_apply_control+0x93/0x710 [ 131.517271][ T607] ? css_next_child+0x160/0x160 [ 131.522101][ T607] ? stack_trace_save+0x12d/0x1f0 [ 131.527116][ T607] ? io_schedule+0x120/0x120 [ 131.531697][ T607] ? kernfs_fop_write_iter+0x15e/0x410 [ 131.537145][ T607] ? __kasan_check_write+0x14/0x20 [ 131.542253][ T607] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 131.547519][ T607] cgroup_subtree_control_write+0xd19/0x1310 [ 131.553479][ T607] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 131.559442][ T607] ? __kasan_check_write+0x14/0x20 [ 131.564540][ T607] ? _copy_from_iter+0x3fb/0xd60 [ 131.569463][ T607] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 131.575425][ T607] cgroup_file_write+0x28e/0x590 [ 131.580348][ T607] ? cgroup_seqfile_stop+0xc0/0xc0 [ 131.585442][ T607] ? mutex_lock+0xa6/0x110 [ 131.589841][ T607] ? mutex_trylock+0xb0/0xb0 [ 131.594412][ T607] ? __kasan_check_write+0x14/0x20 [ 131.599501][ T607] kernfs_fop_write_iter+0x2d0/0x410 [ 131.604765][ T607] ? cgroup_seqfile_stop+0xc0/0xc0 [ 131.609856][ T607] vfs_write+0xc1c/0xf40 [ 131.614078][ T607] ? __kasan_check_write+0x14/0x20 [ 131.619166][ T607] ? kernel_write+0x3c0/0x3c0 [ 131.623820][ T607] ? _raw_spin_unlock_irq+0x4e/0x70 [ 131.628996][ T607] ? ptrace_stop+0x6ff/0x9f0 [ 131.633565][ T607] ? __kasan_check_read+0x11/0x20 [ 131.638569][ T607] ? __fdget_pos+0x27e/0x310 [ 131.643138][ T607] ksys_write+0x198/0x2c0 [ 131.647446][ T607] ? do_notify_parent+0xa60/0xa60 [ 131.652447][ T607] ? __ia32_sys_read+0x90/0x90 [ 131.657186][ T607] ? __ia32_sys_open+0x270/0x270 [ 131.662103][ T607] __x64_sys_write+0x7b/0x90 [ 131.666670][ T607] do_syscall_64+0x34/0x70 [ 131.671066][ T607] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 131.676934][ T607] RIP: 0033:0x7fc8ece62c09 [ 131.681331][ T607] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 131.700912][ T607] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 611] write(4, "+pids ", 6 [pid 607] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 607] close(3) = 0 [pid 607] close(4) = 0 [pid 607] close(5) = 0 [pid 607] close(6) = -1 EBADF (Bad file descriptor) [pid 607] close(7) = -1 EBADF (Bad file descriptor) [pid 607] close(8) = -1 EBADF (Bad file descriptor) [pid 607] close(9) = -1 EBADF (Bad file descriptor) [pid 607] close(10) = -1 EBADF (Bad file descriptor) [pid 607] close(11) = -1 EBADF (Bad file descriptor) [pid 607] close(12) = -1 EBADF (Bad file descriptor) [pid 607] close(13) = -1 EBADF (Bad file descriptor) [pid 607] close(14) = -1 EBADF (Bad file descriptor) [pid 607] close(15) = -1 EBADF (Bad file descriptor) [pid 607] close(16) = -1 EBADF (Bad file descriptor) [pid 607] close(17) = -1 EBADF (Bad file descriptor) [pid 607] close(18) = -1 EBADF (Bad file descriptor) [pid 607] close(19) = -1 EBADF (Bad file descriptor) [pid 607] close(20) = -1 EBADF (Bad file descriptor) [pid 607] close(21) = -1 EBADF (Bad file descriptor) [pid 607] close(22) = -1 EBADF (Bad file descriptor) [pid 607] close(23) = -1 EBADF (Bad file descriptor) [pid 607] close(24) = -1 EBADF (Bad file descriptor) [pid 607] close(25) = -1 EBADF (Bad file descriptor) [pid 607] close(26) = -1 EBADF (Bad file descriptor) [pid 607] close(27) = -1 EBADF (Bad file descriptor) [pid 607] close(28) = -1 EBADF (Bad file descriptor) [pid 607] close(29) = -1 EBADF (Bad file descriptor) [pid 607] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory ) = 89 [pid 607] exit_group(0) = ? [pid 607] +++ exited with 0 +++ [pid 375] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=42, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 375] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 375] umount2("./40", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] openat(AT_FDCWD, "./40", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 375] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 375] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 375] umount2("./40/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./40/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 375] unlink("./40/binderfs") = 0 [pid 375] umount2("./40/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./40/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 375] unlink("./40/cgroup") = 0 [pid 375] umount2("./40/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./40/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 375] unlink("./40/cgroup.net") = 0 [pid 375] umount2("./40/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 375] umount2("./40/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./40/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 375] umount2("./40/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] openat(AT_FDCWD, "./40/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 375] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 375] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 375] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 375] close(4) = 0 [pid 375] rmdir("./40/file0") = 0 [pid 375] umount2("./40/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./40/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 375] unlink("./40/cgroup.cpu") = 0 [pid 375] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 375] close(3) = 0 [pid 375] rmdir("./40") = 0 [pid 375] mkdir("./41", 0777) = 0 [pid 375] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556fab5d0) = 43 ./strace-static-x86_64: Process 613 attached [pid 613] chdir("./41") = 0 [pid 613] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 613] setpgid(0, 0) = 0 [pid 613] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 613] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 613] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 613] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 613] write(3, "1000", 4) = 4 [pid 613] close(3) = 0 [pid 613] symlink("/dev/binderfs", "./binderfs") = 0 [pid 613] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 613] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 613] open("./file0", O_RDONLY) = 3 [pid 613] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [ 131.709303][ T607] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 131.717259][ T607] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 131.725209][ T607] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 131.733156][ T607] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 131.741105][ T607] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000028 [ 131.751885][ T607] cgroup: cgroup_addrm_files: failed to add max, err=-12 [ 131.800410][ T606] FAULT_INJECTION: forcing a failure. [ 131.800410][ T606] name failslab, interval 1, probability 0, space 0, times 0 [ 131.813350][ T606] CPU: 1 PID: 606 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 131.824951][ T606] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 131.834983][ T606] Call Trace: [ 131.838265][ T606] dump_stack_lvl+0x1e2/0x24b [ 131.842933][ T606] ? bfq_pos_tree_add_move+0x43e/0x43e [ 131.848377][ T606] ? selinux_kernfs_init_security+0x1a8/0x760 [ 131.854433][ T606] dump_stack+0x15/0x17 [ 131.858562][ T606] should_fail+0x3c0/0x510 [ 131.862953][ T606] ? __kernfs_new_node+0x99/0x6e0 [ 131.867960][ T606] __should_failslab+0x9f/0xe0 [ 131.872719][ T606] should_failslab+0x9/0x20 [ 131.877213][ T606] __kmalloc_track_caller+0x5f/0x350 [ 131.882481][ T606] kstrdup_const+0x55/0x90 [ 131.886875][ T606] __kernfs_new_node+0x99/0x6e0 [ 131.891707][ T606] ? is_module_text_address+0xe1/0x140 [pid 613] write(4, "-pids ", 6 [pid 376] openat(AT_FDCWD, "/sys/fs/fuse/connections", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 376] fstat(3, {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0 [pid 376] getdents64(3, 0x555556fad630 /* 2 entries */, 32768) = 48 [pid 376] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 376] close(3) = 0 [ 131.897165][ T606] ? kernfs_new_node+0x170/0x170 [ 131.902099][ T606] ? ptr_to_hashval+0x60/0x60 [ 131.906761][ T606] ? arch_stack_walk+0xf8/0x140 [ 131.911600][ T606] ? snprintf+0xd6/0x120 [ 131.915827][ T606] kernfs_new_node+0x97/0x170 [ 131.920487][ T606] __kernfs_create_file+0x4a/0x270 [ 131.925590][ T606] cgroup_addrm_files+0xab8/0xfe0 [ 131.930596][ T606] ? ____kasan_kmalloc+0xdc/0x110 [ 131.935593][ T606] ? __kasan_kmalloc+0x9/0x10 [ 131.940249][ T606] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 131.945783][ T606] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 131.951913][ T606] ? delete_node+0x759/0x7b0 [ 131.956746][ T606] ? __kasan_check_read+0x11/0x20 [ 131.961743][ T606] ? delete_node+0x759/0x7b0 [ 131.966305][ T606] ? __kasan_check_write+0x14/0x20 [ 131.971422][ T606] ? idr_replace+0x1c4/0x230 [ 131.975987][ T606] ? idr_get_next+0x4b0/0x4b0 [ 131.980642][ T606] ? _raw_spin_lock_bh+0xa3/0x1b0 [ 131.985648][ T606] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 131.990825][ T606] css_populate_dir+0x137/0x370 [ 131.995650][ T606] cgroup_apply_control_enable+0x8b9/0x12f0 [ 132.001523][ T606] cgroup_apply_control+0x93/0x710 [ 132.006618][ T606] ? css_next_child+0x160/0x160 [ 132.011534][ T606] ? stack_trace_save+0x12d/0x1f0 [ 132.016545][ T606] ? io_schedule+0x120/0x120 [ 132.021116][ T606] ? kernfs_fop_write_iter+0x15e/0x410 [ 132.026558][ T606] ? __kasan_check_write+0x14/0x20 [ 132.031645][ T606] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 132.036904][ T606] cgroup_subtree_control_write+0xd19/0x1310 [ 132.042859][ T606] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 132.048823][ T606] ? __kasan_check_write+0x14/0x20 [ 132.053922][ T606] ? _copy_from_iter+0x3fb/0xd60 [ 132.058920][ T606] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 132.064873][ T606] cgroup_file_write+0x28e/0x590 [ 132.069796][ T606] ? cgroup_seqfile_stop+0xc0/0xc0 [ 132.074889][ T606] ? mutex_lock+0xa6/0x110 [ 132.079281][ T606] ? mutex_trylock+0xb0/0xb0 [ 132.083856][ T606] ? __kasan_check_write+0x14/0x20 [ 132.088951][ T606] kernfs_fop_write_iter+0x2d0/0x410 [ 132.094212][ T606] ? cgroup_seqfile_stop+0xc0/0xc0 [ 132.099297][ T606] vfs_write+0xc1c/0xf40 [ 132.103517][ T606] ? __kasan_check_write+0x14/0x20 [ 132.108611][ T606] ? kernel_write+0x3c0/0x3c0 [ 132.113272][ T606] ? _raw_spin_unlock_irq+0x4e/0x70 [ 132.118455][ T606] ? ptrace_stop+0x6ff/0x9f0 [ 132.123029][ T606] ? __kasan_check_read+0x11/0x20 [ 132.128066][ T606] ? __fdget_pos+0x27e/0x310 [ 132.132638][ T606] ksys_write+0x198/0x2c0 [ 132.136944][ T606] ? do_notify_parent+0xa60/0xa60 [ 132.141952][ T606] ? __ia32_sys_read+0x90/0x90 [ 132.146700][ T606] ? __ia32_sys_open+0x270/0x270 [ 132.151618][ T606] __x64_sys_write+0x7b/0x90 [ 132.156196][ T606] do_syscall_64+0x34/0x70 [ 132.160588][ T606] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 132.166455][ T606] RIP: 0033:0x7fc8ece62c09 [ 132.170851][ T606] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 132.190448][ T606] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 606] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 606] close(3) = 0 [pid 606] close(4) = 0 [pid 606] close(5) = 0 [pid 606] close(6) = -1 EBADF (Bad file descriptor) [pid 606] close(7) = -1 EBADF (Bad file descriptor) [pid 606] close(8) = -1 EBADF (Bad file descriptor) [pid 606] close(9) = -1 EBADF (Bad file descriptor) [pid 606] close(10) = -1 EBADF (Bad file descriptor) [pid 606] close(11) = -1 EBADF (Bad file descriptor) [pid 606] close(12) = -1 EBADF (Bad file descriptor) [pid 606] close(13) = -1 EBADF (Bad file descriptor) [pid 606] close(14) = -1 EBADF (Bad file descriptor) [pid 606] close(15) = -1 EBADF (Bad file descriptor) [pid 606] close(16) = -1 EBADF (Bad file descriptor) [pid 606] close(17) = -1 EBADF (Bad file descriptor) [pid 606] close(18) = -1 EBADF (Bad file descriptor) [pid 606] close(19) = -1 EBADF (Bad file descriptor) [pid 606] close(20) = -1 EBADF (Bad file descriptor) [pid 606] close(21) = -1 EBADF (Bad file descriptor) [pid 606] close(22) = -1 EBADF (Bad file descriptor) [pid 606] close(23) = -1 EBADF (Bad file descriptor) [pid 606] close(24) = -1 EBADF (Bad file descriptor) [pid 606] close(25) = -1 EBADF (Bad file descriptor) [pid 606] close(26) = -1 EBADF (Bad file descriptor) [pid 606] close(27) = -1 EBADF (Bad file descriptor) [pid 606] close(28) = -1 EBADF (Bad file descriptor) [pid 606] close(29) = -1 EBADF (Bad file descriptor) [pid 606] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory ) = 89 [pid 606] exit_group(0) = ? [pid 606] +++ exited with 0 +++ [pid 382] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=42, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 382] umount2("./40", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] openat(AT_FDCWD, "./40", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 382] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 382] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 382] umount2("./40/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./40/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 382] unlink("./40/binderfs") = 0 [pid 382] umount2("./40/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./40/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 382] unlink("./40/cgroup") = 0 [pid 382] umount2("./40/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./40/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 382] unlink("./40/cgroup.net") = 0 [pid 382] umount2("./40/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 382] umount2("./40/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./40/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 382] umount2("./40/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] openat(AT_FDCWD, "./40/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 382] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 382] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 382] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 382] close(4) = 0 [pid 382] rmdir("./40/file0") = 0 [pid 382] umount2("./40/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./40/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 382] unlink("./40/cgroup.cpu") = 0 [pid 382] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 382] close(3) = 0 [pid 382] rmdir("./40") = 0 [pid 382] mkdir("./41", 0777) = 0 [pid 382] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 614 attached , child_tidptr=0x555556fab5d0) = 43 [pid 614] chdir("./41") = 0 [pid 614] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 614] setpgid(0, 0) = 0 [pid 614] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 614] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [pid 614] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 614] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 614] write(3, "1000", 4) = 4 [pid 614] close(3) = 0 [pid 614] symlink("/dev/binderfs", "./binderfs") = 0 [pid 614] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 614] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 614] open("./file0", O_RDONLY) = 3 [pid 614] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [pid 614] write(4, "-pids ", 6) = 6 [pid 614] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [ 132.198855][ T606] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 132.206819][ T606] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 132.214776][ T606] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 132.222723][ T606] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 132.230677][ T606] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000028 [ 132.238855][ T606] cgroup: cgroup_addrm_files: failed to add max, err=-12 [pid 614] write(5, "22", 2) = 2 [ 132.270444][ T612] FAULT_INJECTION: forcing a failure. [ 132.270444][ T612] name failslab, interval 1, probability 0, space 0, times 0 [ 132.283125][ T612] CPU: 1 PID: 612 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 132.294748][ T612] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 132.304858][ T612] Call Trace: [ 132.308143][ T612] dump_stack_lvl+0x1e2/0x24b [ 132.312799][ T612] ? bfq_pos_tree_add_move+0x43e/0x43e [ 132.318240][ T612] ? selinux_kernfs_init_security+0x1a8/0x760 [ 132.324289][ T612] dump_stack+0x15/0x17 [ 132.328423][ T612] should_fail+0x3c0/0x510 [ 132.332817][ T612] ? __kernfs_new_node+0x99/0x6e0 [ 132.337816][ T612] __should_failslab+0x9f/0xe0 [ 132.342553][ T612] should_failslab+0x9/0x20 [ 132.347034][ T612] __kmalloc_track_caller+0x5f/0x350 [ 132.352294][ T612] kstrdup_const+0x55/0x90 [ 132.356684][ T612] __kernfs_new_node+0x99/0x6e0 [ 132.361519][ T612] ? is_module_text_address+0xe1/0x140 [ 132.366971][ T612] ? kernfs_new_node+0x170/0x170 [ 132.371892][ T612] ? ptr_to_hashval+0x60/0x60 [ 132.376541][ T612] ? arch_stack_walk+0xf8/0x140 [ 132.381367][ T612] ? snprintf+0xd6/0x120 [ 132.385585][ T612] kernfs_new_node+0x97/0x170 [ 132.390246][ T612] __kernfs_create_file+0x4a/0x270 [ 132.395345][ T612] cgroup_addrm_files+0xab8/0xfe0 [ 132.400350][ T612] ? ____kasan_kmalloc+0xdc/0x110 [ 132.405350][ T612] ? __kasan_kmalloc+0x9/0x10 [ 132.410006][ T612] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 132.415526][ T612] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 132.421652][ T612] ? delete_node+0x759/0x7b0 [ 132.426224][ T612] ? __kasan_check_read+0x11/0x20 [ 132.431233][ T612] ? delete_node+0x759/0x7b0 [ 132.435798][ T612] ? __kasan_check_write+0x14/0x20 [ 132.440883][ T612] ? idr_replace+0x1c4/0x230 [ 132.445446][ T612] ? idr_get_next+0x4b0/0x4b0 [ 132.450110][ T612] ? _raw_spin_lock_bh+0xa3/0x1b0 [ 132.455119][ T612] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 132.460307][ T612] css_populate_dir+0x137/0x370 [ 132.465148][ T612] cgroup_apply_control_enable+0x8b9/0x12f0 [ 132.471019][ T612] cgroup_apply_control+0x93/0x710 [ 132.476116][ T612] ? css_next_child+0x160/0x160 [ 132.480948][ T612] ? stack_trace_save+0x12d/0x1f0 [ 132.485959][ T612] ? io_schedule+0x120/0x120 [ 132.490536][ T612] ? kernfs_fop_write_iter+0x15e/0x410 [ 132.495976][ T612] ? __kasan_check_write+0x14/0x20 [ 132.501067][ T612] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 132.506327][ T612] cgroup_subtree_control_write+0xd19/0x1310 [ 132.512284][ T612] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 132.518258][ T612] ? __kasan_check_write+0x14/0x20 [ 132.523355][ T612] ? _copy_from_iter+0x3fb/0xd60 [ 132.528278][ T612] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 132.534246][ T612] cgroup_file_write+0x28e/0x590 [ 132.539157][ T612] ? cgroup_seqfile_stop+0xc0/0xc0 [ 132.544248][ T612] ? mutex_lock+0xa6/0x110 [ 132.548638][ T612] ? mutex_trylock+0xb0/0xb0 [ 132.553207][ T612] ? __kasan_check_write+0x14/0x20 [ 132.558302][ T612] kernfs_fop_write_iter+0x2d0/0x410 [ 132.563559][ T612] ? cgroup_seqfile_stop+0xc0/0xc0 [ 132.568652][ T612] vfs_write+0xc1c/0xf40 [ 132.572889][ T612] ? __kasan_check_write+0x14/0x20 [ 132.577992][ T612] ? kernel_write+0x3c0/0x3c0 [ 132.582651][ T612] ? _raw_spin_unlock_irq+0x4e/0x70 [ 132.587822][ T612] ? ptrace_stop+0x6ff/0x9f0 [ 132.592395][ T612] ? __kasan_check_read+0x11/0x20 [ 132.597402][ T612] ? __fdget_pos+0x27e/0x310 [ 132.601982][ T612] ksys_write+0x198/0x2c0 [ 132.606286][ T612] ? do_notify_parent+0xa60/0xa60 [ 132.611284][ T612] ? __ia32_sys_read+0x90/0x90 [ 132.616026][ T612] ? __ia32_sys_open+0x270/0x270 [ 132.620942][ T612] __x64_sys_write+0x7b/0x90 [ 132.625512][ T612] do_syscall_64+0x34/0x70 [ 132.629922][ T612] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 132.635794][ T612] RIP: 0033:0x7fc8ece62c09 [ 132.640192][ T612] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 132.659776][ T612] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 614] write(4, "+pids ", 6 [pid 612] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 612] close(3) = 0 [pid 612] close(4) = 0 [pid 612] close(5) = 0 [pid 612] close(6) = -1 EBADF (Bad file descriptor) [pid 612] close(7) = -1 EBADF (Bad file descriptor) [pid 612] close(8) = -1 EBADF (Bad file descriptor) [pid 612] close(9) = -1 EBADF (Bad file descriptor) [pid 612] close(10) = -1 EBADF (Bad file descriptor) [pid 612] close(11) = -1 EBADF (Bad file descriptor) [pid 612] close(12) = -1 EBADF (Bad file descriptor) [pid 612] close(13) = -1 EBADF (Bad file descriptor) [pid 612] close(14) = -1 EBADF (Bad file descriptor) [pid 612] close(15) = -1 EBADF (Bad file descriptor) [pid 612] close(16) = -1 EBADF (Bad file descriptor) [pid 612] close(17) = -1 EBADF (Bad file descriptor) [pid 612] close(18) = -1 EBADF (Bad file descriptor) [pid 612] close(19) = -1 EBADF (Bad file descriptor) [pid 612] close(20) = -1 EBADF (Bad file descriptor) [pid 612] close(21) = -1 EBADF (Bad file descriptor) [pid 612] close(22) = -1 EBADF (Bad file descriptor) [pid 612] close(23) = -1 EBADF (Bad file descriptor) [pid 612] close(24) = -1 EBADF (Bad file descriptor) [pid 612] close(25) = -1 EBADF (Bad file descriptor) [pid 612] close(26) = -1 EBADF (Bad file descriptor) [pid 612] close(27) = -1 EBADF (Bad file descriptor) [pid 612] close(28) = -1 EBADF (Bad file descriptor) [pid 612] close(29) = -1 EBADF (Bad file descriptor) write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory [pid 612] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 612] exit_group(0) = ? [pid 612] +++ exited with 0 +++ [pid 380] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=37, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 380] umount2("./35", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] openat(AT_FDCWD, "./35", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 380] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 380] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 380] umount2("./35/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./35/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 380] unlink("./35/binderfs") = 0 [pid 380] umount2("./35/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./35/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 380] unlink("./35/cgroup") = 0 [pid 380] umount2("./35/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./35/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 380] unlink("./35/cgroup.net") = 0 [pid 380] umount2("./35/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 380] umount2("./35/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./35/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 380] umount2("./35/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] openat(AT_FDCWD, "./35/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 380] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 380] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 380] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 380] close(4) = 0 [pid 380] rmdir("./35/file0") = 0 [pid 380] umount2("./35/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./35/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 380] unlink("./35/cgroup.cpu") = 0 [pid 380] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 380] close(3) = 0 [pid 380] rmdir("./35") = 0 [pid 380] mkdir("./36", 0777) = 0 [pid 380] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556fab5d0) = 38 ./strace-static-x86_64: Process 615 attached [pid 615] chdir("./36") = 0 [pid 615] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 615] setpgid(0, 0) = 0 [pid 615] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 615] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 615] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 615] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 615] write(3, "1000", 4) = 4 [pid 615] close(3) = 0 [pid 615] symlink("/dev/binderfs", "./binderfs") = 0 [pid 615] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 615] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 615] open("./file0", O_RDONLY) = 3 [pid 615] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [ 132.668162][ T612] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 132.676111][ T612] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 132.684063][ T612] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 132.692020][ T612] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 132.699966][ T612] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000023 [ 132.708274][ T612] cgroup: cgroup_addrm_files: failed to add max, err=-12 [pid 615] write(4, "-pids ", 6) = 6 [pid 610] <... write resumed>) = 6 [pid 610] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 610] write(5, "22", 2) = 2 [pid 610] write(4, "+pids ", 6 [ 132.740523][ T602] FAULT_INJECTION: forcing a failure. [ 132.740523][ T602] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 132.753796][ T602] CPU: 0 PID: 602 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 132.765408][ T602] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 132.775442][ T602] Call Trace: [ 132.778725][ T602] dump_stack_lvl+0x1e2/0x24b [ 132.783389][ T602] ? bfq_pos_tree_add_move+0x43e/0x43e [ 132.788824][ T602] ? __kasan_check_write+0x14/0x20 [ 132.793917][ T602] ? _raw_spin_lock_irq+0xa4/0x1b0 [ 132.799010][ T602] dump_stack+0x15/0x17 [ 132.803143][ T602] should_fail+0x3c0/0x510 [ 132.807538][ T602] should_fail_alloc_page+0x50/0x60 [ 132.812715][ T602] __alloc_pages_nodemask+0x1c0/0x890 [ 132.818073][ T602] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 132.824209][ T602] ? gfp_pfmemalloc_allowed+0x120/0x120 [ 132.829732][ T602] allocate_slab+0x78/0x540 [ 132.834221][ T602] ___slab_alloc+0x131/0x2e0 [ 132.838798][ T602] ? pids_css_alloc+0x4e/0x120 [ 132.843548][ T602] __slab_alloc+0x63/0xa0 [ 132.847853][ T602] ? pids_css_alloc+0x4e/0x120 [ 132.852593][ T602] kmem_cache_alloc_trace+0x20e/0x330 [ 132.857942][ T602] ? pids_css_alloc+0x4e/0x120 [ 132.862685][ T602] pids_css_alloc+0x4e/0x120 [ 132.867266][ T602] cgroup_apply_control_enable+0x350/0x12f0 [ 132.873170][ T602] cgroup_apply_control+0x93/0x710 [ 132.878269][ T602] ? css_next_child+0x160/0x160 [ 132.883102][ T602] ? stack_trace_save+0x12d/0x1f0 [ 132.888109][ T602] ? io_schedule+0x120/0x120 [ 132.892685][ T602] ? kernfs_fop_write_iter+0x15e/0x410 [ 132.898133][ T602] ? __kasan_check_write+0x14/0x20 [ 132.903229][ T602] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 132.908489][ T602] cgroup_subtree_control_write+0xd19/0x1310 [ 132.914441][ T602] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 132.920407][ T602] ? __kasan_check_write+0x14/0x20 [ 132.925501][ T602] ? _copy_from_iter+0x3fb/0xd60 [ 132.930421][ T602] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 132.936397][ T602] cgroup_file_write+0x28e/0x590 [ 132.941319][ T602] ? cgroup_seqfile_stop+0xc0/0xc0 [ 132.946413][ T602] ? mutex_lock+0xa6/0x110 [ 132.950801][ T602] ? mutex_trylock+0xb0/0xb0 [ 132.955383][ T602] ? __kasan_check_write+0x14/0x20 [ 132.960479][ T602] kernfs_fop_write_iter+0x2d0/0x410 [ 132.965738][ T602] ? cgroup_seqfile_stop+0xc0/0xc0 [ 132.970835][ T602] vfs_write+0xc1c/0xf40 [ 132.975075][ T602] ? __kasan_check_write+0x14/0x20 [ 132.980197][ T602] ? kernel_write+0x3c0/0x3c0 [ 132.984857][ T602] ? _raw_spin_unlock_irq+0x4e/0x70 [ 132.990037][ T602] ? ptrace_stop+0x6ff/0x9f0 [ 132.994606][ T602] ? __kasan_check_read+0x11/0x20 [ 132.999785][ T602] ? __fdget_pos+0x27e/0x310 [ 133.004363][ T602] ksys_write+0x198/0x2c0 [ 133.008683][ T602] ? do_notify_parent+0xa60/0xa60 [ 133.013691][ T602] ? __ia32_sys_read+0x90/0x90 [ 133.018436][ T602] ? __ia32_sys_open+0x270/0x270 [ 133.023357][ T602] __x64_sys_write+0x7b/0x90 [ 133.027922][ T602] do_syscall_64+0x34/0x70 [ 133.032328][ T602] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 133.038198][ T602] RIP: 0033:0x7fc8ece62c09 [ 133.042608][ T602] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 133.062201][ T602] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 133.070602][ T602] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 133.078555][ T602] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [pid 615] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 615] write(5, "22", 2) = 2 [pid 615] write(4, "+pids ", 6 [pid 602] <... write resumed>) = ? [pid 613] <... write resumed>) = 6 [pid 613] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 613] write(5, "22", 2 [pid 602] +++ killed by SIGKILL +++ [pid 613] <... write resumed>) = 2 [pid 613] write(4, "+pids ", 6 [pid 376] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=39, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=1} --- [pid 376] umount2("./37", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] openat(AT_FDCWD, "./37", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 376] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 376] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 376] umount2("./37/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./37/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 376] unlink("./37/binderfs") = 0 [pid 376] umount2("./37/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./37/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 376] unlink("./37/cgroup") = 0 [pid 376] umount2("./37/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./37/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 376] unlink("./37/cgroup.net") = 0 [pid 376] umount2("./37/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 376] umount2("./37/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./37/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 376] umount2("./37/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] openat(AT_FDCWD, "./37/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 376] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 376] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 376] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 376] close(4) = 0 [pid 376] rmdir("./37/file0") = 0 [pid 376] umount2("./37/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./37/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 376] unlink("./37/cgroup.cpu") = 0 [pid 376] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 376] close(3) = 0 [pid 376] rmdir("./37") = 0 [pid 376] mkdir("./38", 0777) = 0 [pid 376] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 616 attached , child_tidptr=0x555556fab5d0) = 40 [pid 616] chdir("./38") = 0 [pid 616] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 616] setpgid(0, 0) = 0 [pid 616] symlink("/syzcgroup/unified/syz1", "./cgroup") = 0 [pid 616] symlink("/syzcgroup/cpu/syz1", "./cgroup.cpu") = 0 [pid 616] symlink("/syzcgroup/net/syz1", "./cgroup.net") = 0 [pid 616] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 616] write(3, "1000", 4) = 4 [pid 616] close(3) = 0 [pid 616] symlink("/dev/binderfs", "./binderfs") = 0 [pid 616] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 616] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 616] open("./file0", O_RDONLY) = 3 [pid 616] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [ 133.086592][ T602] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 133.094537][ T602] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 133.102491][ T602] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000025 [ 133.140460][ T614] FAULT_INJECTION: forcing a failure. [ 133.140460][ T614] name failslab, interval 1, probability 0, space 0, times 0 [ 133.153156][ T614] CPU: 1 PID: 614 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 133.164766][ T614] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 133.174809][ T614] Call Trace: [ 133.178099][ T614] dump_stack_lvl+0x1e2/0x24b [ 133.182762][ T614] ? panic+0x7d7/0x7d7 [ 133.186813][ T614] ? bfq_pos_tree_add_move+0x43e/0x43e [ 133.192262][ T614] ? find_next_bit+0xd6/0x120 [ 133.196922][ T614] ? cpumask_next+0x11/0x30 [ 133.201418][ T614] dump_stack+0x15/0x17 [ 133.205546][ T614] should_fail+0x3c0/0x510 [ 133.209936][ T614] ? percpu_ref_init+0xd0/0x330 [ 133.214776][ T614] __should_failslab+0x9f/0xe0 [ 133.219523][ T614] should_failslab+0x9/0x20 [ 133.224003][ T614] kmem_cache_alloc_trace+0x3a/0x330 [ 133.229265][ T614] percpu_ref_init+0xd0/0x330 [ 133.233924][ T614] ? cgroup_setup_root+0xea0/0xea0 [ 133.239018][ T614] cgroup_apply_control_enable+0x3a2/0x12f0 [ 133.244892][ T614] cgroup_apply_control+0x93/0x710 [ 133.249984][ T614] ? css_next_child+0x160/0x160 [ 133.254814][ T614] ? stack_trace_save+0x12d/0x1f0 [ 133.259825][ T614] ? io_schedule+0x120/0x120 [ 133.264397][ T614] ? kernfs_fop_write_iter+0x15e/0x410 [ 133.269848][ T614] ? __kasan_check_write+0x14/0x20 [ 133.274942][ T614] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 133.280219][ T614] cgroup_subtree_control_write+0xd19/0x1310 [ 133.286188][ T614] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 133.292146][ T614] ? __kasan_check_write+0x14/0x20 [ 133.297341][ T614] ? _copy_from_iter+0x3fb/0xd60 [ 133.302299][ T614] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 133.308260][ T614] cgroup_file_write+0x28e/0x590 [ 133.313179][ T614] ? cgroup_seqfile_stop+0xc0/0xc0 [ 133.318280][ T614] ? mutex_lock+0xa6/0x110 [ 133.322695][ T614] ? mutex_trylock+0xb0/0xb0 [ 133.327280][ T614] ? __kasan_check_write+0x14/0x20 [ 133.332368][ T614] kernfs_fop_write_iter+0x2d0/0x410 [ 133.337639][ T614] ? cgroup_seqfile_stop+0xc0/0xc0 [ 133.342733][ T614] vfs_write+0xc1c/0xf40 [ 133.346953][ T614] ? __kasan_check_write+0x14/0x20 [ 133.352062][ T614] ? kernel_write+0x3c0/0x3c0 [ 133.356731][ T614] ? _raw_spin_unlock_irq+0x4e/0x70 [ 133.361913][ T614] ? ptrace_stop+0x6ff/0x9f0 [ 133.366478][ T614] ? __kasan_check_read+0x11/0x20 [ 133.371487][ T614] ? __fdget_pos+0x27e/0x310 [ 133.376072][ T614] ksys_write+0x198/0x2c0 [ 133.380396][ T614] ? do_notify_parent+0xa60/0xa60 [ 133.385405][ T614] ? __ia32_sys_read+0x90/0x90 [ 133.390142][ T614] ? __ia32_sys_open+0x270/0x270 [ 133.395061][ T614] __x64_sys_write+0x7b/0x90 [ 133.399658][ T614] do_syscall_64+0x34/0x70 [ 133.404070][ T614] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 133.409954][ T614] RIP: 0033:0x7fc8ece62c09 [ 133.414353][ T614] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 616] write(4, "-pids ", 6 [pid 614] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 614] close(3) = 0 [pid 614] close(4) = 0 [pid 614] close(5) = 0 [pid 614] close(6) = -1 EBADF (Bad file descriptor) [pid 614] close(7) = -1 EBADF (Bad file descriptor) [pid 614] close(8) = -1 EBADF (Bad file descriptor) [pid 614] close(9) = -1 EBADF (Bad file descriptor) [pid 614] close(10) = -1 EBADF (Bad file descriptor) [pid 614] close(11) = -1 EBADF (Bad file descriptor) [pid 614] close(12) = -1 EBADF (Bad file descriptor) [pid 614] close(13) = -1 EBADF (Bad file descriptor) [pid 614] close(14) = -1 EBADF (Bad file descriptor) [pid 614] close(15) = -1 EBADF (Bad file descriptor) [pid 614] close(16) = -1 EBADF (Bad file descriptor) [pid 614] close(17) = -1 EBADF (Bad file descriptor) [pid 614] close(18) = -1 EBADF (Bad file descriptor) [pid 614] close(19) = -1 EBADF (Bad file descriptor) [pid 614] close(20) = -1 EBADF (Bad file descriptor) [pid 614] close(21) = -1 EBADF (Bad file descriptor) [pid 614] close(22) = -1 EBADF (Bad file descriptor) [pid 614] close(23) = -1 EBADF (Bad file descriptor) [pid 614] close(24) = -1 EBADF (Bad file descriptor) [pid 614] close(25) = -1 EBADF (Bad file descriptor) [pid 614] close(26) = -1 EBADF (Bad file descriptor) [pid 614] close(27) = -1 EBADF (Bad file descriptor) [pid 614] close(28) = -1 EBADF (Bad file descriptor) [pid 614] close(29) = -1 EBADF (Bad file descriptor) write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory [pid 614] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 614] exit_group(0) = ? [pid 614] +++ exited with 0 +++ [pid 382] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=43, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 382] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 382] umount2("./41", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] openat(AT_FDCWD, "./41", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 382] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 382] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 382] umount2("./41/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./41/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 382] unlink("./41/binderfs") = 0 [pid 382] umount2("./41/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./41/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 382] unlink("./41/cgroup") = 0 [pid 382] umount2("./41/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./41/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 382] unlink("./41/cgroup.net") = 0 [ 133.433949][ T614] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 133.442358][ T614] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 133.450313][ T614] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 133.458271][ T614] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 133.466218][ T614] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 133.474178][ T614] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000029 [ 133.491782][ T382] ------------[ cut here ]------------ [ 133.497282][ T382] WARNING: CPU: 0 PID: 382 at fs/namespace.c:1168 mntput_no_expire+0x48a/0x6c0 [ 133.506323][ T382] Modules linked in: [ 133.510228][ T382] CPU: 0 PID: 382 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 133.521848][ T382] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 133.531904][ T382] RIP: 0010:mntput_no_expire+0x48a/0x6c0 [ 133.537508][ T382] Code: 48 c7 c2 80 02 44 86 e8 64 f0 8e ff e9 8b fc ff ff e8 ba 21 b6 ff e9 81 fc ff ff e8 b0 21 b6 ff e9 77 fc ff ff e8 a6 21 b6 ff <0f> 0b e9 f4 fc ff ff e8 9a 21 b6 ff e8 65 ad a2 ff e9 ea fc ff ff [ 133.557136][ T382] RSP: 0018:ffffc90000b77ba0 EFLAGS: 00010293 [ 133.563213][ T382] RAX: ffffffff81b68f1a RBX: 00000000fffffffe RCX: ffff8881065e4f00 [ 133.571185][ T382] RDX: 0000000000000000 RSI: 00000000fffffffe RDI: 0000000000000000 [ 133.579140][ T382] RBP: ffffc90000b77c70 R08: ffffffff81b68c08 R09: 0000000000000003 [ 133.587131][ T382] R10: fffff5200016ef65 R11: 1ffff9200016ef64 R12: dffffc0000000000 [ 133.595110][ T382] R13: ffff8881192dc8c0 R14: ffffc90000b77c00 R15: 1ffff9200016ef7c [ 133.603102][ T382] FS: 0000555556fab300(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 133.612053][ T382] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 133.618630][ T382] CR2: 00007ffd7d0e1c18 CR3: 000000011dd7e000 CR4: 00000000003506b0 [ 133.626619][ T382] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 133.634588][ T382] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 133.642562][ T382] Call Trace: [ 133.645846][ T382] ? io_schedule+0x120/0x120 [ 133.650435][ T382] ? vfs_submount+0xb0/0xb0 [ 133.654922][ T382] ? shrink_dentry_list+0x4ec/0x500 [ 133.660107][ T382] ? __kasan_check_write+0x14/0x20 [ 133.665219][ T382] namespace_unlock+0x448/0x4f0 [ 133.670055][ T382] ? umount_tree+0xf50/0xf50 [ 133.674642][ T382] ? __detach_mounts+0x670/0x670 [ 133.679563][ T382] ? selinux_umount+0xf0/0x130 [ 133.684331][ T382] ? security_sb_umount+0x9d/0xb0 [ 133.689335][ T382] path_umount+0xf03/0xfb0 [ 133.693745][ T382] ? namespace_unlock+0x4f0/0x4f0 [ 133.698755][ T382] ? user_path_at_empty+0x40/0x50 [ 133.703779][ T382] __x64_sys_umount+0x122/0x170 [ 133.708612][ T382] ? path_umount+0xfb0/0xfb0 [ 133.713204][ T382] ? syscall_enter_from_user_mode+0x58/0x1b0 [ 133.719336][ T382] do_syscall_64+0x34/0x70 [ 133.723806][ T382] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 133.729688][ T382] RIP: 0033:0x7fc8ece63fb7 [ 133.734178][ T382] Code: 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 133.753818][ T382] RSP: 002b:00007ffd7d0e2358 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [ 133.760419][ T615] FAULT_INJECTION: forcing a failure. [ 133.760419][ T615] name failslab, interval 1, probability 0, space 0, times 0 [ 133.762227][ T382] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc8ece63fb7 [ 133.782742][ T382] RDX: 00007ffd7d0e241a RSI: 000000000000000a RDI: 00007ffd7d0e2410 [ 133.790720][ T382] RBP: 00007ffd7d0e2410 R08: 00000000ffffffff R09: 00007ffd7d0e21f0 [ 133.798682][ T382] R10: 0000555556fad6a3 R11: 0000000000000202 R12: 00007ffd7d0e3490 [ 133.801835][ T615] CPU: 1 PID: 615 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 133.806659][ T382] R13: 0000555556fad600 R14: 00007ffd7d0e2380 R15: 000000000000002a [ 133.818238][ T615] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 133.818242][ T615] Call Trace: [ 133.818259][ T615] dump_stack_lvl+0x1e2/0x24b [ 133.818269][ T615] ? bfq_pos_tree_add_move+0x43e/0x43e [ 133.818287][ T615] ? selinux_kernfs_init_security+0x1a8/0x760 [ 133.826237][ T382] ---[ end trace d4de1ca9cdcd1986 ]--- [ 133.836260][ T615] dump_stack+0x15/0x17 [ 133.836269][ T615] should_fail+0x3c0/0x510 [ 133.836285][ T615] ? __kernfs_new_node+0x99/0x6e0 [ 133.839939][ T382] ------------[ cut here ]------------ [ 133.844185][ T615] __should_failslab+0x9f/0xe0 [ 133.844195][ T615] should_failslab+0x9/0x20 [ 133.844205][ T615] __kmalloc_track_caller+0x5f/0x350 [ 133.844215][ T615] kstrdup_const+0x55/0x90 [ 133.844232][ T615] __kernfs_new_node+0x99/0x6e0 [ 133.849667][ T382] WARNING: CPU: 0 PID: 382 at fs/namespace.c:1168 mntput_no_expire+0x48a/0x6c0 [ 133.855696][ T615] ? is_module_text_address+0xe1/0x140 [ 133.855705][ T615] ? kernfs_new_node+0x170/0x170 [ 133.855722][ T615] ? ptr_to_hashval+0x60/0x60 [ 133.861147][ T382] Modules linked in: [ 133.865272][ T615] ? arch_stack_walk+0xf8/0x140 [ 133.869649][ T382] [ 133.874643][ T615] ? snprintf+0xd6/0x120 [ 133.874653][ T615] kernfs_new_node+0x97/0x170 [ 133.874662][ T615] __kernfs_create_file+0x4a/0x270 [ 133.874677][ T615] cgroup_addrm_files+0xab8/0xfe0 [ 133.880106][ T382] CPU: 0 PID: 382 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 133.884832][ T615] ? ____kasan_kmalloc+0xdc/0x110 [ 133.884840][ T615] ? __kasan_kmalloc+0x9/0x10 [ 133.884857][ T615] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 133.889322][ T382] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 133.894580][ T615] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 133.894595][ T615] ? delete_node+0x759/0x7b0 [ 133.898984][ T382] RIP: 0010:mntput_no_expire+0x48a/0x6c0 [ 133.903798][ T615] ? __kasan_check_read+0x11/0x20 [ 133.903806][ T615] ? delete_node+0x759/0x7b0 [ 133.903822][ T615] ? __kasan_check_write+0x14/0x20 [ 133.912729][ T382] Code: 48 c7 c2 80 02 44 86 e8 64 f0 8e ff e9 8b fc ff ff e8 ba 21 b6 ff e9 81 fc ff ff e8 b0 21 b6 ff e9 77 fc ff ff e8 a6 21 b6 ff <0f> 0b e9 f4 fc ff ff e8 9a 21 b6 ff e8 65 ad a2 ff e9 ea fc ff ff [ 133.918150][ T615] ? idr_replace+0x1c4/0x230 [ 133.923062][ T382] RSP: 0018:ffffc90000b77ca0 EFLAGS: 00010293 [ 133.927705][ T615] ? idr_get_next+0x4b0/0x4b0 [ 133.931580][ T382] [ 133.936389][ T615] ? _raw_spin_lock_bh+0xa3/0x1b0 [ 133.938692][ T382] RAX: ffffffff81b68f1a RBX: 00000000ffffffff RCX: ffff8881065e4f00 [ 133.942897][ T615] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 133.942908][ T615] css_populate_dir+0x137/0x370 [ 133.942924][ T615] cgroup_apply_control_enable+0x8b9/0x12f0 [ 133.947567][ T382] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000 [ 133.952674][ T615] cgroup_apply_control+0x93/0x710 [ 133.952689][ T615] ? css_next_child+0x160/0x160 [ 133.957684][ T382] RBP: ffffc90000b77d70 R08: ffffffff81b68c08 R09: 0000000000000003 [ 133.969271][ T615] ? io_schedule+0x120/0x120 [ 133.969281][ T615] ? kernfs_fop_write_iter+0x15e/0x410 [ 133.969297][ T615] ? __kasan_check_write+0x14/0x20 [ 133.974293][ T382] R10: fffff5200016ef85 R11: 1ffff9200016ef84 R12: dffffc0000000000 [ 133.978943][ T615] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 133.984468][ T382] R13: ffff8881192dc8c0 R14: ffffc90000b77d00 R15: 1ffff9200016ef9c [ 133.994487][ T615] cgroup_subtree_control_write+0xd19/0x1310 [ 133.994498][ T615] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 133.994515][ T615] ? __kasan_check_write+0x14/0x20 [ 134.000665][ T382] FS: 0000555556fab300(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 134.005221][ T615] ? _copy_from_iter+0x3fb/0xd60 [ 134.010825][ T382] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [pid 382] umount2("./41/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 615] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 615] close(3) = 0 [pid 615] close(4) = 0 [pid 615] close(5) = 0 [pid 615] close(6) = -1 EBADF (Bad file descriptor) [pid 615] close(7) = -1 EBADF (Bad file descriptor) [pid 615] close(8) = -1 EBADF (Bad file descriptor) [pid 615] close(9) = -1 EBADF (Bad file descriptor) [pid 615] close(10) = -1 EBADF (Bad file descriptor) [pid 615] close(11) = -1 EBADF (Bad file descriptor) [pid 615] close(12) = -1 EBADF (Bad file descriptor) [pid 615] close(13) = -1 EBADF (Bad file descriptor) [pid 615] close(14) = -1 EBADF (Bad file descriptor) [pid 615] close(15) = -1 EBADF (Bad file descriptor) [pid 615] close(16) = -1 EBADF (Bad file descriptor) [pid 615] close(17) = -1 EBADF (Bad file descriptor) [pid 615] close(18) = -1 EBADF (Bad file descriptor) [pid 615] close(19) = -1 EBADF (Bad file descriptor) [pid 615] close(20) = -1 EBADF (Bad file descriptor) [pid 615] close(21) = -1 EBADF (Bad file descriptor) [pid 615] close(22) = -1 EBADF (Bad file descriptor) [pid 615] close(23) = -1 EBADF (Bad file descriptor) [pid 615] close(24) = -1 EBADF (Bad file descriptor) [ 134.015813][ T615] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 134.020375][ T382] CR2: 00007ffd7d0e1c18 CR3: 000000011dd7e000 CR4: 00000000003506b0 [ 134.025451][ T615] cgroup_file_write+0x28e/0x590 [ 134.045035][ T382] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 134.049588][ T615] ? cgroup_seqfile_stop+0xc0/0xc0 [ 134.055637][ T382] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 134.060273][ T615] ? mutex_lock+0xa6/0x110 [ 134.060289][ T615] ? mutex_trylock+0xb0/0xb0 [ 134.062586][ T382] Call Trace: [pid 615] close(25write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory ) = -1 EBADF (Bad file descriptor) [pid 615] close(26) = -1 EBADF (Bad file descriptor) [pid 615] close(27) = -1 EBADF (Bad file descriptor) [pid 615] close(28) = -1 EBADF (Bad file descriptor) [pid 615] close(29) = -1 EBADF (Bad file descriptor) [pid 615] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 615] exit_group(0) = ? [pid 615] +++ exited with 0 +++ [pid 380] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=38, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 380] restart_syscall(<... resuming interrupted clone ...>) = 0 [ 134.067584][ T615] ? __kasan_check_write+0x14/0x20 [ 134.075539][ T382] ? lockref_get_or_lock+0x340/0x340 [ 134.080695][ T615] kernfs_fop_write_iter+0x2d0/0x410 [ 134.080711][ T615] ? cgroup_seqfile_stop+0xc0/0xc0 [ 134.085531][ T382] ? umount_tree+0xf50/0xf50 [ 134.091383][ T615] vfs_write+0xc1c/0xf40 [ 134.091392][ T615] ? __kasan_check_write+0x14/0x20 [ 134.091408][ T615] ? kernel_write+0x3c0/0x3c0 [ 134.099352][ T382] ? vfs_submount+0xb0/0xb0 [ 134.104424][ T615] ? _raw_spin_unlock_irq+0x4e/0x70 [ 134.104434][ T615] ? ptrace_stop+0x6ff/0x9f0 [ 134.104449][ T615] ? __kasan_check_read+0x11/0x20 [ 134.109273][ T382] ? dput+0x2b6/0x320 [ 134.117215][ T615] ? __fdget_pos+0x27e/0x310 [ 134.117224][ T615] ksys_write+0x198/0x2c0 [ 134.117234][ T615] ? do_notify_parent+0xa60/0xa60 [ 134.117248][ T615] ? __ia32_sys_read+0x90/0x90 [ 134.121815][ T382] path_umount+0x1fe/0xfb0 [ 134.127235][ T615] ? __ia32_sys_open+0x270/0x270 [ 134.132328][ T382] ? namespace_unlock+0x4f0/0x4f0 [ 134.140258][ T615] __x64_sys_write+0x7b/0x90 [ 134.140274][ T615] do_syscall_64+0x34/0x70 [ 134.145527][ T382] ? user_path_at_empty+0x40/0x50 [ 134.153467][ T615] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 134.153476][ T615] RIP: 0033:0x7fc8ece62c09 [ 134.153491][ T615] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 134.159445][ T382] __x64_sys_umount+0x122/0x170 [ 134.165384][ T615] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 134.165404][ T615] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 134.170512][ T382] ? path_umount+0xfb0/0xfb0 [ 134.179395][ T615] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 134.184315][ T382] ? syscall_enter_from_user_mode+0x58/0x1b0 [ 134.190857][ T615] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 134.190864][ T615] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 134.190878][ T615] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000024 [ 134.196827][ T382] do_syscall_64+0x34/0x70 [ 134.205349][ T615] cgroup: cgroup_addrm_files: failed to add max, err=-12 [ 134.209689][ T382] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 134.209698][ T382] RIP: 0033:0x7fc8ece63fb7 [ 134.209715][ T382] Code: 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 134.487202][ T382] RSP: 002b:00007ffd7d0e2358 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [pid 380] umount2("./36", MNT_DETACH|UMOUNT_NOFOLLOW [pid 382] <... umount2 resumed>) = 0 [pid 380] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 380] openat(AT_FDCWD, "./36", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 380] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 380] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 380] umount2("./36/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./36/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 380] unlink("./36/binderfs") = 0 [pid 380] umount2("./36/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./36/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 380] unlink("./36/cgroup") = 0 [pid 380] umount2("./36/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./36/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 380] unlink("./36/cgroup.net") = 0 [pid 380] umount2("./36/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 380] umount2("./36/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./36/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 380] umount2("./36/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] openat(AT_FDCWD, "./36/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 380] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 380] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 380] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 380] close(4) = 0 [pid 380] rmdir("./36/file0") = 0 [pid 380] umount2("./36/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./36/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 380] unlink("./36/cgroup.cpu") = 0 [pid 380] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 380] close(3) = 0 [pid 380] rmdir("./36") = 0 [pid 380] mkdir("./37", 0777) = 0 [pid 380] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 617 attached , child_tidptr=0x555556fab5d0) = 39 [pid 382] umount2("./41/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./41/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 382] umount2("./41/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] openat(AT_FDCWD, "./41/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 382] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 382] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 382] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 382] close(4) = 0 [pid 382] rmdir("./41/file0") = 0 [pid 382] umount2("./41/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./41/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 382] unlink("./41/cgroup.cpu") = 0 [pid 382] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 617] chdir("./37" [pid 382] close(3) = 0 [pid 382] rmdir("./41") = 0 [pid 382] mkdir("./42", 0777 [pid 617] <... chdir resumed>) = 0 [pid 617] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 382] <... mkdir resumed>) = 0 [pid 382] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 617] <... prctl resumed>) = 0 [pid 617] setpgid(0, 0 [pid 382] <... clone resumed>, child_tidptr=0x555556fab5d0) = 44 ./strace-static-x86_64: Process 618 attached [pid 618] chdir("./42") = 0 [pid 618] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 617] <... setpgid resumed>) = 0 [pid 617] symlink("/syzcgroup/unified/syz2", "./cgroup" [pid 618] setpgid(0, 0 [pid 617] <... symlink resumed>) = 0 [pid 617] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu" [pid 618] <... setpgid resumed>) = 0 [pid 617] <... symlink resumed>) = 0 [pid 617] symlink("/syzcgroup/net/syz2", "./cgroup.net" [pid 618] symlink("/syzcgroup/unified/syz5", "./cgroup" [pid 617] <... symlink resumed>) = 0 [pid 617] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 618] <... symlink resumed>) = 0 [pid 617] <... openat resumed>) = 3 [pid 617] write(3, "1000", 4 [pid 618] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu" [pid 617] <... write resumed>) = 4 [pid 617] close(3) = 0 [pid 618] <... symlink resumed>) = 0 [pid 617] symlink("/dev/binderfs", "./binderfs") = 0 [pid 618] symlink("/syzcgroup/net/syz5", "./cgroup.net" [pid 617] mkdirat(AT_FDCWD, "./file0", 000 [pid 618] <... symlink resumed>) = 0 [pid 617] <... mkdirat resumed>) = 0 [pid 617] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 617] open("./file0", O_RDONLY) = 3 [pid 617] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [pid 617] write(4, "-pids ", 6 [pid 618] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 618] write(3, "1000", 4) = 4 [pid 618] close(3) = 0 [pid 618] symlink("/dev/binderfs", "./binderfs") = 0 [pid 618] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 618] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 618] open("./file0", O_RDONLY) = 3 [pid 618] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [pid 618] write(4, "-pids ", 6) = 6 [pid 617] <... write resumed>) = 6 [pid 616] <... write resumed>) = 6 [pid 618] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 617] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 618] <... openat resumed>) = 5 [pid 617] <... openat resumed>) = 5 [pid 618] write(5, "22", 2 [ 134.495633][ T382] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc8ece63fb7 [ 134.503621][ T382] RDX: 00007ffd7d0e241a RSI: 000000000000000a RDI: 00007ffd7d0e2410 [ 134.511596][ T382] RBP: 00007ffd7d0e2410 R08: 00000000ffffffff R09: 00007ffd7d0e21f0 [ 134.519559][ T382] R10: 0000555556fad6a3 R11: 0000000000000202 R12: 00007ffd7d0e3490 [ 134.527566][ T382] R13: 0000555556fad600 R14: 00007ffd7d0e2380 R15: 000000000000002a [ 134.535548][ T382] ---[ end trace d4de1ca9cdcd1987 ]--- [pid 617] write(5, "22", 2 [pid 618] <... write resumed>) = 2 [pid 617] <... write resumed>) = 2 [pid 618] write(4, "+pids ", 6 [pid 617] write(4, "+pids ", 6 [pid 616] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 616] write(5, "22", 2) = 2 [ 134.560511][ T613] FAULT_INJECTION: forcing a failure. [ 134.560511][ T613] name failslab, interval 1, probability 0, space 0, times 0 [ 134.573205][ T613] CPU: 1 PID: 613 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 134.584825][ T613] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 134.594865][ T613] Call Trace: [ 134.598132][ T613] dump_stack_lvl+0x1e2/0x24b [ 134.602794][ T613] ? panic+0x7d7/0x7d7 [ 134.606846][ T613] ? bfq_pos_tree_add_move+0x43e/0x43e [ 134.612299][ T613] ? find_next_bit+0xd6/0x120 [ 134.616964][ T613] ? cpumask_next+0x11/0x30 [ 134.621440][ T613] dump_stack+0x15/0x17 [ 134.625571][ T613] should_fail+0x3c0/0x510 [ 134.629974][ T613] ? percpu_ref_init+0xd0/0x330 [ 134.634813][ T613] __should_failslab+0x9f/0xe0 [ 134.639557][ T613] should_failslab+0x9/0x20 [ 134.644045][ T613] kmem_cache_alloc_trace+0x3a/0x330 [ 134.649304][ T613] percpu_ref_init+0xd0/0x330 [ 134.653966][ T613] ? cgroup_setup_root+0xea0/0xea0 [ 134.659075][ T613] cgroup_apply_control_enable+0x3a2/0x12f0 [ 134.664953][ T613] cgroup_apply_control+0x93/0x710 [ 134.670043][ T613] ? css_next_child+0x160/0x160 [ 134.674875][ T613] ? stack_trace_save+0x12d/0x1f0 [ 134.679893][ T613] ? io_schedule+0x120/0x120 [ 134.684472][ T613] ? kernfs_fop_write_iter+0x15e/0x410 [ 134.689911][ T613] ? __kasan_check_write+0x14/0x20 [ 134.695003][ T613] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 134.700268][ T613] cgroup_subtree_control_write+0xd19/0x1310 [ 134.706226][ T613] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 134.712190][ T613] ? __kasan_check_write+0x14/0x20 [ 134.717289][ T613] ? _copy_from_iter+0x3fb/0xd60 [ 134.722219][ T613] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 134.728184][ T613] cgroup_file_write+0x28e/0x590 [ 134.733104][ T613] ? cgroup_seqfile_stop+0xc0/0xc0 [ 134.738212][ T613] ? mutex_lock+0xa6/0x110 [ 134.742611][ T613] ? mutex_trylock+0xb0/0xb0 [ 134.747183][ T613] ? __kasan_check_write+0x14/0x20 [ 134.752289][ T613] kernfs_fop_write_iter+0x2d0/0x410 [ 134.757559][ T613] ? cgroup_seqfile_stop+0xc0/0xc0 [ 134.762652][ T613] vfs_write+0xc1c/0xf40 [ 134.766871][ T613] ? __kasan_check_write+0x14/0x20 [ 134.771965][ T613] ? kernel_write+0x3c0/0x3c0 [ 134.776626][ T613] ? _raw_spin_unlock_irq+0x4e/0x70 [ 134.781813][ T613] ? ptrace_stop+0x6ff/0x9f0 [ 134.786399][ T613] ? __kasan_check_read+0x11/0x20 [ 134.791415][ T613] ? __fdget_pos+0x27e/0x310 [ 134.796000][ T613] ksys_write+0x198/0x2c0 [ 134.800322][ T613] ? do_notify_parent+0xa60/0xa60 [ 134.805335][ T613] ? __ia32_sys_read+0x90/0x90 [ 134.810080][ T613] ? __ia32_sys_open+0x270/0x270 [ 134.815015][ T613] __x64_sys_write+0x7b/0x90 [ 134.819589][ T613] do_syscall_64+0x34/0x70 [ 134.823991][ T613] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 134.829870][ T613] RIP: 0033:0x7fc8ece62c09 [ 134.834272][ T613] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 616] write(4, "+pids ", 6 [pid 613] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 613] close(3) = 0 [pid 613] close(4) = 0 [pid 613] close(5) = 0 [pid 613] close(6) = -1 EBADF (Bad file descriptor) [pid 613] close(7) = -1 EBADF (Bad file descriptor) [pid 613] close(8) = -1 EBADF (Bad file descriptor) [pid 613] close(9) = -1 EBADF (Bad file descriptor) [pid 613] close(10) = -1 EBADF (Bad file descriptor) [pid 613] close(11) = -1 EBADF (Bad file descriptor) [pid 613] close(12) = -1 EBADF (Bad file descriptor) [pid 613] close(13) = -1 EBADF (Bad file descriptor) [pid 613] close(14) = -1 EBADF (Bad file descriptor) [pid 613] close(15) = -1 EBADF (Bad file descriptor) [pid 613] close(16) = -1 EBADF (Bad file descriptor) [pid 613] close(17) = -1 EBADF (Bad file descriptor) [pid 613] close(18) = -1 EBADF (Bad file descriptor) [pid 613] close(19) = -1 EBADF (Bad file descriptor) [pid 613] close(20) = -1 EBADF (Bad file descriptor) [pid 613] close(21) = -1 EBADF (Bad file descriptor) [pid 613] close(22) = -1 EBADF (Bad file descriptor) [pid 613] close(23) = -1 EBADF (Bad file descriptor) [pid 613] close(24) = -1 EBADF (Bad file descriptor) [pid 613] close(25) = -1 EBADF (Bad file descriptor) [pid 613] close(26) = -1 EBADF (Bad file descriptor) [pid 613] close(27) = -1 EBADF (Bad file descriptor) [pid 613] close(28) = -1 EBADF (Bad file descriptor) [pid 613] close(29) = -1 EBADF (Bad file descriptor) write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory [pid 613] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 613] exit_group(0) = ? [pid 613] +++ exited with 0 +++ [pid 375] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=43, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 375] umount2("./41", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] openat(AT_FDCWD, "./41", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 375] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 375] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 375] umount2("./41/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./41/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 375] unlink("./41/binderfs") = 0 [pid 375] umount2("./41/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./41/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 375] unlink("./41/cgroup") = 0 [pid 375] umount2("./41/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./41/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 375] unlink("./41/cgroup.net") = 0 [pid 375] umount2("./41/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 375] umount2("./41/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./41/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 375] umount2("./41/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] openat(AT_FDCWD, "./41/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 375] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 375] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 375] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 375] close(4) = 0 [pid 375] rmdir("./41/file0") = 0 [pid 375] umount2("./41/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./41/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 375] unlink("./41/cgroup.cpu") = 0 [pid 375] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 375] close(3) = 0 [pid 375] rmdir("./41") = 0 [pid 375] mkdir("./42", 0777) = 0 [pid 375] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 619 attached , child_tidptr=0x555556fab5d0) = 44 [pid 619] chdir("./42") = 0 [pid 619] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 619] setpgid(0, 0) = 0 [pid 619] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 619] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 619] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 619] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 619] write(3, "1000", 4) = 4 [pid 619] close(3) = 0 [pid 619] symlink("/dev/binderfs", "./binderfs") = 0 [pid 619] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 619] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 619] open("./file0", O_RDONLY) = 3 [pid 619] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [ 134.853863][ T613] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 134.862263][ T613] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 134.870219][ T613] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 134.878184][ T613] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 134.886140][ T613] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 134.894097][ T613] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000029 [ 134.940428][ T616] FAULT_INJECTION: forcing a failure. [ 134.940428][ T616] name failslab, interval 1, probability 0, space 0, times 0 [ 134.953188][ T616] CPU: 0 PID: 616 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 134.964799][ T616] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 134.974883][ T616] Call Trace: [ 134.978166][ T616] dump_stack_lvl+0x1e2/0x24b [ 134.982826][ T616] ? panic+0x7d7/0x7d7 [ 134.986878][ T616] ? bfq_pos_tree_add_move+0x43e/0x43e [ 134.992314][ T616] ? find_next_bit+0xd6/0x120 [ 134.996965][ T616] ? cpumask_next+0x11/0x30 [ 135.001445][ T616] dump_stack+0x15/0x17 [ 135.005586][ T616] should_fail+0x3c0/0x510 [ 135.009984][ T616] ? percpu_ref_init+0xd0/0x330 [ 135.014821][ T616] __should_failslab+0x9f/0xe0 [ 135.019557][ T616] should_failslab+0x9/0x20 [ 135.024040][ T616] kmem_cache_alloc_trace+0x3a/0x330 [ 135.029308][ T616] percpu_ref_init+0xd0/0x330 [ 135.033972][ T616] ? cgroup_setup_root+0xea0/0xea0 [ 135.039059][ T616] cgroup_apply_control_enable+0x3a2/0x12f0 [ 135.044927][ T616] cgroup_apply_control+0x93/0x710 [ 135.050021][ T616] ? css_next_child+0x160/0x160 [ 135.054848][ T616] ? io_schedule+0x120/0x120 [ 135.059412][ T616] ? kernfs_fop_write_iter+0x15e/0x410 [ 135.064843][ T616] ? __kasan_check_write+0x14/0x20 [ 135.069928][ T616] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 135.075188][ T616] cgroup_subtree_control_write+0xd19/0x1310 [ 135.081142][ T616] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 135.087110][ T616] ? __kasan_check_write+0x14/0x20 [ 135.092204][ T616] ? _copy_from_iter+0x3fb/0xd60 [ 135.097115][ T616] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 135.103076][ T616] cgroup_file_write+0x28e/0x590 [ 135.108004][ T616] ? cgroup_seqfile_stop+0xc0/0xc0 [ 135.113092][ T616] ? mutex_lock+0xa6/0x110 [ 135.117482][ T616] ? mutex_trylock+0xb0/0xb0 [ 135.122049][ T616] ? __kasan_check_write+0x14/0x20 [ 135.127495][ T616] kernfs_fop_write_iter+0x2d0/0x410 [ 135.132763][ T616] ? cgroup_seqfile_stop+0xc0/0xc0 [ 135.137857][ T616] vfs_write+0xc1c/0xf40 [ 135.142082][ T616] ? __kasan_check_write+0x14/0x20 [ 135.147178][ T616] ? kernel_write+0x3c0/0x3c0 [ 135.151837][ T616] ? _raw_spin_unlock_irq+0x4e/0x70 [ 135.157011][ T616] ? ptrace_stop+0x6ff/0x9f0 [ 135.161587][ T616] ? __kasan_check_read+0x11/0x20 [ 135.166595][ T616] ? __fdget_pos+0x27e/0x310 [ 135.171160][ T616] ksys_write+0x198/0x2c0 [ 135.175466][ T616] ? do_notify_parent+0xa60/0xa60 [ 135.180473][ T616] ? __ia32_sys_read+0x90/0x90 [ 135.185217][ T616] ? __ia32_sys_open+0x270/0x270 [ 135.190136][ T616] __x64_sys_write+0x7b/0x90 [ 135.194711][ T616] do_syscall_64+0x34/0x70 [ 135.199117][ T616] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 135.204992][ T616] RIP: 0033:0x7fc8ece62c09 [ 135.209378][ T616] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 135.228958][ T616] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 619] write(4, "-pids ", 6 [pid 616] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 616] close(3) = 0 [pid 616] close(4) = 0 [pid 616] close(5) = 0 [pid 616] close(6) = -1 EBADF (Bad file descriptor) [pid 616] close(7) = -1 EBADF (Bad file descriptor) [pid 616] close(8) = -1 EBADF (Bad file descriptor) [pid 616] close(9) = -1 EBADF (Bad file descriptor) [pid 616] close(10) = -1 EBADF (Bad file descriptor) [pid 616] close(11) = -1 EBADF (Bad file descriptor) [pid 616] close(12) = -1 EBADF (Bad file descriptor) [pid 616] close(13) = -1 EBADF (Bad file descriptor) [pid 616] close(14) = -1 EBADF (Bad file descriptor) [pid 616] close(15) = -1 EBADF (Bad file descriptor) [pid 616] close(16) = -1 EBADF (Bad file descriptor) [pid 616] close(17) = -1 EBADF (Bad file descriptor) [pid 616] close(18) = -1 EBADF (Bad file descriptor) [pid 616] close(19) = -1 EBADF (Bad file descriptor) [pid 616] close(20) = -1 EBADF (Bad file descriptor) [pid 616] close(21) = -1 EBADF (Bad file descriptor) [pid 616] close(22) = -1 EBADF (Bad file descriptor) [pid 616] close(23) = -1 EBADF (Bad file descriptor) [pid 616] close(24) = -1 EBADF (Bad file descriptor) [pid 616] close(25) = -1 EBADF (Bad file descriptor) [pid 616] close(26) = -1 EBADF (Bad file descriptor) [pid 616] close(27) = -1 EBADF (Bad file descriptor) [pid 616] close(28) = -1 EBADF (Bad file descriptor) [pid 616] close(29) = -1 EBADF (Bad file descriptor) [pid 616] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory ) = 89 [pid 616] exit_group(0) = ? [pid 616] +++ exited with 0 +++ [pid 376] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=40, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 376] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 376] umount2("./38", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] openat(AT_FDCWD, "./38", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 376] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 376] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 376] umount2("./38/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./38/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 376] unlink("./38/binderfs") = 0 [pid 376] umount2("./38/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./38/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 376] unlink("./38/cgroup") = 0 [pid 376] umount2("./38/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./38/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 376] unlink("./38/cgroup.net") = 0 [pid 376] umount2("./38/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 376] umount2("./38/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./38/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 376] umount2("./38/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] openat(AT_FDCWD, "./38/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 376] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 376] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 376] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 376] close(4) = 0 [pid 376] rmdir("./38/file0") = 0 [pid 376] umount2("./38/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./38/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 376] unlink("./38/cgroup.cpu") = 0 [pid 376] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 376] close(3) = 0 [pid 376] rmdir("./38") = 0 [pid 376] mkdir("./39", 0777) = 0 [pid 376] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 620 attached , child_tidptr=0x555556fab5d0) = 41 [pid 620] chdir("./39") = 0 [pid 620] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 620] setpgid(0, 0) = 0 [pid 620] symlink("/syzcgroup/unified/syz1", "./cgroup") = 0 [pid 620] symlink("/syzcgroup/cpu/syz1", "./cgroup.cpu") = 0 [pid 620] symlink("/syzcgroup/net/syz1", "./cgroup.net") = 0 [pid 620] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 620] write(3, "1000", 4) = 4 [pid 620] close(3) = 0 [pid 620] symlink("/dev/binderfs", "./binderfs") = 0 [pid 620] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 620] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 620] open("./file0", O_RDONLY) = 3 [pid 620] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [ 135.237362][ T616] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 135.245315][ T616] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 135.253266][ T616] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 135.261220][ T616] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 135.269178][ T616] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000026 [pid 620] write(4, "-pids ", 6) = 6 [pid 619] <... write resumed>) = 6 [pid 620] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 619] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 620] write(5, "22", 2 [pid 619] <... openat resumed>) = 5 [pid 620] <... write resumed>) = 2 [pid 620] write(4, "+pids ", 6 [pid 619] write(5, "22", 2) = 2 [ 135.320374][ T611] FAULT_INJECTION: forcing a failure. [ 135.320374][ T611] name failslab, interval 1, probability 0, space 0, times 0 [ 135.334452][ T611] CPU: 0 PID: 611 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 135.346071][ T611] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 135.356108][ T611] Call Trace: [ 135.359391][ T611] dump_stack_lvl+0x1e2/0x24b [ 135.364043][ T611] ? panic+0x7d7/0x7d7 [ 135.368092][ T611] ? bfq_pos_tree_add_move+0x43e/0x43e [ 135.373526][ T611] ? find_next_bit+0xd6/0x120 [ 135.378186][ T611] ? cpumask_next+0x11/0x30 [ 135.382685][ T611] dump_stack+0x15/0x17 [ 135.386846][ T611] should_fail+0x3c0/0x510 [ 135.391248][ T611] ? percpu_ref_init+0xd0/0x330 [ 135.396085][ T611] __should_failslab+0x9f/0xe0 [ 135.400833][ T611] should_failslab+0x9/0x20 [ 135.405312][ T611] kmem_cache_alloc_trace+0x3a/0x330 [ 135.410580][ T611] percpu_ref_init+0xd0/0x330 [ 135.415248][ T611] ? cgroup_setup_root+0xea0/0xea0 [ 135.420342][ T611] cgroup_apply_control_enable+0x3a2/0x12f0 [ 135.426215][ T611] cgroup_apply_control+0x93/0x710 [ 135.431306][ T611] ? css_next_child+0x160/0x160 [ 135.436141][ T611] ? io_schedule+0x120/0x120 [ 135.440705][ T611] ? kernfs_fop_write_iter+0x15e/0x410 [ 135.446145][ T611] ? __kasan_check_write+0x14/0x20 [ 135.451241][ T611] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 135.456525][ T611] cgroup_subtree_control_write+0xd19/0x1310 [ 135.462516][ T611] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 135.468495][ T611] ? __kasan_check_write+0x14/0x20 [ 135.473601][ T611] ? _copy_from_iter+0x3fb/0xd60 [ 135.478516][ T611] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 135.484470][ T611] cgroup_file_write+0x28e/0x590 [ 135.489394][ T611] ? cgroup_seqfile_stop+0xc0/0xc0 [ 135.494489][ T611] ? mutex_lock+0xa6/0x110 [ 135.498882][ T611] ? mutex_trylock+0xb0/0xb0 [ 135.503452][ T611] ? __kasan_check_write+0x14/0x20 [ 135.508549][ T611] kernfs_fop_write_iter+0x2d0/0x410 [ 135.513817][ T611] ? cgroup_seqfile_stop+0xc0/0xc0 [ 135.518906][ T611] vfs_write+0xc1c/0xf40 [ 135.523139][ T611] ? __kasan_check_write+0x14/0x20 [ 135.528235][ T611] ? kernel_write+0x3c0/0x3c0 [ 135.532984][ T611] ? _raw_spin_unlock_irq+0x4e/0x70 [ 135.538158][ T611] ? ptrace_stop+0x6ff/0x9f0 [ 135.542734][ T611] ? __kasan_check_read+0x11/0x20 [ 135.547741][ T611] ? __fdget_pos+0x27e/0x310 [ 135.552342][ T611] ksys_write+0x198/0x2c0 [ 135.556676][ T611] ? do_notify_parent+0xa60/0xa60 [ 135.561679][ T611] ? __ia32_sys_read+0x90/0x90 [ 135.566422][ T611] ? __ia32_sys_open+0x270/0x270 [ 135.571348][ T611] __x64_sys_write+0x7b/0x90 [ 135.575913][ T611] do_syscall_64+0x34/0x70 [ 135.580304][ T611] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 135.586176][ T611] RIP: 0033:0x7fc8ece62c09 [ 135.590565][ T611] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 135.610148][ T611] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 619] write(4, "+pids ", 6 [pid 611] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 611] close(3) = 0 [pid 611] close(4) = 0 [pid 611] close(5) = 0 [pid 611] close(6) = -1 EBADF (Bad file descriptor) [pid 611] close(7) = -1 EBADF (Bad file descriptor) [pid 611] close(8) = -1 EBADF (Bad file descriptor) [pid 611] close(9) = -1 EBADF (Bad file descriptor) [pid 611] close(10) = -1 EBADF (Bad file descriptor) [pid 611] close(11) = -1 EBADF (Bad file descriptor) [pid 611] close(12) = -1 EBADF (Bad file descriptor) [pid 611] close(13) = -1 EBADF (Bad file descriptor) [pid 611] close(14) = -1 EBADF (Bad file descriptor) [pid 611] close(15) = -1 EBADF (Bad file descriptor) [pid 611] close(16) = -1 EBADF (Bad file descriptor) [pid 611] close(17) = -1 EBADF (Bad file descriptor) [pid 611] close(18) = -1 EBADF (Bad file descriptor) [pid 611] close(19) = -1 EBADF (Bad file descriptor) [pid 611] close(20) = -1 EBADF (Bad file descriptor) [pid 611] close(21) = -1 EBADF (Bad file descriptor) [pid 611] close(22) = -1 EBADF (Bad file descriptor) [pid 611] close(23) = -1 EBADF (Bad file descriptor) [pid 611] close(24) = -1 EBADF (Bad file descriptor) [pid 611] close(25) = -1 EBADF (Bad file descriptor) [pid 611] close(26) = -1 EBADF (Bad file descriptor) [pid 611] close(27) = -1 EBADF (Bad file descriptor) [pid 611] close(28) = -1 EBADF (Bad file descriptor) [pid 611] close(29) = -1 EBADF (Bad file descriptor) [pid 611] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory ) = 89 [pid 611] exit_group(0) = ? [pid 611] +++ exited with 0 +++ [pid 381] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=39, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 381] umount2("./37", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] openat(AT_FDCWD, "./37", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 381] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 381] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 381] umount2("./37/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./37/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 381] unlink("./37/binderfs") = 0 [pid 381] umount2("./37/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./37/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 381] unlink("./37/cgroup") = 0 [pid 381] umount2("./37/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./37/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 381] unlink("./37/cgroup.net") = 0 [pid 381] umount2("./37/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 381] umount2("./37/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./37/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 381] umount2("./37/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] openat(AT_FDCWD, "./37/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 381] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 381] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 381] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 381] close(4) = 0 [pid 381] rmdir("./37/file0") = 0 [pid 381] umount2("./37/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./37/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 381] unlink("./37/cgroup.cpu") = 0 [pid 381] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 381] close(3) = 0 [pid 381] rmdir("./37") = 0 [pid 381] mkdir("./38", 0777) = 0 [pid 381] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 621 attached [pid 621] chdir("./38" [pid 381] <... clone resumed>, child_tidptr=0x555556fab5d0) = 40 [pid 621] <... chdir resumed>) = 0 [pid 621] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 621] setpgid(0, 0) = 0 [pid 621] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [pid 621] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 621] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 621] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 621] write(3, "1000", 4) = 4 [pid 621] close(3) = 0 [pid 621] symlink("/dev/binderfs", "./binderfs") = 0 [pid 621] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 621] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 621] open("./file0", O_RDONLY) = 3 [pid 621] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [ 135.618551][ T611] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 135.626508][ T611] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 135.634460][ T611] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 135.642418][ T611] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 135.650369][ T611] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000025 [pid 621] write(4, "-pids ", 6) = 6 [pid 621] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 621] write(5, "22", 2) = 2 [ 135.700578][ T618] FAULT_INJECTION: forcing a failure. [ 135.700578][ T618] name failslab, interval 1, probability 0, space 0, times 0 [ 135.713621][ T618] CPU: 0 PID: 618 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 135.725231][ T618] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 135.735265][ T618] Call Trace: [ 135.738534][ T618] dump_stack_lvl+0x1e2/0x24b [ 135.743185][ T618] ? panic+0x7d7/0x7d7 [ 135.747226][ T618] ? bfq_pos_tree_add_move+0x43e/0x43e [ 135.752658][ T618] ? find_next_bit+0xd6/0x120 [ 135.757336][ T618] ? cpumask_next+0x11/0x30 [ 135.761812][ T618] dump_stack+0x15/0x17 [ 135.765944][ T618] should_fail+0x3c0/0x510 [ 135.770335][ T618] ? percpu_ref_init+0xd0/0x330 [ 135.775162][ T618] __should_failslab+0x9f/0xe0 [ 135.779898][ T618] should_failslab+0x9/0x20 [ 135.784377][ T618] kmem_cache_alloc_trace+0x3a/0x330 [ 135.789636][ T618] percpu_ref_init+0xd0/0x330 [ 135.794288][ T618] ? cgroup_setup_root+0xea0/0xea0 [ 135.799377][ T618] cgroup_apply_control_enable+0x3a2/0x12f0 [ 135.805258][ T618] cgroup_apply_control+0x93/0x710 [ 135.810342][ T618] ? css_next_child+0x160/0x160 [ 135.815168][ T618] ? stack_trace_save+0x12d/0x1f0 [ 135.820171][ T618] ? io_schedule+0x120/0x120 [ 135.824741][ T618] ? kernfs_fop_write_iter+0x15e/0x410 [ 135.830176][ T618] ? __kasan_check_write+0x14/0x20 [ 135.835270][ T618] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 135.840539][ T618] cgroup_subtree_control_write+0xd19/0x1310 [ 135.846500][ T618] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 135.852468][ T618] ? __kasan_check_write+0x14/0x20 [ 135.857572][ T618] ? _copy_from_iter+0x3fb/0xd60 [ 135.862493][ T618] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 135.868451][ T618] cgroup_file_write+0x28e/0x590 [ 135.873363][ T618] ? cgroup_seqfile_stop+0xc0/0xc0 [ 135.878461][ T618] ? mutex_lock+0xa6/0x110 [ 135.882871][ T618] ? mutex_trylock+0xb0/0xb0 [ 135.887443][ T618] ? __kasan_check_write+0x14/0x20 [ 135.892530][ T618] kernfs_fop_write_iter+0x2d0/0x410 [ 135.897790][ T618] ? cgroup_seqfile_stop+0xc0/0xc0 [ 135.902899][ T618] vfs_write+0xc1c/0xf40 [ 135.907129][ T618] ? __kasan_check_write+0x14/0x20 [ 135.912230][ T618] ? kernel_write+0x3c0/0x3c0 [ 135.916900][ T618] ? _raw_spin_unlock_irq+0x4e/0x70 [ 135.922083][ T618] ? ptrace_stop+0x6ff/0x9f0 [ 135.926647][ T618] ? __kasan_check_read+0x11/0x20 [ 135.931644][ T618] ? __fdget_pos+0x27e/0x310 [ 135.936209][ T618] ksys_write+0x198/0x2c0 [ 135.940514][ T618] ? do_notify_parent+0xa60/0xa60 [ 135.945510][ T618] ? __ia32_sys_read+0x90/0x90 [ 135.950248][ T618] ? __ia32_sys_open+0x270/0x270 [ 135.955158][ T618] __x64_sys_write+0x7b/0x90 [ 135.959722][ T618] do_syscall_64+0x34/0x70 [ 135.964122][ T618] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 135.969996][ T618] RIP: 0033:0x7fc8ece62c09 [ 135.974386][ T618] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 621] write(4, "+pids ", 6 [pid 383] kill(-34, SIGKILL [pid 618] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 618] close(3 [pid 383] <... kill resumed>) = 0 [pid 383] kill(34, SIGKILL [pid 618] <... close resumed>) = 0 [pid 383] <... kill resumed>) = 0 [pid 618] close(4) = 0 [pid 618] close(5) = 0 [pid 618] close(6) = -1 EBADF (Bad file descriptor) [pid 618] close(7) = -1 EBADF (Bad file descriptor) [pid 618] close(8) = -1 EBADF (Bad file descriptor) [pid 618] close(9) = -1 EBADF (Bad file descriptor) [pid 618] close(10) = -1 EBADF (Bad file descriptor) [pid 618] close(11) = -1 EBADF (Bad file descriptor) [pid 618] close(12) = -1 EBADF (Bad file descriptor) [pid 618] close(13) = -1 EBADF (Bad file descriptor) [pid 618] close(14) = -1 EBADF (Bad file descriptor) [pid 618] close(15) = -1 EBADF (Bad file descriptor) [pid 618] close(16) = -1 EBADF (Bad file descriptor) [pid 618] close(17) = -1 EBADF (Bad file descriptor) [pid 618] close(18) = -1 EBADF (Bad file descriptor) [pid 618] close(19) = -1 EBADF (Bad file descriptor) [pid 618] close(20) = -1 EBADF (Bad file descriptor) [pid 618] close(21) = -1 EBADF (Bad file descriptor) [pid 618] close(22) = -1 EBADF (Bad file descriptor) [pid 618] close(23) = -1 EBADF (Bad file descriptor) [pid 618] close(24) = -1 EBADF (Bad file descriptor) [pid 618] close(25) = -1 EBADF (Bad file descriptor) [pid 618] close(26) = -1 EBADF (Bad file descriptor) [pid 618] close(27) = -1 EBADF (Bad file descriptor) [pid 618] close(28) = -1 EBADF (Bad file descriptor) [pid 618] close(29) = -1 EBADF (Bad file descriptor) [pid 618] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory ) = 89 [pid 618] exit_group(0) = ? [pid 618] +++ exited with 0 +++ [pid 382] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=44, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 382] umount2("./42", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] openat(AT_FDCWD, "./42", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 382] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 382] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 382] umount2("./42/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./42/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 382] unlink("./42/binderfs") = 0 [pid 382] umount2("./42/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./42/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 382] unlink("./42/cgroup") = 0 [pid 382] umount2("./42/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./42/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 382] unlink("./42/cgroup.net") = 0 [pid 382] umount2("./42/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 382] umount2("./42/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./42/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 382] umount2("./42/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] openat(AT_FDCWD, "./42/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 382] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 382] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 382] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 382] close(4) = 0 [pid 382] rmdir("./42/file0") = 0 [pid 382] umount2("./42/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./42/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 382] unlink("./42/cgroup.cpu") = 0 [pid 382] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 382] close(3) = 0 [pid 382] rmdir("./42") = 0 [pid 382] mkdir("./43", 0777) = 0 [ 135.993968][ T618] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 136.002357][ T618] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 136.010303][ T618] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 136.018247][ T618] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 136.026194][ T618] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 136.034141][ T618] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 000000000000002a [pid 382] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 622 attached [pid 622] chdir("./43") = 0 [pid 622] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 382] <... clone resumed>, child_tidptr=0x555556fab5d0) = 45 [pid 622] <... prctl resumed>) = 0 [pid 622] setpgid(0, 0) = 0 [pid 622] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 622] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [pid 622] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 622] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 622] write(3, "1000", 4) = 4 [pid 622] close(3) = 0 [pid 622] symlink("/dev/binderfs", "./binderfs") = 0 [pid 622] mkdirat(AT_FDCWD, "./file0", 000) = 0 [ 136.070791][ T610] FAULT_INJECTION: forcing a failure. [ 136.070791][ T610] name failslab, interval 1, probability 0, space 0, times 0 [ 136.084382][ T610] CPU: 0 PID: 610 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 136.095999][ T610] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 136.106029][ T610] Call Trace: [ 136.109322][ T610] dump_stack_lvl+0x1e2/0x24b [ 136.113977][ T610] ? panic+0x7d7/0x7d7 [ 136.118020][ T610] ? bfq_pos_tree_add_move+0x43e/0x43e [ 136.123459][ T610] ? find_next_bit+0xd6/0x120 [ 136.128109][ T610] ? cpumask_next+0x11/0x30 [ 136.132593][ T610] dump_stack+0x15/0x17 [ 136.136739][ T610] should_fail+0x3c0/0x510 [ 136.141135][ T610] ? percpu_ref_init+0xd0/0x330 [ 136.145977][ T610] __should_failslab+0x9f/0xe0 [ 136.150724][ T610] should_failslab+0x9/0x20 [ 136.155200][ T610] kmem_cache_alloc_trace+0x3a/0x330 [ 136.160490][ T610] percpu_ref_init+0xd0/0x330 [ 136.165142][ T610] ? cgroup_setup_root+0xea0/0xea0 [pid 622] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 383] openat(AT_FDCWD, "/sys/fs/fuse/connections", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 383] fstat(3, {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0 [pid 383] getdents64(3, 0x555556fad630 /* 2 entries */, 32768) = 48 [pid 383] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 383] close(3) = 0 [ 136.170240][ T610] cgroup_apply_control_enable+0x3a2/0x12f0 [ 136.176116][ T610] cgroup_apply_control+0x93/0x710 [ 136.181207][ T610] ? css_next_child+0x160/0x160 [ 136.186035][ T610] ? stack_trace_save+0x12d/0x1f0 [ 136.191033][ T610] ? io_schedule+0x120/0x120 [ 136.195602][ T610] ? kernfs_fop_write_iter+0x15e/0x410 [ 136.201058][ T610] ? __kasan_check_write+0x14/0x20 [ 136.206154][ T610] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 136.211417][ T610] cgroup_subtree_control_write+0xd19/0x1310 [ 136.217382][ T610] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 136.223345][ T610] ? __kasan_check_write+0x14/0x20 [ 136.228432][ T610] ? _copy_from_iter+0x3fb/0xd60 [ 136.233341][ T610] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 136.239299][ T610] cgroup_file_write+0x28e/0x590 [ 136.244223][ T610] ? cgroup_seqfile_stop+0xc0/0xc0 [ 136.249318][ T610] ? mutex_lock+0xa6/0x110 [ 136.253712][ T610] ? mutex_trylock+0xb0/0xb0 [ 136.258274][ T610] ? __kasan_check_write+0x14/0x20 [ 136.263360][ T610] kernfs_fop_write_iter+0x2d0/0x410 [ 136.268619][ T610] ? cgroup_seqfile_stop+0xc0/0xc0 [ 136.273704][ T610] vfs_write+0xc1c/0xf40 [ 136.277929][ T610] ? __kasan_check_write+0x14/0x20 [ 136.283025][ T610] ? kernel_write+0x3c0/0x3c0 [ 136.287682][ T610] ? _raw_spin_unlock_irq+0x4e/0x70 [ 136.292862][ T610] ? ptrace_stop+0x6ff/0x9f0 [ 136.297427][ T610] ? __kasan_check_read+0x11/0x20 [ 136.302425][ T610] ? __fdget_pos+0x27e/0x310 [ 136.306991][ T610] ksys_write+0x198/0x2c0 [ 136.311296][ T610] ? do_notify_parent+0xa60/0xa60 [ 136.316294][ T610] ? __ia32_sys_read+0x90/0x90 [ 136.321030][ T610] ? fpregs_assert_state_consistent+0xb6/0xe0 [ 136.327080][ T610] __x64_sys_write+0x7b/0x90 [ 136.331659][ T610] do_syscall_64+0x34/0x70 [ 136.336063][ T610] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 136.341943][ T610] RIP: 0033:0x7fc8ece62c09 [ 136.346345][ T610] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 622] <... mount resumed>) = 0 [pid 610] <... write resumed>) = ? [pid 622] open("./file0", O_RDONLY) = 3 [pid 622] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [pid 622] write(4, "-pids ", 6 [pid 610] +++ killed by SIGKILL +++ [pid 383] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=34, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=1} --- [pid 383] umount2("./32", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] openat(AT_FDCWD, "./32", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 383] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 383] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 383] umount2("./32/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./32/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 383] unlink("./32/binderfs") = 0 [pid 383] umount2("./32/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./32/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 383] unlink("./32/cgroup") = 0 [pid 383] umount2("./32/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./32/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 383] unlink("./32/cgroup.net") = 0 [ 136.365937][ T610] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 136.374329][ T610] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 136.382287][ T610] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 136.390250][ T610] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 136.398209][ T610] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 136.406161][ T610] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000020 [ 136.422707][ T383] ------------[ cut here ]------------ [ 136.428220][ T383] WARNING: CPU: 1 PID: 383 at fs/namespace.c:1168 mntput_no_expire+0x48a/0x6c0 [ 136.437176][ T383] Modules linked in: [ 136.440490][ T621] FAULT_INJECTION: forcing a failure. [ 136.440490][ T621] name failslab, interval 1, probability 0, space 0, times 0 [ 136.441097][ T383] CPU: 1 PID: 383 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 136.453873][ T621] CPU: 0 PID: 621 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 136.465276][ T383] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 136.476859][ T621] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 136.476863][ T621] Call Trace: [ 136.476881][ T621] dump_stack_lvl+0x1e2/0x24b [ 136.476898][ T621] ? bfq_pos_tree_add_move+0x43e/0x43e [ 136.487108][ T383] RIP: 0010:mntput_no_expire+0x48a/0x6c0 [ 136.497121][ T621] ? selinux_kernfs_init_security+0x1a8/0x760 [ 136.497133][ T621] dump_stack+0x15/0x17 [ 136.497151][ T621] should_fail+0x3c0/0x510 [ 136.500425][ T383] Code: 48 c7 c2 80 02 44 86 e8 64 f0 8e ff e9 8b fc ff ff e8 ba 21 b6 ff e9 81 fc ff ff e8 b0 21 b6 ff e9 77 fc ff ff e8 a6 21 b6 ff <0f> 0b e9 f4 fc ff ff e8 9a 21 b6 ff e8 65 ad a2 ff e9 ea fc ff ff [ 136.505071][ T621] ? __kernfs_new_node+0x99/0x6e0 [ 136.510503][ T383] RSP: 0018:ffffc90000b87ca0 EFLAGS: 00010293 [ 136.516103][ T621] __should_failslab+0x9f/0xe0 [ 136.522139][ T383] [ 136.526270][ T621] should_failslab+0x9/0x20 [ 136.530662][ T383] RAX: ffffffff81b68f1a RBX: 00000000ffffffff RCX: ffff8881065e3b40 [ 136.550230][ T621] __kmalloc_track_caller+0x5f/0x350 [ 136.550240][ T621] kstrdup_const+0x55/0x90 [ 136.550262][ T621] __kernfs_new_node+0x99/0x6e0 [ 136.555252][ T383] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000 [ 136.561289][ T621] ? is_module_text_address+0xe1/0x140 [ 136.561298][ T621] ? kernfs_new_node+0x170/0x170 [ 136.561314][ T621] ? ptr_to_hashval+0x60/0x60 [ 136.566048][ T383] RBP: ffffc90000b87d70 R08: ffffffff81b68c08 R09: 0000000000000003 [ 136.568352][ T621] ? arch_stack_walk+0xf8/0x140 [ 136.572853][ T383] R10: fffff52000170f85 R11: 1ffff92000170f84 R12: dffffc0000000000 [ 136.580786][ T621] ? snprintf+0xd6/0x120 [ 136.580801][ T621] kernfs_new_node+0x97/0x170 [ 136.586055][ T383] R13: ffff8881192dcfc0 R14: ffffc90000b87d00 R15: 1ffff92000170f9c [ 136.590437][ T621] __kernfs_create_file+0x4a/0x270 [ 136.590453][ T621] cgroup_addrm_files+0xab8/0xfe0 [ 136.595273][ T383] FS: 0000555556fab300(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 136.603210][ T621] ? ____kasan_kmalloc+0xdc/0x110 [ 136.603225][ T621] ? __kasan_kmalloc+0x9/0x10 [ 136.608650][ T383] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 136.613555][ T621] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 136.613571][ T621] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 136.618215][ T383] CR2: 00007fc8ececd130 CR3: 0000000104bfa000 CR4: 00000000003506a0 [ 136.626155][ T621] ? delete_node+0x759/0x7b0 [ 136.626165][ T621] ? __kasan_check_read+0x11/0x20 [ 136.626178][ T621] ? delete_node+0x759/0x7b0 [ 136.631006][ T383] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 136.638945][ T621] ? __kasan_check_write+0x14/0x20 [ 136.643160][ T383] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 136.647806][ T621] ? idr_replace+0x1c4/0x230 [ 136.655755][ T383] Call Trace: [ 136.660827][ T621] ? idr_get_next+0x4b0/0x4b0 [ 136.660843][ T621] ? _raw_spin_lock_bh+0xa3/0x1b0 [ 136.665838][ T383] ? lockref_get_or_lock+0x340/0x340 [ 136.674730][ T621] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 136.674740][ T621] css_populate_dir+0x137/0x370 [ 136.674761][ T621] cgroup_apply_control_enable+0x8b9/0x12f0 [ 136.679758][ T383] ? umount_tree+0xf50/0xf50 [ 136.684401][ T621] cgroup_apply_control+0x93/0x710 [ 136.684417][ T621] ? css_next_child+0x160/0x160 [ 136.690981][ T383] ? vfs_submount+0xb0/0xb0 [ 136.696489][ T621] ? stack_trace_save+0x12d/0x1f0 [ 136.702617][ T383] ? dput+0x2b6/0x320 [ 136.710553][ T621] ? io_schedule+0x120/0x120 [ 136.710569][ T621] ? kernfs_fop_write_iter+0x15e/0x410 [ 136.715128][ T383] path_umount+0x1fe/0xfb0 [ 136.720123][ T621] ? __kasan_check_write+0x14/0x20 [ 136.724691][ T383] ? namespace_unlock+0x4f0/0x4f0 [ 136.732622][ T621] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 136.732639][ T621] cgroup_subtree_control_write+0xd19/0x1310 [ 136.737720][ T383] ? user_path_at_empty+0x40/0x50 [ 136.745658][ T621] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 136.745674][ T621] ? __kasan_check_write+0x14/0x20 [ 136.750242][ T383] __x64_sys_umount+0x122/0x170 [ 136.753496][ T621] ? _copy_from_iter+0x3fb/0xd60 [ 136.758138][ T383] ? path_umount+0xfb0/0xfb0 [ 136.763125][ T621] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 136.763140][ T621] cgroup_file_write+0x28e/0x590 [ 136.768396][ T383] ? syscall_enter_from_user_mode+0x58/0x1b0 [ 136.773555][ T621] ? cgroup_seqfile_stop+0xc0/0xc0 [ 136.773571][ T621] ? mutex_lock+0xa6/0x110 [ 136.778390][ T383] do_syscall_64+0x34/0x70 [ 136.784259][ T621] ? mutex_trylock+0xb0/0xb0 [ 136.784276][ T621] ? __kasan_check_write+0x14/0x20 [ 136.788839][ T383] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [pid 383] umount2("./32/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 383] umount2("./32/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./32/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 383] umount2("./32/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] openat(AT_FDCWD, "./32/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 383] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 383] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 383] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 383] close(4) = 0 [pid 383] rmdir("./32/file0") = 0 [pid 383] umount2("./32/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./32/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 383] unlink("./32/cgroup.cpu") = 0 [pid 383] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 383] close(3) = 0 [pid 383] rmdir("./32") = 0 [pid 383] mkdir("./33", 0777) = 0 [pid 383] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556fab5d0) = 35 ./strace-static-x86_64: Process 623 attached [pid 623] chdir("./33") = 0 [pid 623] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 623] setpgid(0, 0) = 0 [pid 623] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 623] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 623] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [pid 623] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 623] write(3, "1000", 4) = 4 [pid 623] close(3) = 0 [pid 623] symlink("/dev/binderfs", "./binderfs") = 0 [pid 623] mkdirat(AT_FDCWD, "./file0", 000) = 0 [ 136.793912][ T621] kernfs_fop_write_iter+0x2d0/0x410 [ 136.793927][ T621] ? cgroup_seqfile_stop+0xc0/0xc0 [ 136.798749][ T383] RIP: 0033:0x7fc8ece63fb7 [ 136.803215][ T621] vfs_write+0xc1c/0xf40 [ 136.803235][ T621] ? __kasan_check_write+0x14/0x20 [ 136.808316][ T383] Code: 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 136.812349][ T621] ? kernel_write+0x3c0/0x3c0 [ 136.812364][ T621] ? _raw_spin_unlock_irq+0x4e/0x70 [ 136.816923][ T383] RSP: 002b:00007ffd7d0e2358 EFLAGS: 00000202 [ 136.822358][ T621] ? ptrace_stop+0x6ff/0x9f0 [ 136.822374][ T621] ? __kasan_check_read+0x11/0x20 [ 136.826757][ T383] ORIG_RAX: 00000000000000a6 [ 136.831835][ T621] ? __fdget_pos+0x27e/0x310 [ 136.831850][ T621] ksys_write+0x198/0x2c0 [ 136.836844][ T383] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc8ece63fb7 [ 136.842093][ T621] ? do_notify_parent+0xa60/0xa60 [ 136.842108][ T621] ? __ia32_sys_read+0x90/0x90 [ 136.848056][ T383] RDX: 00007ffd7d0e241a RSI: 000000000000000a RDI: 00007ffd7d0e2410 [ 136.853046][ T621] ? __ia32_sys_open+0x270/0x270 [ 136.853062][ T621] __x64_sys_write+0x7b/0x90 [ 136.859014][ T383] RBP: 00007ffd7d0e2410 R08: 00000000ffffffff R09: 00007ffd7d0e21f0 [ 136.864094][ T621] do_syscall_64+0x34/0x70 [ 136.864110][ T621] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 136.868926][ T383] R10: 0000555556fad6a3 R11: 0000000000000202 R12: 00007ffd7d0e3490 [ 136.873825][ T621] RIP: 0033:0x7fc8ece62c09 [ 136.873841][ T621] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 136.878392][ T383] R13: 0000555556fad600 R14: 00007ffd7d0e2380 R15: 0000000000000021 [ 136.878403][ T383] ---[ end trace d4de1ca9cdcd1988 ]--- [ 136.884345][ T621] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 136.884363][ T621] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [pid 623] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 621] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 623] <... mount resumed>) = 0 [pid 621] close(3) = 0 [pid 621] close(4) = 0 [pid 621] close(5) = 0 [pid 621] close(6) = -1 EBADF (Bad file descriptor) [pid 621] close(7) = -1 EBADF (Bad file descriptor) [pid 621] close(8) = -1 EBADF (Bad file descriptor) [pid 621] close(9) = -1 EBADF (Bad file descriptor) [pid 621] close(10) = -1 EBADF (Bad file descriptor) [pid 621] close(11) = -1 EBADF (Bad file descriptor) [pid 621] close(12) = -1 EBADF (Bad file descriptor) [pid 621] close(13) = -1 EBADF (Bad file descriptor) [pid 621] close(14) = -1 EBADF (Bad file descriptor) [pid 621] close(15) = -1 EBADF (Bad file descriptor) [pid 621] close(16) = -1 EBADF (Bad file descriptor) [pid 621] close(17) = -1 EBADF (Bad file descriptor) [pid 621] close(18) = -1 EBADF (Bad file descriptor) [pid 621] close(19) = -1 EBADF (Bad file descriptor) [pid 621] close(20) = -1 EBADF (Bad file descriptor) [pid 621] close(21) = -1 EBADF (Bad file descriptor) [pid 621] close(22) = -1 EBADF (Bad file descriptor) [pid 621] close(23) = -1 EBADF (Bad file descriptor) [pid 621] close(24) = -1 EBADF (Bad file descriptor) [pid 621] close(25) = -1 EBADF (Bad file descriptor) [pid 621] close(26) = -1 EBADF (Bad file descriptor) [pid 621] close(27) = -1 EBADF (Bad file descriptor) [pid 621] close(28) = -1 EBADF (Bad file descriptor) [pid 621] close(29) = -1 EBADF (Bad file descriptor) write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory [pid 621] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 621] exit_group(0) = ? [pid 623] open("./file0", O_RDONLY [pid 621] +++ exited with 0 +++ [pid 623] <... open resumed>) = 3 [pid 381] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=40, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 623] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [pid 381] umount2("./38", MNT_DETACH|UMOUNT_NOFOLLOW [pid 623] write(4, "-pids ", 6 [pid 381] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 381] openat(AT_FDCWD, "./38", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 381] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 381] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 381] umount2("./38/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./38/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 381] unlink("./38/binderfs") = 0 [pid 381] umount2("./38/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./38/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 381] unlink("./38/cgroup") = 0 [pid 381] umount2("./38/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./38/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 381] unlink("./38/cgroup.net") = 0 [pid 381] umount2("./38/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 381] umount2("./38/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./38/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 381] umount2("./38/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] openat(AT_FDCWD, "./38/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 381] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 381] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 381] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 381] close(4) = 0 [pid 381] rmdir("./38/file0") = 0 [pid 381] umount2("./38/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./38/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 381] unlink("./38/cgroup.cpu") = 0 [pid 381] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 381] close(3) = 0 [pid 381] rmdir("./38") = 0 [pid 381] mkdir("./39", 0777) = 0 [pid 381] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 624 attached , child_tidptr=0x555556fab5d0) = 41 [pid 624] chdir("./39") = 0 [pid 624] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 624] setpgid(0, 0) = 0 [pid 624] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [pid 624] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 624] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 624] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 624] write(3, "1000", 4) = 4 [pid 624] close(3) = 0 [pid 624] symlink("/dev/binderfs", "./binderfs") = 0 [pid 624] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 624] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 624] open("./file0", O_RDONLY) = 3 [pid 624] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [ 137.121998][ T621] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 137.129951][ T621] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 137.137909][ T621] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 137.145871][ T621] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000026 [ 137.154040][ T621] cgroup: cgroup_addrm_files: failed to add max, err=-12 [pid 624] write(4, "-pids ", 6) = 6 [pid 622] <... write resumed>) = 6 [pid 624] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 624] write(5, "22", 2) = 2 [pid 624] write(4, "+pids ", 6 [pid 622] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 622] write(5, "22", 2) = 2 [ 137.190594][ T617] FAULT_INJECTION: forcing a failure. [ 137.190594][ T617] name failslab, interval 1, probability 0, space 0, times 0 [ 137.203313][ T617] CPU: 1 PID: 617 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 137.214926][ T617] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 137.224958][ T617] Call Trace: [ 137.228231][ T617] dump_stack_lvl+0x1e2/0x24b [ 137.232902][ T617] ? panic+0x7d7/0x7d7 [ 137.236960][ T617] ? bfq_pos_tree_add_move+0x43e/0x43e [ 137.242401][ T617] ? find_next_bit+0xd6/0x120 [ 137.247053][ T617] ? cpumask_next+0x11/0x30 [ 137.251532][ T617] dump_stack+0x15/0x17 [ 137.255661][ T617] should_fail+0x3c0/0x510 [ 137.260052][ T617] ? percpu_ref_init+0xd0/0x330 [ 137.264876][ T617] __should_failslab+0x9f/0xe0 [ 137.269620][ T617] should_failslab+0x9/0x20 [ 137.274115][ T617] kmem_cache_alloc_trace+0x3a/0x330 [ 137.279385][ T617] percpu_ref_init+0xd0/0x330 [ 137.284034][ T617] ? cgroup_setup_root+0xea0/0xea0 [ 137.289132][ T617] cgroup_apply_control_enable+0x3a2/0x12f0 [ 137.295018][ T617] cgroup_apply_control+0x93/0x710 [ 137.300112][ T617] ? css_next_child+0x160/0x160 [ 137.304947][ T617] ? stack_trace_save+0x12d/0x1f0 [ 137.309954][ T617] ? io_schedule+0x120/0x120 [ 137.314530][ T617] ? kernfs_fop_write_iter+0x15e/0x410 [ 137.319977][ T617] ? __kasan_check_write+0x14/0x20 [ 137.325076][ T617] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 137.330344][ T617] cgroup_subtree_control_write+0xd19/0x1310 [ 137.336319][ T617] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 137.342304][ T617] ? __kasan_check_write+0x14/0x20 [ 137.347427][ T617] ? _copy_from_iter+0x3fb/0xd60 [ 137.352344][ T617] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 137.358298][ T617] cgroup_file_write+0x28e/0x590 [ 137.363217][ T617] ? cgroup_seqfile_stop+0xc0/0xc0 [ 137.368313][ T617] ? mutex_lock+0xa6/0x110 [ 137.372706][ T617] ? mutex_trylock+0xb0/0xb0 [ 137.377276][ T617] ? __kasan_check_write+0x14/0x20 [ 137.382372][ T617] kernfs_fop_write_iter+0x2d0/0x410 [ 137.387640][ T617] ? cgroup_seqfile_stop+0xc0/0xc0 [ 137.392747][ T617] vfs_write+0xc1c/0xf40 [ 137.396992][ T617] ? __kasan_check_write+0x14/0x20 [ 137.402092][ T617] ? kernel_write+0x3c0/0x3c0 [ 137.406765][ T617] ? _raw_spin_unlock_irq+0x4e/0x70 [ 137.411947][ T617] ? ptrace_stop+0x6ff/0x9f0 [ 137.416542][ T617] ? __kasan_check_read+0x11/0x20 [ 137.421554][ T617] ? __fdget_pos+0x27e/0x310 [ 137.426121][ T617] ksys_write+0x198/0x2c0 [ 137.430430][ T617] ? do_notify_parent+0xa60/0xa60 [ 137.435432][ T617] ? __ia32_sys_read+0x90/0x90 [ 137.440191][ T617] ? __ia32_sys_open+0x270/0x270 [ 137.445117][ T617] __x64_sys_write+0x7b/0x90 [ 137.449684][ T617] do_syscall_64+0x34/0x70 [ 137.454100][ T617] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 137.459967][ T617] RIP: 0033:0x7fc8ece62c09 [ 137.464357][ T617] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 622] write(4, "+pids ", 6 [pid 617] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 617] close(3) = 0 [pid 617] close(4) = 0 [pid 617] close(5) = 0 [pid 617] close(6) = -1 EBADF (Bad file descriptor) [pid 617] close(7) = -1 EBADF (Bad file descriptor) [pid 617] close(8) = -1 EBADF (Bad file descriptor) [pid 617] close(9) = -1 EBADF (Bad file descriptor) [pid 617] close(10) = -1 EBADF (Bad file descriptor) [pid 617] close(11) = -1 EBADF (Bad file descriptor) [pid 617] close(12) = -1 EBADF (Bad file descriptor) [pid 617] close(13) = -1 EBADF (Bad file descriptor) [pid 617] close(14) = -1 EBADF (Bad file descriptor) [pid 617] close(15) = -1 EBADF (Bad file descriptor) [pid 617] close(16) = -1 EBADF (Bad file descriptor) [pid 617] close(17) = -1 EBADF (Bad file descriptor) [pid 617] close(18) = -1 EBADF (Bad file descriptor) [pid 617] close(19) = -1 EBADF (Bad file descriptor) [pid 617] close(20) = -1 EBADF (Bad file descriptor) [pid 617] close(21) = -1 EBADF (Bad file descriptor) [pid 617] close(22) = -1 EBADF (Bad file descriptor) [pid 617] close(23) = -1 EBADF (Bad file descriptor) [pid 617] close(24) = -1 EBADF (Bad file descriptor) [pid 617] close(25) = -1 EBADF (Bad file descriptor) [pid 617] close(26) = -1 EBADF (Bad file descriptor) [pid 617] close(27) = -1 EBADF (Bad file descriptor) [pid 617] close(28) = -1 EBADF (Bad file descriptor) [pid 617] close(29) = -1 EBADF (Bad file descriptor) [pid 617] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 617] exit_group(0) = ? write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory [pid 617] +++ exited with 0 +++ [pid 380] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=39, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 380] umount2("./37", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] openat(AT_FDCWD, "./37", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 380] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 380] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 380] umount2("./37/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./37/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 380] unlink("./37/binderfs") = 0 [pid 380] umount2("./37/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./37/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 380] unlink("./37/cgroup") = 0 [pid 380] umount2("./37/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./37/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 380] unlink("./37/cgroup.net") = 0 [pid 380] umount2("./37/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 380] umount2("./37/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./37/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 380] umount2("./37/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] openat(AT_FDCWD, "./37/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 380] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 380] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 380] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 380] close(4) = 0 [pid 380] rmdir("./37/file0") = 0 [pid 380] umount2("./37/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./37/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 380] unlink("./37/cgroup.cpu") = 0 [pid 380] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 380] close(3) = 0 [pid 380] rmdir("./37") = 0 [pid 380] mkdir("./38", 0777) = 0 [pid 380] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 625 attached , child_tidptr=0x555556fab5d0) = 40 [pid 625] chdir("./38") = 0 [pid 625] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 625] setpgid(0, 0) = 0 [pid 625] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 625] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 625] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 625] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 625] write(3, "1000", 4) = 4 [pid 625] close(3) = 0 [pid 625] symlink("/dev/binderfs", "./binderfs") = 0 [pid 625] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 625] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 625] open("./file0", O_RDONLY) = 3 [pid 625] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [ 137.483938][ T617] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 137.492327][ T617] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 137.500282][ T617] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 137.508240][ T617] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 137.516198][ T617] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 137.524153][ T617] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000025 [ 137.580564][ T620] FAULT_INJECTION: forcing a failure. [ 137.580564][ T620] name failslab, interval 1, probability 0, space 0, times 0 [ 137.593220][ T620] CPU: 0 PID: 620 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 137.604833][ T620] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 137.614861][ T620] Call Trace: [ 137.618130][ T620] dump_stack_lvl+0x1e2/0x24b [ 137.622787][ T620] ? bfq_pos_tree_add_move+0x43e/0x43e [ 137.628233][ T620] ? selinux_kernfs_init_security+0x1a8/0x760 [ 137.634286][ T620] dump_stack+0x15/0x17 [ 137.638419][ T620] should_fail+0x3c0/0x510 [ 137.642809][ T620] ? __kernfs_new_node+0x99/0x6e0 [ 137.647810][ T620] __should_failslab+0x9f/0xe0 [ 137.652560][ T620] should_failslab+0x9/0x20 [ 137.657054][ T620] __kmalloc_track_caller+0x5f/0x350 [ 137.662323][ T620] kstrdup_const+0x55/0x90 [ 137.666714][ T620] __kernfs_new_node+0x99/0x6e0 [ 137.671545][ T620] ? is_module_text_address+0xe1/0x140 [ 137.676984][ T620] ? kernfs_new_node+0x170/0x170 [ 137.681907][ T620] ? ptr_to_hashval+0x60/0x60 [ 137.686565][ T620] ? arch_stack_walk+0xf8/0x140 [ 137.691390][ T620] ? snprintf+0xd6/0x120 [ 137.695623][ T620] kernfs_new_node+0x97/0x170 [ 137.700278][ T620] __kernfs_create_file+0x4a/0x270 [ 137.705373][ T620] cgroup_addrm_files+0xab8/0xfe0 [ 137.710387][ T620] ? ____kasan_kmalloc+0xdc/0x110 [ 137.715385][ T620] ? __kasan_kmalloc+0x9/0x10 [ 137.720043][ T620] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 137.725569][ T620] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 137.731700][ T620] ? delete_node+0x759/0x7b0 [ 137.736271][ T620] ? __kasan_check_read+0x11/0x20 [ 137.741274][ T620] ? delete_node+0x759/0x7b0 [ 137.745844][ T620] ? __kasan_check_write+0x14/0x20 [ 137.750927][ T620] ? idr_replace+0x1c4/0x230 [ 137.755492][ T620] ? idr_get_next+0x4b0/0x4b0 [ 137.760150][ T620] ? _raw_spin_lock_bh+0xa3/0x1b0 [ 137.765153][ T620] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 137.770329][ T620] css_populate_dir+0x137/0x370 [ 137.775166][ T620] cgroup_apply_control_enable+0x8b9/0x12f0 [ 137.781052][ T620] cgroup_apply_control+0x93/0x710 [ 137.786144][ T620] ? css_next_child+0x160/0x160 [ 137.790968][ T620] ? io_schedule+0x120/0x120 [ 137.795529][ T620] ? kernfs_fop_write_iter+0x15e/0x410 [ 137.800963][ T620] ? __kasan_check_write+0x14/0x20 [ 137.806053][ T620] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 137.811322][ T620] cgroup_subtree_control_write+0xd19/0x1310 [ 137.817284][ T620] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 137.823258][ T620] ? __kasan_check_write+0x14/0x20 [ 137.828351][ T620] ? _copy_from_iter+0x3fb/0xd60 [ 137.833258][ T620] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 137.839208][ T620] cgroup_file_write+0x28e/0x590 [ 137.844123][ T620] ? cgroup_seqfile_stop+0xc0/0xc0 [ 137.849214][ T620] ? mutex_lock+0xa6/0x110 [ 137.853599][ T620] ? mutex_trylock+0xb0/0xb0 [ 137.858160][ T620] ? __kasan_check_write+0x14/0x20 [ 137.863256][ T620] kernfs_fop_write_iter+0x2d0/0x410 [ 137.868521][ T620] ? cgroup_seqfile_stop+0xc0/0xc0 [ 137.873610][ T620] vfs_write+0xc1c/0xf40 [ 137.877844][ T620] ? __kasan_check_write+0x14/0x20 [ 137.882934][ T620] ? kernel_write+0x3c0/0x3c0 [ 137.887580][ T620] ? _raw_spin_unlock_irq+0x4e/0x70 [ 137.892749][ T620] ? ptrace_stop+0x6ff/0x9f0 [ 137.897315][ T620] ? __kasan_check_read+0x11/0x20 [ 137.902324][ T620] ? __fdget_pos+0x27e/0x310 [ 137.906903][ T620] ksys_write+0x198/0x2c0 [ 137.911227][ T620] ? do_notify_parent+0xa60/0xa60 [ 137.916231][ T620] ? __ia32_sys_read+0x90/0x90 [ 137.920965][ T620] ? __ia32_sys_open+0x270/0x270 [ 137.925880][ T620] __x64_sys_write+0x7b/0x90 [ 137.930443][ T620] do_syscall_64+0x34/0x70 [ 137.934830][ T620] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 137.940714][ T620] RIP: 0033:0x7fc8ece62c09 [ 137.945103][ T620] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 137.964690][ T620] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 137.973090][ T620] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [pid 625] write(4, "-pids ", 6 [pid 620] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 620] close(3) = 0 [pid 620] close(4) = 0 [pid 620] close(5) = 0 [pid 620] close(6) = -1 EBADF (Bad file descriptor) [pid 620] close(7) = -1 EBADF (Bad file descriptor) [pid 620] close(8) = -1 EBADF (Bad file descriptor) [pid 620] close(9) = -1 EBADF (Bad file descriptor) [pid 620] close(10) = -1 EBADF (Bad file descriptor) [pid 620] close(11) = -1 EBADF (Bad file descriptor) [pid 620] close(12) = -1 EBADF (Bad file descriptor) [pid 620] close(13) = -1 EBADF (Bad file descriptor) [pid 620] close(14) = -1 EBADF (Bad file descriptor) [pid 620] close(15) = -1 EBADF (Bad file descriptor) [pid 620] close(16) = -1 EBADF (Bad file descriptor) [pid 620] close(17) = -1 EBADF (Bad file descriptor) [pid 620] close(18) = -1 EBADF (Bad file descriptor) [pid 620] close(19) = -1 EBADF (Bad file descriptor) [pid 620] close(20) = -1 EBADF (Bad file descriptor) [pid 620] close(21) = -1 EBADF (Bad file descriptor) [pid 620] close(22) = -1 EBADF (Bad file descriptor) [pid 620] close(23) = -1 EBADF (Bad file descriptor) [pid 620] close(24) = -1 EBADF (Bad file descriptor) [pid 620] close(25) = -1 EBADF (Bad file descriptor) [pid 620] close(26) = -1 EBADF (Bad file descriptor) [pid 620] close(27) = -1 EBADF (Bad file descriptor) [pid 620] close(28) = -1 EBADF (Bad file descriptor) [pid 620] close(29write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory ) = -1 EBADF (Bad file descriptor) [pid 620] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 620] exit_group(0) = ? [pid 620] +++ exited with 0 +++ [pid 376] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=41, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 376] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 376] umount2("./39", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] openat(AT_FDCWD, "./39", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 376] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 376] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 376] umount2("./39/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./39/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 376] unlink("./39/binderfs") = 0 [pid 376] umount2("./39/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./39/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 376] unlink("./39/cgroup") = 0 [pid 376] umount2("./39/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./39/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 376] unlink("./39/cgroup.net") = 0 [pid 376] umount2("./39/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 376] umount2("./39/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./39/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 376] umount2("./39/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] openat(AT_FDCWD, "./39/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 376] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 376] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 376] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 376] close(4) = 0 [pid 376] rmdir("./39/file0") = 0 [pid 376] umount2("./39/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./39/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 376] unlink("./39/cgroup.cpu") = 0 [pid 376] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 376] close(3) = 0 [pid 376] rmdir("./39") = 0 [pid 376] mkdir("./40", 0777) = 0 [pid 376] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 626 attached , child_tidptr=0x555556fab5d0) = 42 [pid 626] chdir("./40") = 0 [pid 626] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 626] setpgid(0, 0) = 0 [pid 626] symlink("/syzcgroup/unified/syz1", "./cgroup") = 0 [pid 626] symlink("/syzcgroup/cpu/syz1", "./cgroup.cpu") = 0 [pid 626] symlink("/syzcgroup/net/syz1", "./cgroup.net") = 0 [pid 626] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 626] write(3, "1000", 4) = 4 [pid 626] close(3) = 0 [pid 626] symlink("/dev/binderfs", "./binderfs") = 0 [pid 626] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 626] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 626] open("./file0", O_RDONLY) = 3 [pid 626] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [ 137.981037][ T620] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 137.988980][ T620] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 137.996929][ T620] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 138.004883][ T620] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000027 [ 138.014548][ T620] cgroup: cgroup_addrm_files: failed to add max, err=-12 [ 138.060460][ T619] FAULT_INJECTION: forcing a failure. [ 138.060460][ T619] name failslab, interval 1, probability 0, space 0, times 0 [ 138.073111][ T619] CPU: 1 PID: 619 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 138.084730][ T619] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 138.094760][ T619] Call Trace: [ 138.098035][ T619] dump_stack_lvl+0x1e2/0x24b [ 138.102695][ T619] ? bfq_pos_tree_add_move+0x43e/0x43e [ 138.108131][ T619] ? selinux_kernfs_init_security+0x1a8/0x760 [ 138.114170][ T619] dump_stack+0x15/0x17 [ 138.118299][ T619] should_fail+0x3c0/0x510 [ 138.122688][ T619] ? __kernfs_new_node+0x99/0x6e0 [ 138.127687][ T619] __should_failslab+0x9f/0xe0 [ 138.132432][ T619] should_failslab+0x9/0x20 [ 138.136924][ T619] __kmalloc_track_caller+0x5f/0x350 [ 138.143027][ T619] kstrdup_const+0x55/0x90 [ 138.147430][ T619] __kernfs_new_node+0x99/0x6e0 [ 138.152268][ T619] ? is_module_text_address+0xe1/0x140 [ 138.157709][ T619] ? kernfs_new_node+0x170/0x170 [ 138.162625][ T619] ? ptr_to_hashval+0x60/0x60 [ 138.167280][ T619] ? arch_stack_walk+0xf8/0x140 [ 138.172102][ T619] ? snprintf+0xd6/0x120 [ 138.176318][ T619] kernfs_new_node+0x97/0x170 [ 138.180969][ T619] __kernfs_create_file+0x4a/0x270 [ 138.186057][ T619] cgroup_addrm_files+0xab8/0xfe0 [ 138.191062][ T619] ? ____kasan_kmalloc+0xdc/0x110 [ 138.196055][ T619] ? __kasan_kmalloc+0x9/0x10 [ 138.200713][ T619] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 138.206240][ T619] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 138.212363][ T619] ? delete_node+0x759/0x7b0 [ 138.216941][ T619] ? __kasan_check_read+0x11/0x20 [ 138.221946][ T619] ? delete_node+0x759/0x7b0 [ 138.226507][ T619] ? __kasan_check_write+0x14/0x20 [ 138.231587][ T619] ? idr_replace+0x1c4/0x230 [ 138.236165][ T619] ? idr_get_next+0x4b0/0x4b0 [ 138.240831][ T619] ? _raw_spin_lock_bh+0xa3/0x1b0 [ 138.245837][ T619] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 138.251012][ T619] css_populate_dir+0x137/0x370 [ 138.255846][ T619] cgroup_apply_control_enable+0x8b9/0x12f0 [ 138.261712][ T619] cgroup_apply_control+0x93/0x710 [ 138.266794][ T619] ? css_next_child+0x160/0x160 [ 138.271637][ T619] ? io_schedule+0x120/0x120 [ 138.276224][ T619] ? kernfs_fop_write_iter+0x15e/0x410 [ 138.281668][ T619] ? __kasan_check_write+0x14/0x20 [ 138.286762][ T619] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 138.292027][ T619] cgroup_subtree_control_write+0xd19/0x1310 [ 138.297983][ T619] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 138.303944][ T619] ? __kasan_check_write+0x14/0x20 [ 138.309036][ T619] ? _copy_from_iter+0x3fb/0xd60 [ 138.313958][ T619] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 138.319912][ T619] cgroup_file_write+0x28e/0x590 [ 138.324823][ T619] ? cgroup_seqfile_stop+0xc0/0xc0 [ 138.329915][ T619] ? mutex_lock+0xa6/0x110 [ 138.334319][ T619] ? mutex_trylock+0xb0/0xb0 [ 138.338904][ T619] ? __kasan_check_write+0x14/0x20 [ 138.343996][ T619] kernfs_fop_write_iter+0x2d0/0x410 [ 138.349262][ T619] ? cgroup_seqfile_stop+0xc0/0xc0 [ 138.354353][ T619] vfs_write+0xc1c/0xf40 [ 138.358567][ T619] ? __kasan_check_write+0x14/0x20 [ 138.363661][ T619] ? kernel_write+0x3c0/0x3c0 [ 138.368326][ T619] ? _raw_spin_unlock_irq+0x4e/0x70 [ 138.373508][ T619] ? ptrace_stop+0x6ff/0x9f0 [ 138.378077][ T619] ? __kasan_check_read+0x11/0x20 [ 138.383081][ T619] ? __fdget_pos+0x27e/0x310 [ 138.387665][ T619] ksys_write+0x198/0x2c0 [ 138.391984][ T619] ? do_notify_parent+0xa60/0xa60 [ 138.396991][ T619] ? __ia32_sys_read+0x90/0x90 [ 138.401725][ T619] ? __ia32_sys_open+0x270/0x270 [ 138.406645][ T619] __x64_sys_write+0x7b/0x90 [ 138.411219][ T619] do_syscall_64+0x34/0x70 [ 138.415609][ T619] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 138.421484][ T619] RIP: 0033:0x7fc8ece62c09 [ 138.425886][ T619] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 138.445475][ T619] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 138.453859][ T619] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [pid 626] write(4, "-pids ", 6 [pid 619] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 619] close(3) = 0 [pid 619] close(4) = 0 [pid 619] close(5) = 0 [pid 619] close(6) = -1 EBADF (Bad file descriptor) [pid 619] close(7) = -1 EBADF (Bad file descriptor) [pid 619] close(8) = -1 EBADF (Bad file descriptor) [pid 619] close(9) = -1 EBADF (Bad file descriptor) [pid 619] close(10) = -1 EBADF (Bad file descriptor) [pid 619] close(11) = -1 EBADF (Bad file descriptor) [pid 619] close(12) = -1 EBADF (Bad file descriptor) [pid 619] close(13) = -1 EBADF (Bad file descriptor) [pid 619] close(14) = -1 EBADF (Bad file descriptor) [pid 619] close(15) = -1 EBADF (Bad file descriptor) [pid 619] close(16) = -1 EBADF (Bad file descriptor) [pid 619] close(17) = -1 EBADF (Bad file descriptor) [pid 619] close(18) = -1 EBADF (Bad file descriptor) [pid 619] close(19) = -1 EBADF (Bad file descriptor) [pid 619] close(20) = -1 EBADF (Bad file descriptor) [pid 619] close(21) = -1 EBADF (Bad file descriptor) [pid 619] close(22) = -1 EBADF (Bad file descriptor) [pid 619] close(23) = -1 EBADF (Bad file descriptor) [pid 619] close(24) = -1 EBADF (Bad file descriptor) [pid 619] close(25) = -1 EBADF (Bad file descriptor) [pid 619] close(26) = -1 EBADF (Bad file descriptor) [pid 619] close(27) = -1 EBADF (Bad file descriptor) [pid 619] close(28) = -1 EBADF (Bad file descriptor) [pid 619] close(29) = -1 EBADF (Bad file descriptor) write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory [pid 619] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 619] exit_group(0) = ? [pid 619] +++ exited with 0 +++ [pid 375] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=44, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 375] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 375] umount2("./42", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] openat(AT_FDCWD, "./42", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 375] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 375] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 375] umount2("./42/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./42/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 375] unlink("./42/binderfs") = 0 [pid 375] umount2("./42/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./42/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 375] unlink("./42/cgroup") = 0 [pid 375] umount2("./42/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./42/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 375] unlink("./42/cgroup.net") = 0 [ 138.461804][ T619] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 138.469799][ T619] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 138.477756][ T619] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 138.485707][ T619] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 000000000000002a [ 138.493730][ T619] cgroup: cgroup_addrm_files: failed to add max, err=-12 [ 138.511984][ T375] ------------[ cut here ]------------ [ 138.517452][ T375] WARNING: CPU: 1 PID: 375 at fs/namespace.c:1168 mntput_no_expire+0x48a/0x6c0 [ 138.526384][ T375] Modules linked in: [ 138.530340][ T375] CPU: 1 PID: 375 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 138.541959][ T375] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 138.552044][ T375] RIP: 0010:mntput_no_expire+0x48a/0x6c0 [ 138.557663][ T375] Code: 48 c7 c2 80 02 44 86 e8 64 f0 8e ff e9 8b fc ff ff e8 ba 21 b6 ff e9 81 fc ff ff e8 b0 21 b6 ff e9 77 fc ff ff e8 a6 21 b6 ff <0f> 0b e9 f4 fc ff ff e8 9a 21 b6 ff e8 65 ad a2 ff e9 ea fc ff ff [ 138.577274][ T375] RSP: 0018:ffffc9000095fba0 EFLAGS: 00010293 [ 138.583348][ T375] RAX: ffffffff81b68f1a RBX: 00000000fffffffe RCX: ffff8881065e13c0 [ 138.591321][ T375] RDX: 0000000000000000 RSI: 00000000fffffffe RDI: 0000000000000000 [ 138.599274][ T375] RBP: ffffc9000095fc70 R08: ffffffff81b68c08 R09: 0000000000000003 [ 138.607256][ T375] R10: fffff5200012bf65 R11: 1ffff9200012bf64 R12: dffffc0000000000 [ 138.615231][ T375] R13: ffff8881192dce00 R14: ffffc9000095fc00 R15: 1ffff9200012bf7c [ 138.623204][ T375] FS: 0000555556fab300(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 138.632137][ T375] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 138.638694][ T375] CR2: 00007fc8ececd130 CR3: 000000011dd54000 CR4: 00000000003506a0 [ 138.646771][ T375] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 138.654870][ T375] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 138.662865][ T375] Call Trace: [ 138.666150][ T375] ? io_schedule+0x120/0x120 [ 138.670760][ T375] ? vfs_submount+0xb0/0xb0 [ 138.675251][ T375] ? shrink_dentry_list+0x4ec/0x500 [ 138.680464][ T375] ? __kasan_check_write+0x14/0x20 [ 138.685562][ T375] namespace_unlock+0x448/0x4f0 [ 138.690423][ T375] ? umount_tree+0xf50/0xf50 [ 138.694995][ T375] ? __detach_mounts+0x670/0x670 [ 138.699903][ T375] ? selinux_umount+0xf0/0x130 [ 138.704682][ T375] ? security_sb_umount+0x9d/0xb0 [ 138.709690][ T375] path_umount+0xf03/0xfb0 [ 138.714105][ T375] ? namespace_unlock+0x4f0/0x4f0 [ 138.719118][ T375] ? user_path_at_empty+0x40/0x50 [ 138.724146][ T375] __x64_sys_umount+0x122/0x170 [ 138.728987][ T375] ? path_umount+0xfb0/0xfb0 [ 138.733585][ T375] ? syscall_enter_from_user_mode+0x58/0x1b0 [ 138.739554][ T375] do_syscall_64+0x34/0x70 [ 138.743988][ T375] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 138.749868][ T375] RIP: 0033:0x7fc8ece63fb7 [ 138.754292][ T375] Code: 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 138.773904][ T375] RSP: 002b:00007ffd7d0e2358 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [ 138.782313][ T375] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc8ece63fb7 [ 138.790296][ T375] RDX: 00007ffd7d0e241a RSI: 000000000000000a RDI: 00007ffd7d0e2410 [ 138.798246][ T375] RBP: 00007ffd7d0e2410 R08: 00000000ffffffff R09: 00007ffd7d0e21f0 [ 138.806229][ T375] R10: 0000555556fad6a3 R11: 0000000000000202 R12: 00007ffd7d0e3490 [ 138.814212][ T375] R13: 0000555556fad600 R14: 00007ffd7d0e2380 R15: 000000000000002b [ 138.822184][ T375] ---[ end trace d4de1ca9cdcd1989 ]--- [ 138.827713][ T375] ------------[ cut here ]------------ [ 138.827850][ T624] FAULT_INJECTION: forcing a failure. [ 138.827850][ T624] name failslab, interval 1, probability 0, space 0, times 0 [ 138.833197][ T375] WARNING: CPU: 0 PID: 375 at fs/namespace.c:1168 mntput_no_expire+0x48a/0x6c0 [ 138.833201][ T375] Modules linked in: [ 138.833224][ T375] CPU: 0 PID: 375 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 138.846124][ T624] CPU: 1 PID: 624 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 138.854799][ T375] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 138.858643][ T624] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 138.870274][ T375] RIP: 0010:mntput_no_expire+0x48a/0x6c0 [ 138.881817][ T624] Call Trace: [ 138.881833][ T624] dump_stack_lvl+0x1e2/0x24b [ 138.881849][ T624] ? panic+0x7d7/0x7d7 [ 138.891888][ T375] Code: 48 c7 c2 80 02 44 86 e8 64 f0 8e ff e9 8b fc ff ff e8 ba 21 b6 ff e9 81 fc ff ff e8 b0 21 b6 ff e9 77 fc ff ff e8 a6 21 b6 ff <0f> 0b e9 f4 fc ff ff e8 9a 21 b6 ff e8 65 ad a2 ff e9 ea fc ff ff [ 138.901903][ T624] ? bfq_pos_tree_add_move+0x43e/0x43e [ 138.901912][ T624] ? find_next_bit+0xd6/0x120 [ 138.901929][ T624] ? cpumask_next+0x11/0x30 [ 138.907525][ T375] RSP: 0018:ffffc9000095fca0 EFLAGS: 00010293 [ 138.910774][ T624] dump_stack+0x15/0x17 [ 138.910783][ T624] should_fail+0x3c0/0x510 [ 138.910792][ T624] ? percpu_ref_init+0xd0/0x330 [ 138.910808][ T624] __should_failslab+0x9f/0xe0 [ 138.915444][ T375] [ 138.919485][ T624] should_failslab+0x9/0x20 [ 138.939071][ T375] RAX: ffffffff81b68f1a RBX: 00000000fffffffd RCX: ffff8881065e13c0 [ 138.944480][ T624] kmem_cache_alloc_trace+0x3a/0x330 [ 138.944496][ T624] percpu_ref_init+0xd0/0x330 [ 138.949140][ T375] RDX: 0000000000000000 RSI: 00000000fffffffd RDI: 0000000000000000 [ 138.953607][ T624] ? cgroup_setup_root+0xea0/0xea0 [ 138.953618][ T624] cgroup_apply_control_enable+0x3a2/0x12f0 [ 138.953633][ T624] cgroup_apply_control+0x93/0x710 [ 138.959666][ T375] RBP: ffffc9000095fd70 R08: ffffffff81b68c08 R09: 0000000000000003 [ 138.963785][ T624] ? css_next_child+0x160/0x160 [ 138.963793][ T624] ? stack_trace_save+0x12d/0x1f0 [ 138.963811][ T624] ? io_schedule+0x120/0x120 [ 138.968190][ T375] R10: fffff5200012bf85 R11: 1ffff9200012bf84 R12: dffffc0000000000 [ 138.973003][ T624] ? kernfs_fop_write_iter+0x15e/0x410 [ 138.973013][ T624] ? __kasan_check_write+0x14/0x20 [ 138.973022][ T624] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 138.973039][ T624] cgroup_subtree_control_write+0xd19/0x1310 [ 138.977769][ T375] R13: ffff8881192dce00 R14: ffffc9000095fd00 R15: 1ffff9200012bf9c [ 138.980068][ T624] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 138.984545][ T375] FS: 0000555556fab300(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 138.992481][ T624] ? __kasan_check_write+0x14/0x20 [ 138.992491][ T624] ? _copy_from_iter+0x3fb/0xd60 [ 138.992507][ T624] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 138.997758][ T375] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 139.002397][ T624] cgroup_file_write+0x28e/0x590 [ 139.002407][ T624] ? cgroup_seqfile_stop+0xc0/0xc0 [ 139.002423][ T624] ? mutex_lock+0xa6/0x110 [ 139.010369][ T375] CR2: 00007ffd7d0e1c18 CR3: 000000011dd54000 CR4: 00000000003506b0 [ 139.015477][ T624] ? mutex_trylock+0xb0/0xb0 [ 139.021343][ T375] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 139.026415][ T624] ? __kasan_check_write+0x14/0x20 [pid 375] umount2("./42/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 624] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 624] close(3) = 0 [pid 624] close(4) = 0 [pid 624] close(5) = 0 [pid 624] close(6) = -1 EBADF (Bad file descriptor) [pid 624] close(7) = -1 EBADF (Bad file descriptor) [pid 624] close(8) = -1 EBADF (Bad file descriptor) [pid 624] close(9) = -1 EBADF (Bad file descriptor) [pid 624] close(10) = -1 EBADF (Bad file descriptor) [pid 624] close(11) = -1 EBADF (Bad file descriptor) [pid 624] close(12) = -1 EBADF (Bad file descriptor) [pid 624] close(13) = -1 EBADF (Bad file descriptor) [pid 624] close(14) = -1 EBADF (Bad file descriptor) [pid 624] close(15) = -1 EBADF (Bad file descriptor) [pid 624] close(16) = -1 EBADF (Bad file descriptor) [pid 624] close(17) = -1 EBADF (Bad file descriptor) [pid 624] close(18) = -1 EBADF (Bad file descriptor) [pid 624] close(19) = -1 EBADF (Bad file descriptor) [pid 624] close(20) = -1 EBADF (Bad file descriptor) [pid 624] close(21) = -1 EBADF (Bad file descriptor) [pid 624] close(22) = -1 EBADF (Bad file descriptor) [pid 624] close(23) = -1 EBADF (Bad file descriptor) [pid 624] close(24) = -1 EBADF (Bad file descriptor) [pid 624] close(25) = -1 EBADF (Bad file descriptor) [pid 624] close(26) = -1 EBADF (Bad file descriptor) [pid 624] close(27) = -1 EBADF (Bad file descriptor) [pid 624] close(28) = -1 EBADF (Bad file descriptor) [pid 624] close(29) = -1 EBADF (Bad file descriptor) [pid 624] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory ) = 89 [pid 624] exit_group(0) = ? [pid 624] +++ exited with 0 +++ [pid 381] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=41, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 381] restart_syscall(<... resuming interrupted clone ...>) = 0 [ 139.034389][ T375] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 139.039175][ T624] kernfs_fop_write_iter+0x2d0/0x410 [ 139.044166][ T375] Call Trace: [ 139.048722][ T624] ? cgroup_seqfile_stop+0xc0/0xc0 [ 139.056673][ T375] ? lockref_get_or_lock+0x340/0x340 [ 139.062084][ T624] vfs_write+0xc1c/0xf40 [ 139.062094][ T624] ? __kasan_check_write+0x14/0x20 [ 139.062103][ T624] ? kernel_write+0x3c0/0x3c0 [ 139.062118][ T624] ? _raw_spin_unlock_irq+0x4e/0x70 [ 139.067197][ T375] ? umount_tree+0xf50/0xf50 [ 139.072443][ T624] ? ptrace_stop+0x6ff/0x9f0 [ 139.072453][ T624] ? __kasan_check_read+0x11/0x20 [ 139.072468][ T624] ? __fdget_pos+0x27e/0x310 [ 139.078414][ T375] ? vfs_submount+0xb0/0xb0 [ 139.086351][ T624] ksys_write+0x198/0x2c0 [ 139.086362][ T624] ? do_notify_parent+0xa60/0xa60 [ 139.086377][ T624] ? __ia32_sys_read+0x90/0x90 [ 139.092347][ T375] ? dput+0x2b6/0x320 [ 139.101219][ T624] ? __ia32_sys_open+0x270/0x270 [ 139.101237][ T624] __x64_sys_write+0x7b/0x90 [ 139.106317][ T375] path_umount+0x1fe/0xfb0 [ 139.111218][ T624] do_syscall_64+0x34/0x70 [ 139.111228][ T624] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 139.111242][ T624] RIP: 0033:0x7fc8ece62c09 [ 139.117190][ T375] ? namespace_unlock+0x4f0/0x4f0 [ 139.123739][ T624] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 139.123752][ T624] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 [ 139.128662][ T375] ? user_path_at_empty+0x40/0x50 [ 139.133726][ T624] ORIG_RAX: 0000000000000001 [ 139.133734][ T624] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 139.133748][ T624] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 139.138134][ T375] __x64_sys_umount+0x122/0x170 [ 139.146064][ T624] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 139.146071][ T624] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 139.146084][ T624] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000027 [ 139.150663][ T375] ? path_umount+0xfb0/0xfb0 [ 139.369131][ T375] ? syscall_enter_from_user_mode+0x58/0x1b0 [ 139.375115][ T375] do_syscall_64+0x34/0x70 [ 139.379529][ T375] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 139.385434][ T375] RIP: 0033:0x7fc8ece63fb7 [ 139.389833][ T375] Code: 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 381] umount2("./39", MNT_DETACH|UMOUNT_NOFOLLOW [pid 375] <... umount2 resumed>) = 0 [pid 381] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 381] openat(AT_FDCWD, "./39", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 375] umount2("./42/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 381] <... openat resumed>) = 3 [pid 381] fstat(3, [pid 375] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 381] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 381] getdents64(3, [pid 375] lstat("./42/file0", [pid 381] <... getdents64 resumed>0x555556fad630 /* 7 entries */, 32768) = 208 [pid 381] umount2("./39/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 375] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 381] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 381] lstat("./39/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 381] unlink("./39/binderfs") = 0 [pid 381] umount2("./39/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./39/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 381] unlink("./39/cgroup") = 0 [pid 381] umount2("./39/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./39/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 381] unlink("./39/cgroup.net") = 0 [pid 381] umount2("./39/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 381] umount2("./39/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./39/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 381] umount2("./39/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] openat(AT_FDCWD, "./39/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 381] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 381] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 381] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 381] close(4) = 0 [pid 381] rmdir("./39/file0") = 0 [pid 381] umount2("./39/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./39/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 381] unlink("./39/cgroup.cpu") = 0 [pid 381] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 381] close(3) = 0 [pid 381] rmdir("./39") = 0 [pid 375] umount2("./42/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 381] mkdir("./40", 0777 [pid 375] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 381] <... mkdir resumed>) = 0 [pid 375] openat(AT_FDCWD, "./42/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 381] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 375] <... openat resumed>) = 4 [pid 381] <... clone resumed>, child_tidptr=0x555556fab5d0) = 42 [pid 375] fstat(4, ./strace-static-x86_64: Process 627 attached {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 627] chdir("./40" [pid 375] getdents64(4, [pid 627] <... chdir resumed>) = 0 [pid 627] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 627] setpgid(0, 0 [pid 375] <... getdents64 resumed>0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 627] <... setpgid resumed>) = 0 [pid 375] getdents64(4, [pid 627] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [pid 627] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 627] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 627] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 627] write(3, "1000", 4) = 4 [pid 627] close(3) = 0 [pid 627] symlink("/dev/binderfs", "./binderfs") = 0 [pid 627] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 627] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 627] open("./file0", O_RDONLY) = 3 [pid 627] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [pid 627] write(4, "-pids ", 6 [pid 375] <... getdents64 resumed>0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 375] close(4) = 0 [pid 375] rmdir("./42/file0") = 0 [pid 375] umount2("./42/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./42/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 375] unlink("./42/cgroup.cpu") = 0 [pid 375] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 375] close(3) = 0 [pid 375] rmdir("./42") = 0 [pid 375] mkdir("./43", 0777) = 0 [pid 375] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 628 attached [pid 628] chdir("./43" [pid 375] <... clone resumed>, child_tidptr=0x555556fab5d0) = 45 [pid 628] <... chdir resumed>) = 0 [pid 628] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 628] setpgid(0, 0) = 0 [pid 628] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 628] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 628] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [ 139.409448][ T375] RSP: 002b:00007ffd7d0e2358 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [ 139.417860][ T375] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc8ece63fb7 [ 139.425846][ T375] RDX: 00007ffd7d0e241a RSI: 000000000000000a RDI: 00007ffd7d0e2410 [ 139.433815][ T375] RBP: 00007ffd7d0e2410 R08: 00000000ffffffff R09: 00007ffd7d0e21f0 [ 139.441795][ T375] R10: 0000555556fad6a3 R11: 0000000000000202 R12: 00007ffd7d0e3490 [ 139.449754][ T375] R13: 0000555556fad600 R14: 00007ffd7d0e2380 R15: 000000000000002b [ 139.457746][ T375] ---[ end trace d4de1ca9cdcd198a ]--- [pid 628] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 627] <... write resumed>) = 6 [pid 627] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 626] <... write resumed>) = 6 [pid 623] <... write resumed>) = 6 [pid 627] <... openat resumed>) = 5 [pid 627] write(5, "22", 2) = 2 [pid 627] write(4, "+pids ", 6 [pid 628] write(3, "1000", 4) = 4 [pid 628] close(3) = 0 [pid 628] symlink("/dev/binderfs", "./binderfs") = 0 [pid 628] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 628] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 626] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 626] write(5, "22", 2) = 2 [pid 626] write(4, "+pids ", 6 [pid 623] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 623] write(5, "22", 2) = 2 [ 139.490607][ T622] FAULT_INJECTION: forcing a failure. [ 139.490607][ T622] name failslab, interval 1, probability 0, space 0, times 0 [ 139.503358][ T622] CPU: 1 PID: 622 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 139.514984][ T622] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 139.525027][ T622] Call Trace: [ 139.528294][ T622] dump_stack_lvl+0x1e2/0x24b [ 139.532952][ T622] ? bfq_pos_tree_add_move+0x43e/0x43e [ 139.538395][ T622] dump_stack+0x15/0x17 [ 139.542527][ T622] should_fail+0x3c0/0x510 [ 139.546920][ T622] ? pids_css_alloc+0x4e/0x120 [ 139.551659][ T622] __should_failslab+0x9f/0xe0 [ 139.556400][ T622] should_failslab+0x9/0x20 [ 139.560878][ T622] kmem_cache_alloc_trace+0x3a/0x330 [ 139.566138][ T622] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 139.571311][ T622] pids_css_alloc+0x4e/0x120 [ 139.575883][ T622] cgroup_apply_control_enable+0x350/0x12f0 [ 139.581753][ T622] cgroup_apply_control+0x93/0x710 [ 139.586845][ T622] ? css_next_child+0x160/0x160 [ 139.591680][ T622] ? io_schedule+0x120/0x120 [ 139.596242][ T622] ? kernfs_fop_write_iter+0x15e/0x410 [ 139.601680][ T622] ? __kasan_check_write+0x14/0x20 [ 139.606773][ T622] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 139.612032][ T622] cgroup_subtree_control_write+0xd19/0x1310 [ 139.617982][ T622] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 139.623938][ T622] ? __kasan_check_write+0x14/0x20 [ 139.629033][ T622] ? _copy_from_iter+0x3fb/0xd60 [ 139.633956][ T622] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 139.639937][ T622] cgroup_file_write+0x28e/0x590 [ 139.644855][ T622] ? cgroup_seqfile_stop+0xc0/0xc0 [ 139.649950][ T622] ? mutex_lock+0xa6/0x110 [ 139.654339][ T622] ? mutex_trylock+0xb0/0xb0 [ 139.658903][ T622] ? __kasan_check_write+0x14/0x20 [ 139.663999][ T622] kernfs_fop_write_iter+0x2d0/0x410 [ 139.669262][ T622] ? cgroup_seqfile_stop+0xc0/0xc0 [ 139.674353][ T622] vfs_write+0xc1c/0xf40 [ 139.678658][ T622] ? __kasan_check_write+0x14/0x20 [ 139.683742][ T622] ? kernel_write+0x3c0/0x3c0 [ 139.688398][ T622] ? _raw_spin_unlock_irq+0x4e/0x70 [ 139.693575][ T622] ? ptrace_stop+0x6ff/0x9f0 [ 139.698138][ T622] ? __kasan_check_read+0x11/0x20 [ 139.703135][ T622] ? __fdget_pos+0x27e/0x310 [ 139.707697][ T622] ksys_write+0x198/0x2c0 [ 139.712006][ T622] ? do_notify_parent+0xa60/0xa60 [ 139.717003][ T622] ? __ia32_sys_read+0x90/0x90 [ 139.721747][ T622] ? __ia32_sys_open+0x270/0x270 [ 139.726672][ T622] __x64_sys_write+0x7b/0x90 [ 139.731243][ T622] do_syscall_64+0x34/0x70 [ 139.735632][ T622] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 139.741501][ T622] RIP: 0033:0x7fc8ece62c09 [ 139.745887][ T622] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 139.765466][ T622] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 139.773857][ T622] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 139.781811][ T622] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [pid 623] write(4, "+pids ", 6 [pid 628] <... mount resumed>) = 0 [pid 622] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 628] open("./file0", O_RDONLY [pid 622] close(3 [pid 628] <... open resumed>) = 3 [pid 622] <... close resumed>) = 0 [pid 628] openat(3, "cgroup.subtree_control", O_RDWR [pid 622] close(4 [pid 628] <... openat resumed>) = 4 [pid 622] <... close resumed>) = 0 [pid 628] write(4, "-pids ", 6 [pid 622] close(5) = 0 [pid 622] close(6) = -1 EBADF (Bad file descriptor) [pid 622] close(7) = -1 EBADF (Bad file descriptor) [pid 622] close(8) = -1 EBADF (Bad file descriptor) [pid 622] close(9) = -1 EBADF (Bad file descriptor) [pid 622] close(10) = -1 EBADF (Bad file descriptor) [pid 622] close(11) = -1 EBADF (Bad file descriptor) [pid 622] close(12) = -1 EBADF (Bad file descriptor) [pid 622] close(13) = -1 EBADF (Bad file descriptor) [pid 622] close(14) = -1 EBADF (Bad file descriptor) [pid 622] close(15) = -1 EBADF (Bad file descriptor) [pid 622] close(16) = -1 EBADF (Bad file descriptor) [pid 622] close(17) = -1 EBADF (Bad file descriptor) [pid 622] close(18) = -1 EBADF (Bad file descriptor) [pid 622] close(19) = -1 EBADF (Bad file descriptor) [pid 622] close(20) = -1 EBADF (Bad file descriptor) [pid 622] close(21) = -1 EBADF (Bad file descriptor) [pid 622] close(22) = -1 EBADF (Bad file descriptor) [pid 622] close(23) = -1 EBADF (Bad file descriptor) [pid 622] close(24) = -1 EBADF (Bad file descriptor) [pid 622] close(25) = -1 EBADF (Bad file descriptor) [pid 622] close(26) = -1 EBADF (Bad file descriptor) [pid 622] close(27) = -1 EBADF (Bad file descriptor) [pid 622] close(28) = -1 EBADF (Bad file descriptor) [pid 622] close(29) = -1 EBADF (Bad file descriptor) write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory [pid 622] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 622] exit_group(0) = ? [pid 622] +++ exited with 0 +++ [pid 382] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=45, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 382] umount2("./43", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] openat(AT_FDCWD, "./43", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 382] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 382] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 382] umount2("./43/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./43/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 382] unlink("./43/binderfs") = 0 [pid 382] umount2("./43/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./43/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 382] unlink("./43/cgroup") = 0 [pid 382] umount2("./43/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./43/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 382] unlink("./43/cgroup.net") = 0 [ 139.789764][ T622] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 139.797718][ T622] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 139.805671][ T622] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 000000000000002b [ 139.822765][ T382] ------------[ cut here ]------------ [ 139.828245][ T382] WARNING: CPU: 0 PID: 382 at fs/namespace.c:1168 mntput_no_expire+0x48a/0x6c0 [ 139.837181][ T382] Modules linked in: [ 139.841093][ T382] CPU: 0 PID: 382 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 139.852731][ T382] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 139.862802][ T382] RIP: 0010:mntput_no_expire+0x48a/0x6c0 [ 139.868445][ T382] Code: 48 c7 c2 80 02 44 86 e8 64 f0 8e ff e9 8b fc ff ff e8 ba 21 b6 ff e9 81 fc ff ff e8 b0 21 b6 ff e9 77 fc ff ff e8 a6 21 b6 ff <0f> 0b e9 f4 fc ff ff e8 9a 21 b6 ff e8 65 ad a2 ff e9 ea fc ff ff [ 139.888114][ T382] RSP: 0018:ffffc90000b77ba0 EFLAGS: 00010293 [ 139.894201][ T382] RAX: ffffffff81b68f1a RBX: 00000000ffffffff RCX: ffff8881065e4f00 [ 139.902269][ T382] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000 [ 139.910248][ T382] RBP: ffffc90000b77c70 R08: ffffffff81b68c08 R09: 0000000000000003 [ 139.918210][ T382] R10: fffff5200016ef65 R11: 1ffff9200016ef64 R12: dffffc0000000000 [ 139.926191][ T382] R13: ffff8881170981c0 R14: ffffc90000b77c00 R15: 1ffff9200016ef7c [ 139.934169][ T382] FS: 0000555556fab300(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 139.943103][ T382] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 139.949676][ T382] CR2: 00007ffd7d0e1c18 CR3: 000000011dd7e000 CR4: 00000000003506b0 [ 139.957665][ T382] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 139.965637][ T382] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 139.973608][ T382] Call Trace: [ 139.976883][ T382] ? io_schedule+0x120/0x120 [ 139.981480][ T382] ? vfs_submount+0xb0/0xb0 [ 139.985980][ T382] ? shrink_dentry_list+0x4ec/0x500 [ 139.991189][ T382] ? __kasan_check_write+0x14/0x20 [ 139.996287][ T382] namespace_unlock+0x448/0x4f0 [ 140.001136][ T382] ? umount_tree+0xf50/0xf50 [ 140.005722][ T382] ? __detach_mounts+0x670/0x670 [ 140.010679][ T382] ? selinux_umount+0xf0/0x130 [ 140.015443][ T382] ? security_sb_umount+0x9d/0xb0 [ 140.020482][ T382] path_umount+0xf03/0xfb0 [ 140.024888][ T382] ? namespace_unlock+0x4f0/0x4f0 [ 140.029888][ T382] ? user_path_at_empty+0x40/0x50 [ 140.034934][ T382] __x64_sys_umount+0x122/0x170 [ 140.039771][ T382] ? path_umount+0xfb0/0xfb0 [ 140.044360][ T382] ? syscall_enter_from_user_mode+0x58/0x1b0 [ 140.050338][ T382] do_syscall_64+0x34/0x70 [ 140.054729][ T382] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 140.060619][ T382] RIP: 0033:0x7fc8ece63fb7 [ 140.065031][ T382] Code: 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 140.084663][ T382] RSP: 002b:00007ffd7d0e2358 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [ 140.093082][ T382] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc8ece63fb7 [ 140.101074][ T382] RDX: 00007ffd7d0e241a RSI: 000000000000000a RDI: 00007ffd7d0e2410 [ 140.109030][ T382] RBP: 00007ffd7d0e2410 R08: 00000000ffffffff R09: 00007ffd7d0e21f0 [ 140.117003][ T382] R10: 0000555556fad6a3 R11: 0000000000000202 R12: 00007ffd7d0e3490 [ 140.124983][ T382] R13: 0000555556fad600 R14: 00007ffd7d0e2380 R15: 000000000000002c [ 140.132966][ T382] ---[ end trace d4de1ca9cdcd198b ]--- [ 140.138583][ T627] FAULT_INJECTION: forcing a failure. [ 140.138583][ T627] name failslab, interval 1, probability 0, space 0, times 0 [ 140.140260][ T382] ------------[ cut here ]------------ [ 140.151398][ T627] CPU: 0 PID: 627 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 140.156623][ T382] WARNING: CPU: 1 PID: 382 at fs/namespace.c:1168 mntput_no_expire+0x48a/0x6c0 [ 140.168193][ T627] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 140.168198][ T627] Call Trace: [ 140.168211][ T627] dump_stack_lvl+0x1e2/0x24b [ 140.168228][ T627] ? bfq_pos_tree_add_move+0x43e/0x43e [ 140.177212][ T382] Modules linked in: [ 140.187235][ T627] ? selinux_kernfs_init_security+0x1a8/0x760 [ 140.187251][ T627] dump_stack+0x15/0x17 [ 140.190508][ T382] [ 140.195155][ T627] should_fail+0x3c0/0x510 [ 140.200590][ T382] CPU: 1 PID: 382 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 140.204458][ T627] ? __kernfs_new_node+0x99/0x6e0 [ 140.210490][ T382] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 140.214612][ T627] __should_failslab+0x9f/0xe0 [ 140.216913][ T382] RIP: 0010:mntput_no_expire+0x48a/0x6c0 [ 140.221286][ T627] should_failslab+0x9/0x20 [ 140.221304][ T627] __kmalloc_track_caller+0x5f/0x350 [ 140.232896][ T382] Code: 48 c7 c2 80 02 44 86 e8 64 f0 8e ff e9 8b fc ff ff e8 ba 21 b6 ff e9 81 fc ff ff e8 b0 21 b6 ff e9 77 fc ff ff e8 a6 21 b6 ff <0f> 0b e9 f4 fc ff ff e8 9a 21 b6 ff e8 65 ad a2 ff e9 ea fc ff ff [ 140.237883][ T627] kstrdup_const+0x55/0x90 [ 140.247910][ T382] RSP: 0018:ffffc90000b77ca0 EFLAGS: 00010293 [ 140.252631][ T627] __kernfs_new_node+0x99/0x6e0 [ 140.252648][ T627] ? is_module_text_address+0xe1/0x140 [ 140.258238][ T382] [ 140.258259][ T382] RAX: ffffffff81b68f1a RBX: 00000000fffffffe RCX: ffff8881065e4f00 [ 140.262739][ T627] ? kernfs_new_node+0x170/0x170 [ 140.262751][ T627] ? ptr_to_hashval+0x60/0x60 [ 140.262768][ T627] ? arch_stack_walk+0xf8/0x140 [ 140.268018][ T382] RDX: 0000000000000000 RSI: 00000000fffffffe RDI: 0000000000000000 [ 140.287611][ T627] ? snprintf+0xd6/0x120 [ 140.287620][ T627] kernfs_new_node+0x97/0x170 [ 140.287637][ T627] __kernfs_create_file+0x4a/0x270 [ 140.292030][ T382] RBP: ffffc90000b77d70 R08: ffffffff81b68c08 R09: 0000000000000003 [ 140.298069][ T627] cgroup_addrm_files+0xab8/0xfe0 [ 140.302899][ T382] R10: fffff5200016ef85 R11: 1ffff9200016ef84 R12: dffffc0000000000 [ 140.308322][ T627] ? ____kasan_kmalloc+0xdc/0x110 [ 140.310631][ T382] R13: ffff8881170981c0 R14: ffffc90000b77d00 R15: 1ffff9200016ef9c [ 140.318585][ T627] ? __kasan_kmalloc+0x9/0x10 [ 140.323520][ T382] FS: 0000555556fab300(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 140.328151][ T627] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 140.332973][ T382] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 140.340919][ T627] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 140.340936][ T627] ? delete_node+0x759/0x7b0 [ 140.345148][ T382] CR2: 00007fc8ece1cc86 CR3: 000000011dd7e000 CR4: 00000000003506a0 [ 140.349814][ T627] ? __kasan_check_read+0x11/0x20 [ 140.354919][ T382] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 140.362852][ T627] ? delete_node+0x759/0x7b0 [ 140.362861][ T627] ? __kasan_check_write+0x14/0x20 [ 140.362877][ T627] ? idr_replace+0x1c4/0x230 [ 140.367869][ T382] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 140.375809][ T627] ? idr_get_next+0x4b0/0x4b0 [ 140.375819][ T627] ? _raw_spin_lock_bh+0xa3/0x1b0 [ 140.375833][ T627] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 140.380827][ T382] Call Trace: [ 140.388775][ T627] css_populate_dir+0x137/0x370 [ 140.393430][ T382] ? lockref_get_or_lock+0x340/0x340 [ 140.402320][ T627] cgroup_apply_control_enable+0x8b9/0x12f0 [ 140.402336][ T627] cgroup_apply_control+0x93/0x710 [ 140.407852][ T382] ? umount_tree+0xf50/0xf50 [ 140.414399][ T627] ? css_next_child+0x160/0x160 [ 140.414407][ T627] ? stack_trace_save+0x12d/0x1f0 [ 140.414423][ T627] ? io_schedule+0x120/0x120 [ 140.420555][ T382] ? vfs_submount+0xb0/0xb0 [ 140.425110][ T627] ? kernfs_fop_write_iter+0x15e/0x410 [ 140.433068][ T382] ? dput+0x2b6/0x320 [ 140.438060][ T627] ? __kasan_check_write+0x14/0x20 [ 140.446043][ T382] path_umount+0x1fe/0xfb0 [ 140.450585][ T627] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 140.450598][ T627] cgroup_subtree_control_write+0xd19/0x1310 [ 140.450615][ T627] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 140.455710][ T382] ? namespace_unlock+0x4f0/0x4f0 [ 140.460268][ T627] ? __kasan_check_write+0x14/0x20 [ 140.460280][ T627] ? _copy_from_iter+0x3fb/0xd60 [ 140.460295][ T627] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 140.468245][ T382] ? user_path_at_empty+0x40/0x50 [ 140.472886][ T627] cgroup_file_write+0x28e/0x590 [ 140.472896][ T627] ? cgroup_seqfile_stop+0xc0/0xc0 [ 140.472914][ T627] ? mutex_lock+0xa6/0x110 [ 140.477913][ T382] __x64_sys_umount+0x122/0x170 [ 140.483072][ T627] ? mutex_trylock+0xb0/0xb0 [ 140.483082][ T627] ? __kasan_check_write+0x14/0x20 [ 140.483098][ T627] kernfs_fop_write_iter+0x2d0/0x410 [ 140.486356][ T382] ? path_umount+0xfb0/0xfb0 [ 140.491170][ T627] ? cgroup_seqfile_stop+0xc0/0xc0 [ 140.491180][ T627] vfs_write+0xc1c/0xf40 [ 140.491195][ T627] ? __kasan_check_write+0x14/0x20 [ 140.496455][ T382] ? syscall_enter_from_user_mode+0x58/0x1b0 [ 140.502307][ T627] ? kernel_write+0x3c0/0x3c0 [ 140.502316][ T627] ? _raw_spin_unlock_irq+0x4e/0x70 [ 140.502331][ T627] ? ptrace_stop+0x6ff/0x9f0 [ 140.507413][ T382] do_syscall_64+0x34/0x70 [ 140.511969][ T627] ? __kasan_check_read+0x11/0x20 [ 140.511978][ T627] ? __fdget_pos+0x27e/0x310 [ 140.511993][ T627] ksys_write+0x198/0x2c0 [ 140.516817][ T382] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 140.521808][ T627] ? do_notify_parent+0xa60/0xa60 [ 140.521817][ T627] ? __ia32_sys_read+0x90/0x90 [ 140.521832][ T627] ? __ia32_sys_open+0x270/0x270 [ 140.526409][ T382] RIP: 0033:0x7fc8ece63fb7 [ 140.530880][ T627] __x64_sys_write+0x7b/0x90 [ 140.530897][ T627] do_syscall_64+0x34/0x70 [ 140.536324][ T382] Code: 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 140.540270][ T627] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 140.540284][ T627] RIP: 0033:0x7fc8ece62c09 [ 140.545366][ T382] RSP: 002b:00007ffd7d0e2358 EFLAGS: 00000202 [ 140.549752][ T627] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 140.555010][ T382] ORIG_RAX: 00000000000000a6 [ 140.560948][ T627] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 140.560967][ T627] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 140.566919][ T382] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc8ece63fb7 [ 140.571900][ T627] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 140.571908][ T627] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 140.571925][ T627] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 140.577007][ T382] RDX: 00007ffd7d0e241a RSI: 000000000000000a RDI: 00007ffd7d0e2410 [ 140.581905][ T627] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000028 [pid 382] umount2("./43/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 627] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 382] umount2("./43/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./43/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 382] umount2("./43/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] openat(AT_FDCWD, "./43/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 382] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 382] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 382] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 382] close(4) = 0 [pid 382] rmdir("./43/file0") = 0 [pid 382] umount2("./43/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./43/cgroup.cpu", [pid 627] close(3 [pid 382] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 382] unlink("./43/cgroup.cpu" [pid 627] <... close resumed>) = 0 [pid 627] close(4 [pid 382] <... unlink resumed>) = 0 [pid 382] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 382] close(3) = 0 [pid 382] rmdir("./43" [pid 627] <... close resumed>) = 0 [pid 382] <... rmdir resumed>) = 0 [pid 382] mkdir("./44", 0777 [pid 627] close(5 [pid 382] <... mkdir resumed>) = 0 [pid 627] <... close resumed>) = 0 [pid 627] close(6 [pid 382] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 627] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 627] close(7) = -1 EBADF (Bad file descriptor) [pid 627] close(8) = -1 EBADF (Bad file descriptor) [pid 627] close(9) = -1 EBADF (Bad file descriptor) [pid 627] close(10 [pid 382] <... clone resumed>, child_tidptr=0x555556fab5d0) = 46 ./strace-static-x86_64: Process 629 attached [pid 629] chdir("./44" [pid 627] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 629] <... chdir resumed>) = 0 [pid 629] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 629] setpgid(0, 0) = 0 [pid 627] close(11 [pid 629] symlink("/syzcgroup/unified/syz5", "./cgroup" [pid 627] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 629] <... symlink resumed>) = 0 [pid 627] close(12 [pid 629] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [pid 629] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 629] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 627] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 629] write(3, "1000", 4) = 4 [pid 629] close(3 [pid 628] <... write resumed>) = 6 [pid 629] <... close resumed>) = 0 [pid 629] symlink("/dev/binderfs", "./binderfs") = 0 [pid 629] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 629] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 627] close(13) = -1 EBADF (Bad file descriptor) [pid 627] close(14) = -1 EBADF (Bad file descriptor) [pid 627] close(15) = -1 EBADF (Bad file descriptor) [pid 627] close(16) = -1 EBADF (Bad file descriptor) [pid 627] close(17) = -1 EBADF (Bad file descriptor) [pid 627] close(18) = -1 EBADF (Bad file descriptor) [pid 627] close(19) = -1 EBADF (Bad file descriptor) [pid 627] close(20) = -1 EBADF (Bad file descriptor) [pid 627] close(21) = -1 EBADF (Bad file descriptor) [pid 627] close(22) = -1 EBADF (Bad file descriptor) [pid 627] close(23) = -1 EBADF (Bad file descriptor) [pid 627] close(24) = -1 EBADF (Bad file descriptor) [pid 627] close(25) = -1 EBADF (Bad file descriptor) [pid 627] close(26) = -1 EBADF (Bad file descriptor) [pid 627] close(27) = -1 EBADF (Bad file descriptor) [pid 627] close(28) = -1 EBADF (Bad file descriptor) [pid 627] close(29) = -1 EBADF (Bad file descriptor) [ 140.842789][ T382] RBP: 00007ffd7d0e2410 R08: 00000000ffffffff R09: 00007ffd7d0e21f0 [ 140.850764][ T382] R10: 0000555556fad6a3 R11: 0000000000000202 R12: 00007ffd7d0e3490 [ 140.858724][ T382] R13: 0000555556fad600 R14: 00007ffd7d0e2380 R15: 000000000000002c [ 140.866691][ T382] ---[ end trace d4de1ca9cdcd198c ]--- [ 140.872232][ T627] cgroup: cgroup_addrm_files: failed to add max, err=-12 [ 140.891131][ T623] FAULT_INJECTION: forcing a failure. [pid 627] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory ) = 89 [pid 627] exit_group(0) = ? [pid 627] +++ exited with 0 +++ [pid 381] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=42, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 381] restart_syscall(<... resuming interrupted clone ...> [pid 628] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 628] write(5, "22", 2) = 2 [pid 628] write(4, "+pids ", 6 [pid 381] <... restart_syscall resumed>) = 0 [pid 381] umount2("./40", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] openat(AT_FDCWD, "./40", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 381] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 381] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 381] umount2("./40/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./40/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 381] unlink("./40/binderfs") = 0 [pid 381] umount2("./40/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./40/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 381] unlink("./40/cgroup") = 0 [pid 381] umount2("./40/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./40/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 381] unlink("./40/cgroup.net") = 0 [pid 381] umount2("./40/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 381] umount2("./40/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./40/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 381] umount2("./40/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] openat(AT_FDCWD, "./40/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 381] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 381] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 381] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 381] close(4) = 0 [pid 381] rmdir("./40/file0") = 0 [pid 381] umount2("./40/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./40/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 381] unlink("./40/cgroup.cpu") = 0 [pid 381] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 381] close(3) = 0 [pid 381] rmdir("./40") = 0 [pid 381] mkdir("./41", 0777) = 0 [pid 381] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556fab5d0) = 43 ./strace-static-x86_64: Process 630 attached [pid 630] chdir("./41") = 0 [pid 630] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 630] setpgid(0, 0) = 0 [pid 630] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [pid 630] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 630] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 630] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 630] write(3, "1000", 4) = 4 [pid 630] close(3) = 0 [pid 630] symlink("/dev/binderfs", "./binderfs") = 0 [pid 630] mkdirat(AT_FDCWD, "./file0", 000) = 0 [ 140.891131][ T623] name failslab, interval 1, probability 0, space 0, times 0 [ 140.904280][ T623] CPU: 1 PID: 623 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 140.915895][ T623] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 140.925937][ T623] Call Trace: [ 140.929325][ T623] dump_stack_lvl+0x1e2/0x24b [ 140.933990][ T623] ? bfq_pos_tree_add_move+0x43e/0x43e [ 140.939429][ T623] ? selinux_kernfs_init_security+0x1a8/0x760 [ 140.945471][ T623] dump_stack+0x15/0x17 [ 140.949598][ T623] should_fail+0x3c0/0x510 [ 140.953990][ T623] ? __kernfs_new_node+0x99/0x6e0 [ 140.958986][ T623] __should_failslab+0x9f/0xe0 [ 140.963731][ T623] should_failslab+0x9/0x20 [ 140.968225][ T623] __kmalloc_track_caller+0x5f/0x350 [ 140.973508][ T623] kstrdup_const+0x55/0x90 [ 140.977915][ T623] __kernfs_new_node+0x99/0x6e0 [ 140.982741][ T623] ? is_module_text_address+0xe1/0x140 [ 140.988171][ T623] ? kernfs_new_node+0x170/0x170 [ 140.993086][ T623] ? ptr_to_hashval+0x60/0x60 [ 140.997759][ T623] ? arch_stack_walk+0xf8/0x140 [ 141.002594][ T623] ? snprintf+0xd6/0x120 [ 141.006816][ T623] kernfs_new_node+0x97/0x170 [ 141.011474][ T623] __kernfs_create_file+0x4a/0x270 [ 141.016557][ T623] cgroup_addrm_files+0xab8/0xfe0 [ 141.021562][ T623] ? ____kasan_kmalloc+0xdc/0x110 [ 141.026566][ T623] ? __kasan_kmalloc+0x9/0x10 [ 141.031216][ T623] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 141.036737][ T623] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 141.042865][ T623] ? delete_node+0x759/0x7b0 [ 141.047428][ T623] ? __kasan_check_read+0x11/0x20 [ 141.052435][ T623] ? delete_node+0x759/0x7b0 [ 141.057016][ T623] ? __kasan_check_write+0x14/0x20 [ 141.062109][ T623] ? idr_replace+0x1c4/0x230 [ 141.066671][ T623] ? idr_get_next+0x4b0/0x4b0 [ 141.071323][ T623] ? _raw_spin_lock_bh+0xa3/0x1b0 [ 141.076329][ T623] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 141.081500][ T623] css_populate_dir+0x137/0x370 [ 141.086346][ T623] cgroup_apply_control_enable+0x8b9/0x12f0 [ 141.092246][ T623] cgroup_apply_control+0x93/0x710 [ 141.097341][ T623] ? css_next_child+0x160/0x160 [ 141.102168][ T623] ? stack_trace_save+0x12d/0x1f0 [ 141.107174][ T623] ? io_schedule+0x120/0x120 [ 141.111749][ T623] ? kernfs_fop_write_iter+0x15e/0x410 [ 141.117192][ T623] ? __kasan_check_write+0x14/0x20 [ 141.122285][ T623] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 141.127558][ T623] cgroup_subtree_control_write+0xd19/0x1310 [ 141.133538][ T623] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 141.139511][ T623] ? __kasan_check_write+0x14/0x20 [ 141.144601][ T623] ? _copy_from_iter+0x3fb/0xd60 [ 141.149522][ T623] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 141.155495][ T623] cgroup_file_write+0x28e/0x590 [ 141.160415][ T623] ? cgroup_seqfile_stop+0xc0/0xc0 [ 141.165498][ T623] ? mutex_lock+0xa6/0x110 [ 141.169886][ T623] ? mutex_trylock+0xb0/0xb0 [ 141.174459][ T623] ? __kasan_check_write+0x14/0x20 [ 141.179547][ T623] kernfs_fop_write_iter+0x2d0/0x410 [ 141.184802][ T623] ? cgroup_seqfile_stop+0xc0/0xc0 [ 141.189885][ T623] vfs_write+0xc1c/0xf40 [ 141.194115][ T623] ? __kasan_check_write+0x14/0x20 [ 141.199211][ T623] ? kernel_write+0x3c0/0x3c0 [ 141.203861][ T623] ? _raw_spin_unlock_irq+0x4e/0x70 [ 141.209033][ T623] ? ptrace_stop+0x6ff/0x9f0 [ 141.213596][ T623] ? __kasan_check_read+0x11/0x20 [ 141.218601][ T623] ? __fdget_pos+0x27e/0x310 [ 141.223166][ T623] ksys_write+0x198/0x2c0 [ 141.227472][ T623] ? do_notify_parent+0xa60/0xa60 [ 141.232479][ T623] ? __ia32_sys_read+0x90/0x90 [ 141.237225][ T623] ? __ia32_sys_open+0x270/0x270 [ 141.242138][ T623] __x64_sys_write+0x7b/0x90 [ 141.246702][ T623] do_syscall_64+0x34/0x70 [ 141.251094][ T623] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 141.256962][ T623] RIP: 0033:0x7fc8ece62c09 [ 141.261349][ T623] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 141.280938][ T623] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 141.289332][ T623] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [pid 630] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 629] <... mount resumed>) = 0 [pid 623] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 630] open("./file0", O_RDONLY [pid 629] open("./file0", O_RDONLY [pid 623] close(3 [pid 630] <... open resumed>) = 3 [pid 629] <... open resumed>) = 3 [pid 630] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [pid 630] write(4, "-pids ", 6 [pid 623] <... close resumed>) = 0 [pid 623] close(4) = 0 [pid 623] close(5) = 0 [pid 623] close(6) = -1 EBADF (Bad file descriptor) [pid 623] close(7) = -1 EBADF (Bad file descriptor) [pid 623] close(8) = -1 EBADF (Bad file descriptor) [pid 623] close(9) = -1 EBADF (Bad file descriptor) [pid 623] close(10) = -1 EBADF (Bad file descriptor) [pid 623] close(11) = -1 EBADF (Bad file descriptor) [pid 623] close(12) = -1 EBADF (Bad file descriptor) [pid 623] close(13) = -1 EBADF (Bad file descriptor) [pid 623] close(14) = -1 EBADF (Bad file descriptor) [pid 623] close(15) = -1 EBADF (Bad file descriptor) [pid 623] close(16) = -1 EBADF (Bad file descriptor) [pid 623] close(17 [pid 629] openat(3, "cgroup.subtree_control", O_RDWR [pid 623] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 623] close(18 [pid 629] <... openat resumed>) = 4 [pid 623] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 623] close(19) = -1 EBADF (Bad file descriptor) [pid 623] close(20) = -1 EBADF (Bad file descriptor) [pid 623] close(21) = -1 EBADF (Bad file descriptor) [pid 623] close(22) = -1 EBADF (Bad file descriptor) [pid 623] close(23) = -1 EBADF (Bad file descriptor) [pid 623] close(24) = -1 EBADF (Bad file descriptor) [pid 623] close(25) = -1 EBADF (Bad file descriptor) [pid 623] close(26) = -1 EBADF (Bad file descriptor) [pid 623] close(27) = -1 EBADF (Bad file descriptor) [pid 623] close(28) = -1 EBADF (Bad file descriptor) [pid 623] close(29) = -1 EBADF (Bad file descriptor) write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory [pid 623] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 623] exit_group(0) = ? [pid 629] write(4, "-pids ", 6 [pid 623] +++ exited with 0 +++ [pid 383] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=35, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 383] umount2("./33", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] openat(AT_FDCWD, "./33", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 383] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 383] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 383] umount2("./33/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./33/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 383] unlink("./33/binderfs") = 0 [pid 383] umount2("./33/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./33/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 383] unlink("./33/cgroup") = 0 [pid 383] umount2("./33/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./33/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 383] unlink("./33/cgroup.net") = 0 [pid 383] umount2("./33/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 383] umount2("./33/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./33/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 383] umount2("./33/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] openat(AT_FDCWD, "./33/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 383] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 383] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 383] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 383] close(4) = 0 [pid 383] rmdir("./33/file0") = 0 [pid 383] umount2("./33/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./33/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 383] unlink("./33/cgroup.cpu") = 0 [pid 383] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 383] close(3) = 0 [pid 383] rmdir("./33") = 0 [pid 383] mkdir("./34", 0777) = 0 [pid 383] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 631 attached , child_tidptr=0x555556fab5d0) = 36 [pid 631] chdir("./34") = 0 [pid 631] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 631] setpgid(0, 0) = 0 [ 141.297281][ T623] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 141.305238][ T623] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 141.313220][ T623] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 141.321175][ T623] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000021 [ 141.329966][ T623] cgroup: cgroup_addrm_files: failed to add max, err=-12 [pid 631] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 631] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 630] <... write resumed>) = 6 [pid 631] symlink("/syzcgroup/net/syz4", "./cgroup.net" [pid 630] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 631] <... symlink resumed>) = 0 [pid 630] <... openat resumed>) = 5 [pid 631] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 630] write(5, "22", 2 [pid 631] <... openat resumed>) = 3 [pid 630] <... write resumed>) = 2 [pid 631] write(3, "1000", 4 [pid 630] write(4, "+pids ", 6 [pid 631] <... write resumed>) = 4 [pid 631] close(3) = 0 [pid 631] symlink("/dev/binderfs", "./binderfs") = 0 [pid 631] mkdirat(AT_FDCWD, "./file0", 000) = 0 [ 141.350589][ T628] FAULT_INJECTION: forcing a failure. [ 141.350589][ T628] name failslab, interval 1, probability 0, space 0, times 0 [ 141.363227][ T628] CPU: 1 PID: 628 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 141.374841][ T628] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 141.384876][ T628] Call Trace: [ 141.388154][ T628] dump_stack_lvl+0x1e2/0x24b [ 141.392822][ T628] ? bfq_pos_tree_add_move+0x43e/0x43e [ 141.398269][ T628] ? selinux_kernfs_init_security+0x1a8/0x760 [ 141.404318][ T628] dump_stack+0x15/0x17 [ 141.408456][ T628] should_fail+0x3c0/0x510 [ 141.412853][ T628] ? __kernfs_new_node+0x99/0x6e0 [ 141.417856][ T628] __should_failslab+0x9f/0xe0 [ 141.422604][ T628] should_failslab+0x9/0x20 [ 141.427087][ T628] __kmalloc_track_caller+0x5f/0x350 [ 141.432358][ T628] kstrdup_const+0x55/0x90 [ 141.436762][ T628] __kernfs_new_node+0x99/0x6e0 [ 141.441589][ T628] ? is_module_text_address+0xe1/0x140 [ 141.447025][ T628] ? kernfs_new_node+0x170/0x170 [ 141.451938][ T628] ? ptr_to_hashval+0x60/0x60 [ 141.456596][ T628] ? arch_stack_walk+0xf8/0x140 [ 141.461425][ T628] ? snprintf+0xd6/0x120 [ 141.465645][ T628] kernfs_new_node+0x97/0x170 [ 141.470300][ T628] __kernfs_create_file+0x4a/0x270 [ 141.475405][ T628] cgroup_addrm_files+0xab8/0xfe0 [ 141.480411][ T628] ? ____kasan_kmalloc+0xdc/0x110 [ 141.485442][ T628] ? __kasan_kmalloc+0x9/0x10 [ 141.490104][ T628] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 141.495633][ T628] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 141.501767][ T628] ? delete_node+0x759/0x7b0 [ 141.506348][ T628] ? __kasan_check_read+0x11/0x20 [ 141.511356][ T628] ? delete_node+0x759/0x7b0 [ 141.515927][ T628] ? __kasan_check_write+0x14/0x20 [ 141.521018][ T628] ? idr_replace+0x1c4/0x230 [ 141.525590][ T628] ? idr_get_next+0x4b0/0x4b0 [ 141.530245][ T628] ? _raw_spin_lock_bh+0xa3/0x1b0 [ 141.535250][ T628] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 141.540430][ T628] css_populate_dir+0x137/0x370 [ 141.545264][ T628] cgroup_apply_control_enable+0x8b9/0x12f0 [ 141.551137][ T628] cgroup_apply_control+0x93/0x710 [ 141.556230][ T628] ? css_next_child+0x160/0x160 [ 141.561059][ T628] ? stack_trace_save+0x12d/0x1f0 [ 141.566058][ T628] ? io_schedule+0x120/0x120 [ 141.570627][ T628] ? kernfs_fop_write_iter+0x15e/0x410 [ 141.576060][ T628] ? __kasan_check_write+0x14/0x20 [ 141.581151][ T628] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 141.586423][ T628] cgroup_subtree_control_write+0xd19/0x1310 [ 141.592393][ T628] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 141.598350][ T628] ? __kasan_check_write+0x14/0x20 [ 141.603440][ T628] ? _copy_from_iter+0x3fb/0xd60 [ 141.608355][ T628] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 141.614309][ T628] cgroup_file_write+0x28e/0x590 [ 141.619223][ T628] ? cgroup_seqfile_stop+0xc0/0xc0 [ 141.624310][ T628] ? mutex_lock+0xa6/0x110 [ 141.628703][ T628] ? mutex_trylock+0xb0/0xb0 [ 141.633270][ T628] ? __kasan_check_write+0x14/0x20 [ 141.638362][ T628] kernfs_fop_write_iter+0x2d0/0x410 [ 141.643623][ T628] ? cgroup_seqfile_stop+0xc0/0xc0 [ 141.648710][ T628] vfs_write+0xc1c/0xf40 [ 141.652929][ T628] ? __kasan_check_write+0x14/0x20 [ 141.658017][ T628] ? kernel_write+0x3c0/0x3c0 [ 141.662673][ T628] ? _raw_spin_unlock_irq+0x4e/0x70 [ 141.667847][ T628] ? ptrace_stop+0x6ff/0x9f0 [ 141.672416][ T628] ? __kasan_check_read+0x11/0x20 [ 141.677417][ T628] ? __fdget_pos+0x27e/0x310 [ 141.681986][ T628] ksys_write+0x198/0x2c0 [ 141.686304][ T628] ? do_notify_parent+0xa60/0xa60 [ 141.691312][ T628] ? __ia32_sys_read+0x90/0x90 [ 141.696051][ T628] ? __ia32_sys_open+0x270/0x270 [ 141.700966][ T628] __x64_sys_write+0x7b/0x90 [ 141.705536][ T628] do_syscall_64+0x34/0x70 [ 141.709928][ T628] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 141.715794][ T628] RIP: 0033:0x7fc8ece62c09 [ 141.720187][ T628] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 141.739767][ T628] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 631] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 628] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 628] close(3 [pid 631] open("./file0", O_RDONLY [pid 628] <... close resumed>) = 0 [pid 631] <... open resumed>) = 3 [pid 628] close(4 [pid 631] openat(3, "cgroup.subtree_control", O_RDWR [pid 628] <... close resumed>) = 0 [pid 631] <... openat resumed>) = 4 [pid 628] close(5 [pid 631] write(4, "-pids ", 6 [pid 628] <... close resumed>) = 0 [pid 628] close(6) = -1 EBADF (Bad file descriptor) [pid 628] close(7) = -1 EBADF (Bad file descriptor) [pid 628] close(8) = -1 EBADF (Bad file descriptor) [pid 628] close(9) = -1 EBADF (Bad file descriptor) [pid 628] close(10) = -1 EBADF (Bad file descriptor) [pid 628] close(11) = -1 EBADF (Bad file descriptor) [pid 628] close(12) = -1 EBADF (Bad file descriptor) [pid 628] close(13) = -1 EBADF (Bad file descriptor) [pid 628] close(14) = -1 EBADF (Bad file descriptor) [pid 628] close(15) = -1 EBADF (Bad file descriptor) [pid 628] close(16) = -1 EBADF (Bad file descriptor) [pid 628] close(17) = -1 EBADF (Bad file descriptor) [pid 628] close(18) = -1 EBADF (Bad file descriptor) [pid 628] close(19) = -1 EBADF (Bad file descriptor) [pid 628] close(20) = -1 EBADF (Bad file descriptor) [pid 628] close(21) = -1 EBADF (Bad file descriptor) [pid 628] close(22) = -1 EBADF (Bad file descriptor) [pid 628] close(23) = -1 EBADF (Bad file descriptor) [pid 628] close(24) = -1 EBADF (Bad file descriptor) [pid 628] close(25) = -1 EBADF (Bad file descriptor) [pid 628] close(26) = -1 EBADF (Bad file descriptor) [pid 628] close(27) = -1 EBADF (Bad file descriptor) [pid 628] close(28) = -1 EBADF (Bad file descriptor) [pid 628] close(29) = -1 EBADF (Bad file descriptor) write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory [pid 628] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 628] exit_group(0) = ? [pid 628] +++ exited with 0 +++ [pid 375] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=45, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 375] umount2("./43", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] openat(AT_FDCWD, "./43", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 375] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 375] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 375] umount2("./43/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./43/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 375] unlink("./43/binderfs") = 0 [pid 375] umount2("./43/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./43/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 375] unlink("./43/cgroup") = 0 [pid 375] umount2("./43/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./43/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 375] unlink("./43/cgroup.net") = 0 [ 141.748158][ T628] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 141.756104][ T628] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 141.764052][ T628] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 141.772002][ T628] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 141.779954][ T628] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 000000000000002b [ 141.788073][ T628] cgroup: cgroup_addrm_files: failed to add max, err=-12 [ 141.804225][ T375] ------------[ cut here ]------------ [ 141.809725][ T375] WARNING: CPU: 0 PID: 375 at fs/namespace.c:1168 mntput_no_expire+0x48a/0x6c0 [ 141.818658][ T375] Modules linked in: [ 141.822553][ T375] CPU: 0 PID: 375 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 141.834166][ T375] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 141.844228][ T375] RIP: 0010:mntput_no_expire+0x48a/0x6c0 [pid 375] umount2("./43/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 625] <... write resumed>) = 6 [ 141.849839][ T375] Code: 48 c7 c2 80 02 44 86 e8 64 f0 8e ff e9 8b fc ff ff e8 ba 21 b6 ff e9 81 fc ff ff e8 b0 21 b6 ff e9 77 fc ff ff e8 a6 21 b6 ff <0f> 0b e9 f4 fc ff ff e8 9a 21 b6 ff e8 65 ad a2 ff e9 ea fc ff ff [ 141.850364][ T626] FAULT_INJECTION: forcing a failure. [ 141.850364][ T626] name failslab, interval 1, probability 0, space 0, times 0 [ 141.869462][ T375] RSP: 0018:ffffc9000095fba0 EFLAGS: 00010293 [ 141.888089][ T375] RAX: ffffffff81b68f1a RBX: 00000000ffffffff RCX: ffff8881065e13c0 [ 141.896101][ T375] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000 [ 141.904072][ T375] RBP: ffffc9000095fc70 R08: ffffffff81b68c08 R09: 0000000000000003 [ 141.912045][ T375] R10: fffff5200012bf65 R11: 1ffff9200012bf64 R12: dffffc0000000000 [ 141.920006][ T375] R13: ffff8881192dddc0 R14: ffffc9000095fc00 R15: 1ffff9200012bf7c [ 141.924161][ T626] CPU: 1 PID: 626 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 141.928002][ T375] FS: 0000555556fab300(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 141.939567][ T626] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 141.939571][ T626] Call Trace: [ 141.939589][ T626] dump_stack_lvl+0x1e2/0x24b [ 141.939604][ T626] ? panic+0x7d7/0x7d7 [ 141.948518][ T375] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 141.958537][ T626] ? bfq_pos_tree_add_move+0x43e/0x43e [ 141.958553][ T626] ? find_next_bit+0xd6/0x120 [ 141.961818][ T375] CR2: 00007ffd7d0e1c18 CR3: 000000011dd54000 CR4: 00000000003506b0 [ 141.966464][ T626] ? cpumask_next+0x11/0x30 [ 141.970514][ T375] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 141.977062][ T626] dump_stack+0x15/0x17 [ 141.982509][ T375] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 141.987137][ T626] should_fail+0x3c0/0x510 [ 141.995082][ T375] Call Trace: [ 141.999553][ T626] ? percpu_ref_init+0xd0/0x330 [ 142.007513][ T375] ? io_schedule+0x120/0x120 [ 142.011628][ T626] __should_failslab+0x9f/0xe0 [ 142.011639][ T626] should_failslab+0x9/0x20 [ 142.011648][ T626] kmem_cache_alloc_trace+0x3a/0x330 [ 142.011664][ T626] percpu_ref_init+0xd0/0x330 [ 142.019612][ T375] ? vfs_submount+0xb0/0xb0 [ 142.023995][ T626] ? cgroup_setup_root+0xea0/0xea0 [ 142.024006][ T626] cgroup_apply_control_enable+0x3a2/0x12f0 [ 142.024022][ T626] cgroup_apply_control+0x93/0x710 [ 142.027279][ T375] ? shrink_dentry_list+0x4ec/0x500 [ 142.032097][ T626] ? css_next_child+0x160/0x160 [ 142.032105][ T626] ? stack_trace_save+0x12d/0x1f0 [ 142.032121][ T626] ? io_schedule+0x120/0x120 [ 142.036682][ T375] ? __kasan_check_write+0x14/0x20 [ 142.041411][ T626] ? kernfs_fop_write_iter+0x15e/0x410 [ 142.041420][ T626] ? __kasan_check_write+0x14/0x20 [ 142.041429][ T626] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 142.041445][ T626] cgroup_subtree_control_write+0xd19/0x1310 [ 142.045936][ T375] namespace_unlock+0x448/0x4f0 [ 142.051191][ T626] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 142.051202][ T626] ? __kasan_check_write+0x14/0x20 [ 142.051213][ T626] ? _copy_from_iter+0x3fb/0xd60 [ 142.051231][ T626] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 142.055884][ T375] ? umount_tree+0xf50/0xf50 [ 142.060368][ T626] cgroup_file_write+0x28e/0x590 [ 142.060380][ T626] ? cgroup_seqfile_stop+0xc0/0xc0 [ 142.060399][ T626] ? mutex_lock+0xa6/0x110 [ 142.065517][ T375] ? __detach_mounts+0x670/0x670 [ 142.071555][ T626] ? mutex_trylock+0xb0/0xb0 [ 142.071566][ T626] ? __kasan_check_write+0x14/0x20 [ 142.071583][ T626] kernfs_fop_write_iter+0x2d0/0x410 [ 142.076679][ T375] ? selinux_umount+0xf0/0x130 [ 142.081842][ T626] ? cgroup_seqfile_stop+0xc0/0xc0 [ 142.081853][ T626] vfs_write+0xc1c/0xf40 [ 142.081863][ T626] ? __kasan_check_write+0x14/0x20 [ 142.081879][ T626] ? kernel_write+0x3c0/0x3c0 [ 142.086700][ T375] ? security_sb_umount+0x9d/0xb0 [ 142.091688][ T626] ? _raw_spin_unlock_irq+0x4e/0x70 [ 142.091698][ T626] ? ptrace_stop+0x6ff/0x9f0 [ 142.091718][ T626] ? __kasan_check_read+0x11/0x20 [ 142.096282][ T375] path_umount+0xf03/0xfb0 [ 142.101359][ T626] ? __fdget_pos+0x27e/0x310 [ 142.101370][ T626] ksys_write+0x198/0x2c0 [ 142.101380][ T626] ? do_notify_parent+0xa60/0xa60 [ 142.101389][ T626] ? __ia32_sys_read+0x90/0x90 [ 142.101404][ T626] ? __ia32_sys_open+0x270/0x270 [ 142.106837][ T375] ? namespace_unlock+0x4f0/0x4f0 [ 142.111920][ T626] __x64_sys_write+0x7b/0x90 [ 142.111933][ T626] do_syscall_64+0x34/0x70 [ 142.111952][ T626] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 142.117213][ T375] ? user_path_at_empty+0x40/0x50 [ 142.123152][ T626] RIP: 0033:0x7fc8ece62c09 [pid 625] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 626] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 626] close(3) = 0 [pid 626] close(4) = 0 [pid 626] close(5) = 0 [pid 626] close(6) = -1 EBADF (Bad file descriptor) [pid 626] close(7) = -1 EBADF (Bad file descriptor) [pid 626] close(8) = -1 EBADF (Bad file descriptor) [pid 626] close(9) = -1 EBADF (Bad file descriptor) [pid 626] close(10) = -1 EBADF (Bad file descriptor) [pid 626] close(11) = -1 EBADF (Bad file descriptor) [pid 626] close(12) = -1 EBADF (Bad file descriptor) [pid 626] close(13) = -1 EBADF (Bad file descriptor) [pid 626] close(14) = -1 EBADF (Bad file descriptor) [pid 626] close(15) = -1 EBADF (Bad file descriptor) [pid 626] close(16) = -1 EBADF (Bad file descriptor) [pid 626] close(17) = -1 EBADF (Bad file descriptor) [pid 626] close(18) = -1 EBADF (Bad file descriptor) [pid 626] close(19) = -1 EBADF (Bad file descriptor) [pid 626] close(20) = -1 EBADF (Bad file descriptor) [pid 626] close(21) = -1 EBADF (Bad file descriptor) [pid 626] close(22) = -1 EBADF (Bad file descriptor) [pid 626] close(23) = -1 EBADF (Bad file descriptor) [pid 626] close(24) = -1 EBADF (Bad file descriptor) [pid 626] close(25) = -1 EBADF (Bad file descriptor) [pid 626] close(26) = -1 EBADF (Bad file descriptor) [pid 626] close(27) = -1 EBADF (Bad file descriptor) [pid 626] close(28) = -1 EBADF (Bad file descriptor) [pid 626] close(29write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory ) = -1 EBADF (Bad file descriptor) [pid 626] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 626] exit_group(0) = ? [pid 626] +++ exited with 0 +++ [pid 376] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=42, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 376] restart_syscall(<... resuming interrupted clone ...>) = 0 [ 142.123164][ T626] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 142.123177][ T626] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 [ 142.128006][ T375] __x64_sys_umount+0x122/0x170 [ 142.133944][ T626] ORIG_RAX: 0000000000000001 [ 142.133952][ T626] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 142.133958][ T626] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 142.133972][ T626] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 142.139082][ T375] ? path_umount+0xfb0/0xfb0 [ 142.143981][ T626] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 142.143988][ T626] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000028 [ 142.369120][ T375] ? syscall_enter_from_user_mode+0x58/0x1b0 [ 142.375108][ T375] do_syscall_64+0x34/0x70 [ 142.379517][ T375] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 142.385431][ T375] RIP: 0033:0x7fc8ece63fb7 [ 142.389835][ T375] Code: 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 142.409470][ T375] RSP: 002b:00007ffd7d0e2358 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [ 142.417894][ T375] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc8ece63fb7 [ 142.425873][ T375] RDX: 00007ffd7d0e241a RSI: 000000000000000a RDI: 00007ffd7d0e2410 [ 142.433860][ T375] RBP: 00007ffd7d0e2410 R08: 00000000ffffffff R09: 00007ffd7d0e21f0 [ 142.441852][ T375] R10: 0000555556fad6a3 R11: 0000000000000202 R12: 00007ffd7d0e3490 [pid 376] umount2("./40", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 142.449821][ T375] R13: 0000555556fad600 R14: 00007ffd7d0e2380 R15: 000000000000002c [ 142.457811][ T375] ---[ end trace d4de1ca9cdcd198d ]--- [ 142.463543][ T375] ------------[ cut here ]------------ [ 142.469005][ T375] WARNING: CPU: 0 PID: 375 at fs/namespace.c:1168 mntput_no_expire+0x48a/0x6c0 [ 142.477951][ T375] Modules linked in: [ 142.481897][ T375] CPU: 0 PID: 375 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 142.493605][ T375] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [pid 376] openat(AT_FDCWD, "./40", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 380] kill(-40, SIGKILL) = 0 [pid 380] kill(40, SIGKILL) = 0 [ 142.503701][ T375] RIP: 0010:mntput_no_expire+0x48a/0x6c0 [ 142.509323][ T375] Code: 48 c7 c2 80 02 44 86 e8 64 f0 8e ff e9 8b fc ff ff e8 ba 21 b6 ff e9 81 fc ff ff e8 b0 21 b6 ff e9 77 fc ff ff e8 a6 21 b6 ff <0f> 0b e9 f4 fc ff ff e8 9a 21 b6 ff e8 65 ad a2 ff e9 ea fc ff ff [ 142.528946][ T375] RSP: 0018:ffffc9000095fca0 EFLAGS: 00010293 [ 142.535032][ T375] RAX: ffffffff81b68f1a RBX: 00000000ffffffff RCX: ffff8881065e13c0 [ 142.543015][ T375] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000 [ 142.551004][ T375] RBP: ffffc9000095fd70 R08: ffffffff81b68c08 R09: 0000000000000003 [ 142.558961][ T375] R10: fffff5200012bf85 R11: 1ffff9200012bf84 R12: dffffc0000000000 [ 142.566943][ T375] R13: ffff8881192dddc0 R14: ffffc9000095fd00 R15: 1ffff9200012bf9c [ 142.574932][ T375] FS: 0000555556fab300(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 142.583883][ T375] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 142.590479][ T375] CR2: 00007ffd7d0e1c18 CR3: 000000011dd54000 CR4: 00000000003506b0 [ 142.598442][ T375] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 142.606419][ T375] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 142.614395][ T375] Call Trace: [ 142.617671][ T375] ? lockref_get_or_lock+0x340/0x340 [ 142.622960][ T375] ? umount_tree+0xf50/0xf50 [ 142.627542][ T375] ? vfs_submount+0xb0/0xb0 [ 142.632048][ T375] ? dput+0x2b6/0x320 [ 142.636020][ T375] path_umount+0x1fe/0xfb0 [ 142.640456][ T375] ? namespace_unlock+0x4f0/0x4f0 [ 142.645471][ T375] ? user_path_at_empty+0x40/0x50 [ 142.650498][ T375] __x64_sys_umount+0x122/0x170 [ 142.655331][ T375] ? path_umount+0xfb0/0xfb0 [ 142.659901][ T375] ? syscall_enter_from_user_mode+0x58/0x1b0 [ 142.665873][ T375] do_syscall_64+0x34/0x70 [ 142.670379][ T375] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 142.676430][ T375] RIP: 0033:0x7fc8ece63fb7 [ 142.680855][ T375] Code: 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 380] openat(AT_FDCWD, "/sys/fs/fuse/connections", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 376] <... openat resumed>) = 3 [pid 375] <... umount2 resumed>) = 0 [pid 376] fstat(3, [pid 375] umount2("./43/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 376] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 376] getdents64(3, [pid 375] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 376] <... getdents64 resumed>0x555556fad630 /* 7 entries */, 32768) = 208 [pid 380] <... openat resumed>) = 3 [pid 376] umount2("./40/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 375] lstat("./43/file0", [pid 376] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 375] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 380] fstat(3, [pid 376] lstat("./40/binderfs", [pid 375] umount2("./43/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 380] <... fstat resumed>{st_mode=S_IFDIR|0755, st_size=0, ...}) = 0 [pid 380] getdents64(3, [pid 376] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 375] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 380] <... getdents64 resumed>0x555556fad630 /* 2 entries */, 32768) = 48 [pid 380] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 376] unlink("./40/binderfs" [pid 375] openat(AT_FDCWD, "./43/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 376] <... unlink resumed>) = 0 [pid 376] umount2("./40/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW [pid 375] <... openat resumed>) = 4 [pid 376] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 376] lstat("./40/cgroup", [pid 375] fstat(4, [pid 376] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 375] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 376] unlink("./40/cgroup" [pid 375] getdents64(4, [pid 376] <... unlink resumed>) = 0 [pid 380] close(3) = 0 [pid 376] umount2("./40/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW [pid 375] <... getdents64 resumed>0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 376] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 376] lstat("./40/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 376] unlink("./40/cgroup.net" [pid 375] getdents64(4, [pid 376] <... unlink resumed>) = 0 [pid 376] umount2("./40/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 376] umount2("./40/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./40/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 376] umount2("./40/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 625] <... openat resumed>) = ? [pid 376] openat(AT_FDCWD, "./40/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 376] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 376] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 376] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 376] close(4 [pid 625] +++ killed by SIGKILL +++ [pid 376] <... close resumed>) = 0 [pid 376] rmdir("./40/file0") = 0 [pid 376] umount2("./40/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./40/cgroup.cpu", [pid 380] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=40, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=16} --- [pid 376] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 376] unlink("./40/cgroup.cpu" [pid 631] <... write resumed>) = 6 [pid 629] <... write resumed>) = 6 [pid 376] <... unlink resumed>) = 0 [ 142.700464][ T375] RSP: 002b:00007ffd7d0e2358 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [ 142.708864][ T375] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc8ece63fb7 [ 142.716830][ T375] RDX: 00007ffd7d0e241a RSI: 000000000000000a RDI: 00007ffd7d0e2410 [ 142.724806][ T375] RBP: 00007ffd7d0e2410 R08: 00000000ffffffff R09: 00007ffd7d0e21f0 [ 142.732792][ T375] R10: 0000555556fad6a3 R11: 0000000000000202 R12: 00007ffd7d0e3490 [ 142.740763][ T375] R13: 0000555556fad600 R14: 00007ffd7d0e2380 R15: 000000000000002c [ 142.748720][ T375] ---[ end trace d4de1ca9cdcd198e ]--- [pid 376] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 376] close(3) = 0 [pid 376] rmdir("./40") = 0 [pid 376] mkdir("./41", 0777) = 0 [pid 376] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556fab5d0) = 43 [pid 375] <... getdents64 resumed>0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 375] close(4) = 0 [pid 375] rmdir("./43/file0") = 0 [pid 375] umount2("./43/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./43/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 375] unlink("./43/cgroup.cpu") = 0 [pid 375] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 375] close(3) = 0 [pid 375] rmdir("./43") = 0 [pid 375] mkdir("./44", 0777) = 0 [pid 375] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556fab5d0) = 46 ./strace-static-x86_64: Process 633 attached [pid 633] chdir("./44") = 0 [pid 633] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 633] setpgid(0, 0) = 0 [pid 633] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 633] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 633] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 633] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 633] write(3, "1000", 4) = 4 [pid 633] close(3) = 0 [pid 633] symlink("/dev/binderfs", "./binderfs") = 0 [pid 633] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 633] mount(NULL, "./file0", "cgroup2", 0, NULL./strace-static-x86_64: Process 632 attached [pid 631] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 629] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 380] umount2("./38", MNT_DETACH|UMOUNT_NOFOLLOW [ 142.762744][ T630] FAULT_INJECTION: forcing a failure. [ 142.762744][ T630] name failslab, interval 1, probability 0, space 0, times 0 [ 142.775449][ T630] CPU: 1 PID: 630 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 142.787057][ T630] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 142.797090][ T630] Call Trace: [ 142.800370][ T630] dump_stack_lvl+0x1e2/0x24b [ 142.805034][ T630] ? bfq_pos_tree_add_move+0x43e/0x43e [ 142.810473][ T630] ? selinux_kernfs_init_security+0x1a8/0x760 [ 142.816526][ T630] dump_stack+0x15/0x17 [ 142.820677][ T630] should_fail+0x3c0/0x510 [ 142.825077][ T630] ? __kernfs_new_node+0x99/0x6e0 [ 142.830076][ T630] __should_failslab+0x9f/0xe0 [ 142.834824][ T630] should_failslab+0x9/0x20 [ 142.839323][ T630] __kmalloc_track_caller+0x5f/0x350 [ 142.844756][ T630] kstrdup_const+0x55/0x90 [ 142.849150][ T630] __kernfs_new_node+0x99/0x6e0 [ 142.854000][ T630] ? is_module_text_address+0xe1/0x140 [ 142.859450][ T630] ? kernfs_new_node+0x170/0x170 [ 142.864372][ T630] ? ptr_to_hashval+0x60/0x60 [ 142.869023][ T630] ? arch_stack_walk+0xf8/0x140 [ 142.873849][ T630] ? snprintf+0xd6/0x120 [ 142.878064][ T630] kernfs_new_node+0x97/0x170 [ 142.882731][ T630] __kernfs_create_file+0x4a/0x270 [ 142.887824][ T630] cgroup_addrm_files+0xab8/0xfe0 [ 142.892824][ T630] ? ____kasan_kmalloc+0xdc/0x110 [ 142.897826][ T630] ? __kasan_kmalloc+0x9/0x10 [ 142.902487][ T630] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 142.908022][ T630] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 142.914150][ T630] ? delete_node+0x759/0x7b0 [ 142.918715][ T630] ? __kasan_check_read+0x11/0x20 [ 142.923712][ T630] ? delete_node+0x759/0x7b0 [ 142.928277][ T630] ? __kasan_check_write+0x14/0x20 [ 142.933366][ T630] ? idr_replace+0x1c4/0x230 [ 142.937929][ T630] ? idr_get_next+0x4b0/0x4b0 [ 142.942668][ T630] ? _raw_spin_lock_bh+0xa3/0x1b0 [ 142.947673][ T630] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 142.952854][ T630] css_populate_dir+0x137/0x370 [ 142.957699][ T630] cgroup_apply_control_enable+0x8b9/0x12f0 [ 142.963567][ T630] cgroup_apply_control+0x93/0x710 [ 142.968651][ T630] ? css_next_child+0x160/0x160 [ 142.973473][ T630] ? stack_trace_save+0x12d/0x1f0 [ 142.978471][ T630] ? io_schedule+0x120/0x120 [ 142.983036][ T630] ? kernfs_fop_write_iter+0x15e/0x410 [ 142.988476][ T630] ? __kasan_check_write+0x14/0x20 [ 142.993572][ T630] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 142.998848][ T630] cgroup_subtree_control_write+0xd19/0x1310 [ 143.004822][ T630] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 143.010781][ T630] ? __kasan_check_write+0x14/0x20 [ 143.015884][ T630] ? _copy_from_iter+0x3fb/0xd60 [ 143.020805][ T630] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 143.026756][ T630] cgroup_file_write+0x28e/0x590 [ 143.031670][ T630] ? cgroup_seqfile_stop+0xc0/0xc0 [ 143.036781][ T630] ? mutex_lock+0xa6/0x110 [ 143.041188][ T630] ? mutex_trylock+0xb0/0xb0 [ 143.045763][ T630] ? __kasan_check_write+0x14/0x20 [ 143.050855][ T630] kernfs_fop_write_iter+0x2d0/0x410 [ 143.056124][ T630] ? cgroup_seqfile_stop+0xc0/0xc0 [ 143.061213][ T630] vfs_write+0xc1c/0xf40 [ 143.065430][ T630] ? __kasan_check_write+0x14/0x20 [ 143.070525][ T630] ? kernel_write+0x3c0/0x3c0 [ 143.075193][ T630] ? _raw_spin_unlock_irq+0x4e/0x70 [ 143.080378][ T630] ? ptrace_stop+0x6ff/0x9f0 [ 143.084951][ T630] ? __kasan_check_read+0x11/0x20 [ 143.089952][ T630] ? __fdget_pos+0x27e/0x310 [ 143.094531][ T630] ksys_write+0x198/0x2c0 [ 143.098850][ T630] ? do_notify_parent+0xa60/0xa60 [ 143.103861][ T630] ? __ia32_sys_read+0x90/0x90 [ 143.108606][ T630] ? __ia32_sys_open+0x270/0x270 [ 143.113529][ T630] __x64_sys_write+0x7b/0x90 [ 143.118093][ T630] do_syscall_64+0x34/0x70 [ 143.122500][ T630] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 143.128377][ T630] RIP: 0033:0x7fc8ece62c09 [ 143.132769][ T630] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 143.152433][ T630] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 632] chdir("./41" [pid 631] <... openat resumed>) = 5 [pid 632] <... chdir resumed>) = 0 [pid 631] write(5, "22", 2 [pid 632] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 631] <... write resumed>) = 2 [pid 632] <... prctl resumed>) = 0 [pid 631] write(4, "+pids ", 6 [pid 632] setpgid(0, 0) = 0 [pid 632] symlink("/syzcgroup/unified/syz1", "./cgroup") = 0 [pid 632] symlink("/syzcgroup/cpu/syz1", "./cgroup.cpu") = 0 [pid 632] symlink("/syzcgroup/net/syz1", "./cgroup.net") = 0 [pid 632] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 632] write(3, "1000", 4) = 4 [pid 632] close(3) = 0 [pid 632] symlink("/dev/binderfs", "./binderfs") = 0 [pid 632] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 632] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 629] <... openat resumed>) = 5 [pid 629] write(5, "22", 2) = 2 [pid 629] write(4, "+pids ", 6 [pid 380] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 380] openat(AT_FDCWD, "./38", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 380] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 380] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 380] umount2("./38/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./38/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 380] unlink("./38/binderfs") = 0 [pid 380] umount2("./38/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./38/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 380] unlink("./38/cgroup") = 0 [pid 380] umount2("./38/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./38/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 380] unlink("./38/cgroup.net") = 0 [pid 380] umount2("./38/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 380] umount2("./38/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./38/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 380] umount2("./38/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] openat(AT_FDCWD, "./38/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 380] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 380] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 380] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 380] close(4) = 0 [pid 380] rmdir("./38/file0") = 0 [pid 380] umount2("./38/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./38/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 380] unlink("./38/cgroup.cpu") = 0 [pid 380] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 380] close(3) = 0 [pid 380] rmdir("./38") = 0 [pid 380] mkdir("./39", 0777) = 0 [pid 380] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 634 attached [pid 634] chdir("./39" [pid 380] <... clone resumed>, child_tidptr=0x555556fab5d0) = 41 [pid 634] <... chdir resumed>) = 0 [pid 634] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 634] setpgid(0, 0) = 0 [pid 634] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 634] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 634] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 634] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 634] write(3, "1000", 4) = 4 [pid 634] close(3) = 0 [pid 634] symlink("/dev/binderfs", "./binderfs") = 0 [pid 633] <... mount resumed>) = 0 [pid 632] <... mount resumed>) = 0 [pid 630] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 634] mkdirat(AT_FDCWD, "./file0", 000 [pid 633] open("./file0", O_RDONLY [pid 632] open("./file0", O_RDONLY [pid 634] <... mkdirat resumed>) = 0 [pid 633] <... open resumed>) = 3 [pid 632] <... open resumed>) = 3 [pid 630] close(3 [pid 634] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 633] openat(3, "cgroup.subtree_control", O_RDWR [pid 632] openat(3, "cgroup.subtree_control", O_RDWR [pid 630] <... close resumed>) = 0 [pid 634] <... mount resumed>) = 0 [pid 633] <... openat resumed>) = 4 [pid 632] <... openat resumed>) = 4 [pid 630] close(4 [pid 634] open("./file0", O_RDONLY [pid 633] write(4, "-pids ", 6 [pid 630] <... close resumed>) = 0 [pid 632] write(4, "-pids ", 6 [pid 630] close(5 [pid 634] <... open resumed>) = 3 [pid 630] <... close resumed>) = 0 [pid 630] close(6 [pid 634] openat(3, "cgroup.subtree_control", O_RDWR [pid 630] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 630] close(7) = -1 EBADF (Bad file descriptor) [pid 630] close(8) = -1 EBADF (Bad file descriptor) [pid 630] close(9) = -1 EBADF (Bad file descriptor) [pid 630] close(10) = -1 EBADF (Bad file descriptor) [pid 630] close(11) = -1 EBADF (Bad file descriptor) [pid 630] close(12) = -1 EBADF (Bad file descriptor) [pid 630] close(13) = -1 EBADF (Bad file descriptor) [pid 630] close(14) = -1 EBADF (Bad file descriptor) [pid 630] close(15 [pid 634] <... openat resumed>) = 4 [pid 630] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 634] write(4, "-pids ", 6 [pid 630] close(16) = -1 EBADF (Bad file descriptor) [pid 630] close(17) = -1 EBADF (Bad file descriptor) [pid 630] close(18) = -1 EBADF (Bad file descriptor) [pid 630] close(19) = -1 EBADF (Bad file descriptor) [pid 630] close(20) = -1 EBADF (Bad file descriptor) [pid 630] close(21) = -1 EBADF (Bad file descriptor) [pid 630] close(22) = -1 EBADF (Bad file descriptor) [pid 630] close(23) = -1 EBADF (Bad file descriptor) [pid 630] close(24) = -1 EBADF (Bad file descriptor) [pid 630] close(25) = -1 EBADF (Bad file descriptor) [pid 630] close(26) = -1 EBADF (Bad file descriptor) [pid 630] close(27) = -1 EBADF (Bad file descriptor) [pid 630] close(28) = -1 EBADF (Bad file descriptor) [pid 630] close(29) = -1 EBADF (Bad file descriptor) write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory [pid 630] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 630] exit_group(0) = ? [pid 630] +++ exited with 0 +++ [pid 381] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=43, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 381] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 381] umount2("./41", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 143.160819][ T630] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 143.168779][ T630] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 143.176734][ T630] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 143.184679][ T630] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 143.192635][ T630] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000029 [ 143.205680][ T630] cgroup: cgroup_addrm_files: failed to add max, err=-12 [pid 381] openat(AT_FDCWD, "./41", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 381] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 381] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 381] umount2("./41/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./41/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 381] unlink("./41/binderfs") = 0 [pid 381] umount2("./41/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./41/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 381] unlink("./41/cgroup") = 0 [pid 381] umount2("./41/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./41/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 381] unlink("./41/cgroup.net") = 0 [ 143.220936][ T631] FAULT_INJECTION: forcing a failure. [ 143.220936][ T631] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 143.234395][ T631] CPU: 0 PID: 631 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 143.246008][ T631] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 143.256038][ T631] Call Trace: [ 143.259308][ T631] dump_stack_lvl+0x1e2/0x24b [ 143.263979][ T631] ? bfq_pos_tree_add_move+0x43e/0x43e [ 143.269422][ T631] ? stack_trace_save+0x12d/0x1f0 [ 143.274423][ T631] ? __kasan_check_write+0x14/0x20 [ 143.279512][ T631] dump_stack+0x15/0x17 [ 143.283642][ T631] should_fail+0x3c0/0x510 [ 143.288212][ T631] should_fail_alloc_page+0x50/0x60 [ 143.293389][ T631] __alloc_pages_nodemask+0x1c0/0x890 [ 143.298741][ T631] ? pcpu_block_update_hint_alloc+0x96c/0xd00 [ 143.304792][ T631] ? gfp_pfmemalloc_allowed+0x120/0x120 [ 143.310318][ T631] ? pcpu_memcg_post_alloc_hook+0x1c8/0x340 [ 143.316194][ T631] ? trace_raw_output_percpu_destroy_chunk+0xc0/0xc0 [ 143.322849][ T631] allocate_slab+0x78/0x540 [ 143.327345][ T631] ___slab_alloc+0x131/0x2e0 [ 143.331910][ T631] ? percpu_ref_init+0xd0/0x330 [ 143.336742][ T631] __slab_alloc+0x63/0xa0 [ 143.341046][ T631] ? percpu_ref_init+0xd0/0x330 [ 143.345882][ T631] kmem_cache_alloc_trace+0x20e/0x330 [ 143.351242][ T631] ? percpu_ref_init+0xd0/0x330 [ 143.356069][ T631] percpu_ref_init+0xd0/0x330 [ 143.360723][ T631] ? cgroup_setup_root+0xea0/0xea0 [ 143.365817][ T631] cgroup_apply_control_enable+0x3a2/0x12f0 [ 143.371693][ T631] cgroup_apply_control+0x93/0x710 [ 143.376783][ T631] ? css_next_child+0x160/0x160 [ 143.381606][ T631] ? io_schedule+0x120/0x120 [ 143.386178][ T631] ? kernfs_fop_write_iter+0x15e/0x410 [ 143.391611][ T631] ? __kasan_check_write+0x14/0x20 [ 143.396706][ T631] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 143.401983][ T631] cgroup_subtree_control_write+0xd19/0x1310 [ 143.407946][ T631] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 143.413898][ T631] ? __kasan_check_write+0x14/0x20 [ 143.418980][ T631] ? _copy_from_iter+0x3fb/0xd60 [ 143.423891][ T631] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 143.429844][ T631] cgroup_file_write+0x28e/0x590 [ 143.434752][ T631] ? cgroup_seqfile_stop+0xc0/0xc0 [ 143.439843][ T631] ? mutex_lock+0xa6/0x110 [ 143.444246][ T631] ? mutex_trylock+0xb0/0xb0 [ 143.448825][ T631] ? __kasan_check_write+0x14/0x20 [ 143.453920][ T631] kernfs_fop_write_iter+0x2d0/0x410 [ 143.459191][ T631] ? cgroup_seqfile_stop+0xc0/0xc0 [ 143.464295][ T631] vfs_write+0xc1c/0xf40 [ 143.468527][ T631] ? __kasan_check_write+0x14/0x20 [ 143.473629][ T631] ? kernel_write+0x3c0/0x3c0 [ 143.478290][ T631] ? _raw_spin_unlock_irq+0x4e/0x70 [ 143.483462][ T631] ? ptrace_stop+0x6ff/0x9f0 [ 143.488029][ T631] ? __kasan_check_read+0x11/0x20 [ 143.493036][ T631] ? __fdget_pos+0x27e/0x310 [ 143.497604][ T631] ksys_write+0x198/0x2c0 [ 143.501917][ T631] ? do_notify_parent+0xa60/0xa60 [ 143.506928][ T631] ? __ia32_sys_read+0x90/0x90 [ 143.511694][ T631] ? __ia32_sys_open+0x270/0x270 [ 143.516607][ T631] __x64_sys_write+0x7b/0x90 [ 143.521173][ T631] do_syscall_64+0x34/0x70 [ 143.525564][ T631] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 143.531428][ T631] RIP: 0033:0x7fc8ece62c09 [ 143.535834][ T631] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 143.555418][ T631] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 143.563814][ T631] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [pid 381] umount2("./41/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 631] <... write resumed>) = 6 [pid 631] close(3) = 0 [pid 631] close(4) = 0 [pid 381] <... umount2 resumed>) = 0 [pid 631] close(5) = 0 [pid 631] close(6) = -1 EBADF (Bad file descriptor) [pid 631] close(7) = -1 EBADF (Bad file descriptor) [pid 631] close(8) = -1 EBADF (Bad file descriptor) [pid 631] close(9) = -1 EBADF (Bad file descriptor) [pid 631] close(10) = -1 EBADF (Bad file descriptor) [pid 631] close(11) = -1 EBADF (Bad file descriptor) [pid 631] close(12) = -1 EBADF (Bad file descriptor) [pid 631] close(13) = -1 EBADF (Bad file descriptor) [pid 631] close(14) = -1 EBADF (Bad file descriptor) [pid 631] close(15) = -1 EBADF (Bad file descriptor) [pid 631] close(16) = -1 EBADF (Bad file descriptor) [pid 631] close(17) = -1 EBADF (Bad file descriptor) [pid 631] close(18) = -1 EBADF (Bad file descriptor) [pid 631] close(19) = -1 EBADF (Bad file descriptor) [pid 631] close(20) = -1 EBADF (Bad file descriptor) [pid 631] close(21) = -1 EBADF (Bad file descriptor) [pid 631] close(22) = -1 EBADF (Bad file descriptor) [pid 631] close(23) = -1 EBADF (Bad file descriptor) [pid 631] close(24) = -1 EBADF (Bad file descriptor) [pid 631] close(25) = -1 EBADF (Bad file descriptor) [pid 631] close(26) = -1 EBADF (Bad file descriptor) [pid 631] close(27) = -1 EBADF (Bad file descriptor) [pid 631] close(28) = -1 EBADF (Bad file descriptor) [pid 631] close(29write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory ) = -1 EBADF (Bad file descriptor) [pid 631] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 631] exit_group(0) = ? [pid 631] +++ exited with 0 +++ [pid 633] <... write resumed>) = 6 [pid 383] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=36, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 381] umount2("./41/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 633] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 383] umount2("./34", MNT_DETACH|UMOUNT_NOFOLLOW [pid 381] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 383] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 633] <... openat resumed>) = 5 [pid 383] openat(AT_FDCWD, "./34", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 381] lstat("./41/file0", [pid 383] <... openat resumed>) = 3 [pid 383] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 383] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 383] umount2("./34/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 381] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 383] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 383] lstat("./34/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 383] unlink("./34/binderfs" [pid 633] write(5, "22", 2) = 2 [pid 633] write(4, "+pids ", 6 [pid 381] umount2("./41/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] openat(AT_FDCWD, "./41/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 381] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 381] getdents64(4, [pid 383] <... unlink resumed>) = 0 [pid 381] <... getdents64 resumed>0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 383] umount2("./34/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] getdents64(4, [pid 383] lstat("./34/cgroup", [pid 381] <... getdents64 resumed>0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 383] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 381] close(4 [pid 383] unlink("./34/cgroup" [pid 381] <... close resumed>) = 0 [pid 383] <... unlink resumed>) = 0 [pid 381] rmdir("./41/file0" [pid 383] umount2("./34/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./34/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 383] unlink("./34/cgroup.net" [pid 381] <... rmdir resumed>) = 0 [pid 383] <... unlink resumed>) = 0 [pid 383] umount2("./34/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 381] umount2("./41/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 383] <... umount2 resumed>) = 0 [pid 381] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 383] umount2("./34/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 381] lstat("./41/cgroup.cpu", [pid 383] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 381] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 383] lstat("./34/file0", [pid 381] unlink("./41/cgroup.cpu" [pid 383] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 383] umount2("./34/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 381] <... unlink resumed>) = 0 [pid 383] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 381] getdents64(3, [pid 383] openat(AT_FDCWD, "./34/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 381] <... getdents64 resumed>0x555556fad630 /* 0 entries */, 32768) = 0 [pid 383] fstat(4, [pid 381] close(3 [pid 383] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 383] getdents64(4, [pid 381] <... close resumed>) = 0 [pid 383] <... getdents64 resumed>0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 381] rmdir("./41" [pid 383] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 383] close(4) = 0 [pid 383] rmdir("./34/file0" [pid 381] <... rmdir resumed>) = 0 [pid 383] <... rmdir resumed>) = 0 [pid 381] mkdir("./42", 0777 [pid 383] umount2("./34/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./34/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 383] unlink("./34/cgroup.cpu") = 0 [pid 381] <... mkdir resumed>) = 0 [pid 383] getdents64(3, [pid 381] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 383] <... getdents64 resumed>0x555556fad630 /* 0 entries */, 32768) = 0 [pid 383] close(3./strace-static-x86_64: Process 635 attached ) = 0 [pid 383] rmdir("./34" [pid 381] <... clone resumed>, child_tidptr=0x555556fab5d0) = 44 [pid 635] chdir("./42" [pid 383] <... rmdir resumed>) = 0 [pid 635] <... chdir resumed>) = 0 [pid 383] mkdir("./35", 0777 [pid 635] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 383] <... mkdir resumed>) = 0 [pid 635] <... prctl resumed>) = 0 [pid 383] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 636 attached [pid 635] setpgid(0, 0) = 0 [pid 383] <... clone resumed>, child_tidptr=0x555556fab5d0) = 37 [pid 635] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [pid 636] chdir("./35" [pid 635] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 636] <... chdir resumed>) = 0 [pid 635] symlink("/syzcgroup/net/syz3", "./cgroup.net" [pid 636] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 635] <... symlink resumed>) = 0 [pid 635] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 636] <... prctl resumed>) = 0 [pid 635] <... openat resumed>) = 3 [pid 636] setpgid(0, 0 [pid 635] write(3, "1000", 4 [pid 636] <... setpgid resumed>) = 0 [pid 635] <... write resumed>) = 4 [pid 635] close(3 [pid 636] symlink("/syzcgroup/unified/syz4", "./cgroup" [pid 635] <... close resumed>) = 0 [pid 635] symlink("/dev/binderfs", "./binderfs" [pid 636] <... symlink resumed>) = 0 [pid 635] <... symlink resumed>) = 0 [pid 636] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu" [pid 635] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 635] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 636] <... symlink resumed>) = 0 [pid 635] <... mount resumed>) = 0 [pid 636] symlink("/syzcgroup/net/syz4", "./cgroup.net" [pid 635] open("./file0", O_RDONLY) = 3 [pid 636] <... symlink resumed>) = 0 [pid 636] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 635] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [pid 635] write(4, "-pids ", 6 [pid 636] <... openat resumed>) = 3 [pid 636] write(3, "1000", 4) = 4 [pid 636] close(3) = 0 [pid 636] symlink("/dev/binderfs", "./binderfs") = 0 [pid 636] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 636] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 636] open("./file0", O_RDONLY) = 3 [pid 636] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [pid 636] write(4, "-pids ", 6 [pid 635] <... write resumed>) = 6 [pid 635] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [ 143.571784][ T631] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 143.579741][ T631] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 143.587698][ T631] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 143.595647][ T631] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000022 [pid 635] write(5, "22", 2) = 2 [ 143.640608][ T629] FAULT_INJECTION: forcing a failure. [ 143.640608][ T629] name failslab, interval 1, probability 0, space 0, times 0 [ 143.653327][ T629] CPU: 1 PID: 629 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 143.664945][ T629] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 143.674981][ T629] Call Trace: [ 143.678353][ T629] dump_stack_lvl+0x1e2/0x24b [ 143.683019][ T629] ? bfq_pos_tree_add_move+0x43e/0x43e [ 143.688466][ T629] ? selinux_kernfs_init_security+0x1a8/0x760 [ 143.694520][ T629] dump_stack+0x15/0x17 [ 143.698672][ T629] should_fail+0x3c0/0x510 [ 143.703073][ T629] ? __kernfs_new_node+0x99/0x6e0 [ 143.708089][ T629] __should_failslab+0x9f/0xe0 [ 143.712838][ T629] should_failslab+0x9/0x20 [ 143.717326][ T629] __kmalloc_track_caller+0x5f/0x350 [ 143.722604][ T629] kstrdup_const+0x55/0x90 [ 143.727010][ T629] __kernfs_new_node+0x99/0x6e0 [ 143.731846][ T629] ? is_module_text_address+0xe1/0x140 [ 143.737290][ T629] ? kernfs_new_node+0x170/0x170 [ 143.742211][ T629] ? ptr_to_hashval+0x60/0x60 [ 143.746956][ T629] ? arch_stack_walk+0xf8/0x140 [ 143.751795][ T629] ? snprintf+0xd6/0x120 [ 143.756023][ T629] kernfs_new_node+0x97/0x170 [ 143.760681][ T629] __kernfs_create_file+0x4a/0x270 [ 143.765776][ T629] cgroup_addrm_files+0xab8/0xfe0 [ 143.770773][ T629] ? ____kasan_kmalloc+0xdc/0x110 [ 143.775777][ T629] ? __kasan_kmalloc+0x9/0x10 [ 143.780444][ T629] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 143.785977][ T629] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 143.792115][ T629] ? delete_node+0x759/0x7b0 [ 143.796692][ T629] ? __kasan_check_read+0x11/0x20 [ 143.801695][ T629] ? delete_node+0x759/0x7b0 [ 143.806269][ T629] ? __kasan_check_write+0x14/0x20 [ 143.811372][ T629] ? idr_replace+0x1c4/0x230 [ 143.815943][ T629] ? idr_get_next+0x4b0/0x4b0 [ 143.820603][ T629] ? _raw_spin_lock_bh+0xa3/0x1b0 [ 143.825616][ T629] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 143.830812][ T629] css_populate_dir+0x137/0x370 [ 143.835658][ T629] cgroup_apply_control_enable+0x8b9/0x12f0 [ 143.841536][ T629] cgroup_apply_control+0x93/0x710 [ 143.846622][ T629] ? css_next_child+0x160/0x160 [ 143.851455][ T629] ? io_schedule+0x120/0x120 [ 143.856034][ T629] ? kernfs_fop_write_iter+0x15e/0x410 [ 143.861476][ T629] ? __kasan_check_write+0x14/0x20 [ 143.866561][ T629] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 143.871818][ T629] cgroup_subtree_control_write+0xd19/0x1310 [ 143.877777][ T629] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 143.883750][ T629] ? __kasan_check_write+0x14/0x20 [ 143.888852][ T629] ? _copy_from_iter+0x3fb/0xd60 [ 143.893775][ T629] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 143.899731][ T629] cgroup_file_write+0x28e/0x590 [ 143.904659][ T629] ? cgroup_seqfile_stop+0xc0/0xc0 [ 143.909757][ T629] ? mutex_lock+0xa6/0x110 [ 143.914155][ T629] ? mutex_trylock+0xb0/0xb0 [ 143.918717][ T629] ? __kasan_check_write+0x14/0x20 [ 143.923802][ T629] kernfs_fop_write_iter+0x2d0/0x410 [ 143.929093][ T629] ? cgroup_seqfile_stop+0xc0/0xc0 [ 143.934213][ T629] vfs_write+0xc1c/0xf40 [ 143.938440][ T629] ? __kasan_check_write+0x14/0x20 [ 143.943525][ T629] ? kernel_write+0x3c0/0x3c0 [ 143.948182][ T629] ? _raw_spin_unlock_irq+0x4e/0x70 [ 143.953369][ T629] ? ptrace_stop+0x6ff/0x9f0 [ 143.957944][ T629] ? __kasan_check_read+0x11/0x20 [ 143.962942][ T629] ? __fdget_pos+0x27e/0x310 [ 143.967509][ T629] ksys_write+0x198/0x2c0 [ 143.971812][ T629] ? do_notify_parent+0xa60/0xa60 [ 143.976818][ T629] ? __ia32_sys_read+0x90/0x90 [ 143.981565][ T629] ? __ia32_sys_open+0x270/0x270 [ 143.986482][ T629] __x64_sys_write+0x7b/0x90 [ 143.991064][ T629] do_syscall_64+0x34/0x70 [ 143.995472][ T629] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 144.001345][ T629] RIP: 0033:0x7fc8ece62c09 [ 144.005734][ T629] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 144.025324][ T629] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 144.033727][ T629] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [pid 635] write(4, "+pids ", 6 [pid 629] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 629] close(3) = 0 [pid 629] close(4) = 0 [pid 629] close(5) = 0 [pid 629] close(6) = -1 EBADF (Bad file descriptor) [pid 629] close(7) = -1 EBADF (Bad file descriptor) [pid 629] close(8) = -1 EBADF (Bad file descriptor) [pid 629] close(9) = -1 EBADF (Bad file descriptor) [pid 629] close(10) = -1 EBADF (Bad file descriptor) [pid 629] close(11) = -1 EBADF (Bad file descriptor) [pid 629] close(12) = -1 EBADF (Bad file descriptor) [pid 629] close(13) = -1 EBADF (Bad file descriptor) [pid 629] close(14) = -1 EBADF (Bad file descriptor) [pid 629] close(15) = -1 EBADF (Bad file descriptor) [pid 629] close(16) = -1 EBADF (Bad file descriptor) [pid 629] close(17) = -1 EBADF (Bad file descriptor) [pid 629] close(18) = -1 EBADF (Bad file descriptor) [pid 629] close(19) = -1 EBADF (Bad file descriptor) [pid 629] close(20) = -1 EBADF (Bad file descriptor) [pid 629] close(21) = -1 EBADF (Bad file descriptor) [pid 629] close(22) = -1 EBADF (Bad file descriptor) [pid 629] close(23) = -1 EBADF (Bad file descriptor) [pid 629] close(24) = -1 EBADF (Bad file descriptor) [pid 629] close(25) = -1 EBADF (Bad file descriptor) [pid 629] close(26) = -1 EBADF (Bad file descriptor) [pid 629] close(27) = -1 EBADF (Bad file descriptor) [pid 629] close(28) = -1 EBADF (Bad file descriptor) [pid 629] close(29) = -1 EBADF (Bad file descriptor) write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory [pid 629] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 629] exit_group(0) = ? [pid 629] +++ exited with 0 +++ [pid 382] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=46, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 382] umount2("./44", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] openat(AT_FDCWD, "./44", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 382] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 382] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 382] umount2("./44/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./44/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 382] unlink("./44/binderfs") = 0 [pid 382] umount2("./44/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./44/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 382] unlink("./44/cgroup") = 0 [pid 382] umount2("./44/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./44/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 382] unlink("./44/cgroup.net") = 0 [ 144.041679][ T629] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 144.049631][ T629] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 144.057584][ T629] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 144.065536][ T629] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 000000000000002c [ 144.075006][ T629] cgroup: cgroup_addrm_files: failed to add max, err=-12 [ 144.090877][ T382] ------------[ cut here ]------------ [ 144.096462][ T382] WARNING: CPU: 0 PID: 382 at fs/namespace.c:1168 mntput_no_expire+0x48a/0x6c0 [ 144.105413][ T382] Modules linked in: [ 144.109295][ T382] CPU: 0 PID: 382 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 144.120933][ T382] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 144.131075][ T382] RIP: 0010:mntput_no_expire+0x48a/0x6c0 [ 144.131419][ T633] FAULT_INJECTION: forcing a failure. [ 144.131419][ T633] name failslab, interval 1, probability 0, space 0, times 0 [ 144.136694][ T382] Code: 48 c7 c2 80 02 44 86 e8 64 f0 8e ff e9 8b fc ff ff e8 ba 21 b6 ff e9 81 fc ff ff e8 b0 21 b6 ff e9 77 fc ff ff e8 a6 21 b6 ff <0f> 0b e9 f4 fc ff ff e8 9a 21 b6 ff e8 65 ad a2 ff e9 ea fc ff ff [ 144.136701][ T382] RSP: 0018:ffffc90000b77ba0 EFLAGS: 00010293 [ 144.136713][ T382] RAX: ffffffff81b68f1a RBX: 00000000ffffffff RCX: ffff8881065e4f00 [ 144.136728][ T382] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000 [ 144.150121][ T633] CPU: 1 PID: 633 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 144.169022][ T382] RBP: ffffc90000b77c70 R08: ffffffff81b68c08 R09: 0000000000000003 [ 144.174998][ T633] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 144.175003][ T633] Call Trace: [ 144.175020][ T633] dump_stack_lvl+0x1e2/0x24b [ 144.175036][ T633] ? panic+0x7d7/0x7d7 [ 144.182989][ T382] R10: fffff5200016ef65 R11: 1ffff9200016ef64 R12: dffffc0000000000 [ 144.190925][ T633] ? bfq_pos_tree_add_move+0x43e/0x43e [ 144.190936][ T633] ? find_next_bit+0xd6/0x120 [ 144.190953][ T633] ? cpumask_next+0x11/0x30 [ 144.202546][ T382] R13: ffff8881192dd880 R14: ffffc90000b77c00 R15: 1ffff9200016ef7c [ 144.210479][ T633] dump_stack+0x15/0x17 [ 144.210488][ T633] should_fail+0x3c0/0x510 [ 144.210504][ T633] ? percpu_ref_init+0xd0/0x330 [ 144.220554][ T382] FS: 0000555556fab300(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 144.223792][ T633] __should_failslab+0x9f/0xe0 [ 144.228433][ T382] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 144.232468][ T633] should_failslab+0x9/0x20 [ 144.232478][ T633] kmem_cache_alloc_trace+0x3a/0x330 [ 144.232488][ T633] percpu_ref_init+0xd0/0x330 [ 144.232500][ T633] ? cgroup_setup_root+0xea0/0xea0 [ 144.232511][ T633] cgroup_apply_control_enable+0x3a2/0x12f0 [ 144.232522][ T633] cgroup_apply_control+0x93/0x710 [ 144.232538][ T633] ? css_next_child+0x160/0x160 [ 144.240487][ T382] CR2: 00007ffd7d0e1c18 CR3: 000000011dd7e000 CR4: 00000000003506b0 [ 144.245911][ T633] ? io_schedule+0x120/0x120 [ 144.250558][ T382] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 144.255023][ T633] ? kernfs_fop_write_iter+0x15e/0x410 [ 144.262967][ T382] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 144.267090][ T633] ? __kasan_check_write+0x14/0x20 [ 144.271472][ T382] Call Trace: [ 144.276292][ T633] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 144.285212][ T382] ? io_schedule+0x120/0x120 [ 144.289933][ T633] cgroup_subtree_control_write+0xd19/0x1310 [ 144.296515][ T382] ? vfs_submount+0xb0/0xb0 [ 144.300958][ T633] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 144.300977][ T633] ? __kasan_check_write+0x14/0x20 [ 144.306235][ T382] ? shrink_dentry_list+0x4ec/0x500 [ 144.310876][ T633] ? _copy_from_iter+0x3fb/0xd60 [ 144.310893][ T633] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 144.315978][ T382] ? __kasan_check_write+0x14/0x20 [ 144.321924][ T633] cgroup_file_write+0x28e/0x590 [ 144.321934][ T633] ? cgroup_seqfile_stop+0xc0/0xc0 [ 144.321952][ T633] ? mutex_lock+0xa6/0x110 [pid 382] umount2("./44/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 633] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 633] close(3) = 0 [pid 633] close(4) = 0 [pid 633] close(5) = 0 [pid 633] close(6) = -1 EBADF (Bad file descriptor) [pid 633] close(7) = -1 EBADF (Bad file descriptor) [pid 633] close(8) = -1 EBADF (Bad file descriptor) [pid 633] close(9) = -1 EBADF (Bad file descriptor) [pid 633] close(10) = -1 EBADF (Bad file descriptor) [pid 633] close(11) = -1 EBADF (Bad file descriptor) [pid 633] close(12) = -1 EBADF (Bad file descriptor) [pid 633] close(13) = -1 EBADF (Bad file descriptor) [pid 633] close(14) = -1 EBADF (Bad file descriptor) [pid 633] close(15) = -1 EBADF (Bad file descriptor) [pid 633] close(16) = -1 EBADF (Bad file descriptor) [pid 633] close(17) = -1 EBADF (Bad file descriptor) [pid 633] close(18) = -1 EBADF (Bad file descriptor) [pid 633] close(19) = -1 EBADF (Bad file descriptor) [pid 633] close(20) = -1 EBADF (Bad file descriptor) [pid 633] close(21) = -1 EBADF (Bad file descriptor) [pid 633] close(22) = -1 EBADF (Bad file descriptor) [pid 633] close(23) = -1 EBADF (Bad file descriptor) [pid 633] close(24) = -1 EBADF (Bad file descriptor) [pid 633] close(25) = -1 EBADF (Bad file descriptor) [pid 633] close(26) = -1 EBADF (Bad file descriptor) [pid 633] close(27) = -1 EBADF (Bad file descriptor) [pid 633] close(28) = -1 EBADF (Bad file descriptor) [pid 633] close(29) = -1 EBADF (Bad file descriptor) [pid 633] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory ) = 89 [ 144.327037][ T382] namespace_unlock+0x448/0x4f0 [ 144.331854][ T633] ? mutex_trylock+0xb0/0xb0 [ 144.331864][ T633] ? __kasan_check_write+0x14/0x20 [ 144.331881][ T633] kernfs_fop_write_iter+0x2d0/0x410 [ 144.339827][ T382] ? umount_tree+0xf50/0xf50 [ 144.344380][ T633] ? cgroup_seqfile_stop+0xc0/0xc0 [ 144.344391][ T633] vfs_write+0xc1c/0xf40 [ 144.344399][ T633] ? __kasan_check_write+0x14/0x20 [ 144.344408][ T633] ? kernel_write+0x3c0/0x3c0 [ 144.344424][ T633] ? _raw_spin_unlock_irq+0x4e/0x70 [ 144.352381][ T382] ? __detach_mounts+0x670/0x670 [pid 633] exit_group(0) = ? [pid 633] +++ exited with 0 +++ [pid 375] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=46, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [ 144.357796][ T633] ? ptrace_stop+0x6ff/0x9f0 [ 144.365746][ T382] ? selinux_umount+0xf0/0x130 [ 144.370810][ T633] ? __kasan_check_read+0x11/0x20 [ 144.370826][ T633] ? __fdget_pos+0x27e/0x310 [ 144.374085][ T382] ? security_sb_umount+0x9d/0xb0 [ 144.379337][ T633] ksys_write+0x198/0x2c0 [ 144.383900][ T382] path_umount+0xf03/0xfb0 [ 144.389840][ T633] ? do_notify_parent+0xa60/0xa60 [ 144.394316][ T382] ? namespace_unlock+0x4f0/0x4f0 [ 144.400248][ T633] ? __ia32_sys_read+0x90/0x90 [ 144.400257][ T633] ? __ia32_sys_open+0x270/0x270 [ 144.400265][ T633] __x64_sys_write+0x7b/0x90 [ 144.400282][ T633] do_syscall_64+0x34/0x70 [ 144.405363][ T382] ? user_path_at_empty+0x40/0x50 [ 144.410519][ T633] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 144.410528][ T633] RIP: 0033:0x7fc8ece62c09 [ 144.410544][ T633] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 144.415451][ T382] __x64_sys_umount+0x122/0x170 [ 144.421421][ T633] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 144.421434][ T633] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 144.421447][ T633] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 144.426538][ T382] ? path_umount+0xfb0/0xfb0 [ 144.431433][ T633] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 144.431440][ T633] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 144.431454][ T633] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 000000000000002c [ 144.436544][ T382] ? syscall_enter_from_user_mode+0x58/0x1b0 [ 144.654526][ T382] do_syscall_64+0x34/0x70 [ 144.658930][ T382] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 144.664825][ T382] RIP: 0033:0x7fc8ece63fb7 [ 144.669231][ T382] Code: 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 375] umount2("./44", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 144.688937][ T382] RSP: 002b:00007ffd7d0e2358 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [ 144.697359][ T382] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc8ece63fb7 [ 144.705374][ T382] RDX: 00007ffd7d0e241a RSI: 000000000000000a RDI: 00007ffd7d0e2410 [ 144.713346][ T382] RBP: 00007ffd7d0e2410 R08: 00000000ffffffff R09: 00007ffd7d0e21f0 [ 144.721310][ T382] R10: 0000555556fad6a3 R11: 0000000000000202 R12: 00007ffd7d0e3490 [ 144.729265][ T382] R13: 0000555556fad600 R14: 00007ffd7d0e2380 R15: 000000000000002d [ 144.737250][ T382] ---[ end trace d4de1ca9cdcd198f ]--- [ 144.743290][ T382] ------------[ cut here ]------------ [ 144.748769][ T382] WARNING: CPU: 0 PID: 382 at fs/namespace.c:1168 mntput_no_expire+0x48a/0x6c0 [ 144.758228][ T382] Modules linked in: [ 144.762150][ T382] CPU: 0 PID: 382 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 144.773761][ T382] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 144.783828][ T382] RIP: 0010:mntput_no_expire+0x48a/0x6c0 [ 144.789446][ T382] Code: 48 c7 c2 80 02 44 86 e8 64 f0 8e ff e9 8b fc ff ff e8 ba 21 b6 ff e9 81 fc ff ff e8 b0 21 b6 ff e9 77 fc ff ff e8 a6 21 b6 ff <0f> 0b e9 f4 fc ff ff e8 9a 21 b6 ff e8 65 ad a2 ff e9 ea fc ff ff [ 144.809053][ T382] RSP: 0018:ffffc90000b77ca0 EFLAGS: 00010293 [ 144.815148][ T382] RAX: ffffffff81b68f1a RBX: 00000000fffffffe RCX: ffff8881065e4f00 [ 144.823113][ T382] RDX: 0000000000000000 RSI: 00000000fffffffe RDI: 0000000000000000 [ 144.831080][ T382] RBP: ffffc90000b77d70 R08: ffffffff81b68c08 R09: 0000000000000003 [ 144.839035][ T382] R10: fffff5200016ef85 R11: 1ffff9200016ef84 R12: dffffc0000000000 [ 144.847011][ T382] R13: ffff8881192dd880 R14: ffffc90000b77d00 R15: 1ffff9200016ef9c [ 144.854989][ T382] FS: 0000555556fab300(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 144.863923][ T382] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 144.870517][ T382] CR2: 00007ffd7d0e1c18 CR3: 000000011dd7e000 CR4: 00000000003506b0 [ 144.878473][ T382] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 144.886440][ T382] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 144.894400][ T382] Call Trace: [ 144.897670][ T382] ? lockref_get_or_lock+0x340/0x340 [ 144.902958][ T382] ? umount_tree+0xf50/0xf50 [ 144.907532][ T382] ? vfs_submount+0xb0/0xb0 [ 144.912052][ T382] ? dput+0x2b6/0x320 [ 144.916029][ T382] path_umount+0x1fe/0xfb0 [ 144.920461][ T382] ? namespace_unlock+0x4f0/0x4f0 [ 144.925474][ T382] ? user_path_at_empty+0x40/0x50 [ 144.930507][ T382] __x64_sys_umount+0x122/0x170 [ 144.935342][ T382] ? path_umount+0xfb0/0xfb0 [ 144.939917][ T382] ? syscall_enter_from_user_mode+0x58/0x1b0 [ 144.945916][ T382] do_syscall_64+0x34/0x70 [ 144.950345][ T382] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 144.956223][ T382] RIP: 0033:0x7fc8ece63fb7 [ 144.960657][ T382] Code: 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 144.980270][ T382] RSP: 002b:00007ffd7d0e2358 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [ 144.988682][ T382] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc8ece63fb7 [pid 375] openat(AT_FDCWD, "./44", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 382] <... umount2 resumed>) = 0 [pid 375] <... openat resumed>) = 3 [pid 375] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 375] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 375] umount2("./44/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./44/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 375] unlink("./44/binderfs") = 0 [pid 375] umount2("./44/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./44/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 375] unlink("./44/cgroup") = 0 [pid 375] umount2("./44/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./44/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 375] unlink("./44/cgroup.net") = 0 [ 144.996655][ T382] RDX: 00007ffd7d0e241a RSI: 000000000000000a RDI: 00007ffd7d0e2410 [ 145.004633][ T382] RBP: 00007ffd7d0e2410 R08: 00000000ffffffff R09: 00007ffd7d0e21f0 [ 145.012618][ T382] R10: 0000555556fad6a3 R11: 0000000000000202 R12: 00007ffd7d0e3490 [ 145.020594][ T382] R13: 0000555556fad600 R14: 00007ffd7d0e2380 R15: 000000000000002d [ 145.028551][ T382] ---[ end trace d4de1ca9cdcd1990 ]--- [ 145.036263][ T375] ------------[ cut here ]------------ [pid 375] umount2("./44/file0", MNT_DETACH|UMOUNT_NOFOLLOW [ 145.041768][ T375] WARNING: CPU: 0 PID: 375 at fs/namespace.c:1168 mntput_no_expire+0x48a/0x6c0 [ 145.050520][ T635] FAULT_INJECTION: forcing a failure. [ 145.050520][ T635] name failslab, interval 1, probability 0, space 0, times 0 [ 145.050697][ T375] Modules linked in: [ 145.067119][ T375] CPU: 0 PID: 375 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 145.078753][ T375] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 145.080499][ T635] CPU: 1 PID: 635 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 145.088817][ T375] RIP: 0010:mntput_no_expire+0x48a/0x6c0 [ 145.100382][ T635] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 145.100386][ T635] Call Trace: [ 145.100401][ T635] dump_stack_lvl+0x1e2/0x24b [ 145.100409][ T635] ? panic+0x7d7/0x7d7 [ 145.100418][ T635] ? bfq_pos_tree_add_move+0x43e/0x43e [ 145.100427][ T635] ? find_next_bit+0xd6/0x120 [ 145.100444][ T635] ? cpumask_next+0x11/0x30 [ 145.106043][ T375] Code: 48 c7 c2 80 02 44 86 e8 64 f0 8e ff e9 8b fc ff ff e8 ba 21 b6 ff e9 81 fc ff ff e8 b0 21 b6 ff e9 77 fc ff ff e8 a6 21 b6 ff <0f> 0b e9 f4 fc ff ff e8 9a 21 b6 ff e8 65 ad a2 ff e9 ea fc ff ff [ 145.116075][ T635] dump_stack+0x15/0x17 [ 145.116084][ T635] should_fail+0x3c0/0x510 [ 145.116099][ T635] ? percpu_ref_init+0xd0/0x330 [ 145.119356][ T375] RSP: 0018:ffffc9000095fba0 EFLAGS: 00010293 [ 145.123995][ T635] __should_failslab+0x9f/0xe0 [ 145.124012][ T635] should_failslab+0x9/0x20 [ 145.128052][ T375] [ 145.133474][ T635] kmem_cache_alloc_trace+0x3a/0x330 [ 145.133485][ T635] percpu_ref_init+0xd0/0x330 [ 145.133494][ T635] ? cgroup_setup_root+0xea0/0xea0 [ 145.133511][ T635] cgroup_apply_control_enable+0x3a2/0x12f0 [ 145.138155][ T375] RAX: ffffffff81b68f1a RBX: 00000000fffffffe RCX: ffff8881065e13c0 [ 145.142623][ T635] cgroup_apply_control+0x93/0x710 [ 145.142639][ T635] ? css_next_child+0x160/0x160 [ 145.162218][ T375] RDX: 0000000000000000 RSI: 00000000fffffffe RDI: 0000000000000000 [ 145.166336][ T635] ? stack_trace_save+0x12d/0x1f0 [ 145.170724][ T375] RBP: ffffc9000095fc70 R08: ffffffff81b68c08 R09: 0000000000000003 [ 145.175537][ T635] ? io_schedule+0x120/0x120 [ 145.181576][ T375] R10: fffff5200012bf65 R11: 1ffff9200012bf64 R12: dffffc0000000000 [ 145.186304][ T635] ? kernfs_fop_write_iter+0x15e/0x410 [ 145.190790][ T375] R13: ffff8881192dc700 R14: ffffc9000095fc00 R15: 1ffff9200012bf7c [ 145.193075][ T635] ? __kasan_check_write+0x14/0x20 [ 145.198329][ T375] FS: 0000555556fab300(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 145.202965][ T635] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 145.202982][ T635] cgroup_subtree_control_write+0xd19/0x1310 [ 145.208063][ T375] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 145.213918][ T635] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 145.213935][ T635] ? __kasan_check_write+0x14/0x20 [ 145.221882][ T375] CR2: 00007ffd7d0e1c18 CR3: 000000011dd54000 CR4: 00000000003506b0 [ 145.226960][ T635] ? _copy_from_iter+0x3fb/0xd60 [ 145.231782][ T375] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 145.239720][ T635] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 145.244714][ T375] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 145.252647][ T635] cgroup_file_write+0x28e/0x590 [ 145.252658][ T635] ? cgroup_seqfile_stop+0xc0/0xc0 [ 145.252669][ T635] ? mutex_lock+0xa6/0x110 [ 145.252678][ T635] ? mutex_trylock+0xb0/0xb0 [ 145.252688][ T635] ? __kasan_check_write+0x14/0x20 [ 145.252698][ T635] kernfs_fop_write_iter+0x2d0/0x410 [ 145.252705][ T635] ? cgroup_seqfile_stop+0xc0/0xc0 [ 145.252722][ T635] vfs_write+0xc1c/0xf40 [ 145.257363][ T375] Call Trace: [ 145.265306][ T635] ? __kasan_check_write+0x14/0x20 [ 145.265324][ T635] ? kernel_write+0x3c0/0x3c0 [ 145.270761][ T375] ? io_schedule+0x120/0x120 [ 145.278695][ T635] ? _raw_spin_unlock_irq+0x4e/0x70 [ 145.283783][ T375] ? vfs_submount+0xb0/0xb0 [ 145.292667][ T635] ? ptrace_stop+0x6ff/0x9f0 [ 145.292685][ T635] ? __kasan_check_read+0x11/0x20 [ 145.297940][ T375] ? shrink_dentry_list+0x4ec/0x500 [ 145.303876][ T635] ? __fdget_pos+0x27e/0x310 [ 145.303886][ T635] ksys_write+0x198/0x2c0 [ 145.303902][ T635] ? do_notify_parent+0xa60/0xa60 [ 145.310476][ T375] ? __kasan_check_write+0x14/0x20 [ 145.316402][ T635] ? __ia32_sys_read+0x90/0x90 [ 145.321486][ T375] namespace_unlock+0x448/0x4f0 [ 145.329419][ T635] ? __ia32_sys_open+0x270/0x270 [ 145.334334][ T375] ? umount_tree+0xf50/0xf50 [ 145.342264][ T635] __x64_sys_write+0x7b/0x90 [ 145.342281][ T635] do_syscall_64+0x34/0x70 [ 145.348226][ T375] ? __detach_mounts+0x670/0x670 [ 145.356161][ T635] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 145.356176][ T635] RIP: 0033:0x7fc8ece62c09 [ 145.361088][ T375] ? selinux_umount+0xf0/0x130 [ 145.366159][ T635] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 145.370560][ T375] ? security_sb_umount+0x9d/0xb0 [ 145.375104][ T635] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 [ 145.380198][ T375] path_umount+0xf03/0xfb0 [ 145.385440][ T635] ORIG_RAX: 0000000000000001 [ 145.390536][ T375] ? namespace_unlock+0x4f0/0x4f0 [ 145.394734][ T635] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 145.397996][ T375] ? user_path_at_empty+0x40/0x50 [ 145.403061][ T635] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 145.403068][ T635] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 145.403081][ T635] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 145.407728][ T375] __x64_sys_umount+0x122/0x170 [ 145.412275][ T635] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 000000000000002a [ 145.597947][ T375] ? path_umount+0xfb0/0xfb0 [ 145.602806][ T375] ? syscall_enter_from_user_mode+0x58/0x1b0 [ 145.608779][ T375] do_syscall_64+0x34/0x70 [ 145.613213][ T375] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 145.619085][ T375] RIP: 0033:0x7fc8ece63fb7 [ 145.623506][ T375] Code: 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 382] umount2("./44/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 635] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [ 145.643123][ T375] RSP: 002b:00007ffd7d0e2358 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [ 145.651541][ T375] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc8ece63fb7 [ 145.659498][ T375] RDX: 00007ffd7d0e241a RSI: 000000000000000a RDI: 00007ffd7d0e2410 [ 145.667476][ T375] RBP: 00007ffd7d0e2410 R08: 00000000ffffffff R09: 00007ffd7d0e21f0 [ 145.675460][ T375] R10: 0000555556fad6a3 R11: 0000000000000202 R12: 00007ffd7d0e3490 [ 145.683440][ T375] R13: 0000555556fad600 R14: 00007ffd7d0e2380 R15: 000000000000002d [ 145.691420][ T375] ---[ end trace d4de1ca9cdcd1991 ]--- [ 145.697071][ T375] ------------[ cut here ]------------ [ 145.702585][ T375] WARNING: CPU: 0 PID: 375 at fs/namespace.c:1168 mntput_no_expire+0x48a/0x6c0 [ 145.711531][ T375] Modules linked in: [ 145.715411][ T375] CPU: 0 PID: 375 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 145.727041][ T375] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 145.737107][ T375] RIP: 0010:mntput_no_expire+0x48a/0x6c0 [ 145.742733][ T375] Code: 48 c7 c2 80 02 44 86 e8 64 f0 8e ff e9 8b fc ff ff e8 ba 21 b6 ff e9 81 fc ff ff e8 b0 21 b6 ff e9 77 fc ff ff e8 a6 21 b6 ff <0f> 0b e9 f4 fc ff ff e8 9a 21 b6 ff e8 65 ad a2 ff e9 ea fc ff ff [ 145.762336][ T375] RSP: 0018:ffffc9000095fca0 EFLAGS: 00010293 [ 145.768386][ T375] RAX: ffffffff81b68f1a RBX: 00000000fffffffd RCX: ffff8881065e13c0 [ 145.776364][ T375] RDX: 0000000000000000 RSI: 00000000fffffffd RDI: 0000000000000000 [ 145.784324][ T375] RBP: ffffc9000095fd70 R08: ffffffff81b68c08 R09: 0000000000000003 [ 145.792304][ T375] R10: fffff5200012bf85 R11: 1ffff9200012bf84 R12: dffffc0000000000 [ 145.800270][ T375] R13: ffff8881192dc700 R14: ffffc9000095fd00 R15: 1ffff9200012bf9c [ 145.808232][ T375] FS: 0000555556fab300(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 145.817165][ T375] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 145.823755][ T375] CR2: 00007ffd7d0e1c18 CR3: 000000011dd54000 CR4: 00000000003506b0 [ 145.831725][ T375] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 145.839675][ T375] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 145.847632][ T375] Call Trace: [ 145.850944][ T375] ? lockref_get_or_lock+0x340/0x340 [ 145.856213][ T375] ? umount_tree+0xf50/0xf50 [ 145.860804][ T375] ? vfs_submount+0xb0/0xb0 [ 145.865291][ T375] ? dput+0x2b6/0x320 [ 145.869250][ T375] path_umount+0x1fe/0xfb0 [ 145.873754][ T375] ? namespace_unlock+0x4f0/0x4f0 [ 145.878765][ T375] ? user_path_at_empty+0x40/0x50 [ 145.883785][ T375] __x64_sys_umount+0x122/0x170 [ 145.888612][ T375] ? path_umount+0xfb0/0xfb0 [ 145.893193][ T375] ? syscall_enter_from_user_mode+0x58/0x1b0 [ 145.899150][ T375] do_syscall_64+0x34/0x70 [ 145.903556][ T375] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 145.909423][ T375] RIP: 0033:0x7fc8ece63fb7 [ 145.913840][ T375] Code: 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 145.933432][ T375] RSP: 002b:00007ffd7d0e2358 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [ 145.941838][ T375] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc8ece63fb7 [pid 382] lstat("./44/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 635] close(3 [pid 375] <... umount2 resumed>) = 0 [pid 635] <... close resumed>) = 0 [pid 382] umount2("./44/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 635] close(4 [pid 375] umount2("./44/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 635] <... close resumed>) = 0 [pid 382] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 635] close(5 [pid 382] openat(AT_FDCWD, "./44/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 375] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 635] <... close resumed>) = 0 [pid 382] <... openat resumed>) = 4 [pid 635] close(6 [pid 375] lstat("./44/file0", [pid 382] fstat(4, [pid 635] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 382] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 635] close(7 [pid 375] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 635] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 382] getdents64(4, [pid 635] close(8 [pid 375] umount2("./44/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 635] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 382] <... getdents64 resumed>0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 375] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 635] close(9 [pid 382] getdents64(4, [pid 635] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 382] <... getdents64 resumed>0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 635] close(10 [pid 382] close(4 [pid 635] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 382] <... close resumed>) = 0 [pid 635] close(11 [pid 382] rmdir("./44/file0" [pid 635] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 382] <... rmdir resumed>) = 0 [pid 635] close(12 [pid 382] umount2("./44/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 635] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 382] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 635] close(13 [pid 382] lstat("./44/cgroup.cpu", [pid 635] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 382] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 635] close(14 [pid 382] unlink("./44/cgroup.cpu" [pid 635] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 382] <... unlink resumed>) = 0 [pid 635] close(15 [pid 382] getdents64(3, [pid 635] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 382] <... getdents64 resumed>0x555556fad630 /* 0 entries */, 32768) = 0 [pid 635] close(16 [pid 382] close(3 [pid 635] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 382] <... close resumed>) = 0 [pid 635] close(17 [pid 382] rmdir("./44" [pid 635] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 382] <... rmdir resumed>) = 0 [pid 375] openat(AT_FDCWD, "./44/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 635] close(18 [pid 382] mkdir("./45", 0777 [pid 635] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 635] close(19 [pid 382] <... mkdir resumed>) = 0 [pid 375] <... openat resumed>) = 4 [pid 635] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 382] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 375] fstat(4, [pid 635] close(20./strace-static-x86_64: Process 637 attached ) = -1 EBADF (Bad file descriptor) [pid 375] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 635] close(21 [pid 382] <... clone resumed>, child_tidptr=0x555556fab5d0) = 47 [pid 375] getdents64(4, [pid 637] chdir("./45" [pid 635] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 635] close(22 [pid 637] <... chdir resumed>) = 0 [pid 635] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 635] close(23) = -1 EBADF (Bad file descriptor) [pid 635] close(24) = -1 EBADF (Bad file descriptor) [pid 637] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 635] close(25) = -1 EBADF (Bad file descriptor) [pid 635] close(26) = -1 EBADF (Bad file descriptor) [pid 635] close(27) = -1 EBADF (Bad file descriptor) [pid 635] close(28) = -1 EBADF (Bad file descriptor) [pid 635] close(29) = -1 EBADF (Bad file descriptor) write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory [pid 635] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 635] exit_group(0) = ? [pid 637] <... prctl resumed>) = 0 [pid 635] +++ exited with 0 +++ [pid 637] setpgid(0, 0 [pid 381] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=44, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 381] restart_syscall(<... resuming interrupted clone ...> [pid 375] <... getdents64 resumed>0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 375] getdents64(4, [pid 381] <... restart_syscall resumed>) = 0 [pid 637] <... setpgid resumed>) = 0 [pid 381] umount2("./42", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] openat(AT_FDCWD, "./42", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 381] fstat(3, [pid 637] symlink("/syzcgroup/unified/syz5", "./cgroup" [pid 381] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 381] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 637] <... symlink resumed>) = 0 [pid 381] umount2("./42/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 637] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu" [pid 381] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 381] lstat("./42/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 381] unlink("./42/binderfs") = 0 [pid 381] umount2("./42/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW [pid 637] <... symlink resumed>) = 0 [pid 381] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 381] lstat("./42/cgroup", [pid 637] symlink("/syzcgroup/net/syz5", "./cgroup.net" [pid 381] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 381] unlink("./42/cgroup" [pid 637] <... symlink resumed>) = 0 [pid 381] <... unlink resumed>) = 0 [pid 637] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 381] umount2("./42/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./42/cgroup.net", [pid 637] <... openat resumed>) = 3 [pid 381] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 637] write(3, "1000", 4 [pid 381] unlink("./42/cgroup.net" [pid 637] <... write resumed>) = 4 [pid 381] <... unlink resumed>) = 0 [pid 381] umount2("./42/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 381] umount2("./42/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./42/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 381] umount2("./42/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 637] close(3 [pid 381] openat(AT_FDCWD, "./42/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 381] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 637] <... close resumed>) = 0 [pid 381] getdents64(4, [pid 637] symlink("/dev/binderfs", "./binderfs" [pid 381] <... getdents64 resumed>0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 381] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 381] close(4) = 0 [pid 375] <... getdents64 resumed>0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 637] <... symlink resumed>) = 0 [pid 381] rmdir("./42/file0") = 0 [pid 375] close(4 [pid 381] umount2("./42/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 637] mkdirat(AT_FDCWD, "./file0", 000 [pid 381] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 375] <... close resumed>) = 0 [pid 381] lstat("./42/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 375] rmdir("./44/file0" [pid 381] unlink("./42/cgroup.cpu" [pid 637] <... mkdirat resumed>) = 0 [pid 381] <... unlink resumed>) = 0 [pid 375] <... rmdir resumed>) = 0 [pid 381] getdents64(3, [pid 637] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 381] <... getdents64 resumed>0x555556fad630 /* 0 entries */, 32768) = 0 [pid 375] umount2("./44/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 381] close(3) = 0 [pid 375] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 637] <... mount resumed>) = 0 [pid 381] rmdir("./42" [pid 637] open("./file0", O_RDONLY [pid 381] <... rmdir resumed>) = 0 [pid 375] lstat("./44/cgroup.cpu", [pid 637] <... open resumed>) = 3 [pid 381] mkdir("./43", 0777 [pid 637] openat(3, "cgroup.subtree_control", O_RDWR [pid 381] <... mkdir resumed>) = 0 [pid 375] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 637] <... openat resumed>) = 4 [pid 636] <... write resumed>) = 6 [pid 634] <... write resumed>) = 6 [pid 632] <... write resumed>) = 6 [pid 381] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 638 attached [pid 637] write(4, "-pids ", 6 [pid 636] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 634] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 632] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 375] unlink("./44/cgroup.cpu" [pid 638] chdir("./43" [pid 636] <... openat resumed>) = 5 [pid 381] <... clone resumed>, child_tidptr=0x555556fab5d0) = 45 [pid 638] <... chdir resumed>) = 0 [pid 636] write(5, "22", 2 [pid 634] <... openat resumed>) = 5 [pid 632] <... openat resumed>) = 5 [pid 375] <... unlink resumed>) = 0 [pid 638] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 637] <... write resumed>) = 6 [pid 636] <... write resumed>) = 2 [pid 634] write(5, "22", 2 [pid 632] write(5, "22", 2 [pid 375] getdents64(3, [pid 638] <... prctl resumed>) = 0 [ 145.949790][ T375] RDX: 00007ffd7d0e241a RSI: 000000000000000a RDI: 00007ffd7d0e2410 [ 145.957757][ T375] RBP: 00007ffd7d0e2410 R08: 00000000ffffffff R09: 00007ffd7d0e21f0 [ 145.965731][ T375] R10: 0000555556fad6a3 R11: 0000000000000202 R12: 00007ffd7d0e3490 [ 145.973703][ T375] R13: 0000555556fad600 R14: 00007ffd7d0e2380 R15: 000000000000002d [ 145.981669][ T375] ---[ end trace d4de1ca9cdcd1992 ]--- [pid 636] write(4, "+pids ", 6 [pid 634] <... write resumed>) = 2 [pid 632] <... write resumed>) = 2 [pid 638] setpgid(0, 0 [pid 637] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 634] write(4, "+pids ", 6 [pid 632] write(4, "+pids ", 6 [pid 375] <... getdents64 resumed>0x555556fad630 /* 0 entries */, 32768) = 0 [pid 637] <... openat resumed>) = 5 [pid 637] write(5, "22", 2) = 2 [pid 637] write(4, "+pids ", 6 [pid 638] <... setpgid resumed>) = 0 [pid 638] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [pid 638] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 638] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 638] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 375] close(3 [pid 638] <... openat resumed>) = 3 [pid 638] write(3, "1000", 4) = 4 [pid 638] close(3) = 0 [pid 638] symlink("/dev/binderfs", "./binderfs") = 0 [pid 638] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 638] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 375] <... close resumed>) = 0 [pid 375] rmdir("./44") = 0 [pid 375] mkdir("./45", 0777) = 0 [pid 375] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556fab5d0) = 47 ./strace-static-x86_64: Process 639 attached [pid 639] chdir("./45") = 0 [pid 639] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 639] setpgid(0, 0) = 0 [pid 639] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 639] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 639] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 639] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 639] write(3, "1000", 4) = 4 [pid 639] close(3) = 0 [pid 639] symlink("/dev/binderfs", "./binderfs") = 0 [pid 639] mkdirat(AT_FDCWD, "./file0", 000) = 0 [ 146.002634][ T636] FAULT_INJECTION: forcing a failure. [ 146.002634][ T636] name failslab, interval 1, probability 0, space 0, times 0 [ 146.015452][ T636] CPU: 0 PID: 636 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 146.027064][ T636] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 146.037107][ T636] Call Trace: [ 146.040388][ T636] dump_stack_lvl+0x1e2/0x24b [ 146.045054][ T636] ? panic+0x7d7/0x7d7 [ 146.049108][ T636] ? bfq_pos_tree_add_move+0x43e/0x43e [ 146.054550][ T636] ? find_next_bit+0xd6/0x120 [ 146.059206][ T636] ? cpumask_next+0x11/0x30 [ 146.063699][ T636] dump_stack+0x15/0x17 [ 146.067845][ T636] should_fail+0x3c0/0x510 [ 146.072256][ T636] ? percpu_ref_init+0xd0/0x330 [ 146.077090][ T636] __should_failslab+0x9f/0xe0 [ 146.081823][ T636] should_failslab+0x9/0x20 [ 146.086299][ T636] kmem_cache_alloc_trace+0x3a/0x330 [ 146.091553][ T636] percpu_ref_init+0xd0/0x330 [ 146.096201][ T636] ? cgroup_setup_root+0xea0/0xea0 [ 146.101293][ T636] cgroup_apply_control_enable+0x3a2/0x12f0 [ 146.107166][ T636] cgroup_apply_control+0x93/0x710 [ 146.112247][ T636] ? css_next_child+0x160/0x160 [ 146.117082][ T636] ? io_schedule+0x120/0x120 [ 146.121656][ T636] ? kernfs_fop_write_iter+0x15e/0x410 [ 146.127094][ T636] ? __kasan_check_write+0x14/0x20 [ 146.132186][ T636] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 146.137440][ T636] cgroup_subtree_control_write+0xd19/0x1310 [ 146.143390][ T636] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 146.149338][ T636] ? __kasan_check_write+0x14/0x20 [ 146.154430][ T636] ? _copy_from_iter+0x3fb/0xd60 [ 146.159349][ T636] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 146.165300][ T636] cgroup_file_write+0x28e/0x590 [ 146.170215][ T636] ? cgroup_seqfile_stop+0xc0/0xc0 [ 146.175310][ T636] ? mutex_lock+0xa6/0x110 [ 146.179695][ T636] ? mutex_trylock+0xb0/0xb0 [ 146.184256][ T636] ? __kasan_check_write+0x14/0x20 [ 146.189337][ T636] kernfs_fop_write_iter+0x2d0/0x410 [ 146.194600][ T636] ? cgroup_seqfile_stop+0xc0/0xc0 [ 146.199692][ T636] vfs_write+0xc1c/0xf40 [ 146.203908][ T636] ? __kasan_check_write+0x14/0x20 [ 146.209004][ T636] ? kernel_write+0x3c0/0x3c0 [ 146.213659][ T636] ? _raw_spin_unlock_irq+0x4e/0x70 [ 146.218836][ T636] ? ptrace_stop+0x6ff/0x9f0 [ 146.223414][ T636] ? __kasan_check_read+0x11/0x20 [ 146.228418][ T636] ? __fdget_pos+0x27e/0x310 [ 146.232983][ T636] ksys_write+0x198/0x2c0 [ 146.237284][ T636] ? do_notify_parent+0xa60/0xa60 [ 146.242284][ T636] ? __ia32_sys_read+0x90/0x90 [ 146.247022][ T636] ? __ia32_sys_open+0x270/0x270 [ 146.251940][ T636] __x64_sys_write+0x7b/0x90 [ 146.256511][ T636] do_syscall_64+0x34/0x70 [ 146.260897][ T636] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 146.266761][ T636] RIP: 0033:0x7fc8ece62c09 [ 146.271154][ T636] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 146.290736][ T636] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 639] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 636] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 638] <... mount resumed>) = 0 [pid 636] close(3) = 0 [pid 636] close(4) = 0 [pid 636] close(5) = 0 [pid 636] close(6) = -1 EBADF (Bad file descriptor) [pid 636] close(7) = -1 EBADF (Bad file descriptor) [pid 636] close(8) = -1 EBADF (Bad file descriptor) [pid 636] close(9) = -1 EBADF (Bad file descriptor) [pid 636] close(10) = -1 EBADF (Bad file descriptor) [pid 636] close(11) = -1 EBADF (Bad file descriptor) [pid 636] close(12) = -1 EBADF (Bad file descriptor) [pid 636] close(13) = -1 EBADF (Bad file descriptor) [pid 636] close(14) = -1 EBADF (Bad file descriptor) [pid 636] close(15) = -1 EBADF (Bad file descriptor) [pid 636] close(16) = -1 EBADF (Bad file descriptor) [pid 636] close(17) = -1 EBADF (Bad file descriptor) [pid 636] close(18) = -1 EBADF (Bad file descriptor) [pid 636] close(19) = -1 EBADF (Bad file descriptor) [pid 639] <... mount resumed>) = 0 [pid 638] open("./file0", O_RDONLY [pid 636] close(20) = -1 EBADF (Bad file descriptor) [pid 636] close(21) = -1 EBADF (Bad file descriptor) [pid 636] close(22) = -1 EBADF (Bad file descriptor) [pid 636] close(23) = -1 EBADF (Bad file descriptor) [pid 636] close(24) = -1 EBADF (Bad file descriptor) [pid 636] close(25) = -1 EBADF (Bad file descriptor) [pid 636] close(26) = -1 EBADF (Bad file descriptor) [pid 636] close(27) = -1 EBADF (Bad file descriptor) [pid 636] close(28) = -1 EBADF (Bad file descriptor) [pid 636] close(29) = -1 EBADF (Bad file descriptor) write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory [pid 636] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 636] exit_group(0) = ? [pid 639] open("./file0", O_RDONLY [pid 638] <... open resumed>) = 3 [pid 636] +++ exited with 0 +++ [pid 639] <... open resumed>) = 3 [pid 638] openat(3, "cgroup.subtree_control", O_RDWR [pid 383] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=37, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 383] umount2("./35", MNT_DETACH|UMOUNT_NOFOLLOW [pid 639] openat(3, "cgroup.subtree_control", O_RDWR [pid 383] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 638] <... openat resumed>) = 4 [pid 639] <... openat resumed>) = 4 [pid 383] openat(AT_FDCWD, "./35", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 638] write(4, "-pids ", 6 [pid 383] <... openat resumed>) = 3 [pid 383] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 383] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 383] umount2("./35/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 639] write(4, "-pids ", 6 [pid 383] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 383] lstat("./35/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 383] unlink("./35/binderfs") = 0 [pid 383] umount2("./35/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./35/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 383] unlink("./35/cgroup") = 0 [pid 383] umount2("./35/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./35/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 383] unlink("./35/cgroup.net") = 0 [pid 383] umount2("./35/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 383] umount2("./35/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./35/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 383] umount2("./35/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] openat(AT_FDCWD, "./35/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 383] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 383] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 383] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 383] close(4) = 0 [pid 383] rmdir("./35/file0") = 0 [pid 383] umount2("./35/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./35/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 383] unlink("./35/cgroup.cpu") = 0 [pid 383] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 383] close(3) = 0 [pid 383] rmdir("./35") = 0 [pid 383] mkdir("./36", 0777) = 0 [pid 383] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 640 attached , child_tidptr=0x555556fab5d0) = 38 [pid 640] chdir("./36") = 0 [pid 640] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 640] setpgid(0, 0) = 0 [pid 640] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 640] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 640] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [pid 640] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 640] write(3, "1000", 4) = 4 [pid 640] close(3) = 0 [pid 640] symlink("/dev/binderfs", "./binderfs") = 0 [pid 640] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 640] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 640] open("./file0", O_RDONLY) = 3 [pid 640] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [ 146.299123][ T636] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 146.307069][ T636] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 146.315024][ T636] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 146.322985][ T636] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 146.330931][ T636] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000023 [pid 640] write(4, "-pids ", 6 [pid 639] <... write resumed>) = 6 [pid 639] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 639] write(5, "22", 2) = 2 [ 146.370619][ T634] FAULT_INJECTION: forcing a failure. [ 146.370619][ T634] name failslab, interval 1, probability 0, space 0, times 0 [ 146.383513][ T634] CPU: 0 PID: 634 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 146.395128][ T634] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 146.405170][ T634] Call Trace: [ 146.408448][ T634] dump_stack_lvl+0x1e2/0x24b [ 146.413098][ T634] ? panic+0x7d7/0x7d7 [ 146.417136][ T634] ? bfq_pos_tree_add_move+0x43e/0x43e [ 146.422562][ T634] ? find_next_bit+0xd6/0x120 [ 146.427212][ T634] ? cpumask_next+0x11/0x30 [ 146.431687][ T634] dump_stack+0x15/0x17 [ 146.435817][ T634] should_fail+0x3c0/0x510 [ 146.440205][ T634] ? percpu_ref_init+0xd0/0x330 [ 146.445025][ T634] __should_failslab+0x9f/0xe0 [ 146.449759][ T634] should_failslab+0x9/0x20 [ 146.454238][ T634] kmem_cache_alloc_trace+0x3a/0x330 [ 146.459493][ T634] percpu_ref_init+0xd0/0x330 [ 146.464145][ T634] ? cgroup_setup_root+0xea0/0xea0 [ 146.469236][ T634] cgroup_apply_control_enable+0x3a2/0x12f0 [ 146.475103][ T634] cgroup_apply_control+0x93/0x710 [ 146.480194][ T634] ? css_next_child+0x160/0x160 [ 146.485026][ T634] ? stack_trace_save+0x12d/0x1f0 [ 146.490031][ T634] ? io_schedule+0x120/0x120 [ 146.494607][ T634] ? kernfs_fop_write_iter+0x15e/0x410 [ 146.500045][ T634] ? __kasan_check_write+0x14/0x20 [ 146.505145][ T634] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 146.510405][ T634] cgroup_subtree_control_write+0xd19/0x1310 [ 146.516360][ T634] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 146.522324][ T634] ? __kasan_check_write+0x14/0x20 [ 146.527421][ T634] ? _copy_from_iter+0x3fb/0xd60 [ 146.532337][ T634] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 146.538295][ T634] cgroup_file_write+0x28e/0x590 [ 146.543204][ T634] ? cgroup_seqfile_stop+0xc0/0xc0 [ 146.548284][ T634] ? mutex_lock+0xa6/0x110 [ 146.552671][ T634] ? mutex_trylock+0xb0/0xb0 [ 146.557233][ T634] ? __kasan_check_write+0x14/0x20 [ 146.562314][ T634] kernfs_fop_write_iter+0x2d0/0x410 [ 146.567576][ T634] ? cgroup_seqfile_stop+0xc0/0xc0 [ 146.572667][ T634] vfs_write+0xc1c/0xf40 [ 146.576883][ T634] ? __kasan_check_write+0x14/0x20 [ 146.581968][ T634] ? kernel_write+0x3c0/0x3c0 [ 146.586618][ T634] ? _raw_spin_unlock_irq+0x4e/0x70 [ 146.591788][ T634] ? ptrace_stop+0x6ff/0x9f0 [ 146.596350][ T634] ? __kasan_check_read+0x11/0x20 [ 146.601355][ T634] ? __fdget_pos+0x27e/0x310 [ 146.605928][ T634] ksys_write+0x198/0x2c0 [ 146.610229][ T634] ? do_notify_parent+0xa60/0xa60 [ 146.615232][ T634] ? __ia32_sys_read+0x90/0x90 [ 146.619976][ T634] ? __ia32_sys_open+0x270/0x270 [ 146.624979][ T634] __x64_sys_write+0x7b/0x90 [ 146.629551][ T634] do_syscall_64+0x34/0x70 [ 146.633939][ T634] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 146.639808][ T634] RIP: 0033:0x7fc8ece62c09 [ 146.644194][ T634] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 146.663857][ T634] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 639] write(4, "+pids ", 6 [pid 634] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 634] close(3) = 0 [pid 634] close(4) = 0 [pid 634] close(5) = 0 [pid 634] close(6) = -1 EBADF (Bad file descriptor) [pid 634] close(7) = -1 EBADF (Bad file descriptor) [pid 634] close(8) = -1 EBADF (Bad file descriptor) [pid 634] close(9) = -1 EBADF (Bad file descriptor) [pid 634] close(10) = -1 EBADF (Bad file descriptor) [pid 634] close(11) = -1 EBADF (Bad file descriptor) [pid 634] close(12) = -1 EBADF (Bad file descriptor) [pid 634] close(13) = -1 EBADF (Bad file descriptor) [pid 634] close(14) = -1 EBADF (Bad file descriptor) [pid 634] close(15) = -1 EBADF (Bad file descriptor) [pid 634] close(16) = -1 EBADF (Bad file descriptor) [pid 634] close(17) = -1 EBADF (Bad file descriptor) [pid 634] close(18) = -1 EBADF (Bad file descriptor) [pid 634] close(19) = -1 EBADF (Bad file descriptor) [pid 634] close(20) = -1 EBADF (Bad file descriptor) [pid 634] close(21) = -1 EBADF (Bad file descriptor) [pid 634] close(22) = -1 EBADF (Bad file descriptor) [pid 634] close(23) = -1 EBADF (Bad file descriptor) [pid 634] close(24) = -1 EBADF (Bad file descriptor) [pid 634] close(25) = -1 EBADF (Bad file descriptor) [pid 634] close(26) = -1 EBADF (Bad file descriptor) [pid 634] close(27) = -1 EBADF (Bad file descriptor) [pid 634] close(28) = -1 EBADF (Bad file descriptor) [pid 634] close(29) = -1 EBADF (Bad file descriptor) [pid 634] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory ) = 89 [pid 634] exit_group(0) = ? [pid 634] +++ exited with 0 +++ [pid 380] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=41, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 380] umount2("./39", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] openat(AT_FDCWD, "./39", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 380] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 380] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 380] umount2("./39/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 146.672240][ T634] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 146.680187][ T634] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 146.688142][ T634] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 146.696096][ T634] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 146.704039][ T634] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000027 [pid 380] lstat("./39/binderfs", [pid 640] <... write resumed>) = 6 [pid 638] <... write resumed>) = 6 [pid 380] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 638] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 380] unlink("./39/binderfs" [pid 638] <... openat resumed>) = 5 [pid 380] <... unlink resumed>) = 0 [pid 638] write(5, "22", 2 [pid 380] umount2("./39/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW [pid 638] <... write resumed>) = 2 [pid 380] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 638] write(4, "+pids ", 6 [pid 380] lstat("./39/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 380] unlink("./39/cgroup") = 0 [pid 380] umount2("./39/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./39/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 640] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 380] unlink("./39/cgroup.net") = 0 [pid 380] umount2("./39/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 640] <... openat resumed>) = 5 [pid 640] write(5, "22", 2) = 2 [ 146.730434][ T637] FAULT_INJECTION: forcing a failure. [ 146.730434][ T637] name failslab, interval 1, probability 0, space 0, times 0 [ 146.743097][ T637] CPU: 1 PID: 637 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 146.754705][ T637] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 146.764735][ T637] Call Trace: [ 146.768002][ T637] dump_stack_lvl+0x1e2/0x24b [ 146.772662][ T637] ? bfq_pos_tree_add_move+0x43e/0x43e [ 146.778114][ T637] ? selinux_kernfs_init_security+0x1a8/0x760 [ 146.784167][ T637] dump_stack+0x15/0x17 [ 146.788297][ T637] should_fail+0x3c0/0x510 [ 146.792686][ T637] ? __kernfs_new_node+0x99/0x6e0 [ 146.797696][ T637] __should_failslab+0x9f/0xe0 [ 146.802442][ T637] should_failslab+0x9/0x20 [ 146.806919][ T637] __kmalloc_track_caller+0x5f/0x350 [ 146.812177][ T637] kstrdup_const+0x55/0x90 [ 146.816566][ T637] __kernfs_new_node+0x99/0x6e0 [ 146.821397][ T637] ? is_module_text_address+0xe1/0x140 [ 146.826826][ T637] ? kernfs_new_node+0x170/0x170 [ 146.831738][ T637] ? ptr_to_hashval+0x60/0x60 [ 146.836391][ T637] ? arch_stack_walk+0xf8/0x140 [ 146.841226][ T637] ? snprintf+0xd6/0x120 [ 146.845460][ T637] kernfs_new_node+0x97/0x170 [ 146.850122][ T637] __kernfs_create_file+0x4a/0x270 [ 146.855215][ T637] cgroup_addrm_files+0xab8/0xfe0 [ 146.860221][ T637] ? ____kasan_kmalloc+0xdc/0x110 [ 146.865226][ T637] ? __kasan_kmalloc+0x9/0x10 [ 146.869883][ T637] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 146.875404][ T637] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 146.881528][ T637] ? delete_node+0x759/0x7b0 [ 146.886098][ T637] ? __kasan_check_read+0x11/0x20 [ 146.891102][ T637] ? delete_node+0x759/0x7b0 [ 146.895663][ T637] ? __kasan_check_write+0x14/0x20 [ 146.900750][ T637] ? idr_replace+0x1c4/0x230 [ 146.905312][ T637] ? idr_get_next+0x4b0/0x4b0 [ 146.909971][ T637] ? _raw_spin_lock_bh+0xa3/0x1b0 [ 146.915009][ T637] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 146.920189][ T637] css_populate_dir+0x137/0x370 [ 146.925020][ T637] cgroup_apply_control_enable+0x8b9/0x12f0 [ 146.930885][ T637] cgroup_apply_control+0x93/0x710 [ 146.935974][ T637] ? css_next_child+0x160/0x160 [ 146.940803][ T637] ? stack_trace_save+0x12d/0x1f0 [ 146.945808][ T637] ? io_schedule+0x120/0x120 [ 146.950388][ T637] ? kernfs_fop_write_iter+0x15e/0x410 [ 146.955819][ T637] ? __kasan_check_write+0x14/0x20 [ 146.960905][ T637] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 146.966172][ T637] cgroup_subtree_control_write+0xd19/0x1310 [ 146.972138][ T637] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 146.978089][ T637] ? __kasan_check_write+0x14/0x20 [ 146.983185][ T637] ? _copy_from_iter+0x3fb/0xd60 [ 146.988105][ T637] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 146.994060][ T637] cgroup_file_write+0x28e/0x590 [ 146.998975][ T637] ? cgroup_seqfile_stop+0xc0/0xc0 [ 147.004067][ T637] ? mutex_lock+0xa6/0x110 [ 147.008474][ T637] ? mutex_trylock+0xb0/0xb0 [ 147.013047][ T637] ? __kasan_check_write+0x14/0x20 [ 147.018140][ T637] kernfs_fop_write_iter+0x2d0/0x410 [ 147.023409][ T637] ? cgroup_seqfile_stop+0xc0/0xc0 [ 147.028494][ T637] vfs_write+0xc1c/0xf40 [ 147.032710][ T637] ? __kasan_check_write+0x14/0x20 [ 147.037801][ T637] ? kernel_write+0x3c0/0x3c0 [ 147.042460][ T637] ? _raw_spin_unlock_irq+0x4e/0x70 [ 147.047641][ T637] ? ptrace_stop+0x6ff/0x9f0 [ 147.052217][ T637] ? __kasan_check_read+0x11/0x20 [ 147.057225][ T637] ? __fdget_pos+0x27e/0x310 [ 147.061800][ T637] ksys_write+0x198/0x2c0 [ 147.066111][ T637] ? do_notify_parent+0xa60/0xa60 [ 147.071110][ T637] ? __ia32_sys_read+0x90/0x90 [ 147.075849][ T637] ? __ia32_sys_open+0x270/0x270 [ 147.080760][ T637] __x64_sys_write+0x7b/0x90 [ 147.085333][ T637] do_syscall_64+0x34/0x70 [ 147.089748][ T637] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 147.095625][ T637] RIP: 0033:0x7fc8ece62c09 [ 147.100022][ T637] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 147.119597][ T637] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 640] write(4, "+pids ", 6 [pid 380] <... umount2 resumed>) = 0 [pid 380] umount2("./39/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./39/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 380] umount2("./39/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] openat(AT_FDCWD, "./39/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 380] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 380] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 380] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 380] close(4) = 0 [pid 380] rmdir("./39/file0") = 0 [pid 380] umount2("./39/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./39/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 380] unlink("./39/cgroup.cpu") = 0 [pid 380] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 380] close(3) = 0 [pid 380] rmdir("./39") = 0 [pid 380] mkdir("./40", 0777) = 0 [pid 380] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 641 attached [pid 641] chdir("./40" [pid 380] <... clone resumed>, child_tidptr=0x555556fab5d0) = 42 [pid 641] <... chdir resumed>) = 0 [pid 641] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 641] setpgid(0, 0) = 0 [pid 637] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 641] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 637] close(3 [pid 641] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 641] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 641] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 641] write(3, "1000", 4) = 4 [pid 641] close(3) = 0 [pid 641] symlink("/dev/binderfs", "./binderfs") = 0 [pid 641] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 637] <... close resumed>) = 0 [pid 641] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 641] open("./file0", O_RDONLY) = 3 [pid 641] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [pid 641] write(4, "-pids ", 6 [pid 637] close(4) = 0 [pid 637] close(5) = 0 [pid 637] close(6) = -1 EBADF (Bad file descriptor) [pid 637] close(7) = -1 EBADF (Bad file descriptor) [pid 637] close(8) = -1 EBADF (Bad file descriptor) [pid 637] close(9) = -1 EBADF (Bad file descriptor) [pid 637] close(10) = -1 EBADF (Bad file descriptor) [pid 637] close(11) = -1 EBADF (Bad file descriptor) [pid 637] close(12) = -1 EBADF (Bad file descriptor) [pid 637] close(13) = -1 EBADF (Bad file descriptor) [pid 637] close(14) = -1 EBADF (Bad file descriptor) [pid 637] close(15) = -1 EBADF (Bad file descriptor) [pid 637] close(16) = -1 EBADF (Bad file descriptor) [pid 637] close(17) = -1 EBADF (Bad file descriptor) [pid 637] close(18) = -1 EBADF (Bad file descriptor) [pid 637] close(19) = -1 EBADF (Bad file descriptor) [pid 637] close(20) = -1 EBADF (Bad file descriptor) [pid 637] close(21) = -1 EBADF (Bad file descriptor) [pid 637] close(22) = -1 EBADF (Bad file descriptor) [pid 637] close(23) = -1 EBADF (Bad file descriptor) [pid 637] close(24) = -1 EBADF (Bad file descriptor) [pid 637] close(25) = -1 EBADF (Bad file descriptor) [pid 637] close(26) = -1 EBADF (Bad file descriptor) [pid 637] close(27) = -1 EBADF (Bad file descriptor) [pid 637] close(28) = -1 EBADF (Bad file descriptor) [pid 637] close(29) = -1 EBADF (Bad file descriptor) [pid 637] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory ) = 89 [pid 637] exit_group(0) = ? [pid 637] +++ exited with 0 +++ [pid 382] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=47, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 382] umount2("./45", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] openat(AT_FDCWD, "./45", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 382] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 382] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 382] umount2("./45/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./45/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 382] unlink("./45/binderfs") = 0 [pid 382] umount2("./45/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./45/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 382] unlink("./45/cgroup") = 0 [pid 382] umount2("./45/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./45/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 382] unlink("./45/cgroup.net") = 0 [ 147.127983][ T637] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 147.135934][ T637] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 147.143889][ T637] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 147.151837][ T637] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 147.159788][ T637] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 000000000000002d [ 147.169217][ T637] cgroup: cgroup_addrm_files: failed to add max, err=-12 [ 147.186763][ T382] ------------[ cut here ]------------ [ 147.192267][ T382] WARNING: CPU: 0 PID: 382 at fs/namespace.c:1168 mntput_no_expire+0x48a/0x6c0 [ 147.201213][ T382] Modules linked in: [ 147.205092][ T382] CPU: 0 PID: 382 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 147.216696][ T382] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 147.226768][ T382] RIP: 0010:mntput_no_expire+0x48a/0x6c0 [ 147.232412][ T382] Code: 48 c7 c2 80 02 44 86 e8 64 f0 8e ff e9 8b fc ff ff e8 ba 21 b6 ff e9 81 fc ff ff e8 b0 21 b6 ff e9 77 fc ff ff e8 a6 21 b6 ff <0f> 0b e9 f4 fc ff ff e8 9a 21 b6 ff e8 65 ad a2 ff e9 ea fc ff ff [ 147.252038][ T382] RSP: 0018:ffffc90000b77ba0 EFLAGS: 00010293 [ 147.258112][ T382] RAX: ffffffff81b68f1a RBX: 00000000ffffffff RCX: ffff8881065e4f00 [ 147.266095][ T382] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000 [ 147.274073][ T382] RBP: ffffc90000b77c70 R08: ffffffff81b68c08 R09: 0000000000000003 [ 147.282056][ T382] R10: fffff5200016ef65 R11: 1ffff9200016ef64 R12: dffffc0000000000 [ 147.290016][ T382] R13: ffff888117099500 R14: ffffc90000b77c00 R15: 1ffff9200016ef7c [ 147.298001][ T382] FS: 0000555556fab300(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 147.306931][ T382] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 147.313535][ T382] CR2: 00007ffd7d0e1c18 CR3: 000000011dd7e000 CR4: 00000000003506b0 [ 147.321508][ T382] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 147.329452][ T382] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 147.337416][ T382] Call Trace: [ 147.340709][ T382] ? io_schedule+0x120/0x120 [ 147.345277][ T382] ? vfs_submount+0xb0/0xb0 [ 147.349763][ T382] ? shrink_dentry_list+0x4ec/0x500 [ 147.354981][ T382] ? __kasan_check_write+0x14/0x20 [ 147.360243][ T382] namespace_unlock+0x448/0x4f0 [ 147.365102][ T382] ? umount_tree+0xf50/0xf50 [ 147.369677][ T382] ? __detach_mounts+0x670/0x670 [ 147.374629][ T382] ? selinux_umount+0xf0/0x130 [ 147.379398][ T382] ? security_sb_umount+0x9d/0xb0 [ 147.384443][ T382] path_umount+0xf03/0xfb0 [ 147.388856][ T382] ? namespace_unlock+0x4f0/0x4f0 [ 147.393912][ T382] ? user_path_at_empty+0x40/0x50 [ 147.398922][ T382] __x64_sys_umount+0x122/0x170 [ 147.403788][ T382] ? path_umount+0xfb0/0xfb0 [ 147.408376][ T382] ? syscall_enter_from_user_mode+0x58/0x1b0 [ 147.414370][ T382] do_syscall_64+0x34/0x70 [ 147.418781][ T382] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 147.424686][ T382] RIP: 0033:0x7fc8ece63fb7 [ 147.429099][ T382] Code: 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 147.448715][ T382] RSP: 002b:00007ffd7d0e2358 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [ 147.457157][ T382] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc8ece63fb7 [ 147.465144][ T382] RDX: 00007ffd7d0e241a RSI: 000000000000000a RDI: 00007ffd7d0e2410 [ 147.473140][ T382] RBP: 00007ffd7d0e2410 R08: 00000000ffffffff R09: 00007ffd7d0e21f0 [ 147.481124][ T382] R10: 0000555556fad6a3 R11: 0000000000000202 R12: 00007ffd7d0e3490 [ 147.489086][ T382] R13: 0000555556fad600 R14: 00007ffd7d0e2380 R15: 000000000000002e [ 147.497074][ T382] ---[ end trace d4de1ca9cdcd1993 ]--- [ 147.502596][ T382] ------------[ cut here ]------------ [ 147.508053][ T382] WARNING: CPU: 0 PID: 382 at fs/namespace.c:1168 mntput_no_expire+0x48a/0x6c0 [ 147.516997][ T382] Modules linked in: [ 147.520425][ T639] FAULT_INJECTION: forcing a failure. [ 147.520425][ T639] name failslab, interval 1, probability 0, space 0, times 0 [ 147.520981][ T382] CPU: 0 PID: 382 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 147.543373][ T639] CPU: 1 PID: 639 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 147.545194][ T382] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 147.556724][ T639] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 147.556728][ T639] Call Trace: [ 147.556747][ T639] dump_stack_lvl+0x1e2/0x24b [ 147.556758][ T639] ? bfq_pos_tree_add_move+0x43e/0x43e [ 147.556769][ T639] dump_stack+0x15/0x17 [ 147.556779][ T639] should_fail+0x3c0/0x510 [ 147.556789][ T639] ? pids_css_alloc+0x4e/0x120 [ 147.556800][ T639] __should_failslab+0x9f/0xe0 [ 147.556810][ T639] should_failslab+0x9/0x20 [ 147.556822][ T639] kmem_cache_alloc_trace+0x3a/0x330 [ 147.556831][ T639] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 147.556849][ T639] pids_css_alloc+0x4e/0x120 [ 147.566918][ T382] RIP: 0010:mntput_no_expire+0x48a/0x6c0 [ 147.576930][ T639] cgroup_apply_control_enable+0x350/0x12f0 [ 147.576943][ T639] cgroup_apply_control+0x93/0x710 [ 147.576962][ T639] ? css_next_child+0x160/0x160 [ 147.580255][ T382] Code: 48 c7 c2 80 02 44 86 e8 64 f0 8e ff e9 8b fc ff ff e8 ba 21 b6 ff e9 81 fc ff ff e8 b0 21 b6 ff e9 77 fc ff ff e8 a6 21 b6 ff <0f> 0b e9 f4 fc ff ff e8 9a 21 b6 ff e8 65 ad a2 ff e9 ea fc ff ff [ 147.584888][ T639] ? io_schedule+0x120/0x120 [ 147.590354][ T382] RSP: 0018:ffffc90000b77ca0 EFLAGS: 00010293 [ 147.594452][ T639] ? kernfs_fop_write_iter+0x15e/0x410 [ 147.598844][ T382] [ 147.603583][ T639] ? __kasan_check_write+0x14/0x20 [ 147.603594][ T639] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 147.603611][ T639] cgroup_subtree_control_write+0xd19/0x1310 [ 147.608349][ T382] RAX: ffffffff81b68f1a RBX: 00000000fffffffe RCX: ffff8881065e4f00 [ 147.612822][ T639] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 147.612837][ T639] ? __kasan_check_write+0x14/0x20 [ 147.612854][ T639] ? _copy_from_iter+0x3fb/0xd60 [ 147.618107][ T382] RDX: 0000000000000000 RSI: 00000000fffffffe RDI: 0000000000000000 [ 147.623270][ T639] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 147.623279][ T639] cgroup_file_write+0x28e/0x590 [ 147.623294][ T639] ? cgroup_seqfile_stop+0xc0/0xc0 [ 147.627853][ T382] RBP: ffffc90000b77d70 R08: ffffffff81b68c08 R09: 0000000000000003 [ 147.633449][ T639] ? mutex_lock+0xa6/0x110 [ 147.633458][ T639] ? mutex_trylock+0xb0/0xb0 [ 147.633474][ T639] ? __kasan_check_write+0x14/0x20 [ 147.639339][ T382] R10: fffff5200016ef85 R11: 1ffff9200016ef84 R12: dffffc0000000000 [ 147.644410][ T639] kernfs_fop_write_iter+0x2d0/0x410 [pid 382] umount2("./45/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 376] kill(-43, SIGKILL) = 0 [pid 376] kill(43, SIGKILL) = 0 [ 147.644419][ T639] ? cgroup_seqfile_stop+0xc0/0xc0 [ 147.644428][ T639] vfs_write+0xc1c/0xf40 [ 147.644436][ T639] ? __kasan_check_write+0x14/0x20 [ 147.644452][ T639] ? kernel_write+0x3c0/0x3c0 [ 147.649273][ T382] R13: ffff888117099500 R14: ffffc90000b77d00 R15: 1ffff9200016ef9c [ 147.668850][ T639] ? _raw_spin_unlock_irq+0x4e/0x70 [ 147.668861][ T639] ? ptrace_stop+0x6ff/0x9f0 [ 147.668876][ T639] ? __kasan_check_read+0x11/0x20 [ 147.673442][ T382] FS: 0000555556fab300(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 147.679485][ T639] ? __fdget_pos+0x27e/0x310 [ 147.684922][ T382] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 147.687218][ T639] ksys_write+0x198/0x2c0 [ 147.692305][ T382] CR2: 00007ffd7d0e1c18 CR3: 000000011dd7e000 CR4: 00000000003506b0 [ 147.697551][ T639] ? do_notify_parent+0xa60/0xa60 [ 147.703520][ T382] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 147.711442][ T639] ? __ia32_sys_read+0x90/0x90 [ 147.711451][ T639] ? __ia32_sys_open+0x270/0x270 [ 147.711466][ T639] __x64_sys_write+0x7b/0x90 [ 147.717415][ T382] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 147.722492][ T639] do_syscall_64+0x34/0x70 [ 147.722509][ T639] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 147.727408][ T382] Call Trace: [ 147.735351][ T639] RIP: 0033:0x7fc8ece62c09 [ 147.735363][ T639] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 147.735375][ T639] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 [ 147.741357][ T382] ? lockref_get_or_lock+0x340/0x340 [ 147.746235][ T639] ORIG_RAX: 0000000000000001 [ 147.751342][ T382] ? umount_tree+0xf50/0xf50 [ 147.759271][ T639] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 147.763679][ T382] ? vfs_submount+0xb0/0xb0 [ 147.768214][ T639] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 147.773305][ T382] ? dput+0x2b6/0x320 [ 147.781233][ T639] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 147.781240][ T639] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 147.781254][ T639] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 000000000000002d [ 147.786512][ T382] path_umount+0x1fe/0xfb0 [ 148.006517][ T382] ? namespace_unlock+0x4f0/0x4f0 [ 148.011543][ T382] ? user_path_at_empty+0x40/0x50 [ 148.016555][ T382] __x64_sys_umount+0x122/0x170 [ 148.021404][ T382] ? path_umount+0xfb0/0xfb0 [ 148.025976][ T382] ? syscall_enter_from_user_mode+0x58/0x1b0 [ 148.031960][ T382] do_syscall_64+0x34/0x70 [ 148.036372][ T382] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 148.042263][ T382] RIP: 0033:0x7fc8ece63fb7 [ 148.046728][ T382] Code: 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 148.066341][ T382] RSP: 002b:00007ffd7d0e2358 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [ 148.074748][ T382] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc8ece63fb7 [ 148.082715][ T382] RDX: 00007ffd7d0e241a RSI: 000000000000000a RDI: 00007ffd7d0e2410 [pid 376] openat(AT_FDCWD, "/sys/fs/fuse/connections", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 639] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 382] <... umount2 resumed>) = 0 [pid 639] close(3) = 0 [pid 382] umount2("./45/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 376] fstat(3, [pid 639] close(4 [pid 382] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 376] <... fstat resumed>{st_mode=S_IFDIR|0755, st_size=0, ...}) = 0 [pid 639] <... close resumed>) = 0 [pid 376] getdents64(3, [pid 639] close(5 [pid 376] <... getdents64 resumed>0x555556fad630 /* 2 entries */, 32768) = 48 [pid 639] <... close resumed>) = 0 [pid 376] getdents64(3, [pid 639] close(6 [pid 376] <... getdents64 resumed>0x555556fad630 /* 0 entries */, 32768) = 0 [pid 639] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 376] close(3 [pid 639] close(7 [pid 376] <... close resumed>) = 0 [pid 639] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 639] close(8) = -1 EBADF (Bad file descriptor) [pid 639] close(9) = -1 EBADF (Bad file descriptor) [pid 639] close(10) = -1 EBADF (Bad file descriptor) [pid 639] close(11) = -1 EBADF (Bad file descriptor) [pid 639] close(12) = -1 EBADF (Bad file descriptor) [pid 639] close(13) = -1 EBADF (Bad file descriptor) [pid 639] close(14) = -1 EBADF (Bad file descriptor) [pid 639] close(15) = -1 EBADF (Bad file descriptor) [pid 639] close(16) = -1 EBADF (Bad file descriptor) [pid 639] close(17) = -1 EBADF (Bad file descriptor) [pid 639] close(18) = -1 EBADF (Bad file descriptor) [pid 639] close(19) = -1 EBADF (Bad file descriptor) [pid 639] close(20) = -1 EBADF (Bad file descriptor) [pid 639] close(21) = -1 EBADF (Bad file descriptor) [pid 639] close(22) = -1 EBADF (Bad file descriptor) [pid 639] close(23) = -1 EBADF (Bad file descriptor) [pid 639] close(24) = -1 EBADF (Bad file descriptor) [pid 639] close(25) = -1 EBADF (Bad file descriptor) [pid 639] close(26) = -1 EBADF (Bad file descriptor) [pid 639] close(27) = -1 EBADF (Bad file descriptor) [pid 639] close(28) = -1 EBADF (Bad file descriptor) [pid 639] close(29) = -1 EBADF (Bad file descriptor) write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory [pid 639] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 639] exit_group(0) = ? [pid 639] +++ exited with 0 +++ [pid 375] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=47, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 375] umount2("./45", MNT_DETACH|UMOUNT_NOFOLLOW [pid 382] lstat("./45/file0", [pid 375] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 382] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 375] openat(AT_FDCWD, "./45", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 382] umount2("./45/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 375] <... openat resumed>) = 3 [pid 375] fstat(3, [pid 382] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 375] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 382] openat(AT_FDCWD, "./45/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 375] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 382] <... openat resumed>) = 4 [pid 375] umount2("./45/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 382] fstat(4, [pid 375] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 375] lstat("./45/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 375] unlink("./45/binderfs" [pid 382] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 375] <... unlink resumed>) = 0 [pid 382] getdents64(4, [pid 375] umount2("./45/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./45/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 375] unlink("./45/cgroup" [pid 382] <... getdents64 resumed>0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 375] <... unlink resumed>) = 0 [pid 382] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 375] umount2("./45/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW [pid 382] close(4 [pid 375] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 382] <... close resumed>) = 0 [pid 375] lstat("./45/cgroup.net", [pid 382] rmdir("./45/file0" [pid 375] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 641] <... write resumed>) = 6 [pid 375] unlink("./45/cgroup.net") = 0 [pid 375] umount2("./45/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 382] <... rmdir resumed>) = 0 [ 148.090678][ T382] RBP: 00007ffd7d0e2410 R08: 00000000ffffffff R09: 00007ffd7d0e21f0 [ 148.098632][ T382] R10: 0000555556fad6a3 R11: 0000000000000202 R12: 00007ffd7d0e3490 [ 148.106606][ T382] R13: 0000555556fad600 R14: 00007ffd7d0e2380 R15: 000000000000002e [ 148.114574][ T382] ---[ end trace d4de1ca9cdcd1994 ]--- [ 148.131212][ T640] FAULT_INJECTION: forcing a failure. [pid 382] umount2("./45/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./45/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 382] unlink("./45/cgroup.cpu") = 0 [pid 382] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 382] close(3) = 0 [pid 382] rmdir("./45") = 0 [pid 382] mkdir("./46", 0777) = 0 [pid 641] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 375] <... umount2 resumed>) = 0 [pid 375] umount2("./45/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 641] <... openat resumed>) = 5 [pid 375] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 382] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 375] lstat("./45/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 375] umount2("./45/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] openat(AT_FDCWD, "./45/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 382] <... clone resumed>, child_tidptr=0x555556fab5d0) = 48 [pid 375] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 375] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 375] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 375] close(4) = 0 [pid 375] rmdir("./45/file0") = 0 [pid 375] umount2("./45/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./45/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 375] unlink("./45/cgroup.cpu") = 0 [pid 375] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 375] close(3) = 0 [pid 375] rmdir("./45") = 0 [pid 375] mkdir("./46", 0777) = 0 [pid 375] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556fab5d0) = 48 [pid 641] write(5, "22", 2) = 2 [pid 641] write(4, "+pids ", 6./strace-static-x86_64: Process 642 attached [pid 642] chdir("./46") = 0 [pid 642] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 642] setpgid(0, 0) = 0 [pid 642] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 642] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [pid 642] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 642] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 642] write(3, "1000", 4) = 4 [pid 642] close(3) = 0 [pid 642] symlink("/dev/binderfs", "./binderfs") = 0 [pid 642] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 642] mount(NULL, "./file0", "cgroup2", 0, NULL./strace-static-x86_64: Process 643 attached [pid 643] chdir("./46") = 0 [pid 643] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 643] setpgid(0, 0) = 0 [pid 643] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 643] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 643] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 643] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 643] write(3, "1000", 4) = 4 [pid 643] close(3) = 0 [pid 643] symlink("/dev/binderfs", "./binderfs") = 0 [pid 643] mkdirat(AT_FDCWD, "./file0", 000) = 0 [ 148.131212][ T640] name failslab, interval 1, probability 0, space 0, times 0 [ 148.144299][ T640] CPU: 1 PID: 640 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 148.155920][ T640] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 148.165963][ T640] Call Trace: [ 148.169246][ T640] dump_stack_lvl+0x1e2/0x24b [ 148.173915][ T640] ? bfq_pos_tree_add_move+0x43e/0x43e [ 148.179356][ T640] ? selinux_kernfs_init_security+0x1a8/0x760 [ 148.185406][ T640] dump_stack+0x15/0x17 [ 148.189533][ T640] should_fail+0x3c0/0x510 [ 148.193925][ T640] ? __kernfs_new_node+0x99/0x6e0 [ 148.198931][ T640] __should_failslab+0x9f/0xe0 [ 148.203708][ T640] should_failslab+0x9/0x20 [ 148.208193][ T640] __kmalloc_track_caller+0x5f/0x350 [ 148.213454][ T640] kstrdup_const+0x55/0x90 [ 148.217846][ T640] __kernfs_new_node+0x99/0x6e0 [ 148.222670][ T640] ? is_module_text_address+0xe1/0x140 [ 148.228102][ T640] ? kernfs_new_node+0x170/0x170 [ 148.233024][ T640] ? ptr_to_hashval+0x60/0x60 [ 148.237678][ T640] ? arch_stack_walk+0xf8/0x140 [ 148.242509][ T640] ? snprintf+0xd6/0x120 [ 148.246745][ T640] kernfs_new_node+0x97/0x170 [ 148.251409][ T640] __kernfs_create_file+0x4a/0x270 [ 148.256513][ T640] cgroup_addrm_files+0xab8/0xfe0 [ 148.261526][ T640] ? ____kasan_kmalloc+0xdc/0x110 [ 148.266541][ T640] ? __kasan_kmalloc+0x9/0x10 [ 148.271207][ T640] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 148.276735][ T640] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 148.282960][ T640] ? delete_node+0x759/0x7b0 [ 148.287527][ T640] ? __kasan_check_read+0x11/0x20 [ 148.292526][ T640] ? delete_node+0x759/0x7b0 [ 148.297097][ T640] ? __kasan_check_write+0x14/0x20 [ 148.302202][ T640] ? idr_replace+0x1c4/0x230 [ 148.306781][ T640] ? idr_get_next+0x4b0/0x4b0 [ 148.311431][ T640] ? _raw_spin_lock_bh+0xa3/0x1b0 [ 148.316434][ T640] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 148.321612][ T640] css_populate_dir+0x137/0x370 [ 148.326442][ T640] cgroup_apply_control_enable+0x8b9/0x12f0 [ 148.332311][ T640] cgroup_apply_control+0x93/0x710 [ 148.337493][ T640] ? css_next_child+0x160/0x160 [ 148.342337][ T640] ? io_schedule+0x120/0x120 [ 148.346901][ T640] ? kernfs_fop_write_iter+0x15e/0x410 [ 148.352335][ T640] ? __kasan_check_write+0x14/0x20 [ 148.357421][ T640] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 148.362691][ T640] cgroup_subtree_control_write+0xd19/0x1310 [ 148.368661][ T640] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 148.374617][ T640] ? __kasan_check_write+0x14/0x20 [ 148.379715][ T640] ? _copy_from_iter+0x3fb/0xd60 [ 148.384644][ T640] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 148.390599][ T640] cgroup_file_write+0x28e/0x590 [ 148.395509][ T640] ? cgroup_seqfile_stop+0xc0/0xc0 [ 148.400603][ T640] ? mutex_lock+0xa6/0x110 [ 148.405010][ T640] ? mutex_trylock+0xb0/0xb0 [ 148.409591][ T640] ? __kasan_check_write+0x14/0x20 [ 148.414687][ T640] kernfs_fop_write_iter+0x2d0/0x410 [ 148.419958][ T640] ? cgroup_seqfile_stop+0xc0/0xc0 [ 148.425053][ T640] vfs_write+0xc1c/0xf40 [ 148.429271][ T640] ? __kasan_check_write+0x14/0x20 [ 148.434367][ T640] ? kernel_write+0x3c0/0x3c0 [ 148.439028][ T640] ? _raw_spin_unlock_irq+0x4e/0x70 [ 148.444207][ T640] ? ptrace_stop+0x6ff/0x9f0 [ 148.448798][ T640] ? __kasan_check_read+0x11/0x20 [ 148.453810][ T640] ? __fdget_pos+0x27e/0x310 [ 148.458377][ T640] ksys_write+0x198/0x2c0 [ 148.462698][ T640] ? do_notify_parent+0xa60/0xa60 [ 148.467706][ T640] ? __ia32_sys_read+0x90/0x90 [ 148.472441][ T640] ? __ia32_sys_open+0x270/0x270 [ 148.477354][ T640] __x64_sys_write+0x7b/0x90 [ 148.481923][ T640] do_syscall_64+0x34/0x70 [ 148.486314][ T640] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 148.492180][ T640] RIP: 0033:0x7fc8ece62c09 [ 148.496583][ T640] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 148.516179][ T640] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 148.524589][ T640] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 148.532547][ T640] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [pid 643] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 640] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 643] <... mount resumed>) = 0 [pid 642] <... mount resumed>) = 0 [pid 643] open("./file0", O_RDONLY [pid 640] close(3 [pid 643] <... open resumed>) = 3 [pid 643] openat(3, "cgroup.subtree_control", O_RDWR [pid 640] <... close resumed>) = 0 [pid 643] <... openat resumed>) = 4 [pid 643] write(4, "-pids ", 6 [pid 640] close(4) = 0 [pid 640] close(5) = 0 [pid 640] close(6) = -1 EBADF (Bad file descriptor) [pid 640] close(7) = -1 EBADF (Bad file descriptor) [pid 640] close(8) = -1 EBADF (Bad file descriptor) [pid 642] open("./file0", O_RDONLY [pid 640] close(9) = -1 EBADF (Bad file descriptor) [pid 640] close(10) = -1 EBADF (Bad file descriptor) [pid 640] close(11) = -1 EBADF (Bad file descriptor) [pid 640] close(12) = -1 EBADF (Bad file descriptor) [pid 640] close(13) = -1 EBADF (Bad file descriptor) [pid 640] close(14) = -1 EBADF (Bad file descriptor) [pid 640] close(15) = -1 EBADF (Bad file descriptor) [pid 640] close(16) = -1 EBADF (Bad file descriptor) [pid 640] close(17) = -1 EBADF (Bad file descriptor) [pid 640] close(18) = -1 EBADF (Bad file descriptor) [pid 640] close(19) = -1 EBADF (Bad file descriptor) [pid 640] close(20) = -1 EBADF (Bad file descriptor) [pid 640] close(21) = -1 EBADF (Bad file descriptor) [pid 640] close(22) = -1 EBADF (Bad file descriptor) [pid 640] close(23) = -1 EBADF (Bad file descriptor) [pid 640] close(24) = -1 EBADF (Bad file descriptor) [pid 640] close(25) = -1 EBADF (Bad file descriptor) [pid 640] close(26) = -1 EBADF (Bad file descriptor) [pid 640] close(27) = -1 EBADF (Bad file descriptor) [pid 640] close(28) = -1 EBADF (Bad file descriptor) [pid 640] close(29) = -1 EBADF (Bad file descriptor) write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory [pid 640] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 640] exit_group(0) = ? [pid 642] <... open resumed>) = 3 [pid 640] +++ exited with 0 +++ [pid 642] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [pid 642] write(4, "-pids ", 6 [pid 383] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=38, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 383] umount2("./36", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] openat(AT_FDCWD, "./36", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 383] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 383] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 383] umount2("./36/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./36/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 383] unlink("./36/binderfs") = 0 [pid 383] umount2("./36/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./36/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 383] unlink("./36/cgroup") = 0 [pid 383] umount2("./36/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./36/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 383] unlink("./36/cgroup.net") = 0 [pid 383] umount2("./36/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 383] umount2("./36/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./36/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 383] umount2("./36/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] openat(AT_FDCWD, "./36/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 383] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 383] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 383] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 383] close(4) = 0 [pid 383] rmdir("./36/file0") = 0 [pid 383] umount2("./36/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] lstat("./36/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 383] unlink("./36/cgroup.cpu") = 0 [pid 383] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 383] close(3) = 0 [pid 383] rmdir("./36") = 0 [pid 383] mkdir("./37", 0777) = 0 [pid 383] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 644 attached [pid 644] chdir("./37") = 0 [pid 383] <... clone resumed>, child_tidptr=0x555556fab5d0) = 39 [pid 644] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 644] setpgid(0, 0) = 0 [pid 644] symlink("/syzcgroup/unified/syz4", "./cgroup") = 0 [pid 644] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu") = 0 [pid 644] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [pid 644] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 644] write(3, "1000", 4) = 4 [pid 644] close(3) = 0 [pid 644] symlink("/dev/binderfs", "./binderfs") = 0 [pid 644] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 644] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 644] open("./file0", O_RDONLY) = 3 [pid 644] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [ 148.540493][ T640] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 148.548437][ T640] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 148.556390][ T640] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000024 [ 148.564923][ T640] cgroup: cgroup_addrm_files: failed to add max, err=-12 [ 148.600426][ T632] FAULT_INJECTION: forcing a failure. [ 148.600426][ T632] name failslab, interval 1, probability 0, space 0, times 0 [ 148.613101][ T632] CPU: 0 PID: 632 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 148.624715][ T632] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 148.634746][ T632] Call Trace: [ 148.638015][ T632] dump_stack_lvl+0x1e2/0x24b [ 148.642678][ T632] ? bfq_pos_tree_add_move+0x43e/0x43e [ 148.648124][ T632] ? selinux_kernfs_init_security+0x1a8/0x760 [ 148.654167][ T632] dump_stack+0x15/0x17 [ 148.658307][ T632] should_fail+0x3c0/0x510 [ 148.662708][ T632] ? __kernfs_new_node+0x99/0x6e0 [ 148.667715][ T632] __should_failslab+0x9f/0xe0 [ 148.672464][ T632] should_failslab+0x9/0x20 [ 148.676941][ T632] __kmalloc_track_caller+0x5f/0x350 [ 148.682198][ T632] kstrdup_const+0x55/0x90 [ 148.686588][ T632] __kernfs_new_node+0x99/0x6e0 [ 148.691423][ T632] ? is_module_text_address+0xe1/0x140 [ 148.696866][ T632] ? kernfs_new_node+0x170/0x170 [ 148.701780][ T632] ? ptr_to_hashval+0x60/0x60 [ 148.706429][ T632] ? arch_stack_walk+0xf8/0x140 [ 148.711266][ T632] ? snprintf+0xd6/0x120 [ 148.715504][ T632] kernfs_new_node+0x97/0x170 [ 148.720167][ T632] __kernfs_create_file+0x4a/0x270 [ 148.725265][ T632] cgroup_addrm_files+0xab8/0xfe0 [ 148.730276][ T632] ? ____kasan_kmalloc+0xdc/0x110 [ 148.735277][ T632] ? __kasan_kmalloc+0x9/0x10 [ 148.739929][ T632] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 148.745451][ T632] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 148.751579][ T632] ? delete_node+0x759/0x7b0 [ 148.756152][ T632] ? __kasan_check_read+0x11/0x20 [ 148.761159][ T632] ? delete_node+0x759/0x7b0 [ 148.765727][ T632] ? __kasan_check_write+0x14/0x20 [ 148.770823][ T632] ? idr_replace+0x1c4/0x230 [ 148.775385][ T632] ? idr_get_next+0x4b0/0x4b0 [ 148.780042][ T632] ? _raw_spin_lock_bh+0xa3/0x1b0 [ 148.785048][ T632] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 148.790229][ T632] css_populate_dir+0x137/0x370 [ 148.795055][ T632] cgroup_apply_control_enable+0x8b9/0x12f0 [ 148.800936][ T632] cgroup_apply_control+0x93/0x710 [ 148.806031][ T632] ? css_next_child+0x160/0x160 [ 148.810865][ T632] ? io_schedule+0x120/0x120 [ 148.815440][ T632] ? kernfs_fop_write_iter+0x15e/0x410 [ 148.820880][ T632] ? __kasan_check_write+0x14/0x20 [ 148.825969][ T632] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 148.831236][ T632] cgroup_subtree_control_write+0xd19/0x1310 [ 148.837189][ T632] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 148.843150][ T632] ? __kasan_check_write+0x14/0x20 [ 148.848242][ T632] ? _copy_from_iter+0x3fb/0xd60 [ 148.853160][ T632] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 148.859121][ T632] cgroup_file_write+0x28e/0x590 [ 148.864042][ T632] ? cgroup_seqfile_stop+0xc0/0xc0 [ 148.869135][ T632] ? mutex_lock+0xa6/0x110 [ 148.873526][ T632] ? mutex_trylock+0xb0/0xb0 [ 148.878101][ T632] ? __kasan_check_write+0x14/0x20 [ 148.883193][ T632] kernfs_fop_write_iter+0x2d0/0x410 [ 148.888449][ T632] ? cgroup_seqfile_stop+0xc0/0xc0 [ 148.893631][ T632] vfs_write+0xc1c/0xf40 [ 148.897865][ T632] ? __kasan_check_write+0x14/0x20 [ 148.902960][ T632] ? kernel_write+0x3c0/0x3c0 [ 148.907620][ T632] ? _raw_spin_unlock_irq+0x4e/0x70 [ 148.912800][ T632] ? ptrace_stop+0x6ff/0x9f0 [ 148.917370][ T632] ? __kasan_check_read+0x11/0x20 [ 148.922378][ T632] ? __fdget_pos+0x27e/0x310 [ 148.926941][ T632] ksys_write+0x198/0x2c0 [ 148.931247][ T632] ? do_notify_parent+0xa60/0xa60 [ 148.936258][ T632] ? __ia32_sys_read+0x90/0x90 [ 148.941000][ T632] ? __ia32_sys_open+0x270/0x270 [ 148.945909][ T632] __x64_sys_write+0x7b/0x90 [ 148.950473][ T632] do_syscall_64+0x34/0x70 [ 148.954864][ T632] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 148.960735][ T632] RIP: 0033:0x7fc8ece62c09 [ 148.965142][ T632] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 148.984738][ T632] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 148.993145][ T632] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [pid 644] write(4, "-pids ", 6 [pid 632] <... write resumed>) = ? [pid 632] +++ killed by SIGKILL +++ [pid 376] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=43, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=1} --- [pid 376] umount2("./41", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] openat(AT_FDCWD, "./41", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 376] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 376] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 376] umount2("./41/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./41/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 376] unlink("./41/binderfs") = 0 [pid 376] umount2("./41/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./41/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 376] unlink("./41/cgroup") = 0 [pid 376] umount2("./41/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./41/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 376] unlink("./41/cgroup.net") = 0 [pid 376] umount2("./41/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 376] umount2("./41/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./41/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 376] umount2("./41/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] openat(AT_FDCWD, "./41/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 376] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 376] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 376] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 376] close(4) = 0 [pid 376] rmdir("./41/file0") = 0 [pid 376] umount2("./41/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./41/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 376] unlink("./41/cgroup.cpu") = 0 [pid 376] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 376] close(3) = 0 [pid 376] rmdir("./41") = 0 [pid 376] mkdir("./42", 0777) = 0 [pid 376] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 645 attached , child_tidptr=0x555556fab5d0) = 44 [pid 645] chdir("./42") = 0 [pid 645] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 645] setpgid(0, 0) = 0 [pid 645] symlink("/syzcgroup/unified/syz1", "./cgroup") = 0 [pid 645] symlink("/syzcgroup/cpu/syz1", "./cgroup.cpu") = 0 [pid 645] symlink("/syzcgroup/net/syz1", "./cgroup.net") = 0 [pid 645] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 645] write(3, "1000", 4) = 4 [pid 645] close(3) = 0 [pid 645] symlink("/dev/binderfs", "./binderfs") = 0 [pid 645] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 645] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 645] open("./file0", O_RDONLY) = 3 [pid 645] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [pid 645] write(4, "-pids ", 6) = 6 [pid 644] <... write resumed>) = 6 [pid 643] <... write resumed>) = 6 [pid 642] <... write resumed>) = 6 [ 149.001099][ T632] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 149.009045][ T632] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 149.016999][ T632] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 149.024955][ T632] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000029 [ 149.033045][ T632] cgroup: cgroup_addrm_files: failed to add max, err=-12 [pid 645] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 644] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 642] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 645] <... openat resumed>) = 5 [pid 644] <... openat resumed>) = 5 [pid 642] <... openat resumed>) = 5 [pid 645] write(5, "22", 2 [pid 644] write(5, "22", 2 [pid 642] write(5, "22", 2 [pid 645] <... write resumed>) = 2 [pid 644] <... write resumed>) = 2 [pid 642] <... write resumed>) = 2 [pid 645] write(4, "+pids ", 6 [pid 644] write(4, "+pids ", 6 [pid 642] write(4, "+pids ", 6 [ 149.070456][ T638] FAULT_INJECTION: forcing a failure. [ 149.070456][ T638] name failslab, interval 1, probability 0, space 0, times 0 [ 149.083330][ T638] CPU: 0 PID: 638 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 149.094950][ T638] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 149.104981][ T638] Call Trace: [ 149.108251][ T638] dump_stack_lvl+0x1e2/0x24b [ 149.112906][ T638] ? bfq_pos_tree_add_move+0x43e/0x43e [ 149.118341][ T638] ? selinux_kernfs_init_security+0x1a8/0x760 [ 149.124387][ T638] dump_stack+0x15/0x17 [ 149.128519][ T638] should_fail+0x3c0/0x510 [ 149.132914][ T638] ? __kernfs_new_node+0x99/0x6e0 [ 149.138004][ T638] __should_failslab+0x9f/0xe0 [ 149.142744][ T638] should_failslab+0x9/0x20 [ 149.147233][ T638] __kmalloc_track_caller+0x5f/0x350 [ 149.152504][ T638] kstrdup_const+0x55/0x90 [ 149.156896][ T638] __kernfs_new_node+0x99/0x6e0 [ 149.161724][ T638] ? is_module_text_address+0xe1/0x140 [ 149.167161][ T638] ? kernfs_new_node+0x170/0x170 [ 149.172076][ T638] ? ptr_to_hashval+0x60/0x60 [ 149.176737][ T638] ? arch_stack_walk+0xf8/0x140 [ 149.181566][ T638] ? snprintf+0xd6/0x120 [ 149.185794][ T638] kernfs_new_node+0x97/0x170 [ 149.190456][ T638] __kernfs_create_file+0x4a/0x270 [ 149.195542][ T638] cgroup_addrm_files+0xab8/0xfe0 [ 149.200542][ T638] ? ____kasan_kmalloc+0xdc/0x110 [ 149.205540][ T638] ? __kasan_kmalloc+0x9/0x10 [ 149.210205][ T638] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 149.215729][ T638] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 149.221861][ T638] ? delete_node+0x759/0x7b0 [ 149.226428][ T638] ? __kasan_check_read+0x11/0x20 [ 149.231435][ T638] ? delete_node+0x759/0x7b0 [ 149.236001][ T638] ? __kasan_check_write+0x14/0x20 [ 149.241108][ T638] ? idr_replace+0x1c4/0x230 [ 149.245683][ T638] ? idr_get_next+0x4b0/0x4b0 [ 149.250337][ T638] ? _raw_spin_lock_bh+0xa3/0x1b0 [ 149.255336][ T638] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 149.260509][ T638] css_populate_dir+0x137/0x370 [ 149.265337][ T638] cgroup_apply_control_enable+0x8b9/0x12f0 [ 149.271210][ T638] cgroup_apply_control+0x93/0x710 [ 149.276299][ T638] ? css_next_child+0x160/0x160 [ 149.281139][ T638] ? stack_trace_save+0x12d/0x1f0 [ 149.286152][ T638] ? io_schedule+0x120/0x120 [ 149.290824][ T638] ? kernfs_fop_write_iter+0x15e/0x410 [ 149.296275][ T638] ? __kasan_check_write+0x14/0x20 [ 149.301375][ T638] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 149.306640][ T638] cgroup_subtree_control_write+0xd19/0x1310 [ 149.312607][ T638] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 149.318565][ T638] ? __kasan_check_write+0x14/0x20 [ 149.323655][ T638] ? _copy_from_iter+0x3fb/0xd60 [ 149.328573][ T638] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 149.334528][ T638] cgroup_file_write+0x28e/0x590 [ 149.339444][ T638] ? cgroup_seqfile_stop+0xc0/0xc0 [ 149.344541][ T638] ? mutex_lock+0xa6/0x110 [ 149.348937][ T638] ? mutex_trylock+0xb0/0xb0 [ 149.353506][ T638] ? __kasan_check_write+0x14/0x20 [ 149.358594][ T638] kernfs_fop_write_iter+0x2d0/0x410 [ 149.363859][ T638] ? cgroup_seqfile_stop+0xc0/0xc0 [ 149.368953][ T638] vfs_write+0xc1c/0xf40 [ 149.373175][ T638] ? __kasan_check_write+0x14/0x20 [ 149.378266][ T638] ? kernel_write+0x3c0/0x3c0 [ 149.382928][ T638] ? _raw_spin_unlock_irq+0x4e/0x70 [ 149.388102][ T638] ? ptrace_stop+0x6ff/0x9f0 [ 149.392672][ T638] ? __kasan_check_read+0x11/0x20 [ 149.397698][ T638] ? __fdget_pos+0x27e/0x310 [ 149.402267][ T638] ksys_write+0x198/0x2c0 [ 149.406598][ T638] ? do_notify_parent+0xa60/0xa60 [ 149.411618][ T638] ? __ia32_sys_read+0x90/0x90 [ 149.416383][ T638] ? __ia32_sys_open+0x270/0x270 [ 149.421309][ T638] __x64_sys_write+0x7b/0x90 [ 149.425888][ T638] do_syscall_64+0x34/0x70 [ 149.430292][ T638] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 149.436170][ T638] RIP: 0033:0x7fc8ece62c09 [ 149.440569][ T638] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 149.460150][ T638] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 643] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 643] write(5, "22", 2) = 2 [pid 643] write(4, "+pids ", 6 [pid 638] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 638] close(3) = 0 [pid 638] close(4) = 0 [pid 638] close(5) = 0 [pid 638] close(6) = -1 EBADF (Bad file descriptor) [pid 638] close(7) = -1 EBADF (Bad file descriptor) [pid 638] close(8) = -1 EBADF (Bad file descriptor) [pid 638] close(9) = -1 EBADF (Bad file descriptor) [pid 638] close(10) = -1 EBADF (Bad file descriptor) [pid 638] close(11) = -1 EBADF (Bad file descriptor) [pid 638] close(12) = -1 EBADF (Bad file descriptor) [pid 638] close(13) = -1 EBADF (Bad file descriptor) [pid 638] close(14) = -1 EBADF (Bad file descriptor) [pid 638] close(15) = -1 EBADF (Bad file descriptor) [pid 638] close(16) = -1 EBADF (Bad file descriptor) [pid 638] close(17) = -1 EBADF (Bad file descriptor) [pid 638] close(18) = -1 EBADF (Bad file descriptor) [pid 638] close(19) = -1 EBADF (Bad file descriptor) [pid 638] close(20) = -1 EBADF (Bad file descriptor) [pid 638] close(21) = -1 EBADF (Bad file descriptor) [pid 638] close(22) = -1 EBADF (Bad file descriptor) [pid 638] close(23) = -1 EBADF (Bad file descriptor) [pid 638] close(24) = -1 EBADF (Bad file descriptor) [pid 638] close(25) = -1 EBADF (Bad file descriptor) [pid 638] close(26) = -1 EBADF (Bad file descriptor) [pid 638] close(27) = -1 EBADF (Bad file descriptor) [pid 638] close(28) = -1 EBADF (Bad file descriptor) [pid 638] close(29) = -1 EBADF (Bad file descriptor) [pid 638] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory ) = 89 [pid 638] exit_group(0) = ? [pid 638] +++ exited with 0 +++ [pid 381] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=45, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 381] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 381] umount2("./43", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] openat(AT_FDCWD, "./43", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 381] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 381] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 381] umount2("./43/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./43/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 381] unlink("./43/binderfs") = 0 [pid 381] umount2("./43/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./43/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 381] unlink("./43/cgroup") = 0 [pid 381] umount2("./43/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./43/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 381] unlink("./43/cgroup.net") = 0 [ 149.468543][ T638] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 149.476700][ T638] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 149.484661][ T638] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 149.492615][ T638] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 149.500568][ T638] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 000000000000002b [ 149.512041][ T638] cgroup: cgroup_addrm_files: failed to add max, err=-12 [ 149.537977][ T381] ------------[ cut here ]------------ [ 149.543515][ T381] WARNING: CPU: 0 PID: 381 at fs/namespace.c:1168 mntput_no_expire+0x48a/0x6c0 [ 149.552445][ T381] Modules linked in: [ 149.556320][ T381] CPU: 0 PID: 381 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 149.567941][ T381] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 149.577997][ T381] RIP: 0010:mntput_no_expire+0x48a/0x6c0 [ 149.583632][ T381] Code: 48 c7 c2 80 02 44 86 e8 64 f0 8e ff e9 8b fc ff ff e8 ba 21 b6 ff e9 81 fc ff ff e8 b0 21 b6 ff e9 77 fc ff ff e8 a6 21 b6 ff <0f> 0b e9 f4 fc ff ff e8 9a 21 b6 ff e8 65 ad a2 ff e9 ea fc ff ff [ 149.603244][ T381] RSP: 0018:ffffc90000b37ba0 EFLAGS: 00010293 [ 149.609286][ T381] RAX: ffffffff81b68f1a RBX: 00000000ffffffff RCX: ffff8881065813c0 [ 149.617258][ T381] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000 [ 149.625246][ T381] RBP: ffffc90000b37c70 R08: ffffffff81b68c08 R09: 0000000000000003 [ 149.633228][ T381] R10: fffff52000166f65 R11: 1ffff92000166f64 R12: dffffc0000000000 [ 149.641208][ T381] R13: ffff88811d953a40 R14: ffffc90000b37c00 R15: 1ffff92000166f7c [ 149.649166][ T381] FS: 0000555556fab300(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 149.658103][ T381] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 149.664685][ T381] CR2: 00007ffd7d0e1c18 CR3: 000000011dddb000 CR4: 00000000003506b0 [ 149.672676][ T381] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 149.680659][ T381] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 149.688602][ T381] Call Trace: [ 149.691894][ T381] ? io_schedule+0x120/0x120 [ 149.696476][ T381] ? vfs_submount+0xb0/0xb0 [ 149.700991][ T381] ? shrink_dentry_list+0x4ec/0x500 [ 149.706177][ T381] ? __kasan_check_write+0x14/0x20 [ 149.711290][ T381] namespace_unlock+0x448/0x4f0 [ 149.716136][ T381] ? umount_tree+0xf50/0xf50 [ 149.720750][ T381] ? __detach_mounts+0x670/0x670 [ 149.725674][ T381] ? selinux_umount+0xf0/0x130 [ 149.730440][ T381] ? security_sb_umount+0x9d/0xb0 [ 149.735447][ T381] path_umount+0xf03/0xfb0 [ 149.739839][ T381] ? namespace_unlock+0x4f0/0x4f0 [ 149.744882][ T381] ? user_path_at_empty+0x40/0x50 [ 149.749896][ T381] __x64_sys_umount+0x122/0x170 [ 149.754758][ T381] ? path_umount+0xfb0/0xfb0 [ 149.759348][ T381] ? syscall_enter_from_user_mode+0x58/0x1b0 [ 149.765337][ T381] do_syscall_64+0x34/0x70 [ 149.769749][ T381] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 149.775643][ T381] RIP: 0033:0x7fc8ece63fb7 [ 149.780053][ T381] Code: 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 149.799667][ T381] RSP: 002b:00007ffd7d0e2358 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [ 149.808096][ T381] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc8ece63fb7 [ 149.816068][ T381] RDX: 00007ffd7d0e241a RSI: 000000000000000a RDI: 00007ffd7d0e2410 [ 149.824055][ T381] RBP: 00007ffd7d0e2410 R08: 00000000ffffffff R09: 00007ffd7d0e21f0 [ 149.832035][ T381] R10: 0000555556fad6a3 R11: 0000000000000202 R12: 00007ffd7d0e3490 [ 149.839996][ T381] R13: 0000555556fad600 R14: 00007ffd7d0e2380 R15: 000000000000002c [ 149.847988][ T381] ---[ end trace d4de1ca9cdcd1995 ]--- [ 149.853522][ T381] ------------[ cut here ]------------ [ 149.853665][ T643] FAULT_INJECTION: forcing a failure. [ 149.853665][ T643] name failslab, interval 1, probability 0, space 0, times 0 [ 149.858994][ T381] WARNING: CPU: 1 PID: 381 at fs/namespace.c:1168 mntput_no_expire+0x48a/0x6c0 [ 149.871745][ T643] CPU: 0 PID: 643 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 149.880471][ T381] Modules linked in: [ 149.892041][ T643] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 149.892045][ T643] Call Trace: [ 149.892060][ T643] dump_stack_lvl+0x1e2/0x24b [ 149.892077][ T643] ? bfq_pos_tree_add_move+0x43e/0x43e [ 149.895936][ T381] [ 149.905964][ T643] ? selinux_kernfs_init_security+0x1a8/0x760 [ 149.905973][ T643] dump_stack+0x15/0x17 [ 149.905989][ T643] should_fail+0x3c0/0x510 [ 149.909249][ T381] CPU: 1 PID: 381 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 149.913889][ T643] ? __kernfs_new_node+0x99/0x6e0 [ 149.913906][ T643] __should_failslab+0x9f/0xe0 [ 149.919328][ T381] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 149.921630][ T643] should_failslab+0x9/0x20 [ 149.921641][ T643] __kmalloc_track_caller+0x5f/0x350 [ 149.921657][ T643] kstrdup_const+0x55/0x90 [ 149.927696][ T381] RIP: 0010:mntput_no_expire+0x48a/0x6c0 [ 149.931819][ T643] __kernfs_new_node+0x99/0x6e0 [ 149.931829][ T643] ? is_module_text_address+0xe1/0x140 [ 149.931843][ T643] ? kernfs_new_node+0x170/0x170 [ 149.936232][ T381] Code: 48 c7 c2 80 02 44 86 e8 64 f0 8e ff e9 8b fc ff ff e8 ba 21 b6 ff e9 81 fc ff ff e8 b0 21 b6 ff e9 77 fc ff ff e8 a6 21 b6 ff <0f> 0b e9 f4 fc ff ff e8 9a 21 b6 ff e8 65 ad a2 ff e9 ea fc ff ff [ 149.947815][ T643] ? ptr_to_hashval+0x60/0x60 [ 149.947824][ T643] ? arch_stack_walk+0xf8/0x140 [ 149.947833][ T643] ? snprintf+0xd6/0x120 [ 149.947841][ T643] kernfs_new_node+0x97/0x170 [ 149.947856][ T643] __kernfs_create_file+0x4a/0x270 [ 149.952854][ T381] RSP: 0018:ffffc90000b37ca0 EFLAGS: 00010293 [ 149.957586][ T643] cgroup_addrm_files+0xab8/0xfe0 [ 149.967615][ T381] [ 149.972082][ T643] ? ____kasan_kmalloc+0xdc/0x110 [ 149.972097][ T643] ? __kasan_kmalloc+0x9/0x10 [ 149.977353][ T381] RAX: ffffffff81b68f1a RBX: 00000000fffffffe RCX: ffff8881065813c0 [ 149.981734][ T643] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 149.981752][ T643] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 149.987350][ T381] RDX: 0000000000000000 RSI: 00000000fffffffe RDI: 0000000000000000 [ 149.992251][ T643] ? delete_node+0x759/0x7b0 [ 149.992261][ T643] ? __kasan_check_read+0x11/0x20 [ 149.992276][ T643] ? delete_node+0x759/0x7b0 [ 149.997706][ T381] RBP: ffffc90000b37d70 R08: ffffffff81b68c08 R09: 0000000000000003 [ 150.002615][ T643] ? __kasan_check_write+0x14/0x20 [ 150.002626][ T643] ? idr_replace+0x1c4/0x230 [ 150.002642][ T643] ? idr_get_next+0x4b0/0x4b0 [ 150.022250][ T381] R10: fffff52000166f85 R11: 1ffff92000166f84 R12: dffffc0000000000 [ 150.026879][ T643] ? _raw_spin_lock_bh+0xa3/0x1b0 [ 150.031711][ T381] R13: ffff88811d953a40 R14: ffffc90000b37d00 R15: 1ffff92000166f9c [ 150.035913][ T643] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 150.040569][ T381] FS: 0000555556fab300(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 150.045644][ T643] css_populate_dir+0x137/0x370 [ 150.051684][ T381] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 150.056760][ T643] cgroup_apply_control_enable+0x8b9/0x12f0 [ 150.059056][ T381] CR2: 00007fc8ececd130 CR3: 000000011dddb000 CR4: 00000000003506a0 [ 150.064048][ T643] cgroup_apply_control+0x93/0x710 [ 150.064058][ T643] ? css_next_child+0x160/0x160 [ 150.064067][ T643] ? io_schedule+0x120/0x120 [ 150.064083][ T643] ? kernfs_fop_write_iter+0x15e/0x410 [ 150.068731][ T381] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 150.076674][ T643] ? __kasan_check_write+0x14/0x20 [ 150.076692][ T643] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 150.082208][ T381] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [pid 381] umount2("./43/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 643] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 643] close(3) = 0 [pid 643] close(4) = 0 [pid 643] close(5) = 0 [pid 643] close(6) = -1 EBADF (Bad file descriptor) [pid 643] close(7) = -1 EBADF (Bad file descriptor) [pid 643] close(8) = -1 EBADF (Bad file descriptor) [pid 643] close(9) = -1 EBADF (Bad file descriptor) [pid 643] close(10) = -1 EBADF (Bad file descriptor) [pid 643] close(11) = -1 EBADF (Bad file descriptor) [pid 643] close(12) = -1 EBADF (Bad file descriptor) [pid 643] close(13) = -1 EBADF (Bad file descriptor) [pid 643] close(14) = -1 EBADF (Bad file descriptor) [pid 643] close(15) = -1 EBADF (Bad file descriptor) [pid 643] close(16) = -1 EBADF (Bad file descriptor) [pid 643] close(17) = -1 EBADF (Bad file descriptor) [pid 643] close(18) = -1 EBADF (Bad file descriptor) [pid 643] close(19) = -1 EBADF (Bad file descriptor) [pid 643] close(20) = -1 EBADF (Bad file descriptor) [pid 643] close(21) = -1 EBADF (Bad file descriptor) [pid 643] close(22) = -1 EBADF (Bad file descriptor) [pid 643] close(23) = -1 EBADF (Bad file descriptor) [pid 643] close(24) = -1 EBADF (Bad file descriptor) [pid 643] close(25) = -1 EBADF (Bad file descriptor) [pid 643] close(26) = -1 EBADF (Bad file descriptor) [pid 643] close(27) = -1 EBADF (Bad file descriptor) [pid 643] close(28) = -1 EBADF (Bad file descriptor) [pid 643] close(29) = -1 EBADF (Bad file descriptor) [pid 643] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory ) = 89 [pid 643] exit_group(0) = ? [pid 643] +++ exited with 0 +++ [ 150.088330][ T643] cgroup_subtree_control_write+0xd19/0x1310 [ 150.096286][ T381] Call Trace: [ 150.100838][ T643] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 150.100854][ T643] ? __kasan_check_write+0x14/0x20 [ 150.105849][ T381] ? lockref_get_or_lock+0x340/0x340 [ 150.110401][ T643] ? _copy_from_iter+0x3fb/0xd60 [ 150.110410][ T643] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 150.110425][ T643] cgroup_file_write+0x28e/0x590 [ 150.118375][ T381] ? umount_tree+0xf50/0xf50 [ 150.123468][ T643] ? cgroup_seqfile_stop+0xc0/0xc0 [pid 375] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=48, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [ 150.123478][ T643] ? mutex_lock+0xa6/0x110 [ 150.123485][ T643] ? mutex_trylock+0xb0/0xb0 [ 150.123501][ T643] ? __kasan_check_write+0x14/0x20 [ 150.128060][ T381] ? vfs_submount+0xb0/0xb0 [ 150.132700][ T643] kernfs_fop_write_iter+0x2d0/0x410 [ 150.132708][ T643] ? cgroup_seqfile_stop+0xc0/0xc0 [ 150.132724][ T643] vfs_write+0xc1c/0xf40 [ 150.140676][ T381] ? dput+0x2b6/0x320 [ 150.145659][ T643] ? __kasan_check_write+0x14/0x20 [ 150.153611][ T381] path_umount+0x1fe/0xfb0 [ 150.158774][ T643] ? kernel_write+0x3c0/0x3c0 [ 150.167681][ T381] ? namespace_unlock+0x4f0/0x4f0 [ 150.172483][ T643] ? _raw_spin_unlock_irq+0x4e/0x70 [ 150.172499][ T643] ? ptrace_stop+0x6ff/0x9f0 [ 150.179054][ T381] ? user_path_at_empty+0x40/0x50 [ 150.184904][ T643] ? __kasan_check_read+0x11/0x20 [ 150.184913][ T643] ? __fdget_pos+0x27e/0x310 [ 150.184921][ T643] ksys_write+0x198/0x2c0 [ 150.184937][ T643] ? do_notify_parent+0xa60/0xa60 [ 150.192888][ T381] __x64_sys_umount+0x122/0x170 [ 150.197962][ T643] ? __ia32_sys_read+0x90/0x90 [ 150.202786][ T381] ? path_umount+0xfb0/0xfb0 [ 150.207336][ T643] ? __ia32_sys_open+0x270/0x270 [ 150.212773][ T381] ? syscall_enter_from_user_mode+0x58/0x1b0 [ 150.220699][ T643] __x64_sys_write+0x7b/0x90 [ 150.220715][ T643] do_syscall_64+0x34/0x70 [ 150.225796][ T381] do_syscall_64+0x34/0x70 [ 150.231041][ T643] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 150.231049][ T643] RIP: 0033:0x7fc8ece62c09 [ 150.231066][ T643] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 150.239006][ T381] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 150.244942][ T643] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 150.244954][ T643] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 150.244960][ T643] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 150.244973][ T643] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 150.248235][ T381] RIP: 0033:0x7fc8ece63fb7 [ 150.254172][ T643] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 150.254179][ T643] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 000000000000002e [ 150.268753][ T643] cgroup: cgroup_addrm_files: failed to add max, err=-12 [ 150.269454][ T381] Code: 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 375] umount2("./46", MNT_DETACH|UMOUNT_NOFOLLOW [pid 381] <... umount2 resumed>) = 0 [pid 381] umount2("./43/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./43/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 381] umount2("./43/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] openat(AT_FDCWD, "./43/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 381] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 381] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 381] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 381] close(4) = 0 [pid 381] rmdir("./43/file0") = 0 [pid 381] umount2("./43/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./43/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 381] unlink("./43/cgroup.cpu") = 0 [pid 381] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 381] close(3) = 0 [pid 381] rmdir("./43") = 0 [pid 381] mkdir("./44", 0777 [pid 375] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 381] <... mkdir resumed>) = 0 [pid 375] openat(AT_FDCWD, "./46", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 381] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556fab5d0) = 46 [pid 375] <... openat resumed>) = 3 [pid 375] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 375] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 375] umount2("./46/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./46/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 375] unlink("./46/binderfs") = 0 ./strace-static-x86_64: Process 646 attached [pid 646] chdir("./44" [pid 375] umount2("./46/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW [pid 646] <... chdir resumed>) = 0 [pid 646] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 646] setpgid(0, 0) = 0 [pid 375] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 375] lstat("./46/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 646] symlink("/syzcgroup/unified/syz3", "./cgroup" [pid 375] unlink("./46/cgroup") = 0 [pid 646] <... symlink resumed>) = 0 [pid 375] umount2("./46/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW [pid 646] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu" [pid 375] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 375] lstat("./46/cgroup.net", [pid 646] <... symlink resumed>) = 0 [pid 646] symlink("/syzcgroup/net/syz3", "./cgroup.net" [pid 375] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 646] <... symlink resumed>) = 0 [pid 375] unlink("./46/cgroup.net" [pid 646] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 646] write(3, "1000", 4) = 4 [pid 646] close(3) = 0 [pid 646] symlink("/dev/binderfs", "./binderfs" [pid 375] <... unlink resumed>) = 0 [pid 375] umount2("./46/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 646] <... symlink resumed>) = 0 [pid 646] mkdirat(AT_FDCWD, "./file0", 000 [pid 375] <... umount2 resumed>) = 0 [pid 646] <... mkdirat resumed>) = 0 [ 150.534904][ T381] RSP: 002b:00007ffd7d0e2358 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [ 150.543341][ T381] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc8ece63fb7 [ 150.551319][ T381] RDX: 00007ffd7d0e241a RSI: 000000000000000a RDI: 00007ffd7d0e2410 [ 150.559270][ T381] RBP: 00007ffd7d0e2410 R08: 00000000ffffffff R09: 00007ffd7d0e21f0 [ 150.567254][ T381] R10: 0000555556fad6a3 R11: 0000000000000202 R12: 00007ffd7d0e3490 [ 150.575219][ T381] R13: 0000555556fad600 R14: 00007ffd7d0e2380 R15: 000000000000002c [ 150.583205][ T381] ---[ end trace d4de1ca9cdcd1996 ]--- [pid 646] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 375] umount2("./46/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 646] open("./file0", O_RDONLY) = 3 [pid 646] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [pid 646] write(4, "-pids ", 6 [pid 375] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 375] lstat("./46/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 375] umount2("./46/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] openat(AT_FDCWD, "./46/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 375] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 375] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 375] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 375] close(4) = 0 [pid 375] rmdir("./46/file0") = 0 [pid 375] umount2("./46/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./46/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 375] unlink("./46/cgroup.cpu") = 0 [pid 375] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 375] close(3) = 0 [pid 375] rmdir("./46") = 0 [pid 375] mkdir("./47", 0777) = 0 [pid 375] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556fab5d0) = 49 ./strace-static-x86_64: Process 647 attached [pid 647] chdir("./47") = 0 [pid 647] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 647] setpgid(0, 0) = 0 [pid 647] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 647] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 647] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 647] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 647] write(3, "1000", 4) = 4 [pid 647] close(3) = 0 [pid 647] symlink("/dev/binderfs", "./binderfs") = 0 [pid 647] mkdirat(AT_FDCWD, "./file0", 000) = 0 [ 150.610498][ T642] FAULT_INJECTION: forcing a failure. [ 150.610498][ T642] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 150.623842][ T642] CPU: 0 PID: 642 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 150.635454][ T642] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 150.645485][ T642] Call Trace: [ 150.648763][ T642] dump_stack_lvl+0x1e2/0x24b [ 150.653423][ T642] ? bfq_pos_tree_add_move+0x43e/0x43e [ 150.658863][ T642] ? __kasan_check_write+0x14/0x20 [ 150.663951][ T642] ? _raw_spin_lock_irq+0xa4/0x1b0 [ 150.669040][ T642] dump_stack+0x15/0x17 [ 150.673169][ T642] should_fail+0x3c0/0x510 [ 150.677557][ T642] should_fail_alloc_page+0x50/0x60 [ 150.682738][ T642] __alloc_pages_nodemask+0x1c0/0x890 [ 150.688100][ T642] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 150.694243][ T642] ? gfp_pfmemalloc_allowed+0x120/0x120 [ 150.699776][ T642] allocate_slab+0x78/0x540 [ 150.704286][ T642] ___slab_alloc+0x131/0x2e0 [ 150.708858][ T642] ? pids_css_alloc+0x4e/0x120 [ 150.713591][ T642] __slab_alloc+0x63/0xa0 [ 150.717892][ T642] ? pids_css_alloc+0x4e/0x120 [ 150.722628][ T642] kmem_cache_alloc_trace+0x20e/0x330 [ 150.727972][ T642] ? pids_css_alloc+0x4e/0x120 [ 150.732709][ T642] pids_css_alloc+0x4e/0x120 [ 150.737280][ T642] cgroup_apply_control_enable+0x350/0x12f0 [ 150.743167][ T642] cgroup_apply_control+0x93/0x710 [ 150.748258][ T642] ? css_next_child+0x160/0x160 [ 150.753079][ T642] ? stack_trace_save+0x12d/0x1f0 [ 150.758086][ T642] ? io_schedule+0x120/0x120 [ 150.762664][ T642] ? kernfs_fop_write_iter+0x15e/0x410 [ 150.768104][ T642] ? __kasan_check_write+0x14/0x20 [ 150.773186][ T642] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 150.778440][ T642] cgroup_subtree_control_write+0xd19/0x1310 [ 150.784392][ T642] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 150.790347][ T642] ? __kasan_check_write+0x14/0x20 [ 150.795433][ T642] ? _copy_from_iter+0x3fb/0xd60 [ 150.800340][ T642] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 150.806289][ T642] cgroup_file_write+0x28e/0x590 [ 150.811204][ T642] ? cgroup_seqfile_stop+0xc0/0xc0 [ 150.816300][ T642] ? mutex_lock+0xa6/0x110 [ 150.820685][ T642] ? mutex_trylock+0xb0/0xb0 [ 150.825248][ T642] ? __kasan_check_write+0x14/0x20 [ 150.830331][ T642] kernfs_fop_write_iter+0x2d0/0x410 [ 150.835585][ T642] ? cgroup_seqfile_stop+0xc0/0xc0 [ 150.840665][ T642] vfs_write+0xc1c/0xf40 [ 150.844878][ T642] ? __kasan_check_write+0x14/0x20 [ 150.849968][ T642] ? kernel_write+0x3c0/0x3c0 [ 150.854625][ T642] ? _raw_spin_unlock_irq+0x4e/0x70 [ 150.859798][ T642] ? ptrace_stop+0x6ff/0x9f0 [ 150.864359][ T642] ? __kasan_check_read+0x11/0x20 [ 150.869362][ T642] ? __fdget_pos+0x27e/0x310 [ 150.873923][ T642] ksys_write+0x198/0x2c0 [ 150.878228][ T642] ? do_notify_parent+0xa60/0xa60 [ 150.883222][ T642] ? __ia32_sys_read+0x90/0x90 [ 150.887954][ T642] ? __ia32_sys_open+0x270/0x270 [ 150.892871][ T642] __x64_sys_write+0x7b/0x90 [ 150.897445][ T642] do_syscall_64+0x34/0x70 [ 150.901845][ T642] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 150.907729][ T642] RIP: 0033:0x7fc8ece62c09 [ 150.912134][ T642] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 150.931720][ T642] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 150.940111][ T642] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 150.948061][ T642] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [pid 647] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 642] <... write resumed>) = 6 [pid 642] close(3) = 0 [pid 642] close(4) = 0 [pid 642] close(5) = 0 [pid 642] close(6 [pid 646] <... write resumed>) = 6 [pid 642] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 642] close(7) = -1 EBADF (Bad file descriptor) [pid 642] close(8) = -1 EBADF (Bad file descriptor) [pid 642] close(9) = -1 EBADF (Bad file descriptor) [pid 642] close(10) = -1 EBADF (Bad file descriptor) [pid 642] close(11) = -1 EBADF (Bad file descriptor) [pid 642] close(12) = -1 EBADF (Bad file descriptor) [pid 642] close(13) = -1 EBADF (Bad file descriptor) [pid 642] close(14) = -1 EBADF (Bad file descriptor) [pid 642] close(15) = -1 EBADF (Bad file descriptor) [pid 642] close(16) = -1 EBADF (Bad file descriptor) [pid 642] close(17) = -1 EBADF (Bad file descriptor) [pid 642] close(18) = -1 EBADF (Bad file descriptor) [pid 642] close(19) = -1 EBADF (Bad file descriptor) [pid 642] close(20) = -1 EBADF (Bad file descriptor) [pid 642] close(21) = -1 EBADF (Bad file descriptor) [pid 642] close(22) = -1 EBADF (Bad file descriptor) [pid 642] close(23) = -1 EBADF (Bad file descriptor) [pid 642] close(24) = -1 EBADF (Bad file descriptor) [pid 642] close(25) = -1 EBADF (Bad file descriptor) [pid 642] close(26) = -1 EBADF (Bad file descriptor) write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory [pid 642] close(27) = -1 EBADF (Bad file descriptor) [pid 642] close(28) = -1 EBADF (Bad file descriptor) [pid 642] close(29) = -1 EBADF (Bad file descriptor) [pid 642] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 642] exit_group(0) = ? [pid 642] +++ exited with 0 +++ [pid 646] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 647] <... mount resumed>) = 0 [pid 646] <... openat resumed>) = 5 [pid 646] write(5, "22", 2) = 2 [pid 646] write(4, "+pids ", 6 [pid 647] open("./file0", O_RDONLY [pid 382] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=48, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 647] <... open resumed>) = 3 [pid 647] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [pid 647] write(4, "-pids ", 6 [pid 382] umount2("./46", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] openat(AT_FDCWD, "./46", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 382] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 382] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 382] umount2("./46/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./46/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 382] unlink("./46/binderfs") = 0 [pid 382] umount2("./46/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./46/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 382] unlink("./46/cgroup") = 0 [pid 382] umount2("./46/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./46/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 382] unlink("./46/cgroup.net") = 0 [pid 382] umount2("./46/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 382] umount2("./46/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./46/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 382] umount2("./46/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] openat(AT_FDCWD, "./46/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 382] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 382] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 382] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 382] close(4) = 0 [pid 382] rmdir("./46/file0") = 0 [pid 382] umount2("./46/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./46/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 382] unlink("./46/cgroup.cpu") = 0 [pid 382] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 382] close(3) = 0 [pid 382] rmdir("./46") = 0 [pid 382] mkdir("./47", 0777) = 0 [pid 382] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 648 attached , child_tidptr=0x555556fab5d0) = 49 [pid 648] chdir("./47") = 0 [pid 648] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 648] setpgid(0, 0) = 0 [pid 648] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 648] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [pid 648] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 648] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 648] write(3, "1000", 4) = 4 [pid 648] close(3) = 0 [pid 648] symlink("/dev/binderfs", "./binderfs") = 0 [pid 648] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 648] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 648] open("./file0", O_RDONLY) = 3 [pid 648] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [ 150.956010][ T642] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 150.963965][ T642] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 150.971907][ T642] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 000000000000002e [ 151.000459][ T646] FAULT_INJECTION: forcing a failure. [ 151.000459][ T646] name failslab, interval 1, probability 0, space 0, times 0 [ 151.013119][ T646] CPU: 0 PID: 646 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 151.024730][ T646] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 151.034755][ T646] Call Trace: [ 151.038022][ T646] dump_stack_lvl+0x1e2/0x24b [ 151.042673][ T646] ? bfq_pos_tree_add_move+0x43e/0x43e [ 151.048106][ T646] ? selinux_kernfs_init_security+0x1a8/0x760 [ 151.054144][ T646] dump_stack+0x15/0x17 [ 151.058281][ T646] should_fail+0x3c0/0x510 [ 151.062679][ T646] ? __kernfs_new_node+0x99/0x6e0 [ 151.067676][ T646] __should_failslab+0x9f/0xe0 [ 151.072414][ T646] should_failslab+0x9/0x20 [ 151.076901][ T646] __kmalloc_track_caller+0x5f/0x350 [ 151.082173][ T646] kstrdup_const+0x55/0x90 [ 151.086600][ T646] __kernfs_new_node+0x99/0x6e0 [ 151.091434][ T646] ? is_module_text_address+0xe1/0x140 [ 151.096863][ T646] ? kernfs_new_node+0x170/0x170 [ 151.101781][ T646] ? ptr_to_hashval+0x60/0x60 [ 151.106437][ T646] ? arch_stack_walk+0xf8/0x140 [ 151.111267][ T646] ? snprintf+0xd6/0x120 [ 151.115501][ T646] kernfs_new_node+0x97/0x170 [ 151.120165][ T646] __kernfs_create_file+0x4a/0x270 [ 151.125268][ T646] cgroup_addrm_files+0xab8/0xfe0 [ 151.130274][ T646] ? ____kasan_kmalloc+0xdc/0x110 [ 151.135272][ T646] ? __kasan_kmalloc+0x9/0x10 [ 151.139920][ T646] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 151.145438][ T646] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 151.151562][ T646] ? delete_node+0x759/0x7b0 [ 151.156125][ T646] ? __kasan_check_read+0x11/0x20 [ 151.161126][ T646] ? delete_node+0x759/0x7b0 [ 151.165690][ T646] ? __kasan_check_write+0x14/0x20 [ 151.170775][ T646] ? idr_replace+0x1c4/0x230 [ 151.175348][ T646] ? idr_get_next+0x4b0/0x4b0 [ 151.180005][ T646] ? _raw_spin_lock_bh+0xa3/0x1b0 [ 151.185007][ T646] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 151.190190][ T646] css_populate_dir+0x137/0x370 [ 151.195028][ T646] cgroup_apply_control_enable+0x8b9/0x12f0 [ 151.200923][ T646] cgroup_apply_control+0x93/0x710 [ 151.206020][ T646] ? css_next_child+0x160/0x160 [ 151.210843][ T646] ? stack_trace_save+0x12d/0x1f0 [ 151.215855][ T646] ? io_schedule+0x120/0x120 [ 151.220428][ T646] ? kernfs_fop_write_iter+0x15e/0x410 [ 151.225867][ T646] ? __kasan_check_write+0x14/0x20 [ 151.230962][ T646] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 151.236220][ T646] cgroup_subtree_control_write+0xd19/0x1310 [ 151.242173][ T646] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 151.248124][ T646] ? __kasan_check_write+0x14/0x20 [ 151.253219][ T646] ? _copy_from_iter+0x3fb/0xd60 [ 151.258137][ T646] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 151.264089][ T646] cgroup_file_write+0x28e/0x590 [ 151.269008][ T646] ? cgroup_seqfile_stop+0xc0/0xc0 [ 151.274099][ T646] ? mutex_lock+0xa6/0x110 [ 151.278494][ T646] ? mutex_trylock+0xb0/0xb0 [ 151.283063][ T646] ? __kasan_check_write+0x14/0x20 [ 151.288158][ T646] kernfs_fop_write_iter+0x2d0/0x410 [ 151.293426][ T646] ? cgroup_seqfile_stop+0xc0/0xc0 [ 151.298576][ T646] vfs_write+0xc1c/0xf40 [ 151.302818][ T646] ? __kasan_check_write+0x14/0x20 [ 151.307920][ T646] ? kernel_write+0x3c0/0x3c0 [ 151.312587][ T646] ? _raw_spin_unlock_irq+0x4e/0x70 [ 151.317758][ T646] ? ptrace_stop+0x6ff/0x9f0 [ 151.322322][ T646] ? __kasan_check_read+0x11/0x20 [ 151.327326][ T646] ? __fdget_pos+0x27e/0x310 [ 151.331900][ T646] ksys_write+0x198/0x2c0 [ 151.336209][ T646] ? do_notify_parent+0xa60/0xa60 [ 151.341212][ T646] ? __ia32_sys_read+0x90/0x90 [ 151.345946][ T646] ? __ia32_sys_open+0x270/0x270 [ 151.350857][ T646] __x64_sys_write+0x7b/0x90 [ 151.355420][ T646] do_syscall_64+0x34/0x70 [ 151.359808][ T646] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 151.365674][ T646] RIP: 0033:0x7fc8ece62c09 [ 151.370062][ T646] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 151.389646][ T646] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 151.398052][ T646] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 151.406005][ T646] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [pid 648] write(4, "-pids ", 6 [pid 646] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 646] close(3) = 0 [pid 646] close(4) = 0 [pid 646] close(5) = 0 [pid 646] close(6) = -1 EBADF (Bad file descriptor) [pid 646] close(7) = -1 EBADF (Bad file descriptor) [pid 646] close(8) = -1 EBADF (Bad file descriptor) [pid 646] close(9) = -1 EBADF (Bad file descriptor) [pid 646] close(10) = -1 EBADF (Bad file descriptor) [pid 646] close(11) = -1 EBADF (Bad file descriptor) [pid 646] close(12) = -1 EBADF (Bad file descriptor) [pid 646] close(13) = -1 EBADF (Bad file descriptor) [pid 646] close(14) = -1 EBADF (Bad file descriptor) [pid 646] close(15) = -1 EBADF (Bad file descriptor) [pid 646] close(16) = -1 EBADF (Bad file descriptor) [pid 646] close(17) = -1 EBADF (Bad file descriptor) [pid 646] close(18) = -1 EBADF (Bad file descriptor) [pid 646] close(19) = -1 EBADF (Bad file descriptor) [pid 646] close(20) = -1 EBADF (Bad file descriptor) [pid 646] close(21) = -1 EBADF (Bad file descriptor) [pid 646] close(22) = -1 EBADF (Bad file descriptor) [pid 646] close(23) = -1 EBADF (Bad file descriptor) [pid 646] close(24) = -1 EBADF (Bad file descriptor) [pid 646] close(25) = -1 EBADF (Bad file descriptor) [pid 646] close(26) = -1 EBADF (Bad file descriptor) [pid 646] close(27) = -1 EBADF (Bad file descriptor) [pid 646] close(28) = -1 EBADF (Bad file descriptor) [pid 646] close(29) = -1 EBADF (Bad file descriptor) [pid 646] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory ) = 89 [pid 646] exit_group(0) = ? [pid 646] +++ exited with 0 +++ [pid 381] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=46, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 381] umount2("./44", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] openat(AT_FDCWD, "./44", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 381] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 381] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 381] umount2("./44/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./44/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 381] unlink("./44/binderfs") = 0 [pid 381] umount2("./44/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./44/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 381] unlink("./44/cgroup") = 0 [pid 381] umount2("./44/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./44/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 381] unlink("./44/cgroup.net") = 0 [pid 381] umount2("./44/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 381] umount2("./44/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./44/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 381] umount2("./44/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] openat(AT_FDCWD, "./44/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 381] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 381] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 381] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [ 151.413954][ T646] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 151.421908][ T646] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 151.429853][ T646] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 000000000000002c [ 151.437979][ T646] cgroup: cgroup_addrm_files: failed to add max, err=-12 [pid 381] close(4) = 0 [pid 381] rmdir("./44/file0") = 0 [pid 381] umount2("./44/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./44/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 381] unlink("./44/cgroup.cpu") = 0 [pid 381] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 381] close(3) = 0 [pid 381] rmdir("./44") = 0 [pid 381] mkdir("./45", 0777) = 0 [pid 381] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 649 attached [pid 649] chdir("./45" [pid 381] <... clone resumed>, child_tidptr=0x555556fab5d0) = 47 [pid 649] <... chdir resumed>) = 0 [pid 649] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 649] setpgid(0, 0) = 0 [pid 649] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [pid 649] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 649] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 649] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 649] write(3, "1000", 4) = 4 [pid 649] close(3) = 0 [pid 649] symlink("/dev/binderfs", "./binderfs") = 0 [pid 649] mkdirat(AT_FDCWD, "./file0", 000) = 0 [ 151.470395][ T645] FAULT_INJECTION: forcing a failure. [ 151.470395][ T645] name failslab, interval 1, probability 0, space 0, times 0 [ 151.483067][ T645] CPU: 1 PID: 645 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 151.494702][ T645] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 151.504740][ T645] Call Trace: [ 151.508023][ T645] dump_stack_lvl+0x1e2/0x24b [ 151.512684][ T645] ? bfq_pos_tree_add_move+0x43e/0x43e [ 151.518123][ T645] ? selinux_kernfs_init_security+0x1a8/0x760 [ 151.524170][ T645] dump_stack+0x15/0x17 [ 151.528304][ T645] should_fail+0x3c0/0x510 [ 151.532703][ T645] ? __kernfs_new_node+0x99/0x6e0 [ 151.537707][ T645] __should_failslab+0x9f/0xe0 [ 151.542452][ T645] should_failslab+0x9/0x20 [ 151.546929][ T645] __kmalloc_track_caller+0x5f/0x350 [ 151.552199][ T645] kstrdup_const+0x55/0x90 [ 151.556605][ T645] __kernfs_new_node+0x99/0x6e0 [ 151.561435][ T645] ? is_module_text_address+0xe1/0x140 [ 151.566872][ T645] ? kernfs_new_node+0x170/0x170 [ 151.571790][ T645] ? ptr_to_hashval+0x60/0x60 [ 151.576436][ T645] ? arch_stack_walk+0xf8/0x140 [ 151.581265][ T645] ? snprintf+0xd6/0x120 [ 151.585506][ T645] kernfs_new_node+0x97/0x170 [ 151.590174][ T645] __kernfs_create_file+0x4a/0x270 [ 151.595262][ T645] cgroup_addrm_files+0xab8/0xfe0 [ 151.600369][ T645] ? ____kasan_kmalloc+0xdc/0x110 [ 151.605365][ T645] ? __kasan_kmalloc+0x9/0x10 [ 151.610020][ T645] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 151.615547][ T645] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 151.621682][ T645] ? delete_node+0x759/0x7b0 [ 151.626260][ T645] ? __kasan_check_read+0x11/0x20 [ 151.631264][ T645] ? delete_node+0x759/0x7b0 [ 151.635830][ T645] ? __kasan_check_write+0x14/0x20 [ 151.640924][ T645] ? idr_replace+0x1c4/0x230 [ 151.645508][ T645] ? idr_get_next+0x4b0/0x4b0 [ 151.650170][ T645] ? _raw_spin_lock_bh+0xa3/0x1b0 [ 151.655179][ T645] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 151.660358][ T645] css_populate_dir+0x137/0x370 [ 151.665193][ T645] cgroup_apply_control_enable+0x8b9/0x12f0 [ 151.671073][ T645] cgroup_apply_control+0x93/0x710 [ 151.676157][ T645] ? css_next_child+0x160/0x160 [ 151.680988][ T645] ? stack_trace_save+0x12d/0x1f0 [ 151.686001][ T645] ? io_schedule+0x120/0x120 [ 151.690571][ T645] ? kernfs_fop_write_iter+0x15e/0x410 [ 151.696008][ T645] ? __kasan_check_write+0x14/0x20 [ 151.701110][ T645] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 151.706387][ T645] cgroup_subtree_control_write+0xd19/0x1310 [ 151.712350][ T645] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 151.718314][ T645] ? __kasan_check_write+0x14/0x20 [ 151.723414][ T645] ? _copy_from_iter+0x3fb/0xd60 [ 151.728337][ T645] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 151.734290][ T645] cgroup_file_write+0x28e/0x590 [ 151.739201][ T645] ? cgroup_seqfile_stop+0xc0/0xc0 [ 151.744287][ T645] ? mutex_lock+0xa6/0x110 [ 151.748678][ T645] ? mutex_trylock+0xb0/0xb0 [ 151.753242][ T645] ? __kasan_check_write+0x14/0x20 [ 151.758327][ T645] kernfs_fop_write_iter+0x2d0/0x410 [ 151.763582][ T645] ? cgroup_seqfile_stop+0xc0/0xc0 [ 151.768672][ T645] vfs_write+0xc1c/0xf40 [ 151.772894][ T645] ? __kasan_check_write+0x14/0x20 [ 151.778005][ T645] ? kernel_write+0x3c0/0x3c0 [ 151.782670][ T645] ? _raw_spin_unlock_irq+0x4e/0x70 [ 151.787854][ T645] ? ptrace_stop+0x6ff/0x9f0 [ 151.792414][ T645] ? __kasan_check_read+0x11/0x20 [ 151.797410][ T645] ? __fdget_pos+0x27e/0x310 [ 151.801979][ T645] ksys_write+0x198/0x2c0 [ 151.806291][ T645] ? do_notify_parent+0xa60/0xa60 [ 151.811294][ T645] ? __ia32_sys_read+0x90/0x90 [ 151.816041][ T645] ? __ia32_sys_open+0x270/0x270 [ 151.820959][ T645] __x64_sys_write+0x7b/0x90 [ 151.825520][ T645] do_syscall_64+0x34/0x70 [ 151.829912][ T645] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 151.837702][ T645] RIP: 0033:0x7fc8ece62c09 [ 151.842106][ T645] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 151.861693][ T645] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 649] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 645] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 649] <... mount resumed>) = 0 [pid 649] open("./file0", O_RDONLY [pid 645] close(3 [pid 649] <... open resumed>) = 3 [pid 649] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [pid 649] write(4, "-pids ", 6 [pid 645] <... close resumed>) = 0 [pid 645] close(4) = 0 [pid 645] close(5) = 0 [pid 645] close(6) = -1 EBADF (Bad file descriptor) [pid 645] close(7) = -1 EBADF (Bad file descriptor) [pid 645] close(8) = -1 EBADF (Bad file descriptor) [pid 645] close(9) = -1 EBADF (Bad file descriptor) [pid 645] close(10) = -1 EBADF (Bad file descriptor) [pid 645] close(11) = -1 EBADF (Bad file descriptor) [pid 645] close(12) = -1 EBADF (Bad file descriptor) [pid 645] close(13) = -1 EBADF (Bad file descriptor) [pid 645] close(14) = -1 EBADF (Bad file descriptor) [pid 645] close(15) = -1 EBADF (Bad file descriptor) [pid 645] close(16) = -1 EBADF (Bad file descriptor) [pid 645] close(17) = -1 EBADF (Bad file descriptor) [pid 645] close(18) = -1 EBADF (Bad file descriptor) [pid 645] close(19) = -1 EBADF (Bad file descriptor) [pid 645] close(20) = -1 EBADF (Bad file descriptor) [pid 645] close(21) = -1 EBADF (Bad file descriptor) [pid 645] close(22) = -1 EBADF (Bad file descriptor) [pid 645] close(23) = -1 EBADF (Bad file descriptor) [pid 645] close(24) = -1 EBADF (Bad file descriptor) [pid 645] close(25) = -1 EBADF (Bad file descriptor) [pid 645] close(26) = -1 EBADF (Bad file descriptor) [pid 645] close(27) = -1 EBADF (Bad file descriptor) [pid 645] close(28) = -1 EBADF (Bad file descriptor) [pid 645] close(29) = -1 EBADF (Bad file descriptor) [pid 645] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory ) = 89 [pid 645] exit_group(0) = ? [pid 645] +++ exited with 0 +++ [pid 376] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=44, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 376] umount2("./42", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] openat(AT_FDCWD, "./42", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 376] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 376] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 376] umount2("./42/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./42/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 376] unlink("./42/binderfs") = 0 [pid 376] umount2("./42/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./42/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 376] unlink("./42/cgroup") = 0 [pid 376] umount2("./42/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 151.870104][ T645] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 151.878063][ T645] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 151.886020][ T645] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 151.893967][ T645] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 151.901916][ T645] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 000000000000002a [ 151.911590][ T645] cgroup: cgroup_addrm_files: failed to add max, err=-12 [pid 376] lstat("./42/cgroup.net", [pid 649] <... write resumed>) = 6 [pid 648] <... write resumed>) = 6 [pid 649] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 649] write(5, "22", 2) = 2 [pid 649] write(4, "+pids ", 6 [pid 648] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 648] write(5, "22", 2) = 2 [pid 648] write(4, "+pids ", 6 [pid 376] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 376] unlink("./42/cgroup.net") = 0 [ 151.930588][ T641] FAULT_INJECTION: forcing a failure. [ 151.930588][ T641] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 151.944777][ T641] CPU: 1 PID: 641 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 151.956398][ T641] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 151.966436][ T641] Call Trace: [ 151.969715][ T641] dump_stack_lvl+0x1e2/0x24b [ 151.974376][ T641] ? bfq_pos_tree_add_move+0x43e/0x43e [ 151.979808][ T641] ? __kasan_check_write+0x14/0x20 [ 151.984894][ T641] ? _raw_spin_lock_irq+0xa4/0x1b0 [ 151.989983][ T641] dump_stack+0x15/0x17 [ 151.994113][ T641] should_fail+0x3c0/0x510 [ 151.998513][ T641] should_fail_alloc_page+0x50/0x60 [ 152.003699][ T641] __alloc_pages_nodemask+0x1c0/0x890 [ 152.009043][ T641] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 152.015170][ T641] ? gfp_pfmemalloc_allowed+0x120/0x120 [ 152.020688][ T641] allocate_slab+0x78/0x540 [ 152.025165][ T641] ___slab_alloc+0x131/0x2e0 [ 152.029735][ T641] ? pids_css_alloc+0x4e/0x120 [ 152.034477][ T641] __slab_alloc+0x63/0xa0 [ 152.038788][ T641] ? pids_css_alloc+0x4e/0x120 [ 152.043537][ T641] kmem_cache_alloc_trace+0x20e/0x330 [ 152.048884][ T641] ? pids_css_alloc+0x4e/0x120 [ 152.053628][ T641] pids_css_alloc+0x4e/0x120 [ 152.058195][ T641] cgroup_apply_control_enable+0x350/0x12f0 [ 152.064070][ T641] cgroup_apply_control+0x93/0x710 [ 152.069166][ T641] ? css_next_child+0x160/0x160 [ 152.073989][ T641] ? io_schedule+0x120/0x120 [ 152.078552][ T641] ? kernfs_fop_write_iter+0x15e/0x410 [ 152.083983][ T641] ? __kasan_check_write+0x14/0x20 [ 152.089068][ T641] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 152.094330][ T641] cgroup_subtree_control_write+0xd19/0x1310 [ 152.100381][ T641] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 152.106340][ T641] ? __kasan_check_write+0x14/0x20 [ 152.111430][ T641] ? _copy_from_iter+0x3fb/0xd60 [ 152.116353][ T641] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 152.122317][ T641] cgroup_file_write+0x28e/0x590 [pid 376] umount2("./42/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 380] kill(-42, SIGKILL) = 0 [pid 380] kill(42, SIGKILL) = 0 [ 152.127224][ T641] ? cgroup_seqfile_stop+0xc0/0xc0 [ 152.132316][ T641] ? mutex_lock+0xa6/0x110 [ 152.136712][ T641] ? mutex_trylock+0xb0/0xb0 [ 152.141273][ T641] ? __kasan_check_write+0x14/0x20 [ 152.146355][ T641] kernfs_fop_write_iter+0x2d0/0x410 [ 152.151613][ T641] ? cgroup_seqfile_stop+0xc0/0xc0 [ 152.156696][ T641] vfs_write+0xc1c/0xf40 [ 152.160909][ T641] ? __kasan_check_write+0x14/0x20 [ 152.166031][ T641] ? kernel_write+0x3c0/0x3c0 [ 152.170686][ T641] ? _raw_spin_unlock_irq+0x4e/0x70 [ 152.175868][ T641] ? ptrace_stop+0x6ff/0x9f0 [ 152.180457][ T641] ? __kasan_check_read+0x11/0x20 [ 152.185468][ T641] ? __fdget_pos+0x27e/0x310 [ 152.190031][ T641] ksys_write+0x198/0x2c0 [ 152.194332][ T641] ? do_notify_parent+0xa60/0xa60 [ 152.199326][ T641] ? __ia32_sys_read+0x90/0x90 [ 152.204058][ T641] ? __ia32_sys_open+0x270/0x270 [ 152.208969][ T641] __x64_sys_write+0x7b/0x90 [ 152.213533][ T641] do_syscall_64+0x34/0x70 [ 152.217928][ T641] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 152.223795][ T641] RIP: 0033:0x7fc8ece62c09 [ 152.228182][ T641] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 152.247757][ T641] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 152.256138][ T641] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 152.264084][ T641] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 152.272033][ T641] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [pid 649] <... write resumed>) = 6 [pid 647] <... write resumed>) = 6 [pid 644] <... write resumed>) = 6 [pid 641] <... write resumed>) = ? [pid 376] <... umount2 resumed>) = 0 [pid 649] close(3 [pid 647] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 644] close(3 [pid 376] umount2("./42/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 649] <... close resumed>) = 0 [pid 647] <... openat resumed>) = 5 [pid 644] <... close resumed>) = 0 [pid 641] +++ killed by SIGKILL +++ [pid 376] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 649] close(4 [pid 380] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=42, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=2} --- [pid 376] lstat("./42/file0", [pid 649] <... close resumed>) = 0 [pid 376] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 649] close(5 [pid 376] umount2("./42/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 649] <... close resumed>) = 0 [pid 376] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 649] close(6 [pid 376] openat(AT_FDCWD, "./42/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 649] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 376] <... openat resumed>) = 4 [pid 649] close(7 [pid 376] fstat(4, [pid 649] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 376] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 649] close(8 [pid 376] getdents64(4, [pid 649] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 376] <... getdents64 resumed>0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 649] close(9 [pid 376] getdents64(4, [pid 649] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 376] <... getdents64 resumed>0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 649] close(10 [pid 376] close(4 [pid 649] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 376] <... close resumed>) = 0 [pid 649] close(11 [pid 376] rmdir("./42/file0" [pid 649] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 647] write(5, "22", 2 [pid 380] umount2("./40", MNT_DETACH|UMOUNT_NOFOLLOW [pid 376] <... rmdir resumed>) = 0 [pid 644] close(4 [pid 649] close(12 [pid 647] <... write resumed>) = 2 [pid 380] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 376] umount2("./42/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 649] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 647] write(4, "+pids ", 6 [pid 644] <... close resumed>) = 0 [pid 380] openat(AT_FDCWD, "./40", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 376] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 649] close(13 [pid 644] close(5 [pid 380] <... openat resumed>) = 3 [pid 376] lstat("./42/cgroup.cpu", [pid 649] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 644] <... close resumed>) = 0 [pid 380] fstat(3, [pid 376] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 649] close(14 [pid 644] close(6 [pid 380] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 376] unlink("./42/cgroup.cpu" [pid 649] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 644] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 380] getdents64(3, [pid 376] <... unlink resumed>) = 0 [pid 649] close(15 [pid 644] close(7 [pid 380] <... getdents64 resumed>0x555556fad630 /* 7 entries */, 32768) = 208 [pid 376] getdents64(3, [pid 649] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 644] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 380] umount2("./40/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 376] <... getdents64 resumed>0x555556fad630 /* 0 entries */, 32768) = 0 [pid 649] close(16 [pid 644] close(8 [pid 380] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 376] close(3 [pid 649] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 644] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 380] lstat("./40/binderfs", [pid 376] <... close resumed>) = 0 [pid 649] close(17 [pid 644] close(9 [pid 380] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 376] rmdir("./42" [pid 649] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 644] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 380] unlink("./40/binderfs" [pid 376] <... rmdir resumed>) = 0 [pid 649] close(18 [pid 644] close(10 [pid 380] <... unlink resumed>) = 0 [pid 376] mkdir("./43", 0777 [pid 649] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 644] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 380] umount2("./40/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW [pid 376] <... mkdir resumed>) = 0 [pid 649] close(19 [pid 644] close(11 [pid 380] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 376] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 649] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 644] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 380] lstat("./40/cgroup", ./strace-static-x86_64: Process 650 attached [pid 649] close(20 [pid 644] close(12 [pid 380] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 376] <... clone resumed>, child_tidptr=0x555556fab5d0) = 45 [pid 649] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 380] unlink("./40/cgroup" [pid 650] chdir("./43" [pid 649] close(21 [pid 644] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 380] <... unlink resumed>) = 0 [pid 650] <... chdir resumed>) = 0 [pid 649] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 644] close(13 [pid 380] umount2("./40/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW [pid 650] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 649] close(22 [pid 644] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 380] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 650] <... prctl resumed>) = 0 [pid 649] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 644] close(14 [pid 380] lstat("./40/cgroup.net", [pid 650] setpgid(0, 0 [pid 649] close(23 [pid 644] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 380] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 650] <... setpgid resumed>) = 0 [pid 649] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 644] close(15 [pid 380] unlink("./40/cgroup.net" [pid 650] symlink("/syzcgroup/unified/syz1", "./cgroup" [pid 649] close(24 [pid 644] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 380] <... unlink resumed>) = 0 [pid 649] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 380] umount2("./40/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 650] <... symlink resumed>) = 0 [pid 649] close(25 [pid 644] close(16 [pid 380] <... umount2 resumed>) = 0 [pid 650] symlink("/syzcgroup/cpu/syz1", "./cgroup.cpu" [pid 649] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 644] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 380] umount2("./40/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 649] close(26 [pid 380] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 649] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 380] lstat("./40/file0", [pid 650] <... symlink resumed>) = 0 [pid 649] close(27 [pid 644] close(17 [pid 380] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 650] symlink("/syzcgroup/net/syz1", "./cgroup.net" [pid 649] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 644] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 380] umount2("./40/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 649] close(28 [pid 380] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 650] <... symlink resumed>) = 0 [pid 649] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 380] openat(AT_FDCWD, "./40/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 650] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 649] close(29 [pid 644] close(18 [pid 380] <... openat resumed>) = 4 [pid 649] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 380] fstat(4, write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory [pid 650] <... openat resumed>) = 3 [pid 649] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89 [pid 644] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 380] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 650] write(3, "1000", 4 [pid 649] <... write resumed>) = 89 [pid 644] close(19 [pid 380] getdents64(4, [pid 650] <... write resumed>) = 4 [pid 649] exit_group(0 [pid 644] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 380] <... getdents64 resumed>0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 649] <... exit_group resumed>) = ? [pid 380] getdents64(4, [pid 650] close(3 [pid 649] +++ exited with 0 +++ [pid 644] close(20 [pid 380] <... getdents64 resumed>0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 381] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=47, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 380] close(4 [pid 381] restart_syscall(<... resuming interrupted clone ...> [pid 380] <... close resumed>) = 0 [pid 381] <... restart_syscall resumed>) = 0 [pid 380] rmdir("./40/file0") = 0 [pid 380] umount2("./40/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 381] umount2("./45", MNT_DETACH|UMOUNT_NOFOLLOW [pid 380] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 381] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 380] lstat("./40/cgroup.cpu", [pid 381] openat(AT_FDCWD, "./45", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 380] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 381] <... openat resumed>) = 3 [pid 380] unlink("./40/cgroup.cpu" [pid 381] fstat(3, [pid 380] <... unlink resumed>) = 0 [pid 381] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 380] getdents64(3, [pid 381] getdents64(3, [pid 380] <... getdents64 resumed>0x555556fad630 /* 0 entries */, 32768) = 0 [pid 381] <... getdents64 resumed>0x555556fad630 /* 7 entries */, 32768) = 208 [pid 380] close(3 [pid 381] umount2("./45/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 380] <... close resumed>) = 0 [pid 381] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 380] rmdir("./40" [pid 381] lstat("./45/binderfs", [pid 380] <... rmdir resumed>) = 0 [pid 381] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 380] mkdir("./41", 0777 [pid 381] unlink("./45/binderfs" [pid 380] <... mkdir resumed>) = 0 [pid 381] <... unlink resumed>) = 0 [pid 380] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 651 attached [pid 381] umount2("./45/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW [pid 651] chdir("./41" [pid 381] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 380] <... clone resumed>, child_tidptr=0x555556fab5d0) = 43 [pid 651] <... chdir resumed>) = 0 [pid 381] lstat("./45/cgroup", [pid 651] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 381] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 651] <... prctl resumed>) = 0 [pid 381] unlink("./45/cgroup" [pid 651] setpgid(0, 0 [pid 381] <... unlink resumed>) = 0 [pid 651] <... setpgid resumed>) = 0 [pid 381] umount2("./45/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW [pid 651] symlink("/syzcgroup/unified/syz2", "./cgroup" [pid 381] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 651] <... symlink resumed>) = 0 [pid 381] lstat("./45/cgroup.net", [pid 651] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu" [pid 381] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 651] <... symlink resumed>) = 0 [pid 381] unlink("./45/cgroup.net" [pid 651] symlink("/syzcgroup/net/syz2", "./cgroup.net" [pid 381] <... unlink resumed>) = 0 [pid 651] <... symlink resumed>) = 0 [pid 381] umount2("./45/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 651] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 651] write(3, "1000", 4) = 4 [pid 651] close(3) = 0 [pid 651] symlink("/dev/binderfs", "./binderfs") = 0 [pid 651] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 651] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 650] <... close resumed>) = 0 [pid 650] symlink("/dev/binderfs", "./binderfs") = 0 [pid 650] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 650] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 644] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 644] close(21) = -1 EBADF (Bad file descriptor) [pid 644] close(22) = -1 EBADF (Bad file descriptor) [pid 644] close(23) = -1 EBADF (Bad file descriptor) [pid 644] close(24) = -1 EBADF (Bad file descriptor) [pid 644] close(25) = -1 EBADF (Bad file descriptor) [pid 644] close(26) = -1 EBADF (Bad file descriptor) [pid 644] close(27) = -1 EBADF (Bad file descriptor) [pid 644] close(28) = -1 EBADF (Bad file descriptor) write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory [pid 644] close(29) = -1 EBADF (Bad file descriptor) [pid 644] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 644] exit_group(0) = ? [pid 644] +++ exited with 0 +++ [pid 383] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=39, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 383] umount2("./37", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 383] openat(AT_FDCWD, "./37", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 383] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 383] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 383] umount2("./37/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] <... umount2 resumed>) = 0 [pid 383] lstat("./37/binderfs", [pid 381] umount2("./45/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 383] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 381] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 383] unlink("./37/binderfs" [pid 381] lstat("./45/file0", [pid 383] <... unlink resumed>) = 0 [pid 381] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 383] umount2("./37/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW [pid 381] umount2("./45/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 383] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 381] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 383] lstat("./37/cgroup", [pid 381] openat(AT_FDCWD, "./45/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 383] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 381] <... openat resumed>) = 4 [pid 383] unlink("./37/cgroup" [pid 381] fstat(4, [pid 383] <... unlink resumed>) = 0 [pid 381] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 383] umount2("./37/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW [pid 381] getdents64(4, [pid 383] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 381] <... getdents64 resumed>0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 383] lstat("./37/cgroup.net", [pid 381] getdents64(4, [pid 383] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 381] <... getdents64 resumed>0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 383] unlink("./37/cgroup.net" [pid 381] close(4 [pid 383] <... unlink resumed>) = 0 [pid 381] <... close resumed>) = 0 [pid 383] umount2("./37/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 381] rmdir("./45/file0") = 0 [pid 381] umount2("./45/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./45/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 381] unlink("./45/cgroup.cpu") = 0 [pid 381] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 381] close(3) = 0 [pid 381] rmdir("./45") = 0 [pid 381] mkdir("./46", 0777) = 0 [pid 381] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556fab5d0) = 48 ./strace-static-x86_64: Process 652 attached [pid 652] chdir("./46") = 0 [pid 652] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 652] setpgid(0, 0) = 0 [pid 652] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [ 152.279976][ T641] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 152.288274][ T641] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000028 [ 152.311412][ T647] FAULT_INJECTION: forcing a failure. [ 152.311412][ T647] name failslab, interval 1, probability 0, space 0, times 0 [pid 652] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 652] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 652] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 652] write(3, "1000", 4) = 4 [pid 652] close(3) = 0 [pid 652] symlink("/dev/binderfs", "./binderfs") = 0 [pid 652] mkdirat(AT_FDCWD, "./file0", 000) = 0 [ 152.324496][ T647] CPU: 1 PID: 647 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 152.336118][ T647] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 152.346153][ T647] Call Trace: [ 152.349428][ T647] dump_stack_lvl+0x1e2/0x24b [ 152.354087][ T647] ? panic+0x7d7/0x7d7 [ 152.358140][ T647] ? bfq_pos_tree_add_move+0x43e/0x43e [ 152.363574][ T647] ? find_next_bit+0xd6/0x120 [ 152.368231][ T647] ? cpumask_next+0x11/0x30 [ 152.372724][ T647] dump_stack+0x15/0x17 [ 152.376863][ T647] should_fail+0x3c0/0x510 [ 152.381259][ T647] ? percpu_ref_init+0xd0/0x330 [ 152.386082][ T647] __should_failslab+0x9f/0xe0 [ 152.390822][ T647] should_failslab+0x9/0x20 [ 152.395309][ T647] kmem_cache_alloc_trace+0x3a/0x330 [ 152.400571][ T647] percpu_ref_init+0xd0/0x330 [ 152.405334][ T647] ? cgroup_setup_root+0xea0/0xea0 [ 152.410441][ T647] cgroup_apply_control_enable+0x3a2/0x12f0 [ 152.416326][ T647] cgroup_apply_control+0x93/0x710 [ 152.421427][ T647] ? css_next_child+0x160/0x160 [ 152.426253][ T647] ? stack_trace_save+0x12d/0x1f0 [ 152.431251][ T647] ? io_schedule+0x120/0x120 [ 152.435825][ T647] ? kernfs_fop_write_iter+0x15e/0x410 [ 152.441264][ T647] ? __kasan_check_write+0x14/0x20 [ 152.446359][ T647] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 152.451620][ T647] cgroup_subtree_control_write+0xd19/0x1310 [ 152.457573][ T647] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 152.463526][ T647] ? __kasan_check_write+0x14/0x20 [ 152.468611][ T647] ? _copy_from_iter+0x3fb/0xd60 [ 152.473523][ T647] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 152.479500][ T647] cgroup_file_write+0x28e/0x590 [ 152.484428][ T647] ? cgroup_seqfile_stop+0xc0/0xc0 [ 152.489521][ T647] ? mutex_lock+0xa6/0x110 [ 152.493921][ T647] ? mutex_trylock+0xb0/0xb0 [ 152.498492][ T647] ? __kasan_check_write+0x14/0x20 [ 152.503585][ T647] kernfs_fop_write_iter+0x2d0/0x410 [ 152.508850][ T647] ? cgroup_seqfile_stop+0xc0/0xc0 [ 152.513946][ T647] vfs_write+0xc1c/0xf40 [ 152.518164][ T647] ? __kasan_check_write+0x14/0x20 [ 152.523257][ T647] ? kernel_write+0x3c0/0x3c0 [ 152.527930][ T647] ? _raw_spin_unlock_irq+0x4e/0x70 [ 152.533112][ T647] ? ptrace_stop+0x6ff/0x9f0 [ 152.537684][ T647] ? __kasan_check_read+0x11/0x20 [ 152.542681][ T647] ? __fdget_pos+0x27e/0x310 [ 152.547250][ T647] ksys_write+0x198/0x2c0 [ 152.551577][ T647] ? do_notify_parent+0xa60/0xa60 [ 152.556609][ T647] ? __ia32_sys_read+0x90/0x90 [ 152.561353][ T647] ? __ia32_sys_open+0x270/0x270 [ 152.566274][ T647] __x64_sys_write+0x7b/0x90 [ 152.570835][ T647] do_syscall_64+0x34/0x70 [ 152.575226][ T647] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 152.581100][ T647] RIP: 0033:0x7fc8ece62c09 [ 152.585507][ T647] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 152.605100][ T647] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 152.613506][ T647] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 152.621465][ T647] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [pid 652] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 651] <... mount resumed>) = 0 [pid 650] <... mount resumed>) = 0 [pid 647] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 383] <... umount2 resumed>) = 0 [pid 652] open("./file0", O_RDONLY [pid 651] open("./file0", O_RDONLY [pid 650] open("./file0", O_RDONLY [pid 652] <... open resumed>) = 3 [pid 651] <... open resumed>) = 3 [pid 650] <... open resumed>) = 3 [pid 647] close(3 [pid 383] umount2("./37/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 652] openat(3, "cgroup.subtree_control", O_RDWR [pid 651] openat(3, "cgroup.subtree_control", O_RDWR [pid 650] openat(3, "cgroup.subtree_control", O_RDWR [pid 651] <... openat resumed>) = 4 [pid 650] <... openat resumed>) = 4 [pid 383] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 651] write(4, "-pids ", 6 [pid 650] write(4, "-pids ", 6 [pid 652] <... openat resumed>) = 4 [pid 383] lstat("./37/file0", [pid 647] <... close resumed>) = 0 [pid 647] close(4) = 0 [pid 647] close(5) = 0 [pid 647] close(6) = -1 EBADF (Bad file descriptor) [pid 647] close(7) = -1 EBADF (Bad file descriptor) [pid 647] close(8) = -1 EBADF (Bad file descriptor) [pid 647] close(9) = -1 EBADF (Bad file descriptor) [pid 647] close(10) = -1 EBADF (Bad file descriptor) [pid 647] close(11) = -1 EBADF (Bad file descriptor) [pid 647] close(12) = -1 EBADF (Bad file descriptor) [pid 647] close(13) = -1 EBADF (Bad file descriptor) [pid 647] close(14) = -1 EBADF (Bad file descriptor) [pid 647] close(15) = -1 EBADF (Bad file descriptor) [pid 647] close(16) = -1 EBADF (Bad file descriptor) [pid 647] close(17) = -1 EBADF (Bad file descriptor) [pid 647] close(18) = -1 EBADF (Bad file descriptor) [pid 647] close(19) = -1 EBADF (Bad file descriptor) [pid 647] close(20) = -1 EBADF (Bad file descriptor) [pid 647] close(21) = -1 EBADF (Bad file descriptor) [pid 647] close(22) = -1 EBADF (Bad file descriptor) [pid 647] close(23) = -1 EBADF (Bad file descriptor) [pid 647] close(24) = -1 EBADF (Bad file descriptor) [pid 647] close(25) = -1 EBADF (Bad file descriptor) [pid 647] close(26) = -1 EBADF (Bad file descriptor) [pid 647] close(27) = -1 EBADF (Bad file descriptor) [pid 647] close(28) = -1 EBADF (Bad file descriptor) [pid 647] close(29) = -1 EBADF (Bad file descriptor) write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory [pid 647] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 647] exit_group(0) = ? [pid 652] write(4, "-pids ", 6 [pid 647] +++ exited with 0 +++ [pid 383] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 383] umount2("./37/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 375] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=49, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 383] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 383] openat(AT_FDCWD, "./37/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 375] umount2("./47", MNT_DETACH|UMOUNT_NOFOLLOW [pid 383] <... openat resumed>) = 4 [pid 375] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 375] openat(AT_FDCWD, "./47", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 383] fstat(4, [pid 375] <... openat resumed>) = 3 [pid 383] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 375] fstat(3, [pid 383] getdents64(4, [pid 375] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 375] getdents64(3, [pid 383] <... getdents64 resumed>0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 375] <... getdents64 resumed>0x555556fad630 /* 7 entries */, 32768) = 208 [pid 383] getdents64(4, [pid 375] umount2("./47/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 383] <... getdents64 resumed>0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 375] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 383] close(4 [pid 375] lstat("./47/binderfs", [pid 383] <... close resumed>) = 0 [pid 375] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 383] rmdir("./37/file0" [pid 375] unlink("./47/binderfs" [pid 383] <... rmdir resumed>) = 0 [pid 375] <... unlink resumed>) = 0 [pid 383] umount2("./37/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 375] umount2("./47/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW [pid 383] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 375] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 383] lstat("./37/cgroup.cpu", [pid 375] lstat("./47/cgroup", [pid 383] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 375] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 383] unlink("./37/cgroup.cpu" [pid 375] unlink("./47/cgroup" [pid 383] <... unlink resumed>) = 0 [pid 375] <... unlink resumed>) = 0 [pid 375] umount2("./47/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW [pid 383] getdents64(3, [pid 375] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 375] lstat("./47/cgroup.net", [pid 383] <... getdents64 resumed>0x555556fad630 /* 0 entries */, 32768) = 0 [pid 375] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 383] close(3 [pid 375] unlink("./47/cgroup.net" [pid 383] <... close resumed>) = 0 [pid 375] <... unlink resumed>) = 0 [pid 383] rmdir("./37" [pid 375] umount2("./47/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 383] <... rmdir resumed>) = 0 [pid 375] umount2("./47/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 383] mkdir("./38", 0777 [pid 375] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 375] lstat("./47/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 375] umount2("./47/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] openat(AT_FDCWD, "./47/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 383] <... mkdir resumed>) = 0 [pid 375] <... openat resumed>) = 4 [pid 383] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 375] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 375] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 375] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 375] close(4) = 0 [pid 375] rmdir("./47/file0"./strace-static-x86_64: Process 653 attached ) = 0 [pid 375] umount2("./47/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 383] <... clone resumed>, child_tidptr=0x555556fab5d0) = 40 [pid 653] chdir("./38" [pid 375] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 653] <... chdir resumed>) = 0 [pid 375] lstat("./47/cgroup.cpu", [pid 653] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 375] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 653] <... prctl resumed>) = 0 [pid 375] unlink("./47/cgroup.cpu" [pid 653] setpgid(0, 0 [pid 375] <... unlink resumed>) = 0 [pid 653] <... setpgid resumed>) = 0 [pid 375] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 375] close(3) = 0 [pid 653] symlink("/syzcgroup/unified/syz4", "./cgroup" [pid 375] rmdir("./47" [pid 653] <... symlink resumed>) = 0 [pid 375] <... rmdir resumed>) = 0 [pid 653] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu" [pid 375] mkdir("./48", 0777 [pid 653] <... symlink resumed>) = 0 [pid 375] <... mkdir resumed>) = 0 [pid 653] symlink("/syzcgroup/net/syz4", "./cgroup.net" [pid 375] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 654 attached [pid 653] <... symlink resumed>) = 0 [pid 654] chdir("./48" [pid 653] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 375] <... clone resumed>, child_tidptr=0x555556fab5d0) = 50 [pid 654] <... chdir resumed>) = 0 [pid 654] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 653] <... openat resumed>) = 3 [pid 654] <... prctl resumed>) = 0 [pid 654] setpgid(0, 0 [pid 653] write(3, "1000", 4 [pid 654] <... setpgid resumed>) = 0 [pid 654] symlink("/syzcgroup/unified/syz0", "./cgroup" [pid 653] <... write resumed>) = 4 [pid 654] <... symlink resumed>) = 0 [pid 654] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu" [pid 653] close(3 [pid 654] <... symlink resumed>) = 0 [pid 654] symlink("/syzcgroup/net/syz0", "./cgroup.net" [pid 653] <... close resumed>) = 0 [pid 654] <... symlink resumed>) = 0 [pid 653] symlink("/dev/binderfs", "./binderfs" [pid 654] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 653] <... symlink resumed>) = 0 [pid 654] write(3, "1000", 4 [pid 653] mkdirat(AT_FDCWD, "./file0", 000 [pid 654] <... write resumed>) = 4 [pid 654] close(3) = 0 [pid 654] symlink("/dev/binderfs", "./binderfs") = 0 [pid 653] <... mkdirat resumed>) = 0 [pid 654] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 653] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 654] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 653] <... mount resumed>) = 0 [pid 654] open("./file0", O_RDONLY) = 3 [pid 653] open("./file0", O_RDONLY [pid 654] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [pid 653] <... open resumed>) = 3 [pid 654] write(4, "-pids ", 6 [pid 653] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [pid 653] write(4, "-pids ", 6 [pid 654] <... write resumed>) = 6 [pid 651] <... write resumed>) = 6 [pid 650] <... write resumed>) = 6 [pid 654] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 652] <... write resumed>) = 6 [ 152.629413][ T647] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 152.637374][ T647] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 152.645350][ T647] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 000000000000002f [pid 651] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR [pid 654] <... openat resumed>) = 5 [pid 651] <... openat resumed>) = 5 [pid 654] write(5, "22", 2 [pid 651] write(5, "22", 2 [pid 654] <... write resumed>) = 2 [pid 651] <... write resumed>) = 2 [pid 654] write(4, "+pids ", 6 [pid 651] write(4, "+pids ", 6 [pid 650] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 650] write(5, "22", 2) = 2 [pid 650] write(4, "+pids ", 6 [pid 652] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 652] write(5, "22", 2) = 2 [ 152.690514][ T648] FAULT_INJECTION: forcing a failure. [ 152.690514][ T648] name failslab, interval 1, probability 0, space 0, times 0 [ 152.703231][ T648] CPU: 1 PID: 648 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 152.714840][ T648] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 152.724874][ T648] Call Trace: [ 152.728155][ T648] dump_stack_lvl+0x1e2/0x24b [ 152.732813][ T648] ? bfq_pos_tree_add_move+0x43e/0x43e [ 152.738256][ T648] ? selinux_kernfs_init_security+0x1a8/0x760 [ 152.744306][ T648] dump_stack+0x15/0x17 [ 152.748439][ T648] should_fail+0x3c0/0x510 [ 152.752853][ T648] ? __kernfs_new_node+0x99/0x6e0 [ 152.757864][ T648] __should_failslab+0x9f/0xe0 [ 152.762606][ T648] should_failslab+0x9/0x20 [ 152.767084][ T648] __kmalloc_track_caller+0x5f/0x350 [ 152.772351][ T648] kstrdup_const+0x55/0x90 [ 152.776740][ T648] __kernfs_new_node+0x99/0x6e0 [ 152.781562][ T648] ? is_module_text_address+0xe1/0x140 [ 152.786999][ T648] ? kernfs_new_node+0x170/0x170 [ 152.791919][ T648] ? ptr_to_hashval+0x60/0x60 [ 152.796567][ T648] ? arch_stack_walk+0xf8/0x140 [ 152.801397][ T648] ? snprintf+0xd6/0x120 [ 152.805621][ T648] kernfs_new_node+0x97/0x170 [ 152.810277][ T648] __kernfs_create_file+0x4a/0x270 [ 152.815371][ T648] cgroup_addrm_files+0xab8/0xfe0 [ 152.820368][ T648] ? ____kasan_kmalloc+0xdc/0x110 [ 152.825372][ T648] ? __kasan_kmalloc+0x9/0x10 [ 152.830036][ T648] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 152.835562][ T648] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 152.841699][ T648] ? delete_node+0x759/0x7b0 [ 152.846260][ T648] ? __kasan_check_read+0x11/0x20 [ 152.851254][ T648] ? delete_node+0x759/0x7b0 [ 152.855821][ T648] ? __kasan_check_write+0x14/0x20 [ 152.860916][ T648] ? idr_replace+0x1c4/0x230 [ 152.865475][ T648] ? idr_get_next+0x4b0/0x4b0 [ 152.870122][ T648] ? _raw_spin_lock_bh+0xa3/0x1b0 [ 152.875124][ T648] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 152.880304][ T648] css_populate_dir+0x137/0x370 [ 152.885134][ T648] cgroup_apply_control_enable+0x8b9/0x12f0 [ 152.891019][ T648] cgroup_apply_control+0x93/0x710 [ 152.896109][ T648] ? css_next_child+0x160/0x160 [ 152.900933][ T648] ? io_schedule+0x120/0x120 [ 152.905506][ T648] ? __kasan_check_write+0x14/0x20 [ 152.910600][ T648] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 152.915867][ T648] cgroup_subtree_control_write+0xd19/0x1310 [ 152.921936][ T648] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 152.927906][ T648] ? __kasan_check_write+0x14/0x20 [ 152.932993][ T648] ? _copy_from_iter+0x3fb/0xd60 [ 152.937910][ T648] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 152.943875][ T648] cgroup_file_write+0x28e/0x590 [ 152.948795][ T648] ? cgroup_seqfile_stop+0xc0/0xc0 [ 152.953875][ T648] ? mutex_lock+0xa6/0x110 [ 152.958261][ T648] ? mutex_trylock+0xb0/0xb0 [ 152.962827][ T648] ? __kasan_check_write+0x14/0x20 [ 152.967916][ T648] kernfs_fop_write_iter+0x2d0/0x410 [ 152.973184][ T648] ? cgroup_seqfile_stop+0xc0/0xc0 [ 152.978274][ T648] vfs_write+0xc1c/0xf40 [ 152.982488][ T648] ? __kasan_check_write+0x14/0x20 [ 152.987570][ T648] ? kernel_write+0x3c0/0x3c0 [ 152.992216][ T648] ? _raw_spin_unlock_irq+0x4e/0x70 [ 152.997393][ T648] ? ptrace_stop+0x6ff/0x9f0 [ 153.001971][ T648] ? __kasan_check_read+0x11/0x20 [ 153.006973][ T648] ? __fdget_pos+0x27e/0x310 [ 153.011535][ T648] ksys_write+0x198/0x2c0 [ 153.015841][ T648] ? do_notify_parent+0xa60/0xa60 [ 153.020838][ T648] ? __ia32_sys_read+0x90/0x90 [ 153.025580][ T648] ? __ia32_sys_open+0x270/0x270 [ 153.030497][ T648] __x64_sys_write+0x7b/0x90 [ 153.035058][ T648] do_syscall_64+0x34/0x70 [ 153.039444][ T648] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 153.045313][ T648] RIP: 0033:0x7fc8ece62c09 [ 153.049702][ T648] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 153.069279][ T648] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 153.077661][ T648] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [pid 652] write(4, "+pids ", 6 [pid 648] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 648] close(3) = 0 [pid 648] close(4) = 0 [pid 648] close(5) = 0 [pid 648] close(6) = -1 EBADF (Bad file descriptor) [pid 648] close(7) = -1 EBADF (Bad file descriptor) [pid 648] close(8) = -1 EBADF (Bad file descriptor) [pid 648] close(9) = -1 EBADF (Bad file descriptor) [pid 648] close(10) = -1 EBADF (Bad file descriptor) [pid 648] close(11) = -1 EBADF (Bad file descriptor) [pid 648] close(12) = -1 EBADF (Bad file descriptor) [pid 648] close(13) = -1 EBADF (Bad file descriptor) [pid 648] close(14) = -1 EBADF (Bad file descriptor) [pid 648] close(15) = -1 EBADF (Bad file descriptor) [pid 648] close(16) = -1 EBADF (Bad file descriptor) [pid 648] close(17) = -1 EBADF (Bad file descriptor) [pid 648] close(18) = -1 EBADF (Bad file descriptor) [pid 648] close(19) = -1 EBADF (Bad file descriptor) [pid 648] close(20) = -1 EBADF (Bad file descriptor) [pid 648] close(21) = -1 EBADF (Bad file descriptor) [pid 648] close(22) = -1 EBADF (Bad file descriptor) [pid 648] close(23) = -1 EBADF (Bad file descriptor) [pid 648] close(24) = -1 EBADF (Bad file descriptor) [pid 648] close(25) = -1 EBADF (Bad file descriptor) [pid 648] close(26) = -1 EBADF (Bad file descriptor) [pid 648] close(27) = -1 EBADF (Bad file descriptor) [pid 648] close(28) = -1 EBADF (Bad file descriptor) [pid 648] close(29) = -1 EBADF (Bad file descriptor) write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory [pid 648] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 648] exit_group(0) = ? [pid 648] +++ exited with 0 +++ [pid 382] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=49, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 382] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 382] umount2("./47", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] openat(AT_FDCWD, "./47", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 382] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 382] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 382] umount2("./47/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./47/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 382] unlink("./47/binderfs") = 0 [pid 382] umount2("./47/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./47/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 382] unlink("./47/cgroup") = 0 [pid 382] umount2("./47/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./47/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 382] unlink("./47/cgroup.net") = 0 [pid 382] umount2("./47/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 382] umount2("./47/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./47/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 382] umount2("./47/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] openat(AT_FDCWD, "./47/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 382] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 382] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 382] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 382] close(4) = 0 [pid 382] rmdir("./47/file0") = 0 [pid 382] umount2("./47/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./47/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 382] unlink("./47/cgroup.cpu") = 0 [pid 382] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 382] close(3) = 0 [pid 382] rmdir("./47") = 0 [pid 382] mkdir("./48", 0777) = 0 [pid 382] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 655 attached , child_tidptr=0x555556fab5d0) = 50 [pid 655] chdir("./48") = 0 [pid 655] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 655] setpgid(0, 0) = 0 [pid 655] symlink("/syzcgroup/unified/syz5", "./cgroup") = 0 [pid 655] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu") = 0 [pid 655] symlink("/syzcgroup/net/syz5", "./cgroup.net") = 0 [pid 655] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 655] write(3, "1000", 4) = 4 [pid 655] close(3) = 0 [pid 655] symlink("/dev/binderfs", "./binderfs") = 0 [pid 655] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 655] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 655] open("./file0", O_RDONLY) = 3 [pid 655] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [ 153.085604][ T648] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 153.093549][ T648] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 153.101500][ T648] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 153.109458][ T648] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 000000000000002f [ 153.118299][ T648] cgroup: cgroup_addrm_files: failed to add max, err=-12 [ 153.140522][ T654] FAULT_INJECTION: forcing a failure. [ 153.140522][ T654] name failslab, interval 1, probability 0, space 0, times 0 [ 153.153206][ T654] CPU: 0 PID: 654 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 153.164808][ T654] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 153.174840][ T654] Call Trace: [ 153.178109][ T654] dump_stack_lvl+0x1e2/0x24b [ 153.182762][ T654] ? panic+0x7d7/0x7d7 [ 153.186810][ T654] ? bfq_pos_tree_add_move+0x43e/0x43e [ 153.192243][ T654] ? find_next_bit+0xd6/0x120 [ 153.196896][ T654] ? cpumask_next+0x11/0x30 [ 153.201374][ T654] dump_stack+0x15/0x17 [ 153.205508][ T654] should_fail+0x3c0/0x510 [ 153.209899][ T654] ? percpu_ref_init+0xd0/0x330 [ 153.214727][ T654] __should_failslab+0x9f/0xe0 [ 153.219467][ T654] should_failslab+0x9/0x20 [ 153.223948][ T654] kmem_cache_alloc_trace+0x3a/0x330 [ 153.229210][ T654] percpu_ref_init+0xd0/0x330 [ 153.233865][ T654] ? cgroup_setup_root+0xea0/0xea0 [ 153.238952][ T654] cgroup_apply_control_enable+0x3a2/0x12f0 [ 153.244824][ T654] cgroup_apply_control+0x93/0x710 [ 153.249932][ T654] ? css_next_child+0x160/0x160 [ 153.254757][ T654] ? stack_trace_save+0x12d/0x1f0 [ 153.259758][ T654] ? io_schedule+0x120/0x120 [ 153.264332][ T654] ? kernfs_fop_write_iter+0x15e/0x410 [ 153.269765][ T654] ? __kasan_check_write+0x14/0x20 [ 153.274850][ T654] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 153.280113][ T654] cgroup_subtree_control_write+0xd19/0x1310 [ 153.286068][ T654] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 153.292020][ T654] ? __kasan_check_write+0x14/0x20 [ 153.297106][ T654] ? _copy_from_iter+0x3fb/0xd60 [ 153.302022][ T654] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 153.307980][ T654] cgroup_file_write+0x28e/0x590 [ 153.312904][ T654] ? cgroup_seqfile_stop+0xc0/0xc0 [ 153.317994][ T654] ? mutex_lock+0xa6/0x110 [ 153.322388][ T654] ? mutex_trylock+0xb0/0xb0 [ 153.326956][ T654] ? __kasan_check_write+0x14/0x20 [ 153.332044][ T654] kernfs_fop_write_iter+0x2d0/0x410 [ 153.337304][ T654] ? cgroup_seqfile_stop+0xc0/0xc0 [ 153.342393][ T654] vfs_write+0xc1c/0xf40 [ 153.346614][ T654] ? __kasan_check_write+0x14/0x20 [ 153.351703][ T654] ? kernel_write+0x3c0/0x3c0 [ 153.356359][ T654] ? _raw_spin_unlock_irq+0x4e/0x70 [ 153.361535][ T654] ? ptrace_stop+0x6ff/0x9f0 [ 153.366104][ T654] ? __kasan_check_read+0x11/0x20 [ 153.371107][ T654] ? __fdget_pos+0x27e/0x310 [ 153.375676][ T654] ksys_write+0x198/0x2c0 [ 153.379985][ T654] ? do_notify_parent+0xa60/0xa60 [ 153.384984][ T654] ? __ia32_sys_read+0x90/0x90 [ 153.389726][ T654] ? __ia32_sys_open+0x270/0x270 [ 153.394638][ T654] __x64_sys_write+0x7b/0x90 [ 153.399205][ T654] do_syscall_64+0x34/0x70 [ 153.403599][ T654] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 153.409466][ T654] RIP: 0033:0x7fc8ece62c09 [ 153.413862][ T654] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 153.433442][ T654] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 655] write(4, "-pids ", 6 [pid 654] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 654] close(3) = 0 [pid 654] close(4) = 0 [pid 654] close(5) = 0 [pid 654] close(6) = -1 EBADF (Bad file descriptor) [pid 654] close(7) = -1 EBADF (Bad file descriptor) [pid 654] close(8) = -1 EBADF (Bad file descriptor) [pid 654] close(9) = -1 EBADF (Bad file descriptor) [pid 654] close(10) = -1 EBADF (Bad file descriptor) [pid 654] close(11) = -1 EBADF (Bad file descriptor) [pid 654] close(12) = -1 EBADF (Bad file descriptor) [pid 654] close(13) = -1 EBADF (Bad file descriptor) [pid 654] close(14) = -1 EBADF (Bad file descriptor) [pid 654] close(15) = -1 EBADF (Bad file descriptor) [pid 654] close(16) = -1 EBADF (Bad file descriptor) [pid 654] close(17) = -1 EBADF (Bad file descriptor) [pid 654] close(18) = -1 EBADF (Bad file descriptor) [pid 654] close(19) = -1 EBADF (Bad file descriptor) [pid 654] close(20) = -1 EBADF (Bad file descriptor) [pid 654] close(21) = -1 EBADF (Bad file descriptor) [pid 654] close(22) = -1 EBADF (Bad file descriptor) [pid 654] close(23) = -1 EBADF (Bad file descriptor) [pid 654] close(24) = -1 EBADF (Bad file descriptor) [pid 654] close(25) = -1 EBADF (Bad file descriptor) [pid 654] close(26) = -1 EBADF (Bad file descriptor) [pid 654] close(27) = -1 EBADF (Bad file descriptor) [pid 654] close(28) = -1 EBADF (Bad file descriptor) [pid 654] close(29) = -1 EBADF (Bad file descriptor) write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory [pid 654] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 654] exit_group(0) = ? [pid 654] +++ exited with 0 +++ [pid 375] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=50, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 375] umount2("./48", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] openat(AT_FDCWD, "./48", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 375] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 375] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 375] umount2("./48/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./48/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 375] unlink("./48/binderfs") = 0 [pid 375] umount2("./48/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./48/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 375] unlink("./48/cgroup") = 0 [pid 375] umount2("./48/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./48/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 375] unlink("./48/cgroup.net") = 0 [pid 375] umount2("./48/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 375] umount2("./48/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./48/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 375] umount2("./48/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] openat(AT_FDCWD, "./48/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 375] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 375] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 375] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 375] close(4) = 0 [pid 375] rmdir("./48/file0") = 0 [pid 375] umount2("./48/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./48/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 375] unlink("./48/cgroup.cpu") = 0 [pid 375] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 375] close(3) = 0 [pid 375] rmdir("./48") = 0 [pid 375] mkdir("./49", 0777) = 0 [pid 375] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 656 attached [pid 656] chdir("./49") = 0 [pid 375] <... clone resumed>, child_tidptr=0x555556fab5d0) = 51 [pid 656] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 656] setpgid(0, 0) = 0 [pid 656] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 656] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 656] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 656] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 656] write(3, "1000", 4) = 4 [pid 656] close(3) = 0 [pid 656] symlink("/dev/binderfs", "./binderfs") = 0 [ 153.441850][ T654] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 153.449803][ T654] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 153.457760][ T654] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 153.465711][ T654] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 153.473662][ T654] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000030 [pid 656] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 656] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 655] <... write resumed>) = 6 [pid 656] open("./file0", O_RDONLY) = 3 [pid 656] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [pid 656] write(4, "-pids ", 6 [pid 655] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 655] write(5, "22", 2) = 2 [ 153.500463][ T652] FAULT_INJECTION: forcing a failure. [ 153.500463][ T652] name failslab, interval 1, probability 0, space 0, times 0 [ 153.513810][ T652] CPU: 0 PID: 652 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 153.525434][ T652] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 153.535469][ T652] Call Trace: [ 153.538743][ T652] dump_stack_lvl+0x1e2/0x24b [ 153.543393][ T652] ? bfq_pos_tree_add_move+0x43e/0x43e [ 153.548829][ T652] ? selinux_kernfs_init_security+0x1a8/0x760 [ 153.554879][ T652] dump_stack+0x15/0x17 [ 153.559016][ T652] should_fail+0x3c0/0x510 [ 153.563410][ T652] ? __kernfs_new_node+0x99/0x6e0 [ 153.568420][ T652] __should_failslab+0x9f/0xe0 [ 153.573190][ T652] should_failslab+0x9/0x20 [ 153.577665][ T652] __kmalloc_track_caller+0x5f/0x350 [ 153.582924][ T652] kstrdup_const+0x55/0x90 [ 153.587311][ T652] __kernfs_new_node+0x99/0x6e0 [ 153.592141][ T652] ? is_module_text_address+0xe1/0x140 [ 153.597578][ T652] ? kernfs_new_node+0x170/0x170 [ 153.602492][ T652] ? ptr_to_hashval+0x60/0x60 [ 153.607154][ T652] ? arch_stack_walk+0xf8/0x140 [ 153.611982][ T652] ? snprintf+0xd6/0x120 [ 153.616195][ T652] kernfs_new_node+0x97/0x170 [ 153.620843][ T652] __kernfs_create_file+0x4a/0x270 [ 153.625927][ T652] cgroup_addrm_files+0xab8/0xfe0 [ 153.630941][ T652] ? ____kasan_kmalloc+0xdc/0x110 [ 153.635940][ T652] ? __kasan_kmalloc+0x9/0x10 [ 153.640590][ T652] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 153.646108][ T652] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 153.652234][ T652] ? delete_node+0x759/0x7b0 [ 153.656799][ T652] ? __kasan_check_read+0x11/0x20 [ 153.661808][ T652] ? delete_node+0x759/0x7b0 [ 153.666377][ T652] ? __kasan_check_write+0x14/0x20 [ 153.671465][ T652] ? idr_replace+0x1c4/0x230 [ 153.676027][ T652] ? idr_get_next+0x4b0/0x4b0 [ 153.680676][ T652] ? _raw_spin_lock_bh+0xa3/0x1b0 [ 153.685678][ T652] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 153.690849][ T652] css_populate_dir+0x137/0x370 [ 153.695680][ T652] cgroup_apply_control_enable+0x8b9/0x12f0 [ 153.701549][ T652] cgroup_apply_control+0x93/0x710 [ 153.706633][ T652] ? css_next_child+0x160/0x160 [ 153.711456][ T652] ? stack_trace_save+0x12d/0x1f0 [ 153.716457][ T652] ? io_schedule+0x120/0x120 [ 153.721029][ T652] ? kernfs_fop_write_iter+0x15e/0x410 [ 153.726462][ T652] ? __kasan_check_write+0x14/0x20 [ 153.731554][ T652] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 153.736820][ T652] cgroup_subtree_control_write+0xd19/0x1310 [ 153.742779][ T652] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 153.748732][ T652] ? __kasan_check_write+0x14/0x20 [ 153.753823][ T652] ? _copy_from_iter+0x3fb/0xd60 [ 153.758742][ T652] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 153.764704][ T652] cgroup_file_write+0x28e/0x590 [ 153.769618][ T652] ? cgroup_seqfile_stop+0xc0/0xc0 [ 153.774711][ T652] ? mutex_lock+0xa6/0x110 [ 153.779109][ T652] ? mutex_trylock+0xb0/0xb0 [ 153.783671][ T652] ? __kasan_check_write+0x14/0x20 [ 153.788754][ T652] kernfs_fop_write_iter+0x2d0/0x410 [ 153.794040][ T652] ? cgroup_seqfile_stop+0xc0/0xc0 [ 153.799139][ T652] vfs_write+0xc1c/0xf40 [ 153.803362][ T652] ? __kasan_check_write+0x14/0x20 [ 153.808448][ T652] ? kernel_write+0x3c0/0x3c0 [ 153.813100][ T652] ? _raw_spin_unlock_irq+0x4e/0x70 [ 153.818272][ T652] ? ptrace_stop+0x6ff/0x9f0 [ 153.822846][ T652] ? __kasan_check_read+0x11/0x20 [ 153.827848][ T652] ? __fdget_pos+0x27e/0x310 [ 153.832417][ T652] ksys_write+0x198/0x2c0 [ 153.836727][ T652] ? do_notify_parent+0xa60/0xa60 [ 153.841737][ T652] ? __ia32_sys_read+0x90/0x90 [ 153.846477][ T652] ? __ia32_sys_open+0x270/0x270 [ 153.851400][ T652] __x64_sys_write+0x7b/0x90 [ 153.855977][ T652] do_syscall_64+0x34/0x70 [ 153.860367][ T652] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 153.866241][ T652] RIP: 0033:0x7fc8ece62c09 [ 153.870632][ T652] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 153.890221][ T652] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 655] write(4, "+pids ", 6 [pid 652] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 652] close(3) = 0 [pid 652] close(4) = 0 [pid 652] close(5) = 0 [pid 652] close(6) = -1 EBADF (Bad file descriptor) [pid 652] close(7) = -1 EBADF (Bad file descriptor) [pid 652] close(8) = -1 EBADF (Bad file descriptor) [pid 652] close(9) = -1 EBADF (Bad file descriptor) [pid 652] close(10) = -1 EBADF (Bad file descriptor) [pid 652] close(11) = -1 EBADF (Bad file descriptor) [pid 652] close(12) = -1 EBADF (Bad file descriptor) [pid 652] close(13) = -1 EBADF (Bad file descriptor) [pid 652] close(14) = -1 EBADF (Bad file descriptor) [pid 652] close(15) = -1 EBADF (Bad file descriptor) [pid 652] close(16) = -1 EBADF (Bad file descriptor) [pid 652] close(17) = -1 EBADF (Bad file descriptor) [pid 652] close(18) = -1 EBADF (Bad file descriptor) [pid 652] close(19) = -1 EBADF (Bad file descriptor) [pid 652] close(20) = -1 EBADF (Bad file descriptor) [pid 652] close(21) = -1 EBADF (Bad file descriptor) [pid 652] close(22) = -1 EBADF (Bad file descriptor) [pid 652] close(23) = -1 EBADF (Bad file descriptor) [pid 652] close(24) = -1 EBADF (Bad file descriptor) [pid 652] close(25) = -1 EBADF (Bad file descriptor) [pid 652] close(26) = -1 EBADF (Bad file descriptor) [pid 652] close(27) = -1 EBADF (Bad file descriptor) [pid 652] close(28) = -1 EBADF (Bad file descriptor) [pid 652] close(29) = -1 EBADF (Bad file descriptor) [pid 652] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory ) = 89 [pid 652] exit_group(0) = ? [pid 652] +++ exited with 0 +++ [pid 381] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=48, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 381] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 381] umount2("./46", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] openat(AT_FDCWD, "./46", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 381] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 381] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 381] umount2("./46/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./46/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 381] unlink("./46/binderfs") = 0 [pid 381] umount2("./46/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./46/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 381] unlink("./46/cgroup") = 0 [pid 381] umount2("./46/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./46/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 381] unlink("./46/cgroup.net") = 0 [pid 381] umount2("./46/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 381] umount2("./46/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./46/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 381] umount2("./46/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] openat(AT_FDCWD, "./46/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 381] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 381] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 381] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [ 153.898622][ T652] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 153.906571][ T652] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 153.914523][ T652] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 153.922468][ T652] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 153.930453][ T652] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 000000000000002e [ 153.938617][ T652] cgroup: cgroup_addrm_files: failed to add max, err=-12 [pid 381] close(4) = 0 [pid 656] <... write resumed>) = 6 [pid 656] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 656] write(5, "22", 2) = 2 [pid 656] write(4, "+pids ", 6 [ 153.970454][ T655] FAULT_INJECTION: forcing a failure. [ 153.970454][ T655] name failslab, interval 1, probability 0, space 0, times 0 [ 153.983155][ T655] CPU: 0 PID: 655 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 153.994767][ T655] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 154.004801][ T655] Call Trace: [ 154.008074][ T655] dump_stack_lvl+0x1e2/0x24b [ 154.012725][ T655] ? panic+0x7d7/0x7d7 [ 154.016775][ T655] ? bfq_pos_tree_add_move+0x43e/0x43e [ 154.022210][ T655] ? find_next_bit+0xd6/0x120 [ 154.027212][ T655] ? cpumask_next+0x11/0x30 [ 154.031689][ T655] dump_stack+0x15/0x17 [ 154.035819][ T655] should_fail+0x3c0/0x510 [ 154.040209][ T655] ? percpu_ref_init+0xd0/0x330 [ 154.045056][ T655] __should_failslab+0x9f/0xe0 [ 154.049798][ T655] should_failslab+0x9/0x20 [ 154.054282][ T655] kmem_cache_alloc_trace+0x3a/0x330 [ 154.059545][ T655] percpu_ref_init+0xd0/0x330 [ 154.064198][ T655] ? cgroup_setup_root+0xea0/0xea0 [ 154.069460][ T655] cgroup_apply_control_enable+0x3a2/0x12f0 [ 154.075332][ T655] cgroup_apply_control+0x93/0x710 [ 154.080418][ T655] ? css_next_child+0x160/0x160 [ 154.085243][ T655] ? io_schedule+0x120/0x120 [ 154.089809][ T655] ? kernfs_fop_write_iter+0x15e/0x410 [ 154.095243][ T655] ? __kasan_check_write+0x14/0x20 [ 154.100328][ T655] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 154.105588][ T655] cgroup_subtree_control_write+0xd19/0x1310 [ 154.111543][ T655] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 154.117496][ T655] ? __kasan_check_write+0x14/0x20 [ 154.122585][ T655] ? _copy_from_iter+0x3fb/0xd60 [ 154.127496][ T655] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 154.133451][ T655] cgroup_file_write+0x28e/0x590 [ 154.138363][ T655] ? cgroup_seqfile_stop+0xc0/0xc0 [ 154.143449][ T655] ? mutex_lock+0xa6/0x110 [ 154.147845][ T655] ? mutex_trylock+0xb0/0xb0 [ 154.152412][ T655] ? __kasan_check_write+0x14/0x20 [ 154.157500][ T655] kernfs_fop_write_iter+0x2d0/0x410 [ 154.162758][ T655] ? cgroup_seqfile_stop+0xc0/0xc0 [ 154.167846][ T655] vfs_write+0xc1c/0xf40 [ 154.172065][ T655] ? __kasan_check_write+0x14/0x20 [ 154.177150][ T655] ? kernel_write+0x3c0/0x3c0 [ 154.181802][ T655] ? _raw_spin_unlock_irq+0x4e/0x70 [ 154.186972][ T655] ? ptrace_stop+0x6ff/0x9f0 [ 154.191538][ T655] ? __kasan_check_read+0x11/0x20 [ 154.196537][ T655] ? __fdget_pos+0x27e/0x310 [ 154.201103][ T655] ksys_write+0x198/0x2c0 [ 154.205414][ T655] ? do_notify_parent+0xa60/0xa60 [ 154.210416][ T655] ? __ia32_sys_read+0x90/0x90 [ 154.215151][ T655] ? __ia32_sys_open+0x270/0x270 [ 154.220065][ T655] __x64_sys_write+0x7b/0x90 [ 154.224634][ T655] do_syscall_64+0x34/0x70 [ 154.229027][ T655] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 154.234894][ T655] RIP: 0033:0x7fc8ece62c09 [ 154.239285][ T655] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 154.258864][ T655] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 381] rmdir("./46/file0") = 0 [pid 381] umount2("./46/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 381] lstat("./46/cgroup.cpu", [pid 655] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 381] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 381] unlink("./46/cgroup.cpu" [pid 655] close(3) = 0 [pid 381] <... unlink resumed>) = 0 [pid 655] close(4 [pid 381] getdents64(3, [pid 655] <... close resumed>) = 0 [pid 381] <... getdents64 resumed>0x555556fad630 /* 0 entries */, 32768) = 0 [pid 655] close(5 [pid 381] close(3 [pid 655] <... close resumed>) = 0 [pid 655] close(6 [pid 381] <... close resumed>) = 0 [pid 655] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 381] rmdir("./46") = 0 [pid 655] close(7) = -1 EBADF (Bad file descriptor) [pid 381] mkdir("./47", 0777) = 0 [pid 655] close(8) = -1 EBADF (Bad file descriptor) [pid 381] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 657 attached [pid 655] close(9 [pid 657] chdir("./47" [pid 381] <... clone resumed>, child_tidptr=0x555556fab5d0) = 49 [pid 655] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 657] <... chdir resumed>) = 0 [pid 657] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 655] close(10 [pid 657] setpgid(0, 0) = 0 [pid 657] symlink("/syzcgroup/unified/syz3", "./cgroup" [pid 655] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 657] <... symlink resumed>) = 0 [pid 655] close(11 [pid 657] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 655] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 657] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 655] close(12 [pid 657] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 655] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 657] write(3, "1000", 4) = 4 [pid 657] close(3 [pid 655] close(13 [pid 657] <... close resumed>) = 0 [pid 657] symlink("/dev/binderfs", "./binderfs") = 0 [pid 655] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 657] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 655] close(14 [pid 657] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 655] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 657] open("./file0", O_RDONLY) = 3 [pid 655] close(15 [pid 657] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [pid 655] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 657] write(4, "-pids ", 6 [pid 655] close(16) = -1 EBADF (Bad file descriptor) [pid 655] close(17) = -1 EBADF (Bad file descriptor) [pid 655] close(18) = -1 EBADF (Bad file descriptor) [pid 655] close(19) = -1 EBADF (Bad file descriptor) [pid 655] close(20) = -1 EBADF (Bad file descriptor) [pid 655] close(21) = -1 EBADF (Bad file descriptor) [pid 655] close(22) = -1 EBADF (Bad file descriptor) [pid 655] close(23) = -1 EBADF (Bad file descriptor) [pid 655] close(24) = -1 EBADF (Bad file descriptor) [pid 655] close(25) = -1 EBADF (Bad file descriptor) [pid 655] close(26) = -1 EBADF (Bad file descriptor) [pid 655] close(27) = -1 EBADF (Bad file descriptor) [pid 655] close(28) = -1 EBADF (Bad file descriptor) [pid 655] close(29) = -1 EBADF (Bad file descriptor) [pid 655] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory ) = 89 [pid 655] exit_group(0) = ? [pid 655] +++ exited with 0 +++ [pid 382] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=50, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 382] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 382] umount2("./48", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] openat(AT_FDCWD, "./48", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 382] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 382] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 382] umount2("./48/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./48/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [ 154.267251][ T655] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 154.275220][ T655] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 154.283197][ T655] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 154.291149][ T655] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 154.299213][ T655] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000030 [pid 382] unlink("./48/binderfs") = 0 [pid 382] umount2("./48/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./48/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 382] unlink("./48/cgroup") = 0 [pid 382] umount2("./48/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./48/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 382] unlink("./48/cgroup.net") = 0 [ 154.330614][ T650] FAULT_INJECTION: forcing a failure. [ 154.330614][ T650] name failslab, interval 1, probability 0, space 0, times 0 [ 154.343815][ T650] CPU: 0 PID: 650 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 154.355440][ T650] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 154.365484][ T650] Call Trace: [ 154.368753][ T650] dump_stack_lvl+0x1e2/0x24b [ 154.373415][ T650] ? bfq_pos_tree_add_move+0x43e/0x43e [ 154.378851][ T650] ? selinux_kernfs_init_security+0x1a8/0x760 [ 154.384900][ T650] dump_stack+0x15/0x17 [ 154.389042][ T650] should_fail+0x3c0/0x510 [ 154.393432][ T650] ? __kernfs_new_node+0x99/0x6e0 [ 154.398432][ T650] __should_failslab+0x9f/0xe0 [ 154.403167][ T650] should_failslab+0x9/0x20 [ 154.407645][ T650] __kmalloc_track_caller+0x5f/0x350 [ 154.412904][ T650] kstrdup_const+0x55/0x90 [ 154.417290][ T650] __kernfs_new_node+0x99/0x6e0 [ 154.422121][ T650] ? is_module_text_address+0xe1/0x140 [ 154.427562][ T650] ? kernfs_new_node+0x170/0x170 [ 154.432480][ T650] ? ptr_to_hashval+0x60/0x60 [ 154.437137][ T650] ? arch_stack_walk+0xf8/0x140 [ 154.441960][ T650] ? snprintf+0xd6/0x120 [ 154.446177][ T650] kernfs_new_node+0x97/0x170 [ 154.450823][ T650] __kernfs_create_file+0x4a/0x270 [ 154.455905][ T650] cgroup_addrm_files+0xab8/0xfe0 [ 154.460920][ T650] ? ____kasan_kmalloc+0xdc/0x110 [ 154.465931][ T650] ? __kasan_kmalloc+0x9/0x10 [ 154.470584][ T650] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 154.476120][ T650] ? trace_raw_output_cgroup_event+0x1f0/0x1f0 [ 154.482248][ T650] ? delete_node+0x759/0x7b0 [ 154.486817][ T650] ? __kasan_check_read+0x11/0x20 [ 154.491821][ T650] ? delete_node+0x759/0x7b0 [ 154.496383][ T650] ? __kasan_check_write+0x14/0x20 [ 154.501468][ T650] ? idr_replace+0x1c4/0x230 [ 154.507343][ T650] ? idr_get_next+0x4b0/0x4b0 [ 154.512005][ T650] ? _raw_spin_lock_bh+0xa3/0x1b0 [ 154.517008][ T650] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 154.522198][ T650] css_populate_dir+0x137/0x370 [ 154.527032][ T650] cgroup_apply_control_enable+0x8b9/0x12f0 [ 154.532899][ T650] cgroup_apply_control+0x93/0x710 [ 154.537982][ T650] ? css_next_child+0x160/0x160 [ 154.542808][ T650] ? stack_trace_save+0x12d/0x1f0 [ 154.547817][ T650] ? io_schedule+0x120/0x120 [ 154.552381][ T650] ? kernfs_fop_write_iter+0x15e/0x410 [ 154.557815][ T650] ? __kasan_check_write+0x14/0x20 [ 154.562903][ T650] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 154.568250][ T650] cgroup_subtree_control_write+0xd19/0x1310 [ 154.574200][ T650] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 154.580157][ T650] ? __kasan_check_write+0x14/0x20 [ 154.585249][ T650] ? _copy_from_iter+0x3fb/0xd60 [ 154.590173][ T650] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 154.596131][ T650] cgroup_file_write+0x28e/0x590 [ 154.601054][ T650] ? cgroup_seqfile_stop+0xc0/0xc0 [ 154.606159][ T650] ? mutex_lock+0xa6/0x110 [ 154.610561][ T650] ? mutex_trylock+0xb0/0xb0 [ 154.615131][ T650] ? __kasan_check_write+0x14/0x20 [ 154.620232][ T650] kernfs_fop_write_iter+0x2d0/0x410 [ 154.625504][ T650] ? cgroup_seqfile_stop+0xc0/0xc0 [ 154.630606][ T650] vfs_write+0xc1c/0xf40 [ 154.634832][ T650] ? __kasan_check_write+0x14/0x20 [ 154.639913][ T650] ? kernel_write+0x3c0/0x3c0 [ 154.644560][ T650] ? _raw_spin_unlock_irq+0x4e/0x70 [ 154.649733][ T650] ? ptrace_stop+0x6ff/0x9f0 [ 154.654300][ T650] ? __kasan_check_read+0x11/0x20 [ 154.659299][ T650] ? __fdget_pos+0x27e/0x310 [ 154.663863][ T650] ksys_write+0x198/0x2c0 [ 154.668166][ T650] ? do_notify_parent+0xa60/0xa60 [ 154.673172][ T650] ? __ia32_sys_read+0x90/0x90 [ 154.677915][ T650] ? __ia32_sys_open+0x270/0x270 [ 154.682823][ T650] __x64_sys_write+0x7b/0x90 [ 154.687392][ T650] do_syscall_64+0x34/0x70 [ 154.691780][ T650] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 154.697654][ T650] RIP: 0033:0x7fc8ece62c09 [ 154.702049][ T650] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 154.721629][ T650] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 382] umount2("./48/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 382] umount2("./48/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./48/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 382] umount2("./48/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] openat(AT_FDCWD, "./48/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 382] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 382] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 382] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 382] close(4) = 0 [pid 382] rmdir("./48/file0") = 0 [pid 382] umount2("./48/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 382] lstat("./48/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 382] unlink("./48/cgroup.cpu") = 0 [pid 382] getdents64(3, 0x555556fad630 /* 0 entries */, 32768) = 0 [pid 382] close(3) = 0 [pid 382] rmdir("./48" [pid 650] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 382] <... rmdir resumed>) = 0 [pid 650] close(3 [pid 382] mkdir("./49", 0777 [pid 650] <... close resumed>) = 0 [pid 382] <... mkdir resumed>) = 0 [pid 382] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 658 attached [pid 650] close(4 [pid 382] <... clone resumed>, child_tidptr=0x555556fab5d0) = 51 [pid 658] chdir("./49" [pid 650] <... close resumed>) = 0 [pid 658] <... chdir resumed>) = 0 [pid 650] close(5 [pid 658] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 650] <... close resumed>) = 0 [pid 658] setpgid(0, 0 [pid 650] close(6 [pid 658] <... setpgid resumed>) = 0 [pid 658] symlink("/syzcgroup/unified/syz5", "./cgroup" [pid 650] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 658] <... symlink resumed>) = 0 [pid 658] symlink("/syzcgroup/cpu/syz5", "./cgroup.cpu" [pid 650] close(7 [pid 658] <... symlink resumed>) = 0 [pid 658] symlink("/syzcgroup/net/syz5", "./cgroup.net" [pid 650] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 658] <... symlink resumed>) = 0 [pid 658] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 650] close(8 [pid 658] <... openat resumed>) = 3 [pid 650] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 658] write(3, "1000", 4) = 4 [pid 650] close(9 [pid 658] close(3) = 0 [pid 650] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 658] symlink("/dev/binderfs", "./binderfs" [pid 650] close(10 [pid 658] <... symlink resumed>) = 0 [pid 658] mkdirat(AT_FDCWD, "./file0", 000 [pid 650] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 658] <... mkdirat resumed>) = 0 [pid 658] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 650] close(11 [pid 658] <... mount resumed>) = 0 [pid 650] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 658] open("./file0", O_RDONLY) = 3 [pid 658] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [pid 658] write(4, "-pids ", 6 [pid 650] close(12) = -1 EBADF (Bad file descriptor) [pid 650] close(13) = -1 EBADF (Bad file descriptor) [pid 650] close(14) = -1 EBADF (Bad file descriptor) [pid 650] close(15) = -1 EBADF (Bad file descriptor) [pid 650] close(16) = -1 EBADF (Bad file descriptor) [pid 650] close(17) = -1 EBADF (Bad file descriptor) [ 154.730012][ T650] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 154.737954][ T650] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 154.745897][ T650] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 154.753845][ T650] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 154.761794][ T650] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 000000000000002b [ 154.770272][ T650] cgroup: cgroup_addrm_files: failed to add max, err=-12 [pid 650] close(18) = -1 EBADF (Bad file descriptor) [pid 650] close(19) = -1 EBADF (Bad file descriptor) write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory [pid 650] close(20) = -1 EBADF (Bad file descriptor) [pid 650] close(21) = -1 EBADF (Bad file descriptor) [pid 650] close(22) = -1 EBADF (Bad file descriptor) [pid 650] close(23) = -1 EBADF (Bad file descriptor) [pid 650] close(24) = -1 EBADF (Bad file descriptor) [pid 650] close(25) = -1 EBADF (Bad file descriptor) [pid 650] close(26) = -1 EBADF (Bad file descriptor) [pid 650] close(27) = -1 EBADF (Bad file descriptor) [pid 650] close(28) = -1 EBADF (Bad file descriptor) [pid 650] close(29) = -1 EBADF (Bad file descriptor) [pid 650] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 650] exit_group(0) = ? [pid 650] +++ exited with 0 +++ [pid 376] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=45, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 376] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 376] umount2("./43", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] openat(AT_FDCWD, "./43", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 376] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 376] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 376] umount2("./43/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./43/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 376] unlink("./43/binderfs") = 0 [ 154.800432][ T656] FAULT_INJECTION: forcing a failure. [ 154.800432][ T656] name failslab, interval 1, probability 0, space 0, times 0 [ 154.813496][ T656] CPU: 1 PID: 656 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 154.825114][ T656] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 154.835148][ T656] Call Trace: [ 154.838433][ T656] dump_stack_lvl+0x1e2/0x24b [ 154.843088][ T656] ? panic+0x7d7/0x7d7 [ 154.847130][ T656] ? bfq_pos_tree_add_move+0x43e/0x43e [ 154.852561][ T656] ? find_next_bit+0xd6/0x120 [ 154.857211][ T656] ? cpumask_next+0x11/0x30 [ 154.861690][ T656] dump_stack+0x15/0x17 [ 154.865827][ T656] should_fail+0x3c0/0x510 [ 154.870221][ T656] ? percpu_ref_init+0xd0/0x330 [ 154.875051][ T656] __should_failslab+0x9f/0xe0 [ 154.879785][ T656] should_failslab+0x9/0x20 [ 154.884270][ T656] kmem_cache_alloc_trace+0x3a/0x330 [ 154.889539][ T656] percpu_ref_init+0xd0/0x330 [ 154.894205][ T656] ? cgroup_setup_root+0xea0/0xea0 [ 154.899298][ T656] cgroup_apply_control_enable+0x3a2/0x12f0 [ 154.905170][ T656] cgroup_apply_control+0x93/0x710 [ 154.910263][ T656] ? css_next_child+0x160/0x160 [ 154.915089][ T656] ? stack_trace_save+0x12d/0x1f0 [ 154.920103][ T656] ? io_schedule+0x120/0x120 [ 154.924664][ T656] ? kernfs_fop_write_iter+0x15e/0x410 [ 154.930094][ T656] ? __kasan_check_write+0x14/0x20 [ 154.935182][ T656] ? cgroup_kn_lock_live+0x1b0/0x2f0 [ 154.940447][ T656] cgroup_subtree_control_write+0xd19/0x1310 [ 154.946411][ T656] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 154.952363][ T656] ? __kasan_check_write+0x14/0x20 [ 154.957447][ T656] ? _copy_from_iter+0x3fb/0xd60 [ 154.962363][ T656] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 154.968335][ T656] cgroup_file_write+0x28e/0x590 [ 154.973252][ T656] ? cgroup_seqfile_stop+0xc0/0xc0 [ 154.978334][ T656] ? mutex_lock+0xa6/0x110 [ 154.982720][ T656] ? mutex_trylock+0xb0/0xb0 [ 154.987280][ T656] ? __kasan_check_write+0x14/0x20 [ 154.992364][ T656] kernfs_fop_write_iter+0x2d0/0x410 [ 154.997627][ T656] ? cgroup_seqfile_stop+0xc0/0xc0 [ 155.002720][ T656] vfs_write+0xc1c/0xf40 [ 155.006934][ T656] ? __kasan_check_write+0x14/0x20 [ 155.012016][ T656] ? kernel_write+0x3c0/0x3c0 [ 155.016664][ T656] ? _raw_spin_unlock_irq+0x4e/0x70 [ 155.021837][ T656] ? ptrace_stop+0x6ff/0x9f0 [ 155.026403][ T656] ? __kasan_check_read+0x11/0x20 [ 155.031401][ T656] ? __fdget_pos+0x27e/0x310 [ 155.035961][ T656] ksys_write+0x198/0x2c0 [ 155.040265][ T656] ? do_notify_parent+0xa60/0xa60 [ 155.045261][ T656] ? __ia32_sys_read+0x90/0x90 [ 155.050005][ T656] ? __ia32_sys_open+0x270/0x270 [ 155.054925][ T656] __x64_sys_write+0x7b/0x90 [ 155.059490][ T656] do_syscall_64+0x34/0x70 [ 155.063884][ T656] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 155.069765][ T656] RIP: 0033:0x7fc8ece62c09 [ 155.074170][ T656] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 376] umount2("./43/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./43/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 376] unlink("./43/cgroup") = 0 [pid 376] umount2("./43/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./43/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 376] unlink("./43/cgroup.net") = 0 [pid 376] umount2("./43/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 656] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 376] <... umount2 resumed>) = 0 [pid 656] close(3 [pid 376] umount2("./43/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 656] <... close resumed>) = 0 [pid 376] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 656] close(4 [pid 376] lstat("./43/file0", [pid 656] <... close resumed>) = 0 [pid 376] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 656] close(5 [pid 376] umount2("./43/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 656] <... close resumed>) = 0 [pid 376] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 656] close(6 [pid 376] openat(AT_FDCWD, "./43/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 656] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 656] close(7) = -1 EBADF (Bad file descriptor) [pid 656] close(8) = -1 EBADF (Bad file descriptor) [pid 656] close(9) = -1 EBADF (Bad file descriptor) [pid 656] close(10) = -1 EBADF (Bad file descriptor) [pid 656] close(11) = -1 EBADF (Bad file descriptor) [pid 656] close(12) = -1 EBADF (Bad file descriptor) [pid 656] close(13) = -1 EBADF (Bad file descriptor) [pid 656] close(14) = -1 EBADF (Bad file descriptor) [pid 656] close(15) = -1 EBADF (Bad file descriptor) [pid 656] close(16) = -1 EBADF (Bad file descriptor) [pid 656] close(17) = -1 EBADF (Bad file descriptor) [pid 656] close(18) = -1 EBADF (Bad file descriptor) [pid 656] close(19) = -1 EBADF (Bad file descriptor) [pid 656] close(20) = -1 EBADF (Bad file descriptor) [pid 656] close(21) = -1 EBADF (Bad file descriptor) [pid 656] close(22) = -1 EBADF (Bad file descriptor) [pid 656] close(23) = -1 EBADF (Bad file descriptor) [pid 656] close(24) = -1 EBADF (Bad file descriptor) [pid 656] close(25) = -1 EBADF (Bad file descriptor) [pid 656] close(26) = -1 EBADF (Bad file descriptor) [pid 656] close(27) = -1 EBADF (Bad file descriptor) [pid 656] close(28) = -1 EBADF (Bad file descriptor) [pid 656] close(29) = -1 EBADF (Bad file descriptor) write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory [pid 656] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 656] exit_group(0) = ? [pid 656] +++ exited with 0 +++ [pid 376] <... openat resumed>) = 4 [pid 376] fstat(4, [pid 375] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=51, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 376] <... fstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 375] umount2("./49", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] openat(AT_FDCWD, "./49", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 376] getdents64(4, [pid 375] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 375] getdents64(3, [pid 376] <... getdents64 resumed>0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 375] <... getdents64 resumed>0x555556fad630 /* 7 entries */, 32768) = 208 [pid 376] getdents64(4, [pid 375] umount2("./49/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 376] <... getdents64 resumed>0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 375] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 375] lstat("./49/binderfs", [pid 376] close(4 [pid 375] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 375] unlink("./49/binderfs" [pid 376] <... close resumed>) = 0 [pid 375] <... unlink resumed>) = 0 [pid 376] rmdir("./43/file0" [pid 375] umount2("./49/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 375] lstat("./49/cgroup", [pid 376] <... rmdir resumed>) = 0 [pid 375] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 376] umount2("./43/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW [pid 375] unlink("./49/cgroup" [pid 376] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 375] <... unlink resumed>) = 0 [pid 375] umount2("./49/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] lstat("./43/cgroup.cpu", [pid 375] lstat("./49/cgroup.net", [pid 376] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 375] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 376] unlink("./43/cgroup.cpu" [pid 375] unlink("./49/cgroup.net") = 0 [pid 376] <... unlink resumed>) = 0 [pid 375] umount2("./49/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 376] getdents64(3, [pid 375] <... umount2 resumed>) = 0 [pid 375] umount2("./49/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 376] <... getdents64 resumed>0x555556fad630 /* 0 entries */, 32768) = 0 [pid 375] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 376] close(3 [pid 375] lstat("./49/file0", [pid 376] <... close resumed>) = 0 [pid 375] <... lstat resumed>{st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 376] rmdir("./43" [pid 375] umount2("./49/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 376] <... rmdir resumed>) = 0 [pid 375] openat(AT_FDCWD, "./49/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 376] mkdir("./44", 0777 [pid 375] <... openat resumed>) = 4 [pid 375] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 375] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 375] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 376] <... mkdir resumed>) = 0 [pid 375] close(4 [pid 376] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 375] <... close resumed>) = 0 [pid 375] rmdir("./49/file0") = 0 [pid 375] umount2("./49/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 659 attached ) = -1 EINVAL (Invalid argument) [pid 375] lstat("./49/cgroup.cpu", [pid 659] chdir("./44" [pid 375] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 376] <... clone resumed>, child_tidptr=0x555556fab5d0) = 46 [pid 659] <... chdir resumed>) = 0 [pid 375] unlink("./49/cgroup.cpu" [pid 659] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 375] <... unlink resumed>) = 0 [pid 659] <... prctl resumed>) = 0 [pid 375] getdents64(3, [pid 659] setpgid(0, 0 [pid 375] <... getdents64 resumed>0x555556fad630 /* 0 entries */, 32768) = 0 [pid 659] <... setpgid resumed>) = 0 [pid 375] close(3) = 0 [pid 375] rmdir("./49" [pid 659] symlink("/syzcgroup/unified/syz1", "./cgroup" [pid 375] <... rmdir resumed>) = 0 [pid 659] <... symlink resumed>) = 0 [pid 375] mkdir("./50", 0777 [pid 659] symlink("/syzcgroup/cpu/syz1", "./cgroup.cpu" [pid 375] <... mkdir resumed>) = 0 [pid 375] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 659] <... symlink resumed>) = 0 ./strace-static-x86_64: Process 660 attached [pid 659] symlink("/syzcgroup/net/syz1", "./cgroup.net" [pid 375] <... clone resumed>, child_tidptr=0x555556fab5d0) = 52 [pid 660] chdir("./50" [pid 659] <... symlink resumed>) = 0 [pid 660] <... chdir resumed>) = 0 [pid 659] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 660] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 659] <... openat resumed>) = 3 [pid 659] write(3, "1000", 4 [pid 660] setpgid(0, 0 [pid 659] <... write resumed>) = 4 [pid 660] <... setpgid resumed>) = 0 [pid 660] symlink("/syzcgroup/unified/syz0", "./cgroup" [pid 659] close(3 [pid 660] <... symlink resumed>) = 0 [pid 659] <... close resumed>) = 0 [pid 660] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 659] symlink("/dev/binderfs", "./binderfs" [pid 660] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 659] <... symlink resumed>) = 0 [pid 660] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 659] mkdirat(AT_FDCWD, "./file0", 000 [pid 660] write(3, "1000", 4) = 4 [pid 660] close(3) = 0 [pid 660] symlink("/dev/binderfs", "./binderfs") = 0 [pid 659] <... mkdirat resumed>) = 0 [pid 660] mkdirat(AT_FDCWD, "./file0", 000) = 0 [pid 659] mount(NULL, "./file0", "cgroup2", 0, NULL [pid 660] mount(NULL, "./file0", "cgroup2", 0, NULL) = 0 [pid 659] <... mount resumed>) = 0 [pid 660] open("./file0", O_RDONLY [pid 659] open("./file0", O_RDONLY [pid 660] <... open resumed>) = 3 [pid 660] openat(3, "cgroup.subtree_control", O_RDWR [pid 659] <... open resumed>) = 3 [pid 660] <... openat resumed>) = 4 [pid 660] write(4, "-pids ", 6 [pid 659] openat(3, "cgroup.subtree_control", O_RDWR) = 4 [pid 659] write(4, "-pids ", 6 [pid 660] <... write resumed>) = 6 [pid 653] <... write resumed>) = 6 [pid 660] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 660] write(5, "22", 2) = 2 [ 155.093748][ T656] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 155.102136][ T656] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 155.110085][ T656] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 155.118036][ T656] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 155.125992][ T656] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 155.133948][ T656] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000031 [pid 660] write(4, "+pids ", 6 [pid 653] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 653] write(5, "22", 2) = 2 [ 155.161503][ T651] FAULT_INJECTION: forcing a failure. [ 155.161503][ T651] name failslab, interval 1, probability 0, space 0, times 0 [ 155.174275][ T651] CPU: 1 PID: 651 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 155.185891][ T651] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 155.195928][ T651] Call Trace: [ 155.199195][ T651] dump_stack_lvl+0x1e2/0x24b [ 155.203852][ T651] ? panic+0x7d7/0x7d7 [ 155.207912][ T651] ? bfq_pos_tree_add_move+0x43e/0x43e [ 155.213345][ T651] ? find_next_bit+0xd6/0x120 [ 155.218001][ T651] ? cpumask_next+0x11/0x30 [ 155.222497][ T651] dump_stack+0x15/0x17 [ 155.226633][ T651] should_fail+0x3c0/0x510 [ 155.231018][ T651] ? percpu_ref_init+0xd0/0x330 [ 155.235850][ T651] __should_failslab+0x9f/0xe0 [ 155.240601][ T651] should_failslab+0x9/0x20 [ 155.245085][ T651] kmem_cache_alloc_trace+0x3a/0x330 [ 155.250352][ T651] percpu_ref_init+0xd0/0x330 [ 155.255004][ T651] ? cgroup_setup_root+0xea0/0xea0 [ 155.260099][ T651] cgroup_apply_control_enable+0x3a2/0x12f0 [ 155.265971][ T651] cgroup_apply_control+0x93/0x710 [ 155.271055][ T651] ? __irq_exit_rcu+0x41/0x150 [ 155.275789][ T651] ? css_next_child+0x160/0x160 [ 155.280615][ T651] ? common_interrupt+0x156/0x1e0 [ 155.285618][ T651] ? asm_common_interrupt+0x1e/0x40 [ 155.290788][ T651] ? cgroup_subtree_control_write+0xb3f/0x1310 [ 155.296927][ T651] cgroup_subtree_control_write+0xd19/0x1310 [ 155.302893][ T651] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 155.308846][ T651] ? __kasan_check_write+0x14/0x20 [ 155.313932][ T651] ? _copy_from_iter+0x3fb/0xd60 [ 155.318849][ T651] ? cgroup_subtree_control_show+0x1d0/0x1d0 [ 155.324810][ T651] cgroup_file_write+0x28e/0x590 [ 155.329728][ T651] ? cgroup_seqfile_stop+0xc0/0xc0 [ 155.334829][ T651] ? mutex_lock+0xa6/0x110 [ 155.339227][ T651] ? mutex_trylock+0xb0/0xb0 [ 155.343811][ T651] ? __kasan_check_write+0x14/0x20 [ 155.348912][ T651] kernfs_fop_write_iter+0x2d0/0x410 [ 155.354180][ T651] ? cgroup_seqfile_stop+0xc0/0xc0 [ 155.359271][ T651] vfs_write+0xc1c/0xf40 [ 155.363488][ T651] ? __kasan_check_write+0x14/0x20 [ 155.368570][ T651] ? kernel_write+0x3c0/0x3c0 [ 155.373229][ T651] ? _raw_spin_unlock_irq+0x4e/0x70 [ 155.378417][ T651] ? ptrace_stop+0x6ff/0x9f0 [ 155.382990][ T651] ? __kasan_check_read+0x11/0x20 [ 155.387992][ T651] ? __fdget_pos+0x27e/0x310 [ 155.392565][ T651] ksys_write+0x198/0x2c0 [ 155.396872][ T651] ? do_notify_parent+0xa60/0xa60 [ 155.401870][ T651] ? __ia32_sys_read+0x90/0x90 [ 155.406614][ T651] ? __ia32_sys_open+0x270/0x270 [ 155.411531][ T651] __x64_sys_write+0x7b/0x90 [ 155.416091][ T651] do_syscall_64+0x34/0x70 [ 155.420499][ T651] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 155.426378][ T651] RIP: 0033:0x7fc8ece62c09 [ 155.430779][ T651] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 155.450377][ T651] RSP: 002b:00007ffd7d0e3448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 653] write(4, "+pids ", 6 [pid 651] <... write resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 651] close(3) = 0 [pid 651] close(4) = 0 [pid 651] close(5) = 0 [pid 651] close(6) = -1 EBADF (Bad file descriptor) [pid 651] close(7) = -1 EBADF (Bad file descriptor) [pid 651] close(8) = -1 EBADF (Bad file descriptor) [pid 651] close(9) = -1 EBADF (Bad file descriptor) [pid 651] close(10) = -1 EBADF (Bad file descriptor) [pid 651] close(11) = -1 EBADF (Bad file descriptor) [pid 651] close(12) = -1 EBADF (Bad file descriptor) [pid 651] close(13) = -1 EBADF (Bad file descriptor) [pid 651] close(14) = -1 EBADF (Bad file descriptor) [pid 651] close(15) = -1 EBADF (Bad file descriptor) [pid 651] close(16) = -1 EBADF (Bad file descriptor) [pid 651] close(17) = -1 EBADF (Bad file descriptor) [pid 651] close(18) = -1 EBADF (Bad file descriptor) [pid 651] close(19) = -1 EBADF (Bad file descriptor) [pid 651] close(20) = -1 EBADF (Bad file descriptor) [pid 651] close(21) = -1 EBADF (Bad file descriptor) [pid 651] close(22) = -1 EBADF (Bad file descriptor) [pid 651] close(23) = -1 EBADF (Bad file descriptor) [pid 651] close(24) = -1 EBADF (Bad file descriptor) [pid 651] close(25) = -1 EBADF (Bad file descriptor) [pid 651] close(26) = -1 EBADF (Bad file descriptor) [pid 651] close(27) = -1 EBADF (Bad file descriptor) [pid 651] close(28) = -1 EBADF (Bad file descriptor) [pid 651] close(29) = -1 EBADF (Bad file descriptor) write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory [pid 651] write(1, "write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory\n", 89) = 89 [pid 651] exit_group(0) = ? [pid 651] +++ exited with 0 +++ [pid 380] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=43, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 380] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 380] umount2("./41", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] openat(AT_FDCWD, "./41", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 380] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 380] getdents64(3, 0x555556fad630 /* 7 entries */, 32768) = 208 [pid 380] umount2("./41/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./41/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 380] unlink("./41/binderfs") = 0 [pid 380] umount2("./41/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./41/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 380] unlink("./41/cgroup") = 0 [pid 380] umount2("./41/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./41/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 380] unlink("./41/cgroup.net") = 0 [ 155.458782][ T651] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc8ece62c09 [ 155.466731][ T651] RDX: 0000000000000006 RSI: 00000000200000c0 RDI: 0000000000000004 [ 155.474676][ T651] RBP: 00007ffd7d0e3470 R08: 0000000000000002 R09: 00007ffd7d0e3480 [ 155.482624][ T651] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 155.490576][ T651] R13: 00007ffd7d0e3490 R14: 00007ffd7d0e34d0 R15: 0000000000000029 [ 155.508148][ T380] ------------[ cut here ]------------ [ 155.513653][ T380] WARNING: CPU: 0 PID: 380 at fs/namespace.c:1168 mntput_no_expire+0x48a/0x6c0 [ 155.522584][ T380] Modules linked in: [ 155.526481][ T380] CPU: 0 PID: 380 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 155.538103][ T380] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 155.548174][ T380] RIP: 0010:mntput_no_expire+0x48a/0x6c0 [ 155.553805][ T380] Code: 48 c7 c2 80 02 44 86 e8 64 f0 8e ff e9 8b fc ff ff e8 ba 21 b6 ff e9 81 fc ff ff e8 b0 21 b6 ff e9 77 fc ff ff e8 a6 21 b6 ff <0f> 0b e9 f4 fc ff ff e8 9a 21 b6 ff e8 65 ad a2 ff e9 ea fc ff ff [ 155.573416][ T380] RSP: 0018:ffffc90000b27ba0 EFLAGS: 00010293 [ 155.579458][ T380] RAX: ffffffff81b68f1a RBX: 00000000ffffffff RCX: ffff8881065ebb40 [ 155.587435][ T380] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000 [ 155.595420][ T380] RBP: ffffc90000b27c70 R08: ffffffff81b68c08 R09: 0000000000000003 [ 155.603394][ T380] R10: fffff52000164f65 R11: 1ffff92000164f64 R12: dffffc0000000000 [ 155.611363][ T380] R13: ffff88811d68ae00 R14: ffffc90000b27c00 R15: 1ffff92000164f7c [ 155.619322][ T380] FS: 0000555556fab300(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 155.628256][ T380] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 155.634838][ T380] CR2: 00007ffd7d0e1c18 CR3: 000000011ddaf000 CR4: 00000000003506b0 [ 155.642813][ T380] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 155.650796][ T380] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 155.658745][ T380] Call Trace: [ 155.662046][ T380] ? io_schedule+0x120/0x120 [ 155.666629][ T380] ? vfs_submount+0xb0/0xb0 [ 155.671133][ T380] ? shrink_dentry_list+0x4ec/0x500 [ 155.676320][ T380] ? __kasan_check_write+0x14/0x20 [ 155.681431][ T380] namespace_unlock+0x448/0x4f0 [ 155.686272][ T380] ? umount_tree+0xf50/0xf50 [ 155.690860][ T380] ? __detach_mounts+0x670/0x670 [ 155.695778][ T380] ? selinux_umount+0xf0/0x130 [ 155.700535][ T380] ? security_sb_umount+0x9d/0xb0 [ 155.705571][ T380] path_umount+0xf03/0xfb0 [ 155.709963][ T380] ? namespace_unlock+0x4f0/0x4f0 [ 155.715004][ T380] ? user_path_at_empty+0x40/0x50 [ 155.720011][ T380] __x64_sys_umount+0x122/0x170 [ 155.724857][ T380] ? path_umount+0xfb0/0xfb0 [ 155.729440][ T380] ? syscall_enter_from_user_mode+0x58/0x1b0 [ 155.735425][ T380] do_syscall_64+0x34/0x70 [ 155.739831][ T380] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 155.745718][ T380] RIP: 0033:0x7fc8ece63fb7 [ 155.750113][ T380] Code: 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 155.769711][ T380] RSP: 002b:00007ffd7d0e2358 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [ 155.778138][ T380] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc8ece63fb7 [ 155.786111][ T380] RDX: 00007ffd7d0e241a RSI: 000000000000000a RDI: 00007ffd7d0e2410 [ 155.794099][ T380] RBP: 00007ffd7d0e2410 R08: 00000000ffffffff R09: 00007ffd7d0e21f0 [ 155.802076][ T380] R10: 0000555556fad6a3 R11: 0000000000000202 R12: 00007ffd7d0e3490 [ 155.810039][ T380] R13: 0000555556fad600 R14: 00007ffd7d0e2380 R15: 000000000000002a [ 155.818016][ T380] ---[ end trace d4de1ca9cdcd1997 ]--- [ 155.823506][ T380] ------------[ cut here ]------------ [ 155.828957][ T380] WARNING: CPU: 0 PID: 380 at fs/namespace.c:1168 mntput_no_expire+0x48a/0x6c0 [ 155.837912][ T380] Modules linked in: [ 155.841851][ T380] CPU: 0 PID: 380 Comm: syz-executor971 Tainted: G W 5.10.112-syzkaller-00287-gde64d941a71a #0 [ 155.853528][ T380] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 155.863631][ T380] RIP: 0010:mntput_no_expire+0x48a/0x6c0 [ 155.869236][ T380] Code: 48 c7 c2 80 02 44 86 e8 64 f0 8e ff e9 8b fc ff ff e8 ba 21 b6 ff e9 81 fc ff ff e8 b0 21 b6 ff e9 77 fc ff ff e8 a6 21 b6 ff <0f> 0b e9 f4 fc ff ff e8 9a 21 b6 ff e8 65 ad a2 ff e9 ea fc ff ff [ 155.888860][ T380] RSP: 0018:ffffc90000b27ca0 EFLAGS: 00010293 [ 155.894949][ T380] RAX: ffffffff81b68f1a RBX: 00000000fffffffe RCX: ffff8881065ebb40 [ 155.902927][ T380] RDX: 0000000000000000 RSI: 00000000fffffffe RDI: 0000000000000000 [ 155.910891][ T380] RBP: ffffc90000b27d70 R08: ffffffff81b68c08 R09: 0000000000000003 [ 155.918844][ T380] R10: fffff52000164f85 R11: 1ffff92000164f84 R12: dffffc0000000000 [ 155.926821][ T380] R13: ffff88811d68ae00 R14: ffffc90000b27d00 R15: 1ffff92000164f9c [ 155.934796][ T380] FS: 0000555556fab300(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 155.943719][ T380] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 155.950316][ T380] CR2: 00007ffd7d0e1c18 CR3: 000000011ddaf000 CR4: 00000000003506b0 [ 155.958266][ T380] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 155.966241][ T380] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 155.974211][ T380] Call Trace: [ 155.977476][ T380] ? lockref_get_or_lock+0x340/0x340 [ 155.982763][ T380] ? umount_tree+0xf50/0xf50 [ 155.987359][ T380] ? vfs_submount+0xb0/0xb0 [ 155.991878][ T380] ? dput+0x2b6/0x320 [ 155.995853][ T380] path_umount+0x1fe/0xfb0 [ 156.000287][ T380] ? namespace_unlock+0x4f0/0x4f0 [ 156.005300][ T380] ? user_path_at_empty+0x40/0x50 [ 156.010336][ T380] __x64_sys_umount+0x122/0x170 [ 156.015168][ T380] ? path_umount+0xfb0/0xfb0 [ 156.019737][ T380] ? syscall_enter_from_user_mode+0x58/0x1b0 [ 156.025750][ T380] do_syscall_64+0x34/0x70 [ 156.030167][ T380] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 156.036064][ T380] RIP: 0033:0x7fc8ece63fb7 [ 156.040502][ T380] Code: 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [pid 380] umount2("./41/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 380] umount2("./41/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] lstat("./41/file0", {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [pid 380] umount2("./41/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 380] openat(AT_FDCWD, "./41/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 380] fstat(4, {st_mode=S_IFDIR|000, st_size=4096, ...}) = 0 [ 156.060098][ T380] RSP: 002b:00007ffd7d0e2358 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [ 156.068505][ T380] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc8ece63fb7 [ 156.076495][ T380] RDX: 00007ffd7d0e241a RSI: 000000000000000a RDI: 00007ffd7d0e2410 [ 156.084472][ T380] RBP: 00007ffd7d0e2410 R08: 00000000ffffffff R09: 00007ffd7d0e21f0 [ 156.092442][ T380] R10: 0000555556fad6a3 R11: 0000000000000202 R12: 00007ffd7d0e3490 [ 156.100417][ T380] R13: 0000555556fad600 R14: 00007ffd7d0e2380 R15: 000000000000002a [ 156.108385][ T380] ---[ end trace d4de1ca9cdcd1998 ]--- [pid 380] getdents64(4, 0x555556fb5670 /* 2 entries */, 32768) = 48 [pid 380] getdents64(4, 0x555556fb5670 /* 0 entries */, 32768) = 0 [pid 380] close(4) = 0 [pid 380] rmdir("./41/file0") = 0 [pid 380] umount2